1 Manual for Using Homomorphic Encryption for Bioinformatics Nathan Dowlin, Ran Gilad-Bachrach, Kim Laine, Kristin Lauter, Michael Naehrig, John Wernsing
Abstract—Biological Data Science is an emerging field for decrypting it or requiring access to the decryption facing multiple challenges for hosting, sharing, computing key. on, and interacting with large data sets. Privacy regulations This paper details a state-of-the-art homomorphic en- and concerns about the risks of leaking sensitive personal cryption solution and is meant to serve as a guide to health and genomic data add another layer of complexity using it for bioinformatics and genomic computations. to the problem. Recent advances in cryptography over the last 5 years have yielded a tool, homomorphic encryption, The Microsoft Research Simple Encrypted Arithmetic which can be used to encrypt data in such a way that Library (SEAL) has been publicly released and can be 1 storage can be outsourced to an untrusted cloud, and the downloaded for experimentation and research purposes . data can be computed on in a meaningful way in encrypted Homomorphic encryption is a technique to encrypt form, without access to decryption keys. This paper in- data in such a way that it can be computed on by anyone, troduces homomorphic encryption to the bioinformatics without access to the encryption or decryption keys, and community, and presents an informal “manual” for using the result of the computation is obtained in encrypted the Simple Encrypted Arithmetic Library (SEAL), which we form. Solutions for homomorphic encryption which al- have made publicly available for bioinformatic, genomic, and other research purposes. low one operation, such as addition, have been known for decades, for example based on the RSA or Elgamal Keywords: homomorphic encryption, outsourced compu- cryptosystems. But a homomorphic encryption solution tation, privacy, genome-wide association studies, sequence which allows an unlimited number of two operations, i.e. matching addition and multiplication, enables the computation of any circuit, and thus such a solution is referred to as fully homomorphic (FHE). The first FHE solution was pro- I.INTRODUCTION posed in [14], and many improvements and extensions A wealth of personal genomic data is becoming have followed over the last 5 years: [9], [6], [15], [30], available thanks to scientific advances in sequencing the [1]. For practical applications, an important idea intro- human genome and gene assembly techniques. Hospitals, duced in [25] is to use homomorphic encryption schemes research institutes, clinics, and companies handling hu- which only allow for a fixed amount of computation man genomic material and other sensitive health data are on the data. It is usually the case that the computation all faced with the common problem of securely storing, (the function or the algorithm) which will be applied to and interacting, with large amounts of data. Commercial the data is known in advance, so that a homomorphic clouds offer solutions but are subject to subpoenas, data encryption scheme may be instantiated to allow only for misuse or theft, and possible insider attacks. To mitigate that amount of computation on the data. This insight the privacy risks inherent in storing and computing on leads to improved parameters, and thus better efficiency sensitive data, cryptography offers a potential solution in for both storage and computation. A scheme for which the form of encryption, which metaphorically locks the it is possible, for any fixed given function, to choose data in a “box” which requires a key to open. Traditional parameters such that the scheme allows homomorphic encryption systems lock data down in a way which evaluation of that function, is called a leveled homomor- makes it impossible to use, or compute on, in encrypted phic encryption scheme. Using a leveled homomorphic form. Recent advances in cryptography have yielded new scheme, where parameters are set to allow a certain tools that allow operations on encrypted data. One such predetermined, fixed amount of computation, together tool is homomorphic encryption. Encrypting data using a with application-specific data encodings and algorithmic homomorphic encryption scheme allows for meaningful optimizations, leads to a significant efficiency gain. We computation on the encrypted data producing the results of the computation in encrypted form, without the need 1The SEAL library is available at http://sealcrypto.codeplex.com/ 2 refer to such a combination as Practical Homomorphic scheme was presented by Gentry [14] in 2009, and since Encryption (PHE). its discovery many improvements and new constructions While it was considered a major breakthrough to have been proposed [33], [9], [8], [6], [12], [22], [4], [1], develop solutions for homomorphic encryption, serious [16], [10]. challenges remain to convert these proposals into practi- In Gentry’s work, and in many later papers, data cal systems which can overcome the performance hurdles is encrypted bit-wise. This means that a separate ci- and storage requirements. Significant improvements have phertext is produced for each bit in the message. The been made by encoding data for computation in clever computation is described as a boolean circuit with XOR ways to reduce both the size of ciphertexts and the and AND gates, which can be realized as addition and depth of circuits to be evaluated. In Section III we multiplication modulo 2. Both operations can then be present new methods for encoding real data which lead to performed on the encrypted bits. Unfortunately, breaking concrete improvements in both performance and storage down a computation into bit operations can quickly lead requirements. to a large and complex circuit, which together with a When using PHE, parameters of the encoding an significant overhead in memory use per bit imposed by encryption schemes should be chosen to optimize for the encryption scheme this makes homomorphic compu- efficiency, while preserving security and correctness. To tations very costly. make this feasible in practice, we have implemented Fortunately, most known constructions allow for a tools (most importantly a noise growth simulator and larger message space. In practical applications the de- an automatic parameter selection module) to help users sired computations often only consist of additions and choose their parameters for maximal performance. Sec- multiplications of integers or real numbers, so there is tion IV details these techniques, and demonstrates their no need to express the data in a bit-wise manner. Indeed, use in practice. most known constructions allow to encrypt integers, or Homomorphic encryption provides a suitable solution appropriate encodings of integers, and to homomorphi- for some, but not all, privacy problems and scenarios. cally add and multiply these values. This approach has Current solutions allow for a single data owner, such the clear advantage that a ciphertext now contains much as a hospital, to encrypt data so that it can be securely more information than just a single bit of data, making stored in a commercial cloud. Both private and public the homomorphic computations significantly more effi- key solutions are practical, and with the public key cient. version many parties can upload data encrypted under the In the known FHE schemes, typically ciphertexts con- hospital’s public key: doctors, patients, lab technicians, tain a certain amount of inherent noise, which “pollutes” etc., and the hospital administration can set a policy for them. This noise grows during homomorphic operations, access to computations and decryptions. The same idea and if it becomes too large the ciphertext cannot be can be applied to a research institute which stores data in decrypted even with the correct decryption key. In order the cloud, selectively allows researchers to make queries to perform an unlimited number of operations, and thus on the encrypted data, and then