Abstract

With the development of new computing models such as cloud computing, user’s data are at the risk of being leaked. Fully homomorphic encryption (FHE) provides a possible way to fundamentally solve the problem. It enables a third party who does not know anything about the secret key and plaintexts to homomorphically perform any computable functions on the corresponding ciphertexts. In 2009, Gentry proposed the first FHE scheme. After that, its inefficiency has always been a bottleneck of the development of practical schemes and applications. At TCC 2019, Gentry and Halevi proposed the first compressible FHE scheme that enables the ratio of plaintext size to the ciphertext size (i.e., the compression rate) to reach for any small under the standard learning with errors (LWE) assumption. However, it is only a single-key one, where the homomorphic evaluation can only be performed over ciphertexts encrypted under the same key. Compared with single-key FHE, multikey FHE is more practical. Multikey FHE enables ciphertexts encrypted under different public keys to be homomorphically computed without having to decrypt these ciphertexts using their own private keys. In addition, in a multi-identity FHE scheme, only identity information and public parameters are required when encrypting, which simplifies certificate-based key management in public key infrastructure. In this paper, a new compressible ciphertext expansion technique is proposed. Then, we use this technique to construct a compressible multikey FHE scheme and a compressible multi-identity FHE scheme to overcome the bottleneck of bandwidth inefficiency in the multikey and multi-identity settings. The two schemes proposed in this paper make it possible that the objects of homomorphic operation can be the ciphertexts encrypted under different keys or different identities before compression, thus solving the single-key defect of the work of Gentry and Halevi.

1. Introduction

We are quickly entering a new digital era where huge amounts of data will be stored and operated remotely in powerful cloud servers. Cloud computing is a popular option for people and businesses for a number of reasons including cost savings, increased productivity, and performance. With all of these advantages, however, it also raises grave security issues and challenges. User’s sensitive information, such as medical data and organizational secrets, is vulnerable to be leaked to cloud providers and even clients. Thus, it is prudent for users to encrypt their data before transmitting to the cloud.

Fully homomorphic encryption (FHE) provides a fundamental method to solve the issue, making it possible to perform arbitrary operations over encrypted data. In particular, FHE enables the third party who does not know anything about the secret key and plaintexts to homomorphically evaluate any computable functions on the corresponding ciphertexts. Since 2009, when Gentry proposed the first FHE scheme [1], FHE has been a research hot spot. Various FHE schemes were then proposed [2–4].

However, conventional FHE is only a single-key one, where the homomorphic evaluation can only be performed over ciphertexts encrypted under the same key. Compared with single-key FHE, multikey FHE is more practical. In many scenarios, several users (often mutually distrusting) want to compute a joint function on their collective data, which have been encrypted and stored in the cloud. For example, two medical companies want the cloud to calculate some statistical information on their medical databases that are encrypted using their own public keys and stored on the cloud. In the meantime, they do not want to leak anything except the final result to others. Single-key FHE cannot deal with these situations, while multikey FHE enables ciphertexts encrypted under different public keys to be homomorphically computed without having to decrypt these ciphertexts using their own private keys.

At STOC 2012, López-Alt, Tromer and Vaikuntanathan [5] proposed the notion of multikey FHE (MKFHE) and they provided the first MKFHE candidate from NTRU-based cryptography. At CRYPTO 2015, Clear and McGoldrick [6] constructed an MKFHE scheme based on the learning with errors (LWE) assumption, which was simplified by Mukherjee and Wichs [7] and then followed by [8–11]. Very recently, Chen, Chillotti, and Song proposed an MKFHE scheme [12] based on TFHE [13], and they were the first to implement an MKFHE scheme.

Identity-based FHE (IBFHE) is an identity-based version of FHE. The first IBFHE scheme was achieved by Gentry, Sahai, and Waters [4] using a special compiler, which allows all lattice-based IBE schemes [14, 15] to be compiled into IBFHE schemes. Multi-identity FHE (MIFHE) is an identity-based version of MKFHE. In an MIFHE scheme, only identity information and public parameters are required when encrypting, which simplifies certificate-based key management in public key infrastructure. Clear and McGoldrick [6] also constructed the first MIFHE scheme in the random oracle model based on the GPV-IBE scheme [14].

