Homomorphic Encryption: Initial evaluation via a simple reduction benchmark

Homomorphic Encryption: Initial evaluation via a simple reduction benchmark

Chun-Yu Lin (NCHC) Feb 02, 2021 @ Taipei

Homomorphic Encryption •

Allow to do computations on encrypted data without decryption: đ?‘“(đ??¸đ?‘›đ?‘? đ?‘Ž , đ??¸đ?‘›đ?‘? đ?‘? , ‌ ) = đ??¸đ?‘›đ?‘? đ?‘“(đ?‘Ž, đ?‘?, ‌ ) ďź?

Partially HE (only "Ă—" or "+") ďź? Somewhat HE (only finite steps) ďź? (Leveled) Fully HE Currently, most FHE scheme based on Lattice cryptography: After many operations, ciphertext would become too noisy to decrypt. • Strategy to “refreshâ€? the ciphertext : ďź? Bootstrapping (Gentry 2009): Homomorphically decrypt with encrypted secret key and encrypt with a new public key (re-encryption) ďź? W/o bootstrapping: Relinearization, key switching, modulus switching, ‌ •

•

Proposed tech standard by community (2019) 2

Textbook RSA as an example of partially HE • • • • •

Choose coprime p, q, n=pq, and e coprime to Ď•(n)=(p−1)(q−1) Secret key: d, the inverse of e ( d*e=1 mod Ď•(n). ) Public key: (e,n).

Encrypt: c ≥ đ??¸đ?‘›đ?‘? đ?‘š = đ?‘šđ?‘’ mod đ?‘› Decrypt: đ??ˇđ?‘’đ?‘? đ?‘? = đ?‘? đ?‘‘ mod đ?‘› đ??¸đ?‘›đ?‘? đ?‘š1 Ă— đ??¸đ?‘›đ?‘? đ?‘š2 = đ?‘š1 đ?‘š2 đ?‘’ = đ??¸đ?‘›đ?‘? đ?‘š1 ∗ đ?‘š2

3

Batch operations on packed ciphertext Algebraic structure of many HE scheme allows packed plain/ciphertext and batch, SIMD operations : (batch size usually > 8 k) • Element-wise "ד, "+"

1 2 3 4 1

+ 2 3 =

Rotation by an offset

1 2 3 4

4

2 4 6 8 •

•

4 1 2 3

More operations can be assembled by: － Masked-multiplication: (0,1,0,0) * c1 = (0, c1[1],0,0 ) － Merge/Collect the 1st element of ciphertexts (c1, c2, c3, c4…)  (c1[0], c2[0] c3[0]. c4[0], …) － Comparison is possible, though not widely available yet. https://eprint.iacr.org/2011/133

4

Implementations & functionality Projects \ Scheme

BGV

[int]

CKKS

[real]

BFV

[int]

FHEW

[bool]

CKKS Bootstrapping

TFHE

[bool]

HELib

Yes

Yes

No

No

No

No

MS SEAL

No

Yes

Yes

No

No

No

PALISADE

Yes

Yes

Yes

Yes

No

Yes

HEAAN

No

Yes

No

No

Yes

No

FHEW

No

No

No

Yes

No

No

TFHE

No

No

No

No

No

Yes

FV-NFLlib

No

No

Yes

No

No

No

NuFHE

No

No

No

No

No

Yes

Lattigo

No

Yes

Yes

No

No

No

https://en.wikipedia.org/wiki/Homomorphic_encryption

5

Benchmark scenario: Outsourcing simple reduction by a single client Keygen － Pub/ Eval/ Sec key generation 2. Encrypt － Encrypt raw data w/ pub key － Output encrypted data 3. Evalution － Compute w/ eval key － Save encrypted result 4. Decrypt － Recover encrypted result w/ sec key 1.

Table from a single client • Key generation (pk/ sk/ eval) • Encrypt raw data Pub key, Enc(x)

Enc (result)

HE evaluation (Reduction of a column with >10 M numbers is tested)

(red should be kept secret) 6

Reduction of large dataset by batch A ciphertext can hold ~8k element Parallel batch reduction after element-wise operations.

1. Batch sum = Rotation + Addition log(batchsize) times 1

2

3

4

5

6

8 10 12 6

6

7

8

8 10 12

16 20 16 20 16 20 16 20

36 36 36 36 36 36 36 36 2.

