SoK: Fully Homomorphic Encryption Compilers Alexander Viand Patrick Jattke Anwar Hithnawi ETH Zurich ETH Zurich ETH Zurich [email protected] [email protected] [email protected] Abstract—Fully Homomorphic Encryption (FHE) allows a seven orders of magnitude slower than an IMUL instruction third party to perform arbitrary computations on encrypted on a modern CPU, it is sufficient to make many applications data, learning neither the inputs nor the computation results. practical. Additionally, modern schemes introduced SIMD- Hence, it provides resilience in situations where computations are carried out by an untrusted or potentially compromised party. style parallelism, encoding thousands of plaintext values into This powerful concept was first conceived by Rivest et al. in a single ciphertext to further improve throughput [12]. the 1970s. However, it remained unrealized until Craig Gentry These advances have enabled a wide range of applications presented the first feasible FHE scheme in 2009. covering a wide range of domains. These include mobile The advent of the massive collection of sensitive data in cloud applications, where FHE has been used to encrypt the back services, coupled with a plague of data breaches, moved highly regulated businesses to increasingly demand confidential and end of a privacy-preserving fitness app [13], while continuing secure computing solutions. This demand, in turn, has led to a to provide a real-time experience. In the medical domain, recent surge in the development of FHE tools. To understand FHE has been used to enable privacy-preserving genome the landscape of recent FHE tool developments, we conduct analysis [14] applications over large datasets. More generally, an extensive survey and experimental evaluation to explore the FHE has been used to solve various well-known problems current state of the art and identify areas for future development. like Private Set Intersection (PSI) [15], outperforming previous In this paper, we survey, evaluate, and systematize FHE tools and compilers. We perform experiments to evaluate these tools’ solutions by 2× in running time. In the domain of machine performance and usability aspects on a variety of applications. learning, FHE has been used for tasks ranging from linear and We conclude with recommendations for developers intending logistic regression [16] to Encrypted Neural Network infer- to develop FHE-based applications and a discussion on future ence [17], which can be used to run privacy-preserving ML-as- directions for FHE tools development. a-Service applications, for example, for private phishing email detection [18]. As a consequence, there has been increasing I. INTRODUCTION interest in FHE-based secure computation solutions [3]–[9]. Recent years have seen unprecedented growth in the adop- Gartner projects [19] that “by 2025, at least 20% of companies tion of cloud computing services. More and more highly reg- will have a budget for projects that include fully homomorphic ulated businesses and organizations (e.g., banks, governments, encryption.” insurances, health), where data security is paramount, move Despite these recent breakthroughs, building secure and their data and services to the cloud. This trend has led to efficient FHE-based applications remains a challenging task. a surge in demand for secure and confidential computing This is largely attributed to the differences between traditional solutions that protect data confidentiality while in transit, rest, programming paradigms and FHE’s computation model, which and in-use. This is an amply justified and expected demand, poses unique challenges. For example, virtually all standard particularly in the light of the numerous reports of data programming paradigms rely on data-dependent branching, breaches [1], [2]. Fully Homomorphic Encryption (FHE) is e.g., if/else statements and loops. On the other hand, FHE a key technological enabler for secure computation and has computations are, by definition, data-independent, or they arXiv:2101.07078v1 [cs.CR] 18 Jan 2021 recently matured to be practical for real-world use [3]–[9]. would violate the privacy guarantees. Working with FHE FHE allows arbitrary computations to be performed over also introduces significant engineering challenges in practice. encrypted data, eliminating the need to decrypt the data and Different schemes offer varying performance tradeoffs, and expose it to potential risk while in use. While first proposed optimal choices are heavily application-dependent. To address in the 1970s [10], FHE was long considered impossible or some of the engineering challenges in this space, we have seen impractical. However, thanks to advances in the underlying a surge of work on tools that aim to improve accessibility and theory, general hardware improvements, and more efficient reduce barriers to entry in this field. implementations, it has become increasingly practical. In Without tool support, realizing FHE-based computations by 2009, breakthrough work from Craig Gentry proposed the implementing the required mathematical operations directly or first feasible FHE scheme [11]. In the last decade, FHE has using an arbitrary-precision arithmetic library is complex, re- gone from a theoretical concept to reality, with performance quiring considerable expertise in both cryptography and high- improving by up to five orders of magnitude. For example, performance numerical computation. Therefore, FHE libraries times for a multiplication between ciphertexts dropped from 30 like the Simple Encrypted Arithmetic Library (SEAL) [20] minutes to less than 20 milliseconds. While this is still around or the Fast Fully Homomorphic Encryption Library over the 1 FHE ALCHEMY Cingulata EVA nGraph-HE SEALion Therefore, this paper aims to fill in this knowledge gap Compilers CHET E3 Marble RAMPARTS by studying and surveying the current state-of-the-art of FHE FHE concrete FHEW HEAAN lattigo PALISADE TFHE Libraries cuFHE FV-NFLib HElib nuFHE SEAL use tools. More concretely, this survey has two objectives: First, to Maths & ABC FLINT GMP MPFR NFLib OpenMP assist developers looking to develop FHE-based applications Other Libs. Boost FFTW Λ ￮ λ MPIR NTL … use in selecting a suitable approach and, second, to provide the Figure 1: Overview of the FHE tool space. community with valuable insights on both successes and remaining issues in this space. Towards this goal, we conduct an extensive survey of Torus (TFHE) [21] implement the underlying cryptographic existing tools and highlight their features and characteristics. operations and expose a higher-level API. In addition to key Subsequently, we consider these tools in practice by experi- generation, encryption, and decryption, these APIs also expose mentally evaluating them across a range of case study applica- at least homomorphic addition and multiplication. tions, contrasting usability, expressiveness, and performance. In practice, however, library APIs often include dozens In our experimental evaluation, we consider a selection of additional functionalities for ciphertext maintenance and of tools in more detail and provide an in-depth analysis of manipulation. Since schemes vary in features, these APIs their usability and expressiveness in practice. We implement differ significantly not just in their implementation but also and benchmark three case-study applications that represent conceptually. Efforts are being made to standardize APIs different domains of FHE-based computation. Our benchmarks for FHE schemes [22] and, simultaneously, there are first allow us to study not only the overall performance of FHE for steps towards interoperability via wrappers around existing these applications across tools but also the relative strengths libraries [23]. However, achieving competitive performance of different tools compared to each other. frequently still requires working with libraries directly. Along with this paper, we provide an online repository1 While FHE libraries make the process of writing FHE-based that includes Docker images for all the tools we evaluate, applications substantially more efficient, they still require sig- our automated benchmarking framework, and the example nificant expertise and understanding of the underlying scheme applications. Additionally, it includes further benchmarks and since they remain relatively low-level cryptographic libraries. tool descriptions that we could not include in this paper due Therefore, recent years have seen the development of higher- to space limitations. level tools, frequently known as FHE compilers, that aim to We conclude our paper with a discussion of the current state translate standard programs into FHE-based implementations. of FHE and FHE tools. We discuss applications for which FHE These tools focus on making FHE accessible to non-experts is likely practical today and show gaps between state-of-the-art by improving usability and increasingly offering advanced results and what non-expert users can realistically implement. optimizations previously accessible only to experts. Compilers Based on the insights gained through our study, we highlight generally rely on FHE libraries to realize the actual en- successes in the FHE tool space and identify gaps that remain /decryption and homomorphic computation. FHE libraries, in to be addressed. Finally, we discuss a possible road map for turn, frequently employ existing libraries for fast numerical the next generation of FHE tools. computations, parallelization, or other non-FHE-specific fea- tures. Figure