provides decryptions achieve fully homomorphic encryption, ciphertexts need of the results. Consumer and patient scenarios enabled to be constantly refreshed in order to reduce their noise. by homomorphic encryption include secure and private This is done using a costly procedure called bootstrap- outsourcing of storage of personal health records, or of ping [14]. predictive services for risk of disease. However, in applications where only a predetermined This article is intended to serve as a guide to help computation needs to be done, the costly bootstrapping bioinformaticians use the library, to experiment with procedure can be avoided by using a so-called leveled secure computation on biomedical data, and to evaluate homomorphic encryption scheme. As a guiding princi- the security implications. ple, the choice of the parameters dictates how many sequential multiplications the computation can involve, II.HOMOMORPHIC ENCRYPTION i.e. the maximum allowed depth of the computation An encryption scheme that enables arbitrary computa- expressed as an arithmetic circuit, although in reality tions on encrypted data without first decrypting the data, also other features of the computation need to be taken and without any access to the secret decryption key, is into account. This approach is often significantly more called a Fully Homomorphic Encryption (FHE) scheme. practical than using an FHE scheme with bootstrapping, The result of any such computation on encrypted data but is not as flexible if at a later point a different, more is itself provided in encrypted form, and can only be complex function needs to be evaluated. decrypted by an owner of the secret key. The first FHE The remainder of this section describes the leveled 3
homomorphic encryption scheme that is implemented in call log2 w the decomposition bit count. In SEAL, our Simple Encrypted Arithmetic Library (SEAL). log2 w is called decomposition_bit_count. • The distribution χkey is a probability distribution on A. Homomorphic encryption scheme algorithms polynomials of degree at most n − 1 with integer The encryption scheme we use is a public-key, homo- coefficients, which is used to sample polynomials morphic encryption scheme, and consists of the follow- with small coefficients that are used in the key ing algorithms: generation procedure. In SEAL, coefficients are sampled uniformly from {−1, 0, 1}. • A key generation algorithm KeyGen(parms) that, • Similarly, the distribution χ on polynomials of on input the system parameters parms, generates a err degree at most n − 1 is used to sample noise public/private key pair (pk, sk) and a public evalu- polynomials, which are needed during both key ation key evk, which is used during homomorphic generation and encryption. In SEAL, the distribu- multiplication. tion χerr is a truncated discrete Gaussian centered • An encryption algorithm Enc(pk, m), that encrypts at zero, with standard deviation σ. In SEAL, σ is a plaintext m using the public key pk. called noise_standard_deviation. • A decryption algorithm Dec(sk, c), that decrypts a The remainder of this subsection goes into further ciphertext c with the private key sk. detail, introduces the necessary mathematical structures, • A homomorphic addition operation Add(c , c ) that, 1 2 and explains how the different parameters are related given as input encryptions c and c of m and m , 1 2 1 2 to each other. The scheme operates in the ring R := outputs a ciphertext encrypting the sum m + m . 1 2 [X]/(Xn + 1), the elements of which are polynomials • A homomorphic multiplication operation Z with integer coefficients of degree less than n, where n Mult(c , c ) that, given encryptions c and c 1 2 1 2 is a power of 2. Any element a ∈ R can be written as of m and m , outputs a ciphertext encrypting the 1 2 a = Pn−1 a Xi, with a ∈ . All plaintexts, ciphertexts, product m · m . i=0 i i Z 1 2 encryption and decryption keys, etc. are elements of the ring R, and have this form. Addition in R is done B. Encryption parameters coefficient-wise, and multiplication is simply polynomial The specific instantiation that is implemented in SEAL multiplication modulo Xn + 1, i.e. standard polynomial is the more practical variant of the scheme YASHE, multiplication followed by reduction modulo Xn+1. The proposed in the paper [1]. The encryption parameters reduction modulo Xn + 1 is carried out by replacing all of the scheme are the degree n, the moduli q and t, the occurrences of Xn by −1. decomposition word size w, and distributions χkey, χerr. The scheme uses two integer moduli q and t, for which Thus, parms := (n, q, t, w, χkey, χerr). Next we discuss q is much larger than t. The coefficients of ciphertext these parameters in more detail. and key elements are taken modulo q, whereas the • The parameter n is the maximum number of terms coefficients of the plaintext elements are taken modulo t. in the polynomials used to represent both plaintext In what follows, we use the notation [a]q (resp. [a]t) to and ciphertext elements. In SEAL, n is always a denote the operation of reducing the coefficients of a ∈ n power of 2. The polynomial X + 1 is called the R modulo q (resp. t) into the set {d−q/2e,..., b(q−1)/2c} polynomial modulus, and denoted poly_modulus (resp. {d−t/2e,..., b(t−1)/2c}). in SEAL. The homomorphic multiplication operation, defined • The parameter q is the coefficient modulus. It is below, contains a step which decomposes a given poly- an integer modulus used to reduce the coefficients nomial into a vector of polynomials with smaller coeffi- of ciphertext polynomials. In SEAL, q is called cients. This step is needed to manage the noise growth coeff_modulus. during the homomorphic multiplication by computing a • The parameter t is the plaintext modulus. It is product of two intermediate polynomials via a scalar an integer modulus used to reduce the coefficients product. The size of the smaller coefficients is deter- of plaintext polynomials. In SEAL, t is called mined by the parameter w, which thus controls a trade- plain_modulus. off between multiplication efficiency and evaluation key • The integer w is the base to which we decompose size on one hand, and noise growth on the other. We integer coefficients into smaller parts. It determines now present the details for this decomposition. the number `w,q := blogw(q)c + 1 of parts when A polynomial a ∈ R with coefficients in decomposing an integer modulo q to the base w. {d−q/2e,..., b(q−1)/2c} can be decomposed using a base P`w,q −1 i In practice, we take w be a power of two, and w ∈ Z as a = i=0 aiw , where the ai ∈ R 4 have coefficients in {d−w/2e,..., b(w−1)/2c}. This is For homomorphic addition this means that the resulting done by decomposing each coefficient to the base w. ciphertext will encrypt the coefficient-wise sum m1+m2, The homomorphic encryption scheme makes use of two where the coefficients are automatically reduced modulo `w,q −1 functions. The first one is Decw,q(a) := ([ai]w)i=0 , the plaintext modulus t. For homomorphic multiplica- which takes a polynomial with coefficients modulo q, tion the resulting ciphertext will encrypt the product and returns the vector of polynomial parts obtained by m1 · m2 ∈ Rt, which means that the polynomial will the w-adic decomposition described above. The second automatically be reduced modulo Xn +1, i.e. all powers i `w,q −1 n one is Poww,q(a) := ([aw ]q)i=0 , which takes a X will be automatically replaced by −1, until no polynomial and returns a vector of polynomials that monomials of degree n or higher remain, and just as are the products of the polynomial with powers of the in homomorphic addition, the coefficients of the poly- base w. Both functions take a polynomial and map it to nomial m1 · m2 will be automatically reduced modulo t. a vector of polynomials in R`w,q , such that the following These properties need to be taken into account when property holds encrypting data such as integers or real numbers that first need to be encoded as plaintext