Thales B. Paiva
Future Security Team, LG Electronics USA, Inc., New Jersey, USA

Gabrielle De Micheli
Future Security Team, LG Electronics USA, Inc., New Jersey, USA

Syed Mahbub Hafiz
Future Security Team, LG Electronics USA, Inc., New Jersey, USA

Marcos A. Simplicio Jr.
Future Security Team, LG Electronics USA, Inc., New Jersey, USA; Universidade de São Paulo, São Paulo, Brazil

Bahattin Yildiz
Future Security Team, LG Electronics USA, Inc., New Jersey, USA

Keywords: Fully homomorphic encryption, FHEW/TFHE, amortized bootstrapping, incomplete NTT, efficient implementation

Abstract

Amortized bootstrapping techniques have been proposed for FHEW/TFHE to efficiently refresh multiple ciphertexts simultaneously within a polynomial modulus. Although recent proposals have very efficient asymptotic complexity, reducing the amortized cost essentially to Õ(1) FHE multiplications, the practicality of such algorithms still suffers from substantial overhead and high decryption failure rates (DFR). In this study, we improve upon one of the state-of-the-art amortized bootstrapping algorithms (Guimarães et al., ASIACRYPT 2023) for FHEW/TFHE-like schemes by introducing an alternative algorithmic strategy. Specifically, we combine Guimarães et al.’s strategy based on a two-part NTT with an incomplete Number Theoretic Transform (NTT) algorithm. The resulting construction is such that the multiplication of higher-degree polynomials that would usually create a bottleneck in an incomplete NTT setting actually comes for free. As a result, we demonstrate a 2.12x speedup compared to the algorithm of Guimarães et al. and a 1.12x improvement over the state-of-the-art (sequential) TFHE-rs while achieving a DFR close to 2−32 for 7-bit messages, although the DFR is higher for 8-bit messages. We also explore trade-offs between execution time and DFR, identifying parameter sets that improve the execution time of Guimarães et al. by 1.41x, while simultaneously reducing the DFR by a factor of 2−22 for 8-bit messages.