However, there is always a question plaguing FHE researchers. How bandwidth-efficient can FHE be? Although it is quite easy to achieve public key encryption (PKE) with nearly no loss in bandwidth, the same is nontrivial in the FHE case because there should be much more redundancy in an FHE ciphertext to support homomorphism, which means much more bandwidth waste.

Some works managed to partly improve the inefficiency by using the “dimension-modulus reduction” technique [16, 17] to make ciphertexts have smaller dimensions and coefficients, and some by using the “ciphertext packing” technique [18–20] managed to encrypt an array of plaintexts in a single ciphertext and even encrypt a matrix of plaintexts in a single ciphertext [21, 22]. But none of them achieved a “sufficiently high” rate; that is, none of them break the rate-1/2 bottleneck. Very recently, Gentry and Halevi [23] proposed the first compressible FHE scheme, allowing compressing many ciphertexts into a compressed one, so that the compression rate can reach for any small . A concurrent work of Brakerski et al. [24] also achieved compressible FHE, but their work is more general and is unlikely to yield practical schemes for applications.

A natural question is the following: how can we extend their idea of compressible single-key FHE into compressible MKFHE or compressible MIFHE to achieve an optimal compression rate even in the multikey and multi-identity cases? In other words, we want to construct a compressible MKFHE scheme and a compressible MIFHE scheme that enable ciphertexts encrypted under different public keys and different identities to perform homomorphic operations without having to decrypt these ciphertexts using their own private keys. At the same time, expanded ciphertexts (under the combined key) are supposed to be compressed to achieve an optimal compression rate. In this work, we focus on this problem.

1.1. Technical Overview

We now give a technical overview of our new compressible expansion algorithm, which is the key step towards our constructions of compressible MKFHE and compressible MIFHE. We start with Gentry and Halevi’s basic ideas of constructing compressible single-key FHE [23]. Then, we give a discussion about the difficulties encountered when trying to construct compressible multikey (multi-identity) FHE, which can be solved using our new compressible expansion algorithm.

1.1.1. Compressible Single-Key FHE

We begin with a brief description of the approach of Gentry and Halevi. At a very high level, their approach of building a compressible single-key FHE is based on two ideas: Using matrix versions of LWE and GSW-FHE [4]. Firstly, they noticed that the conventional GSW-FHE uses only one “slot” to place a message bit. To achieve an optimal compression rate, more message “slots” must be utilized. Their solution is to use LWE with matrix secrets, which yields a matrix version of GSW-FHE. Then, a compression algorithm is added after evaluation, so that multiple ciphertexts can be compressed into one. Besides, the secret key of matrix version is used in the decryption algorithm. The compression rate is now bounded by . Using a “nearly square” gadget matrix. The second idea is to transform a “fat” compressed ciphertext matrix into a “nearly square” compressed ciphertext matrix using a “nearly square” gadget matrix with some special properties, which comes with almost no dimension expansion. On the other hand, attributed to , the redundancy in ciphertexts enables us to erase the noise and finally recover the message matrix. Using instead of the original gadget matrix , the compression rate is now , an optimal compression rate!

More information can be found later in Section 2.4.

1.1.2. Compressible Multikey (Multi-Identity) FHE

We propose the first compressible multikey (multi-identity) FHE that achieves an optimal compression rate via a new compressible expansion algorithm. At a high level, the key observation of our compressible expansion algorithm is that we can transform a secret key vector and a “fat” ciphertext matrix into a “nearly square” secret key matrix and a “nearly square” ciphertext matrix, even in the multikey and multi-identity FHE cases.

We note that it is nontrivial to utilize the powerful functionality of the nearly square gadget matrix described above in the multikey (or multi-identity) setting. The idea of using the matrix version of secret key does not directly work because all of the secret matrices for different users, say 2 users totally, are required to decrypt the expanded ciphertext. Hence, the combined key matrix is a “fat” one, rather than a “nearly square” one. To the best of our knowledge, all of the existing GSW-based multikey (or multi-identity) FHE schemes combine secret keys like this. To make the combined secret key matrix more “square,” we must decrease the number of columns of the combined secret key matrix.

Our solution is to delete the identity matrix in every single secret key matrix because it seems like the most insignificant part compared with the LWE secrets. After all, everybody knows there is an identity matrix in the secret key matrix but no one can recover the LWE secrets after discarding them. The combined secret key matrix now becomes , a nearly square one again.