polynomials. One hDecw,q(a), Poww,q(b)i = a · b (mod q) , needs to be aware of the fact that the various reductions where h·, ·i denotes the dot product of vectors (of poly- that occur on plaintext polynomials during homomorphic nomials), defined in the usual way. operations do not necessarily correspond to meaningful Finally, the scheme uses two probability distributions operations on the integral or real data. on R, χkey and χerr, which both generate polynomials in R with small coefficients. In our implementation, we D. Detailed algorithm description chose the distribution χ as the uniform distribution on key The following gives a detailed description of the key polynomials with coefficients in {−1, 0, 1}. Sampling an generation, encryption, decryption, and homomorphic element according to this distribution means sampling evaluation algorithms. all its coefficients uniformly from {−1, 0, 1}. For the • KeyGen(parms): On input the encryption parame- distribution χerr, we use a discrete Gaussian distribu- ters parms := (n, q, t, χ , χ ), the key genera- tion with mean 0 and appropriately chosen standard key err tion algorithm samples polynomials f 0, g ← χ deviation σ. Gaussian samplers typically sample from a key from the key distribution, and sets f := [1 + tf 0] . truncated discrete Gaussian distribution, and we denote q If f is not invertible modulo q, it chooses a new f 0. the bound, i.e. the maximal deviation from the mean −1 Otherwise, it computes the inverse f of f in Rq. (zero), by Berr. A typical large enough choice for Berr Next, the algorithm samples vectors e, s ∈ R`w,q , would be around 5σ. for which each component is sampled according to the error distribution χerr, and computes the vector C. Plaintext space and homomorphic operations of polynomials γ := [Poww,q(f) + e + hs]q. It −1 All plaintext elements, i.e. the messages that can be computes h := [tgf ]q ∈ R, and outputs the key encrypted with the homomorphic encryption scheme, are pair polynomials in the ring R, with coefficients reduced (pk, sk) := (h, f) ∈ R × R, modulo the integer t. All ciphertext elements, i.e. en- and the evaluation key evk := γ. cryptions of plaintext elements, are polynomials in the • Enc(h, m): To encrypt a plaintext element m ∈ R , ring R, with coefficients reduced modulo the integer q. t the encryption algorithm samples small error poly- Formally, this means that the plaintext space is the ring ∼ n nomials s, e ← χerr, and outputs the ciphertext Rt := R/tR = Zt[X]/(X +1), and the ciphertext space ∼ n is contained in the ring Rq := R/qR = Zq[X]/(X +1). c := [bq/tcm + e + hs]q ∈ R. However, not every element of Rq is a valid ciphertext. Any ciphertext produced by the encryption function of • Dec(f, c): Given the private decryption key f, and a our scheme, as described below, encrypts one plaintext ciphertext c = Enc(h, m), the decryption algorithm m message polynomial m ∈ Rt. Whenever homomorphic recovers using addition (resp. multiplication) is performed on cipher- m = [bt/q · [fc]qe]t ∈ R. texts that encrypt two plaintext elements, say m1, m2 ∈ Rt, the resulting ciphertext will encrypt the sum m1+m2 • Add(c1, c2): Given two ciphertexts c1 and c2, the (resp. the product m1 · m2). The operations between algorithm Add outputs the ciphertext cadd := [c1 + the plaintext elements are performed in the ring Rt. c2]q. 5
• Mult(c1, c2, evk): Given two ciphertexts c1 and homomorphic multiplication algorithm then only com- c2, the algorithm Mult first computes c˜mult := putes the polynomial c˜mult. Thus, we can replace Mult [bt/q(c1 · c2)e]q. It then performs a so-called relin- by earization (or key switch) operation, by returning • Multnorelin(c1, c2): Given two ciphertexts c1 and c2, the algorithm returns cmult := [hDecw,q(˜cmult), evki]q .
c˜mult := [bt/q(c1 · c2)e]q ∈ R. E. Practical considerations The result of this operation does not give the correct As we already explained in the beginning of Section II, value when decrypted with the secret key sk, but instead every ciphertext, even a freshly encrypted one, has a needs to be decrypted with the square of the secret key, certain amount of inherent noise, or error, in it. The de- 2 [sk ]q ∈ R. Further multiplications of this kind increase cryption operation can be understood as an algorithm for the required power of the secret key. This means that removing this noise using some auxiliary information, the decryption algorithm needs to be called with the namely the secret key. One of the main difficulties in ho- corresponding power s of the secret key, and now looks momorphic cryptography is that in every homomorphic as follows: operation this inherent noise increases, until it reaches • Dec (f, s, c): Given the private decryption its maximum, at which point the message becomes so norelin key f, an exponent s, and a ciphertext c, the distorted that even the decryption algorithm can not decryption algorithm recovers m using recover it. To counter this problem, one needs to increase s the parameter q, but for security reasons this means that m = [bt/q · [f c]qe]t ∈ R. also n should be increased. Unfortunately, increasing n and q can significantly degrade performance. This approach has the advantage that it omits the by There are a number of ways to lower the noise growth far most costly part of the homomorphic evaluation during homomorphic operations, at least in certain sit- algorithms, and works without the evaluation key. Its uations, and thus to improve performance by allowing usefulness, however, depends on the specific choice of smaller parameters to be used. For example, the function the encryption parameters. For example, the larger the to be computed might involve publicly known values plaintext modulus t is, the fewer levels of multiplications that do not need to be encrypted before adding them can be computed like this, given all other parameters stay to, or multiplying them with an encrypted value. One fixed. One can experiment with different trade-offs, for simply needs to mimic the standard operations described example by manually reintroducing relinearization steps above, and include the public values as ciphertexts at certain points in the computation. obtained from an encryption procedure in which all noise terms are set to zero. This approach yields significantly F. Implementation smaller noise growth, allowing for the same number of We now demonstrate how the above concepts are homomorphic operations to be performed with smaller implemented in SEAL. Here we present mostly code parameters, and thus will indirectly lead to improved snippets, and for complete examples we refer the reader performance. to Section VI. Furthermore, when such public values are small, a SEAL is written in C++, but comes with a C# wrapper multiplication with them can be made much more ef- library SEALNET. All of our code examples use the ficient by using their representation according to the C++ library. The necessary C++ header files are included currently used encoding technique. The multiplication with #include "seal.h". SEAL contains a data can then be performed by a sequence of shifts (multi- type BigUInt for large unsigned integers, and a data plications by powers of X) and homomorphic additions, type BigPoly for large polynomials with BigUInt avoiding the multiplication routine altogether. Since typi- coefficients. All polynomials used in the encryption cally homomorphic additions are significantly less costly scheme are stored using instances of BigPoly, includ- than a homomorphic multiplication, this approach can ing plaintext and ciphertext polynomials, the secret key, increase the efficiency of a computation considerably. and the public key. For example, to create a (plaintext) Due to their importance, SEAL contains functionality polynomial p(X) = 3X4 + X + 2, we can write for performing addition and multiplication by a (public) BigPolyp("3xˆ4+1xˆ1+2"); plaintext polynomial. Another promising avenue is to omit the relineariza- To access the i-th coefficient as a BigUInt, we can use tion step (recall the description of Mult in II-D). The p[i]. To return the polynomial as a human-readable 6 string, we can use the member function to_string. EncryptionParameters using KeyGenerator as We have seen above that plaintext polynomials can follows: have either positive or negative numbers as coefficients, BigPoly Listing II.2. key_generator but in SEAL the coefficients of are always KeyGenerator generator(parms); instances of BigUInt, i.e. unsigned. For this reason we generator.generate(); BigPoly public_key= generator.public_key(); {d−t/2e,..., −1} store coefficients in the range instead BigPoly secret_key= generator.secret_key(); 10 as {b(t−1)/2c + 1, . . . , t − 1}. For example, if t = 2 EvaluationKeys evaluation_keys= generator. (0x400 in hexadecimal), the polynomial p(X) = X2 − evaluation_keys(); 3X − 1 could be created using The next set of tools we need are for encrypting, BigPolyp("1xˆ2+3FDxˆ1+3FF"); decrypting, and performing homomorphic operations:
