目前大部分内容翻译自维基百科, 后续会根据调研情况不断丰富.
基本概念
同态加密(Homomorphic encryption) 是一种可以支持在密文上进行计算的加密方式, 对在密文上计算得到的结果进行解密后得到的内容与直接在明文上做计算的结果是相同的.
应用安全外包计算(secure outsourced computation), 如安全云计算服务
不同实体之间的安全协作, 如计算汇率, 税费等等
其他安全系统, 如安全投票系统, 抗碰撞哈希函数, PSI(private set intersection), PIR(private information retrieval)方案.
特点延展性(malleability). 从延展性的角度, 同态加密方案比非同态的方案在安全特性上更弱.
全同态加密
全同态加密 (fully homomorphic encryption, FHE) 是指支持对密文进行任意计算的密码系统. 通过FHE方案可以通过程序接收加密后的输入并产生加密形式的输出结果, 从而实现任意想要的功能, 并且这些操作可以由不可信方在不恢复出输入和中间状态对应的明文的情况下来执行. FHE在云环境下有广泛的应用前景.
现有的同态加密系统The Brakerski-Gentry-Vaikuntanathan cryptosystem (BGV) [1] (基于 Brakerski-Vaikuntanathan 的方案[2]).
Brakerski’s scale-invariant cryptosystem [3].
The NTRU-based cryptosystem due to Lopez-Alt, Tromer, and Vaikuntanathan (LTV) [4].
The Gentry-Sahai-Waters cryptosystem (GSW) [5].
The Brakerski/Fan-Vercauteren cryptosystem (BFV) [6].
The Cheon-Kim-Kim-Song cryptosystem (CKKS) [7].
上述大多数方案都是基于LWE(Learning with errors)问题, LTV方案是基于NTRU计算性问题的变种, BFV方案基于Ring-LWE问题的变种. 这些密码学方案的显著特征就是它们在进行同态计算的过程中噪声的增长速度很慢.
Craig Gentry, Shai Halevi 和 Nigel Smart 提出的优化方案[8 — 10]实现了最理想的渐进复杂度: 对在安全参数 下加密的数据执行 次操作的复杂度只有 . 这些优化基于 Smart-Vercauteren 技术, 该技术可以把多个明文打包在单个密文中并以 SIMD 方式[11]对这些明文进行操作. 这些第二代的密码系统中的很多优势也被移植到了整数上的密码系统中[12, 13].
Zvika Brakerski 和 Vinod Vaikuntanathan 发现对于特定类型的电路, GSW方案有更慢的噪声增长速度, 因此也具有更好的性能和更强的安全性[14]. 随后 Jacob Alperin-Sheriff 和 Chris Peikert 利用这一类电路提出了一个非常有效的 bootstrapping 技术[15]. 然而, 这种类型的电路看起来与密文打包技术不相容, 因此 Gentry-Halevi-Smart 优化方法[8]在这里不适用.
所有的第二代密码系统仍然遵循 Gentry 最初方案的基本设想, 也就是先构造一个可以处理密文噪声的某种程度上同态的加密方案, 然后通过 bootstrapping 将其转化为一个全同态方案.
同态加密方案的实现
开源库名称
实现的同态加密方案
HElib [16]
GHS优化的BGV
PALISADE [17]
BFV, BGV
HEAAN [18]
CKKS including a bootstrapping algorithm [19]
Microsoft SEAL [20]
BFV, CKKS
FHEW [21]
Regev’s LWE cryptosystem with the bootstrapping techniques of Alperin-Sheriff and Peikert
TFHE [22]
Faster variant over the Torus with an intuitive API to evaluate boolean circuits
bootstrapping的实现: HElib 需要 5 — 10 分钟来 bootstrapping 一个包含1000个明文值的密文[23], FHEW 需要大概 秒来 bootstrapping 一个未打包的单比特数据对应的密文[24], TFHE 需要 13 毫秒来评估已经自扩展的任意未打包单比特数据对应密文上的二进制门[25], HEAAN 需要 2 分钟来 bootstrapping一个以12比特精度打包的128比特明文对应的密文[19].
底, 利用HElib实现的对AES加密电路的同态评估显示对于120个输入的评估时间只有4分多钟, 也就是说每个输入分摊的评估时间大约为2秒.
同态加密的历史
1978 年就有人提出了构造全同态加密方案的问题[26] (和RSA的提出同一年), 之后的30年, 对应的解决方案是否存在一直是个未知数, 在这段时间中出现的成果包括解决了对数深度电路问题的 Sander-Young-Yung 系统[27], 支持对不限数量的加法但是最多一次乘法操作进行评估的 Boneh-Goh-Nissim 密码系统[28], 以及支持对多项式大小分支程序进行评估的 Ishai-Paskin 密码系统[29].
