Gauthier, Benoit, Anaïs, Laurène, Clémentine Luc

Léo

Voici donc venu le temps des remerciements, partie la plus lue d'une thèse et exercice de style libre mais délicat pour l'auteur qui doit veiller à ne pas décevoir les attentes de ceux qui viendront inévitablement y chercher leur nom. Je me dois également, et avant tout, de te remercier toi, lecteur anonyme pour qui cette thèse a été écrite, d'avoir ouvert ce manuscrit, puisses-tu y trouver ce que tu es venu y chercher.

Comme beaucoup de personnes avant moi, et certainement plusieurs après moi, je tiens à remercier en premier lieu J.-C. pour sa bienveillance à mon égard. Il a su me guider et m'accompagner au cours des trois dernières années. Malgré un contexte parfois compliqué, ta bonne humeur, ton enthousiasme permanent et ton humour, bien que souvent controversé, ont été de précieux atouts durant cette thèse. Celle-ci n'aurait pu aboutir sans la confiance que tu m'as accordée, tes conseils avisés et surtout ton aptitude inestimable à remplacer une pression pesante par des pressions pétillantes ;-). Pour le temps que tu m'as accordé, les opportunités de découvrir le monde que tu m'as offertes, je te remercie.

Si ce manuscrit est entre vos mains aujourd'hui, c'est également grâce à Frederik et Fabien qui ont accepté de rapporter cette thèse. Merci de vous être intéressés à mon travail, d'avoir pris le temps de le lire et d'avoir donné votre aval indispensable. Fabien, merci d'avoir pris le temps de lire cette thèse bien que le chiffrement homomorphe ne soit pas ton sujet de prédilection. Frederik, thank you very much for having paid such a close attention to the reading of this thesis and for all your valuable comments. Je tiens également à remercier Anne, Léo, Philippe, Caroline et Adeline d'avoir accepté de faire partie de mon jury et d'avoir fait le déplacement afin d'assister à ma soutenance.

Si j'ai pu commencer cette thèse, je le dois particulièrement à Philippe, qui a non seulement commencé ma formation à Grenoble en 1 avant J.-C., mais a aussi attiré l'attention de Jean-Claude sur moi. Merci d'avoir veillé, même de loin, au bon déroulement de cette thèse en t'impliquant à chacun des points de contrôle : commencement, comité de suivi et enfin soutenance. Puisque j'en suis aux grenoblois, je souhaite également remercier Jean-Guillaume Dumas qui a su m'initier et me donner goût à la recherche durant le stage de master. Enfin, je voudrais remercier Vanessa Vitse, pour son cours d'introduction au chiffrement homomorphe sans lequel je ne serais certainement pas là aujourd'hui. i consacré un peu de temps au début de celle-ci pour m'aider à orienter mes recherches, Guénaël pour ses blagues potaches et sa bonne humeur, Elias pour sa gentillesse et sa disponibilité, Karine pour avoir accepté de faire partie de mon comité de suivi malgré sa peur des polynômes cyclotomiques et Damien pour sa disponibilité et sa bonne humeur depuis qu'il nous a rejoint.

J'ai également eu la chance de pouvoir faire différents séjours à l'étranger durant cette thèse. Merci à Thomas de m'avoir donné l'opportunité d'aller travailler avec lui en Australie. Thank you Anwar for welcoming me in Waterloo for three months, and thank you Leonel for your welcome in Lisbon. I would like to thank in particular Paulo, first for being such an efficient co-worker, but most importantly for the good moments we have shared together, first in Paris and then in Lisbon and Sintra, I really appreciated them.

Enfin la personne qui m'a probablement le plus aidé durant cette thèse, et qui a été bien plus qu'un simple co-auteur : Julien. Merci de m'avoir quasiment encadré au début de ces trois années ; si je peux soutenir aujourd'hui c'est clairement grâce à toi. D'ailleurs, si cela ne tenait qu'à moi, ton nom figurerait sur la page de garde. Je te remercie également de m'avoir accueilli chez toi pendant mon séjour à Waterloo. Certes, tout n'aura pas été parfait et nous avons essuyé quelques échecs, notamment la v3 :p, mais les apéros et les séances de grimpe avec Nevin, Claire et Monica resteront toujours de bons souvenirs grâce à toi. Monica good luck for supporting him, I did not expect to see you in my defense when we first met one year ago, but I am glad you have been able to join him in France and to come in Paris for my defense. Bref, merci et bonne chance à tous les deux pour Grenoble ! Si une thèse nous donne l'occasion de rencontrer de nouvelles personnes, on a fatalement moins de temps à consacrer aux anciens amis. Je remercie ceux qui ont su s'accrocher et me pardonner mon manque de disponibilité.

La partie la plus intéressante et la plus enrichissante d'une thèse provient incontestablement des rencontres que l'on fait, en cela je dois dire que j'ai eu beaucoup de chance.

En arrivant à Jussieu au début de cette thèse, j'ai eu la chance d'être très bien accueilli par tous les occupants du bureau 338 de l'époque : Ivan, Thibaut, Anastasia, Alexandre, Ulrick et Pacôme. La bonne ambiance qui régnait dans ce bureau, due essentiellement à la grande qualité de ses occupants, m'a apporté un confort indéniable lors du commencement de cette thèse. Je me souviendrai longtemps du dévouement d'Ivan, du chapeau de Thibaut, de la bonne humeur permanente de Nastia, des enragements divers et variés d'Alexandre, de la décontraction d'Ulrick et du flegme de Pacôme. Merci à tous les six pour votre accueil, le Baker Street n'est plus aussi attirant depuis que vous êtes partis. J'ai bien sûr très vite pu élargir mes horizons avec le bureau 325, dont les occupants principaux Charles et Guillaume, mes référents C++, ont été des rencontres au moins aussi formidables que les précédentes. La décontraction de Guillaume et les débats passionnés et quasi-quotidiens vim/emacs entre Charles et Thibaut, sont à mon sens indissociables de ces trois dernières années. Il y a encore de nombreuses personnes que j'ai apprécié avoir rencontrées et qui doivent au moins être mentionnées : Sénan, Ramon, Clothilde, Daisuke, Cécile, Romain et Jocelyn. This thesis has also been the opportunity to enriched and enlarged my vision of politic, with the meeting of one of the last Trotskyist on Earth, my favorite Argentinian fellow: Matìas. Thank you for the various talks and moments we have shared together, I have enjoyed them more than you think and I am looking forward the next ones. I hope I have been able to make you discover the charms of Provence and our shitty football. I am proud to count you as a friend now, and I hope someday we will have the opportunity to visit your country together.

Les membres de ma vraie équipe : Alexandre, Thomas, Natasha, Jérôme, Anand, Jérémy et Lucas ont été également autant de rencontres appréciables. Alexandre, merci pour ta disponibilité et ton aide notamment lors de notre arrivée dans l'équipe. Je ne doute pas que ton intérêt pour moi au départ ait été principalement motivé par la clim et les fléchettes dans le bureau ;-), mais nous avons quand même bien rigolé, et pas grâce à ton humour vaseux. Nous avons été pendant un long moment les deux seuls vrais permanents de l'équipe. Thomas, merci d'avoir si brillamment pris la relève d'Alexandre entre tes séjours au Japon et surtout merci d'avoir consacré du temps à la relecture du début de cette thèse, tu es le prochain à soutenir ! Jérôme, merci pour ta disponibilité permanente et ton rire si communicatif. Anand, thank you for always being in such a good mood and for the time you have spent correcting my shitty English.

Plusieurs personnes m'ont aidé d'une façon ou d'une autre durant cette thèse, et en premier lieu notre gestionnaire Irphane que je tiens à remercier particulièrement pour son aptitude à régler tous mes problèmes administratifs avec une efficacité sans égale. Il te faudra maintenant trouver quelqu'un d'autre pour t'aider à préparer les différents workshops :p. Merci à Valérie et Christoph pour m'avoir donné la possibilité d'enseigner durant cette thèse. Je remercie également Antoine pour avoir financé la plus grande partie de ma thèse, Tancrède pour m'avoir Bien que déjà utilisée pendant l'Antiquité, la cryptologie -étymologiquement science du secret -n'a justifié son statut de science que récemment grâce aux fondations théoriques posées par Shannon à la fin des années 40 ( [START_REF] Shannon | Communication Theory of Secrecy Systems[END_REF]), et l'avènement de la cryptographie à clé publique dans les années 70. Elle se divise en deux disciplines de nature opposées mais complémentaires : la cryptographie et la cryptanalyse.

La première a pour but de protéger des communications, pour cela il lui faut garantir quatre propriétés : la confidentialité, l'authenticité, l'intégrité et la non-répudiation de cellesci. La première propriété garantie que seuls les participants à la communication aient accès aux messages. L'authenticité permet d'assurer l'identité des entités qui y participent, tandis que l'intégrité est nécessaire afin de garantir qu'un message n'ait pas été altéré par un tiers non autorisé. Enfin la non-répudiation a pour but d'empêcher que l'une des entités participant à la communication puisse nier l'avoir fait. Afin d'assurer ces propriétés en pratique, les participants à la communication doivent être en possession d'un secret ou clé.

un télégramme du ministre allemand des affaires étrangères, Arthur Zimmermann, envoyé à l'ambassadeur allemand au Mexique dans lequel l'Allemagne proposait une alliance au Mexique. Les termes de cette alliance spécifiaient que le Mexique devrait envahir le sud des États-Unis, si jamais ceux-ci venaient à abandonner leur neutralité, afin de les empêcher d'intervenir en Europe. La révélation de ce télégramme poussa les États-Unis à déclarer la guerre à l'Allemagne et précipita la fin du conflit. Lors de la deuxième guerre mondiale, la machine Enigma, utilisée par les Allemands pour chiffrer leurs communications fut le premier exemple de chiffrement mécanique de l'histoire. Sa cryptanalyse, par l'équipe d'Alan Turing en 1940 nécessita quant à elle la construction du premier ordinateur de l'histoire. Une fois le chiffrement cassé, les Alliés disposèrent d'un avantage certain sur la suite du conflit. La cryptologie venait d'entrer dans l'ère moderne.

Jusqu'à la seconde moitié du XX ème siècle, la même clé était utilisée pour chiffrer et déchiffrer les messages ; on parle alors de cryptographie symétrique. Ce type de chiffrement souffre toutefois d'un inconvénient majeur puisqu'il nécessite que les partis souhaitant communiquer aient échangé la clé de chiffrement, de manière sécurisée, avant le début de la communication. Le problème est alors d'échanger cette clé de manière sécurisée. Ce problème fut solutionné dans les années 70 par l'invention du concept de la cryptographie asymétrique, ou encore cryptographie à clé publique, par W. Diffie et M. Hellman ([DH76]), et de manière moins connue par R. Merkle [START_REF] Ralph | Secure Communications over Insecure Channels[END_REF]).

La cryptographie à clé publique repose sur le principe que la personne qui doit déchiffrer le message génère deux clés. La première est une clé secrète, qui comme son nom l'indique doit rester secrète, la seconde est une clé qui est rendue publique. Cette clé publique est utilisée par quiconque souhaitant envoyer un message, de manière sécurisée, au détenteur de la clé secrète afin de chiffrer son message. En revanche, ce dernier est le seul à être capable de déchiffrer le message grâce à la clé secrète. Si ces deux clés sont bien évidemment liées entre elles, on s'assure qu'on ne puisse pas retrouver facilement la clé secrète à partir de la clé publique en faisant en sorte que cela revienne à résoudre un problème calculatoire difficile.

Une bonne analogie à la cryptographie à clé publique est une boite aux lettres. Tout le monde peut facilement glisser un message dans une boite aux lettres. Par contre il est très difficile de récupérer les messages si l'on ne possède pas la clé qui l'ouvre, seul le propriétaire de la boite est en mesure de récupérer les messages facilement.

Dans le contexte de la cryptologie, les mots «facile» ou «difficile» doivent être compris au sens calculatoire du terme, facile signifiant qu'il existe un algorithme permettant de résoudre n'importe quelle instance du problème en temps polynomial tandis que difficile signifie que ce n'est pas facile. Pour des raisons de sécurité il faut que retrouver la clé secrète à partir de la clé publique soit difficile, mais pour des raisons pratiques on souhaite pouvoir déduire la clé publique de la clé secrète facilement.

Ainsi, la cryptographie à clé publique repose sur des problèmes calculatoires qui sont faciles à résoudre dans un sens mais difficile dans l'autre. Un bon exemple d'un tel problème ment le circuit de déchiffrement à partir d'un chiffré «frais». Sachant que l'augmentation du bruit après une multiplication est plus importante qu'après une addition, si le schéma de base permet d'effectuer homomorphiquement une multiplication en plus de l'évaluation de son circuit de déchiffrement, il est dit «bootstrappable» et peut donc être transformé en un schéma complètement homomorphe.

De nos jours, ce genre de chiffrement pourrait avoir un impact considérable sur la protection de la vie privée notamment avec l'essor du «cloud computing». Le chiffrement homomorphe offre une solution concrète à différents problèmes apparaissant en cryptographie comme le calcul multipartite sécurisé, la délégation de calculs ou encore le vote électronique. Malheureusement, bien que théoriquement correcte, la première construction de Gentry requiert de tels paramètres qu'elle est inutilisable en pratique.

C'est pourquoi, dans les années qui suivirent, la communauté consacra des efforts importants à améliorer cette première construction de sorte à la rendre implémentable, ce qui fut accomplit en 2011 ( [START_REF] Gentry | Implementing Gentry's Fully-Homomorphic Encryption Scheme[END_REF]). Cette première implémentation fut toutefois rapidement rendue obsolète par l'arrivée des schémas, dit de deuxième génération, qui furent construit les années suivantes. Citons par exemple : Brakerski-Gentry-Vaikuntanathan (BGV) ( [START_REF] Brakerski | Leveled) Fully Homomorphic Encryption Without Bootstrapping[END_REF]), Brakerski «scale-invariant» ( [START_REF] Brakerski | Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP[END_REF]) ou encore Gentry-Sahai-Waters (GSW) ( [START_REF] Gentry | Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based[END_REF]). Les meilleures performances obtenues par les schémas susmentionnés sont directement liées au problème sous-jacent sur lequel leur sécurité est basée : le Learning With Errors (LWE).

Ce problème, basé sur les réseaux euclidiens et introduit par O. Regev en 2005 ([Reg05]), est actuellement la structure de base sur laquelle une grande partie des schémas de chiffrement homomorphe sont construits. De manière informelle ce problème consiste à la résolution d'un système linéaire «bruité». Plus précisément, considérons une matrice A et un vecteur s à coefficients entiers dans un grand intervalle centré en zéro [q/2, q/2[. Connaissant la matrice A, la version «décisionnelle» du problème consiste à être capable de déterminer si un vecteur b a ses coefficients tirés uniforméments dans [-q/, q/2[ ou bien s'il est tel que b = As + e ( mod q), où e est un vecteur de «bruit», i.e. de petits coefficients. De manière équivalente la version «recherche» consiste à retrouver le vecteur s à partir du couple ( A, b = As+e mod q). Notons l'importance du vecteur e, sans lequel ce problème se réduirait une résolution de système linéaire.

Bien que permettant une augmentation significative des performances par rapport à la première construction de Gentry, la structure sous-jacente du LWE est loin d'être satisfaisante en pratique. En effet, pour obtenir des niveaux de sécurité suffisants et un schéma «bootstrappable», il est nécessaire d'utiliser des matrices et des vecteurs de grande taille avec de gros coefficients de sorte que les temps de calculs, et les coûts en mémoire, pour manipuler les éléments deviennent trop importants. C'est pourquoi, très rapidement, la communauté académique s'est mise à considérer différentes variantes de ce problème, et en particulier sa version sur les anneaux appelée Ring-Learning With Errors (Ring-LWE) ou encore Learning With Errors over Rings qui est basée sur les réseaux idéaux ( [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF]). Dans cette version, la matrice A du LWE est remplacée par un élément a de l'anneau R q = (Z/qZ)[X]/(f ) où f est un polynôme unitaire et irréductible de degré n. Les vecteurs s et e sont à présent considérés comme des éléments de R q . Le problème est alors similaire : déterminer si un couple d'éléments (a, b) ∈ R 2 q a été tiré de manière uniforme dans R q , ou bien s'il existe des éléments s et e tels que b = a • s + e. Il y a deux bénéfices principaux à cette variante :

• a est désormais représenté par n coefficients au lieu de n 2 , ce qui permet de gagner un facteur n sur la complexité en mémoire ;

• plutôt que d'avoir à effectuer des produits matrice vecteur (complexité asymptotique O(n 2 )), on multiplie à présent des éléments de R q ce qui peut être fait plus efficacement (complexité asymptotique O(n log n)), en particulier lorsque f (X ) = X n + 1 pour n une puissance de deux.

de 0.1 seconde pour le bootstrapping ( [START_REF] Chillotti | Faster Fully Homomorphic Encryption: Bootstrapping in Less Than 0.1 Seconds[END_REF]). Dans leur contexte, le bootstrapping est effectué après chaque évaluation d'une porte logique, ils peuvent ainsi évaluer homomorphiquement autant de portes qu'ils le souhaitent obtenant ainsi un chiffrement complètement homomorphe très compétitif.

Enfin, il est probablement important de mentionner qu'après des années de recherche et de développement dans les laboratoires académiques, l'ordinateur quantique n'est plus un rêve fantaisiste. Son arrivée prochaine va confronter la cryptologie moderne à la première grande révolution de sa jeune histoire.

En effet, avec un tel ordinateur, les problèmes calculatoires sur lesquels repose la sécurité des systèmes de chiffrements utilisés à l'heure actuelle (factorisation et logarithme discret) pourront être résolus en temps polynomial ( [START_REF] Shor | Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer[END_REF]). Ainsi, tous les chiffrements basés sur ces problèmes ne seront plus sûrs. Il devient donc nécessaire de développer de nouveaux chiffrements qui soient basés sur des problèmes que l'ordinateur quantique ne pourra pas résoudre en temps polynomial. L'appel récent de la National Institute of Standards and Technology (NIST), afin de poser les bases des futurs standards de la cryptographie postquantique va dans ce sens.

Dans cette perspective, les problèmes basés sur les réseaux (euclidiens ou idéaux) sont de bons candidats puisqu'on ne connaît pas, à ce jour, d'algorithme quantique permettant de les résoudre de manière significativement plus efficace. Ainsi le chiffrement homomorphe n'est pas compromis à moyen terme par l'arrivée de l'ordinateur quantique. En revanche, l'utilisation de ce genre de chiffrement est toujours limitée en pratique par les coûts importants qu'il nécessite, que ce soit en temps ou en mémoire.

But et organisation de la thèse

Le but de cette thèse est d'optimiser l'arithmétique sous-jacente à plusieurs schémas de chiffrements presque homomorphes basés sur le problème du Ring-LWE afin d'améliorer leur performances. Nous espérons contribuer ainsi à lever une partie des barrières qui empêchent toujours l'utilisation de ce type de chiffrement en pratique. Pour cela, nous nous sommes concentrés sur deux points :

• l'optimisation de l'arithmétique utilisée par les primitives de ces schémas, qu'il s'agisse d'opérations intrinsèques à leurs primitives, ou bien d'opérations requises dans le contexte plus général du Ring-LWE ;

• optimiser les calculs spécifiques à une utilisation concrète de ce type de chiffrement, que ce soit au niveau des algorithmes utilisés ou de leurs implémentations.

Le chapitre 1 a pour but d'introduire les différentes notions nécessaires à la bonne compréhension de la suite de ce manuscrit. Pour cela nous commençons par introduire brièvement le problème du Ring-LWE dans le cas des corps cyclotomiques tout en mettant en évidence 2. But et organisation de la thèse son lien avec les réseaux idéaux. Dans une deuxième partie, nous présentons deux des schémas de chiffrements homomorphes les plus couramment utilisés : BGV et FV, tous deux basés sur le problème du Ring-LWE. Enfin dans une dernière partie, nous présentons les différents outils utilisés afin d'effectuer les opérations requises par ce genre de chiffrement de manière efficace.

La première contribution ( [START_REF] Bajard | A Full RNS Variant of FV Like Somewhat Homomorphic Encryption Schemes[END_REF]) de cette thèse est présentée dans le chapitre 2. Ce travail s'est concentré sur l'utilisation du système de représentation des nombres par les restes (RNS). La représentation RNS permet d'effectuer des additions et multiplications sur de grands nombres de manière très efficace, ce qui est très utile dans le contexte du chiffrement homomorphe. Malheureusement, d'autres opérations comme par exemple les comparaisons ne peuvent pas être effectuées directement en RNS. En surmontant les limitations de cette représentation, nous avons réussi à effectuer l'ensemble des calculs nécessaires aux différentes procédures des schémas de chiffrement homomorphe de type «scale-invariant» comme FV. Cela s'est traduit par une amélioration remarquable des performances de ces schémas.

L'efficacité de l'arithmétique dans l'espace R q = (Z/qZ)[X]/(f ) dépend fortement de f notamment à cause de la réduction modulo ce polynôme. Cette efficacité est maximale lorsque f est un cyclotomique de la forme X n +1. En revanche ce type de polynômes entraîne d'autres limitations qui, selon l'application voulue, peuvent nécessiter de considérer d'autres types de cyclotomiques. Le chapitre 3, présente un travail dans lequel nous nous sommes concentrés à améliorer l'efficacité de l'opération de réduction par le polynôme f , lorsque celui-ci est un cyclotomique différent de X n + 1 ([BEH + 18]). Cette opération étant nécessaire pour chaque produit d'éléments dans R q , son optimisation a permis d'augmenter significativement les performances des primitives des schémas BGV et FV dans ces cas là.

Finalement dans le quatrième et dernier chapitre nous présentons une application concrète d'utilisation de chiffrement homomorphe pour la classification de données privées ( [START_REF] Bajard | Classification of Private Data using Homomorphic Encryption[END_REF]). De nos jours ce genre de classification utilise de plus en plus des méthodes d'apprentissages automatiques et notamment des machines à vecteurs de support (MVS). Évaluer homomorphiquement une MVS permet de classer des données sans jamais avoir à révéler celles-ci. Nous commençons par présenter le fonctionnement de ces MVS qui sont des techniques appartenant au domaine de l'apprentissage supervisé. Dans un deuxième temps nous exposons les méthodes algorithmiques que nous avons utilisées afin d'effectuer homomorphiquement les opérations requises par ces techniques. L'efficacité de nos méthodes est illustrée par des implémentations sur différents type d'architectures.

Enfin dans une dernière partie nous présentons les conclusions de cette thèse ainsi que les perspectives qu'elle nous permet d'envisager.

Introduction 1 Historical context and motivations

Although already used during ancient times, cryptology -etymologically science of secretonly justified its science status recently with its theoritical foundations laid out by Shannon at the end of the 1940s ( [START_REF] Shannon | Communication Theory of Secrecy Systems[END_REF]), and the advent of public-key cryptography (1970s). It can be split into two mains areas of study which are opposite by nature but complementary: cryptography and cryptanalysis.

The first is about protecting communications from unauthorized third parties, requiring four properties: confidentiality, authentication, data integrity and non-repudiation. Confidentiality guaranties that only authorized people can access the messages. The purpose of authentication is to certify the identity of the participants, while data integrity is required to ensure that messages were not corrupted by any unauthorized third party. Finally nonrepudiation prevents participants in the communication from falsy denying their implication. In practice, participants of a communication need to possess a secret, also called key, to ensure these properties.

On the other hand, cryptanalysis aims at retrieving some information from a secure communication in order to corrupt one, or several, of the previous four properties and this, without necessarily knowing the key.

Historically cryptography was mainly about ensuring the confidentiality of messages. The other properties too are integral to modern cryptography and particularly in the current internet era. Confidentiality of a message is ensured by converting it into an unintelligible text, called ciphertext, by using a key. From there, the message can only be understood by people with knowledge of the key.

During war, it is essential to ensure that encrypted messages remain undecipherable to the adversary in the eventuality where they are intercepted. This is why historically most progress in encryption techniques and cryptanalysis appeared during different conflicts. Among the famous classical encryption methods we can mention the scytale used by the Spartans during the Peloponnesian War, and the Caesar cipher used by the Romans during the Gallic Wars.

More recently, during the two major conflicts of the XX th century, cryptology has been decisive. In 1917, British intelligence intercepted and decrypted a telegram sent by the German foreign secretary, Arthur Zimmermann, to the German ambassador in Mexico in which Germany was offering an alliance to Mexico. The terms of this alliance specified that Mexico should invade the south of the United States in order to prevent Americans from taking action in Europe in case the United States dropped their neutrality. Once the United States were aware of the content of this telegram they declared war to Germany which sped up the end of the conflict. During World War II the Enigma machine, used by the Germans to encipher their communications, was the first mechanic cipher machine in history. Its cryptanalysis by Alan Turing's team in 1940 has itself required the construction of the first computer in history. Once Enigma was broken, the Allies had a significant advantage for the rest of the conflict. Cryptology just entered its modern era.

Until the second half of the XX th century, the same key was used to encrypt and decrypt messages: the case referred to as symmetric cryptography. However symmetric cryptography suffers from a major drawback since it requires the parties wishing to communicate have exchanged the cipher key before the communication starts. The problem is therefore to exchange this key in a secure way. This was addressed in the seventies when W. Diffie and M. Hellman proposed the concept of asymmetric cryptography, also called public key cryptography ( [START_REF] Diffie | New Directions in Cryptography[END_REF]). One should probably mention it was also proposed, roughly at the same time, by R. Merkle even though it is less well-known ( [START_REF] Ralph | Secure Communications over Insecure Channels[END_REF]).

The principle of public key cryptography is that the person who needs to decrypt messages generates two keys. The first one must remain secret while the second one is made public. The public key is used to encrypt messages by anyone willing to communicate with the owner of the secret key. However the owner of the secret key is the only one able to decrypt the messages encrypted with the corresponding public key. Of course the two keys are related, but it is made sure that one cannot retrieve easily the secret key from the public key unless by solving a difficult computationnal problem.

An analogy for thinking about public key cryptography is a mail box. Everyone can easily put a letter in a mail box, however it is hard to get the letters which are inside the box if you do not have its key. Only the owner of the mail box can easily take the letters inside it.

In the context of cryptology, "easy" and "difficult" must be understood in terms of computational complexities. "Easy" means that there exists an algorithm which can solve any instantiation of the problem in polynomial time while "difficult" means that it is not easy. If for security reasons it must be difficult to retrieve the secret key from the public key, for efficiency reasons deriving the public key from the secret key should be easy.

As a consequence, public key cryptography relies on mathematical problems which are easy in one way but difficult on the other. A good example of such a problem is the multiplication/factorization of integers. Multiplying two integers is quiet easy, for instance it is not hard to find that 41 × 37 = 1517, however it is much harder to find out that 2021 is actually the product of 43 and 47.

It is precisely on this problem that in 1978, R. Rivest, A. Shamir and L. Adleman based their encryption/signature scheme, called RSA, which was the first concrete public key con-1. Historical context and motivations struction in history ( [START_REF] Rivest | A Method for Obtaining Digital Signatures and Public-key Cryptosystems[END_REF]). A noteworthy property of RSA is that when multiplying two ciphertexts, encrypting two different messages, one obtains a ciphertext corresponding to the product of the messages. This property, allowing to process messages directly through their ciphertexts without having to decrypt them beforehand is called homomorphic property.

From there the question whether or not it is possible to construct an encryption scheme generalizing the homomorphic property of RSA arose. This encryption scheme should allow to perform, not only multiplications, but any kind of computations on messages directly through their ciphertexts ( [START_REF] Rivest | On data banks and privacy homomorphisms[END_REF]). Later this will be referred as Fully Homomorphic Encryption (FHE). Whether or not it was possible to construct such a scheme remained opened for many years. Knowing that any continuous function can be approximated over a compact domain by a polynomial, in practice the question can be reduced to being able to evaluate polynomials homomorphically. This only requires to perform both additions and multiplications homomorphically. Several encryption schemes allowing to perform one of the two operations like RSA were built in the ensuing years: for instance ElGamal for the multiplication ( [START_REF] Elgamal | A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF]) and Paillier for the addition ( [START_REF] Paillier | Public-Key Cryptosystems Based on Composite Degree Residuosity Classes[END_REF]).

The first significant step was made in 2005 by D. Boneh, E. Goh and K. Nissim who constructed the first encryption scheme possessing the two homomorphic properties ( [START_REF] Boneh | Evaluating 2-DNF Formulas on Ciphertexts[END_REF]). Nevertheless their construction suffers from a major drawback since it only allows to perform one homomorphic multiplication. In a major breakthrough C. Gentry in 2009 resolved the problem by constructing the first fully homomorphic scheme, i.e. which allows to perform an arbitrary number of additions and multiplications homomorphically, solving a thirty years old problem ( [START_REF] Gentry | A Fully Homomorphic Encryption Scheme[END_REF]).

Its construction, based on euclidean lattices, works through two steps. The first step is the construction of a scheme allowing to perform a limited number of additions and multiplications. Such restrictive schemes, referred as Somewhat Homomorphic Encryption (SHE), are called "noisy". In a nutshell, ciphertexts of SHE schemes contains a noise which grows after each homomorphic operation. Unfortunately one is only able to decrypt the message correctly as long as the noise remains small enough, which is the reason why one can only perform a limited number of operations. The second step of Gentry's construction is a procedure to "refresh" ciphertexts, i.e. which allows to reduce the size of the noise inherent to a ciphertext. This procedure, called "bootstrapping", roughly consists in running homomorphically the decryption function. At the end of the procedure, we obtain a new ciphertext, encrypting the same message, whose inherent noise has the same size as if one had evaluated the decryption circuit from a "fresh" ciphertext. Noise growth after a multiplication is more important than after an addition. Therefore if the SHE scheme allows to perform one multiplication additionally to the evaluation of its decryption procedure, then the scheme is said "bootstrappable" which means that it can be transformed to a fully homomorphic scheme.

Nowadays, the potential impact of such schemes on privacy is considerable, in particu-lar with the rise of cloud computing. FHE offers a concrete solution to different problems appearing in cryptography such as secure multiparty/outsourced computations or e-voting. Unfortunately, although theoretically correct, the parameters required by the first construction of Gentry make it unusable in practice.

Hence in the years following Gentry's breakthrough, the cryptographic community has devoted important efforts to improve this first construction in order to make it implementable. This was finally accomplished in 2011 by C. Gentry and S. Halevi ([GH11]). This first implementation quickly became outdated with the so-called second generation schemes which appeared in the next few years. We mention for instance: Brakerski-Gentry-Vaikuntanathan (BGV) ([BGV12]), Brakerski scale invariant construction ( [START_REF] Brakerski | Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP[END_REF]) and Gentry-Sahai-Waters (GSW) ( [START_REF] Gentry | Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based[END_REF]). The better performances of the aforementioned schemes are directly related to the underlying problem on which their security is based upon: Learning With Errors (LWE).

The LWE problem was introduced in 2005 by O. Regev in his seminal work [START_REF] Regev | On Lattices, Learning with Errors, Random Linear Codes, and Cryptography[END_REF]), is currently the main structure used for constructing homomorphic encryption schemes. In an informal way this problem consists in solving a "noisy" linear system. More precisely, let us consider a matrix A and a vector s both with integer coefficients lying in a large centered interval [-q/2, q/2[. Knowing the matrix A, the "decisional" version of the problem consists in distinguishing whether a vector b has its coefficients sampled uniformly in [-q/2, q/2[ or if it is such that b = As + e ( mod q), for a vector e with "small" coefficients. Equivalently the search version of the problem consists in finding the vector s from the couple ( A, b = As+e ( mod q)). Note the importance of the noise/error vector e, without which this problem would reduce to the resolution of a linear system. Despite much better performances when compared to Gentry's first construction, in practice the structure underlying the LWE problem is not completely satisfying. Indeed, in order to obtain levels of security high enough, and to make the scheme bootstrappable, one needs to use large size of matrices and vectors with also large coefficients. As a consequence, the time and memory complexities required to manipulate these elements turn out to be quickly unpractical.

Therefore the cryptographic community has started to consider different variants of this problem and in particular its ring version called Ring-Learning With Errors (Ring-LWE), also called Learning With Errors over Rings, which is based on ideal lattices ( [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF]). In this variant, the matrix A is substituted for an element a lying in the ring R q = (Z/qZ)[X]/(f ), where f ∈ Z[X] is a monic and irreducible polynomial of degree n. The vectors s and e are now also considered as elements of R q . The problem is similar : determine whether a couple of elements (a, b) ∈ R 2 q was sampled uniformly in R 2 q or if there exists s and e such that b = a • s + e. The benefits brought by this variant are twofold:

• a can now be represented by n coefficients instead of n 2 for a matrix, which reduces the memory complexity by a factor n ;

• instead of performing matrix vector products (asymptotic time complexity O(n 2 )), one now performs product of elements of R q which can be done more efficiently (asymptotic time complexity O(n log n)), especially when f (X ) = X n + 1 with n a power-of-two.

Homomorphic encryption schemes based on the LWE problem can be adapted quite naturally to Ring-LWE which enhances significantly their performance. The BGV scheme has been directly developed to fit on the two problems, Brakerski' scale-invariant construction was adapted to Ring-LWE by J. Fan and F. Vercauteren and named after them FV ( [START_REF] Fan | Somewhat Practical Fully Homomorphic Encryption[END_REF]) and GSW' adaptation was named SHIELD ( [START_REF] Khedr | SHIELD: Scalable Homomorphic Implementation of Encrypted Data-Classifiers[END_REF]).

Both LWE and Ring-LWE problems reduce, under some conditions, to hard problems on euclidean and ideal lattices respectively. So far no algorithm solving Ring-LWE more efficiently than LWE is known, and actually concrete cryptanalysis of a Ring-LWE instantiation is currently made by constructing an LWE instantiation from it. In this case the coefficients of the element a ∈ R q form the first column of the matrix A and the other columns are derived from the first one by exploiting the structure of the polynomial f . Nonetheless, the benefits brought by Ring-LWE are not without potential consequences. Indeed there are important suspicions that the additional structure appearing in ideal lattices, which is brought by the polynomial f , can be exploited to solve problems in this kind of lattices more efficiently. Hence, despite it is not known yet whether this structure can be exploited or not, people tends to believe that Ring-LWE is less hard than LWE.

In practice, Gentry's bootstrapping is the most cumbersome procedure, hence one should try to avoid using it as much as possible. One way of avoiding it is to select parameters for an SHE scheme with a targeted application, so that it allows to perform enough operations to evaluate homomorphically the required functions without bootstrapping ( [START_REF] Brakerski | Leveled) Fully Homomorphic Encryption Without Bootstrapping[END_REF]).

In a noteworthy work L. Ducas and D. Micciancio have built a scheme, called FHEW, based on the Ring-LWE problem in which the bootstrapping procedure can be performed very efficiently -less than 1 sec ( [START_REF] Ducas | FHEW: Bootstrapping Homomorphic Encryption in Less Than a Second[END_REF]). By considering a variant of Ring-LWE on the real torus, FHEW was improved a few years latter by Chillotti et al. (TFHE) reaching execution time of 0.1 sec ( [START_REF] Chillotti | Faster Fully Homomorphic Encryption: Bootstrapping in Less Than 0.1 Seconds[END_REF]). In their setting, bootstrapping is performed after the evaluation of each logic gate, so that one can evaluate homomorphically as many gates as he wants achieving therefore FHE with very competitive performance.

It is probably important to mention that after years of research and development in academic laboratories, the quantum computer is no longer a fanciful dream. Its impending arrival will confront modern cryptology to the first revolution of its young history. Indeed with such computer, the problems on which the security of the current cryptosystems are based upon (factorization, discrete logarithm) can be solved in polynomial time ( [START_REF] Shor | Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer[END_REF]). As a direct consequence, all the cryptographic schemes whose security is based on these problems will not be safe any longer. Therefore it becomes urgent to develop new constructions based on problems which cannot be solved more efficiently with a quantum computer. The recent call of the national Institute of Standards and Technology (NIST) to lay down the foundations of the future standards of post-quantum cryptography goes in this direction.