To set up the cryptosystem, the first thing we must Listing II.3. encryption_tools do is choose the encryption parameters as described Encryptor encryptor(parms, public_key); Decryptor decryptor(parms, secret_key); in II-B. These are encapsulated in an instance of the class Evaluator evaluator(parms, evaluation_keys); EncryptionParameters. First, we set the three moduli that the encryption scheme uses: q (coefficient The following code constructs two plaintext polyno- modulus), t (plain modulus), and Xn + 1 (polynomial mials, X2 − 2X, and 3X3 + 1, and encrypts them: modulus). These three are the most important parame- BigPoly plain1("1xˆ2+3FExˆ1"); BigPoly plain2("3xˆ3+1"); ters, and choosing them correctly is crucial for achieving BigPoly enc1= encryptor.encrypt(plain1); optimal performance. Next we set w, or rather the BigPoly enc2= encryptor.encrypt(plain2); decomposition bit count log w, the standard deviation σ 2 We can use the Evaluator to operate on ciphertext of the distribution χ , and an upper bound for the output err polynomials: of the χerr sampler. For the purpose of the examples here, BigPoly enc_sum= evaluator.add(enc1, enc2); we use the following parameters: BigPoly enc_prod= evaluator.multiply(enc1, enc2); Listing II.1. encryption_parameters In addition to add and multiply, Evaluator EncryptionParameters parms; parms.poly_modulus() ="1xˆ2048+1"; supports a number of other operations. For example, parms.coeff_modulus() = ChooserEvaluator:: it is very efficient to add and multiply ciphertexts by default_parameter_options().at(2048); parms.plain_modulus() = 1 << 10; plaintext polynomials (recall II-E): parms.decomposition_bit_count() = 32; BigPolyp("1x+2"); // Public polynomial parms.noise_standard_deviation() = BigPoly enc1_sum= evaluator.add_plain(enc1,p); ChooserEvaluator:: BigPoly enc2_prod= evaluator.multiply_plain(enc2, default_noise_standard_deviation(); p); parms.noise_max_deviation() = ChooserEvaluator:: default_noise_max_deviation(); The above code produces encryptions of (x2 − 2x) + In the above, coeff_modulus and plain_modulus (x + 2) and (3x3 + 1) · (x + 2). are instances of BigUInt, poly_modulus is an in- Finally, we can decrypt using our instance of stance of BigPoly, decomposition_bit_count Decryptor: is an int, and the last two are double. In general, BigPoly sum= decryptor.decrypt(enc_sum); BigPoly prod= decryptor.decrypt(enc_prod); choosing appropriate and optimal encryption parameters BigPoly plain_sum= decryptor.decrypt(enc1_sum); is a surprisingly difficult task. For this reason SEAL BigPoly plain_prod= deryptor.decrypt(enc2_prod); provides an easy-to-use automatic parameter selection SEAL also supports multiplication without relineariza- module, which we discuss in more detail in Section IV. tion, and a stand-alone relinearization operation (re- A part of this can be seen in the above where call II-E). These are provided by the member func- coeff_modulus, noise_standard_devation tions multiply_norelin and relinearize of and noise_max_deviation are set to values Evaluator. hard-coded into the library that we consider secure. Next we need to generate the encryption keys. Specif- ically, there are three types of keys we need to set: III.ENCODING DATA the public key, the secret key, and the evaluation key As was described in II-B and II-C, plaintexts and (recall II-D). Of these, the public key and the se- ciphertexts are certain polynomials rather than integers cret key are instances of BigPoly, and the evalu- or real numbers. More precisely, plaintext elements are ation key is encapsulated in an EvaluationKeys polynomials in R, with coefficients reduced modulo t, object. The keys are generated based on an instance of and ciphertexts are polynomials in R, with coefficients 7 reduced modulo q. However, most algorithms in ge- t to be enormous, and (2) it is inefficient in its use of nomics and bioinformatics operate on integers, real num- available space in the plaintext polynomial p(X), which bers, and binary values. Therefore, there is a mismatch has a total of n coefficients waiting to be used. For one between the plaintexts used by the encrypt function way to resolve both (1) and (2), consider the following. P i in SEAL, and the data types used by practitioners. This Let i bi2 be the binary representation of an integer y. P i mismatch is resolved using encodings, which convert We can encode y as the polynomial p(X) := i biX . In common data types into plaintext polynomials. Encod- this case the number y can be recovered using y = p(2), ings must always come with a matching decoding, which so this encoding also admits an efficient and straight- performs the inverse operation. For the homomorphic forward decoding. The advantage of this binary encoding property of the encryption scheme to make sense, the over the scalar encoding is that the coefficients at the encoding and decoding functions must also be homo- beginning of each computation have only small values: morphic in such a way that addition (resp. multiplication) either zero or one. While adding and multiplying may of encoded plaintext polynomials yields an encoding of increase the sizes of the coefficient, they will still grow the sum (resp. product) of the encoded integers or real much slower than in the scalar encoding, and therefore numbers. may not so easily reduced modulo t. However, modular The main challenges in designing an encoding are reduction may happen, as may reduction modulo around (1) making sure that the encoding and decoding functions Xn +1, which was not possible with the scalar encoding. have the appropriate homomorphic poperties (see above), A negative number we would encode by simply negating and (2) making sure that the representation is compact every coefficient of the binary expansion of its absolute and allows for fast and memory efficient computation. As value. a simple example, consider encoding an integer as the The binary encoding uses a base-2 representation to scalar coefficient of a plaintext polynomial. Decoding in encode integers, but we can just as well use any higher this case is trivial: Simply read the constant coefficient. base b, although this comes with the cost of having However, if at any point during the computation the larger coefficients appear in the freshly encoded plaintext values of the constant coefficient increase beyond t, it polynomial. Consider an odd base b ≥ 3. In this case will automatically be reduced modulo t, and the result we can use a balanced set of representatives of integers might be unexpected. The solution is to choose t large modulo b as coefficients of the base-b representation. In enough, but this might in turn cause the inherent noise other words, each integer has a unique base-b representa- to grow very rapidly in homomorphic multiplications. tion, where powers of b appear with coefficients from the When encoding integers or real numbers as higher degree symmetric range {b−b/2c,..., bb/2c}. Encoding using the polynomials, it is typically