References
[1] Z. Brakerski, C. Gentry, and V. Vaikuntanathan. Fully Homomorphic Encryption without Bootstrapping. In ITCS
[2] Z. Brakerski and V. Vaikuntanathan. Efficient Fully Homomorphic Encryption from (Standard) LWE. In FOCS (IEEE)
[3] Z. Brakerski. Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP. In CRYPTO (Springer)
[4] A. Lopez-Alt, E. Tromer, and V. Vaikuntanathan. On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption. In STOC (ACM)
[5] C. Gentry, A. Sahai, and B. Waters. Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based. In CRYPTO (Springer)
[6] Fan, Junfeng; Vercauteren, Frederik (). “Somewhat Practical Fully Homomorphic Encryption”.
[7] Cheon, Jung Hee; Kim, Andrey; Kim, Miran; Song, Yongsoo (). “Homomorphic encryption for arithmetic of approximate numbers”. Takagi T., Peyrin T. (eds) Advances in Cryptology – ASIACRYPT . ASIACRYPT . Springer, Cham. pp. 409–437. doi:10.1007/978-3-319-70694-8_15.
[8] C. Gentry, S. Halevi, and N. P. Smart. Fully Homomorphic Encryption with Polylog Overhead. In EUROCRYPT (Springer)
[9] C. Gentry, S. Halevi, and N. P. Smart. Better Bootstrapping in Fully Homomorphic Encryption. In PKC (SpringeR)
[10] C. Gentry, S. Halevi, and N. P. Smart. Homomorphic Evaluation of the AES Circuit. In CRYPTO (Springer)
[11] Smart, Nigel P.; Vercauteren, Frederik (). “Fully Homomorphic SIMD Operations”. Designs, Codes and Cryptography. 71 (1): 57–81.
[12] Coron, Jean-Sébastien; Lepoint, Tancrède; Tibouchi, Mehdi (). “Batch Fully Homomorphic Encryption over the Integers”. Eurocrypt .
[13] Coron, Jean-Sébastien; Lepoint, Tancrède; Tibouchi, Mehdi (). “Scale-Invariant Fully Homomorphic Encryption over the Integers”. Pkc .
[14] Z. Brakerski and V. Vaikuntanathan. Lattice-Based FHE as Secure as PKE. In ITCS
[15] J. Alperin-Sheriff and C. Peikert. Faster Bootstrapping with Polynomial Error. In CRYPTO (Springer)
[16] Shai Halevi; Victor Shoup. “HElib: An Implementation of homomorphic encryption”. Retrieved 31 December .
[17] [palisade- “PALISADE Lattice Cryptography Library”] Check |url= value (help). Retrieved 1 January .
[18] Jung Hee Cheon; Kyoohyung Han; Andrey Kim; Miran Kim; Yongsoo Song. “Homomorphic Encryption for Arithmetic of Approximate Numbers”. Retrieved 15 May .
[19] Jung Hee Cheon, Kyoohyung Han, Andrey Kim, Miran Kim and Yongsoo Song. Bootstrapping for Approximate Homomorphic Encryption. In EUROCRYPT (springer).
[20] Microsoft Research. “Microsoft SEAL”. Retrieved 20 February .
[21] Leo Ducas; Daniele Micciancio. “FHEW: A Fully Homomorphic Encryption library”. Retrieved 31 December .
[22] Ilaria Chillotti; Nicolas Gama; Mariya Georgieva; Malika Izabachene. “Faster Fully Homomorphic Encryption: Bootstrapping in less than 0.1 Seconds”. Retrieved 31 December .
[23] Halevi, Shai; Shoup, Victor. “Bootstrapping for HElib”. Cryptology ePrint archive. Retrieved 2 January .
[24] Ducas, Léo; Micciancio, Daniele. “FHE Bootstrapping in less than a second”. Cryptology ePrint archive. Retrieved 2 January .
[25] Chillotti, Ilaria; Gama, Nicolas; Georgieva, Mariya; Izabachene, Malika. “Improving TFHE: faster packed homomorphic operations and efficient circuit bootstrapping”. Cryptology ePrint archive. Retrieved 2 May .
[26] R. L. Rivest, L. Adleman, and M. L. Dertouzos. On data banks and privacy homomorphisms. In Foundations of Secure Computation, 1978.
[27] Sander, Tomas; Young, Adam L.; Yung, Moti (1999). Non-Interactive CryptoComputing For NC1. Focs1991. pp. 554–566. doi:10.1109/SFFCS.1999.814630. ISBN 978-0-7695-0409-4.
[28] D. Boneh, E. Goh, and K. Nissim. Evaluating 2-DNF Formulas on Ciphertexts. In Theory of Cryptography Conference, .
[29] Y. Ishai and A. Paskin. Evaluating branching programs on encrypted data. In Theory of Cryptography Conference, .