In view of this, problems based on lattices (euclidean or ideal) are good candidates since we do not know so far any quantum algorithm to solve them more efficiently than with classical algorithms. This is why the medium-term security of homomorphic encryption schemes is not compromised by the quantum computer. However the important costs in time and memory required in practice by homomorphic schemes are still the major bottleneck to their deployment for real-life applications.

Contributions and organization of the report

The purpose of this thesis is to optimize the underlying arithmetic of several SHE schemes based on the Ring-LWE problem in order to enhance their performance. In this way, we hope to break some barriers which still prevent the widespread use of homomorphic encryption. To this end, we have focused on two main approaches:

• optimize the arithmetic used by the primitive of SHE schemes by considering, either the specific operations of these primitives, or the operations needed in the more general framework of Ring-LWE;

• optimize the operations required by a concrete and specific application of homomorphic encryption, both at the algorithmic level and their practical implementations.

Chapter 1 aims at introducing the different notions needed for a correct understanding of the rest of the report. We start by briefly introducing the Ring-LWE problem in the context of cyclotomic fields while highlighting its link with ideal lattices. In a second part we present two of the most currently used homomorphic encryption schemes: BGV and FV which are both based on the Ring-LWE problem. Finally, we present the different tools used in practice to perform the operations needed by these schemes efficiently.

The first contribution of this thesis ([BEHZ17]), presented in Chapter 2, is a suite of algortihms implementing all the primitives of scale-invariant SHE schemes efficiently within the Residue Number System (RNS) representation. RNS representation permits efficient arithmetic (additions and multiplications) for big numbers which is critical to homomorphic encryption. Unfortunately certain operations, like comparison for instance, cannot be performed directly in RNS. By overcoming these limitations, we have been able to perform all the computations required by the different procedures of scale-invariant schemes like FV in RNS representation. This has resulted in a noticeable improvement of the performance of these schemes.

Efficiency of the arithmetic in R q = (Z/qZ)[X]/(f ), which is the ambient space in Ring-LWE, heavily depends on f , in particular because of the reduction modulo this polynomial. This 2. Contributions and organization of the report efficiency is maximal when f is a cyclotomic polynomial of the form X n + 1, but this kind of polynomials suffers from others limitations which, depending on the targeted application, may require to consider other kind of cyclotomics. Chapter 3 presents a work in which we have focused on improving the reduction modulo f procedure, when it is a cyclotomic different from X n +1 ([BEH + 18]). Since this operation is required for each product of elements in R q , its optimization has led to a significant improvement of the performance of BGV and FV in these cases.

In the fourth and last chapter we present a concrete use case of homomorphic encryption to the classification of private data ( [START_REF] Bajard | Classification of Private Data using Homomorphic Encryption[END_REF]). This classification uses advanced machine learning techniques and in particular Support Vector Machine (SVM). Evaluating a SVM homomorphically allows to classify data without revealing them. We start by presenting how SVMs, which are techniques from the supervised learning domain, work. We then describe the algorithmic methods we have devised in order to perform the operations required by SVMs homomorphically. The efficiency of our methods is illustrated by several implementations on different kind of architectures.

Finally in the last chapter, we summarize the results of this thesis together with directions for possible future works. This chapter aims to familiarize the reader with the general context of this thesis. Therefore we start by introducing the celebrated Ring-LWE problem and its relation to ideal lattices. Afterwards we present two of the most used homomorphic encryption schemes in practice BGV and FV, both based on Ring-LWE. Finally we give an overview of the different arithmetic tools used to perform computations in these schemes.

Ring-Learning with Errors problem

In this section we introduce the Ring-LWE problem in the context of cyclotomic fields. Although this problem can be defined and proven hard in any number field [START_REF] Peikert | Pseudorandomness of ring-LWE for any ring and modulus[END_REF], we restrict our exposition to the case of cyclotomic fields, which are among the most used in practice.

Cyclotomic polynomials and cyclotomic number fields

Let m ≥ 1 be an integer and let us consider K m the splitting field of X m -1 over Q.

Definition 1.1.1. An element ζ ∈ K m such that ζ m = 1 is called a m-th root of unity. Moreover if ζ is of order m then it is called a primitive m-th root of unity. Remark 1.1.2.
In C, the m distinct m-th roots of unity form a multiplicative group of order m hence one can think of K m as the smallest extension of Q containing these elements. Since a finite subgroup of the multiplicative group of a field is cyclic, there exists an element of order m in K m .

From now, we denote by ζ m ∈ K m a primitive m-th root of unity. Since ζ m generates all the m-th roots of unity, it generates in particular all the other primitive m-th roots of unity thus

K m = Q(ζ m ). Lemma 1.1.3 ([DF04] section 13.4). Let ζ m ∈ K m be a primitive m-th root of unity. For any 0 ≤ k < m, ζ k
m is a primitive m-th root of unity if and only if k is coprime to m. In particular there are ϕ(m) primitive m-th roots of unity where ϕ denotes the Euler's totient function.

From the primitive m-th roots of unity we can define the m-th cyclotomic polynomial

Φ m ∈ K m [X]
Φ m (X ) = 1≤k < m k∧m=1 (X -ζ k m )
is called the m-th cyclotomic polynomial and its degree is n = ϕ(m).

We can deduce directly from the definition that Φ m is monic and divides X m -1; it follows directly that:

1.1. Ring-Learning with Errors problem Proposition 1.1.5 ([DF04] section 13.6). For any integer m ≥ 1 we have:

X m -1 = d |m Φ d (X ) (1.1.1)
Properties to recursively compute cyclotomic polynomials can be derived from (1.1.1). We do not aim to present those properties but the interested reader can find them in references such as [START_REF] Lang | Algebra. Graduate Texts in Mathematics[END_REF] and [START_REF] Dummit | Abstract Algebra[END_REF]. However the following is essential for our purpose.

K m = Q(ζ m ) Q[X]/(Φ m (X )). The degree of the extension is therefore [Q(ζ m ) : Q] = ϕ(m).
Definition 1.1.9. For an integer m ≥ 1, the m-th cyclotomic number field K m = Q(ζ m ) is the field extension obtained by adjoining an element ζ m of multiplicative order m to Q.

Cyclotomic number fields have been intensively studied but for our purpose we are only interested in a few of their properties. The interested reader can nonetheless refer to the more extensive reference [START_REF] Washington | Introduction to Cyclotomic Fields[END_REF]. We start by introducing the notion of ring of integers. Definition 1.1.10. A number α ∈ C is called an algebraic integer if it is a root of a monic polynomial with integer coefficients.

Theorem 1.1.11 ([DF04] section 15.3). The set of algebraic integers of K m is a ring and a free Z-module of rank n = ϕ(m). Proposition 1.1.12 ([Was97] Proposition 1.2). The ring of algebraic integers of K m is

Z[ζ m ] := k i=0 a i ζ i m / k ∈ N, (a i ) k i=0 ∈ Z . Remark 1.1.13. The set {1, ζ m , . . . , ζ n-1 m } forms a basis of Z[ζ m ] as a free-Z module called its power basis. It corresponds to {1, X, . . . , X n-1 } when Z[ζ m ] is identified to the polynomial ring R = Z[X]/(Φ m (X )) through the ring isomorphism ζ m → X.
We would like to draw the reader's attention on the following important facts. Definition 1.1.16. A fractional ideal F is a set of K m such that there exists a non-zero

d ∈ Z[ζ m ] and d • F = {d f / ∀ f ∈ F } ⊆ Z[ζ m ] forms an ideal of Z[ζ m ].
Equivalently it can be seen as the subset of K m defined by

F = d -1 • I for an ideal I ⊆ Z[ζ m ].
Remark 1.1.17. Note that every ideal of Z[ζ m ] is a fractional ideal. In order to differentiate fractional ideals with ideals of Z[ζ m ] the latter are called integral ideals.

Remark 1.1.18. As fractional ideals are defined through an integral ideal therefore they also form a free Z-module of rank n, their bases being the bases of the corresponding integral ideal multiplied by d -1 .

Another noteworthy fact about cyclotomic fields concerns their Galois group.

Definition 1.1.19. Let L be an extension of a field K, an automorphism σ of L over K is a field automorphism of L such that σ coincides with the identity on K.

It is straightforward to show the set of all the field automorphisms of L over K is a group for the function composition operator. When L is a Galois extension of K, this group is called the Galois group of L over K and is denoted Gal(L/K ). Since K m is the splitting field of X m -1 over Q it is Galois and we know exactly the structure of its Galois group.

Theorem 1.1.20 ([Was97] Theorem 2.5). There is a group isomorphism between the Galois group G = Gal(K m /Q) and (Z/mZ) × which is given by i → (ζ m → ζ i m ). In particular K m has abelian Galois group.

Lattices and ideal lattices

Definition 1.1.21. Let n ≥ 1 be an integer, a lattice L is a discrete additive subgroup of R n endowed with a norm • .

Discrete means that for a given norm there exists an n-dimensional ball centered at zero that does not contain any vector of the lattice L except 0. Therefore there exists a non-zero vector u ∈ L which minimizes this norm. This vector is not unique (-u also satisfies this condition) and is called a shortest vector of L. One may notice that if a vector v ∈ L is linearly dependent with u, i.e. such that v = α • u, then α ∈ Z. Indeed otherwise the non-zero vector v -α • u ∈ L, with • the rounding to the nearest integer, would have a smaller norm than u which would contradict the definition of u. From there we can build by induction on the degree of liberty of L a family of linearly independent vectors that generate L. As a direct consequence a lattice of rank d can be seen as a free Z-module of rank d. We can represent it by a matrix B ∈ M n,d (R) formed by the column vectors of the basis. One may notice that any non-trivial unimodular transformation (matrix with integer coefficients whose determinant is ±1) transforms a basis into another. Hence a lattice of rank d ≥ 2 has an infinite number of bases, all of same cardinality. The common cardinality of the bases is called the rank of the lattice while a full rank lattice refers to a lattice of rank n. From now on n = ϕ(m) will denote the dimension of K m as Q-vector space.

Definition 1.1.23. A geometric embedding ι : K m → R n is an injective morphism of additive groups.

Through a geometric embedding ι any fractional ideal can be mapped to R n and can therefore be identified to a full rank lattice (remark 1.1.18). However those lattices inherit some additional structure from the absorption property of their generating integral ideal, in order to differentiate them from other lattices, they are called ideal lattices. Definition 1.1.24. Let ι be a geometric embedding, then any fractional ideal I ⊆ K m can be identified through ι to a full rank lattice L(I) ⊆ R n and this lattice is called an ideal lattice.

Remark 1.1.25. Depending on the geometric embedding the lattice will not be the same. Therefore, one should always precise through which one the ideal lattice is considered.

The most intuitive geometric embedding is probably the coefficient embedding which represents an element a = a i ζ i m ∈ Z[ζ m ] through its coordinates in the power basis (a 0 , . . . , a n-1 ) ∈ Z n . Unfortunately, despite its relative simplicity, the coefficient embedding is not adapted from an algebraic point of view since it does not preserve the multiplication and thus the structure of ideals. The canonical embedding from algebraic number theory on the other hand, allows to perform multiplication coefficient-wise and thus preserves this structure. Although two embeddings are always related by a linear transformation of R n , the multiplicative property of the canonical embedding makes it more suited for the study of ideal lattices and enables the security reduction of the Ring-LWE problem ( [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF]) and thus its theoretical foundation .

Each element σ

i ∈ G = Gal(K m /Q) defines an embedding from K m to C given by ζ m → ζ i m for i ∈ (Z/mZ) × .
Since any polynomial with real coefficients which vanishes on a complex number x also vanishes on its complex conjugate x, complex embeddings in number fields always come in pairs. Let s 1 be the number of real embeddings and s 2 be the number of pairs of complex embeddings, we have s 1 + 2s 2 = n. We define H ⊆ R s 1 × C 2s 2 hereafter:

H = {(x 1 , . . . , x n ) ∈ R s 1 × C 2s 2 : x s 1 +s 2 +j = x s 1 +j , for 1 ≤ j ≤ s 2 } ⊆ C n (1.1.2)
Definition 1.1.26. Let the elements of Gal(K m /Q) be denoted σ i with 1 ≤ i ≤ n and ordered such that σ s 1 +s 2 +j = σ s 1 +j with 1 ≤ j ≤ s 2 , the canonical embedding is the map σ : K m → H such that σ(a) = (σ 1 (a), . . . , σ n (a)) for any a ∈ K m .

Remark 1.1.27. Since the elements σ i are field homomorphisms, additions and multiplications can be performed coefficient-wise in the canonical embedding.

Remark 1.1.28. General number fields may have some real embedding corresponding to the real roots of their minimal polynomial but in our case Φ m has no real root as soon as m > 2.

Since the cases m = 1, 2 present few interest from a cryptographic point of view, we only consider the case where m > 2, thus K m has only complex embeddings and s 1 = 0.

Remark 1.1.29. For p ≥ 1, H can be endowed with the p norm defined by x p =

( n i=1 |x i | p ) 1/p when p < ∞ and x ∞ = max 1≤i ≤n |x i | when p = ∞.
By identifying elements of K m with their canonical embedding in H, we can speak of geometric norm on K m

x p = σ(x) p .

The attentive reader may have noticed that our definition of the canonical embedding does not match the definition of a geometric embedding as stated in definition 1.1.23 since it embeds into C n . Elements of H have half of their coordinates fixed by complex conjugation, therefore H has dimension n/2 as C-vector space and thus dimension n as R-vector space. In order to work with real lattices, we need to differentiate the real and imaginary parts of the canonical embedding to pull it back to R n . In the case of cyclotomic fields with m > 2, it can be done through the linear transformation whose matrix A is given below:

A = 1 √ 2
I n/2 I n/2 iI n/2 -iI n/2
with I n the identity matrix of size n, i = √ -1. The normalization factor 1/ √ 2 is added in order to preserve the 2 norm through the transformation A (i.e. such that 2 ( Ax) = 2 (x) for any x ∈ H).

Figures 1 and 2 illustrate on a small example how different the lattices generated by the coefficient and canonical embedding are. One can see for instance that one is sparser than the other and that their number of short vectors is different. The interested reader can find a more detailed study of the relations between these two embeddings in [START_REF] Scott | On the Relationship Between Two Embeddings of Ideals into Geometric Space and the Shortest Vector Problem in Principal Ideal Lattices[END_REF].

(1-ζ 3 ) = ζ 3 -(-ζ 3 -1) = 2ζ 3 +1 (since Φ 3 (X ) = X 2 + X +1) corresponds to the vector b 2 = (1, 2)
. These two vectors form a basis of the lattice generated by (1 -ζ 3 ) (Lemma 1.1.14) through the coefficient embedding.

However σ(1 -ζ 3 ) = (1 -ζ 3 , 1 -ζ 3 ) = 1/2(3 -i √ 3, 3 + i √ 3) ∈ H (ζ 3 = e 2iπ/3 = -1/2 + i √ 3/2) and b 1 = σ(1-ζ 3 ) A t = 1/ √ 2(3, √ 3). Similarly σ(2ζ 3 +1) = (i √ 3, -i √ 3) and b 2 = σ(2ζ 3 +1) A t = (0, √ 6

Theoretical hardness of Ring-Learning With Errors

Defining the Ring-LWE problem in a formal way would involve notions and considerations on the shape of the error distribution which are beyond the scope of this thesis. For the sake of simplicity, we introduce the Ring-LWE problem and highlight its hardness in an informal way. For further details on the rigorous definition of Ring-LWE the reader should refer to [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF]. We start by introducing the Shortest (Independent) Vector Problem (S(I)VP) in the context of ideal lattices. Unless stated otherwise, from now we only consider ideal lattices through the canonical embedding.

For a given norm, the length of a shortest vector in a lattice L is called the minimum distance of the lattice and denoted λ 1 (L). This notion can be extended to define the sequence of successive minima. The k-th minimum of the lattice L is defined as the smallest positive real number λ k (L) such that there exists k linearly independent vectors of L, with each vector of norm at most λ k (L). Definition 1.1.31 (SVP and SIVP). Let K m be the m-th cyclotomic number field endowed with a norm • and let γ ≥ 1. The K m -SVP γ problem in the given norm is: given a fractional ideal I in K m find some non-zero x ∈ I such that x ≤ γ • λ 1 (I). The K m -SIVP γ problem is defined similarly, where the goal is to find n linearly independent elements in I whose norms are all at most γ • λ n (I).

Remark 1.1.32. SVP was proven to be an NP-Hard problem for generic lattices ([vEB81], [START_REF] Ajtai | The Shortest Vector Problem in L2 is NP-hard for Randomized Reductions (Extended Abstract)[END_REF], [START_REF] Micciancio | The Shortest Vector Problem is NP-hard to approximate to within some constant[END_REF]), while S(I)VP γ is hard within polynomial factor γ = n O(1) ([Ajt96]). Despite considerable efforts it is not known so far whether or not these problems are easier for ideal lattices and the best current strategy to solve them is to use lattice reduction algorithms. Remark 1.1.33. For convenience we often identify a fractional ideal I with its embedded lattice L(I), and speak of the minimum distance of an ideal λ 1 (I).

Let m ≥ 1 be an integer and R = Z[X]/ (Φ m (X )) ( Z[ζ m ]) be the ring of integer polynomials modulo Φ m (X ). Furthermore for an integer q ≥ 2, consider the ring R q = R/qR (Z/qZ)[X]/ (Φ m (X )), each element of R q can be represented as a polynomial of degree smaller than n and coefficients in {0, . . . , q -1}. Let χ err be an error distribution on R and U q be the uniform distribution on R q . Given a probability distribution D, we use x $ ← -D to denote that x is sampled randomly from D. Definition 1.1.34 (Ring-LWE Distribution). For s ∈ R q and an error distribution χ err over R, a sample from the Ring-LWE distribution A q s, χ er r over R q × R q is the distribution obtained by sampling a $ ← -U q and e $ ← -χ err and outputting a, [a • s + e] q ∈ R 2 q .

Definition 1.1.35 (Ring-LWE, Decisional). Let q ≥ 2 be an integer, s ∈ R q and χ err be a distribution over R. The decisional version of the Ring-LWE problem is defined as follows:

given access to a polynomial number of independent samples in R q × R q , determine whether they were drawn from A q s, χ er r or from the uniform distribution on R q × R q .

Definition 1.1.36 (Ring-LWE, Search). Let q ≥ 2 be an integer, s ∈ R q and χ err be a distribution over R. The search version of the Ring-LWE problem is defined as follows:

given access to a polynomial number of independent samples from the Ring-LWE distribution A q s, χ er r , find s.

The error term e is supposed to be sampled according to a discrete n-dimensional centered spherical Gaussian distribution in the embedding space H, with each coordinate sampled independently ([LPR10], [START_REF] Castryck | On Error Distributions in Ring-based LWE[END_REF]). A noteworthy case is when m is a power of two, in which case the geometry of the corresponding cyclotomic field allows to sample the error term e, as a scaled centered spherical Gaussian, directly in R. We can emphasize two main approaches to transfer the error in R for a general m. In [START_REF] Lyubashevsky | A Toolkit for Ring-LWE Cryptography[END_REF] the authors explain how to invert the canonical embedding map in quasi-linear time allowing therefore to transfer the error term from H to R. The authors of [START_REF] Ducas | Ring-LWE in Polynomial Rings[END_REF] proposed an alternative method to generate the error and proved it does not affect notably the difficulty of the problems. Their approach consists in sampling the error according to a centered spherical Gaussian in Q[X]/(θ m (X )), where θ m (X ) = X m/2 + 1 if m is even and θ m (X ) = X m -1 otherwise. From there the error is reduced to Q[X]/(Φ m (X )) with a polynomial reduction and then its coordinates are rounded coefficient-wise to get it in R.

Lyubashevski et al. have shown that the Ring-LWE Search problem reduces to the Ring-LWE

Decisional problem [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF]. It was later proven that both problems are equivalent [START_REF] Lyubashevsky | Search to decision reduction for the learning with errors over rings problem[END_REF] and both reduce to the Shortest (Independent) Vector(s) Problem: Theorem 1. 1.37 ([LPR10]). Let m be an integer and q a prime congruent to 1 modulo m. Also let α = α(ϕ(m)) ∈ (0, 1) be a real number such that α • q > ω( log m). If there is an algorithm that can solve the decisional Ring-LWE problem for a secret s sampled uniformly in R q = (Z/qZ)[X]/(Φ m (X )) and an error distribution χ err (α); then there exists a quantum algorithm that runs in time O(q • poly(m)) which solves the S(I)VP γ to within a factor γ ∈ Õ( √ m/α) in any ideal of the ring Z[ζ m ].

Remark 1.1.38. The conditions on q to be a prime and congruent to 1 modulo m in the theorem have been removed in [START_REF] Langlois | Hardness of decision (R)LWE for any modulus[END_REF] so that q has only to be an integer greater than 2.

Remark 1.1.39. The secret s should formally be considered as an element of R ∨ the dual fractional ideal of R, however the authors of [START_REF] Ducas | Ring-LWE in Polynomial Rings[END_REF] have also shown that it could be chosen directly uniform in R q without making the problem any easier.

Selecting parameters for a secure Ring-LWE instantiation requires to take many parameters in consideration, in particular the width of the error distribution, and should be done carefully. In [START_REF] Peikert | How Not to Instantiate Ring-LWE[END_REF], Peikert exposes several instantiations of Ring-LWE which are insecure because the error distribution is not well chosen.

Practical considerations

Conditions of the Ring-LWE reduction to S(I)VP ensure an asymptotic security however in practice we need to have an idea of the concrete hardness of an instantiation to estimate its security. Concrete cryptanalysis of lattice based cryptography is beyond the scope of this thesis. However having a basic understanding of the relation between the parameters and the security of a Ring-LWE instantiation is essential to avoid gross errors in parameters selection. We remind that so far it is unknown whether or not the additional structure brought by the defining polynomial in Ring-LWE can be exploited for cryptanalysis. Therefore the security estimations for Ring-LWE are made through analysis for an LWE instance. As mentioned in Remark 1.1.32, the best current strategy to solve S(I)VP or its approximate version is to use lattice reductions algorithms. We have already seen that lattices can be represented by a basis, however vectors appearing in bases can be of very different lengths. Intuitively a "good" basis is formed by short vectors almost orthogonal, i.e. with low orthogonality defect, by opposition a "bad" basis is formed by long vectors almost collinear. Lattice reduction algorithms aim at finding a "good" basis from an arbitrary basis, together with some guaranties on the norm and the orthogonality of the output. The most famous lattice reduction algorithm is probably the celebrated Lenstra Lenstra Lovász (LLL) ([LLL82]) which runs in polynomial time and provides bases of descent quality. Another noteworthy lattice reduction algorithm is BKZ ( [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems[END_REF]) which uses LLL and an SVP-oracle, usually based on enumeration techniques, on small blocks of β < d vectors both as subroutine. For many cryptanalysis applications BKZ provides bases of higher quality in high dimension however its running time, as well as the quality of the output, increases significantly with the block size β. As a consequence, when considering the basis B outputted by a lattice reduction algorithm A, run on an input basis B, we consider the value γ A(B) to measure the quality of reduction offered by the algorithm:

b 1 = γ d A(B) det(L) 1/d
Gama and Nguyen ([GN08]) conjectured that γ A(B) depends mostly on the lattice reduction algorithm used and not on the input basis, thus we will refer to this value as γ A . They also showed that when targeting a given factor γ A in high dimension, the running time of the reduction algorithm mainly depends on γ A and not on the dimension or the volume of the lattice. Thus, by following their idea, there is a minimal factor γ min A that one can achieve in time 2 λ , for security level of λ, with algorithm A. In [START_REF] Lindner | Better Key Sizes (and Attacks) for LWE-Based Encryption[END_REF], Lindner and Peikert proposed a distinguishing attack which succeeds with probability very close to exp(-π( v σ err /q) 2 ) with v a short vector of a lattice associated to the Ring-LWE instantiation with modulus q and error distribution χ err whose standard deviation is σ err . Therefore for the attack to succeed with probability one needs to find a vector of length at most αq/σ err with α =log 2 ( )/π. Furthermore they showed that for a lattice of rank n, the shortest length of vectors one can compute for a given γ A is 2 2

√

n log 2 (q) log 2 (γ A ) . As a consequence to ensure the security of a Ring-LWE instantiation the following inequality must hold:

α q σ err < 2 2 n log 2 (q) log 2 (γ mi n A ) (1.1.3)
Many works were led to predict more accurately the behavior of BKZ, or other lattice reduction algorithms, to get better estimations of the root-Hermite factor one could reach in order to derive better security parameters. The interested reader can refer to the following nonexhaustive list ([CN11], [START_REF] Van De Pol | Estimating Key Sizes for High Dimensional Lattice-Based Systems[END_REF], [START_REF] Lepoint | A comparison of the homomorphic encryption schemes fv and yashe[END_REF], [START_REF] Albrecht | On the concrete hardness of Learning with Errors[END_REF], [START_REF] Micciancio | Practical, Predictable Lattice Basis Reduction[END_REF]). However inequality (1.1.3) allows us to understand the relations between the different parameters and the security, e.g. for a fixed dimension n, one cannot increase q beyond a certain bound without also increasing the standard deviation σ err of the error distribution. Throughout the rest of this thesis, Φ m (X ) ∈ Z[X] will denote the m-th cyclotomic polynomial of degree n = ϕ(m), where ϕ is Euler's totient function. The ring R = Z[X]/(Φ m (X )) is the main structure of Ring-LWE-based schemes such as FV and BGV. An element of R can be thought of as a polynomial with integer coefficients and a degree strictly smaller than n. Unless mentioned otherwise, polynomials are represented in the power-basis {1, X, . . . X n-1 } and are denoted with bold lower-case letters. For a

Somewhat Homomorphic Encryption based on Ring-LWE

= n-1 i=0 a i X i ∈ Z[X],
we denote a ∞ = max{|a i |, 0 i < n} the infinite norm on the coefficients. The expansion factor of the ring R is defined by

δ R = sup{ a • b ∞ / a ∞ • b ∞ for a, b ∈ R -{0}}
and quantifies the size growth of the coefficients during a multiplication in R in the worst-case scenario. The underlying space for ciphertexts is R q = R/qR = (Z/qZ)[X]/(φ m (X )), which is composed of elements of R with coefficients reduced modulo q while the plaintext space is R t for an integer t q. The notation | • | q is used to denote the classical residue modulo q in [0, q) of an integer, while the centered residue in [-q/2, q/2) is denoted by [•] q . Moreover • denotes flooring while • denotes rounding to the nearest integer. By applying them coefficient-wise, those notations can be extended to polynomials.

The following two functions are needed to limit the noise growth during an homomorphic multiplication in the BGV and FV schemes. They are applicable to any a ∈ R, for any radix ω ≥ 2, and with the subsequent parameter ω,q = log ω (q) + 1. D ω,q is a decomposition in radix base ω, while P ω,q retrieves powers of ω which are lost within the decomposition process.

D ω,q (a) = [a] ω , a ω ω , . . . , a ω ω, q -1 ω ∈ R ω, q ω P ω,q (a) = [a] q , [aω] q , . . . , [aω ω, q -1 ] q ∈ R ω, q q Lemma 1.2.1 ([BGV12] lemma 2). For any (a, b) ∈ R 2 , D ω,q (a), P ω,q (b) ≡ a • b mod q.
U q will denote the uniform distribution on R q with coefficients sampled independently in Z ∩ [-q/2, q/2). We will also consider two distributions χ key and χ err on R which are supposed bounded by B key and B err respectively. It means that any a sampled randomly from χ key (resp. χ err ) verifies a ∞ ≤ B key (resp. B err ). The distribution χ err corresponds to a distribution statistically indistinguishable from a discrete centered Gaussian of standard deviation σ err truncated at B err , for a large enough B err (e.g. B err = 6σ err ). Despite Ring-LWE problems being not easier when the secret is sampled from the error distribution χ err ([LPR10]), the key distribution χ key is often chosen different than χ err (e.g. uniform in {-1, 0, 1}). Since noise growth depends on the size of the secret key in many situations, this leads to more efficient protocols. However, such choice might introduce security weaknesses, and thus would require further investigations for any commercial deployment.

Brakerski-Gentry-Vaikuntanathan

In 2011, Brakerski et al. ([BGV12]) designed a leveled homomorphic scheme, namely capable of evaluating circuits of arbitrary size, but known beforehand, without involving the costly bootstrapping procedure of Gentry. The key tool of their construction is the modulus switching procedure which allows to switch a ciphertext ct encrypted under a modulus q to a smaller modulus q in order to keep the noise level "constant". Hence by selecting a chain of moduli {q 0 , . . . , q L } long enough to perform the desired computations, bootstrapping is no longer needed. This section describes the BGV encryption scheme in the Ring-LWE setting.

First, accordingly to the desired security level and the targeted application one starts by selecting public parameters params BGV for the scheme: the cyclotomic index m, the plaintext modulus t, an radix ω ≥ 2, two probability distributions χ key and χ err on the ring R, and a chain of moduli q 0 | q 1 | . . . | q L such that q i ≡ q j mod t for any (i, j) ∈ {0, . . . , L} 2 , and such that t and q L are coprime.

params BGV = (m, t, ω, {q i } L i=0 , χ key , χ err ) Remark 1.2.2.
Usually q L is a product of L + 1 primes of same size and t is a power of two.

Key generation. The secret key sk = s ∈ R is sampled randomly from the distribution χ key . The public key pk = ([a • s + te] q L , -a) ∈ R 2 q L corresponds roughly to a Ring-LWE sample associated to s and q L with a $ ← -U q L and e $ ← -χ err . Finally one generates a public relinearization key

--→ rlk = ([P ω,q (s 2 )+ - → a •s+t - → e ] q L , -- → a ) ∈ R ω, q L q L ×R ω, q L q L by sampling randomly a vector - → a ∈ R ω, q L q L (resp. - → e ∈ R ω, q L q L
) with each component sampled independently from U q L (resp χ err ). Note that s is multiplied to each component of -→ a.

Remark 1.2.3. One can think to --→ rlk as an encryption of s 2 .

Algorithm 1 Key Generation BGV Require: the public parameters params BGV . Ensure: secret key sk, public key pk and relinearization key

--→ rlk function KeyGen BGV (params BGV ) s $ ← -χ key sk ← s (a, e) $ ← -U q L × χ err pk ← ([a • s + te] q L , -a) ( - → a, - → e ) $ ← -U ω, q L q L × χ ω, q L err --→ rlk ← P ω,q L (s 2 ) + - → a • s + t - → e q L
, --→ a return (sk, pk, --→ rlk)

Somewhat Homomorphic Encryption based on Ring-LWE

Encryption A ciphertext ct = (c 0 , c 1 ) ∈ R 2 q L corresponds to a degree 1 polynomial whose coefficients lie in R q L . The message m ∈ R t is hidden in the first coefficient c 0 of the ciphertext, more precisely a message m is encrypted under the public key pk as follows:

ct = [[m] t + u • pk 0 + te 0 ] q L , [u • pk 1 + te 1 ] q L
with u $ ← -χ key and e 0 , e 1 $ ← -χ err . The noise contained in a ciphertext ct = (c 0 , c 1 ) is revealed once it is evaluated on the secret key s, indeed the following equalities hold modulo q L :

c 0 + c 1 • s = [m] t + u • pk 0 + te 0 + (u • pk 1 + te 1 ) • s = [m] t + u • (a • s + te) + te 0 + (-u • a + te 1 ) • s = [m] t + t(u • e + e 1 • s + e 0 )
which leads to:

c 0 + c 1 • s ≡ [m] t + tv mod q L (1.2.1)
where the term v = u•e+e 1 •s+e 0 is the noise inherent to a ciphertext "freshly" encrypted. Since q 0 | q 1 | . . . | q L , encryptions can be performed equivalently at any level i, i.e. modulo q i therefore ciphertexts are always paired with a number 0 ≤ i ≤ L which indicates the level of the encryption.

Algorithm 2 Encryption BGV Require: message m ∈ R t , public key pk = (pk 0 , pk 1 ) and the public parameters params BGV . Ensure: level i ciphertext ct = ((c 0 , c 1 ), i) encrypting m.

function Enc BGV (m, pk, params BGV )

u $ ← -χ key (e 0 , e 1 ) $ ← -χ 2 err return ct = [[m] t + u • pk 0 + te 0 ] q i , [u • pk 1 + te 1 ] q i , i
Decryption As shown in equation (1.2.1), by evaluating a ciphertext on the secret key one almost reveals the message. Therefore to decrypt a message m ∈ R t encrypted at level i in a ciphertext ct = (c 0 , c 1 ) ∈ R 2 q i , one starts by computing m = [c 0 + c 1 • s] q i and then outputs [m ] t . To ensure correctness of the decryption, the noise v must be "small enough" such that m = m + tv does not wrap-around modulo q i . As a consequence decryption will remain correct if:

[m] t + tv ∞ < q i 2 which is ensured as long as:

v ∞ < q i 2t (1.2.2)
As explained above, the noise of fresh ciphertexts is v = u • e + e 1 • s + e 0 with s, u $ ← -χ key and e, e 0 , e 1 $ ← -χ err . Therefore one way to ensure the correctness of the scheme is to choose q 0 such that the norm of this fresh noise v ∞ ≤ 2δ R B key B err + B err remains smaller than q 0 /2t i.e. B err (2δ R B key + 1) < q 0 /2t , with δ R the expansion factor of the ring R.

Algorithm 3 Decryption BGV Require: ciphertext ct = ((c 0 , c 1 ), i), secret key sk = s and the public parameters params BGV .

Ensure: message [m] t (if equation (1.2.2) is satisfied). function Dec BGV (ct, sk, params BGV ) m ← [c 0 + c 1 • s] q i return [m ] t

Modulus switching

The modulus switching is a noise management technique allowing to decrease the size of the noise of a level j > 0 ciphertext, as soon as it becomes too important (e.g. v ∞ > q j /2t ). Roughly, the idea is to drop one (or several) levels in the ladder of moduli by scaling the ciphertext by q i /q j for i < j, which roughly scales down the noise by the same factor. More precisely, let ct = (c 0 , c 1 ) be a level j ∈ (0, L] ∩ Z encryption of a message m and let i be an integer smaller than j, then set:

δ = (t[-c 0 /t] q j /q i , t[-c 1 /t] q j /q i )
In this way for l = 0, 1, δ l ≡ 0 mod t and δ l ≡ -c l mod q j /q i and we can compute:

ct = q i q j • (c 0 + δ 0 , c 1 + δ 1 )
Since c l + δ l ≡ 0 mod q j /q i , the division by q j /q i is exact. Now if we want ct = (c 0 , c 1 ) to be a level i encryption of m, we need to ensure

[c 0 + c 1 • s] q i = [c 0 + c 1 • s] q j mod t.
Let k be such that:

[c 0 + c 1 • s] q j = c 0 + c 1 • s -q j k
and so we have:

c 0 + c 1 • s = q i q j (c 0 + c 1 • s + δ 0 + δ 1 • s) ⇔ c 0 + c 1 • s -q i k = q i q j [c 0 + c 1 • s] q j + δ 0 + δ 1 • s notice that for l = 0, 1 δ l ∞ < tq j 2q i
, it implies:

δ 0 + δ 1 • s ∞ ≤ tq j 2q i (1 + δ R B key ) 1.2. Somewhat Homomorphic Encryption based on Ring-LWE therefore if ct = (c 0 , c 1 ) is such that: [c 0 + c 1 • s] q j ∞ < q j 2 - tq j 2q i (1 + δ R B key ) (1.2.3)
we have:

c 0 + c 1 • s -q i k ∞ < q i 2
and so we obtain what we want:

[c 0 + c 1 • s] q i = c 0 + c 1 • s -q i k = q i q j ([c 0 + c 1 • s] q j + δ 0 + δ 1 • s) = [c 0 + c 1 • s] q j mod t (δ l ≡ 0 mod t and q j ≡ q i mod t)
Furthermore the noise v of ct is given by:

v = q i q j v + b scale (1.2.4) with: b scale ∞ = q i tq j (δ 0 + δ 1 • s) ∞ ≤ 1 + δ R B key 2
Therefore when a level i ciphertext satisfies inequality (1.2.3), one is able to reduce the noise of this ciphertext by converting it to a level i < j. In particular, once a ciphertext reaches level 0, this method cannot be applied anymore.

