fixed-point arithmetic in she schemes · fixed-point arithmetic in she schemes anamaria costache1,...

Fixed-Point Arithmetic in SHE Schemes

Anamaria Costache1, Nigel P. Smart1, Srinivas Vivek1,

Adrian Waller2

1University of Bristol

2Thales UK Research & Technology

July 6, 2016

Outline

Motivation

Encoding integers and fixed-point numbers

Lower bounds on ring parameters

Application to homomorphic image processing

Conclusion

Motivation

Somewhat Homomorphic Encryption

Huge improvement in efficiency of FHE schemes since 2009.

Yet, practical FHE schemes seem out of reach.

Goal: to obtain practical SHE schemes for a given class of functions.

Problem 1

Problem 1: how to encode/decode data types of an application into

an SHE scheme?

Application: emulate fixed point arithmetic.

Target SHE schemes: ring-based SHE schemes

I currently among the most efficient,

I plaintext space R = Z[x ]/(Φm(X ), p).

Encoding considerably effects efficiency

I working with binary circuits is usually inefficient in practice.

Problem 1

an SHE scheme?

Problem 1

an SHE scheme?

Problem 1

an SHE scheme?

Problem 2

The parameters of an SHE scheme depends upon

I multiplicative depth,

I plaintext modulus p and degree of the ring d ,

I security level

Problem 2: derive lower bounds on

I plaintext modulus p

F to ensure no wrap around the modulus p,

I degree of the ring d

F to ensure no wrap around the modulus Φm(X ),

Problem 2

I security level

Problem 2

I security level

Problem 2

I security level

Problem 1: Encoding data types

Encoding integers: Scalar encoding

Integer encoded as the constant term.

p must be greater than the largest integer occurring.

For a regular circuit of

I multiplicative depth: M

I No. of additions per multiplicative depth: A,

I and for inputs in [−L, . . . , L]

p > 2 · 2A(2M+1−2) · L2M .

Encoding integers: Non-balanced base-B encoding

Integer encoded as a polynomial corresponding to base-B expansion.

I coefficients in [0, ..,B − 1].

Example: 19 7→ 2 · X 2 + 1, when base B = 3.

Smaller-sized coefficients compared to scalar encoding.

Every coefficient has the same sign.

Encoding integers: Balanced base-B encoding

I coefficients instead in [−(B − 1)/2, . . . , (B − 1)/2].

Example: 19 7→ X 3 − X 2 − X − 1, when bal. base B = 3.

Tradeoff : size of coefficients and the degree of encodings.

B = 3 turns out be optimal.

Deriving bounds on the size of coefficients is more challenging.

Encoding fixed-point numbers: Scaled integer encoding

Fixed-point number encoded as an integer scaled down by a power of

a base B.

y = y+.y− 7→ (q(X ), i), y = q(B) ∗ B−i ,

where the integer itself is represented by a balanced base-B encoding.

Example: 6.33 . . . = 19× 3−1 7→ (X 3 − X 2 + 1, 1), when bal. base

B = 3.

Fixed-point number encoded as an integer scaled down by a power of

a base B.

y = y+.y− 7→ (q(X ), i), y = q(B) ∗ B−i ,

where the integer itself is represented by a balanced base-B encoding.

Example: 6.33 . . . = 19× 3−1 7→ (X 3 − X 2 + 1, 1), when bal. base

B = 3.

Addition +:

(q(X ), i) + (q′(X ), i ′) =: (Q, I ).

(Q, I ) =

(q + q′ · X i−i ′ , i) if i > i ′

(q′ + q · X i ′−i , i ′) if i ′ ≥ i .

Multiplication ×:

(q(X ), i) × (q′(X ), i ′) = (q(X ) · q′(X ), i + i ′).

Addition +:

(q(X ), i) + (q′(X ), i ′) =: (Q, I ).

(Q, I ) =

(q + q′ · X i−i ′ , i) if i > i ′

(q′ + q · X i ′−i , i ′) if i ′ ≥ i .

Multiplication ×:

(q(X ), i) × (q′(X ), i ′) = (q(X ) · q′(X ), i + i ′).

Let R1 = {(q, i) | q ∈ Z[X ]/Φm(X ), i ∈ Z/φ(m)Z}.

R1 is a ring w.r.t. + and ×.

Disadvantage: Keep track of the exponent i in the clear for every

ciphertext

I not an issue if the evaluated circuit is public.

Bounds: same as the balanced base integer representation

ciphertext

Encoding fixed-point numbers: Fractional encoding

Proposed by [Dowlin et al. 2015].

Closely related to Laurent polynomial representation.