Meanwhile, the structure of corresponding expanded ciphertexts must be tailored to fit the combined secret key. Traditionally, the expanded ciphertexts are supposed to be partitioned into blocks, each with the same size. Since we have discarded some columns of the combined secret key, it is fair to also dump some rows of expanded ciphertexts. In particular, the expanded ciphertexts are now partitioned into blocks, each with different size, i.e.,

However, abandoning some rows disrupts the structure of the G-trapdoor, which bears great responsibility on evaluation and decryption. Here comes our second idea: restoring the disrupted structure of the G-trapdoor. In particular, the expanded ciphertexts should be partitioned into blocks rather than blocks as above. Our construction allows user 1 to generate some additional helper information and associated with the ciphertext when encrypting, and releasing all of them does not compromise semantic security. We define the expanded ciphertext asso that

Part 1 and Part 2 are nothing special and there are many ways to achieve them [6, 7, 11]. The major difficulty lies in Part 3, i.e., . The right-hand side must come from , since the randomness can only come from this. In terms of normal routine, , where is the public key of user 2 and is the encryption randomness. Thus, the only thing left is to construct .

Similarly, the expanded ciphertext for user 2 can be created, and then we can perform regular GSW-like homomorphic evaluations. Our new expansion technique leads to the first compressible MKFHE and the first compressible MIFHE. The relationship between them is just like the relationship between Regev-PKE [25] and GPV-IBE [14]. A more formal and detailed description can be found later in Sections 3 and 4.

1.2. Contribution

In this paper, a new compressible expansion algorithm is proposed, which makes it possible to construct the first compressible MKFHE scheme, as well as the first compressible MIFHE scheme, while the construction of Gentry and Halevi only works for compressible single-key FHE. Informally, the following theorem outlines our main result. A formal version will be presented later in Sections 3 and 4.

Theorem 1. For any , there exist a rate- compressible multikey fully homomorphic encryption scheme that is semantically secure and a rate- compressible multi-identity fully homomorphic encryption scheme that is selectively secure, both under the decisional learning with error assumption.

Besides, as Gentry and Halevi noted, a compressible MKFHE scheme or a compressible MIFHE scheme enables messages always in a compressed state except when operating homomorphic evaluation for a short time. In particular, freshly encrypted ciphertexts are compressed after encryption. The compressed ciphertexts are homomorphically decompressed before performing required homomorphic operations. Finally, these evaluated ciphertexts are compressed again and stored or transmitted to corresponding users.

1.3. Paper Organization

Firstly, we recall some notations, definitions, and facts in Section 2. Then, we present our compressible MKFHE scheme in Section 3 and our compressible MIFHE scheme in Section 4, respectively. Finally, we conclude the paper in Section 5.

2. Preliminaries

There are some notations that we will use throughout this paper. Let denote the security parameter throughout the paper. Matrices are represented by bold uppercase letters (e.g., ), vectors are represented by bold lowercase letters (e.g., ), the -entry of is represented by the notation of , the -dimensional identity matrix is represented by , the concatenation of two matrices is represented by the notation of , and the concatenation of two vectors is represented by the notation of .

2.1. Lattice Trapdoor

Our constructions will make use of the following results including the -trapdoor generation algorithm, sub-Gaussian sampling algorithm, and Gaussian sampling algorithm [26]. We only summarize the following lemmas here while neglecting the details of implementation because they are not strictly required.

Let be a distribution over which outputs 0 with a probability of 0.5, -1 with a probability of 0.25, and 1 with a probability of 0.25 (the notation of will be used throughout this paper to denote this distribution).

Given an integer , for any , define , where . The notation of will be used throughout this paper.

Lemma 1 (see [26]). Let be positive integers such that , , and . For , invertible , and , there exists an efficiently randomized algorithm GenTrap () to generate a matrix with trapdoor and tag such that is negl-far from uniform. The matrix is called the -trapdoor of with tag .

Lemma 2 (see [26, 27]). Given any matrix , there exists an efficiently randomized algorithm that samples a sub-Gaussian matrix with some constant parameter over such that , where the gadget matrix is specified as above.

Lemma 3 (see [26]). Using the parameters described in Lemma 1, given a uniformly random vector , there exists an efficient algorithm that samples a vector over for some and satisfying .