Algorithm 4 Modulus Switching BGV

Require: ciphertext ct = ((c 0 , c 1 ), i) encrypted at level j > 0 satisfying equation (1.2.3), a level i < j and the public parameters params BGV . Ensure:

ciphertext ct = ((c 0 , c 1 ), i) encrypting the same message than ct at level i function Mod-Switch BGV (ct, j, params BGV ) δ ← (t[-c 0 /t] q j /q i , t[-c 1 /t] q j /q i ) ct ← q i q j (c 0 + δ 0 ) q i , q i q j (c 1 + δ 1 ) q i , j
return ct Addition In the case where ct is encrypted at level i and ct at level j > i, then one starts by applying modulus switching to ct from level j to level i. Once both at same level i, adding the two ciphertexts, which encrypt m and m respectively, leads to:

c 0 + c 0 + (c 1 + c 1 ) • s = c 0 + c 1 • s + c 0 + c 1 • s ≡ [m] t + [m ] t + t(v + v ) mod q i ≡ [m + m ] t + t(v + v + u) mod q i where [m] t + [m ] t = [m • m ] t + u with u ∞ ≤ 1.
This means that:

ct add = [c 0 + c 0 ] q i , [[c 1 + c 1 ] q i ]
is a level i encryption of m + m and its noise is roughly the sum of the noises of ct and ct :

v add = v + v + u.
of norm bounded by:

v add ∞ ≤ v ∞ + v ∞ + 1. (1.2.5)
Algorithm 5 Addition BGV Require: ciphertexts ct = ((c 0 , c 1 ), i) and ct = ((c 0 , c 1 ), j) encrypting messages m and m respectively and the public parameters params BGV . Ensure: ciphertext ct add encrypting m + m at level k = min(i, j).

function

Add BGV (ct, ct , params BGV ) if i j then if i < j then ct ←Mod-Switch BGV (ct , i, params BGV ) ct ← ct else ct ←Mod-Switch BGV (ct, j, params BGV ) ct ← ct k ← min(i, j) ct add ← ([ c0 + c0 ] q k , [ c1 + c1 ] q k , k) return ct add
Multiplication Similarly to the addition, we first need to convert the two ciphertexts to the same level, let say i, by applying the modulus switching technique. Then multiplying the two ciphertexts leads to:

c 0 • c 0 + (c 0 • c 1 + c 1 • c 0 ) • s + c 0 • c 0 • s 2 = (c 0 + c 1 • s) • (c 0 + c 1 • s) ≡ [m] t • [m ] t + t([m] t • v + v • [m ] t + tv • v ) mod q i ≡ [m • m ] t + t([m] t • v + v • [m ] t + tv • v + r m ) mod q i with [m] t • [m ] t = [m • m ] t + tr m which implies that: r m ∞ = [m] t • [m ] t -[m • m ] t t ∞ ≤ δ R t 2 + 2t 4t ≤ δ R t 4 + 1 2 < δ R t 2 (1.2.6)
This means that:

ct mult = ([c 0 • c 0 ] q i , [c 0 • c 1 + c 1 • c 0 ] q i , [c 1 • c 1 ] q i ) ∈ R 3 q i (1.2.7)
1.2. Somewhat Homomorphic Encryption based on Ring-LWE is a degree 2 ciphertext which encrypts m • m and its noise is given by:

v mult = [m] t • v + v • [m ] t + tv • v + r m
whose norm is bounded by:

v mult ∞ < δ R t 2 v ∞ + v ∞ + v ∞ v ∞ + 1 (1.2.8)
Algorithm 6 Multiplication BGV Require: ciphertexts ct = ((c 0 , c 1 ), i) and ct = ((c 0 , c 1 ), j) encrypting messages m and m respectively and the public parameters params BGV . Ensure:

degree 2 ciphertext ct mult encrypting m • m at level k = min(i, j). function Mult BGV (ct, ct , params BGV ) if i j then if i < j then ct ←Mod-Switch BGV (ct , i, params BGV ) ct ← ct else ct ←Mod-Switch BGV (ct, j, params BGV ) ct ← ct k ← min(i, j) ct mult ← ([ c0 • c0 ] q k , [ c0 • c1 + c1 • c0 ] q k , [ c1 • c1 ] q k , k) return ct mult
Relinearization The drawback of the multiplication is the growth of the ciphertext's degree in the same way as in polynomials. Therefore after several multiplications the complexity in terms of time and memory for further operations is considerably increased. In order to keep the ciphertexts' degree constant, one can use a relinearization technique, introduced in [BV11], or sometimes called key switching when ciphertexts reach degree 2.

A degree 2 ciphertext ct = (c 0 , c 1 , c 2 ) which encrypts a message m at level i, satisfies:

c 0 + c 1 • s + c 2 • s 2 ≡ [m] t + tv mod q i
Essentially the idea would be to add c 2 • s 2 to c 0 to get back a degree 1 ciphertext. Although s 2 cannot be published, it can be hidden in a kind of encryption under the public key pk. This is exactly what is done in --→ rlk. However since s 2 is encrypted with pk which is derived from s it requires to use a circular security assumption, i.e. to assume that encrypting a secret key with its corresponding public key remains safe. Hence by computing:

ct = c 0 + D ω,q i (c 2 ), --→ rlk 0 q i , c 1 + D ω,q i (c 2 ), --→ rlk 1 q i ∈ R 2 q i
we obtain a degree 1 encryption of m at level i, indeed:

c0 + c1 s ≡ c 0 + D ω,q i (c 2 ), --→ rlk 0 + c 1 + D ω,q i (c 2 ), --→ rlk 1 • s mod q i ≡ c 0 + c 1 • s + D ω,q i (c 2 ), --→ rlk 0 + D ω,q i (c 2 ), --→ rlk 1 • s mod q i ≡ c 0 + c 1 • s + D ω,q i (c 2 ), P ω,q i (s 2 ) + - → a • s + t - → e -D ω,q i (c 2 ), - → a • s mod q i ≡ c 0 + c 1 • s + c 2 • s 2 + D ω,q i (c 2 ), - → a • s + t - → e -D ω,q i (c 2 ), - → a • s mod q i ≡ c 0 + c 1 • s + c 2 • s 2 + t D ω,q i (c 2 ), - → e mod q i ≡ [m] t + t(v + b relin ) mod q i
with a noise given by:

v relin = v + b relin = v + D ω,q i (c 2 ), - → e
whose norm is bounded by:

v relin ∞ ≤ v ∞ + b relin ∞ ≤ v ∞ + D ω,q i (c 2 ), - → e ∞ ≤ v ∞ + ω, q i -1 j=0 c 2 ω j ω • - → e j ∞ ≤ v ∞ + δ R ω,q i ωB err 2 (1.2.9)
Remark 1.2.4. c 2 is decomposed in radix ω because otherwise there would have been a factor q i instead of ω,q i ω ( log q i ) in the right term of (1.2.9). In which case the noise caused by the relinearization would be potentially much bigger than the decryption bound given in equation (1.2.2) which cannot be tolerated.

Algorithm 7 Relinearization BGV

Require: degree 2 ciphertext ct = ((c 0 , c 1 , c 2 ), i), the relinearization key --→ rlk = ( --→ rlk 0 , --→ rlk 1
) and the public parameters params BGV . Ensure: degree 1 ciphertext ct = ((c 0 , c 1 ), i) encrypting the same message than ct.

function Relinearization BGV (ct, --→ rlk, params BGV ) ct ← c 0 + D ω,q i (c 2 ), --→ rlk 0 q i , c 1 + D ω,q i (c 2 ), --→ rlk 1 q i , i return ct
Parameters selection As shown in equation (1.2.2), in order to correctly decrypt the noise must remain smaller than q 0 /2t . The noise growth during additions is linear (eq. (1.2.15)) and thus quite slow. Hence, it is not necessary to perform a modulus switching technique after each addition. However noise growth during multiplication is quadratic (eq. (1.2.8)), actually it is even more important since each multiplication is followed by a relinearization. Therefore, to prevent the noise to blow up, it is necessary to run a modulus switching procedure at the end of the multiplication plus relinearization procedures. In order to be able to evaluate arithmetic circuits of multiplicative depth L, we must ensure that the noise, after being scaled down by one level, at the end of the whole procedure remains smaller than the noise of the input ciphertexts. Let us assume that the two level i ciphertexts in input of the multiplication have a noise whose norm is bounded by V (V < q 0 /2t ). By combining inequalities (1.2.8), (1.2.9) and (1.2.4) we can show that the noise of the level i -1 ciphertext at the end of the three procedures has norm bounded by:

v ∞ ≤ q i-1 q i δ R t 2 V 2 + 2V + 1 + b relin ∞ + b scale ∞
Therefore if the parameters are selected such that:

         q i q i-1 ≥ δ R tV for all 1 ≤ i ≤ L 2 + b relin ∞ + b scale ∞ ≤ V 2 (1.2.10)
we obtain:

v ∞ ≤ 1 2V V 2 + 2V + 1 + b relin ∞ + b scale ∞ ≤ V 2 + 2 + b relin ∞ + b scale ∞ ≤ V
which means that for a chain of L + 1 moduli, we are able to evaluate circuits of multiplicative depth L.

Fan-Vercauteren

The main drawback of schemes such as BGV is the quadratic growth of the noise during multiplication which requires the use of the modulus switching technique. In its seminal work [START_REF] Brakerski | Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP[END_REF], Brakerski introduced a new type of homomorphic schemes where the noise grows only linearly during multiplication removing thereby the necessity of modulus switching. Therefore all the computations require only a single modulus q by opposition to the chain of moduli in BGV. This is achieved by placing the message in the "upper bits", as opposed to the "lower bits", of the decryption equation (1.2.1). This more effective noise control mechanism makes the scale-invariant schemes, as they are called, particularly interesting. In 2012, Fan and Vercauteren [START_REF] Fan | Somewhat Practical Fully Homomorphic Encryption[END_REF] have adapted the scale-invariant scheme of Brakerski ([Bra12]) to the Ring-LWE setting. We present their scheme (FV) in this section.

Like for BGV, one starts by selecting public parameters params FV according to the desired security level and the targeted application. These parameters are: the cyclotomic index m, the plaintext modulus t, a radix ω ≥ 2, the ciphertext modulus q t and two probability distributions χ key and χ err on the ring R.

params FV = (m, t, ω, q, χ key , χ err ) Key generation. The secret key sk = s ∈ R is sampled randomly from the distribution χ key . The public key pk = ([a • s + e] q , -a) ∈ R 2 q corresponds this time exactly to a Ring-LWE sample associated to s and q (a $ ← -U q and e $ ← -χ err ). The relinearization key

--→ rlk = ([P ω,q (s 2 ) + - → a • s + - → e ] q , -- → a ) ∈ R ω, q q × R ω, q
q is modified in the same way as the public key ( -→ a ∈ R ω, q q sampled from U ω, q q and -→ e ∈ R ω, q q sampled from χ ω, q err ).

Algorithm 8 Key Generation FV Require: the public parameters params FV .

Ensure: secret key sk, public key pk and relinearization key

--→ rlk function KeyGen FV (params FV ) s $ ← -χ key sk ← s (a, e) $ ← -U q × χ err pk ← ([a • s + e] q , -a) ( - → a, - → e ) $ ← -U ω, q q × χ ω, q err --→ rlk ← P ω,q (s 2 ) + - → a • s + - → e q , -- → a return (sk, pk, --→ rlk)
Encryption A message m ∈ R t is encrypted under the public key pk in a ciphertext ct = (c 0 , c 1 ) ∈ R 2 q as follows:

ct = [∆[m] t + u • pk 0 + e 0 ] q , [u • pk 1 + e 1 ] q
with ∆ = q/t , u $ ← -χ key and e 0 , e 1 $ ← -χ err . Like for BGV, the noise contained in a ciphertext ct = (c 0 , c 1 ) is revealed once we evaluate ct on the secret key s:

c 0 + c 1 • s ≡ ∆[m] t + u • pk 0 + e 0 + (u • pk 1 + e 1 ) • s mod q ≡ ∆[m] t + v mod q (1.2.11) with v = u • e + e 1
• s + e 0 the noise of a ciphertext "freshly" encrypted which has its norm bounded by:

v ∞ ≤ B err (2δ R B key + 1) (1.2.12)
Decryption Once again evaluating a ciphertext ct = (c 0 , c 1 ) ∈ R 2 q on the secret key almost reveals the message (cf. (1.2.11)). However this time one cannot simply retrieve the message by taking the result modulo t. We first need to get rid of the factor ∆ by scaling the result by t/q ∆ -1 and rounding the result: Algorithm 9 Encryption FV Require: message m ∈ R t , public key pk = (pk 0 , pk 1 ) and the public parameters params FV . Ensure: ciphertext ct = (c 0 , c 1 ) encrypting the message m function Enc FV (m, pk, params FV )

u $ ← -χ key (e 0 , e 1 ) $ ← -χ 2 err return ct = [∆[m] t + u • pk 0 + e 0 ] q , [u • pk 1 + e 1 ] q t q [c 0 + c 1 • s] q = t q ∆[m] t + v + qu for some u ∈ R = q -|q| t q [m] t + t q v + tu = [m] t + tv -|q| t [m] t q + tu
the last rounding will vanish if:

tv -|q| t [m] t q ∞ < 1 2 ⇔ v - |q| t t [m] t ∞ < q 2t
which is ensured as long as:

v ∞ < q 2t - |q| t 2 = B dec ∆ 2 (1.2.13)
Finally, if inequality (1.2.13) holds, one just has to take the result of the rounding modulo t to get back the message:

t q [c 0 + c 1 • s] q t = [[m] t + tu] t = [m] t
As a consequence, to ensure correct decryption of fresh ciphertexts one needs to have:

B err (2δ R B key + 1) < B dec (1.2.14)
Algorithm 10 Decryption FV Require: ciphertext ct = (c 0 , c 1 ), secret key sk = s and the public parameters params FV .

Ensure: message [m] t (if equation (1.2.13) is satisfied). function Dec FV (ct, sk, params FV ) m ← t q • [c 0 + c 1 • s] q return [m ] t
Addition The addition of ciphertexts ct and ct encrypting m and m respectively is done exactly like in BGV:

c 0 + c 0 + (c 1 + c 1 ) • s ≡ ∆ [m] t + [m ] t + v + v mod q ≡ ∆[m + m ] t + v + v (q -|q| t )u mod q ≡ ∆[m + m ] t + v + v -|q| t u mod q where [m] t + [m ] t = [m • m ] t + u with u ∞ ≤ 1, thus: ct add = ([c 0 + c 0 ] q , [[c 1 + c 1 ] q ])
is an encryption of m + m and its noise is roughly the sum of the noises of ct and ct :

v add = v + v + tu of norm bounded by: v add ∞ ≤ v ∞ + v ∞ + t (1.2.15)
Algorithm 11 Addition FV Require: ciphertexts ct = (c 0 , c 1 ) and ct = (c 0 , c 1 ) encrypting messages m and m respectively and the public parameters params FV . Ensure: ciphertext ct add encrypting m + m .

function

Add FV (ct, ct , params FV ) ct add ← [c 0 + c 0 ] q , [c 1 + c 1 ] q return ct add
Multiplication Multiplying ciphertexts like in BGV would make appear a factor ∆ 2 together with the message. Therefore to get back a valid ciphertext the product is scaled by t/q, which roughly remove one factor ∆, and then rounded. Before starting, remark that any valid ciphertext ct = (c 0 , c 1 ) ∈ R 2 q whose noise has norm smaller than B dec (< ∆/2) satisfies:

c 0 + c 1 • s = ∆[m] t + v + qr for some r ∈ R with: r ∞ = c 0 + c 1 • s -∆[m] t -v q ∞ ≤ δ R B key + 1 2 + 1 r d ∞ (1.2.16) 1.2. Somewhat Homomorphic Encryption based on Ring-LWE Thus: ct • ct (s) = (c 0 + c 1 • s) • (c 0 + c 1 • s) = (∆[m] t + v + qr) • (∆[m ] t + v + qr ) = ∆ 2 [m] t • [m ] t + ∆ [m] t • v + v • [m ] t + q v • r + v • r + v • v + q∆ [m] t • r + [m ] t • r + q 2 r • r = ∆ 2 [m • m ] t + tr m + ∆ [m] t • v + v • [m ] t + q v • r + v • r + v • v + q∆ [m] t • r + [m ] t • r + q 2 r • r
with r m like in (1.2.6). Then scaling by t/q and using t∆ = q -|q| t leads to:

t q ct • ct (s) = ∆[m • m ] t + [m] t • v + v • [m ] t + t q v • v + t v • r + v • r + tqr • r + ∆t [m] t • r + [m ] t • r + r m - |q| t q ∆[m] t • [m ] t + [m] t • v + v • [m ] t
Assuming the ciphertexts in input could decrypt correctly, i.e. have noise v, v' smaller in norm than B dec and thus ∆/2, we can write v

• v = [v] ∆ • [v ] ∆ = [v • v ] ∆ + ∆r v with: r v ∞ ≤ δ R v ∞ v ∞ ∆ + 1 2 < δ R min{ v ∞ , v ∞ } 2 + 1 2 =⇒ 2 r v ∞ < δ R min{ v ∞ , v ∞ } + 1 =⇒ 2 r v ∞ ≤ δ R min{ v ∞ , v ∞ } (1.2.17)
and we obtain:

t q ct • ct (s) = ∆[m • m ] t + [m] t • v + v • [m ] t + t v • r + v • r + (q -|q| t ) [m] t • r + [m ] t • r + r m + r v + tqr • r + t q [v • v ] ∆ - |q| t q ∆[m] t • [m ] t + [m] t • v + v • [m ] t + r v r r with: r r ∞ < 1 q ∆t 2 + |q| t δ R ∆t 2 4 + δ R t 2 ( v ∞ + v ∞ ) + r v ∞ < 1 2 + |q| t δ R t 4 + 1 2 + 1 4t < 1 2 + |q| t δ R t hence: r r ∞ ≤ |q| t δ R t (1.2.18)
The rounding procedure introduces an error r a ∈ Q[X]/(Φ m (X )) such that:

t q (ct • ct )(s) = t q c 0 • c 0 + t q (c 0 • c 1 + c 1 • c 0 ) • s + t q c 1 • c 1 • s 2 + r a
which has its norm bounded by:

r a ∞ ≤ 1 + δ R B key + δ 2 R B 2 key 2 (1.2.19)
Now, by rounding the above expression and by considering its remainder modulo q we get:

t q c 0 • c 0 + t q (c 0 • c 1 + c 1 • c 0 ) • s + t q c 1 • c 1 • s 2 = t q (ct • ct )(s) -r a mod q = ∆[m • m ] t + [m] t • v + v • [m ] t + t v • r + v • r -|q| t [m] t • r + [m ] t • r + r m + r v + r r -r a mod q
So finally we obtain:

t q c 0 • c 0 + t q (c 0 • c 1 + c 1 • c 0 ) • s + t q c 1 • c 1 • s 2 = ∆[m • m ] t + v mult mod q
which means that:

ĉt = t q c 0 • c 0 q , t q (c 0 • c 1 + c 1 • c 0 ) q , t q c 1 • c 1 q (1.2.20)
is a degree 2 ciphertext which encrypts m • m and whose inherent noise is:

v mult = [m] t • v + v • [m ] t + t v • r + v • r -|q| t [m] t • r + [m ] t • r + r m + r v + r r -
v mult ∞ ≤ δ R t δ R B key 2 + 3 2 v ∞ + v ∞ + δ R min{ v ∞ , v ∞ } 2
+ |q| t δ R t δ R B key 2 + 2 + δ 2 R B 2 key + δ R B key + 1 2 (1.2.21)
Algorithm 12 Multiplication FV Require: ciphertexts ct = (c 0 , c 1 ) and ct = (c 0 , c 1 ) encrypting messages m and m respectively and the public parameters params FV . Ensure:

degree 2 ciphertext ct mult encrypting m • m . function Mult FV (ct, ct , params FV ) ct ← (c 0 • c 0 , c 0 • c 1 + c 1 • c 0 , c 1 • c 1 ) ct mult ← t q ct 0 q , t q ct 1 q , t q ct 2 q return ct mult
Relinearization The relinearization step of FV is introduced for the same reasons than in BGV and works exactly the same. By computing:

ct = c 0 + D ω,q (c 2 ), --→ rlk 0 q , c 1 + D ω,q (c 2 ), --→ rlk 1 q ∈ R 2 q
we obtain a degree 1 ciphertext, which encrypts the same message than ct but with an additional term b relin in the noise:

ṽ = v + b relin whose norm is smaller than: b relin ∞ ≤ δ R ω,q i ωB err 2 Algorithm 13 Relinearization FV Require: degree 2 ciphertext ct = (c 0 , c 1 , c 2 ), the relinearization key --→ rlk = ( --→ rlk 0 , --→ rlk 1
) and the public parameters params FV . Ensure: degree 1 ciphertext ct = (c 0 , c 1 ) encrypting the same message than ct.

function Relinearization FV (ct, --→ rlk, params FV ) ct ← c 0 + D ω,q i (c 2 ), --→ rlk 0 q , c 1 + D ω,q i (c 2 ), --→ rlk 1 q return ct
Multiplicative depth Contrary to BGV which is built such that the multiplicative depth is the length of the moduli chain minus one, the multiplicative depth in FV can not be read directly from the parameters. However we can compute it by using the same method than [START_REF] Joppew | Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme[END_REF]. Let us assume that both ciphertexts, in input of the multiplication procedure, have a noise smaller than V in norm. In the case of fresh ciphertext V is smaller than

V init = B err (2δ R B key + 1)
. From the bounds on the noise given above we can deduce that the size of the noise after one multiplication and relinearization is bounded by

C 1 V + C 2 with:          C 1 = δ R t δ R B key + 3 + δ R 2 C 2 = |q| t δ R t δ R B key 2 + 2 + δ 2 R B 2 key + δ R B key + 1 2 + δ R ω,q i ωB err 2
Therefore after L multiplications the noise is bounded by:

C L 1 V + C 2 L-1 i=0 C i 1 = C L 1 V + C 2 C L 1 -1 C 1 -1
Thus the theoretical multiplicative depth corresponds to the biggest integer L max such that:

C L max 1 V init + C 2 C L max 1 -1 C 1 -1 < B dec (1.2.22)

Classical arithmetic in cyclotomic rings

In order to use in practice Ring-LWE based cryptography, one needs to implement basic operations for the arithmetic on cyclotomic rings whose elements can be seen as polynomials of degree smaller than n with coefficients taken modulo q. However to be able to tolerate large noise growth, q is usually chosen large (several hundreds of bits). Besides the size of q, the rank of the associated lattice, which corresponds to n, has to be high enough to meet the security requirements (usually between 2 10 and 2 15 ). This section aims to present the different tools which are used in practice to get an efficient arithmetic on the coefficients and on the polynomials with such parameters. We end our exposition by showing how to encode several messages into a single one while processing them independently through a single ciphertext. All these tools rely on the Chinese Remainder Theorem (CRT) that we recall below for the sake of completeness. We state it in the case of commutative rings which have a neutral element for the multiplication 1 0.

Definition 1.3.1. Let R be a commutative ring, two ideals I and J of R are said to be coprime if there exists x ∈ I and y ∈ J such that x + y = 1.

Definition 1.3.2. Let R be a commutative ring and I and J two ideals of R, the product I • J of the ideals I and J is the ideal of R formed by the set of all the finite sums of elements of the form xy for x ∈ I and y ∈ J.

Theorem 1.3.3 ([DF04] section 7.6). Let I 1 , . . . , I k be k ideals of R that are pairwise coprime and let I = I 1 • I 2 • • • I k be their product, then we have the following ring isomorphism:

C RT : R/I -→ R/I 1 × • • • × R/I k x mod I → (x mod I 1 , . . . , x mod I k ) Remark 1.3.4.
This ring isomorphism allows to carry the ring operations on the residues modulo each "small" ideal I i independently and thus in parallel.

On coefficients: Residue Number System

In order to reach an efficient arithmetic in a polynomial ring, the first thing to do is to get an efficient one in the ring of the coefficients. In our case the coefficients belong to Z/qZ with q an integer of possibly several hundreds of bits without any restriction on its shape (Remark 1.1.38). Asymptotic complexities of operations modulo an integer q for naive algorithms are given in Table 1, for further details on these algorithms one can refer to [START_REF] Menezes | Handbook of Applied Cryptography[END_REF].

As illustrated in Table 1, the bottleneck of modular arithmetic is multiplication (and inversion) whose time complexity is quadratic in the size of q. Therefore for evaluating the cost of an algorithm we usually only consider the number of multiplications/inversions and do not take into account the additions/subtraction's whose cost is negligible compared to multiplications.

Operation Complexity Modular addition

a + b mod q O(log 2 q) Modular subtraction ab mod q O(log 2 q) Modular multiplication ab mod q O((log 2 q) 2 ) Modular inversion (when possible) a -1 mod q O((log 2 q) 2 )

Table 1: Asymptotic complexity of basic operations in Z/qZ

Although dividing the size of q by a constant k does not affect the asymptotic complexity of the operations, it brings an important gain in practice. Hence if some application requires a large modulus q, one has an incentive to decompose it in a product of k smaller prime moduli and use the representation given via the CRT a.k.a Residue Number System (RNS) ( [START_REF] Harvey | The Residue Number System[END_REF]). Unless stated otherwise, from now we assume q = q 1 . . . q k to be a product of k prime moduli of same size. Hence the polynomials of R q are represented through k polynomials of same degree but with smaller coefficients thanks to the ring isomorphism given by the CRT:

RN S q=q 1 ...q k : R q -→ R q 1 × • • • × R q k a → (a mod q 1 , . . . , a mod q k ) (1.3.1)
Remark 1.3.5. The attentive reader should have noticed that to get the isomorphism the moduli q i only need to be pairwise coprime and not prime. However, for reasons that will be explained in the next section they are chosen prime.

RNS representation turns out to be very efficient to compute sums and products to the point where it is commonly used in implementation of RSA ([BI04]) or for elliptic curve cryptography ( [START_REF] Bajard | Residue systems efficiency for modular products summation: Application to Elliptic Curves Cryptography[END_REF]). Furthermore it offers a competitive alternative for issues concerning material implementations with low power consumption [START_REF] Freking | Low-power FIR digital filters using residue arithmetic[END_REF]. However despite its computational efficiency the RNS representation suffers from the drawbacks of non-positional representation systems which limit its practicality. Indeed unlike positional representation such as the binary representation, non-positional representations do not allow to perform any comparison between numbers. Therefore operations like non-exact divisions or roundings require to invert the isomorphism (1.3.1) or at least to convert the residues to an other positional representation like Mix Radix System ([ST67]).

Definition 1.3.6. An (RNS) basis is a finite set of integers B = {b 1 , . . . , b l } pairwise coprime and B = b 1 • • • b l is called the (RNS) modulus of the basis. The set of residues of an element a ∈ R q in basis B is denoted a B .
In the general case, RNS can be used to represent integers and not necessary modular integers. This only requires to use a basis large enough to represent our elements, i.e. such that the modulus of the basis is larger than the biggest element we may need to represent. This condition is needed to avoid an eventual overflow of the basis capacity which would result in a reduction by the modulus of the basis. However since in our case we only want to represent integers modulo q, we do not have to fear an eventual reduction modulo q and we can use {q 1 , . . . , q k } as RNS basis. Throughout the rest of this thesis depending on the context, the letter q may refer either to the product q 1 • • • q k or the RNS basis {q 1 , . . . , q k }. Proposition 1.3.7. Let a ∈ R q be represented by its residues a q in base q, then the polynomial of R defined by:

PartialInv(a q ) = k i=1 |a| q i q i q q i q q i (1.3.2)
is congruent to a modulo q and has its coefficients belonging to [0, kq) ∩ Z.

Proof. One can verify that |PartialInv(a q )| q i = |a| q i for every modulus q i thus it is congruent to a modulo q. Its coefficients are positive by definition and by applying the triangular inequality to upper-bound them we obtain the result.

Remark 1.3.8. The values |q i /q| q i can be precomputed for every q i so that the partial inversion requires k multiplications for each coefficients thus kn multiplications in total.

By computing PartialInv one does not necessary obtain the polynomial a ∈ R q but one of its representatives whose coefficients are not reduced modulo q. In order to get back a, the result has to be reduced modulo q:

a = PartialInv(a q ) -q • α(a q ) (1.3.3)
with α(a q ) = PartialInv(a q ) q which has its coefficients in [0, k) ∩ Z (eq. 1.3.2).

As illustrated in Chapter 2, some computations in RNS require to change the RNS basis which means to convert the residues of a ∈ R q , given in basis q, to an other basis B = {b 1 , . . . , b l } which can be achieved by computing:

FastBconv(a, q, B) = PartialInv(a q ) mod b i b ∈B . (1.3.4)
Even though this computation is quiet efficient (kln modular multiplications) it does not allow to obtain exactly the residues of |a| q in base B but those of |a| q + α(a q )q with α(a q ) ∈ [0, k) (c.f. eq. (1.3.3)). Getting an exact conversion would require to compute α(a q ) with fix or floating point arithmetic at first glance and thus cannot be achieved directly in RNS. In

On polynomials: Number Theoretic Transform

Multiplication of elements in R q corresponds to the multiplication of two polynomials of degree n -1 followed by a reduction modulo Φ m . Since n is large in practice, these operations are the major bottleneck for the efficiency of Ring-LWE based schemes. Several algorithms to perform a polynomial product exist, the number of multiplications asymptotically required by the most important of them is given in Table 2.

Algorithm Complexity Naive O(n 2 ) Karatsuba O(n log 2 (3) ) (≈ n 1.585 ) Toom-Cook O(n log 3 (5) ) (≈ n 1.465 ) Fast Fourier Transform (FFT) O(n log 2 (n))
Table 2: Number of multiplications modulo q asymptotically required for performing a product of two degree n polynomials with classical algorithms As illustrated in Table 2, FFT is the most efficient asymptotically and thus is usually the one used for Ring-LWE arithmetic. We would like to highlight that the name FFT usually refers to the case where polynomials have real or complex coefficients, but when the coefficients belong to a finite field the algorithm is called Number Theoretic Transform (NTT). The principle of the algorithm is to evaluate the input polynomials on the n-roots of unity, perform the product coefficient-wise and interpolate the result. Since multiplication coefficient-wise requires a linear number of multiplications, the bottleneck of this procedure is the evaluation/interpolation of the polynomials. Evaluation of a polynomial of degree n-1 can be done optimally in the general case with n multiplications using Horner's method. Hence an evaluation on n different points, required to interpolate a degree n -1 polynomial, would require n 2 multiplications with a naive approach. However by using symmetries of the n-roots of unity, Cooley and Tukey showed that we could evaluate/interpolate a polynomial on the n-roots of unity, with O(n log 2 (n)) multiplications asymptotically ( [START_REF] Cooley | An algorithm for the machine calculation of complex fourier series[END_REF]). This algorithm, known as Fast Fourier Transform, is optimal for the 2 d -roots of unity (d ≥ 0), therefore when n -1 is not a power of two the coefficients of input polynomials are usually padded with zeroes up to the next power of two. Let N 2 be the function defined over N such that for any n ∈ N N 2 (n) is the smallest power of two greater than or equal to n.

N 2 : N → N n → 2 log 2 (n) (1.3.6)
In our context elements of R q have degree n -1, thus the product of two elements, before the reduction modulo Φ m (X ), have degree 2n -2. As a consequence NTT for multiplications of elements in R q must be of size N = N 2 (2n). The last thing to ensure to be able to use the NTT algorithm is the existence of the N-roots of unity in the ambient space. Lemma 1.3.9. Let q be a prime number, then F q = Z/qZ has an element of order N ≥ 1 if and only if q = 1 mod N.

Proof. First notice that the multiplicative group of F q is F q -{0} which has order q -1 and is cyclic. The direct implication is a consequence of Lagrange's theorem, let ζ be an element of order m in F * q then m divides the order of the group q -1. For the second implication, consider a generator g of

F × q , since N | q -1 then ψ = g q-1
N has order N.

Remark 1.3.10. In our case the arithmetic on R q is decomposed on k smaller arithmetics over the R q i through the RNS representation of the coefficients (c.f. section 1.3.1). Therefore, to be able to use the NTT algorithm on each R q i we need to choose all the moduli q i prime and congruent to 1 modulo N, with N = N 2 (2n).

Throughout the rest of this section q will denote a prime congruent to 1 modulo N = N 2 (2n) and ψ ∈ F q a primitive N-root of unity. The NTT algorithm can be seen as the evaluation of the ring isomorphism given by the CRT:

NTT q, N,ψ : F q [X]/(X N -1) -→ F q [X]/(X -1) × • • • × F q [X]/(X -ψ N -1 ) a → a(1) , a(ψ) , . . . , a(ψ N -1 ) (1.3.7)
Once (1.3.7) is applied we obtain the NTT representation of the polynomials and their product can be performed coordinate-wise thus the time-complexity of the polynomial arithmetic becomes linear in N. Intensive efforts have been made to improve the efficiency of the NTT, either by saving some reductions modulo the prime q [Har14], or by using moduli with special shape [START_REF] Longa | Speeding up the Number Theoretic Transform for Faster Ideal Lattice-Based Cryptography[END_REF] to allow lazy reductions. When the context is clear, we will denote an NTT transformation of degree N by NTT N instead of NTT q, N,ψ . Once the inputs are in NTT representation, one can compute the NTT representation of the product c = a × b of degree 2n -2 through:

NTT N (c) = NTT N (a) NTT N (b) (1.3.8)
where denotes the component-wise multiplication in F q . To obtain the value of c = a × b ∈ R q , a second step is needed, which consists of reducing the result of (1.3.8) modulo Φ m (X ). Further details on this reduction step are given in chapter 3

Before ending this section we would like to draw the reader's attention on the special case occurring when the index m of the cyclotomic is a power of two. In this case n = m/2, N = m and Φ m (X ) = X n + 1 which means that the roots of Φ m are the n-roots of -1.

Lemma 1.3.11. Let m ≥ 2 an even integer, n = m/2 and q a prime such that q = 1 mod m. Let ψ ∈ F q be an element of order m, in particular ψ n = -1 mod q, then Ψ = ψ 2 is a primitive n-root of unity and {Ψ i ψ} n-1 i=0 is the set of the n-roots of -1 over F q .

Proof. ψ is of order m thus ψ 2 is of order n = m/2 by definition. It is immediate to show that

(Ψ i ψ) n = -1 mod q for every i ∈ [0, n) ∩ Z.
Hence we have n roots of X n + 1 over F q which is a field thus we have all of them.

Thus when m is a power of two and q and ψ ∈ F q are like in Lemma 1.3.11 we can evaluate a polynomial a ∈ R q directly on the roots of Φ m by applying an NTT of size n = N/2 on

f ψ (a) = n-1 i=0 a i ψ i X i ∈ R q .
In this case the product of two polynomials is done directly modulo X n + 1 = Φ m and we can get back the result c = a × b ∈ R q by just inverting the NTT representation and f ψ through:

c = f ψ -1 NTT -1 N/2,ψ 2 NTT N/2,ψ 2 ( f ψ (a)) NTT N/2,ψ 2 ( f ψ (b)) (1.3.9)
This technique introduced in [LMPR08], and known as negative-wrapped convolution, allows to perform a product in R q with NTT of size n = N/2 instead of N and without requiring any polynomial reduction. The cheap pre-(resp post-) processing required for the evaluations of f ψ (resp. f -1 ψ = f ψ -1 ) can be avoided by merging the powers of ψ (resp. ψ -1 ) with powers of Ψ = ψ 2 (resp. Ψ -1 ) inside the NTT [RVM + 14] (resp. inverse NTT [START_REF] Pöppelmann | High-Performance Ideal Lattice-Based Cryptography on 8-Bit ATxmega Microcontrollers[END_REF]).