necessary to keep track of the binary encoding wastes space since each coefficient is degrees of the plaintext polynomials appearing during one of {−1, 0, 1}, but all non-zero ones will necessarily the computation, since if they exceed Xn−1 reduction have the same sign. In balanced base-3 representation modulo the polynomial modulus Xn + 1 might occur, each coefficient again belongs to the set {−1, 0, 1}, but again leading to unexpected results. now they can have different signs. For example, encoding In the following section we present several powerful the number 25 using balanced base-3 encoding would encoding techniques. The choice of the right encoding yield the polynomial p(X) := X3 − X + 1. Decoding depends on the problem. Moreover, there are many other amounts to evaluating the polynomial at X = 3. Using a encoding techniques that might be more appropriate for higher base b produces shorter polynomials with larger certain applications. coefficients. This might be advantageous if the numbers to be encoded are very large. A. Encoding integers Another way to handle large numbers is by encoding The simplest way to encode an integer is what we them multiple times using several co-prime plaintext already mentioned above: by representing it as the con- moduli t1, . . . , tk. Decoding can be done using the stant coefficient of a plaintext polynomial. Therefore, Chinese Remainder Theorem (CRT)2 to combine the Q an integer y is encoded as the constant polynomial individual decodings back into an integer modulo ti. p(X) := y. This scalar encoding works as long as Therefore, we can break a large integer y into k much the numbers used during the computation remain in smaller integers, obtained by reducing y modulo the ti, {d−t/2e,..., b(t−1)/2c}. Otherwise reduction modulo t might occur, yielding unexpected results. 2 According to CRT, given co-prime integers t1, . . . , tk, and inte- Q The scalar encoding has two main limitations: gers ri (mod ti), there is exactly one integer y (mod ti) such (1) large integers cannot be encoded without choosing that y ≡ ri (mod ti) for every i. 8
and for instance use the scalar encoding to these sep- denotes the binary digits b−1b−2 . . . b−I− , is encoded as arately, encrypt them, and operate on them. Note that the plaintext polynomial each operation must now be performed on each of the X X Xib − Xn−ib . k ciphertexts. Once done with the computation, use i −i i≤I+ 0 /* In BalancedEncoder the base defaults to3 */ When setting up such a fractional encoder, we need BalancedEncoder encoder3(plain_modulus); to tell how many plaintext polynomial coefficients are BalancedEncoder encoder5(plain_modulus, 5); reserved for the fractional part, and how many are BigPoly e2= encoder2.encode(1234); reserved for the integral part, because the encoding BigPoly e3= encoder3.encode(1234); BigPoly e5= encoder5.encode(1234); algorithm needs to know where to truncate a possibly infinite expansion of the fractional part, and the decoding The encoded BigPoly objects can be printed, as usual, algorithm needs to know which coefficients belong to using the member function to_string. which part, as they must be treated differently. For example, if we have n = 4096, we could reserve 1024 coefficients for the integral part, and 128 for the B. Encoding real numbers fractional part. Freshly encoded numbers can then use The most straightforward way to encode reals is by all of the 128 highest coefficients for their fractional scaling them to integers, which of course can only be parts, and up to 1024 lowest coefficients for their integral done when a fixed precision is needed. For example, parts. When two such polynomials are multiplied, they suppose we are given real numbers for which 3 digits can have up to 256 of their top coefficients be non-zero. after the decimal point are significant. Multiplying these Clearly when such polynomials are further multiplied, numbers by 1000 and ignoring the fractional part will the fractional part quickly grows down towards the results in integer values that capture the significant coefficients reserved for the integral part. In this case information. Note however, that some book-keeping is the fractional part can take up to 4096 − 1024 = 3072 required since all the results will be scaled up. Moreover, coefficients, but after that it gets mixed with the integral when multiplying numbers that were scaled up, the result part and can yield unexpected results when decoded. will have a different scaling factor than the inputs. As In the decoding process we would only count the 128 a result, it is important to keep track of the scale at highest coefficients towards the fractional part, the lowest different parts of the calculation, which can get rather 1024 towards the integral part, and ignore the rest. tedious with complicated computations. Our library provides basic fractional encoding func- When the number of significant digits is large, the tionality in the BinaryFractionalEncoder and above method will result in very large integers to be BalancedFractionalEncoder classes. encoded. This can be avoided by a different encoding We present an example of computing 3.14 · 15.93 scheme, where we encode the digits after the decimal in encrypted form. In this example we use fractional point as the highest degree coefficients of the polyno- balanced base-3 encoding, reserve 128 coefficients for mial. More precisely, a real number y = y+.y−, where the fractional part, and 256 coefficients for the integral + − y denotes the binary digits bI+ bI+−1 . . . b1b0, and y part. 9 encryption_parameters (Listing II.1) In many cases it is possible to find n such polynomials key_generator (Listing II.2) n Q1(X),...,Qn(X) which are co-prime, and X + 1 = encryption_tools (Listing II.3) Q Qi(X) (mod t), in which case, each Qi(X) must /* The base defaults to3 */ ∼ BalancedFractionalEncoder encoder(parms. be a linear polynomial, Zt[X]/(Qi(X)) = Zt, and n ∼ n plain_modulus(), parms.poly_modulus(), 256, Zt[X]/(X + 1) = Zt . This is the optimal case, 128); and allows encoding of n integers into one plaintext BigPoly plain1= encoder.encode(3.14); polynomial. Of course this only makes sense if the scalar BigPoly plain2= encoder.encode(15.93); encoding is otherwise appropriate for the problem at BigPoly enc1= encryptor.encrypt(plain1); hand. BigPoly enc2= encryptor.encrypt(plain2); Plaintext packing is implemented in SEAL in the BigPoly enc_prod= evaluator.multiply(enc1, enc2); class PolyCRTBuilder. BigPoly prod= decryptor.decrypt(enc_prod); double result= encoder.decode(prod); D. Encoding binary data The correct answer, stored in result, is 50.0202. In some situations encrypting integers is more con- venient to do bit-by-bit. This is particularly useful for C. Plaintext packing efficient comparison or equality testing, but is not very efficient or practical when homomorphic multiplication SEAL requires working with high degree polynomials of integers is required. For example, one situation where to ensure both security and correctness of the compu- bit-wise encryption is particularly useful is in computing tation. However, the data to be encoded is in many the edit distance between two short encrypted DNA cases rather small, resulting in an enormous message sequences [11]. One option is to use the scalar encoding expansion rate, and relatively long encoding/encryp- together with a plaintext modulus t = 2, so that the tion/decryption times. One way to avoid these problems plaintexts are elements of [X]/(Xn + 1). This is of is to pack several pieces of data in a single message, Z2 course incredibly inefficient in many ways, but it does and use the Single Instruction Multiple Data (SIMD) allow the user to perform both XOR and AND operations paradigm to operate on these messages [5], [29]. One way to encode more data in a single message on individual bits using homomorphic addition and mul- is by using the Chinese Reminder Theorem (CRT) for tiplication, respectively, providing an enormous amount