Suppose we are working in Z[X ]/(X n + 1).

y = y+.y− 7→∑i≤I+

bi · X i +∑

0<i≤I−b−i · X−i (mod X n + 1),

Since −X n ≡ 1 (mod X n + 1),

y = y+.y− 7→∑i≤I+

bi · X i −∑

0<i≤I−b−i · X n−i (mod X n + 1).

y = y+.y− 7→∑i≤I+

bi · X i +∑

0<i≤I−b−i · X−i (mod X n + 1),

y = y+.y− 7→∑i≤I+

bi · X i −∑

0<i≤I−b−i · X n−i (mod X n + 1).

y = y+.y− 7→∑i≤I+

bi · X i +∑

0<i≤I−b−i · X−i (mod X n + 1),

y = y+.y− 7→∑i≤I+

bi · X i −∑

0<i≤I−b−i · X n−i (mod X n + 1).

y = y+.y− 7→∑i≤I+

bi · X i +∑

0<i≤I−b−i · X−i (mod X n + 1),

y = y+.y− 7→∑i≤I+

bi · X i −∑

0<i≤I−b−i · X n−i (mod X n + 1).

Example: in Z[X ]/(X 8 + 1) and bal. base B = 3,

I 6.33 . . . 7→ −X 7 + X 2 − X .

Advantage: ”Dispenses away” the need for tracking the exponent

I need to separate coefficients in integer and fractional parts.

Disadvantage

I works only in power-of-two cyclotomic rings,

I no slots for SIMD operations.

Addition and Multiplication: as in R2 := Z[X ]/(X n + 1).

Bounds: seems more complicated than the scaled integer case?

I 6.33 . . . 7→ −X 7 + X 2 − X .

Disadvantage

I 6.33 . . . 7→ −X 7 + X 2 − X .

Disadvantage

I 6.33 . . . 7→ −X 7 + X 2 − X .

Disadvantage

I 6.33 . . . 7→ −X 7 + X 2 − X .

Disadvantage

Problem 2: bounding size of coefficients

Upper bounds on coefficients

Problem: compute max. size of coefficients in encodings given

I circuit description,

I bounds on input numbers

Our contribution:

I efficient computational procedure to bound arbitrary circuits

F precisely determining max. values can be very expensive,

I closed form upper bounds for regular circuits.

Problem: compute max. size of coefficients in encodings given

I circuit description,

I bounds on input numbers

Our contribution:

I efficient computational procedure to bound arbitrary circuits

F precisely determining max. values can be very expensive,

I closed form upper bounds for regular circuits.

Two cases:

I balanced base-3 integer encoding ≡ scaled integer encoding,

I fractional encoding (modulo X n + 1) for fixed-point numbers.

Equivalence: scaled integer vs. fractional encoding

Ring R1 of scaled integer encodings

I R1 := {(q, i) | q ∈ Z[X ]/(X n + 1), i ∈ Z/nZ)} .

Ring R2 of fractional encodings

I R2 := Z[X ]/(X n + 1).

R1 is isomorphic to R2

R1 → R2

(q := qI · X i + qF , i) 7→ qI − qF · X n−i

I R1 := {(q, i) | q ∈ Z[X ]/(X n + 1), i ∈ Z/nZ)} .

I R2 := Z[X ]/(X n + 1).

R1 → R2

I R1 := {(q, i) | q ∈ Z[X ]/(X n + 1), i ∈ Z/nZ)} .

I R2 := Z[X ]/(X n + 1).

R1 → R2

Example: encoding 6.33

I using balanced base-3 representation and Z[X ]/(X 8 + 1),

I scaled integer encoding (R1): (X 3 − X 2 + 1, 1),

I fractional encoding (R2): −X 7 + X 2 − X ,

(X 3 − X 2 + 1) · (−X 7) = −X 7 + X 2 − X (mod X 8 + 1).

Note: infinity norm of intermediate polynomials is identical for any

circuit.

Suffices to analyse only the integer case.

(X 3 − X 2 + 1) · (−X 7) = −X 7 + X 2 − X (mod X 8 + 1).

circuit.

(X 3 − X 2 + 1) · (−X 7) = −X 7 + X 2 − X (mod X 8 + 1).

circuit.

Bounding integer-valued arithmetic circuits

Suppose there are t distinct input ranges [−Li , . . . , Li ].

di : degree of corresponding balanced base-3 encoding polynomials.

Input encoding polynomials have infinity norm 1.

Define

c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏

(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.

Define

c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏

(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.

Define

c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏

(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.

Define

c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏

(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.

Upper bound is of the form

LP =∑

e1,...,et

a[(d1,e1),...,(dt ,et)] · c[(d1,e1),...,(dt ,et)],

Compute the bounds iteratively

LP =∑

e1,...,et

a[(d1,e1),...,(dt ,et)] · c[(d1,e1),...,(dt ,et)],

LP′ =∑

e′1,...,e′t

a[(d1,e′1),...,(dt ,e′t)] · c[(d1,e′1),...,(dt ,e′t)],

Compute the bounds iteratively

LP+P′ = LP + LP′ ,

LP·P′ =∑

e1,...,et ,e′1,...,e′t

(a[(d1,e1),...,(dt ,et)] · a[(d1,e′1),...,(dt ,e′t)]

c[(d1,e1+e′1),...,(dt ,et+e′t)]

Iteratively bounding

c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏

(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.

using the relation

c[(d1,e1),...,(dt ,et)] ≤ (dk · ek + 1) · cdk ,ek · c[(d1,e′1),...,(dt ,e′t)],

where e ′i = ei except that e ′k = 0.