We end this section by summarizing in Figure 3 the different representations used to perform computations in R q with q = q 1 • • • q k a product of k prime moduli of same size all congruent to

1 modulo N = N 2 (2n). Classical R q = (Z/qZ)[X]/(Φ m (X ))
Simple CRT (RNS)

F q 1 [X]/(Φ m (X )) × • • • × F q k [X]/(Φ m (X )) Double CRT (RNS + NTT) F q 1 [X]/(X -1) × • • • × F q k [X]/(X -1) . . . . . . . . . . . . . . . . . . F q 1 [X]/(X -ψ N -1 1 ) × • • • × F q k [X]/(X -ψ N -1 k ) RNS q=q 1 •••q k RNS -1 q=q 1 •••q k NTT q 1 , N,ψ 1 NTT -1 q 1 , N,ψ 1 (+reduction) • • • NTT q k , N,ψ k NTT -1 q k , N,ψ k (+reduction) O nk log 2 (q) O nk log 2 (q) O n log n log 2 (q) k O n log n log 2 (q) k

Splitting cyclotomic polynomials for homomorphic encryption

In practice, the efficiency of Ring-LWE based homomorphic encryption schemes is strongly related to the polynomial arithmetic in the ring R q . Choosing m as a power of 2 allows to use NTTs with the negative wrapped convolution technique and thus to perform one multiplication in R q through the operations in (1.3.8) with half-sized NTTs, resulting in a very efficient arithmetic. However, even in this case the efficiency of the schemes remains lowly satisfactory and hardly practical. In [START_REF] Smart | Fully homomorphic SIMD operations[END_REF], the authors found a way to amortize the cost of these operations by encoding several messages in a single plaintext element, with a technique called batching. The idea is to choose a prime plaintext modulus t such that, Φ m splits modulo t into distinct irreducible polynomials F 1 , ...,F , thus a message in the original plaintext space can be split through the CRT into smaller plaintext spaces.

Proposition 1.3.12. Let t be a prime and m a positive integer not divisible by t. The m-th cyclotomic polynomial Φ m of degree n = ϕ(m) splits modulo t into = n/d irreducible factors of same degree d, where d is the order of t modulo m.

Proof. Let ζ be a root of Φ m in a splitting field K of Φ m over F t . Since ζ is a root of Φ m , it has multiplicative order m in K × . Let d be the degree of the minimal polynomial of ζ over F t , then d is the smallest integer such that ζ t d = 1, i.e. d is the smallest integer such that m | t d -1.
Hence when the conditions of Proposition 1.3.3 are fulfilled, Φ m splits modulo t in F 1 , . . . , F and the CRT gives us the ring isomorphism:

CRT t R t -→ F t [X]/(F 1 ) × • • • × F t [X]/(F ) a → (a mod F 1 , . . . , a mod F ) (1.3.10)
In this way, "small" plaintexts m 1 , ..., m can be compactly represented as a single polynomial m ∈ R t . Afterwards m is encrypted and homomorphic operations applied to this ciphertext operate on each slot individually. This technique is particularly interesting when the messages to encode are small. For instance when evaluating Boolean circuits, i.e. with t = 2, the bit to encrypt is encoded on the degree zero coefficient of the message, thus only one coefficient (over n) would be used while with batching one can pack -bits per plaintext.

Remark 1.3.13. When m is a power of two, since Φ m (X ) = X m/2 + 1 ≡ (X + 1) m/2 mod 2,
this technique cannot be used. Thus the efficient arithmetic associated with power-of-two cyclotomics has limited applicability thus for practical application one may considered nonpower of two cyclotomics (see for instance: [START_REF] Gentry | Homomorphic Evaluation of the AES Circuit[END_REF], [START_REF] Halevi | Faster Homomorphic Linear Transformations in HElib[END_REF], [START_REF] Basilakis | Efficient Parallel Binary Operations on Homomorphic Encrypted Real Numbers[END_REF], [CGH + 18], ...).

With batching, the slots are processed independently in their ambient space, however for some computations it can be useful to permute the slots directly through the ciphertexts. In [START_REF] Gentry | Fully Homomorphic Encryption with Polylog Overhead[END_REF], Gentry et al. have shown how to achieve this by using the action of the Galois group of K m = Q(ζ m ) over Q on the cyclotomic ring R K m . We give an overview of their method in the following.

Let t and m be like in Proposition 1.3.3 and let G = Gal(K m /Q). We know that (Z/mZ) × is isomorphic to G through the map i → (X → X i ) (theorem 1.1.20). It is noteworthy to notice that elements of the Galois group σ commutes with CRT t i.e. for a ∈ R t we have σ(CRT t (a)) = CRT t (σ(a)) = (σ(a 1 ), . . . , σ(a )). Moreover since t generates a subgroup of order d in (Z/mZ) × , G contains a subgroup of order d generated by X → X t . Proposition 1.3.14 ([DF04], section 13.5). Let F be a field of characteristic t, the map:

F t : F → F x → x t (1.3.11)
is an injective field morphism called the Frobenius endomorphism of F, also simply called the Frobenius of F. When F is finite it is an automorphism of F over its prime field. In our case, X → X t induces, through CRT t , the Frobenius automorphism over each field

F t [X]/(F i (X )) F t d
for all the factors F i of Φ m and generates their Galois group over F t . In particular the group F = X → X t , seen as Galois group, acts transitively on the roots of the factors F i . Thus, by considering the action of the subgroup F of G over all the roots of Φ m , we are able to partition them into disjoint subset of cardinality d, where each subset corresponds to the roots of a factor F i . Since G acts transitively on all the roots of Φ m , the quotient group H = G/F acts transitively on the set X 1 , . . . , X where each X i is a representative of the roots of the factor F i of Φ m modulo t. Since defining a representative X i essentially means fixing a representation of the field F t [X]/(F i (X )), the elements of H act directly as permutations of the plaintext slots. Now let us consider messages m 1 , . . . , m encoded in m ∈ R t which is encrypted, with the FV scheme for instance (can be applied to BGV in the same manner), in a ciphertext ct = (c 0 , c 1 ) ∈ R 2 q with inherent noise v i.e. such that:

c 0 + c 1 • s = ∆[m] t + v
where s ∈ R is the secret key. For σ i : X → X i ∈ G and a ∈ R q we denote a (i) = σ i (a). Therefore if we apply an element σ i ∈ G to this equation we obtain:

c (i) 0 + c (i) 1 • s (i) = ∆[m (i) ] t + v (i) mod q which means that ct (i) = (c (i) 0 , c (i) 1
) is an encryption of m (i) , i.e. m with its slots permuted by σ i (modulo the action of the Frobenius), and which requires the secret key s (i) to be decrypted. In order to be able to decrypt ct (i) with the original key s we need to apply a key-switching method whose principle is similar to the relinearization procedure. If the entity which performs the computations on the ciphertexts was given an "encryption" of s (i) as evaluation key:

--→ evk i = P ω,q (s (i) ) + - → a i • s + - → e i q , -- → a i with - → a i $ ← -U ω, q q
and -→ e i $ ← -χ ω, q err similarly to the relinearization key. Then the ciphertext:

ct = c (i) 0 + D ω,q (c (i) 1 ), --→ evk i 0 q , D ω,q (c (i) 1 ), --→ evk i 1 q
can be decrypted using the key s. Indeed one can verify that:

c 0 + c 1 • s = ∆[m (i) ] t + v (i) + D ω,q (c (i) 1 ), - → e i mod q
Therefore the key-switching procedure adds a noise v switch = D ω,q (c (i) 1 ), -→ e i of same size than the one of the relinearization procedure.

v switch ∞ ≤ δ R ω,q i ωB err 2
Remark 1.3.16. Making the evaluation key, or even the relinearization key, public implies to use a circular security assumption i.e. to assume that encrypting a secret key under its corresponding public key is secure.

A last thing to notice is that the action of G on a ciphertext applies to the encrypted message and the noise. Therefore it would be interesting to know by how much it increases the initial noise. The easiest way to get a general bound on this growth is to consider the infinite norm of the elements through the canonical embedding like the authors of [START_REF] Gentry | Fully Homomorphic Encryption with Polylog Overhead[END_REF] do. For a ∈ R and ζ m a primitive m-th root of unity it is defined as:

a can ∞ = max 1≤k < m k∧m=1 a(ζ k m ) = σ(a) ∞ (1.3.12)
where σ denotes the canonical embedding map. Indeed since elements of G permute the roots of Φ m , the canonical norm is invariant under the action of G. If we consider the invertible Vandermonde matrix CRT m ∈ M n,n (C) given by the n = ϕ(m) primitive m-th roots of unity ζ m,1 , . . . , ζ m,n :

CRT m = 1 ζ m,1 • • • ζ n-1 m,1 1 ζ m,2 • • • ζ n-1 m,2 . . . . . . . . . 1 ζ m,n • • • ζ n-1 m,n (1.3.13)
we can write for any a ∈ K m :

a ∞ = CRT -1 m σ(a) ∞ ≤ CRT -1 m ∞ σ(a) ∞ ≤ CRT -1 m ∞ a can ∞ ≤ c m a can ∞ (1.3.14)
where

c m = CRT -1 m ∞ , with A ∞ = max 1≤i ≤n n j=1 |a i, j | for a square matrix A ∈ M n,n (C).
The interested reader can find details about the constant c m in [START_REF] Damgård | Multiparty Computation from Somewhat Homomorphic Encryption[END_REF], we just would like to mention that it can grow super-polynomially with m and that when m is a power-of-two it is equal to 1. Thus going back to key-switching, we can write:

v (i) ∞ ≤ c m v (i) can ∞ = c m v can ∞ Thus if the noise v of a ciphertext ct is such that: c m v can ∞ < B dec -δ R ω,q i ωB err /2 (1.3.15) then the ciphertext ct (i) = (c (i) 0 , c (i) 1 )
will decrypt correctly after the key-switching procedure.

This work focuses on practical improvement of scaled-invariant homomorphic schemes. The improvements will be highlighted on the FV scheme although other schemes like Yet Another Somewhat Homomorphic Encryption' (YASHE') [START_REF] Joppew | Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme[END_REF], despite the fact that its security has been called into question recently [START_REF] Albrecht | A subfield lattice attack on overstretched NTRU assumptions: Cryptanalysis of some FHE and Graded Encoding Schemes[END_REF], could also benefit from this work. As mentioned in section 1.3.1, choosing the ciphertexts modulus q as a product of small moduli fitting with practical hardware requirements (machine word, etc), allows to use RNS representation for the coefficients and thus avoid the need of multi-precision arithmetic in almost the whole scheme. However, since RNS is hardly compatible with several operations: non-exact division, rounding and decomposition in basis ω occurring in decryption, multiplication and relinearization, it is required to switch to a positional system at some point for performing these operations.

In this work we show how to efficiently avoid any switch between RNS and a positional system for performing these operations. Therefore we avoid the costs associated to the conversions (cf. Figure 3) together with costly multi-precision arithmetic. We present our full RNS variant of FV and analyze the new bounds on noise growth, finally a software implementation highlights the practical benefits of our variant. It is important to note that this work is related to the arithmetic at the coefficient level, thus the security features of the original scheme are not modified. For the same reasons, we will not complicate futilely our exposition with polynomial arithmetic in the general case and will only consider the particular case of power-of-two cyclotomics R = Z[X]/(X n + 1) with NTT using the negative wrapped convolution technique (cf. section 1.3.2).

Preliminaries and notations. The ciphertexts modulus q is chosen as a product of k prime moduli q 1 • • • q k . Ciphertexts will be managed as polynomials (of degree 1 2 } is equal to n. For our subsequent discussions on decryption and homomorphic multiplication, we denote the "Division and Rounding" in R[Y ], depending on parameters t and q, by:

) in R[Y ]. For ct ∈ R[Y ], we note ct ∞ = max i ct[i] ∞ , ct[i] being the coefficient of degree i in Y . The multiplicative law of R[Y ] is denoted by . In the case of power-of-two cyclotomics the expansion factor δ R = sup{ f • g ∞ / f ∞ • g ∞ : (f, g) ∈ (R \ {0})
DR t,q : ct = deg(ct) j=0 ct[ j]Y j ∈ R[Y ] → deg(ct) j=0 t q ct[ j] Y j ∈ R[Y ]. (2.0.1)
The letter ν will denote the size of a machine word. Therefore, from now on, any modulus b (should it belong to basis q or any other RNS basis) is assumed to verify b < 2 ν . In RNS, an "inner modular multiplication" (IMM) in a small ring like Z/bZ is a core operation. If EM stands for an elementary multiplication of two words, in practice an IMM is costlier than an EM. But it can be well controlled. For instance, the moduli provided in NFLlib library [AMBG + 16] (cf. Sect. 2.4) enable a modular reduction which reduces to one EM followed by a multiplication modulo 2 ν . Furthermore, the cost of an inner reduction can be limited by using lazy reduction, e.g. during RNS base conversions used throughout this paper. For the sake of simplicity, NTT and invNTT will denote the Number Theoretic Transform and its inverse used with the negative wrapped-convolution technique in a ring R b for a modulus b.

Towards a full RNS decryption

This section deals with the creation of a variant of the original decryption function Dec FV , which will only involve RNS representation. The definition of Dec FV is recalled hereafter.

Dec FV (ct = (c 0 , c 1 ) ∈ R q [Y ]) = DR t,q [ct(s)] q t = t q [c 0 + c 1 s] q t
We recall that the idea is to compute ] t +v] q to reveal the noise v. If this noise is small enough, and given that [m] t has been scaled by ∆ = q/2t , the function DR t,q allows to cancel the noise while scaling down ∆[m] t to recover [m] t . Concretely, decryption is correct as long as v ∞ < B dec = (∆ -|q| t )/2, i.e. the size of the noise should not go over this bound after homomorphic operations.

[c 0 +c 1 s] q = [∆[m
The division-and-rounding operation makes Dec FV hardly compatible with RNS at a first sight. Because RNS is of non positional nature, only exact integer division can be naturally performed (by multiplying by a modular inverse). But it is not the case here. And the rounding operation involves comparisons which require to switch from RNS to another positional system anyway, should it be a classical binary system or a mixed-radix one [START_REF] Szabo | Residue Arithmetic and Its Applications to Computer Technology[END_REF]. To get an efficient RNS variant of Dec FV , we use an idea of [START_REF] Bajard | RNS Arithmetic Approach in Lattice-Based Cryptography: Accelerating the "Rounding-off" Core Procedure[END_REF]. To this end, we quickly recall relevant RNS tools.

Fast RNS base conversion

At some point, the decryption requires, among others, a polynomial to be converted from R q to R t . To achieve such kind of operations as efficiently as possible, we suggest to use a "fast base conversion". In order to convert residues of a ∈ R q from base q to a base B (e.g. {t}) coprime to q, we compute:

FastBconv(a, q, B) = k i=1 a q i q q i × q q i mod b b ∈B . (2.1.1)
This conversion is relatively fast. This is because the sum should ideally be reduced modulo q in order to provide the exact value a; instead, (2.1.1) provides a + α(a q )q for a α(a q ) ∈ R with coefficients in [0, k) ∩ Z (cf. section 1.3.1). Computing the coefficients of α(a q ) would require extra operations in RNS. So this step is by-passed, at the cost of an approximate result.

Approximate RNS rounding

The above mentioned fast conversion allows us to efficiently compute an approximation of t q [c 0 + c 1 s] q modulo t. The next step consists in correcting this approximation.

First, we remark that |ct(s)| q can be used instead of [ct(s)] q . Indeed, the difference between these two polynomials is a multiple of q. So, the division-and-rounding turns it into a polynomial multiple of t, which is canceled by the last reduction modulo t. Second, a rounding would involve, at some point, a comparison. This is hardly compatible with RNS, so it is avoided. Therefore, we propose to simplify the computation, albeit at the price of possible errors, by replacing rounding by flooring. To this end, we use the following formula:

t q |ct(s)| q = t|ct(s)| q -|t • ct(s)| q q .
The division is now exact, so it can be done in RNS. Since this computation has to be done modulo t, the term t|ct(s)| q cancels. Furthermore, the term (|t • ct(s)| q mod t) can be obtained through a fast conversion. Lemma 2.1.1 sums up the strategy by replacing |ct(s)| q by γ|ct(s)| q , where γ is an integer which will help in correcting the approximation error.

Lemma 2.1.1. Let ct be such that [ct(s)] q = ∆[m] t + v + qr, and let v c := tv -[m] t |q| t . Let γ be an integer coprime to q. Then, for b ∈ {t, γ}, the following equalities hold modulo b:

FastBconv(|γt • ct(s)| q , q, {t, γ}) × | -q -1 | b = γ t q [ct(s)] q -e = γ [m] t + tr + γ v c q -e (2.1.2)
where each integer coefficient of the error polynomial e ∈ R lies in [0, k].

Proof. According to (2.1.1), FastBconv(|tγ • ct(s)| q , q, {t, γ}) provides |tγ • ct(s)| q + qa, where each coefficient a i is an integer lying in [0, k) ∩ Z. Let b be t or γ. Then,

FastBconv(|tγ • ct(s)| q , q, {t, γ}) × | -q -1 | b = (|tγ • ct(s)| q + qa) × | -q -1 | b mod b = tγ[ct(s)] q -|tγ • ct(s)| q -qa q mod b = tγ[ct(s)] q q -a mod b = tγ[ct(s)] q q -e mod b
where e = a + u, with u i ∈ {0, 1}, i.e. e i ∈ [0, k] ∩ Z. To conclude the proof, it suffices to use the equality ∆t = q -|q| t . That way, one can write:

t[ct(s)] q = q([m] t + tr) + v c
and the second equality (2.1.2) follows.

The error e, due to the fast conversion and the replacement of rounding by flooring, is the same error for residues modulo t and γ. The residues modulo γ will enable a fast correction of it and of the term γ v c q at a same time. Also, note that r vanishes since it is multiplied by both t and γ.

Correcting the approximate RNS rounding

The next step is to show how γ can be used to correct the term ( γ v c q -e) of (2.1.2). In practice it can be done efficiently when the polynomial

v c is such that v c ∞ q( 1 2 -ε), for some real number ε ∈ (0, 1/2]. Lemma 2.1.2. Let v c ∞ q( 1 2 -ε), e ∈ R with coefficients in [0, k],
and γ an integer. Then,

γε k ⇒ γ v c q -e γ = γ v c q -e.
(2.1.3)

Proof. By hypothesis, the coefficients γ (v c ) i q -e i belong to -γ( 1 2 -ε) -k, γ( 1 2 -ε) ∩ Z for any i ∈ [0, n) ∩ Z. To have [ γ v c q -e] γ = γ v c
q -e, we need to ensure:

- γ 2 - 1 2 γ (v c ) i q -e i < γ -1 2 + 1 2
A sufficient condition for this is given by:

         γ 1 2 -ε < γ -1 2 + 1 2 - γ 2 - 1 2 -γ 1 2 -ε -k ⇔                  (γ odd)      γε > 0 γε k (γ even)      γε > 1 2 γε k -1 2
Lemma 2.1.2 enables an efficient and correct RNS rounding as long as γ, which has to be greater than:

γ ≥ kε -1 = k 1 2 - v c ∞ q -1
has the size of a modulus i.e. such that γ < 2 ν . Concretely, one computes (2.1.2) and uses the centered remainder modulo γ to obtain γ [m] t + tr modulo t, which reduces to γ[m] t mod t.

In the end, it remains to multiply by |γ -1 | t to recover [m] t .

A full RNS variant of FV decryption

The new variant of the decryption is detailed in Algorithm 14. The main modification for the proposed RNS decryption is due to lemma 2.1.2. As stated by theorem 2.1.3, for a given γ, the correctness of rounding requires a new bound on the noise to make the "γ-correction" technique successful.

Theorem 2.1.3. Let ct(s) = ∆[m] t + v (mod q). Let γ be a positive integer coprime to t and q such that γ > 2k/ 1 -t |q | t q . For Algorithm 14 returning [m] t , it suffices that v satisfies the following bound:

v ∞ q t 1 2 - k γ - |q| t 2 .
(2.1.4)

Proof. According to lemma 2.1.2, the γ-correction technique works as long as:

γ 1 2 - v c ∞ q k ⇔ v c ∞ q 1 2 - k γ
Moreover since we have:

v c ∞ = tv -|q| t [m] t ∞ t v ∞ + |q| t t 2
The bound (2.1.4) follows, and the lower bound on γ just ensures it is positive.

There is a trade-off between the size of γ and the bound in (2.1.4). From a computational point of view γ should ideally be as small as possible (γ 2k) but it would result in a quite small bound for the noise. However by choosing γ 2 p+1 k for p < ν -1log 2 (k) (i.e. γ < 2 ν is a standard modulus), the bound (∆(1-2 -p ) -|q| t )/2 for a correct decryption should be close to the original bound (∆ -|q| t )/2 for practical values of ν. In section 2.4.1 we will provide a concrete estimation of γ which shows that γ can be chosen very close to 2k in practice, and thus fitting in a basic machine word by far.

Algorithm 14 RNS Decryption of FV Require: a ciphertext ct, encrypting a message m ∈ R t and whose noise v satisfies (2.1.4), and the secret key s both in base q, an integer γ satisfying hypothesis of theorem 2.1.3 Ensure:

[m] t function Dec RNS (ct, s, γ)) for b ∈ {t, γ} do s (b) ← FastBconv(|γt • ct(s)| q , q, {b}) × | -q -1 | b mod b s(γ) ← [s (γ) ] γ m (t) ← [(s (t) -s(γ) ) × |γ -1 | t ] t return m (t)

Staying in RNS is asymptotically better

In the decryption technique, (ct(s) mod q) has to be computed first. To optimize this polynomial product, one basically performs kNTT → knIMM → kinvNTT. For the following steps, a simple strategy is to compute ( t q [ct(s)] q mod t) by doing an RNS-to-binary conversion in order to perform the division and rounding. By denoting x i = ct(s) q i q q i , one computes k i=1 x i q q i mod q, compares it to q/2 so as to center the result, and performs division and rounding. Since the x i s fit in one word and the q/q i s fit in k -1 words, each product x i q/q i requires n(k -1)EM. The scaling and rounding only requires O(n) multiplications, hence the whole procedure requires O(k 2 n)EM. As shown in equation (1.1.3), in practice security analysis (cf. e.g. [START_REF] Fan | Somewhat Practical Fully Homomorphic Encryption[END_REF], [START_REF] Joppew | Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme[END_REF], [START_REF] Lepoint | A comparison of the homomorphic encryption schemes fv and yashe[END_REF]) requires that k ν = log 2 (q) ∈ O(n) which leads to an asymptotic complexity of O(n 3 )EM for leaving RNS representation. On the other hand, the cost of evaluating the ciphertext on the secret key is asymptotically O(kn log 2 (n))EM, i.e. O(n 2 log 2 (n))EM, since k ∈ O(n). So, the cost of leaving RNS to access a positional system is dominant in the asymptotic computational complexity.

Staying in RNS enables to get a better asymptotic complexity. Indeed, since the operations in Algorithm 14 are always made modulo b ∈ {t, γ}, all the elements fit in one word, therefore it requires O(kn)EM operations (excluding the polynomial product). Thus, the cost of NTT is dominant in this case. By considering k ∈ O(n), we deduce C(Dec FV ) ∈ O(n 3 ), while C(Dec RNS ) ∈ O(n 2 log 2 (n)). However, the hidden constant in " k ∈ O(n)" is small, and the NTT, common to both variants, should avoid any noticeable divergence (cf. 2.4.4) for practical ranges for parameters.

In order to provide optimized RNS variants of decryption, we make two remarks.

• First, the reduction modulo q is unnecessary. Indeed, any extra multiple of q in the sum k i=1 x i q q i is multiplied by t q , making the resulting term a multiple of t, which is not affected by the rounding and is finally canceled modulo t.

• Second, it is possible to precompute t q as a multi-precision floating point number in order to avoid a costly integer division. But given the first remark, it suffices to precompute the floating point numbers Q i ∼ t q i with 2ν+log 2 (k)-log 2 (t) bits (∼ 2 words) of precision. In this case, using standard double or quadruple (depending on ν) precision is sufficient. Finally, it is sufficient to compute k i=1 x i Q i mod t. This represents about 2knEM, in particular since reducing modulo t is nearly free of cost when t is a power of 2.

Actually, we can perform the computations even more efficiently. In Algorithm 14, γ is assumed to be coprime to t. It is possible to be slightly more efficient by noticing that the coprimality assumption can be avoided since the division by γ is exact. To do it, the for loop can be done modulo γ × t. For instance, even if t a power of 2, one can choose γ as being a power of 2, and thanks to the following lemma, finish the decryption very efficiently.

Lemma 2.1.4. Let γ be a power of 2. Let z := |γ[m] t + γ v c
q -e| γt coming from (2.1.2) when computed modulo γt. If γ satisfies (2.1.3), then ( denotes the right bit-shifting, and & the bit-wise and)

[(z + (z&(γ -1))) log 2 (γ)] t = [m] t .
(2.1.5)

Proof. Let's denote ṽc := γ v c q -e. By computing (2.1.2) modulo γt, we obtain:

z = γ[m] t + ṽc γt
First, we notice that we can also write z = |γ|m| t + ṽc | γt . Indeed, γ|m| t = γ([m] t + ta), where a i ∈ {0, 1}. Thus, γta vanishes modulo γt. Next, for any t, and because γ is a power of 2, we have z&(γ -1) = |z| γ = |ṽ c | γ . Consequently,

z + z&(γ -1) = |γ|m| t + ṽc | γt + |ṽ c | γ Now, (2.1.3) means that γ is chosen such that the coefficients (ṽ c ) i , i ∈ {0, . . . , n -1}, lie in [-γ 2 , γ 2
). This, together with the fact that (γ|m| t ) i ∈ [0, γ(t -1)], implies that we can write |γ|m| t + ṽc | γt = γ|m| t + ṽc + γtb with b i ∈ {0, 1} (b i = 1 ⇔ ((γ|m| t ) i = 0 and (ṽ c ) i < 0)). To sum up, we have established so far that:

z + z&(γ -1) = γ|m| t + ṽc + |ṽ c | γ + γtb
The next step is to show that any coefficient of ṽc + |ṽ c | γ lies in [0, γ). This is a direct consequence of the fact that (ṽ

c ) i ∈ [-γ 2 , γ 2
). Indeed, we have:

∀i ∈ [0, n -1] ,        (ṽ c ) i ∈ [-γ/2, 0) (ṽ c ) i ∈ [0, γ/2) ⇒        |ṽ c | γ i = (ṽ c ) i + γ |ṽ c | γ i = (ṽ c ) i ⇒        ṽc + |ṽ c | γ i ∈ [0, γ -2] ṽc + |ṽ c | γ i ∈ [0, γ -2]
Consequently, (z + z&(γ -1)) log 2 (γ) = |m| t + tb, and (2.1.5) follows.

Lemma 2.1.4 can be adapted to other values for γ, but choosing it as a power of 2 makes the computation very easy because it is composed of simple operations on bits. Finally, as soon as γt fits in 1 word, the cost of such variant (besides the polynomial product) reduces to knIMM, or simply to knEM modulo 2 log 2 (γt) whenever t is a power of 2.

Remark 2.1.5. In the previous discussion, the product γt was assumed to fit in one machine word to simplify complexity analysis. However, for some applications, the plaintext modulus t can be bigger than a machine word (e.g. homomorphic neural networks [GDL + 16], where t > 2 80 ). In such cases, either the plaintexts directly lie in R t , or t can be decomposed in a product of smaller moduli t 1 , . . . , t , enabling the use of RNS for encoding plaintexts (and then allowing better homomorphic multiplicative depth for a given dimension n). In the first case, the optimized RNS decryption (given by lemma 2.1.4) remains available, but the residues modulo t should be handled with several words. In the second case, a plaintext is recovered by decrypting its residues modulo each of the t i . These decryptions can be done as in lemma 2.1.4, by using γ as a power of 2 (whatever the t i 's are). Finally, the plaintext is reconstructed from residues modulo the t i 's by using a classical RNS to binary conversion. However, this conversion is only related to the way the plaintexts are encoded, hence it does not affect the RNS description described in this section which essentially deals with arithmetic of the ciphertexts, i.e. modulo q.

Towards a full RNS homomorphic multiplication

Assume that we want to multiply homomorphically two degree 1 ciphertexts ct 1 and ct 2 . The main obstacle to a full RNS variant of the multiplication procedure in the original FV is the call to DR t,q for the scaling of the degree 2 ciphertext ct = ct 1 ct 2 ∈ R 3 . Indeed, the context here is different than for the decryption. While in the decryption we are working with a noise whose size can be controlled, and while we are reducing a value from q to {t}, here the polynomial coefficients of the product ct 1 ct 2 have kind of random size modulo q (for each integer coefficient) and have to be reduced towards q. Roughly the idea is to use a second RNS basis B in which we can compute the scaling by t/q and perform the rounding. We add two moduli to B: one modulus b to reduce the q-overflow due to the first fast conversion from q to B and one modulus b sk which is used to perform an exact conversion from bases B to q. We summarize our strategy in Figure 4.

q = q 1 • • • q k B sk = B ∪ {b sk } b      ct 1 = (c 1 0 , c 1 1 ) ct 2 = (c 2 0 , c 2 1 )      ct 1 = |ct 1 | q + qu 1 ct 2 = |ct 2 | q + qu 2 u i ∞ < k FastBconv(ct i , q, B sk ∪ { b}) SmMRq b (ct i )      ct 1 ≡ |ct 1 | q + qu 1 ct 2 ≡ |ct 2 | q + qu 2 u i ∞ 1 ct = (c 0 , c 1 , c 2 ) ct = (c 0 , c 1 , c 2 ) DR t,q (ct ) ct mult ct mult t q ct
FastBconv(ct , q, B sk )

FastBconvSK( ct mult , B sk , q)
Figure 4: Overview of the strategy for the homomorphic multiplication of FV in RNS

Auxiliary RNS bases

The computation of ct = ct 1 ct 2 ∈ R 3 , which is the first step of multiplication, requires to use enough moduli to contain any product, in R[Y ] (coefficients in Z), of degree-1 elements from R q [Y ] (coefficients modulo q). So, we need an auxiliary basis B, additionally to the basis q. We assume that B contains moduli (while q has k elements). A sufficient size for will be given later. An extra modulus b sk is added to B to create an extended base B sk . It will be used for a transition between the new steps 1 and 2. Computing the residues of ciphertexts in B sk is done through a fast conversion from q (cf. Equation ( (2.1.1))). In order to reduce the extra multiples of q (called "q-overflows" in further discussions) this conversion can produce, a single-modulus base b is introduced. All these bases are assumed to be pairwise coprime which means that all the moduli are pairwise coprime.

Reducing (mod q) a ciphertext in B sk Prior to each multiplication we need the residues of the degree 1 ciphertexts ct 1 and ct 2 in q ∪ B sk , therefore the residues in basis q must be extended to B sk . However, fast conversions (cf. Section 2.1.1) from q can create q-overflows (i.e. unnecessary multiples of q) in the output which would be added to the noise. Therefore to limit the impact on noise growth, we give an efficient way to reduce a polynomial c = c+qu in B sk . For that purpose, we need to add an extra modulus b to B sk . The strategy is based on a Montgomery reduction and is described in Algorithm 15.

Algorithm 15 Small Montgomery Reduction modulo q

Require: c in B sk ∪ { b} Ensure: c in B sk , with c ≡ c b-1 mod q, c ∞ c ∞ / b + q/2 function SmMRq b((c m ) b ∈B sk ∪{ b } ) r b ← [-c b /q] b for b ∈ B sk do c b ← |(c b + qr b ) b-1 | b return c in B sk Lemma 2.2.1. On input c b = |[ bc] q + qu| b for all b ∈ B sk ∪ { b}, with u ∞ τ
, and given a parameter ρ > 0 such that: bρ 2τ + 1.

(2.2.1)

Algorithm 15 returns c in B sk with c ≡ c mod q and c ∞ q 2 (1 + ρ).

Proof. Algorithm 15 performs in B sk the computation of:

[c b] q + qu + q[-([c b] q + qu)/q] b b .
This quantity is clearly congruent to c modulo q. In accordance with hypothesis (2.2.1), its norm is bounded by:

q(1/2 + τ + b/2) b q 2 (1 + ρ) Remark 2.2.2.
To use this fast reduction, the ciphertexts have to be handled in base q through the Montgomery [START_REF] Peter | Modular multiplication without trial division[END_REF] representation with respect to b (i.e. | bc| q instead of |c| q ). This can be done for free during the fast conversions, by multiplying the residues of c by precomputed bq i /q q i instead of |q i /q| q i . Moreover, since { b} is a single-modulus base, conversion of r b from { b} to B sk (line 4 of Algorithm 15) is a simple copy-paste when b < b i . Finally, if Algorithm 15 is performed right after a fast extension from q (for converting | bc| q ), τ is nothing but k -1 (cf. section 1.3.1).

Hence at this point we have the residues of both ciphertexts ct 1 and ct 2 in q ∪ B sk (with the residues ct i (≡ ct i mod q) in B sk reduced through Algorithm 15). Therefore we can compute the product ct = ct 1 ct 2 in q and ct = ct 1 ct 2 in B sk .

Adapting the scaling

We recall that originally this step is the computation of DR t,q (ct ) q (cf. Equation (2.0.1)). Unlike the decryption, a γ-correction technique does not guarantee an exact rounding. Indeed, for the decryption we wanted to get DR t,q [ct(s)] q , and through s we had access to the noise of ct, on which we had some control. In the present context, we cannot ensure a condition like [t • ct ] q ∞ q( 1 2 -ε), for some ε -1 ∼ 2 ν , which would enable the use of an efficient γ-correction. Therefore, we suggest to perform a simple uncorrected RNS flooring. For that purpose, we define for a ∈ R and b ∈ B sk :

fastRNSFloor q (a, b) := (a -FastBconv(|a| q , q, b)) × |q -1 | b mod b.
Since Algorithm 15 should be executed first, lemma 2.2.1 ensures that if b satisfies the bound (2.2.1), for a given parameter ρ > 0, then the residues of ct i (≡ ct i mod q) in B sk are such that:

ct := ct 1 ct 2 ∞ δ R q 2 2 (1 + ρ) 2 . (2.2.2)
The parameter ρ is chosen as small as possible in practice to limit the noise growth but such that equation (2.2.1) holds. Notice that, in base q, ct i and ct i are equals.