polynomial rings. For example, suppose that n = 2 and of functionality. t = 5. Since X2 + 1 = (X + 2)(X + 3) (mod 5), CRT A na¨ıve way to improve the performance is by en- n n yields an explicit isomorphism coding up to bits as the coefficients of a plain- text polynomial. This does allow for some parallelism, [X] [X] [X] Z5 =∼ Z5 × Z5 . namely one can evaluate XOR gates on n encrypted (X2 + 1) (X + 2) (X + 3) pairs of bits with just one homomorphic addition, or to This isomorphism allows taking two values, one in evaluate either XOR or AND with a plaintext bit on Z5[X]/(X + 2), and the other in Z5[X]/(X + 3), and n encrypted bits simultaneously. What is not possible 2 encoding them as a single element in Z5[X]/(X + 1). however, is evaluating AND gates on n encrypted pairs More generally, assume that of bits simultaneously. k A much better way to introduce parallelism to bit- n Y wise encryption is to use the CRT technique of III-C. X + 1 = Qi(X) (mod t) i=1 In this case up to n bits can be encoded in the constant coefficients of the different slots, where both addition for some polynomials Q (X),...,Q (X) that are co- 1 k and multiplication are performed separately for each prime3. Then slot, resulting in massive improvements in the amortized k complexity. Zt[X] ∼ Y Zt[X] n = (mod t) . (X + 1) (Qi(x)) i=1 IV. PARAMETERSELECTION This allows to encode k integers in a single plaintext as, Selecting secure parameters for homomorphic encryp- for instance, the constant coefficients of each of the k tion schemes is a surprisingly complicated task. Security factors, and to operate on each of them simultaneously. of the encryption scheme used by SEAL depends on 3 This means that if R(X) is a polynomial that divides both Qi(X) the assumed hardness of a lattice problem known as and Qj (X) such that i 6= j, then R(X) is a constant. Ring-Learning With Errors (RLWE) [1], [22]. In some 10 parameter settings the hardness of RLWE can further (n, q) that we consider to be secure based on the analysis be proven to that of certain extremely well studied of [20]. Table IV shows the size of q for the values worst-case lattice problems [28], [23], [26], [24], [7], of n that are used by the automatic parameter selector. but unfortunately such parameters are not relevant for A noise growth simulator then estimates the growth of practical use. Instead, in practice the security claims must inherent noise in the homomorphic operations without be directly based on an analysis of state-of-the-art attacks requiring any actual encrypted data as input. These against RLWE, which has been done in [20], [32], [21]. default values are all available also outside the automatic In addition to guaranteeing security, the encryption parameter selector through the static functions parameters must also be large enough, or else the in- default_noise_standard_deviation() herent noise (recall Section II) will grow too big, and default_noise_max_deviation() make the ciphertexts impossible to decrypt. We denote default_parameter_options() ∆ := bq/tc, and by rt(q) the (positive) remainder when dividing q by t. The inherent noise in a ciphertext c ∈ R of ChooserEvaluator. Alternatively, the user can is a polynomial v ∈ R, such that supply their own σ, Berr, and list of (n, q)-pairs for the parameter selector to use. fc ≡ ∆[m]t + v (mod q) . It is shown in [1] that a ciphertext c is possible to decrypt TABLE I only as long as it has an inherent noise that satisfies (n, q)-PAIRS ∆ − r (q) ||v|| < t . n 1024 2048 4096 8192 16384 ∞ 2 q 48 bits 91 bits 127 bits 383 bits 768 bits Here ||v||∞ denotes the largest absolute value of the coefficients of v. Even freshly encrypted ciphertexts have a certain amount of noise in them (see IV-A below), and performing arithmetic operations on ciphertexts always A. Noise growth simulator increases the noise level, until it reaches its maximum Upper bounds for inherent noise growth in the ho- value and corrupts the underlying plaintext. Due to the momorphic encryption scheme are well understood [1], significance of ||v||∞, we often call it the inherent noise, and have already been used for parameter selection in instead of v. In fact, our noise growth simulator only e.g. [2]. The problem with these bounds is that they estimates the growth of ||v||∞, rather than of v. are typically extremely conservative, and as such yield In addition, the encoding scheme typically places highly inefficient parameters. We instead focus on the strong restrictions on the size of the plaintext modulus t, most significant terms contributing to the noise, and use and in some cases on the degree n of the polynomial average-case estimates for their sizes. As a result, we modulus, as was explained in Section III. Hence, to set obtain simple, but fairly accurate estimates for inherent up the cryptosystem with appropriate parameters, the noise growth in all homomorphic operations. Moreover, user must perform (roughly) the following steps: these estimates only require the encryption parameters, (1) Let σ be a constant or possibly a function of n. and the inherent noise estimates for the input ciphertexts (2) Determine lower bounds for t and n (depending on to work. More precisely, given input ciphertexts with encoding). estimated inherent noises v1, v2, the estimated inherent (3) Determine a lower bound for q such that decryption noise of the output is computed as follows: can be expected to succeed. r2n (4) Choose n, q, and possibly σ, based on the bounds fresh: 2t B 3 err determined above and state-of-the-art security esti- p add: ||v ||2 + ||v ||2 mates. 1 ∞ 2 ∞ r2n nt2 √ (5) Choose w to be as large as possible (at most q) so multiply: (||v || + ||v || ) + n ` B w t 3 2 1 ∞ 2 ∞ w,q err that decryption still succeeds. add_plain: ||v|| (6) If w chosen above is too small, or no such w could ∞ multiply_plain p be chosen, switch to larger n and q. by p(X): deg(p) + 1 ||v||∞ ||p||∞ negate: ||v|| Our automatic parameter selection tool essentially per- ∞ forms the above steps. By default it uses a constant The above estimates are only valid when the parameters σ := 3.19, a constant bound Berr = 15.95 for the are in realistic ranges, and only until the inherent noise Gaussian error sampler, and a hard-coded list of pairs reaches its upper bound of (∆ − rt(q))/2. It is crucial 11 to understand that both homomorphic addition and mul- B. Automatic parameter selection tiplication by a plaintext polynomial typically increase As we explained in the beginning of this section, the noise significantly less than true homomorphic mul- automatic parameter selection involves much more than tiplication of two ciphertexts, which can be easily seen simply estimating inherent noise growth. In particular, from the estimates. the plaintext modulus t must be large enough for de- Recall from II-E that it is possible to also do mul- coding to work. The user must provide an estimated tiplication without performing the relinearization proce- size of the input plaintext data, in particular bounds dure, but that the result must then be decrypted with on the lengths of the plaintext polynomials and on the a different secret key. In the above noise growth es- absolute values of their coefficients, and of course the timate for multiply, the first term comes from the homomorphic operations that are to be performed. From multiply_norelin part, and the second from the all this information we can compute a compute a lower operation relinearize. bound for t. The homomorphic operations must also be To understand what is involved in these estimates, stored in order to later run the noise simulator. consider for example estimating the noise in a freshly In practice we perform this by introducing a device encrypted ciphertext. Recall that the encryption of a called ChooserPoly. These objects carry three essen- plaintext polynomial m ∈ R is tial pieces of data: (CP1) Upper bound on the number of non-zero coeffi- c := [bq/tc[m]t + e + hs] ∈ R, q cients in a (plaintext) polynomial −1 (CP2) Upper