All Questions
Tagged with homomorphic-encryption lattice-crypto
23 questions with no upvoted or accepted answers
5
votes
0
answers
491
views
ring-LWE: Minkowski Embedding , the Co-Different Ideal, etc
While (trying) to go over the reductions from approx. SVP on ideal lattices to search ring-LWE, [1] and [2], for $K = \mathbb{Q}(\zeta)$ where $\zeta$ is an abstract root of a cyclotomic polynomial, ...
- 678
3
votes
0
answers
275
views
The decryption correctness of RLWE based Encryption
I get stuck in the proof of decryption correctness in RLWE based Cryptosystem. To state where I am , let me show the full scheme first. The image is from chapter 3.2 of this paper.
And the decryption ...
- 75
2
votes
1
answer
319
views
Avoid CKKS Bootstraping
CKKS is a levelled scheme, because the rescale $\lfloor\frac{x}{\Delta}\rceil$ operation requires truncating a modulus to be efficiently evaluated, and rescale is (usually) needed after every ...
- 51
2
votes
0
answers
48
views
Why could the error term be sampled coefficient wise?
In SEAL homomorphic encryption library, it implements the BFV and CKKS. We know the error $e\in R_q$ which is a Guassian distribution. When sampling an error term $e = \sum_{i=0}^{n-1} e_ix^i$, it ...
- 519
2
votes
0
answers
157
views
Why should the smudge noise be used?
Consider a threshold FHE scheme based on RLWE like this:
Refer to this paper
$\textbf{Initialization:}$
Every party generates his own secret key $s_i$, then uses the common polynomial $a$ to generate ...
- 519
2
votes
0
answers
186
views
Can binomial distribution be used to sample noise for Ring-LWE-based homomorphic encryption?
Homomorphic encryption schemes based on Ring-LWE need to sample the noise terms from a discrete probability distribution $\chi$ over the integers with support $[-B,B]$. For example, the Fan-...
- 438
1
vote
0
answers
38
views
Understanding FHE bootstrapping: value of $q$ fed to lattice estimator
I am implementing OpenFHE. In the implementation I'm generating the modulus chain as shown in the example here. I am trying to run Lattice estimator for the same parameters in this example.
I wanted ...
- 19
1
vote
0
answers
77
views
Difference between TFHE and CKKS?
What are the differences in parameters while implementing CKKS vs TFHE?
For example modulus size, ring dimensions, bit security. Any pointers to literature would be appreciated
- 19
1
vote
0
answers
113
views
Understanding Gentry's initial FHE construction based on ideal lattices
I am trying to understand the encryption procedure in Craig Gentry's initial construction for FHE described in Fully Homomorphic Encryption Using Ideal Lattices. Unfortunately after repeated attempts ...
- 111
1
vote
0
answers
129
views
Why there is so high computational cost of multiplication in Microsoft Seal?
I was doing some Microsoft Seal testing on my macbook pro (i7) and got following results
Coefficient mod $q = 100$ bits and Polynomial degree $n= 8192$
Ciphertext-Plaintext multiplication takes 0.211 ...
- 251
1
vote
0
answers
402
views
Key Switching Error in CKKS
I believe I am misunderstanding something about the bounds derived for the key switching error in CKKS. I will refer to the initial paper, but similar bounds have been derived in all variants I have ...
- 14.6k
1
vote
0
answers
52
views
Effect of small secret attacks on non homomorphic encryption schemes
The new paper by Albrecht describes a new attack on "unusually" small secrets that are used in homomorphic encryption schemes.
In the paper the talk about binary secrets or LWE Normal form i.e $\...
- 1,295
0
votes
0
answers
28
views
Issue building RLWE based program
I've successfully built a LWE based program now moving onto building a RLWE based python program using: https://blog.openmined.org/build-an-homomorphic-encryption-scheme-from-scratch-with-python/ as a ...
0
votes
0
answers
21
views
Tutorial of lattice estimator to compute a specific function with BGV
I recently try to go into lattice estimator https://github.com/malb/lattice-estimator
I did find the document of it, but unfortunately, can not follow.
May I ask how to run the lattice estimator to ...
- 371
0
votes
0
answers
84
views
CKKS encoding. Why not just use fft
I am studying the ckks scheme from this blog post. In the vanilla encoding part we want to encode a complex vector of size N to a complex polynomial of degree N-1. This of course is possible if we ...
0
votes
0
answers
26
views
Urgent help with R-LWE Parameters Choice
I am trying to understand CKKS bootstrap algorithm and wanted to understand how is p (plaintext modulo) and q (ciphertext modulo) related in determining the size of the modulus chain. Suppose my ring ...
- 19
0
votes
0
answers
24
views
Is there any bound on the size of ring dimension for Torus FHE?
I see that all implementations of TFHE in opensource supports 2^10 to 2^12 size of ring dimensions. Is there any specific reason (crypto) behind choosing the value or can we choose higher dimensions (...
- 19
0
votes
0
answers
94
views
[About choosing params in BGV like ciphertexts]
I am new to lattice-based cryptography, so sorry that this question might seems stupid
May I ask that how can I choose the BGV parameter of ciphertext with plain text in mod 128, and error in ...
- 371
0
votes
0
answers
62
views
GSW and homomorphic addition on integers
Is it possible to use the GSW scheme (Gentry, Sahai, Waters) also on integer values and not just single bits? If not, are there any schemes that support integer arithmetic with the same nice property ...
- 1
0
votes
0
answers
72
views
GSW13 scheme and integer arithmetic
I'm new to lattice-based cryptography and have trouble understanding if the GSW13 (Gentry, Sahai, Waters) scheme works only on single bits. But is it also possible to encrypt integers with this scheme ...
- 1
0
votes
0
answers
76
views
Hash chain based secret revealing using homorphic princples?
I have recently been looking into Homomorphic encryption and I am looking for a specific hash-based encryption/decryption scheme.
I don't need a full implementation but I am not sure if what I want ...
- 155
0
votes
0
answers
115
views
How is the security of a plaintext of Ring-LWE without an error term?
I think until public key $\mathsf{pk}=(b=-[as + e]_q,a) $ is broken, Ring-LWE is secure where $a$ is uniformaly random polynomial, $e$ is an error sampled from gaussian distribution with std=$\sigma$ ...
- 1,685
-1
votes
1
answer
154
views
Urgent help with LWE Estimator
I am trying to estimate LWE parameters. I know of the GitHub library for LWE estimator but it has no instructions for installation and also provides no guidance for running simple examples. I have ...
- 19