Lemma 2.2.3. Let the residues of ct i ≡ ct i mod q be given in base q ∪ B sk , with

ct i ∞ q 2 (1 + ρ) for i ∈ {1, 2}. Let ct = ct 1 ct 2 . Then, for j ∈ {0, 1, 2}, fastRNSFloor q (t • ct [ j], B sk ) = t q ct [ j] + b j in B sk , with b j ∞ k. (2.2.3) Proof. We recall that FastBconv(|t •ct [ j]| q , q, B sk ) outputs |t •ct [ j]| q +qu with u ∞ k -1.
Then, the proof is complete by using the general equalities:

x -|x| q q = x q = x q + τ with τ ∈ {-1, 0}
Therefore we can use the residues in basis q to compute DR t,q (ct ), through fastRNSFloor, in B sk . Note that because of the division by q this cannot be done in basis q. Thus at this point we have the residues of ct mult = DR t,q (ct ) in B sk whose inherent noise is bounded by the following proposition. Proposition 2.2.4. Let ct mult = DR 2 (ct ) with ct satisfying (2.2.2), and

r ∞ := 1 + ρ 2 (1 + δ R B key ) + 1 Let v i be the inherent noise of ct i . Then ct mult (s) = ∆ [m 1 m 2 ] t + ṽmult mod q with: ṽmult ∞ ≤δ R t r ∞ + 1 2 ( v 1 ∞ + v 2 ∞ ) + δ R 2 min( v 1 ∞ , v 2 ∞ ) + |q| t δ R t r ∞ + 3 2 + 1 + δ R B key + δ 2 R B 2 key 2 . (2.2.4)
Proof. This proof is similar to the one given in the first chapter. Some of the tools and bounds from there are re-used here. In the following, we write ct i = (c i,0 , c i,1 ). In particular, we have ct

= (c 1,0 • c 2,0 , c 1,1 • c 2,0 + c 1,0 • c 2,1 , c 1,1 • c 2,1 )
. By hypothesis, each c i, j satisfies c i, j ∞ q 2 (1 + ρ). In particular, the bound in (2.2.2) comes from the fact that:

c 1,1 • c 2,0 + c 1,0 • c 2,1 ∞ δ R q 2 2 (1 + ρ) 2
Since ct i = ct i mod q and ct i ∞ q 2 (1 + ρ), and by using s ∞ B key we can write:

ct i (s) = c i,0 + c i,1 • s = ∆[m i ] t + v i + qr i with: r i ∞ = c i,0 + c i,1 • s -∆[m i ] t -v i q ∞ ≤ (1 + ρ) 1 + δ R B key 2 + 1 = r ∞ .
We recall hereafter some useful bounds given in Chapter 1 which come from [START_REF] Joppew | Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme[END_REF].

         v 1 • v 2 = [v 1 v 2 ] ∆ + ∆r v , r v ∞ ≤ δ R 2 min( v 1 ∞ , v 2 ∞ ) [m 1 ] t • [m 2 ] t = [m 1 m 2 ] t + tr m , r m ∞ < δ R t 2 .
(2.2.5)

By noticing that ct (s) = (ct 1 ct 2 )(s) = ct 1 (s) • ct 2 (s), we obtain: ct (s) =∆ 2 [m 1 ] t • [m 2 ] t + ∆([m 1 ] t • v 2 + [m 2 ] t • v 1 ) + q∆([m 1 ] t • r 2 + [m 2 ] t • r 1 ) + v 1 • v 2 + q(v 1 • r 2 + v 2 • r 1 ) + q 2 r 1 • r 2 .
Then, by using (2.2.5) and ∆t = q -|q| t , we deduce that:

t q ct (s) =∆[m 1 • m 2 ] t + ([m 1 ] t • v 2 + [m 2 ] t • v 1 ) + tqr 1 • r 2 + r v + r r + (q -|q| t )([m 1 ] t • r 2 + [m 2 ] t • r 1 + r m ) + t(v 1 • r 2 + v 2 • r 1 ). with r r = t q [v • v ] ∆ - |q| t q ∆[m 1 ] t • [m 2 ] t + [m 1 ] t • v 2 + [m 2 ] t • v 1 + r v like in (1.2.18
). Now in B sk . Let's assume that b sk satisfies b sk 2(|B| + λ ). Let α x be the following integer:

α x := (FastBconv(x, B, {b sk }) -x sk )B -1 b sk . (2.2.7)
Then, for x being either positive or negative, the following equality holds:

FastBconvSK(x, B sk , q) := FastBconv(x, B, q) -α x B mod q = x mod q.

(2.2.8)

Proof. We set B = {b 1 , . . . , b } (|B| = ), the possible negativity of x is the reason why we have to compute a centered remainder modulo m sk in (2.2.7). First, we notice that the residues of

x in B are actually those of |x| B = x + µB ∈ [0, B), where µ is an integer lying in [-λ + 1, λ] ∩ Z.
Therefore, we deduce that:

i=1 x b i B b i B b i = |x| B + α |x | B B = (x + µB) + α x+µB B with 0 α x+µM -1.
Denoting |x| b sk by x sk , it follows that the quantity computed in (2.2.7) is the following one:

      i=1 x b i B b i B b i -x sk B -1       b sk =       i=1 x b i B b i B b i -(x sk + µB) B -1 + µ       b sk = α x+µB + µ
             α x+µB + µ -1 + λ b sk 2 -1 b sk -1 2 , α x+µM + µ -λ - b sk -1 2 - b sk 2 .
Thus, [α x+µB + µ] b sk = α x+µB + µ, and it follows that, by computing the right member of (2.2.8), we obtain what we wanted:

i=1 x b i B b i B b i -[α x+µB + µ] b sk B = (x + µB) + α x+µB B -(α x+µB + µ)B = x.
Therefore we can convert our ciphertext back to q through the following proposition:

Proposition 2.2.6. Given a positive real number λ, let b sk and B be such that:

λ B > δ R t q 2 (1 + ρ) 2 + 1 2 + k and b sk 2(|B| + λ ).
(2.2.9)

Let's assume that DR 2 (ct ) + b is given in B sk , with b ∞ k. Then, FastBconvSK(DR 2 (ct ) + b, B sk , q) = DR 2 (ct ) + b mod q.
Proof. By using (2.2.2), we have:

DR 2 (ct ) ∞ t q ct ∞ + 1 2 δ R t q 2 (1 + ρ) 2 + 1 2
Lemma 2.2.5 concludes the proof.

Algorithm 16 summarizes the new full RNS variant Mult RNS .

Algorithm 16 RNS homomorphic multiplication Mult RNS Require: ct 1 , ct 2 in q with Montgomery representation with respect to b Ensure: ct mult in q with Montgomery representation with respect to b S0: Convert fast ct 1 and ct 2 from q to B sk ∪ { b}:

ct i = ct i + q-overflows S1: Reduce q-overflows in B sk : ct i (in B sk ) ← SmMRq m (((ct i ) b ) b ∈B sk ∪{ b } ) S2: Compute the product ct = ct 1 ct 2 in q ∪ B sk S3:
Convert fast from q to B sk to achieve first step (approximate rounding) in B sk :

( ct mult + b = DR t,q (ct ) + b in B sk ) ← . . . ← FastBconv(t • ct , q, B sk ) S4: Convert exactly from B sk to q to achieve transitional step:

( ct mult + b in q) ← FastBconvSK( ct mult + b, B sk , q)

Last step: the relinearization

At this point, ct mult + b = (c 0 , c 1 , c 2 ) is known in base q ( ct mult := DR 2 (ct )). The main issue with the original procedure is that the function D ω,q (in Relin FV ) requires, by definition, an access to a positional system (in radix base ω), which is hardly compatible with RNS

Adapting the original procedure

We recall that the original relinearization procedure is done as follows:

ct mult = [c 0 + D ω,q (c 2 ), P ω,q (s 2 ) -( - → e + s - → a ) ] q , [c 1 + D ω,q (c 2 ), - → a ] q (2.3.1)
where -→ e ← χ ω, q err , -→ a ← U ω, q q . The decomposition of c 2 in radix ω enables a crucial reduction of the noise growth due to the multiplications by the terms e i + (s • a) i . It cannot be done directly in RNS as is. Indeed, it would require a costly switch between RNS and positional representation in radix ω. However, we can do something very similar. We recall that we can write:

c 2 = k i=1 c 2 q i q q i × q q i mod q
If ω has the same order of magnitude as 2 ν (size of moduli in q), we obtain a similar limitation of the noise growth by using the vectors:

D RNS,q (c 2 ) = c 2 q 1 q q 1 , . . . , c 2 q k q q k and P RNS,q (s 2 ) = s 2 q q 1 q , . . . , s 2 q q k q both in R k . This decomposition has the same properties as the original one:

Lemma 2.3.1. For any c ∈ R, we have D RNS,q (c), P RNS,q (s 2 ) ≡ cs 2 mod q.

Thus, by replacing the public relinearization key --→ rlk FV by:

--→ rlk RNS = [P RNS,q (s 2 ) + ( - → e + s • - → a )] q , -- → a with - → a $ ← -U k q and - → e $
← -χ k err and which can be seen as the matrices:

--→ rlk RNS [0] = s 2 q q 1 + e 1 + s • a 1 q 1 • • • |e 1 + s • a 1 | q k . . . . . . |e k + s • a k | q 1 • • • s 2 q q k + e k + s • a k q k --→ rlk RNS [1] = |-a 1 | q 1 • • • |-a 1 | q k . . . . . . |-a k | q 1 • • • |-a k | q k (2.3.2)
we can perform the relinearization step in RNS. The next lemma helps for providing a bound on the extra noise introduced by this step. Lemma 2.3.2. Let -→ e ← χ k err , -→ a ← U k q , and c ∈ R. Then,

D RNS,q (c), ( - → e + - → as) + D RNS,q (c), --→ -a s mod q ∞ < δ R B err k2 ν . (2.3.3)
Proof. First, we have:

D RNS,q (c), +( - → e + - → as) + D RNS,q (c), -- → a s = D RNS,q (c), - → e mod q
Second, by using q i < 2 ν , we obtain:

D RNS,q (c), - → e ∞ = k i=1 c q i q q i • e i ∞ < k i=1 δ R q i e i ∞ δ R B err k i=1 q i < δ R B err k2 ν
Remark 2.3.3. It is still possible to add a second level of decomposition (like in original approach, but applied on the residues) to limit a little bit more the noise growth (section 2.3.2). Furthermore, Sect. 2.3.3 details how the size of rlk RNS can be reduced in a similar way that rlk FV could be through the method described in ([BLLN13], 5.4).

Finally, on input ct = ct mult + b = (c 0 , c 1 , c 2 ), and the relinearization key rlk RNS = [P RNS,q (s 2 ) + ( -→ e + s -→ a )] q , --→ a , the output of the RNS relinearization is the following one:

ct mult = c 0 + D RNS,q (c 2 ), P RNS,q (s 2 ) + ( - → e + - → as) q , c 1 + D RNS,q (c 2 ), --→ -a q (2.3.4)
Proposition 2.3.4. Let ct mult be as in (2.3.4), and v mult (resp. v mult ) the inherent noise of ct mult (resp. ct mult ). Then: ). We can first notice that:

ct mult (s) = ∆ [m 1 m 2 ] t + v mult (mod q) with: v mult ∞ < v mult ∞ + k (1 + δ R B key (1 + δ R B key )) + δ R k B err 2 ν+1 . ( 2
D RNS,q (c 2 + b 2 ) = D RNS,q (c 2 ) + D RNS,q (b 2 ) -- → u where - → u = (u 1 , . . . , u k ) ∈ R k is such that, for any (i, j) ∈ [1, k] × [0, n -1], (u i ) j ∈ {0, q i }.
In particular, it can be noticed that |b 2 q i q | q i -u i ∞ < q i , and that -→ u, P RNS,q (s 2 ) ≡ 0 mod q.

This latter fact leads to the following equality:

- → u, rlk RNS [0] + - → u, rlk RNS [1] • s = - → u, P RNS,q (s 2 ) + ( - → e + s - → a ) + - → u, -- → a • s = - → u, - → e = k i=1 u i • e i mod q
Consequently, in R q × R q we have that:

Relin RNS (ct) = c 0 + D RNS,q (c 2 ), P RNS,q (s 2 ) + ( - → e + - → as) q , c 1 + D RNS,q (c 2 ), --→ -a q = Relin RNS ( ct mult ) + Relin RNS (b) -- → u, rlk RNS [0] , - → u, rlk RNS [1]
Thus, a part of the noise comes from the following extra term:

Relin RNS (b)(s) -- → u, rlk RNS [0] -- → u, rlk RNS [1] • s ∞ = b 0 + D RNS,q (b 2 ) -- → u, rlk RNS [0] + s • (b 1 + D RNS,q (b 2 ) -- → u, rlk RNS [1] ∞ = b 0 + b 1 • s + b 2 • s 2 - k i=1 b 2 q i q q i -u i • e i ∞ <k (1 + δ R B key + δ 2 R B 2 key ) + δ R B err k i=1 q i <k (1 + δ R B key + δ 2 R B 2 key ) + δ R B err k2 ν .
and lemma 2.3.2 brings the rest of the noise.

Combining two levels of decomposition

To reduce the noise growth due to the relinearization step a bit more, we can integrate another level of decomposition in radix ω where ω = 2 θ << 2 ν as efficiently as in the original scheme by doing it on the residues, because they are handled through the classical binary positional system. By denoting ω,2 ν = ν θ , each polynomial c q i q q i is decomposed into the vector of

polynomials |c q i q | q i ω -z ω z ∈[0,..., ω,2 ν -1]
, and the new decomposition function is defined by: D RNS,ω,q (c) = d z i = c q i q q i ω -z

w i ∈[1,k],z ∈[0,..., ω,2 ν -1]
.

Therefore, each term s 2 q q i + (e i + (s • a) i ) q j in rlk RNS [0] has to be replaced by:

s 2 q q i ω z + (e z i + (s • a) z i ) q j z , z = 0, . . . , ω,2 ν -1, e z i ← χ err , a z i ← U q .
It follows that the extra noise is now bounded by:

D RNS,ω,q (c), - → e ∞ = k i=1 ω,2 ν -1 z=0 d z i e z i ∞ < δ R B err ωk ω,2 ν .
In other words, the term 2 ν in (2.3.3) is replaced by ω ω,2 ν . Even if such optimization may be not really relevant in practice, since the noise caused by the relinearization step is very small compared to the one caused by the multiplication. This is another argument for saying that any trick and technique of the original scheme can be efficiently adapted to a pure RNS approach.

Reducing the size of the relinearization key rlk RNS

In [START_REF] Joppew | Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme[END_REF], Sect. 5.4, the authors describe a method to significantly reduce the size of the public relinearization key rlk (by truncating the ciphertext) which can be applied to the original FV scheme. We provide an efficient adaptation of such kind of optimization to the RNS variant of the relinearization step.

We recall that the relinearization is applied to a degree-2 ciphertext denoted here by (c 0 , c 1 , c 2 ). The initial suggestion was to set to zero, say, the i lowest significant components of the vector D ω,q (c 2 ). Doing so is equivalent to replacing c 2 by

c 2 = ω i c 2 ω -i = c 2 -|c 2 | ω i .
Thus, only the ω,qi most significant components of rlk FV [0] (and then of rlk FV [START_REF]Financial Cryptography and Data Security: FC 2017 International Workshops, WAHC, BITCOIN[END_REF]) are required (in other words, when rlk FV [0] is viewed as an ( q,ω × k) RNS matrix by decomposing each component in base q, ik entries are set to zero like this). However this optimization causes a greater noise than the one in lemma 4 of [START_REF] Joppew | Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme[END_REF], indeed given (c 0 , c 1 , c 2 ) decryptable under s, the relinearization step provides:

(c 0 , c1 ) := c 0 + D ω,q (c 2 ), P ω,q (s 2 ) + ( - → e + - → a • s) , c 1 + D ω,q (c 2 ), -- → a Thus, (c 0 , c1 )(s) = c 0 + c 1 s + c 2 s 2 + D ω,q (c 2 ), - → e mod q.
Consequently, the extra noise comes from the following term:

-|c 2 | ω i s 2 + D ω,q (c 2 ), - → e ∞ = -|c 2 | ω i • s 2 + ω, q -1 j=i D ω,q (c 2 ) j • e j ∞ < δ 2 R ω i B 2 key + ( ω,q -i)δ R ωB err . (2.3.6)
In the present RNS variant, the computation of c 2 ω -i is not straightforward. This could be replaced by c 2 (q 1 . . . q i ) -1 through a Newton like interpolation (also known as mixed-radix conversion [START_REF] Szabo | Residue Arithmetic and Its Applications to Computer Technology[END_REF]). Though the result would be quite similar to the original optimization in terms of noise growth, its efficiency is not satisfying. Indeed, despite ik entries of the RNS matrix rlk RNS [0] can be set to zero like this, this Newton interpolation is intrinsically sequential, while the division by ω i is just an immediate zeroing of the lowest significant coefficients in radix ω representation. Furthermore, a direct approach consisting in zeroing, say, the first i components of D RNS,q (c 2 ) cannot work. Indeed, it would be like using

D RNS,q (Q i × |c 2 Q -1 i | q i+1 ...q k ) with Q i = q 1 • • • q i .
Then, when evaluating the output of relinearization in the secret key s, it would introduce the term:

D RNS,q Q i × |c 2 Q -1 i | q i+1 •••q k , P RNS,q (s 2 ) = Q i × c 2 Q -1 i q i+1 •••q k s 2 mod q = c 2 -q i+1 • • • q k × c 2 (q i+1 • • • q k ) -1 Q i s 2 mod q with the norm of c 2 (q i+1 • • • q k ) -1 Q i
which has no reason to be small.

For our approach, we rely on the fact that rlk RNS contains Ring-LWE encryptions of the polynomials s 2 q q j q . Notice that only the j th -residue of s 2 q q j q can be non zero (cf. Equation 2.3.2). So, let's assume that we want to cancel ik entries in rlk RNS [0] (as it has been done in rlk FV with the previous optimization). Then we choose, for each index j, a subset of index-numbers I j ⊆ [1, k] \ { j} with cardinality i of zero elements (i.e. at line j of rlk RNS , choose i elements, except the diagonal one , and set them to zero).

Next, for each j, we introduce a Ring-LWE-encryption of s 2 q q j q I j q

, where q I j = s ∈I j q s , which is s 2 q q j q I j + (e j + s • a j ) q , -a j . So far, the underlying security features are still relevant. Now, it remains to multiply this encryption by q I j , which gives s 2 q q j + q I j (e j + s • a j ) q .

This corresponds to the j th -line of the new matrix rlk RNS [0]. It is clear that this line contains zeros at columns index-numbered by I j . rlk RNS [START_REF]Financial Cryptography and Data Security: FC 2017 International Workshops, WAHC, BITCOIN[END_REF] = (a 1 , . . . , a k ) is replaced by

rlk RNS [1] = (|q I 1 a 1 | q , . . . , |q I k a k | q ).
Let's analyze the noise growth caused by the relinearization with this new relinearization key. By evaluating in s the output of relinearization with this new rlk RNS , we obtain:

c 0 + D RNS,q (c 2 ), rlk RNS [0] + c 1 + D RNS,q (c 2 ), rlk RNS [1] • s = c 0 + k j=1 c 2 q j q q j s 2 q q j + q I j (e j + s • a j ) + c 1 - k j=1 c 2 q j q q j q I j a j • s = c 0 + c 1 • s + c 2 • s 2 - k j=1 c 2 q j q q j • q I j e j
Consequently, the cancellation of ik terms in the public matrix rlk RNS [0] by using this method causes an extra noise growth bounded by (this can be fairly compared to (2.3.6) in the case where ω = 2 ν , i.e. k = ω,q ):

k j=1 c 2 q j q q j • q I j e j ∞ < k j=1 δ R q j q I j B err < δ R k2 ν(i+1) B err
Therefore, the truncation of ciphertexts can be efficiently adapted to RNS representation without causing more significant noise growth.

About computational complexity

We analyze the cost of a multi-precision variant, in order to estimate the benefits of the new RNS variant of multiplication in terms of computational cost.

• The product ct = ct 1 ct 2 = (c 1,0 , c 1,1 ) (c 2,0 , c 2,1
) in MP variant is advantageously performed in RNS, in order to benefit from NTT. So, the MP variant considered here is assumed to use a second base B such that qB > ct ∞ . By taking centered remainders modulo q, we consider ct i ∞ q 2 . Then B must verify in particular that:

ct [1] ∞ = c 1,0 c 2,1 + c 1,1 c 2,0 ∞ 2δ R q 2 4 < qB
Thus, |B | has to be at least equal to k + 1 (notice that, in RNS variant, we also need to have |B sk | = k + 1 for dealing with the multiplication).

• The conversion, from q to B , of each ct i has to be as exact as possible in order to reduce the noise growth. It can be done by computing: [ k i=1 |c a,b | q i × (| q i q | q i q q i )] q in B . The terms (| q i q | q i q q i ) are precomputable and their size is k words (log 2 (q) bits). Thus, the sum involves k 2 nEM. The reduction modulo q can be performed by using an efficient reduction as described in [AMBG + 16], reducing to around 2 multiplications of k-word integers, that is O(k 1+ε )nEM (where ε stands for complexity of multi-precision multiplication in radix-base 2 ν ; e.g. ε = 1 for the schoolbook multiplication). Next, the k-word value is reduced modulo each 1-word element of B , through around 2knEM for the whole set of coefficients. Finally, this procedure has to be executed four times. Its total cost is around (4k 2 + O(k 1+ε ))nEM.

• Next, the product ct 1 ct 2 is done in q ∪ B . First, 4(2k + 1)NTT are applied. Second, by using a Karatsuba like trick, the product is achieved by using only 3×(2k+1)nIMM. Third, 3(2k +1)invNTT are applied to recover ct = (c ,0 , c ,1 , c ,2 ) in coefficient representation.

• The next step is the division and rounding of the three polynomials c ,i 's. A lift from q ∪ B to Z is required, for a cost of 3(2k + 1) 2 nEM. t/q can be precomputed with around 3k + 1 words of precision to ensure a correct rounding. Thus, a product t q × c ,i is achieved with O(k 1+ε )nEM. After, the rounding of c ,0 and c ,1 are reduced in RNS base q by 2 × 2knEM.

• The relinearization step (2.3.1) can be done in each RNS channel of q. By assuming that ω = 2 ν , we would have ω,q = k. The computation of the vector D ω,q ( t q c 2 ) reduces to shifting. The two scalar products in Relin FV , with an output in coefficient representation, require k ω,q NTT + 2k 2 nIMM + 2kinvNTT.

Thus, the total cost of the multi-precision variant is at most the following one:

Cost(Mult MP ) = (k ω,q + 8k + 4)NTT + (8k + 3)invNTT + [2k 2 + 6k + 3]nIMM + [40k 2 + O(k 1+ε )]nEM.
Now, let's analyze the cost of the RNS variant.

• The fast conversions from q to B sk ∪ { m} require 4 × k (k + 2)nIMM.

• The reduction of q-overflows requires 4 × (k + 1)nIMM.

• The product of ciphertexts ct 1 ct 2 in q ∪ B sk requires the same cost as for MP variant, that is 4(2k + 1)NTT + 3(2k + 1)nIMM + 3(2k + 1)invNTT.

• With adequate pre-computed data, the base conversion from q to B sk can integrate the flooring computation in B sk so that it would cost 3 × k (k + 1)nIMM.

• The exact FastBconvSK to basis q, basically reduces to a fast conversion from B to q sk , followed by a second one from b sk to q. So, this is achieved with 3 × k (k + 2)nIMM.

• For the relinearization step, since the function D RNS,q is an automorphism of R q data in q can stay in this form throughout the computations. Therefore we can have the vector D RNS,q (c 2 ) for free. The two scalar products in Relin RNS involve k 2 NTT + 2k 2 nIMM + 2kinvNTT, exactly like the relinearisation step in the MP variant.

• Finally 2knIMM are needed to manage the Montgomery representation, in q, with respect to b.

Thus the total cost of the RNS variant is the following:

Cost(Mult RNS ) = (k 2 + 8k + 4)NTT + (8k + 3)invNTT + [10k 2 + 25k + 7]nIMM.
To summarize, the RNS variant decreases the computational cost of the whole homomorphic multiplication algorithm except the parts concerning polynomial multiplications. Also, it involves as many NTT and invNTT as the MP variant. Even by considering an optimized multi-precision multiplication algorithm in the MP variant (with sub-quadratic complexity), the asymptotic computational complexity remains dominated by the (k 2 + O(k))nNTT.

Finally, the MP and RNS variants are asymptotically equivalent when n → +∞, but the pure RNS variant is more flexible in terms of parallelization.

Software implementation

The C++ NFLlib library [AMBG + 16] was used for efficiently implementing the arithmetic in R q . It provides an efficient NTT-based product in R q for q a product of 30 or 62-bit prime integers, and with degree n a power of 2, up to 2 15 .

Concrete examples of parameter settings

In this part, we analyze which depth can be reached in a multiplicative tree, and for which parameters. We recall that the initial noise is at most V = B err (1 + 2δ R B key ) and that the output of a tree of depth L has a noise bounded by C L RNS,1 V + C RNS,2 (C L RNS,1 -1)/(C RNS,1 -1) (cf. section 1.2.2) with, for the present RNS variant:

                   C RNS,1 = δ R t (1 + ρ)(1 + δ R B key ) + 3 + δ R 2 C RNS,2 = |q| t δ R t (1 + ρ) 1 + δ R B key 2 + 5 2 + (1 + δ R B key + δ 2 R B 2 key ) k + 1 2 +kδ R B err 2 ν+1 .
(2.4.1)

We denote by:

L RNS = max      L ∈ N | C L RNS,1 V + C RNS,2 C L-1 RNS,1 -1 C RNS,1 -1 q t 1 2 - k γ - |q| t 2     
the maximal depth allowed by Mult RNS , when Dec RNS is used for decryption.

For an 80-bit security level and parameters B key = 1, σ err = 8, B err = 6σ err , we consider the security analysis in [START_REF] Lepoint | A comparison of the homomorphic encryption schemes fv and yashe[END_REF], which provides ranges for (log 2 (q), n) (cf. [START_REF] Lepoint | A comparison of the homomorphic encryption schemes fv and yashe[END_REF], Tab. 2). We analyze our parameters by using the size of moduli given in NFLlib, because those were used for our implementation. For a 32-bit (resp. 64) implementation, a set of 291 30-bit (resp. 1000 62-bit) moduli is available. These moduli are chosen to enable an efficient modular reduction (cf. [AMBG + 16], Algorithm 2). Table 3 lists parameters when q and B are built with these moduli. Note that in powers-of-two cyclotomic, the expansion factor δ R is well-known and is equal to the degree of the cyclotomic n. The parameters were determined by choosing the largest ρ (up to 2k -1), and thus the smallest b (chosen as a power of two for efficiency reasons), allowing to reach the depth L RNS while L std corresponds to the bounds for a classical approach. It also provides sufficient sizes for γ and b sk which allow for b sk , to have |B| = k through (2.2.9) after having chosen for q the k greatest available moduli. One can notice that the bound on γ is smaller than 2 10 for all cases, thus we can choose γ and t as a power of two with γt fitting in one machine word. For these specific parameters, and despite additional terms in the noise, the multiplicative depth remains unchanged for the RNS variants.

n t b 30-bit moduli 62-bit moduli k L RNS ρ log 2 (b sk ) γ k L RNS ρ log 2 (b sk ) γ 2 11 2 2 8 3 2 (2) 5 18 7 1 0 (0) - - 3 2 10 1 (1) 5 27 7 0 (0) - - 3

Influence of b on the noise growth

After a fast conversion from q, ciphertexts in B sk can contain q-overflow and verify ct i ∞ < q 2 (1 + τ) with τ 2k -1. By applying Algorithm 15, this bound decreases to q 2 (1 + ρ), for some 0 < ρ 2k -1. Having ρ = 2k -1 in Tab. 3 means that it is unnecessary to use SmMRq b to obtain a best depth, this case only occurs three times. Thus, most of the time doing such reduction is necessary before a multiplication in order to reach the best possible depth. Moreover, choosing a lower ρ (i.e. a higher b) than necessary can decrease the lower bound on γ and b sk . To illustrate the impact of SmMRq b, Fig. 5 depicts the noise growth for n = 2 13 , t = 2 and b ∈ {0, 2 8 , 2 16 }. According to Tab. 3, b = 2 8 is well sufficient in such scenario in order to reach L RNS = 13. In comparison, a computation with no reduction at all ( b = 0) leads to a theoretical depth L RNS = 11 in this case. More precisely, choosing b = 2 8 implies an average reduction of 25% of the noise, while with b = 2 16 , we gain around 32%. Consequently, SmMRq b has been systematically integrated within the implementation of Mult RNS in our prototype.

Some remarks

Tested algorithms The code1 we compared with is an open source implementation of FV which has been developed in the context of HEAT2 and which is also based on NFLlib.

Multi-precision arithmetic is handled with GMP 6.1.0 [START_REF] Granlund | GNU MP: The GNU Multiple Precision Arithmetic Library[END_REF], and multiplications by t/q are performed with integer divisions. Mult MP and Dec MP denote functions from this code.

Even if the use of SmMRq b could be avoided in Mult RNS to reach the maximal theoretical depth for some parameters, it has been systematically used since its cost is negligible and it enables a noticeable decrease of noise growth in most of the cases. Moreover relinearization procedure was systematically added at the end of the multiplication, therefore the timings presented for the multiplication correspond in reality to multiplication plus relinearization.

Two variants of Dec RNS (cf. section 2.1.5) have been implemented. Depending on the moduli size ν, the one with floating point arithmetic (named Dec RNS-flp thereafter) uses double (resp. long double) for double (resp. quadruple) precision, and then does not rely on any other external library at all. Convenient b and γ Given values of ρ in Tab. 3, b = 2 8 (resp. b = 2 16 ) satisfies, by far, any set of analyzed parameters. This enables an efficient and straightforward modular arithmetic through standard types like uint8_t (resp. uint16_t) and a type conversion towards the signed int8_t (resp. int16_t) immediately gives the centered remainder. The parameter analysis with such b shows that γ = 2 8 (resp. γ = 2 10 ) is sufficient to ensure a correct decryption for all configurations. Furthermore, a reduction modulo γ could be achieved by a simple type conversion to uint8_t when γ = 2 8 .

Results

The tests have been run on a laptop, using Fedora 22 with Intel R Core TM i7-4810MQ CPU @ 2.80GHz and using GNU compiler g++ version 5.3.1 with Hyper-Threading and Turbo Boost turned off. The timings corresponds to an average time on 2 12 decryptions/multiplications. In Fig. 6, the two variants of decryption described in 2.1.5 are almost equally fast. Indeed, they perform the same number of elementary (floating point or integer) operations. All the implemented decryption functions take as input a ciphertext in NTT representation. Thus, only one invNTT is performed (after the product of residues) within each decryption. As explained in section 2.1.5, despite a better asymptotic computational complexity for RNS decryption, the efficiency remains in practice highly related to this invNTT procedure, even maybe justifying the slight convergence between MP and RNS decryption times observed. In Fig. 7, the convergence of complexities of Mult RNS and Mult MP (as explained in Sect. 2.3.4) is noticeable.

Table 4 presents detailed timings and speed-ups of RNS vs MP variants together with timings of an RNS decryption and multiplication including the use of SIMD (Single Instruction Multiple Data). Indeed in RNS variants (as well decryption as multiplication), the replacement of division and rounding by base conversions (i.e. matrix-vector multiplications) allows to benefit, easily and naturally, from concurrent computation. An RNS vector-matrix multiplication naturally owns two levels of parallelization: along the RNS channels, and along the dimension of the result. In NFLlib, an element of R q is stored in a (32-byte aligned) array _data in which the n first values are the coefficients of the polynomial in R q 1 , and so forth and so on. Advanced Vector Extensions (AVX2) have been used to accelerate the computations.

An AVX2 register is handled (for our purpose) through the type __m256i. This enables to handle either 8x32-bit, or 4x64-bit, or again 16x16-bit integers concurrently. Given the configuration of the _data array, reading/writing communications between 256-bit AVX2 registers and _data are the most efficient (through _mm256_store_si256 and _mm256_load_si256 intrinsics, which require the 32-byte alignment of _data) when the base conversion is parallelized along the dimension n. Therefore this is how we have implemented and tested it. However, since more convenient intrinsic instructions are available for 32-bit, we have made it only within the 32-bit implementations.

Regarding the timings, the impact of AVX2 remains quite moderate. This is because it is used to accelerate the parts of algorithms besides the NTT-based polynomial products which constitute the main cost. For decryption, the RNS variants, floating point and integer arithmetic, are already very efficient, whereas the performance of AVX2 variant depends on time-consuming loading operations from/to vectorial registers, explaining the small differences. As expected for the multiplication, the timings are converging when n grows, because of the cost of NTT's.

Conclusion

This work has turned the FV scheme entirely compatible with Residue Number Systems and has led to a publication in the 23 rd Selected Areas of Cryptography (SAC) conference ( [START_REF] Bajard | A Full RNS Variant of FV Like Somewhat Homomorphic Encryption Schemes[END_REF]). Prior to this work, RNS was already used to accelerate polynomial additions and multiplications. However, the decryption and the homomorphic multiplication involve operations at the coefficient level which were hardly compatible with RNS, such as division and rounding. Our solutions overcome these incompatibilities, without modifying the security features of the original scheme. As a consequence, we have provided a SHE scheme which only involves RNS arithmetic and thus only single-precision integer arithmetic. Moreover the new variant has an higher parallelization potential, since it fully benefits from the properties of RNS, which could be used in future efficient implementations.

The C++ implementation of our prototype has highlighted the gain in practice of our approach compared to the classical one which uses multi-precision arithmetic. Since arithmetic on polynomials is not concerned by this work, our implementation, like the one we are comparing with, has been based on the NFLlib library, which embeds a very efficient NTT-based polynomial product. Hence, our decryption (resp. homomorphic multiplication) variants offers speed-ups from 20 to 5 (resp. Beyond the immediate benefit for the FV scheme, this work could also be applied to any protocol or scheme relying on primitives using the same kind of operations in a (Ring)-LWE like setting ([BLLN13], [START_REF] Khedr | SHIELD: Scalable Homomorphic Implementation of Encrypted Data-Classifiers[END_REF], [START_REF] Bonnoron | Large FHE gates from Tensored Homomorphic Accumulator[END_REF]).

Chapter 3

Polynomial arithmetic in general cyclotomic rings As illustrated in the previous chapters, the bottleneck of Ring-LWE based homomorphic schemes coincides with the one of the underlying arithmetic which is the multiplication of elements. Consequently, because of the efficiency of the NTT with the negative-wrapped convolution technique (Section1.3.2), and also the simplicity of the error sampling in this case (Section1.1.3), most of the research on Ring-LWE based cryptography has focused on powerof-two cyclotomics (R = Z[X]/(X n + 1)). However despite these advantages, computations in high dimensions (required for FHE for instance), remain hardly practical. As explained in Section 1.3.3, one way to amortize the cost of these operations is to use the batching technique to pack plaintexts. However it is not available for power-of-two cyclotomics with binary plaintext data types. Hence considering other cyclotomic polynomials could offer, beyond a possible greater number of slots for batching, more flexibility regarding to the dimension of the underlying lattice and thus to the security of the Ring-LWE instantiation. Even though such cyclotomics have been previously considered ( 2) and its inverse. Once evaluated on the canonical embedding, additions and multiplications of elements are performed coefficientwise and the error can be sampled from a spherical discrete gaussian, while the inversion of the embedding allows to return in the coefficient representation. Since this method corresponds to an evaluation/interpolation of the elements (seen as polynomials) on the roots of the cyclotomic, the result does not need to be reduced modulo Φ m . Hence their method can be seen, somehow, as the generalization of the NTT with the negative-wrapped convolution technique. However, despite its numerous advantages in theory (no reduction modulo Φ m , no zeroespadding to the next power of two), in practice the evaluation of the canonical embedding with this method uses Bluestein and Rader algorithms for FFT ( [START_REF] Rabiner | The Chirp z-Transform Algorithm and Its Application[END_REF]) whose efficiency heavily depends on the prime factors of m and require anyway a zero-padding. Although, an Haskell implementation of their method is available in the Λ• λ library ([CP15]), their method remain seldomly used and several works tend to keep using the univariate representation.

In this context, the work presented in this chapter focuses on improving the efficiency of the arithmetic associated with the "classical" univariate representation in general cyclotomic rings R = Z[X]/(Φ m (X )) so that one can use only efficient and well-known algorithms like Cooley-Tukey based NTT. Our improvements concern the polynomial reduction required after having performed a product with NTT of size N = N 2 (2n) and not the product itself. We have also highlighted the applicability of our reduction algorithms to two of the most used homomorphic encryption schemes, namely BGV ( [START_REF] Brakerski | Leveled) Fully Homomorphic Encryption Without Bootstrapping[END_REF]) and FV ([FV12]) implemented respectively in HELib ( [START_REF] Halevi | Algorithms in HElib[END_REF]) and SEAL 2.3 ([CHH + 17]).

Preliminaries

This section aims to familiarize the reader with some elements required when working with general cyclotomic polynomials. We start with the generic Barrett reduction algorithm which is required to compute the reduction modulo Φ m after having performed a polynomial product. We also discuss about the choice of the cyclotomic polynomial in order to maximize: the security, the arithmetic efficiency, and the number of slots.