bound on the || · ||∞-norm of a (plaintext) where h := tgf q is the public key, and s, e ← χerr. To find the inherent noise in c, we compute polynomial (CP3) A directed acyclic graph representing the entire 0 q t [fc]q = (1 + tf )(b / c[m]t + e + hs) q operation history of the ChooserPoly 0 q t One should think of a ChooserPoly as modeling a = b / c[m]t + fe + tgs − rt(q) f [m]t q , ciphertext, while only carrying information about the where coefficients of the secret polynomial f 0 are chosen size of the underlying plaintext polynomial, and in- uniformly at random from {−1, 0, 1}. We have also used formation about how the ciphertext was obtained as a q = bq/tct + rt(q). The inherent noise polynomial in a result of homomorphic operations. The operation his- fresh ciphertext is therefore tory tells exactly how the particular ChooserPoly was obtained from freshly encrypted ciphertexts. Those 0 vfresh := fe + tgs − rt(q) f [m]t q . ChooserPolys that model freshly encrypted cipher- texts have their operation history set to a special fresh It is the || · || -norm of v that matters, and that we ∞ fresh value, with no inputs. We use ChooserPolys with need to estimate. By the triangle inequality NULL operation history to model plaintext polynomials 0 instead of ciphertexts. Whenever a homomorphic oper- ||vfresh||∞ ≤ ||fe||∞ + ||tgs||∞ + rt(q)||f [m]t||∞ . ation is performed on one or more ChooserPolys, a In typical cases the last term is very small compared to new one is created with (CP1) and (CP2) computed from the first two, so we omit it. This is especially true when (CP1) and (CP2) of the inputs. Finally, the operation rt(q) is small, when [m]t has small coefficients, and/or histories of the inputs are fully cloned and merged to when [m]t is sparse and short enough. In the first term, create (CP3). the polynomial e is dense and has coefficients distributed We still have not mentioned the parameter w, or according to a discrete Gaussian distribution with mean the decomposition bit count log2 w. For efficiency rea- 0 and standard deviation σ. Since approximately two sons we prefer to have log2 w be an integer in the thirds of the coefficients of f are ±t, and one third range {1,..., dlog2 qe}, i.e. we always take w to be are 0, each coefficient of fe is roughly a sum of 2n/3 dis- a power of 2. It is clear from the estimates in IV-A crete Gaussian distributions, multiplied by t, and hence that a larger w corresponds to larger noise growth distributed according to a discrete Gaussian distribution in homomorphic multiplication, but it also makes the with standard deviation tp2n/3 σ. This means that we operation faster. Thus, the procedure for selecting w is p can expect ||fe||∞ ≈ t 2n/3 Berr. The polynomial tgs as follows: p has similar structure, so also ||tgs||∞ ≈ t 2n/3 Berr, (1) Start with log2 w = dlog2 qe. resulting in the estimate above for fresh. The other (2) Use the inherent noise growth simulator to find out ones involve similar approximations. whether decryption can be expected to work with 12 encryption parameters (n, q, t, σ, w). obtain an optimized set of encryption parameters encap- (3) If decryption can not be expected to succeed, de- sulated in an instance of EncryptionParameters. crease log2 w, and go to (2), unless log2 w is already too small to be efficient (bound can be determined C. Examples by user), in which case increase (n, q) and go to (1). Here we present a few simple examples of using the Finally, we need to explain in more detail how the automatic parameter selection module. pairs (n, q) are chosen. For security and efficiency rea- Suppose the user wants to compute 12 · 345 + 6789 in sons, we always take n be a power of 2, and choose encrypted form. Consider the following C++ code: q from a hard-coded list of prime numbers of a certain form, whose sizes were presented above in Table IV. ChooserEncoder encoder; ChooserEncryptor encryptor; These choices are estimated to yield a security level ChooserEvaluator evaluator; of well over 128 bits (see [20]), and are certainly a ChooserPoly plain1= encoder.encode(12); 4 conservative choice . ChooserPoly plain2= encoder.encode(345); Our automatic parameter selection module con- ChooserPoly plain3= encoder.encode(6789); ChooserPoly enc1= encryptor.encrypt(plain1); tains also tools analogous to BalancedEncoder, ChooserPoly enc2= encryptor.encrypt(plain2); Encryptor, and Evaluator. This makes it very ChooserPoly enc3= encryptor.encrypt(plain3); easy for the user to switch from running their code ChooserPoly prod= evaluator.multiply(enc1, enc2); on ChooserPoly objects to running it on actual data. ChooserPoly result= evaluator.add(prod12, enc3); More precisely, the following classes are provided: EncryptionParameters parms= evaluator. select_parameters(result); ChooserPoly: Contains information about the approximate size of a This stores a working set of encryption parameters in plaintext polynomial, and an operation history, as was parms, which the user can read and use. Once the explained above. user knows which encryption parameters they want to use, and have set up the cryptosystem accordingly, it ChooserEncoder: is extremely easy to convert the above code to run on This class can be used analogously to real data. The only change needed is, instead of cre- BalancedEncoder. If the user knows beforehand ating ChooserEncoder, ChooserEncryptor, and some numbers going into the computation, e.g. ChooserEvaluator, to create an encoder, encryptor, coefficients of a linear function to be evaluated and evaluator as usual, e.g. on the encrypted data, they can be converted into ChooserPoly NULL encryption_parameters (Listing II.1) objects with operation history key_generator (Listing II.2) using the encode function in ChooserEncoder. encryption_tools (Listing II.3) ChooserEncryptor: BalancedEncoder encoder(parms.plain_modulus()); Encryptor encryptor(parms, public_key); Most importantly, this class contains a function Evaluator evaluator(parms, evaluation_keys); encrypt that can be used to change the operation history in a ChooserPoly from NULL to fresh. The and change the ChooserPoly objects into BigPoly same result can be achieved by calling the set_fresh objects. Then BigPoly result will contain the member function of the particular ChooserPoly. encryption of 12 · 345 + 6789 = 10929. Typically whoever chooses the parameter sizes does ChooserEvaluator: not know exactly what the input data is, but only an The ChooserEvaluator class is used to perform estimate of its size. For example, if we know that enc1, operations on the ChooserPoly objects. The opera- enc2, and enc3 will contain encryptions of balanced tions take a varying number of ChooserPolys as input base-3 encoded numbers, with encodings of length at parameters, and always output a new ChooserPoly most 9, we could use with updated values for (CP1)–(CP3). ChooserEvaluator evaluator; Once the user has performed all of their computations ChooserPoly enc1(9,1); on the ChooserPoly objects, they can use the function ChooserPoly enc2(9,1); select_parameters of ChooserEvaluator to ChooserPoly enc3(9,1); 4 ChooserPoly prod= evaluator.multiply(enc1, enc2); An expert user might benefit from switching to slightly less secure ChooserPoly result= evaluator.add(prod12, enc3); parameters (larger q, smaller n), and this is certainly easy to do by changing the values in the code, but is also highly discouraged EncryptionParameters parms= evaluator. without a very good understanding of the security results. select_parameters(result); 13 to obtain appropriate encryption parameters. The con- Based on earlier internal implementations of homo- structor of ChooserPoly takes (CP1) and (CP2) as morphic encryption which were hand-tuned, not publicly input parameters. The operation histories of the three available, and not very flexible, performance numbers for ChooserPolys are set by default to fresh. many such computations on homomorphically encrypted Next we demonstrate choosing parameters for com- genomic