2.2. LWE

The learning with errors (LWE) problem plays an important role in lattice-based cryptography. Although a ring-based version is more efficient, this work is confined to LWE. We define the decisional LWE () problem as follows.

Definition 1. (DLWE) For positive integers and an error distribution over , let be the distribution of over , where , , and ; and additions are performed in . Given independent instances sampled either from the uniform distribution over or from , the decisional learning with errors () problem is to determine which distribution these samples come from. The DLWE assumption says that these two distributions are computationally indistinguishable.
For simplicity, is frequently used to denote and to denote for . It is generally known that the problem in the average case is as hard as approximation lattices problems with approximation factors of in the worst case by quantum or classical reductions, when [25, 26, 28, 29].
In this work, we rely on the matrix form of LWE denoted by MLWE.

Definition 2. (MLWE) For positive integers and an error distribution over , the problem is to distinguish between , where ; and additions are performed in , and sampled uniformly at random from .
Standard hybrid arguments show that MLWE is equivalent to DLWE with at most an factor loss in the distinguishing advantage.

2.3. GSW-FHE

In this subsection, a matrix version of GSW-FHE [4] is given. GSW.Setup: Given a security parameter , choose a lattice dimension , a sufficiently large m modulus , a number of LWE instances , and a -bounded error distribution . Set , , and . Output public parameters . GSW.KeyGen(): Randomly choose , , and . Compute . Let the secret key and public key be and . Note that . Output . GSW.Enc(): Choose random matrices . Set . Output the ciphertext . GSW.Dec: Let be the penultimate column vector of and let be any column of . Output , where maps a number to 0 if it is closer to 0 and to 1 if it is closer to . GSW.Eval: To homomorphically evaluate a function , perform homomorphic addition and multiplication in sequence.

Addition: .

Multiplication: .

This also allows us to compute a homomorphic NAND gate by outputting .

The correctness of decryption and homomorphic evaluation is obvious due to the correctness of the conventional GSW-FHE, and the semantic security is based on the MLWE assumption, which is in turn based on the DLWE assumption.

2.4. Compressible Single-Key FHE

Very recently, Gentry and Halevi proposed the first compressible single-key FHE. At a high level, their approach is based on two ideas: Using matrix versions of LWE and GSW-FHE [4]. Firstly, they noticed that the conventional GSW-FHE uses only one “slot” when decrypting, i.e., Their solution to utilize more “slots” is to use LWE with matrix secrets, which yields the matrix version of GSW-FHE described above. They added a compression algorithm after evaluation: where is the compressed ciphertext and is an matrix that has 1 in the row and column and 0’s in all other entries. Then the matrix secrets are used in the decryption algorithm: where . The compression rate is now bounded by . Using a “nearly square” gadget matrix. The second idea is to transform a “fat” compressed ciphertext matrix into a “nearly square” compressed ciphertext matrix using a “nearly square” gadget matrix with some special properties, which comes with almost no dimension expansion. On the other hand, attributed to , the redundancy in ciphertexts enables us to erase the noise and finally recover the message matrix. We omit the details of constructing the “nearly square” gadget matrix because it is not strictly required in this paper. The essential characteristic of that is required in our construction is that it has a “public trapdoor” matrix satisfying the following:(1) has small entries ();(2) (mod ), i.e., all rows of span the kernel space of modulo ;(3) is full rank over ;(4) is efficiently computable.

Then, the compression algorithms can produce an optimal rate compressed ciphertext. In particular, let be GSW ciphertexts encrypting . Set the compressed ciphertextwhere is an matrix that has 1 in the row and column and 0’s in all other entries.

Roughly speaking, they have now achieved an optimal compression rate because after “routine decryption” we getwhere . The compression rate is now , an optimal compression rate!

In particular, they upgrade the “routine decryption” into “compressed decryption” which is composed of four steps:(1) (mod ), where is a message matrix; is the nearly square gadget matrix; is a small error matrix;(2) (mod ), where is the public trapdoor matrix;(3) (note that is full rank over and it is required that every entry of does not wrap around );(4) (mod ) (note that is a row full-rank matrix modulo ).

Recall that the compression rate is the ratio of plaintext size to the ciphertext size. To achieve an optimal compression rate of for some small , set , where is the compression parameter defined as a function of the desired compression rate. Then the compression rate .