Barrett's reduction

As explained in Section 1.3.2, once we can compute the polynomial product

c = a × b ∈ Z[X]/(X N -1) of two elements (a, b) ∈ R 2
q through NTT of size N on each RNS channel of q = q 1 • • • q k (with q i prime and congruent to 1 modulo N) through Equation(1.3.8) recalled herafter:

NTT N (c) = NTT N (a) NTT N (b)
Hence, we obtain a polynomial c, in NTT representation, of degree smaller than N = N 2 (2n), the next power of two greater than, or equal to 2n. At this point, one needs to reduce c modulo Φ m to get the result back on each R q i and therefore in R q . One way to perform this reduction is to use the generic Barrett algorithm, like in [START_REF] Dai | cuHE: A Homomorphic Encryption Accelerator Library[END_REF].

Indeed, Barrett's strategy for modular reduction over the integers [START_REF] Barrett | Implementing the Rivest Shamir and Adleman Public Key Encryption Algorithm on a Standard Digital Signal Processor[END_REF] can be adapted to polynomial modular arithmetic to reduce a polynomial c of degree n + α, with α ≥ 0, by a polynomial of degree n (for instance Φ m ) and is presented in Algorithm 17. It consists in computing the quotient of the Euclidean division c/Φ m through multiplications by precomputed constants and shifts, and once the quotient computed deduce the remainder.

Algorithm 17 NTT based Barrett reduction in F q i [X], for a prime q i ≡ 1 mod N

Require: c NTT = NTT N (c) ∈ F N q i with deg(c) = n + α < 2n with q i prime, n = deg(Φ m ), ñ = N 2 (n), A = N 2 (2α + 1), precomputed NTT ñ (Φ m ) and NTT A ( X n+α /Φ m ). Ensure: c mod (q, Φ m ) in power-basis. function NTTBarr(c NTT , q i , Φ m ) c ← NTT -1 N (c NTT ) f ← c/X n r ← NTT -1 A NTT A (f ) NTT A ( X n+α /Φ m ) r ← r/X α d ← NTT -1 ñ NTT ñ (r ) NTT ñ (Φ m ) c ← c mod X ñ -1 return c -d Remark 3.1.1.
In [START_REF] Dai | cuHE: A Homomorphic Encryption Accelerator Library[END_REF], the authors use somehow NTTs of size N = N 2 (2n) to perform the second product while in fact it only requires NTTs of size ñ = N 2 (n).

For the sake of completness we provide a proof of correctness of Algorithm 17 just below.

Proof. Since F q i [X] is an Euclidean ring, we can write the Euclidean division of c of degree

n + α by Φ m of degree n: c = c/Φ m Φ m + r with deg r ≤ n -1.
Let a, b ≥ 0 be two integers, then we can write the following over the field of fractions of F q i [X]: X) and r 2 = |c| X n-b , we have deg(r 1 ), deg(r 2 ) < n and we can write:

X n+a Φ m • c X n-b = c Φ m + r Φ m • X a+b Let r 1 = X n+a Φ m (
X n+a Φ m + r 1 Φ m • c X n-b + r 2 X n-b = c Φ m + r Φ m • X a+b ⇔ X n+a Φ m • c X n-b + r a + r α+b + r = c Φ m + r Φ m • X a+b with deg(r a ) < a, deg(r α+b ) < α + b and deg(r ) < 0.
Writing the Euclidean division of the product on the left part by X a+b leads to:

       X n+a /Φ m • c/X n-b X a+b        X a+b + r + r a + r α+b + r = c Φ m + r Φ m • X a+b
with deg(r ) < a + b, and thus we finally obtain:

⇔        X n+a /Φ m • c/X n-b X a+b        + r + r a + r α+b + r X a+b = c Φ m + r Φ m
By choosing b 0 and a α, the right term of the left member of the equation above have a degree smaller than 0. Therefore we can deduce that the two floored polynomials are equal.

Hence, by taking b = 0 and a = α, we get that c Φ m is equal to the flooring of the left part of last equation, which is what Algorithm 17 computes for r . Indeed, since X n+α /Φ m • c/X n is of degree strictly smaller than 2α + 1, the computation can be done with an NTT of size A = N 2 (2α + 1).

Finally, we notice that the result of the computation of r = cc/Φ m × Φ m has a degree strictly smaller than n. Since the polynomial c in the algorithm is nothing but c/Φ m × Φ m mod X ñ -1 (the reduction modulo X ñ -1 is a consequence of the NTT based polynomial product in dimension ñ) at the end we have that c

-d = (c -c/Φ m × Φ m ) mod (X ñ -1) = c mod Φ m .
The last equality holds because deg(c mod Φ m ) < n and is thus strictly smaller than ñ.

One can notice, that the performance of Algorithm 17 is directly related to the size of the polynomial to be reduced: the algorithm is more efficient when α is small. More precisely if we denote ñ = N 2 (n) and A = N 2 (2α + 1) the cost of the algorithm is given by:

C NTT (N ) + 2C NTT (ñ) + 2C NTT ( A) + (ñ + A)MMult q i
where C NTT (x) denotes the cost for evaluating (1.3.7) (or its inverse) of size x and MMult q i the cost of a modular multiplication modulo q i .

About the choice of the cyclotomic

As shown in Section 1.3.2, the bottleneck of Ring-LWE arithmetic is the polynomial products whose asymptotic complexity is quasi-linear in the degree n of Φ m , and even more so when we are not using power-of-two cyclotomics and thus NTT with negative-wrapped convolution. In practice, the most efficient NTT algorithms require to have a degree which is a power-of-two. Hence, even if it requires to pad the polynomials' coefficients with zeros from 2n to N, we use NTTs of size N = N 2 (2n) the next power of two greater than or equal to 2n. Since practical security of Ring-LWE instantiations increases with the degree n (for a modulus q and an error distribution χ err carefully chosen, see Section 4.2.5), choosing n (and thus 2n) directly as a power-of-two maximizes the security without affecting the efficiency of the underlying arithmetic.

Lemma 3.1.2 ([DF04], Preliminaries). Let m = p r 1 1 • • • p r s s be the prime decomposition of m where each r i ≥ 1, then ϕ(m) = s i=1 (p i -1)p r i -1 i (3.1.1)
where ϕ denotes the Euler-totient function.

According to Equation(3.1.1), in order to have n = ϕ(m) equal to a power of two we must select m such that m = 2 k p 1 • • • p s , where the factors p i are prime numbers of the shape p i = 2 l i +1. It is proven that l i must necessary be a power-of-two for such number to be prime, in this case these numbers are called Fermat numbers (2 2 n i + 1). However this condition is not sufficient for the primality and it is not known whether or not there are an infinite number of Fermat primes. Actually, so far we only know 5 such numbers, which correspond to the first five Fermat numbers:

F 0 = 3, F 1 = 5, F 2 = 17, F 3 = 257 and F 4 = 65537. Lemma 3.1.3 ([Lan05], chapter 6.3). Let m = 2 k r with r an odd integer, then Φ m (X ) = Φ r (-X 2 k-1 ) (3.1.2) Equation (3.1.
2) shows that a cyclotomic of index m = 2 k r with r odd, offers as many batching slots (see Section 1.3.3) than the cyclotomic of index r. Therefore in order to minimize the ratio n/ , with is the number of batching slots, and thus the arithmetic efficiency one should choose m odd. As a consequence, in order to maximize the degree, and thus the security, without increasing the arithmetic cost, m should be chosen as a power of Fermat primes. Moreover choosing such m allows us to know precisely the number of slots of Φ m when the plaintext modulus is t = 2 which is particularly interesting for evaluating homomorphically boolean circuits for instance. Lemma 3.1.4. Let m = p 1 • • • p s the product of s distinct Fermat primes sorted accordingly to their size, i.e. p i = 2 l i + 1 prime with l i = 2 k i and p 1 < p 2 < . . . < p s , then Φ m splits in

= 2 l 1 +•••+l s -k s -
= 2 l 1 +•••+l s /2l s = 2 l 1 +•••+l s -k s -1 .
Last but not least, it would be interesting to know if cyclotomics whose index is a power of Fermat primes offer good ratios between the practical cost of their arithmetic and their number of slots. Indeed if we quantify the arithmetic cost in practice N log 2 (N ) ( complexity of NTTs and reductions algorithms), cyclotomics offering the smallest ratio N log 2 (N )/ are those which "amortize" best the cost of the arithmetic. N log 2 (N )/ . One can see that besides offering a power-of-two degree, and therefore a probably higher level of security for an arithmetic of size N = N 2 (2n), Fermat primes product ratios are among the best ones. Of course, the smallest ratios correspond to the small degree but depending on the targeted application we may need a large degree. For instance with homomorphic encryption, the multiplicative depth increases with the ciphertext modulus q whose size is bounded by the degree n, for a fixed σ err and a given level of security (cf. Equation(1.1.3)). As a consequence large degree cyclotomics are required for evaluating arithmetic circuits with an important multiplicative depth.

Improving polynomial reduction modulo Φ m

In this section, we propose two efficient methods to compute polynomial reductions. The first method takes advantage of the properties of the cyclotomic polynomials to improve the efficiency of the Barrett algorithm. The second reduction rests on an adaptation of the Montgomery modular reduction over integers [START_REF] Peter | Modular multiplication without trial division[END_REF] to polynomials. In order to ease our exposition, throughout the rest of this section, unless stated otherwise, the letter q will refer to a prime congruent to 1 modulo N. The reader should not forget that for applications to Ring-LWE the modulus q is chosen composite q = q 1 • • • q k (c.f. Section 1.3.1), and thus products and polynomial reductions need to be done in each RNS channel of q, i.e. modulo each prime factor q i of q.

Barrett's reduction for cyclotomic polynomials

As explained in the previous section, Barrett algorithm is sensitive to the difference between the degree of the polynomial to be reduced and that of the polynomial we want to reduce by. The smaller the difference, the more efficient the algorithm will be. Herein we propose an efficient method to reduce this difference before doing the actual Barrett reduction.

In our context, polynomials have degree 2n -2 and coefficients in Z/qZ for a prime q congruent to 1 modulo N and have to be reduced modulo Φ m . Let c be such a polynomial, if c was reduced by a polynomial Q sp of degree n + α +1, the difference between the degree of the polynomial and the degree of Φ m would drop to α. However, in order to obtain the correct value modulo Φ m in the end, Φ m has to divide Q sp and for the efficiency of the reduction Q sp should be sparse enough so that its reduction can be handled through few operations in each F q i . X m -1 would be a good candidate however the difference between m and n = ϕ(m) is quite important most of the time, and in particular for the Fermat primes product cyclotomics we consider. Nonetheless, one can find a suitable sparse polynomial Q sp of degree smaller than m by using cyclotomics properties.

First, the property given in Proposition 1.1.5: d/m Φ d (X ) = X m -1, allows us to choose Q sp as the product of Φ m and some Φ d for d dividing m. Lemma 3.2.1 ([Lan05], chapter 6.3). The following propositions are true:

• let m = p r 1 1 • • • p r s
s be an integer with its prime factorization and let r = p 1 • • • p s be the radical of m then: Φ m (X ) = Φ r (X m/r );

• let p be a prime not dividing m then:

Φ m p (X ) • Φ m (X ) = Φ m (X p ).
The first statement generalizes Lemma 3.1.3 in the sense that a cyclotomic of index m will have a higher degree, but the same number of slots, than the cyclotomic of index r the radical of m. Hence to optimize the arithmetic efficiency one should choose a square free index m. By using recursively the second statement on a square free index m = dh, for some d dividing m, one can choose

Q sp = Φ d (X h ) since we have Φ m | Q sp | X m -1.
Therefore one should choose d dividing m such that Φ d is very sparse and its degree hϕ(d) is as close as possible to n. Moreover if d has at most two distinct odd prime factors then Φ d and thus Q sp has its coefficients lying in {-1, 0, 1} ([Isa94]). In this case reduction modulo Q sp in F q only requires additions modulo q and can be performed very efficiently.

In addition, when m < 2n -2, c can initially be reduced by X m -1 with 2nm -1 additions in F q . Since Φ m (X ) | Q sp (X ) | X m -1 the strategy remains correct, and the complexity of the reduction by Q sp (X ) is further reduced. More precisely, if HW(Q sp ) denotes the Hamming weight of Q sp , i.e. its number of non-zero coefficients, the cost of the reduction of c by Q sp is:

(HW(Q sp ) -1)(m -deg(Q sp )) additions in each F q i . At this point, we obtain c = c mod Q sp (with deg(c ) ≤ n + α and c ≡ c mod Φ m ).
Our optimized Barrett algorithm is depicted in Algorithm 18. It starts by recovering c in power-basis from the NTT representation output by (1.3.8). Then it consecutively reduces c of degree 2n -2 by X m -1 and by the sparse polynomial Q sp . This allows to recover c = c mod Q sp of degree n + α very efficiently. Afterwards, we apply the classical Barrett reduction to c (given in coefficients representation) to get c = c mod Φ m .

Algorithm 18 Optimized NTT-based Barrett reduction in F q [X], for a prime q ≡ 1 mod N.

Require: c NTT = NTT N (c) with deg(c) 2n -2, Q sp ∈ Z[X] of degree n + α + 1, N = N 2 (2n), ñ = N 2 (n), A = N 2 (2α + 1), precomputed NTT ñ (Φ m ) and NTT A ( X n+α /Φ m ). Ensure: c = c mod Φ m in power-basis. function redBt Φ m (c NTT , q, Φ m , Q sp ) c ← NTT -1 N (c NTT ) if m < 2n -2 then c ← c mod X m -1 c ← c mod Q sp f ← c/X n r ← NTT -1 A (NTT A (f ) NTT A ( X n+α /Φ m )) r ← r/X α d ← NTT -1 ñ (NTT ñ (r ) NTT ñ (Φ m )) c ← c mod X ñ -1 return c -d
The impact of this sparse reduction is illustrated in Table 5, where polynomials Q sp are presented for different cyclotomic polynomials. We have chosen to use cyclotomics whose index is a product of Fermat primes for the reasons discussed in Section 3.1.2. The number of batching slots associated with each cyclotomic is also presented. Moreover, since our method can be applied to any index m we have also taken the index m = 32767 = 7 × 31 × 151 which is not a product of Fermat primes but which has a relatively good ratio N log 2 (N )/ (Section 3.1.2). In order to highlight the sparsity of Q sp we also give HW(Q sp ) which is the number of non-zero coefficients of Q sp .

Complexity

Since the complexity of computing multiplications in F q is much higher than additions, the cost of the reduction by the sparse polynomial can be neglected. Moreover, with the RNS, each multiplication in R q , with q = q 1 . . . q k can be decomposed into k independent and smaller multiplications. The degree of Q sp is n + α + 1 thus NTT of size A = N 2 (2α + 1) are required to compute the first polynomial product in Algorithm 18. This is in contrast with N = N 2 (2n) which would have been the size required without using the sparse reduction. Therefore the cost, in terms of modular multiplications, to reduce the polynomial c output by (1.3.8) is essentially k times the cost of Algorithm 18:

k • (C NTT (N ) + 2 • C NTT ( A) + 2 • C NTT (ñ) + A + ñ) .
While the cost of the method by using directly Barrett's algorithm, i.e. without performing the reduction by the sparse polynomial, is:

k • (3 • C NTT (N ) + 2 • C NTT (ñ) + N + ñ) .
Based on this analysis, and assuming that C NTT (N ) = N log 2 (N ), we also provide in Table 5 the theoretical speed-up obtained with the use of the sparse reduction. Those theoretical speed-ups can be compared with those obtained in practice which are presented in Table 10. 1.85

m n Q sp deg(Q sp ) α HW(Q sp ) A N Speed-
Table 5: Sparse polynomials used for partial reduction with their related parameters.

NTT-based Montgomery's reduction

We propose a Montgomery reduction of a polynomial given in NTT representation, inspired by the orginal Montgomery reduction over the integers [START_REF] Peter | Modular multiplication without trial division[END_REF] and the work of Bajard et al. [START_REF] Bajard | Arithmetic Operations in Finite Fields of Medium Prime Characteristic Using the Lagrange Representation[END_REF]. The purpose of this new reduction is to overcome the bottleneck of the previous optimized Barrett algorithm, which is the computation of the inverse NTT of size N of the input polynomial (1.3.8). Our Montgomery reduction takes advantage of the presence of the NTT basis of size N/2 (seen as an RNS basis in [START_REF] Bajard | Arithmetic Operations in Finite Fields of Medium Prime Characteristic Using the Lagrange Representation[END_REF]) in the basis of size N allowing to perform all the computations, in particular the inverse NTT evaluation, in the basis of size N/2 instead of N.

The NTT representation of a polynomial of size N was defined in (1.3.7) as the set {c mod (X -ψ j )|0 ≤ j < N } with ψ a primitive N-th root of unity in F q . This representation can be seen as a polynomial-RNS representation of c mod (X N -1) since X N -1 = 0≤ j<N (X -ψ j ) modulo q, with respect to the following NTT-basis:

B ψ, N = {|X -1| q , |X -ψ| q , . . . , |X -ψ N -1 | q } As X N -1 splits in (X N/2 -1)(X N/2 + 1)
when N is even, half of the NTT N representation of c corresponds to its NTT N/2 representation. Hence, the basis B ψ, N is split along even and odd powers of ψ. We can then define two sub-bases defining two polynomials:

               B (e) ψ, N = {[X -ψ 2j | q , 0 ≤ j ≤ N 2 -1} and
Ψ (e) = N/2-1 j=0 (X -ψ 2j ) q B (o) ψ, N = {|X -ψ 2j+1 | q , 0 ≤ j ≤ N 2 -1} and Ψ (o) = N/2-1 j=0 (X -ψ 2j+1 ) q (3.2.1)
It is straightforward to notice that Ψ (e) ≡ |X N/2 -1| q and Ψ (o) ≡ |X N/2 + 1| q . We also note that since N is a power of two, one has Ψ (o) ≡ Φ N mod q. Therefore, thanks to Lemma 3.2.3, whose first point is a direct consequence of Lemma 3.2.2 which is recalled below, we can choose X N/2 + 1 as the Montgomery factor. Lemma 3.2.2 ([Fil00], Lemma 2). Let n and m be positive integers with n > m. If the quotient n/m is not a power of a prime, then for every integer a, there exist U and V in Z[X] satisfying:

Φ m (X ) • U (X ) + Φ n (X ) • V (X ) = a
If for some prime p and some positive integer t we have n/m = pt, then there exist U and V in Z[X] satisfying the above equation if and only if p | a Lemma 3.2.3. Let Φ m be the m-th cyclotomic polynomial of degree n and N be the smallest power of two greater than or equal to 2n. If m is not a power of two then:

• there exists (U, V ) ∈ Z[X] 2 such that U (X ) • Φ m (X ) + V (X ) • Φ N (X ) = 1;
• for any prime q, Φ m and (X N -1) are coprime in F q . In particular Φ m is a unit in

F q [X]/(Φ N ).
Proof. The first point is a direct consequence from Lemma 3.2.2. Since m is not a power of two, m cannot divide N. By denoting m = 2 r m with m > 1 an odd integer we have

n = 2 r-1 ϕ(m ), thus 2n = 2 r ϕ(m ) and then if N divides m, N 2 (ϕ(m )) = 1 which is not possible since m 3.
Therefore N and m do not divide each other and we can apply Lemma 3.2.2.

Let α be a root of Φ m in the algebraic closure of F q . If α is also a root of X N -1 then α N = 1, since α is of order m by definition of Φ m it implies that m divides N which is impossible since N is a power of two and m is not. So, Φ m and X N -1 are coprime on the algebraic closure of F q thus in F q . The second point comes from Bezout equality in F q and from the fact that X N -1 ≡ (X N/2 -1)(X N/2 + 1) mod q.

One can extract from the coordinates of c in B ω, N the representation c (e) of c in B (e) ω, N (resp. c (o) in B (o) ω, N ). So, given c (o) and c (e) , we can use the NTT operator to get:

NTT -1 N/2 ( c (e) ) = c mod (q, X N/2 -1).
Definition 3.2.4. We define the following function, which takes in as input the residues of the polynomial c (deg(c) < N) modulo a prime q:

modMg Φ m ,Ψ (o) ,q (c) = c + Φ m × | -c/Φ m | Ψ (o) Ψ (o) mod q. (3.2.2)
The modMg Φ m ,Ψ (o) , p function defined in (3.2.2) is a classical Montgomery reduction with factor Ψ (o) and consisting in an exact polynomial division. It always outputs a polyno-

mial congruent to |c/Ψ (o) | Φ m , furthermore when deg(c) N/2 + n -1 the output is exactly |c/Ψ (o) | Φ m . Lemma 3.2.5. If deg(c) N 2 + n -1, then modMg Φ m ,Ψ (o) , p (c) = c/Ψ (o) mod (p, Φ m ).
Proof. The degree of the numerator in

(3.2.2) is bounded by max(deg(c), deg(Φ m )+deg(Ψ (o) )- 1) N/2 + n -1.
Thus, the degree of the resulting quotient is bounded by n -1 < N/2. Therefore, the output is |c/Ψ (o) | Φ m and the computation of (3.2.2) can be made modulo X N/2 -1, i.e. in an NTT representation of size N/2 when using primes q ≡ 1 mod N.

Algorithm 19 details the computation of (3.2.2). The following precomputations are used therein:

           W (o) : -1/Φ m mod (q, Ψ (o) ) in base B (o) ω, N Y (e) : 1/Ψ (o) ≡ 1/2 mod (q, Ψ (e) ) in base B (e) ω, N Z (e) : Φ m /Ψ (o) ≡ Φ m /2 mod (q, Ψ (e) ) in base B (e) ω, N
Algorithm 19 NTT-based Montgomery reduction in F q [X], for a prime q ≡ 1 mod N . Require: c = NTT q, N (c), with N = N 2 (2n) and deg(c) 2n-2 < N/2+n-1 and precomputed constants W (o) , Y (e) and Z (e) . Ensure: R = (c/Ψ (o) ) mod (q, Φ m ) in power-basis.

function redMg Φ m ,Ψ (o) ,q ( c, Y (e) , Z (e) ) ( c (e) , c (o) ) ← Split( c) Split the NTT coeff. wrt parity of indexes Q (o) ← c (o) W (o) Q (e) ← BaseConv( Q (o) ) base conversion from B (o) ω, N to B (e) ω, N T (e) ← c (e) Y (e) + Q (e) Z (e) R ← NTT -1 N/2 ( T (e) ) return R
In line 3 of Alg. 19, we require an operator which takes in as input a vector of coefficients in base B (o) ω, N . This vector defines a unique polynomial Q with deg(Q) < N/2. Then this operator must output the vector of coefficients of Q in base B (e) ω, N . The function BaseConv is defined for any Q with deg(Q) < N/2 by:

BaseConv : (Q(ψ), Q(ψ 3 ), . . . , Q(ψ N -1 )) → (Q(1), Q(ψ 2 ), . . . , Q(ψ N -2 )) (3.2.3) In [BIN06], (3.2.
3) is computed with a classical Lagrange interpolation. Our context is more specific, because the points in which polynomials are evaluated are powers of a N th root of unity ψ in F q . Therefore it can be implemented with an inverse NTT of size N/2 (with ψ 2 as primitive N/2-root of unity) with negative-wrapped convolution (nwc) (cf. Section 1.3.2) followed by a classical NTT of size N/2. Thus it can be performed basically with one inverse NTT of size N/2, N/2 modular multiplications and one NTT of size N/2.

NTT N,ψ (c) = c(1), c(ψ), c(ψ 2 ), . . . , c(ψ 2N -1 ) modulo M = X N/2 + 1 (c(ψ), c(ψ 3 ), . . . , c(ψ 2N -1 )) N/2 mult. Q = c -Φ -1 m M modulo X N/2 -1 (c(1), c(ψ 2 ), . . . , c(ψ 2N -2 )) Q(1), Q(ψ 2 ), . . . , Q(ψ 2N -2 ) (c + Q Φ m ) M -1 interpol./eval. NTT -1 N/2,ψ 2 + NTT N/2,ψ 2 N mult. + N/2 add. NTT N/2,ψ 2 • (1, ψ -1 , . . . , ψ -N/2+1 ) NTT -1 N/2,ψ 2 NTT -1 N/2,ψ 2 with nwc NTT -1 N/2,ψ 2 c • M -1 mod Φ m

Complexity

As a consequence, reducing a polynomial c of degree 2n -2 with coefficients taken modulo q = q 1 • • • q k with Algorithm 19 requires to run it on each RNS channel (modulo each q i ). Therefore its cost in terms of modular multiplications is given by:

k • (3 • C NTT (N 2 (n)) + 4 • N 2 (n)) .
One can find in Table 6 the predicted speed-up of the proposed Montgomery reduction by assuming once again than an NTT of size n requires n log 2 (n) modular multiplications. Despite its lower complexity, the Montgomery algorithm suffers from one main drawback which is the presence of the Montgomery factor in the output.

Adaptation of BGV and FV to the Montgomery representation

In this section, we show how the Montgomery representation induced by Algorithm 19 impacts the BGV and FV schemes and suggest modifications to handle these changes. For simplicity, we denote by M the Montgomery factor (X N/2 + 1 mod Φ m ). Thanks to Lemma 3.2.3 we also know that M -1 exists in R. We assume that ciphertexts ct are given in Montgomery representation, i.e. such that ct = ( c 0 , c 1 ) = (c 0 M, c 1 M ). The conversion to the Montgomery domain can be integrated in the encryption procedure for increased efficiency, and the M factor can be removed during decryption by applying a Montgomery reduction to [ c 0 + c 1 s] q . The Montgomery reduction only impacts procedures involving multiplications in R q by adding a factor M -1 to the result. Therefore, homomorphic additions are not affected by this different representation. Notice that the Montgomery representation is stable with respect to multiplications ((cM

) • (c M ) = (c • c )M 2 which is transformed in (c • c )M
( mod Φ m ) after the reduction). Thus the only impact one has to consider is on homomorphic multiplication.

Impact of the Montgomery representation in BGV

Homomorphic multiplication in BGV corresponds to a polynomial multiplication of the ciphertexts, therefore when multiplying two ciphertexts, encrypted at the same level j, ct i = (c i,0 , c i,1 ) ∈ R 2 q j we obtain:

ct 1 ct 2 = ((c 1,0 • c 2,0 ) • M, (c 1,0 • c 2,1 + c 1,1 • c 2,0 ) • M, (c 1,1 • c 2,1 ) • M ) = ct 1 ct 2 = ct mult
Thus, the noise is not affected in this part. As explained in Section 1.2.1 usually a relinearization procedure is applied after each multiplication. Now, we assume that we need to relinearize the ciphertext ct mult = ( c 0 , c 1 , c 2 ). Note that the relinearization procedure of BGV can be adapted to RNS in exactly the same way than for FV (cf. Chapter 2), hence we will adopt the notations of Chapter 2 for this part. Within the RNS variant, the following dot products are computed over R q j D RNS,q j (c 2 ), --→ rlk i , where

--→ rlk 0 = P RNS,q L (s 2 ) + - → as + t - → e q L and --→ rlk 1 = -- → a q L (cf. Section 1.2.1
). The goal of relinearisation is to obtain D RNS,q j (c 2 ), P RNS,q (s 2 ) ≡ c 2 s 2 mod q j with a limited increase of the noise. Indeed, one can write:

               D RNS,q j (c 2 ), --→ rlk 0 ≡ c 2 • s 2 + D RNS,q j (c 2 ), - → a • s + t D RNS,q j (c 2 ), - → e mod q j ≡ c 2 s 2 + a s + te mod q j D RNS,q j (c 2 ), --→ rlk 1 ≡ -D RNS,q j (c 2 ), - → a ≡ -a mod q j (3.3.1)
Now, we need to obtain the Montgomery representation of the output of this relinearisation, i.e. a ciphertext like

c 2 • s 2 + a • s + e • M, -M • a . When the Montgomery representation is used, c 2 replaces c 2 in (3.3.1)
. Therefore if we modify the relinearisation key as follows:

----→ rlkM 0 = P R N S,q L s 2 /M + - → a • s + t - → e • M 2 q L , ----→ rlkM 1 = -- → a • M 2 q L (3.3.2)
In the following equations, we simulate the effect of Montgomery reduction by introducing a factor M -1 (modΦ m ):

D RNS,q j c 2 , -----→ rlkM 0 • M -1 ≡ c 2 • s 2 • M + D RNS,q j c 2 , - → a • s • M 2 • M -1 + D RNS,q j c 2 , - → e • M 2 • M -1 mod q j ≡ c 2 • s 2 + a • s + e • M mod q j = c 2 • s 2 + a • s + e • M mod q j
Similarly, we get D RNS,q j c 2 , -----→ rlkM 1 • M -1 ≡ -a • M mod q j . Hence, we have obtained the Montgomery representation of the output of relinearisation step at no extra cost -both computationally and in terms of noise growth.

Finally, one needs to apply a modulus switching procedure so as to manage noise growth. We consider the ciphertext ( c 0 , c 1 ) encrypting m at level j and given in Montgomery representation. Let q l | q j and δ i = [-c i /t] q j /q l × t. Then the modulus switching function applied to c i outputs c i = ( c i + δ i ) × q l q j (cf. Section 1.2.1).

Lemma 3.3.1. If [c 0 + c 1 • s] q j ∞ < q j 2 -δ R M -1 ∞ q j t 2q l (1 + δ R s ∞ ) and q j = q l mod t, then c 0 + c 1 • s • M -1 q l = [c 0 + c 1 • s] q j mod t (3.3.3) and c 0 + c 1 • s • M -1 q l ∞ q l q j [c 0 + c 1 • s] q j ∞ + tδ R M -1 ∞ 1 + δ R s ∞ 2 (3.3.4)
Proof. It is similar to the proof presented in Section 1.2.1. By definition of c i , we have:

c 0 + c 1 • s • M -1 q j = [c 0 + c 1 • s] q j = c 0 + c 1 • s -q j k. v • v = [v • v ] ∆ + ∆r v .
Then by performing the scaling we obtain:

t q ( c 1 + c 1 • s) • ( c 1 + c 1 • s) =M ∆[m • m ] t + M • ([m] t • v + [m ] t • v) + tqr • r • M -1 + (q -|q| t )([m] t • r + [m ] t • r + r m ) + M • r v + t(v • r + v • r) + M • r r .
with r r ∈ R like in (1.2.18), then by considering the rounding error r a ∈ R (Equation (1.2.19)) we get:

t q M • c 0 • c 0 + t q M • (c 0 • c 1 + c 0 • c 1 ) • s + t q M • c 1 • c 1 • s 2 •M -1 ≡ ∆[m•m ] t +v mult [q]
with:

v mult =([m] t • v + [m ] t • v) -|q| t M -1 • ([m] t • r + [m ] t • r + r m ) + r v + tM -1 • (v • r + v • r) + r r -M -1 • r a .
By using Equations (

we can bound v mult :

v mult ∞ ≤δ R t r M ∞ + 1 2 ( v ∞ + v ∞ ) + δ R 2 min( v ∞ , v ∞ ) + |q| t δ R t r M ∞ + δ R M -1 ∞ 2 + 1 + δ R M -1 ∞ 1 + δ R s ∞ + δ 2 R s 2 ∞ 2 .
Concerning the relinearization step, an analysis similar to the one in Section 3.3.1 can be performed, with minor adaptations for the relinearisation key. Similarly, one concludes that the Montgomery reduction introduces no extra cost, both in terms of computation and in terms of noise growth, during this step.

Overall impact on noise growth

For both BGV and FV, M -1 ∞ and the expansion factor δ R are involved in the noise growth due to the scaling steps performed with the Montgomery reduction. Therefore in this case, one must take into account the norm of the associated M -1 when selecting parameters but this does not seem to be very restrictive. Indeed on the first 20, 000 cyclotomics less than 13.4% have an infinite norm greater than 10, less than 0.5% greater than 100 and only 3 of them greater than 1, 000. Moreover among those cyclotomics, those whose M -1 's norm is greater than 100 offer a relatively small number of batching slots compared to their degree. Indeed their ratio N log 2 (N )/ is equal to 5343 on average (and lie between 450 and 30720) whereas the cyclotomics proposed in Table 5 have their ratio smaller than 250 (cf. Figure 8). Therefore the cyclotomics whose M -1 factor has large coefficients do not seem to be the best suited for batching.

we obtain:

v ∞ ≤ 1 2V V 2 + 2V + 1 + b relin ∞ + δ R M -1 ∞ b scale ∞ ≤ V 2 + 2 + b relin ∞ + δ R M -1 ∞ b scale ∞ ≤ V
which means that for a chain of L + 1 moduli, we are able to evaluate circuits of multiplicative depth L. Since the factor δ R M -1 ∞ is only added to the noise in the end, the impact of the Montgomery representation on the parameter selection is quite moderate, actualy in practice the parameters can remain the same most of the time.

FV

The initial noise of a ciphertext is at most

V init = B err (1 + 2δ R B key ) (cf. Section 1.2.2). We recall that r M ∞ = δ R M -1 ∞ (1+ ρ) δ R B k ey +1 2
+1 and that the k moduli q i have size ν i.e. q i < 2 ν .

The output of a tree of depth L has a noise bounded by

C L RNS,M,1 V + C RNS,M,2 C L RNS,M,1 -1 C RNS,M,1 -1 (cf.
Section 1.2.2) with:

                   C RNS,M,1 = δ R t 2r M ∞ + 1 + δ R 2 C RNS,M,2 = |q| t δ R t r M ∞ + δ R M -1 ∞ 2 + 1 + δ R M -1 ∞ 1 + δ R B key + δ 2 R B 2 key 2 +k (1 + δ R B key + δ 2 R B 2 key ) + kδ R B err 2 ν+1 . (3.3.10)
We denote by

L M max = max      L ∈ N | C L RNS,M,1 V + C RNS,M,2 C L RNS,M,1 -1 C RNS,M,1 -1 B dec     
the depth allowed by the homomorphic multiplication where B dec corresponds to the decryption bound of the RNS variant of FV given in (2.1.4). Since a factor δ R M -1 ∞ is roughly added to the orginal C RNS,1 constant (cf. Equation (2.4.1)), we can expect an important impact on the multiplicative depth.

Table 7 presents the maximal theoretical depths for FV with and without the use of the Montgomery reduction (L M max and L max respectively). For these computations we have taken parameters B key = 1, following the recommendations of [START_REF] Bonnoron | A note on Ring-LWE security in the case of Fully Homomorphic Encryption[END_REF]

σ err = 2
√ n, and a number k of 62-bits moduli to get the largest size for q ensuring at least 80-bits of security according to [START_REF] Albrecht | On the concrete hardness of Learning with Errors[END_REF]. We notice that, as expected, the multiplicative depth is far smaller with a Montgomery representation in theory and we have been able to confirm this behaviour in practice.

Mixing optimized Barrett and Montgomery reductions Considering the non-negligible impact of the Montgomery representation on the multiplicative depth of FV, a more robust strategy for this cryptosystem corresponds to a mixed Barrett/Montgomery approach. Alg. 18 is used during the first stage of homomorphic multiplication, with ciphertexts not exploiting a Montgomery representation. This avoids the noise growth caused by the Montgomery factor. Nonetheless, the Montgomery reduction can still be used during the relinearisation stage, since we have seen that this does not cause a larger noise growth. Since we do not want to obtain a ciphertext in Montgomery representation after the relinearization procedure, the relinearisation key needs to be modified by replacing the factor M 2 of the Montgomery approach (cf. Equation 3.3.2) by M .

m n k M -1 ∞ δ R L max L M max 4369 4096 2 1 35n 1 (4

About the expansion factor

The reader may have noticed the important difference between the theoretical and practical depth for FV presented in Table 7. Of course, the theoretical depth as it is computed represents the worst-case scenario, thus we expect it to be smaller than the depth observed in practice on which we have no guarantee. However for practical applications it could be interesting to have a better approximation of the noise growth behaviour. By definition the expansion factor δ R quantifies the growth of the coefficients after a product in the worst-case scenario, thus this is the quantity we should try to evaluate more precisely in practice.