data were reported in [18], [19], [2]. Most puting a linear combination of encrypted numbers with recently, [18] implemented MAFs, χ2-statistics, Ham- public coefficients. Suppose we know that all of the ming distance, and edit distance for sequence matching, encrypted numbers are encoded using balanced base-7 which were the tasks in the Secure Genome Analysis encoding, and have length at most 20 terms5. Suppose Contest run by iDASH, and funded by NIH [17]. The that the coefficients are stored as integers in an std:: implementation in [19] was written using the Magma vector BalancedFractionalEncoder encoder( The computation above is, however, not a very optimal parms.plain_modulus(), parms.poly_modulus(), solution. In fact, the parameters given in Listing II.1 256, 16); are not nearly large enough to deal with this problem. BigPolya= encoder.encode(42); Everything works well until the sigmoid function has to BigPoly RCPG= encoder.encode(115); BigPolyPT= encoder.encode(8); be evaluated. Problems arise when real numbers encoded BigPoly female= encoder.encode(1); with the fractional encoders are raised to high powers, BigPoly BMI= encoder.encode(20.2); such as 7. The reason is that even if only very few std::vector return 0; on a 2.00 GHz machine using a single thread. Much } better performance can be achieved by parallelizing the 16 computations. These timings were obtained by averaging [15] Craig Gentry, Shai Halevi, and Nigel P Smart. Homomorphic across 25 runs of the operations. For a smaller parameter evaluation of the aes circuit. In Advances in Cryptology– n = 1024 q CRYPTO 2012, pages 850–867. Springer, 2012. set with , and coefficient modulus of size [16] Craig Gentry, Amit Sahai, and Brent Waters. Homomorphic roughly 48 bits, the time required for a homomorphic encryption from learning with errors: Conceptually-simpler, multiplication of ciphertexts is around 92 milliseconds, asymptotically-faster, attribute-based. In Ran Canetti and including the costly relinearization step II-E. For a larger Juan A. Garay, editors, CRYPTO (1), volume 8042 of Lecture Notes in Computer Science, pages 75–92. Springer, 2013. parameter set with n = 4096, and coefficient modulus [17] iDASH Privacy & security workshop 2015. Secure genome q of size roughly 127 bits, the time required for a analysis competition. http://www.humangenomeprivacy.org/ homomorphic multiplication of ciphertexts is around 291 2015/competition-tasks.html. milliseconds, including relinearization. [18] Miran Kim and Kristin Lauter. Private genome analysis through homomorphic encryption. Cryptology ePrint Archive, Report 2015/965, 2015. http://eprint.iacr.org/. [19] Kristin Lauter, Adriana Lopez-Alt,´ and Michael Naehrig. Pri- REFERENCES vate computation on encrypted genomic data. In Progress in Cryptology-LATINCRYPT 2014, pages 3–27. Springer, 2014. [1] Joppe W Bos, Kristin Lauter, Jake Loftus, and Michael Naehrig. [20] Tancrede` Lepoint and Michael Naehrig. A comparison of the Improved security for a ring-based fully homomorphic en- homomorphic encryption schemes fv and yashe. In Progress cryption scheme. In Cryptography and Coding, pages 45–64. in Cryptology–AFRICACRYPT 2014, pages 318–335. Springer, Springer, 2013. 2014. [2] Joppe W Bos, Kristin Lauter, and Michael Naehrig. Private [21] Richard Lindner and Chris Peikert. Better key sizes (and predictive analysis on encrypted medical data. Journal of attacks) for lwe-based encryption. In Topics in Cryptology– biomedical informatics, 50:234–243, 2014. CT-RSA 2011, pages 319–339. Springer, 2011. [3] Wieb Bosma, John Cannon, and Catherine Playoust. The [22] Adriana Lopez-Alt,´ Eran Tromer, and Vinod Vaikuntanathan. Magma algebra system. I. The user language. J. Symbolic On-the-fly multiparty computation on the cloud via multikey Comput., 24(3-4):235–265, 1997. Computational algebra and fully homomorphic encryption. In Proceedings of the forty- number theory (London, 1993). fourth annual ACM symposium on Theory of computing, pages [4] Zvika Brakerski. Fully homomorphic encryption without modu- 1219–1234. ACM, 2012. lus switching from classical GapSVP. In Reihaneh Safavi-Naini [23] Vadim Lyubashevsky, Chris Peikert, and Oded Regev. On ideal and Ran Canetti, editors, CRYPTO, volume 7417 of Lecture lattices and learning with errors over rings. Journal of the ACM Notes in Computer Science, pages 868–886. Springer, 2012. (JACM), 60(6):43, 2013. [5] Zvika Brakerski, Craig Gentry, and Shai Halevi. Packed [24] Daniele Micciancio and Chris Peikert. Trapdoors for lattices: ciphertexts in lwe-based homomorphic encryption. In Public- Simpler, tighter, faster, smaller. In Advances in Cryptology– Key Cryptography–PKC 2013, pages 1–13. Springer, 2013. EUROCRYPT 2012, pages 700–718. Springer, 2012. [6] Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. [25] Michael Naehrig, Kristin Lauter, and Vinod Vaikuntanathan. (leveled) fully homomorphic encryption without bootstrapping. Can homomorphic encryption be practical? In Proceedings of In Proceedings of the 3rd Innovations in Theoretical Computer the 3rd ACM workshop on Cloud computing security workshop, Science Conference, pages 309–325. ACM, 2012. pages 113–124. ACM, 2011. [7] Zvika Brakerski, Adeline Langlois, Chris Peikert, Oded Regev, [26] Chris Peikert. Public-key cryptosystems from the worst-case and Damien Stehle.´ Classical hardness of learning with errors. shortest vector problem. In Proceedings of the forty-first annual In Proceedings of the forty-fifth annual ACM symposium on ACM symposium on Theory of computing, pages 333–342. Theory of computing, pages 575–584. ACM, 2013. ACM, 2009. [8] Zvika Brakerski and Vinod Vaikuntanathan. Efficient fully [27] R Core Team. R: A Language and Environment for Statistical homomorphic encryption from (standard) LWE. In Rafail Computing. R Foundation for Statistical Computing, Vienna, Ostrovsky, editor, FOCS, pages 97–106. IEEE, 2011. Austria, 2015. [9] Zvika Brakerski and Vinod Vaikuntanathan. Fully homomor- [28] Oded Regev. On lattices, learning with errors, random linear phic encryption from ring-lwe and security for key dependent codes, and cryptography. Journal of the ACM (JACM), 56(6):34, messages. In Advances in Cryptology–CRYPTO 2011, pages 2009. 505–524. Springer, 2011. [29] Nigel P Smart and Frederik Vercauteren. Fully homomorphic [10] Zvika Brakerski and Vinod Vaikuntanathan. Lattice-based FHE simd operations. Designs, codes and cryptography, 71(1):57– as secure as PKE. In Moni Naor, editor, ITCS, pages 1–12. 81, 2014. ACM, 2014. [30] Damien Stehle´ and Ron Steinfeld. Making ntru as secure [11] Jung Hee Cheon, Miran Kim, and Kristin Lauter. Homomorphic as worst-case problems over ideal lattices. In Advances in computation of edit distance. Cryptology ePrint Archive, Report Cryptology–EUROCRYPT 2011, pages 27–47. Springer, 2011. 2015/132, 2015. http://eprint.iacr.org/. [31] Bahman P Tabaei and William H Herman. A multivariate [12] Junfeng Fan and Frederik Vercauteren. Somewhat practical fully logistic regression equation to screen for diabetes development homomorphic encryption. Cryptology ePrint Archive, Report and validation. Diabetes Care, 25(11):1999–2003, 2002. 2012/144, 2012. http://eprint.iacr.org/. [32] Joop van de Pol and Nigel P Smart. Estimating key sizes for [13] Andreas Festa, Ken Williams, Anthony J.G. Hanley, James D. high dimensional lattice-based systems. In Cryptography and Otvos, David C. Goff, Lynne E. Wagenknecht, and Steven M. Coding, pages 290–303. Springer, 2013. Haffner. Nuclear magnetic resonance lipoprotein abnormalities [33] Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikun- in prediabetic subjects in the insulin resistance atherosclerosis tanathan. Fully homomorphic encryption over the integers. In study. Circulation, 111(25):3465–3472, 2005. Henri Gilbert, editor, EUROCRYPT, volume 6110 of Lecture [14] Craig Gentry. Fully homomorphic encryption using ideal Notes in Computer Science, pages 24–43. Springer, 2010. lattices. In STOC, volume 9, pages 169–178, 2009.