3.

Collect batch sum into a new ciphertext with full rotation key EvalMerge(M) = (36, xx, xx, xx, ‌) Repeat Step.1 to get the total sum 7

Hello world! (PALISADE) •

Key generation:

keyPair = cc->KeyGen(); cc->EvalSumKeyGen(keyPair.secretKey); cc->EvalMultKeyGen(keyPair.secretKey); • •

•

List of lbcrypto::CryptoContextFactory List of lbcrypto::CryptoContextImpl

Encryption: Plaintext ptx = cc->MakePackedPlaintext(x); // x=int[] Ciphertext c1 = cc->Encrypt(keyPair.publicKey, ptx; Evaluation: c3 = cc->EvalAdd(c1, c2); c3 = cc->EvalMul(c1, c2); c3 = cc->EvalAtIndex(c1, 5); // rotate vector by 5-element Decryption: cc->Decrypt(keyPair.secretKey, c3, &result); 8

Some parameters Multiplication depth: • Plaintext modulo, p: • Ciphertext modulo, q: • Ring dimension, n: •

•

# of multiplication level. Eg. depth of đ?‘Ľ đ?‘› is ~log 2 đ?‘› Number range for plaintext. Eg. 51 mod 50 = 1. ( p=50 bits ~ 15 digits) Number range for Ciphertext Related to # batch slots (and the polynomial order in the cryptosystem)

Recommended configuration in proposed HE Standard (2019) for 128/192/256-bits security levels

9

Testing environment •

ARM cluster (2019): － 64 physical cores (256-core with 4x hyper-threading), 2-way ThunderX2 CN9980 armv8.1a @ 2.2GH － 192 GB DDR4 (158 GB/s per CPU) － L1/2/3: 2/8/32MB per CPU － Peak perf: 560 GFlops per CPU (8 Flops/cycle/core ) － Compiler: gcc-9.3.0

•

Intel cluster (2017): － 36 physical cores, 2-way Intel Xeon Gold 6154 Skylake @ 3GHz － 768 GB DDR4 (119 GB/s per CPU) － L1/2/3: 1.125/ 1/ 24.75 MB per CPU － Peak perf: 1728 GFlops per CPU (32 Flops/cycle/core ) － Compiler: gcc-8.3.0 10

History of CPU/memory usage for a sample run •

Reduction of 16M terms (2048 batches) on 16-core

Batched encryption & Evaluation

Merge

Full rotation key gen

Sample preparation & Compute w/o HE

See appendix for detail time profiling

11

Evaluation time •

Measure effective FLOPS per core = Exact flops / evaluation time / core BFV: Sum(x^2)

CKKS: Sum(x^2)

CKKS: Sum(sigmoid (x))

ARM ThunderX2

HE: 123 KF CPU: 213 MF (1731x)

HE: 29 KF CPU: 215 MF (6700x)

HE: 86 KF CPU: 486 MF (5651x)

Intel Xeon Gold 6154

HE: 256 KF CPU: 439 MF (1715x)

HE: 66 KF CPU: 414 MF (6273x)

HE: 197 KF CPU: 869 MF (4411x)

HE time for 8M terms (Intel)

66 seconds

254 seconds

85 seconds

Exact flops

2 N (integer)

2N

7N

MF = Mega FLOPS, KF = Kilo FLOPS, CPU: native computation w/o HE Timing for 1-core, see appendix for complete tests

•

Low-order sigmoid(x) expansion:

1+

đ?‘’ −đ?‘Ľ −1

=

1 ( 2

đ?‘Ľ 4

+ −

đ?‘Ľ3 48

+ â‹Ż) 12

Size scaling Public key / Secret key: 512 / 256 KB ( ~ batch size * log(q) bits ) • Ciphertext: － 512 KB / per batch － 16x larger than double precision array • Evaluation keys － Full rotation Key ~ O(1000 MB) － Sum Key ~ O( 100 MB) － Multiplication Key ~ O( 1 MB) •

Full rotation key grows almost linearly (~ #offset) Sum key grows ~log(N)

• •

Can be compressed: ~80% rate observed Transferring time of 1GB: > 1 mins @ 100 Mbps network 13

Correctness •

Relative error < 1e-7 % for reduction of O(10 M) real numbers.

|HE result −native result| • Rel. Err. = native result

(lines for different #cores)

14

Experiment observations •

Our preliminary tests suggest performance for simple privacy-critical statistical task is acceptable.