Let us assume we want to multiply two polynomials a and b, both of degree n-1. Without reducing the product by Φ m , we have the following bound:

a • b ∞ ≤ n a ∞ b ∞
For this bound to be reached in practice it is necessary to have all the coefficients of a (resp. b) being equals to a ∞ (resp. b ∞ ) at the same time. If we consider that the coefficients of a and b to be sampled independently from a probabilistic distribution, this bound is likely to be reached with exponentially low probability in n. From now we assume our two polynomials have coefficients (a 0 , . . . , a n-1 ) and (b 0 , . . . , b n-1 ) sampled independently and uniformly in a centered interval [-µ, µ] whose size is exponential in n. To estimate δ R , we need to estimate the distribution of:

δ i = i j=0 a j b i-j a ∞ b ∞ = i j=0 a j a ∞ b i-j b ∞
for i ∈ {0, . . . , 2n -2}. Now if we assume than (a 0 / a ∞ , . . . , a n-1 / a ∞ ) has the same distribution than (T a i ) n-1 i=0 a sequence of independent random variables uniform in [-1, 1]. Of course this is not true since the a i / a ∞ have only rational values and at least one of them is equal to ±1 with probability 1/2, but we assume this is a good enough approximation for our purpose.

Therefore δ i has the same distribution than i j=0 T a j T b i-j . Notice that for j = 0, . . . i, the random variables Z i j = T a j T b i-j are independents and have the same probability distribution. We recall that if Z = XY with X and Y two independent random variables following a uniform distribution in [-µ, µ], then:

P(Z ≤ x) = 1 2 + x 2 2µ 2 1 + ln µ 2 |x | for x ∈ [-µ 2 , µ 2 ] E(Z ) = 0 Var(Z ) = σ 2 Z = µ 2 /9 Since δ i , 0 ≤ i ≤ 2n -2, is a sum of α i = min(i + 1, 2n -i -1) i.i.d
. random variables, the central limit theorem tells us it has asymptotically the same distribution than N (0, α i /9). Now, if we assume the δ i s to be independents, since the reduction modulo Φ m is a linear transformation we can deduce the probabilistic law followed by the coefficients of

a • b/( a ∞ b ∞ ) mod Φ m . Indeed, if X and Y are two independent random variables such that X N (µ 1 , σ 2 1 ) and Y N (µ 2 , σ 2 2 ) then X +Y N (µ 1 + µ 2 , σ 2 1 + σ 2 2 ) and for any λ ∈ R, λ X N (λ µ 1 , λ 2 σ 2 1
). We denote δ = (δ 0 , . . . , δ n-1 ) = F m (δ 0 , . . . , δ 2n-2 ) where F m denotes the reduction modulo Φ m as in Lemma 3.3.3.

All the coefficients of δ follow a centered gaussian distribution for which we can compute the standard deviation σ i for each i = 0, . . . , n-1, let σ max be the biggest one, thus |δ i | follows a half-normal distribution of expected value √ 2/πσ i . We know that P(

|δ i | > xσ i ) = erfc(x/ √ 2)
where erfc denotes the complementary error function, as a consequence we can write the following:

P( a • b ∞ ≥ xσ max a ∞ b ∞ ) ≤ n × erfc x/ √ 2
Hence, for a small enough probability (smaller than 2 -p ), i.e. for a large enough x, we can consider δ p = xσ max as a probabilistic bound on the expansion factor. The following tend to indicate the model is reasonable enough for our purpose.

Experimental results

The proposed methods for polynomial reduction have been implemented using C++, and compiled with gcc using the optimization flag -O3. All the experimental results presented herein were measured on an i7-5960X, running at 3.0 GHz with 32 GB of main memory without exploiting any parallelism.

Polynomial reduction

In Figure 10, one can find the execution timings of polynomial reduction, the unoptimized and optimized Barrett reductions and the Montgomery reduction for the different cyclotomics we have considered. As a general indication, and to highlight the benefit of our reduction algorithms, Figure 10 also presents the timings of a generic reduction algorithm, in our case we have chosen NTL's one by using preconditioning ( [START_REF] Halevi | Implementing BP-Obfuscation Using Graph-Induced Encoding[END_REF]). All timings correspond to the execution of the algorithms on a single modulus of 62-bits. Speed-ups up to 1.95 and 2.55 were achieved for the optimized Barrett and Montgomery algorithms respectively when compared with the unoptimized Barrett reduction. It should be noted that even though the execution times increase with m, allowing to use FHE parameters with a larger multiplicative depth, the time per batching slot presents very little variations for the considered polynomials. Details timings and speed-ups are given in Table 10, one can notice that we obtain speed-ups comparable to what we expected (cf. Tables 5 and6).

Impact on homomorphic multiplication

The aforementioned reduction methods were used to implement the homomorphic multiplication operations of the FV and BGV schemes. One can find in Figures 11 and12 the execution times (resp. execution times divided by the number of batching slots) of the homomorphic multiplication of two freshly encrypted ciphertexts for FV and BGV, with the parameters given in Table 7. Because of their low performances, the results using NTL reduction are omitted.

In order to compare with the most efficient case, we provide instead timings for power-of-two cyclotomics of same dimension using the NTTs with negative-wrapped convolution (NWC) algorithm from NFLlib ([AMBG + 16]). For instance we compare m = 21, 845 of degree n = 2 14 with m = 2 15 of same degree. Unlike Figure 10, the execution time of homomorphic multiplication increases significantly with m. This trend is explained by the relinearisation procedure, which requires a number of NTTs that increases quadratically with log 2 q (cf. Section 2.3.4).

Nevertheless, the employed reduction procedure plays a preponderant role in the efficiency of the homomorphic multiplication. Indeed, one achieves speed-ups up from 1.24 to 1.12 (resp. from 1.37 to 1.19) when comparing the homomorphic multiplication exploiting the optimized and unoptimized Barrett reduction methods for the BGV (resp. FV) scheme. Since using only Montgomery reduction in FV causes much more important noise growth (cf. Section 3.3.3), we provide the timings corresponding to the mixed Barrett/Montgomery stategy (cf. Section 3.3.3), which does not impact the noise growth, and gave speed-ups from 1.39 to 1.19. In contrast, for BGV, where one can exploit the Montgomery representation throughout the whole procedure without impacting significantly the noise growth, we obtain speed-ups from 1. 18 with several reduction strategies (plus modulus switching for BGV) on the m-th cyclotomic polynomial. Modulus q is a product of 62-bit prime moduli and the y-axis is in logarithmic scale Last, one can notice that using power-of-two cyclotomics with NTTs and negative-wrapped convolution brings a speed-up of roughly 10 , for both BGV and FV, compared to the cyclotomic we have chosen. However when considering the time spent per batchig slots, non-power-of-two cyclotomics are clearly more interesting, with a speed-ups up to 100.

The reader may have noticed that the speed-up of the proposed methods decreases as the degree n of the cyclotomic polynomial, and thus when log 2 q gets larger due to the increasing complexity of the relinearisation procedure. This suggests that they are most beneficial when one needs to homomorphically evaluate small circuits. Since a lot of practical applications of FHE ([GDL + 16], [START_REF] Khedr | SHIELD: Scalable Homomorphic Implementation of Encrypted Data-Classifiers[END_REF], [START_REF] Naehrig | Can homomorphic encryption be practical[END_REF]) have circuits with small depth, the reduction algorithms we have proposed can potentially have a wide range of applicability.

m

Conclusion

Properties of non-power of two cyclotomics allow to pack several binary plaintexts in a single ciphertext and thus to amortize the important costs required by homomorphic encryption.

Although Lyubashevsky et al. ([LPR13]) have shown one could generalize the efficient NTT with negative wrapped convolution technique to general cyclotomics, the tensored representation required for their method is less convenient to implement. As a consequence, their method remains little used in practice and major homomorphic libraries such as HElib keep using the simpler univariate representation of elements in the general case.

In this work, we have considered and improved the arithmetic associated to the univariate representation in general cyclotomic rings. We have proposed two methods for performing the polynomial reduction: one based on the Barrett reduction and the other on a Montgomery representation both with the same asymptotic complexity. The latter offers better performances, however it causes more important noise growth in homomorphic schemes. If this growth remains small enough to not affect the multiplicative depth of BGV, it reduces considerably the practical and theoretical one of scale-invariant schemes like FV.

We have highlighted the gains brought by our reduction algorithms in practice with a C++ implementation and have obseverved speed-ups up to 1.95 and 2.55 when comparing, respectively, our optimized Barrett and Montgomery reductions with a classical Barrett reduction. Finally, these reductions have been incorporated into the homomorphic multiplication procedures of BGV and FV, resulting in speed-ups up to 1.33 and 1.49 respectively. If our optimzed Barrett reduction remains hardly compatible with generic implementation, our Montgomery reduction however is completely generic and could benefit to implementation of homomorphic libraries. In particular, since the noise growth caused by the Montgomery representation does not impact significantly the choice of parameters of BGV, HElib could entirely benefit of this As the world moves into an ever more digital-based economy, those who hold the best quality data have a significant advantage over their competitors. Companies can identify patterns in their users' behaviours, and extrapolate their needs of tomorrow [QWD + 16]. As they gather more data, their predictions get increasingly better, further consolidating their position as market leaders. We can foresee how this strategy can be applied to other markets. For instance, a pharmaceutical company, who has collected data about the reactions of a large number of patients to a particular medicine, could potentially extrapolate how other patients would react to it.

Companies can build high-quality models to predict future patterns based on the large amounts of data they collect. When these predictions are made as part of a service, for instance which are the most relevant pages based on a user's query, or which are the products a user is most likely to buy based on his past choices, companies will be invested in preventing the model parameters from being disclosed to a competitor that could potentially mimic their service. In addition, the clients of this service may wish to protect their own data. For example, when doctors want to know how patients would react to a certain medicine, the patients' data should remain confidential.

In its most basic form, one model would produce a single bit based on the input, signaling, for example, whether a certain medicine will be effective based on the patient's heart pressure, age, etc. A SVM is a machine learning method that works through analogy [START_REF] Chang | LIBSVM: A library for support vector machines[END_REF]. When a model is built, a subset of the examples is encoded as support-vectors, along with weights. During classification, the similarity between the input vector and the examples is evaluated through a kernel function, and the resulting values are combined through a weighted average. The sign of the weighted average identifies whether the input belongs to a certain class or not. In a confidential setting, a user should be able to provide encrypted data to be classified, and a service provider, namely a company, should be able to return a single encrypted bit, encoding the classification result; without the client learning anything else about the model, and without the server learning anything about the input.

Homomorphic encryption offers exactly these properties and is thus perfectly suited to address this problem. However performing efficiently the computations required by the SVM from the homomorphic additions and multiplications primitives is quiet challenging. In this chapter we present efficient methods to perform the computations required by the SVMs quite efficiently. For this purpose, we use the construction of Cheon et al. ( [START_REF] Hee Cheon | Homomorphic Encryption for Arithmetic of Approximate Numbers[END_REF]) which allows to perform approximate arithmetic homomorphically.

Preliminaries

This section starts by giving an overview of the related art and in particular of previous works using homomorphic encryption for the classification of data. Then we briefly present the different computations that need to be done for evaluating SVM and the construction of Cheon et al. that we are using.

Related Art

Homomorphic encryption has been typically exploited to implement either bitwise circuits ([GHS12b], [START_REF] Martins | Enhancing data parallelism of fully homomorphic encryption[END_REF]) or operations over the integers [START_REF] Costache | Fixed-Point Arithmetic in SHE Schemes[END_REF]). SVMs are challenging to implement in this setting since they mix both integer arithmetic (computation of the kernel functions) and bitwise circuits (extraction of the sign bit). In the past, this latter problem has been solved by using Garbled Circuits (GCs), requiring interactive protocols ( [START_REF] Laur | Cryptographically private support vector machines[END_REF]).

In contrast to methods based on GCs, approaches based on homomorphic encryption to classify private data, after transmitting key material, require no communication other than the encrypted data to be classified, achieving the minimal possible overhead. Previous works on the applications of homomorphic encryption to machine learning has mostly considered the use of exact arithmetic ([GLN13], [START_REF] Bos | Privacyfriendly forecasting for the smart grid using homomorphic encryption and the group method of data handling[END_REF], [CGH + 18], [START_REF] Bonte | Privacy-Preserving Logistic Regression Training[END_REF]). However in [KSW + 18], Kim et al. have shown that the use of an approximate arithmetic does not affect significantly the quality of the result but has the potential to considerably improve the performance.

The previous works on the application of Homomorphic Encryption (HE) to machine learning have either considered that the computation of threshold functions could be deferred until after the decryption ([GLN13]), or focused on systems, such as logistic regression, where no threshold computation is required ([KSW + 18], [CGH + 18], [START_REF] Bonte | Privacy-Preserving Logistic Regression Training[END_REF]). Difficulties to implement the sign function come from the fact that the operations available through homomorphic encryption are more compatible with the computation of circuits which can be approximated with polynomials.

However, providing the client with a value rather than its sign may lead to a larger leak of information than a service provider would be willing to accept. Nevertheless, recent research has shown inceptive results pertaining to the computation of non-trivial functions, including the threshold ( [START_REF] Gizem S Cetin | Arithmetic Using Word-Wise Homomorphic Encryption[END_REF]) or reduction modulo an integer ([CHK + 18]), through an approximation using sine waves. In this work we use a different method, based on the Newton-Raphson procedure, which converges quadratically to the sign function; and apply it to the computation of SVM classification.

Support Vector Machine

Given a multiset of examples {(x i , y i )} i , each encoded as a vector of features x i ∈ R h with the corresponding labels y i ∈ {-1, 1}, an SVM selects a subset of them of size r as support-vectors, assigns them weights α i and a bias β, and computes the parameters to a kernel function K that maximise the accuracy of the resulting model. This corresponds to the training phase. During the classification phase, the model is provided with a vector of features x and will output the most likely label y. The kernel function is used to compute the similarity between the supportvectors x i and x, and the similarity levels are aggregated through a biased weighted average to output the most likely label x belongs to:

y = sign r i=0 α i y i K (x i , x) + β (4.1.1)
The four most commonly used kernel functions are:

K linear (x, x i ) = x, x i (4.1.2) K γ,ρ,d polynomial (x, x i ) = (γ x, x i + ρ) d (4.1.3) K γ,ρ sigmoid (x, x i ) = tanh(γ x, x i + ρ) (4.1.4) K γ RBF (x, x i ) = e -γ | |x-x i | | 2 (4.1.5)
While the first is the most computationally efficient, it is mostly useful for data with a large number of features. In contrast, kernels like K polynomial , K RBF and K sigmoid are best at generalising patterns from data with fewer features.

Homomorphic encryption for approximate numbers

We recall that the m th cyclotomic field Q(ζ m ) can be embedded in the subring H = {(z 1 , . . . , z n ) : 1.1.2) through the canonical embedding. Instead of trying to encode data in the coefficients of a polynomial m ∈ R t for some plaintext modulus t as it was usually done, Cheon et al have chosen to encode the plaintext data directly in H. In this way, they can encode directly n/2 complex values as an element z of H and thus as an element m of R.

z n/2+j = z j , 1 j n/2} of C n (Equation

However since σ(R)

H, one first needs to round z to an element of σ(R). There are different methods to perform this kind of rounding in general cyclotomic ring, see for instance [START_REF] Lyubashevsky | A Toolkit for Ring-LWE Cryptography[END_REF]. However in the particular case of power-of-two cyclotomics the canonical embedding σ is an isometry, which means in particular that the columns of the matrix CRT m (Equation (1.3.13)) form an orthogonal basis of the lattice σ(R). Therefore, in this case it is staightforward to compute the closest point of z ∈ H belonging to the lattice σ(R) with orthogonal projections:

z σ(R) = z + n-1 i=0        -z/σ(X i ) σ(X i ) 2 2       1 σ(X i ) = z + f (4.1.6)
where [•] 1 denotes the fractional part between [-1/2, 1/2) of a real number, we extend this notations to the complex numbers by considering it both on the real and imaginary parts. Once z approximated by its closest point in the lattice, one can recover

m = σ -1 ( z σ(R) ) ∈ R.
Actually since it is an isometry, it is equivalent to directly round the result of the inversion coefficient-wise, i.e. to compute m = σ -1 (z) . Finally, in order to avoid the rounding to affect the most significant bits of z, one should multiply z by a large factor ∆ before performing the rounding, so that in the end m = σ -1 ( ∆z σ(R) ).

Cheon et al. were able to adapt the procedure of classical homomorphic schemes to their encoding method and since under σ both additions and multiplications are coefficient-wise, homomorphic additions and multiplications act on each slot independently. In particular one is able to perform directly additions and multiplications of n/2 complex-values in parallel even by using power-of-two cyclotomics. Therefore, it is more advantageous that the classical batching technique described in Section 1.3.3 which depends on the properties of the cyclotomic polynomial. However the main drawback of their construction is that it only allows to perform arithmetic on approximate numbers. From now for efficiency reasons we only consider power-of-two cyclotomics.

In the context of [CKKS17], Cheon et al. applied their encoding technique to the BGV scheme [START_REF] Brakerski | Leveled) Fully Homomorphic Encryption Without Bootstrapping[END_REF]. The main difference between the original scheme and their adaptation is that they do not use any bound on the size of the coefficient in the plaintext space, hence in their construction the plaintext space is R and not R t . In this way the noise is not multiplied by a factor t and as a consequence, an encryption of m ∈ R in this construction corresponds to a pair of polynomials ct = (c 0 , c 1 ) ∈ R 2 q which, once evaluated on the secret key s, satisfy:

[c 0 + c 1 • s] q = m + v = σ -1 (∆z + f ) + v (4.1.7)
with v the noise inherent to the ciphertext. Contrarily to [START_REF] Brakerski | Leveled) Fully Homomorphic Encryption Without Bootstrapping[END_REF], the noise is not removed during the decryption procedure. As a consequence, this noise plus the error due to the rounding distort the result so that this construction only allows for an approximate arithmetic. However one can ensure a certain precision on the computation with the size of ∆, indeed from Equation (4.1.7) if we want to ensure p bits of precision on the result we need to choose ∆ such that when decrypting:

∆ ≥ 2 p ( v can ∞ + f ∞ ) (4.1.8)
where f is the error coming from the rounding in Equation (4.1.6).

From there the procedures of BGV can be applied directly to this construction. The homomorphic addition of two ciphertexts corresponds to the pairwise addition of the ciphertexts' polynomials. One can also add a plaintext value directly to a ciphertext by adding it to the first coefficient of the ciphertext.

Similarly we consider two types of homomorphic multiplications: nonscalar and scalar multiplications. While the first type of multiplication involves two encrypted messages, in the second, one of the operands is known in the clear. The nonscalar multiplication of two ciphertexts ct and ct is computed as usual:

ct mult ← c 0 • c 0 q , c 0 • c 1 + c 1 • c 0 q , c 1 • c 1 q
. The relinearization procedure can be performed as usual, however the modulus-switching procedure is now applied both to reduce the growth rate of the norm of v, due to the homomorphic multiplication, and to prevent the growth of the size of the message. Indeed, since after a multiplication, we basically obtain an encryption of ∆ 2 z • z , one should choose ∆ q/q so that after the rescaling operation, the extra ∆ factor is removed. Scalar multiplications can be computed more efficiently than nonscalar multiplications. The operand z that is known in the clear is encoded as m = σ -1 ( ∆z σ(R) ). Afterwards, the ciphertext ct = (c 0 , c 1 ) is multiplied by m , producing ([m • c 0 ] q , [m • c 1 ] q ). Since the resulting ciphertext has only two elements, relinearisation is no longer required. However, one still needs to apply modulus-switching.

It is also useful to permute the slots of a message encrypted under a ciphertext (c 0 , c 1 ). In the case of power-of-two cyclotomics, there is a one-to-one correspondence between the coefficients one obtains through the canonical embedding and the coefficients of the negativelywrapped NTT of the polynomial. Hence, changing the order of the latter, while respecting the position of the complex conjugates, will also permute the slots of the former. Therefore to permute the slots of a plaintext, one does not need to consider the action of the Galois group on the slots and can just instead compute the negatively-wrapped NTT of c 0 and c 1 , and changes the order of the resulting coefficients. After both c 0 and c 1 are permuted, the ciphertext is decipherable under the equivalently permuted s (see Section 1.3.3). Hence we need to apply a key-switching procedure as explained in Section 1.3.3 to be able to decrypt under the original secret key s.

Novel homomorphic techniques for SVM classification

In the analysed scenario, two parties are considered: a client who wishes to classify sensitive data, and a service provider that offers a classification service in a confidential manner.

SVM confidential protocol

The service provider uses large databases to construct an SVM model. Since his objective is to provide classification as a service, the provider will be invested in preventing someone else from being able to replicate his SVM model. However, if a client that uses this service has access to a sufficient amount of samples, he will be able to replicate the SVM by using samples {(x i , y i )} i as input to the learning algorithm. A solution to this problem might involve limiting the number of classifications a client might perform in a given period of time. This will lead to a slower leakage of data. Furthermore, the service provider should limit the number of information that is leaked with each classification. Consider, for instance, that a linear kernel is used. In this case, (4.1.1) reduces down to:

y = sign ( w, x + β) (4.2.1)
where w = r i=0 α i y i x i . If simplifying assumptions were assumed, like in [START_REF] Graepel | ML Confidential: Machine Learning on Encrypted Data[END_REF], namely by not computing the sign function in (4.2.1), a client could completely determine the coefficients of w and β. He would only require h + 1 classifications of the kind w, x + β for h + 1 linearly independent x, where h denotes the number of features. The previous example shows the importance of limiting the amount of information that is provided to the client. Despite the reduced set of operations available with the considered homomorphic scheme, we will design efficient sign determination systems to adress this problem.

A second concern is that of protecting the support-vectors. Since the support-vectors encode examples from the dataset used to train the SVM, they constitute most of the time confidential data. There should therefore be mechanisms in place that prevent their disclosure. This security issue has been addressed in [BCN + 14]. A randomised mechanism is used during the learning phase that supports differential privacy -guaranteeing that even if a training datum is changed or removed, the model output will not change significantly. This concept embodies the idea that the output of the learner is an aggregate statistic of the sensitive data, and if a large amount of data is being aggregated, the statistic should not be very sensitive to changes or removal of a single datum. With this technique, [BCN + 14] is able to prove security even against an attacker with knowledge of a significant set of the training data, knowledge of the learning mechanism (barring its source of randomness) and arbitrary access to the classifier, that tries to determine the features or the training label of a training datum unknown to him.

In the previous discussion, it has been assumed that the client had knowledge of the kernel function being used. While the service provider might try to hide this information from the client, so that it becomes harder for the client to mimic his model, it will not result in a considerable improvement in performance. First, there is a limited number of kernels that can be considered. Second, the service provider needs to make the scheme parameters available which, due to efficiency reasons, should be tuned for the used kernel. By taking this into consideration the client will be able to further reduce the already small number of possible used kernels.

Similarly, the client is interested in protecting his own data. Since BGV achieves semantic security against passive adversaries, it ensures that no adversary is capable of distinguishing an encryption of one message from another. In addition, we assume that the service provider is an honest-but-curious party, i.e. it will precisely follow the stated protocol to provide the desired functionality, but will look at the available information and try to exploit it. This assumption is a reasonable model for an economically motivated provider. The provider will be motivated to offer an excellent service, so that its reputation is not damaged, but will still take advantage of any extra information to improve its profits. A malicious provider would be a much stronger adversary, who could intentionally produce wrong results. Protecting the protocol against this type of adversary would significantly increase its complexity, making it impractical. During the protocol execution, the service provider only has access to the client's data in an encrypted form. Due to BGV's semantic security, we can assume he is unable to derive any information from there.

The protocol herein proposed consists of three main phases. During the first phase, the keys underlying BGV are generated by the client, and the service provider is provisioned with the public-key material. Keys need only to be generated every once in a while (e.g. yearly). During the second phase, the client sends the service provider the data to be classified in encrypted format. The provider will operate on it homomorphically and return the encrypted result of the computation back to the client. In a final phase, the classification result is decrypted. In the following sections, we will not only focus on optimising the efficiency of the homomorphic evaluation of the SVM classification by the service provider, but also on limiting the amount of information that is leaked with each classification. Batching is herein exploited to optimise the efficiency of (4.1.1) by evaluating the kernel function simultaneously for several support-vectors. As previously stated, by exploiting the canonical embedding, one can encrypt ϕ(m)/2 = n/2 values in the same ciphertext, and apply homomorphic additions and multiplications that operate on each value independently. Since we will be working with power-of-two cyclotomics, we restrict ourselves to the case where n is a power of two. If the value slots are numbered from 0 to n/2 -1, and an input vector x has h < n/2 features, then we map it to the plaintext space as follows:

xk•2 log 2 h +j =        x j if 0 ≤ j < h 0 otherwise (4.2.2)
The encoding in (4.2.2) replicates n/2 log 2 h +1 times the vector of feature x, as exemplified in Figure 13 and enables batching without the client knowing the number of support-vectors that will be operated on. If the server uses more than n/2 log 2 h +1 support-vectors, the input ciphertext can be replicated to obtain further copies of the same value. In contrast, if fewer than n/2 log 2 h +1 support-vectors are employed, the unused copies of x in x will be multiplied by 0 during the kernel evaluation and will not influence further computations. h ≤ n/2 log 2 h +1 support-vectors are encoded in a single cryptogram as depicted in Figure 13 for h = n/2 log 2 h +1 :

xk•2 log 2 k+j =        x k, j if 0 ≤ j < h, 0 ≤ k < h 0 otherwise (4.2.3)
Algorithm 20 Homomorphic description of Binary Addition Tree Require: (logSep, logAmount) ∈ N 2 Require: Enc(x) y ← Enc(x) for i ← 0 to logAmount -1 do rotY ← Rotate 2 l ogS e p (y) y ← HomAdd(y, rotY ) logSep ← logSep + 1 return y approximate a function near a point, Remez' algorithm provides a minimax approximation of a function over an interval which is particularly useful in our setting. Hence, by establishing bounds on the magnitude of the coefficients of x, we are able to bound the magnitude of the input of e -γx and tanh(x) in (4.1.5) and (4.1.4). Therefore, we are able to maintain a small maximum error across the whole input interval. Since with a Taylor expansion the error is kept small close to the approximation point, and gets significantly larger as the points get further away from it, one would need larger degrees to keep an accurate approximation within the considered interval.

Traditional polynomial evaluation techniques, which minimise the number of nonscalar multiplications ([PS73]), have been previously considered in the context of homomorphic encryption ([CKKS17]). While this type of algorithms is optimal when computing in the clear, the same is not necessarily true when performing operations with HE. Indeed, one needs to tune the cryptographic scheme parameters to the multiplicative depth of the circuit one wants to evaluate. Having larger parameters leads to a severe degradation of performance. Hence, one can no longer consider the number of multiplications as a whole, but one has rather to consider the maximum number of multiplications in a computational path.

Algorithm 21 Homomorphic evaluation of a polynomial Require: chains ← {2 : (1, 1), 3 : (1, 2), . . .} Require: Enc(x) Require: p 0 , . . . , p d y ← HomAdd((p 0 , 0), HomMul(Enc(x), (p

1 , 0))) powersOfX ← {1 : Enc(x)} for i ← 2 to d do (a (i) j , a (i) k ) ← chains[i] x a (i) j ← powersOfX a (i) j x a (i) k ← powersOfX a (i) k x i ← HomMul x a (i) j , x a (i) k y ← HomAdd y, HomMul x i , p i if a (i) j does not belong to any pair in chains[i + 1, . . . , d] then powersOfX ← powersOfX\ a (i) j : x a (i) j if a (i) k does not belong to any pair in chains[i + 1, . . . , d] then powersOfX ← powersOfX\ a (i) k : x a (i) j if i belongs to a pair in chains[i + 1, . . . , d] then powersOfX ← powersOfX ∪ i : x i return y
Algorithm 21, herein proposed for the evaluation of a polynomial of degree d, minimises the circuit multiplicative depth by precomputing the minimum addition chain for each 2 ≤ n ≤ d. In the Algorithm, the notation d = {k 1 : i 1 , k 2 : i 2 , . . .} is used to denote a dictionary with elements i 1 , i 2 , . . ., that can be accessed by the keys k 1 , k 2 , . . ., via the

[•] operator: d[k 1 ] = i 1 , d[k 2 ] = i 2 , . . . Moreover, the notation d[k 1 , k 2 , .
. .] is used to denote the multiset {i 1 , i 2 , . . .}. An addition chain corresponds to a sequence of integers (a 0 , . . . , a s ) such that ∃ 0≤ j,k<i a i = a j + a k for i > 0 and a 0 = 1. A minimum addition chain of n corresponds to a shortest sequence such that a s = n. By using a minimum addition chain (a 0 , . . . , a s ) of n, one is capable of evaluating x n with the minimum multiplicative depth, by computing:

x a i = x a j × x a k , 0 < i ≤ s, a i = a j + a k (4.2.4)
The proposed procedure computes x n starting at n = 2 and ending at n = d. Each time a power n of x is computed, x n is stored if n is required by an addition chain of n > n. Furthermore, one only needs to store the final pair a j + a k = n for each 2 ≤ n ≤ d, since the values of x a j and x a k will have been computed previously in the algorithm.

Finally, each time a power of x is computed its value is scaled and added to an intermediate sum:

p(x) = d i=0 p i x i (4.2.5)

Sign evaluation

The Newton-Raphson method is a technique to find successively better approximations to roots of real-valued functions. Herein, this method is applied to homomorphically compute the sign of a number. The proposed procedure approximates the roots of f (y) = 1 y 2 -1, converging to -1 for an initial negative guess and to +1 for an initial positive value. For an input value y 0 = y a succession y 1 , . . . , y t is computed such that:

y i+1 = y i - f (y i ) f (y i ) = y i 3 -y 2 i 2 = g(y i ) (4
∈ (- √ 3, 0) (resp. y 0 ∈ (0, √ 3
)) and is constant equal to 0 from rank n = 1 if y 0 ∈ {-√ 3, 0, √ 3}. Moreover the convergence to ±1 is quadratic.

Proof. Figure 15 presents the variations of the function g, defined by ( 4

.2.6), on [- √ 3, √ 3]. y var. of g - √ 3 -1 0 1 √ 3 0 0 -1 -1 1
]) = [-1, 0] (resp. g([0, 1]) = [0, 1]) and that g([- √ 3, 1]) = [-1, 0] (resp. g([1, √ 3]) = [0, 1]). Therefore if y 0 ∈ [- √ 3, √ 3
], all the y i s, for i ≥ 1, will belong to [-1, 1]. The function g is increasing on [-1, 1], thus the sequence defined by y n+1 = g(y n ) and

y 0 ∈ [- √ 3, √ 3
] is monotonic from rank n = 1 and since it is bounded and g is continuous, it converges to a limit ∈ {-1, 0, 1} which is a fixed point of g.

Studying the sign of g(y)y shows that the sequence (y n ) n∈N is decreasing (resp. increasing) from n = 1 if y 0 ∈ (-√ 3, 0) (resp. y 0 ∈ (0, √ 3)) and thus converges to -1 (resp. 1). The case where y 0 = 0 is trivial since g(0) = 0 and if y 0 = ± √ 3, then y 1 = 0. Even though it is well known that the Newton-Raphson method converges quadratically, in our case it can be deduced directly from:

|g(y n ) -| |y n -| 2 = |y n /2 + | -→ n→+∞ 3/2 for y n -→ n→+∞ ∈ {-1, 1}.
Following Lemma 4.2.1, if we assume a certain bound on the coefficients of x in (4.1.1), one can compute a scaling factor s > 0 such that:

- √ 3 < s n i=0 α i y i K (x i , x) + β < √ 3 (4.2.7)
to ensure the convergence of the sign function in (4.1.1) without changing the final result.

Leakage of information

Ideally, the server that homomorphically evaluates the SVM would return nothing but the encrypted sign of y in order to avoid leaking any information about its model. The encoding procedure of Cheon et al. [START_REF] Hee Cheon | Homomorphic Encryption for Arithmetic of Approximate Numbers[END_REF] allows to encrypt up to n = ϕ(m) complex values per plaintext, which permits, as described in Section 4.2, to perform approximated computations on complex values efficiently. However since the sign of these values is not encoded in a specific bit or slot it cannot be extracted directly. As a consequence, we choose to use the iterative Newton-Raphson method described in section 4.2.4, so that after t iterations one will obtain y t = g t (y 0 ) which will be close to ±1 depending on the sign of y. However, since y t will not be exactly ±1 we analyse in this section how much information about y 0 is leaked with this approach.

Direct approach

One can see from Figure 15 that g maps [-1, 1] to [-1, 1] with a one-to-one correspondence. Hence, assuming that the result y is computed with enough precision, a malicious client could invert g on [-1, 1], and thus retrieve y 1 by applying the inverse of g t -1 times. Since y 0 can belong to either [0, 1)

(resp. (-1, 0]) or [1, √ 3) (resp. (- √ 3, - 1
]), the client will only have to choose between two possible values for y 0 . Moreover, since the initial values y 0 closer to 0 or ± √ 3 converge more slowly to ±1, these values are easier to distinguish from the others. A straightforward way to prevent the inversion of the method would be to perform the computations with a lower precision, by choosing a smaller scaling factor ∆ for the encoding (cf. Equation 4.1.8). Although this precision is in practice the key point to know whether or not a malicious client can invert the process to retrieve the original value y 0 , reducing it would result in a service of lower quality. Indeed, the wrong sign value would possibly be computed for |y| < 2 -p , and as a consequence the corresponding input x would be interpreted as belonging to the wrong class. Therefore, this approach should not be considered as a viable solution.

Since the convergence to ±1 is quadratic, we can assume that after t iterations the values close enough to ±1 loose t 2 bits of precision. Thus if the values are encoded with 53 bits of precision, which corresponds to double precision for a floating point representation, running t = 7 or 8 iterations would be enough to prevent a malicious client to invert the process for values of y 0 not too close to 0 or ± √ 3.

Randomised approach

One way to prevent a malicious client from retrieving the initial values would be to return a "random" value of the same sign as the real output. However, this is hardly achievable since the server does not know the sign of y. Nevertheless, it is possible to slightly randomise the previous approach so that it will be harder for a malicious client to invert the process. Indeed, one can choose to add a random noise ε i uniform in [0, 2 -i-1 ] at the i th iteration of the previous method so that: 15), we can add to g(y) a value of the same sign and with an absolute value smaller than √ 3 -1 without changing the sign of the output. However, in order to avoid slowing down the convergence of values close to ±1, we need to be sure that y i+1 = g(y i ) remains far enough from ± √ 3, so that g(y i+1 ) remains far enough from 0. Hence, we have chosen the ε i s smaller than 1/2 i , which seems to be a good trade-off experimentally. Note that, because ε i → 0, the method still converges to ±1.

y i+1 = g(y i ) + ε i+1 g(y i ) = g(y i ) with ε i+1 $ ← 0, 2 -i-1 (4.2.8) since, for any y ∈ [- √ 3, √ 3], g(y) ∈ [-1, 1] (cf. Figure
The benefits of this approach are twofold: first, the output is now randomized and the extra-computations to perform this randomisation bring extra errors resulting in additional loss of precision; second, the sequence moves away from 0 faster and thus the range of values getting close to ±1 after t iterations slightly increases. Moreover, the values close to 0 or ± √ 3 are more sensitive to the perturbations brought by the ε i s, which makes them harder to distinguish from the other values and to be retrieved from y t .

Even if it was assumed that computations were performed with an infinite precision, i.e. the ideal case for a malicious client, it would be harder to retrieve the initial values with randomisation than with the regular method. While a malicious client could perform multiple requests for the same x in order to deduce the average value y t whose distribution he knows. In this case, since the values can be greater than 1 at each iteration step, he would have to determine at each inversion step whether the previous value was smaller or larger than 1 in absolute value, because there is no longer a one-to-one correspondence. As a consequence, by randomising the output one can use a smaller amount of iterations than for the regular case.

Practical Considerations

In practice, performing one iteration of the previous methods consumes 2 levels of multiplicative depth. Even though choosing parameters for a large multiplicative depth results in a significant loss of performance, iterating a larger number of times leads to a smaller leakage of information. The service provider has therefore to deal with a trade-off between the efficiency of his service and how much data is leaked. We have seen that for a precision of 53 bits, 7 or 8 iterations of the non-randomised sign determination method, and so also of the randomised one, should ensure the privacy of almost all the ys. However, in practice one can choose a smaller number of iterations, especially if using the randomised method, without significantly affecting the leakage of information.