Partial order: di · ei ≤ (di+1 · ei+1).

Iteratively bounding

c[(d1,e1),...,(dt ,et)] =∥∥∥ t∏

(1 + x + x2 + . . .+ xdi )ei∥∥∥∞.

using the relation

c[(d1,e1),...,(dt ,et)] ≤ (dk · ek + 1) · cdk ,ek · c[(d1,e′1),...,(dt ,e′t)],

where e ′i = ei except that e ′k = 0.

Partial order: di · ei ≤ (di+1 · ei+1).

Finally, bounding

cd ,e =∥∥∥(1 + x + x2 + . . .+ xd)e

∥∥∥∞.

Simple bounds: (d+1)e

d ·e+1 ≤ cd ,e ≤ (d + 1)e .

Tighter bound [Mattner & Roos 2008]: If e 6= 2 or d ∈ {1, 2, 3},

cd ,e <

π · d · e · (d + 2)· (d + 1)e .

Finally, bounding

cd ,e =∥∥∥(1 + x + x2 + . . .+ xd)e

∥∥∥∞.

d ·e+1 ≤ cd ,e ≤ (d + 1)e .

cd ,e <

π · d · e · (d + 2)· (d + 1)e .

Finally, bounding

cd ,e =∥∥∥(1 + x + x2 + . . .+ xd)e

∥∥∥∞.

d ·e+1 ≤ cd ,e ≤ (d + 1)e .

cd ,e <

π · d · e · (d + 2)· (d + 1)e .

They also show that

lime→∞

√e · cd ,e

(d + 1)e=

π · d · (d + 2).

For a regular circuit having

I M levels of multiplication,

I A additions per multiplicative level,

I max. initial degree of encodings d = dlog(2 · L + 1)/ log 3e − 1,

BM,A = cd,2M · 2A(2M+1−2),

BM,A <

π · 2M · d(d + 2)· (d + 1)2

· 2A(2M+1−2).

I For an SHE scheme

p > 2 · BM,A, deg(R) > 2M · d .

BM,A <

π · 2M · d(d + 2)· (d + 1)2

· 2A(2M+1−2).

I For an SHE scheme

p > 2 · BM,A, deg(R) > 2M · d .

Concrete bounds for p (in bits) and deg(R) for 20-bit inputs:

M 1 2 3 4 5

A = 0 5 12 26 55 114

A = 1 7 18 40 85 176

A = 2 9 24 54 115 238

A = 3 11 30 68 145 300

A = 4 13 36 82 175 362

A = 5 15 42 96 205 424

deg(R) 24 48 96 192 384

Application: homomorphic image processing

Homomorphic image processing

FFT - Hadamard product - iFFT: standard image processing pipeline.

We performed a homomorphic evaluation of this pipeline

I matrix for Hadamard product was also encrypted,

I encrypted inputs were complex numbers

F FFT and HAD inputs: 8-bits precision,

F precision of roots of unity is variable - result to be within 32-bits

precision.

The whole operation is non-linear

I cannot apply additive homomorphic schemes.

precision.

We use mixed Fourier transform instead of FFT

I tradeoff: depth vs. number of scalar multiplications,

I greater depth means longer modulus chain in SHE scheme and hence

slower.

Concrete parameters for the FFT-Hadamard-iFFT pipeline:

FFT B = 1 B =√n NFT B = n

log2 p deg(R) log2 p deg(R) log2 p deg(R)

n ≥ ≥ ≥ ≥ ≥ ≥

16 54 190 37 118 25 46

64 74 248 49 146 29 44

256 93 298 61 170 33 42

1024 112 340 72 190 37 40

Timing results (in sec) using HElib running on a 6-core cluster:

HElib Amortization CPU Amortized

n B deg(R) log2 q Levels Amount Time Time

16 1 32768 710 33 172 188 1.09

16 4 32768 451 19 277 147 0.53

16 16 16384 192 9 356 106 0.3

64 8 32768 622 30 224 1500 6.69

64 64 16384 192 10 372 1582 4.25

256 256 16384 278 11 390 34876 89.4

Conclusion

We investigated the growth of coefficients and the degree for various

encoding schemes.

Proved the equivalence of scaled integer and fractional encodings for

fixed-point numbers.

Computed concrete bounds for regular circuits.

Implemented homomorphic evaluation of FFT-Hadamard

product-iFFT pipeline used in image processing.

Conclusion

encoding schemes.

Conclusion

encoding schemes.

Conclusion

encoding schemes.

Future Work

Improve the current bounds for coefficient growth.

SIMD implementation of FFT-Hadamard product-iFFT pipeline for

scaled integer encoding.

Future Work

Improve the current bounds for coefficient growth.

SIMD implementation of FFT-Hadamard product-iFFT pipeline for

scaled integer encoding.

Thank You!

fixed-point arithmetic in she schemes · fixed-point arithmetic in she schemes anamaria costache1,...

Documents