•

Research and development of FHE are active: －

Technical standard is forming.

－

Untrusted multiparty HE is possible through collectively key generation and decryption.

－

Privacy-preserving GPU ML on image classification appeared in 2018.

－

iDASH (integrating Data for Analysis, Anonymization, SHaring) competition is held yearly since 2014 for solving real-world problems in HE and related PET initiatives; e.g. 。

HE: Secure multi-label Tumor classification using Homomorphic Encryption (2020); Secure Genotype Imputation using Homomorphic Encryption (2019); Secure Parallel Genome Wide Association Studies using Homomorphic Encryption (2018), …

SGX: Privacy-preserving clustering of single-cell transcriptomics data in SGX (2020), Privacy-preserving Machine Learning as a Service on SGX (2019), … 。 DP/sMPC: Differentially private federated learning for cancer prediction model (2020), Secure Collaborative Training of Machine Learning Model (2019), … 。 Blockchain: Distributed Gene-Drug Interaction Data Sharing based on Blockchain and Smart Contracts 15 (2019), … 。

Security discussion •

Levels of secure definition: － IND-CPA, indistinguishability under chosen plaintext attack (eg, not for plain RSA) － IND-CCA1, under non-adaptive chosen ciphertext attack － IND-CCA2, under adaptive (malleable) CCA (impossible for HE. See CHK (2020) ) － IND-CCA3, authenticated-encryption, See Shrimpton (2004)

•

Most HE satisfies at least IND-CPA security (Semantic security), but may be insecure from border secure definition. See Li and Micciancio (2020) for instance.

16

Applications discussion

Application candidates: – Comparison and sorting capabilities, e.g., order statistics – ML (neural network, logistic regression) of process parameters for a particular fab processing line – Cancer classification for medical image data http://homomorphicencryption.org/wp-content/uploads/2018/10/CCS-HE-Tutorial-Slides.pdf https://homomorphicencryption.org/white_papers/applications_homomorphic_encryption_white_paper.pdf

17

Tasks on going and in planning at NCHC •

Compare performances (time and size) of 3 HE open source libraries (Q1, 2021): － PALISADE - done － IBM HElib - on going － Microsoft SEAL - on going

•

Experiment more advanced applications (Q1 – Q4, 2021): － Collaborate with Duality or/and IBM through a POC － Participate iDASH Privacy & Security workshop 2021 (timeline is uncertain)

•

Propose our own HE methodology: Quotient Algebra Partition (QAP)-based HE (by Zheng-Yao Su) (Q1 – Q4, 2021): － Developed in the concept of Quantum Computation, it is an extension of Code-based Cryptography to the Hilbert space, where the operations of addition and multiplication are preserved in nature during an encryption, thus inherently achieving Full Homomorphism. － Start doing some experiments.

18

Backup slides

19

Time scaling Eff. Flops/core = flops / evaluation time / core ARM ThunderX2

CPU

Intel 6154

CPU

HE HE

(For HE, count evaluation + merge time only) 20

Profiling -- wall time vs. data size

4-thread

â&#x20AC;˘

32-thread

128-thread

Evaluation/ Encryption benefits from explicit OpenMP parallel over batches

21

Genome Wide Association Studies (iDASH’18 competition) https://eprint.iacr.org/2020/563 •

GWAS for the age-related macular degeneration (AMD) － 27 k samples * 263 k SNP markers － Computing tasks • allelic chi-square test and • logistic regression with covariates (sex, age, …) － HE implementation ~6x faster than SMPC version reported

•

Proposed HE GWAS analysis framework: 1. Data owners obtain public keys from Coordinator 2. Data owners encrypt data and sent to data bank 3. On analysis, data transmitted to cloud for HE computation.

4. Encrypted result sent back to the coordinator.

5. Coordinator decrypts and publish results. (single decrypter here) 22

Some introductory references

• • • • •

Project pages of PALISADE (Duality) Overview slide form HE Standardization Consortium (2018) Some lectures from Microsoft workshop (2019) Homomorphic Encryption Standard (2019) A brief high-level overview by A. Guellier (2014): “Can Homomorphic Cryptography ensure Privacy?”

23