Annual International Conference on the Theory and Applications of Cryptographic Techniques

EUROCRYPT 2011: Advances in Cryptology – EUROCRYPT 2011 pp 129-148

Implementing Gentry’s Fully-Homomorphic Encryption Scheme

  • Craig Gentry
  • Shai Halevi
Conference paper

DOI: 10.1007/978-3-642-20465-4_9

Volume 6632 of the book series Lecture Notes in Computer Science (LNCS)
Cite this paper as:
Gentry C., Halevi S. (2011) Implementing Gentry’s Fully-Homomorphic Encryption Scheme. In: Paterson K.G. (eds) Advances in Cryptology – EUROCRYPT 2011. EUROCRYPT 2011. Lecture Notes in Computer Science, vol 6632. Springer, Berlin, Heidelberg

Abstract

We describe a working implementation of a variant of Gentry’s fully homomorphic encryption scheme (STOC 2009), similar to the variant used in an earlier implementation effort by Smart and Vercauteren (PKC 2010). Smart and Vercauteren implemented the underlying “somewhat homomorphic” scheme, but were not able to implement the bootstrapping functionality that is needed to get the complete scheme to work. We show a number of optimizations that allow us to implement all aspects of the scheme, including the bootstrapping functionality.

Our main optimization is a key-generation method for the underlying somewhat homomorphic encryption, that does not require full polynomial inversion. This reduces the asymptotic complexity from \(\tilde{O}(n^{2.5})\) to \(\tilde{O}(n^{1.5})\) when working with dimension-n lattices (and practically reducing the time from many hours/days to a few seconds/minutes). Other optimizations include a batching technique for encryption, a careful analysis of the degree of the decryption polynomial, and some space/time trade-offs for the fully-homomorphic scheme.

We tested our implementation with lattices of several dimensions, corresponding to several security levels. From a “toy” setting in dimension 512, to “small,” “medium,” and “large” settings in dimensions 2048, 8192, and 32768, respectively. The public-key size ranges in size from 70 Megabytes for the “small” setting to 2.3 Gigabytes for the “large” setting. The time to run one bootstrapping operation (on a 1-CPU 64-bit machine with large memory) ranges from 30 seconds for the “small” setting to 30 minutes for the “large” setting.

Download to read the full conference paper text

Copyright information

© International Association for Cryptologic Research 2011

Authors and Affiliations

  • Craig Gentry
    • 1
  • Shai Halevi
    • 1
  1. 1.IBM ResearchUSA