Gentry’s bootstrapping technique is still the only known method of obtaining fully homomorphic encryption where the system’s parameters do not depend on the complexity of the evaluated functions. Bootstrapping involves a recryption procedure where the scheme’s decryption algorithm is evaluated homomorphically. Prior to this work, there were very few implementations of recryption and fewer still that can handle “packed ciphertexts” that encrypt vectors of elements. In the current work, we report on an implementation of recryption of fully packed ciphertexts using the HElib library for somewhat homomorphic encryption. This implementation required extending previous recryption algorithms from the literature, as well as many aspects of the HElib library. Our implementation supports bootstrapping of packed ciphertexts over many extension fields/rings. One example that we tested involves ciphertexts that encrypt vectors of 1024 elements from $${\text {GF}}(2^{16})$$ GF ( 2 16 ) . In that setting, the recryption procedure takes under 3 min (at security level $$\approx 80$$ ≈ 80 ) on a single core and allows a multiplicative depth-11 computation before the next recryption is needed. This report updates the results that we reported in Eurocrypt 2015 in several ways. Most importantly, it includes a much more robust method for deriving the parameters, ensuring that recryption errors only occur with negligible probability. Many aspects of this analysis are proved, and for the few well-specified heuristics that we made, we report on thorough experimentation to validate them. The procedure that we describe here is also significantly more efficient than in the previous version, incorporating many optimizations that were reported elsewhere (such as more efficient linear transformations) and adding a few new ones. Finally, our implementation now also incorporates Chen and Han’s techniques from Eurocrypt 2018 for more efficient digit extraction (for some parameters), as well as for “thin bootstrapping” when the ciphertext is only sparsely packed.

中文翻译：

---

HElib 的引导

Gentry 的自举技术仍然是获得完全同态加密的唯一已知方法，其中系统的参数不依赖于评估函数的复杂性。引导涉及重新加密过程，其中方案的解密算法被同态评估。在这项工作之前，重新加密的实现很少，可以处理对元素向量进行加密的“打包密文”的实现也很少。在当前的工作中，我们报告了使用 HElib 库对完全打包的密文进行重新加密的实现，以进行某种程度的同态加密。这种实现需要从文献中扩展以前的重新加密算法，以及 HElib 库的许多方面。我们的实现支持在许多扩展字段/环上引导打包密文。我们测试的一个示例涉及加密来自 $${\text {GF}}(2^{16})$$ GF ( 2 16 ) 的 1024 个元素的向量的密文。在该设置中，重新加密过程在单核上花费不到 3 分钟（在安全级别 $$\approx 80$$ ≈ 80 ），并允许在需要下一次重新加密之前进行乘法深度 11 计算。该报告以多种方式更新了我们在 Eurocrypt 2015 中报告的结果。最重要的是，它包含了一种更强大的参数推导方法，确保重新加密错误的发生概率可以忽略不计。这种分析的许多方面都得到了证明，对于我们所做的少数明确指定的启发式方法，我们报告了彻底的实验来验证它们。我们在这里描述的过程也比以前的版本更有效，结合了其他地方报告的许多优化（例如更有效的线性变换）并添加了一些新的优化。最后，我们的实现现在还结合了 Eurocrypt 2018 中 Chen 和 Han 的技术，以实现更高效的数字提取（对于某些参数），以及当密文只是稀疏打包时的“细引导”。