The additional compression algorithm does not compromise security and the key-generation, encryption, and evaluation algorithms are basically the same as the ones of matrix version of GSW-FHE. Thus, the semantic security of their compressible FHE is based solely on the DLWE assumption. However, the compressed ciphertexts are not GSW ciphertexts any longer, which means they can only support homomorphic addition and multiplication on the left by some GSW ciphertexts encrypting a small scalar. For more information, please refer to [23].

3. Compressible Multikey Fully Homomorphic Encryption

In this section, utilizing the idea of our new compressible expansion algorithm described in Section 1.1, we propose the first compressible MKFHE scheme and analyze the correctness and security level of the construction.

3.1. Compressible Multikey FHE

We begin with the definition of compressible MKFHE, which is adapted from the definitions of compressible FHE in [23] and MKFHE in [7].

Definition 3. A compressible multikey fully homomorphic encryption scheme consists of seven PPT algorithms defined as follows: : Take a security parameter and a bound on the number of users involved as inputs and output parameters . is taken in as an input in all of the following algorithms; thus, we just omit it. : Output a secret key and a public key for the user. : Take a public key and a bit as inputs, and output a fresh low-rate ciphertext . : Take public keys and a fresh ciphertext under the public key as inputs; and compute and output an expanded low-rate ciphertext under ’s public keys . : Take a circuit and a vector of expanded ciphertexts as inputs, corresponding to each input bit of , and output another vector of evaluated low-rate ciphertext , corresponding to each output bit of . : Take a vector of expanded or evaluated low-rate ciphertexts as inputs, and output one or more compressed high-rate ciphertext(s) . : Take secret keys , corresponding to identities , and the compressed ciphertext(s) as inputs, and output a vector of message bits corresponding to .The scheme is said to be correct if, for every allowed circuit and a vector of message bits corresponding to each input bit of , it holds thatwhere each .
Using the parameters described above, the scheme is said to have a compression rate of for any if, for every allowed circuit that has sufficiently long outputs, the compression rateThe semantic security definition for compressible multikey fully homomorphic encryption is the same as that for multikey fully homomorphic encryption, which is the same as that for single-key fully homomorphic encryption because all of parameters used in the expansion and compression algorithms are public and thus do not compromise security. In particular, given a security parameter and a bound on the number of users involved, the following distributions are computationally indistinguishable:where and . We do not consider the distributed decryption for our MKFHE scheme, which can be used to construct round-efficient secure multiparty computation protocols, and instead put the main focus on the compressible expansion algorithm.

3.2. Our Construction

 C-MKFHE.Setup: Choose a lattice dimension parameter , a sufficiently large modulus , a -bounded error distribution , and a compression parameter . The parameter will be specified in Subsection 3.3.2. All of the rows of the nearly square gadget matrix span the kernel space of its public trapdoor matrix having the properties stated in 2.4. Let , , , , and . Then, set and . Choose a random matrix . Output . C-MKFHE.KeyGen(): Choose random matrices and . Compute . Let the secret key and public key be and . Note that . Output . C-MKFHE.Enc(): Given a message bit , randomly select a matrix . Set Then, partition as follows: where . Let be the last columns of . Note that For , compute where and . Set Output a tuple of encryption  C-MKFHE.Exp(): For every , compute that is, , where is an matrix that has in the row and the column and 0’s in all other entries. Set Compute Finally, expand a fresh ciphertext to an expanded one. Output . C-MKFHE.Comp: In this algorithm, a series of low-rate expanded (or evaluated) ciphertexts are compressed into a high-rate ciphertext. Let , where is an matrix that has in the row and the column and 0’s in all other entries. Set the compressed ciphertext as Note that the nearly square gadget matrix and its public trapdoor play a significant role in the compression and compressed decryption algorithms. C-MKFHE.CompDec: Given a compressed ciphertext , set the combined key . The compressed decryption is composed of four steps:(1) (mod );(2) (mod ), where is the public trapdoor matrix;(3) (note that is full rank over );(4) (mod ) (note that is a row full-rank matrix modulo , so that there exists a matrix such that ). C-MKFHE.NAND: Given two expanded ciphertext matrices for two plaintexts , homomorphic NAND operation is defined as Output . Observe that is randomized, and so is this algorithm. C-MKFHE.Eval: An NAND-circuit is applied to a set of ciphertexts , which leads to a ciphertext .