Figures 16 illustrates the convergence of the two methods for different numbers of iterations, and also presents the standard deviation of the values computed with the randomised method. Herein, we have chosen to use 4 iterations of the randomised method for the SVM classification requiring therefore 8 additional levels of multiplicative depth.

Overall system

When considering a linear kernel in the context of (4.1.1), classification boils down to: y = sign ( w, x + β) (4.2.9)

where w = n i=0 α i y i x i . In this case, if the number of features h is smaller than ϕ(m)/2, w, x + β can be computed with a single homomorphic multiplication, followed by log 2 h permutations and additions. Afterwards, the sign of the result is approximated.

For the polynomial and sigmoid functions, the γx i are precomputed, and the values of γx i , x are computed for ϕ(m)/2 log 2 h +1 support-vectors at a time using batching with the approach described in Section 4.2.2. Then, ρ is added to the results. A similar reasoning can be followed when applying the RBF kernel, namely by adding the results of the coefficientwise product x jx i, j x jx i, j with Algorithm 20. Afterwards, the function x d , tanh(x) or e -γx is applied for the polynomial, sigmoid or RBF kernel, respectively, with the techniques proposed in Section 4.2.3. The constants α i y i are multiplied by the result of K (x, x i ), and the results are added with the binary addition tree proposed in Section 4.2.2. Finally, the bias term β is added to the intermediate result, and the sign approximation function is applied.

Even though batching is used, the server will only be interested in returning the result of one slot to the client, since, if no care is taken, the remaining slots might contain sensitive information. Hence when applying the sign evaluation technique, multiplicative constants should be encoded in a single slot (e.g. (3, 0, . . . , 0)), so that information in the other slots is removed. This prevents further information from being disclosed other than the y class.

Implementation details

In this section, we propose algorithms for implementing the presented techniques on parallel systems. In particular, we will assume the nomenclature and the parallel computing model of OpenCL.

OpenCL parallel computing model

The OpenCL computing model considers a host connected to one or multiple compute devices [START_REF] Stone | OpenCL: A Parallel Programming Standard for Heterogeneous Computing Systems[END_REF]. These compute devices may be Central Processing Units (CPUs), Graphics Processor Units (GPUs), among others. The compute device is composed of multiple compute units -which may be Streaming Processors (SPs) in NVIDIA GPUs, or cores in CPUs -which are further divided into processing elements -corresponding for instance to CUDA cores in NVIDIA GPUs or Single Instruction Multiple Data (SIMD) channels in CPUs.

A compute device is programmed using a C-like language. Functions signaled as kernels correspond to entry-points to the code execution. A kernel is replicated thousands of times and executed in parallel in the compute device. Each of these instances, designated a work-item, has a unique identifier, enabling them to access and process different data from one another. Moreover, and up to the extent allowed by the compute device, work-items may be grouped into work-groups. Whereas it is possible to synchronise work-items in the same work-group, the same thing is not possible for work-items across different work-groups. Similarly, whereas global memory can be accessed by all work-items, a faster type of memory, designated local memory, can be used to share data at the work-group level.

Architecture design

Cheon et al. have provided a generic implementation of their scheme [START_REF] Cheon | Implementation of hea-an[END_REF] based on the NTL library. The ciphertext modulus q was chosen as a power-of-two for cheap modular reductions. However, this removes the possibility of using the efficient negatively-wrapped NTT, resulting in poor performance. In this work we have chosen to use the RNS representation of coefficients in order to make use of parallel architectures, such as GPUs.

We have chosen q as a product of 62-bit prime numbers in a similar fashion to [AMBG + 16]. This allows us to represent a polynomial a ∈ R q for a q = q 1 ×. . .×q k as a set of polynomials a i ∈ R q i for all 1 ≤ i ≤ k. Furthermore, we apply the negatively-wrapped NTT to polynomials. Due to this representation, polynomial operations are independents in nature and therefore readily parallelizable. More concretely, they leverage two levels of parallelism: the first derives from the independence of the polynomial coefficients, while the second arises from the independence of the RNS channels.

Additionally, negatively-wrapped NTTs need to be applied during relinearisation, modulusswitching and decryption. Since the NTT is the most burdensome operations of homomorphic computations, it is one of main targets for optimisation. Figure 17 shows how its computation is structured. For illustrative purposes, a radix-2 NTT of eight points is considered, when Figure 17: NTT Work Distribution executing on a fictional compute device that allows for work-groups with a maximum of two work-items. The NTT is computed in 3 epochs, where each one of 4 work-items computes a radix-2 butterfly at each epoch. Each butterfly is comprised of a 2-point Discrete Fourier Transform (DFT), followed by a multiplication of one of the outputs by a precomputed power of an 8 th primitive root of unity.

One can see in Figure 17 that in the second epoch, the computation of work-item 0 depends on the output of work-item 2 in the first epoch, and that in the third epoch the computation of work-item 1 depends on the output of work-item 0 in the second epoch. Since it is not possible to synchronize 3 work-items in the considered device (since it has a maximum work-group size of two work-items), one has to execute the first epoch in a different kernel (kernel 1) from the two last epochs (kernel 2). These two kernels are queued sequentially, and whereas for kernel 1 one sets a work-group size of 1 work-item, for kernel 2 one defines a work-group size of 2 work-items. Furthermore, in the latter kernel, a synchronization point is added to each epoch, and local memory is used for faster accesses.

The example above is generalizable to r-radix NTTs of n points, wherein the initial epochs are executed on independent kernels, until the number of dependencies is confined to a number of work-items smaller or equal to the maximal work-group size supported by the compute device, and from then on computation is limited to the compute device. This technique minimizes the number of synchronizations between the host and the compute device, and generally contributes significantly to the total execution time.

Global strategy

We make use of the relinearization and key-switching procedures proposed in Chapter 2 which are optimised for RNS representations. During the modulus-switching procedure, the ciphertexts are scaled downed to a smaller ring. For a ciphertext whose elements are contained in R q for q = q 1 × . . . × q k , we scale them down to the ring R q with q = q 1 × . . . × q k-1 . This

Experimental results

In this section, we experimentally evaluate the proposed methods, and compare them with state of the art. The characteristics of the considered platforms can be found in Table 12. We mostly use the GTX 980 as an archetype of the kind of parallel platforms that can be found in High Performance Computing (HPC) servers to compare different methods; use the GTX 680 to analyse the scalability of the proposed techniques across different NVIDIA micro-architectures; and use the i7-5960X for a sequential reference implementation.

Polynomial evaluation

The method proposed in [START_REF] Paterson | On the Number of Nonscalar Multiplications Necessary to Evaluate Polynomials[END_REF] achieves the minimum number of nonscalar multiplications for polynomial evaluation. Since this type of multiplication is considerably more expensive than scalar multiplications, [START_REF] Paterson | On the Number of Nonscalar Multiplications Necessary to Evaluate Polynomials[END_REF] is a good candidate for the homomorphic evaluation of polynomials. Both the method described in Section 4.2.3 and the one described in [START_REF] Paterson | On the Number of Nonscalar Multiplications Necessary to Evaluate Polynomials[END_REF] were implemented in an NVIDIA GTX 980 GPU exploiting HE. When implementing [START_REF] Paterson | On the Number of Nonscalar Multiplications Necessary to Evaluate Polynomials[END_REF] to evaluate a polynomial of degree d, m 1 was chosen to be the largest integer dividing d +1 and smaller than √ d + 1. Furthermore, m 2 was defined as m 2 = d+1 m 1 . Initially, the first m 1 powers of the input x are computed by repeated multiplication. Afterwards, the d + 1 coefficients of the polynomial are split into m 2 polynomials each of degree m 1 -1:

p(x) = d i=0 p i x i = m 2 -1 i=0 m 1 -1 j=0 p im 1 +j x j x m 1 i = m 2 -1 i=0 g i (x)z i (4.4.1)
where g i (x) = m 1 -1 j=0 p im 1 +j x j and z = x m 1 . The polynomials g i were evaluated with m 1 -1 scalar multiplications, since the values of x, . . . , x m 1 -1 had been previously computed. The computation of p was finalised using Horner's method with m 2 -1 non-scalar multiplications.

The efficiency of the two evaluation approaches was tested for polynomials of degree d ∈ {4, 8, 16, 32, 64} with the coefficients uniformly sampled from the [-1, 1] interval, and the results were reported in Table 13. As the multiplicative depths of the methods gets larger, larger values of q need to be used, so that the scheme can cope with the extra noise generated by the homomorphic multiplications. This leads to a need of increasing the value of m that defines the underlying cyclotomic ring, so as to ensure security. The performance of the polynomial evaluation methods is severely degraded as these two parameters increase. Even though [START_REF] Paterson | On the Number of Nonscalar Multiplications Necessary to Evaluate Polynomials[END_REF] aims at minimising the number of non-scalar multiplications, by using Table 13: Efficiency of Homomorphic Polynomial Evaluation more efficient scalar multiplications, its multiplicative depth increases at a faster pace than the proposed method, leading to the poor scalability of [START_REF] Paterson | On the Number of Nonscalar Multiplications Necessary to Evaluate Polynomials[END_REF], as it is clearly observable in Table 13. In addition, [START_REF] Paterson | On the Number of Nonscalar Multiplications Necessary to Evaluate Polynomials[END_REF] performs worst when d +1 is prime, since this will lead to m 1 = 1 and m 2 = d + 1, contributing to larger multiplicative depths.

Sign evaluation

The efficiency of the proposed sign evaluation method, when compared to that of [START_REF] Gizem S Cetin | Arithmetic Using Word-Wise Homomorphic Encryption[END_REF] was similarly assessed in an NVIDIA GTX 980, and the results were reported in Table 14. When using the method proposed in [START_REF] Gizem S Cetin | Arithmetic Using Word-Wise Homomorphic Encryption[END_REF], the sign of an input x is approximated by a sum of sine functions which are approximated by polynomials: sign(x) ≈ 1 0.8

β j=1 α i=1
(-1) j-1 (2i -1) 2j-2 (2 j -1)! x 2j-1 (4.4.2)

The polynomial described in (4.4.2) was evaluated with the method proposed in Section 4.2.3. Random values in the [-1, 1] interval were generated and the mean and the standard deviation of the absolute value of the results were computed for several iterations of the two proposed methods, and for different values of β and α = 16 for the method in [CDSM15] (α does not influence the execution time and, as long as it is sufficiently large, it does not significantly change the accuracy of the result). The parameters m and q were selected to be in the same order of magnitude for both approaches. Ideally, one should achieve a mean absolute value of '1' and a small standard deviation. Since the approximation in (4.4.2) converges slowly, one needs large values of β to achieve significant numeric results. The difference in convergence rates is highlighted in Figures 18a and18b. Since the proposed methods offer a better approximation in the whole domain, while [START_REF] Gizem S Cetin | Arithmetic Using Word-Wise Homomorphic Encryption[END_REF] focus on optimising the approximation around the origin, one needs a larger degree for the latter method to cover a more significant interval which negatively affects its performance. Finally, one can see that the randomisation mechanisms, used to reduce information leakage, impose a small overhead, on average 11%; while at the same time improving both the mean and the standard deviation due to a faster convergence of the values close to 0.

Global procedure

The LIBSVM library [START_REF] Chang | LIBSVM: A library for support vector machines[END_REF] was used to train models for the Statlog Australian Credit Card Approval dataset [Fan], the Connectionist Bench (Sonar, Mines vs. Rocks) dataset [Fan], the Pima Indian Diabetes dataset [Fan] and the Statlog Heart Data Set [Fan] with the characteristic described in Table 15. Whereas with the previous experimental results we were concerned with comparing the performance of the proposed methods with those of related art, in Table 17 we present, for the first time, the performance of homomorphically performing an SVM classification. We have chosen a standard deviation σ err = 6.0 for the error distribution, the secret key has been chosen with 64 non-zero coefficients sampled uniformly in {±1}, and the level of security λ achieved by our parameters was computed using the online estimator provided by [START_REF] Albrecht | On the concrete hardness of Learning with Errors[END_REF]. We also present the size of the keys (relinearization and key-switching) the client has to upload to the server before starting the protocol together with the size of the ciphertexts. Remember that we are in an amortised model, so the client has only to provision the keys once for a long period during which he can perform several requests. We assess the efficiency of the OpenCL implementation on two generations of NVIDIA GPUs, in order to evaluate its scalability, and compare it with a reference C++ sequential implementation on an Intel i7-5960X. The sign function in (4.1.1) was evaluated by iterating the method proposed in Section 4.2.5 4 times. The sigmoid and exponential functions in (4.1.4) and (4.1.5) were approximated by polynomials presented in Table 16 The accuracy achieved during the homomorphic test was exactly the same as that achieved with unencrypted values, leading to the conclusion that the errors introduced by the approximate arithmetic of [START_REF] Hee Cheon | Homomorphic Encryption for Arithmetic of Approximate Numbers[END_REF] and our polynomial approximations are not significant. Finally, an average speedup of 2.70 is obtained when comparing the parallel GTX 980 implementation with the sequential i7-5960X. This is made possible by the exploitation of the RNS, which makes the computation of the several work-items uniform and hence more suitable to implementation on GPUs. The improvement in performance that is obtained when comparing the execution on the GTX 980 to that of GTX 680 shows that the developed OpenCL system is very scalable with respect to the number of available processing elements, since the GTX 980 has 2048 CUDA cores, while the GTX 680 has 1536 CUDA cores; and also that it is capable of taking advantage of the reduced latency of the integer arithmetic of the Maxwell micro-architecture in comparison to the Kepler micro-architecture. In [START_REF] Graepel | ML Confidential: Machine Learning on Encrypted Data[END_REF], the Linear Means (LM) and Fisher's Linear Discriminant (FLD) classifiers were considered. Both methods compute the most likely class y based on the input vector of features x as follows:

Dataset

y = sign ( w, x + β) (4.4.3)
where w is learned during the training phase. However, in [START_REF] Graepel | ML Confidential: Machine Learning on Encrypted Data[END_REF], the computation of the sign function is deferred until after decryption. Doing so would not be acceptable in our setting, because it might lead to a larger information leak. Homomorphic classifications take up to 6 seconds with the LM classifier on data with 30 features, and up to 20 seconds with the FLD classifier on data with 10 features, on an i7 processor running at 2.8GHz with 8GB of main memory. In the context of [START_REF] Graepel | ML Confidential: Machine Learning on Encrypted Data[END_REF], the model is assumed to be private to the client, and hence w is only available in encrypted form to the server. The inner-product w, x needs to be computed with nonscalar multiplications, degrading somewhat the computational performance when compared to the setting considered in this paper. A second source for the poor performance of [START_REF] Graepel | ML Confidential: Machine Learning on Encrypted Data[END_REF] is related with the chosen number representation. Instead of making use of the canonical embedding to represent real values as in [START_REF] Hee Cheon | Homomorphic Encryption for Arithmetic of Approximate Numbers[END_REF], rational values are scaled by a common factor so that they can be represented as integers, and are afterwards mapped to a ring R t : z = sign(z)(z s , z s-1 , . . . , z 1 , z 0 ) 2 → m z = sign(z)(z 0 + z 1 x + . . . + z s x s ) (4.4.4) where (z s , z s-1 , . . . , z 1 , z 0 ) 2 corresponds to the binary representation of |z|. Homomorphic multiplications and additions respectively multiply and add polynomials in R t , and the result is evaluated at x = 2 to obtain back the corresponding integer. One needs to select a large enough cyclotomic ring R and a large modulus t, which results in a small multiplicative depth, to ensure that no wrap-around happens. This leads to a significant degradation of performance -although not directly comparable, our reference sequential implementation of classification with an SVM and a linear kernel takes about 3.32s and includes an approximation to the sign value, while [START_REF] Graepel | ML Confidential: Machine Learning on Encrypted Data[END_REF] takes up to 6s to produce the LM classification, without any approximation of the sign.

Conclusion

With the recent advances in machine learning, data is becoming increasingly more valuable.

When offering classification as a service, companies will be interested in preventing their models' parameters from being disclosed, so that no other provider can mimic their services. Clients are also invested in protecting their own sensitive data. In this context, homomorphic encryption offers theoretically an ideal solution.

While SVMs have shown their effectiveness in classifying data in the past, they are challenging to implement homomorphically, since they require both value-wise and bit-wise arithmetic. In this work we have proposed techniques for homomorphic SVM classification improving both value-wise arithmetic, namely by accelerating polynomial evaluation up to 2.72 times, and bit-wise arithmetic, namely by accelerating sign approximation mechanisms up to 6.59 times. The secrecy of the client's data is ensured by the semantic security of the employed HE scheme, while the leakage of the model parameters is reduced through a randomization of the sign-evaluation method.

While the employed plaintext number representation only allowed for approximate arithmetic, we have shown that it does not affect the model's accuracy. Moreover, the possibility to directly encode up to n/2 real values in a single plaintext permit to reach better performances than with the classical batching technique (cf. Section 1.3) where the number of slots available is much smaller than n/2.

Future directions of research to proceed with this work include expanding on techniques to evaluate nontrivial functions homomorphically in an efficient manner but also drastically reducing the size of the different keys needed by the server to process the data.

This work is currently in the process of submission of an international conference.

Conclusion and possible future works

Properties of Homomorphic Encryption could be a major asset for privacy protection in the current numeric era. Gentry's breakthrough in 2009 proved that it was achievable and since then a lot of effort has been devoted to make it practical. Despite considerable improvements since the first construction, homomorphic encryption remained hardly practical at the beginning of this thesis and was still limited by its requirements, either in time or in memory. In this thesis we have focused on enhancing performance of the arithmetic used by such encryption schemes in order to contribute at breaking the performance barrier.

An alternative to the costly bootstrapping procedure of Gentry is to use a Somewhat Homomorphic scheme with parameters large enough to evaluate homomorphically the functions required by a targeted application. In this setting, schemes like BGV require a chain of moduli q 0 < . . . < q L to be able to scale the noise down after each multiplication by switching the ciphertext to a smaller modulus. When evaluating circuits with large multiplicative depth one needs to choose a large chain of moduli and thus use higher dimensions resulting in poor performance. Scale invariant schemes like FV allow to partially overcome this limitation by removing the need of the modulus-switching procedure which potentially results in the possibility of evaluating circuits with a bigger multiplicative depth. However, the complex computations required by the procedures of scale-invariant schemes do not allow to use directly the efficient RNS representation all along the computations which somehow cancels the initial benefit brought by these schemes. Our first contribution has been to overcome the natural limitations of the RNS representation to be able to use it during the entire procedures of scale-invariant schemes like FV ([BEHZ17]). The significant gains we have obtained by avoiding the reconstruction to a positional representation have permitted to reduce the performance gap with schemes like BGV. The methods we have proposed have recently been incorporated in the SEAL library developed by Microsoft Research.

Even though one is able to perform additions and multiplications of plaintext values with homomorphic encryption, the representation of numbers induced by the plaintext space makes the plaintext arithmetic challenging unless encrypting only one bit in each ciphertext. However in this case the ratio between the size of the ciphertext and the size of the plaintext would be huge limiting a little bit more the practicality of homomorphic encryption. The batching technique permits to overcome these difficulties by allowing to pack and process several bits independently in a single plaintext. Sadly this technique is incompatible with the efficient power-of-two cyclotomics and thus one has to consider other rings with a less efficient arithmetic. Our second contribution has been to improve the arithmetic performance in general cyclotomic rings by focusing on the polynomial reduction procedure required in such cases ([BEH + 18]). We have also shown that the impact of our reduction procedures on the noise growth in the BGV and FV schemes could be handled so that it does not affect the multiplicative depth of these schemes. Despite its considerable impact on the noise growth of scale-invariant schemes such as FV, our generic Montgomery reduction is compatible with BGV like schemes and could probably benefit a library such as HElib in the case of non-power-of-two cyclotomics.

In the big data era, machine-learning offers a concrete solution to solve different decisional problems and in particular for the classification of data. Fully homomorphic encryption allows in theory to perform this classification on encrypted data ensuring therefore their privacy. However this kind of computations require to use a threshold function in the end to return the result. In practice, this threshold function is challenging to implement homomorphically, essentially because it requires comparisons which are hardly compatible with homomorphic operations. In a third contribution we have focused on performing the computations required by a Support Vector Machine (SVM) efficiently ( [START_REF] Bajard | Classification of Private Data using Homomorphic Encryption[END_REF]). Besides the evaluation of the threshold function, the methods we have proposed to perform the computations required by SVMs are more efficient than some methods from the related art and can fully exploit the strong parallelization potential of devices such as GPU. The experiments we have run show that we are not so far from practical execution time anymore, however the communication costs, and in particular the size of the keys one needs to send to the server prior starting the classification, are still much too important.

Considering that the construction of Gentry in 2009 was not even implementable, we must admit that homomorphic encryption performance have been considerably improved over the last years. Even though we cannot claim yet it is practical enough for an imminent widespread deployment, this idea is no longer completely unrealistic. Of course there is still a lot of work to be done, for instance one should at least gain an additional level of magnitude in performance before even considering such deployment. Since the cryptographic community is still devoting a lot of efforts in improving performance of homomorphic schemes, it is very likely that homomorphic encryption will reach realistic execution time in the near future. However there are others bottlenecks to consider; starting with the communication costs which are still very high. Even though the size of the ciphertexts is not completely unreasonable, the relinearization key and especially the key-switching keys needed by the entity performing the computations can easily require several Giga Bytes of memory. However this problem starts to be considered and recent work of Halevi and Shoup have shown we could significantly reduce the size of these keys (33%-50%) ( [START_REF] Halevi | Faster Homomorphic Linear Transformations in HElib[END_REF]). However this is probably not sufficient yet and we believe this problem would deserve more attention in the upcoming years. Moreover the recent trend for machine-learning has highlighted once more the difficulties to perform non-trivial computations with homomorphic encryption. Although this problem has already received a lot of attention, the current solutions are not completely satisfactory and would require additional investigations. It is not clear yet, whether or not we will obtain completely generic fully homomorphic encryption, even though big companies like IBM or Microsoft are currently trying to develop efficient and generic libraries for it. However it seems almost certain that we will be able to use efficient homomorphic encryption for several specific applications. As a consequence, identifying these applications and finding efficient ways to perform homomorphically the computations they would require should be a subject of interest for future researches.

Introduction 1 1 Preliminaries 1 . 1 Introduction 1

 11111 Historical context and motivations . . . . . . . . . . . . . . . . . . . . . . . . 2 Contributions and organization of the report . . . . . . . . . . . . . . . . . . . Ring-Learning with Errors problem . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Somewhat Homomorphic Encryption based on Ring-LWE . . . . . . . . . . . 1.3 Classical arithmetic in cyclotomic rings . . . . . . . . . . . . . . . . . . . . . . 2 Full RNS scaled-invariant schemes 2.1 Towards a full RNS decryption . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Towards a full RNS homomorphic multiplication . . . . . . . . . . . . . . . . 2.3 Last step: the relinearization . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 Software implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Polynomial arithmetic in general cyclotomic rings 3.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Improving polynomial reduction modulo Φ m . . . . . . . . . . . . . . . . . . . 3.3 Adaptation of BGV and FV to the Montgomery representation . . . . . . . . 3.4 Experimental results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Homomorphic evaluation of support vector machine 4.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Novel homomorphic techniques for SVM classification . . . . . . . . . . . . . 4.3 Implementation details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v Contexte historique et motivations

  -Learning with Errors problem . . . . . . . . . . . . . . . . . 1.1.1 Cyclotomic polynomials and cyclotomic number fields . . . . . . . . 1.1.2 Lattices and ideal lattices . . . . . . . . . . . . . . . . . . . . . . . . 1.1.3 Theoretical hardness of Ring-Learning With Errors . . . . . . . . . . 1.1.4 Practical considerations . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Somewhat Homomorphic Encryption based on Ring-LWE . . . . 1.2.1 Brakerski-Gentry-Vaikuntanathan . . . . . . . . . . . . . . . . . . . 1.2.2 Fan-Vercauteren . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Classical arithmetic in cyclotomic rings . . . . . . . . . . . . . . . 1.3.1 On coefficients: Residue Number System . . . . . . . . . . . . . . . . 1.3.2 On polynomials: Number Theoretic Transform . . . . . . . . . . . . 1.3.3 Splitting cyclotomic polynomials for homomorphic encryption . . . .

  as the product of the (X -ζ m ) where ζ m ranges over all the primitive m-th roots of unity. Definition 1.1.4. Let m ≥ 1 be an integer, the polynomial defined by:

Lemma 1 .

 1 1.6 ([DF04] section 13.6). For any integer m ≥ 1 the m-th cyclotomic polynomial Φ m is monic and has integer coefficients. Theorem 1.1.7 ([DF04] section 13.6). For any integer m ≥ 1 the m-th cyclotomic polynomial Φ m is irreducible over the field of rationals Q. Corollary 1.1.8 ([DF04] section 13.6). Φ m is the minimal polynomial of any primitive m-th root of unity, hence

Lemma 1 . 1 .

 11 14 ([LM06] Lemma 3.2). Let f ∈ Z[X] a monic irreducible polynomial of degree n then for every non-zero element a ∈ Z[X]/(f (X )), the elements a, X • a, . . . , X n-1 • a are linearly independent. As a direct consequence, by identifying Z[ζ m ] to the polynomial ring R = Z[X]/(Φ m (X )), we can see that every non-zero element a in an ideal of Z[ζ m ], generates a shifted basis {a, a • ζ m , . . . , a • ζ n-1 m } of this ideal seen as Z-module. Corollary 1.1.15. Any non-zero ideal I ⊆ Z[ζ m ] is a free Z-module of rank n = ϕ(m).

Definition 1 .

 1 1.22. A basis B of a lattice L is a set of d ≤ n linearly independent vectors {b 1 , . . . , b d } such that any element of L can be written as a linear combination, with integer coefficients, of elements of B. The lattice generated by a basis B is denoted L(B).

Example 1 . 1 .

 11 30. Let us consider the lattice generated by the ideal (1 -ζ 3 ) ⊂ Z[ζ 3 ] through the coefficient and canonical embeddings. Through the coefficient embedding 1 -ζ 3 corresponds to the vector b 1 whose coordinates are (1, -1) ∈ R 2 and ζ 3

  ). Thus (b 1 , b 2 ) form a basis of the lattice generated by 1 -ζ 3 through the canonical embedding.

b 1 b 2 Figure 1 :

 21 Figure 1: Lattice generated by (1 -ζ 3 ) ⊂ Z[ζ 3 ] through the coefficient embedding.

b 1 b 2 Figure 2 :

 22 Figure 2: Lattice generated by (1 -ζ 3 ) ⊂ Z[ζ 3 ] through the canonical embedding.

Definition 1 . 1 .

 11 40. Let L be a lattice of rank d in R n and let B be a basis of L. The volume of the lattice L is defined as det(B T B) where B ∈ M n,d (R) is the matrix whose columns are formed by the elements of B. When L is full-rank, it corresponds to | det(B)|. Remark 1.1.41. Two bases being related by a unimodular transformation, the determinant of a lattice does not depend on the chosen basis. It measures the volume of the d-dimensional polytope formed by the vectors of a basis. Definition 1.1.42. For a lattice L of rank d, the root-Hermite factor γ B associated to a basis B is defined as b 1 = γ d B det(L) 1/d where b 1 is the shortest vector of B.

  [START_REF] Shenoy | Fast Base Extension Using a Redundant Modulus in RNS[END_REF], Shenoy and Kumaresan proposed a method to retrieve α(a q ) directly in RNS by introducing an extra modulus in the initial basis. More precisely, let B = {b 1 , . . . , b k } and B be two RNS bases used to represent elements of R and b sk a modulus coprime to the productB = b 1 • • • b k . Letus assume that we want to convert exactly the residues of a ∈ R from basis B to the basis B , if we know the residue of a modulo b sk before the conversion, i.e. if we have the residues of a in B sk = B ∪ {b sk } then we can compute |α(a B )| b sk by inverting equation (1.3.3): |α(a B )| b sk = B -1 (PartialInv(a B ) -|a| b sk ) b sk (1.3.5) Since α(a B ) ∈ [0, k) ∩Z, if we choose b sk coprime to B and such that b sk ≥ k then |α(a B )| b sk = α(a B ) which means that we are able to correct the error and perform an exact conversion from B to B at the price of some extra-computations.

Figure 3 :

 3 Figure 3: Summary of the different representations used for the arithmetic of R q

.b sk 2 α x+µB + µ b sk -1 2

 2 It remains to show that [α (x+µB) + µ] b sk = α x+µB + µ or, in other words, that: -But by hypothesis on b sk , and because 1, we can write b sk 2( + λ ) 2 λ + 1. Then,

  .3.5) Proof. At this point, we are evaluating Relin RNS ( ct mult + b). We denote ct mult = (c 0 , c 1 , c 2 ) and b = (b 0 , b 1 , b 2

Figure 5 :

 5 Figure5: Example of noise growth, for n = 2 13 , log 2 (q) = 390 (ν = 30, k = 13), t = 2, σ err = 8, B key = 1 (dashed line: theoretical bound, using (2.4.1); plain line: measurements).

Figure 6 :Figure 7 :

 67 Figure 6: Decryption time (t = 2 10 ), with ν = 30 (plain lines) and ν = 62 (dashed lines).

Figure 6

 6 Figure 6 presents timings for Dec MP , Dec RNS and Dec RNS-flp , and Fig. 7 depicts timings for Mult MP and Mult RNS . Both figures gather data for two modulus sizes: ν = 30 and ν = 62. Relinearization in Mult MP uses a decomposition in radix-base ω = 2 32 when ν = 30, and ω = 2 62 when ν = 62. The auxiliary bases B sk and B involved in Mult RNS and Mult MP contain k + 1 moduli each. Multiplication timing for (n, ν, k) = (2 11 , 62, 1) is not given since L = 1 already causes decryption failures. The contributions appear in the speed-ups between RNS and MP variants.

Contents 3 . 1

 31 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.1 Barrett's reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 About the choice of the cyclotomic . . . . . . . . . . . . . . . . . . . 3.2 Improving polynomial reduction modulo Φ m . . . . . . . . . . . . 3.2.1 Barrett's reduction for cyclotomic polynomials . . . . . . . . . . . . 3.2.2 NTT-based Montgomery's reduction . . . . . . . . . . . . . . . . . . 3.3 Adaptation of BGV and FV to the Montgomery representation 3.3.1 Impact of the Montgomery representation in BGV . . . . . . . . . . . 3.3.2 Impact of the Montgomery representation in FV . . . . . . . . . . . . 3.3.3 Overall impact on noise growth . . . . . . . . . . . . . . . . . . . . . 3.3.4 About the expansion factor . . . . . . . . . . . . . . . . . . . . . . . 3.4 Experimental results . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.1 Polynomial reduction . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.2 Impact on homomorphic multiplication . . . . . . . . . . . . . . . . 3.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  [START_REF] Gentry | Homomorphic Evaluation of the AES Circuit[END_REF],[START_REF] Lyubashevsky | A Toolkit for Ring-LWE Cryptography[END_REF],[START_REF] Lepoint | A comparison of the homomorphic encryption schemes fv and yashe[END_REF],[START_REF] Smart | Fully homomorphic SIMD operations[END_REF], ...), they remain very much unused because, in part, of its less convenient arithmetic. Yet, in [LPR13], Lyubashevsky et al. have shown how to handle general Ring-LWE instantiations, whether it concerns the associated arithmetic or the error sampling. Their approach relies on the tensored representation of cyclotomic fields (K m = r i=1 K m i where m = m 1 • • • m r is the prime power decomposition of m), which allow them to evaluate efficiently (in time O(n log(n))) the canonical embedding (cf. Section 1.1.

Figure 8 :

 8 Figure 8: Amortized cost of the arithmetic for cyclotomics of index 1000 ≤ m ≤ 100000

Figure 9 :

 9 Figure 9: NTT-based Montgomery reduction

  m

FVFigure 11 :

 11 Figure11: Execution time T (µs) for the multiplication plus relinearization of BGV and FV with several reduction strategies (plus modulus switching for BGV) on the m-th cyclotomic polynomial. Modulus q is a product of 62-bit prime moduli and y-axis is in logarithmic scale.

FV

Figure 12 :

 12 Figure 12: Execution time per slot T/ (µs) for the multiplication plus relinearization of BGV and FV

Figure 13 :

 13 Figure 13: Mapping an input vector of features x and h support-vectors x i onto the plaintext space

Figure 15 :

 15 Figure 15: Variations of the function g One can see that g([-1, 0]) = [-1, 0] (resp. g([0, 1]) = [0, 1]) and that g([-√ 3, 1]) = [-1, 0] (resp. g([1, √ 3]) = [0, 1]). Therefore if y 0 ∈ [-√ 3, √3], all the y i s, for i ≥ 1, will belong to [-1, 1]. The function g is increasing on [-1, 1], thus the sequence defined by y n+1 = g(y n ) and

Figure 16 :

 16 Figure 16: Output of regular and randomised methods run on plaintext values for 3, 4 and 5 iterations. Values of the randomised method correspond to an average over 2 12 tests.

α

  = 16, β = 4 α = 16, β = 16 α = 16, β = 32 α = 16, β = 64

Figure 18 :

 18 Figure18: Comparison of the convergence rates of (a) the sign approximation method proposed herein and (b) that of[START_REF] Gizem S Cetin | Arithmetic Using Word-Wise Homomorphic Encryption[END_REF]

Table 3 :

 3 Parameters for RNS variants, using the moduli of NFLlib. Value in parenthesis correspond to the multiplicative depth for the non-RNS variant.

	2 12	2 2 10	2 8	6	5 (5) 4 (4)	11 4	21 27	13 13	3	4 (4) 3 (3)	5 5	19 28	7 7
	2 13	2 2 10	2 8	13	13 (13) 9 (9)	1/3 9	15 30	46 27	6	11 (11) 8 (8)	1 6	17 29	20 33
	2 14	2 2 10	2 8	26	25 (25) 19 (19)	1/2 1	17 27	53 53	12	23 (23) 17 (17)	1/3 3	16 29	27 34
	2 15	2 2 10	2 16	53	50 (50) 1/12 38 (38) 1/2	17 27	351 107	25	47 (47) 37 (37) 1/10 1/2	18 26	83 255

  4 to 2) for cryptographic parameters ensuring 80-bit of security. This work has recently been incorporated by Microsoft Research in the version 2.3 of SEAL, their C++ library implementing FV ([CHH + 17]). More recently in [HPS18], Halevi

	n	ν	k variant	Decryption (ms) Speed-up Multiplication (ms) Speed-up
				MP	1.153	-	13.809	-
		30 3	RNS-flp RNS	0.192 0.189	6.005 6.101	-3.159	-4.371
	2 11			RNS-AVX2	0.188	6.133	2.710	5.096
				MP	1.020	-	-	-
		62 1	RNS-flp	0.054	18.880	-	-
				RNS	0.050	20.390	-	-
				MP	4.587	-	45.055	-
		30 6	RNS-flp RNS	0.798 0.789	5.748 5.814	-15.614	-2.886
	2 12			RNS-AVX2	0.775	5.919	13.737	3.280
				MP	3.473	-	28.168	-
		62 3	RNS-flp	0.339	10.245	-	-
				RNS	0.326	10.653	7.688	3.664
				MP	16.051	-	218.103	-
		30		RNS-flp RNS	3.732 3.691	4.301 4.349	-100.625	-2.167
	2 13			RNS-AVX2	3.637	4.413	88.589	2.462
				MP	10.945	-	92.093	-
		62 6	RNS-flp	1.552	7.052	-	-
				RNS	1.513	7.234	37.738	2.440
				MP	70.154	-	1, 249.400	-
		30		RNS-flp RNS	17.497 17.333	4.009 4.047	-622.596	-2.007
	2 14			RNS-AVX2	16.818	4.171	617.846	2.022
				MP	38.910	-	424.014	-
		62		RNS-flp	6.702	5.806	-	-
				RNS	6.494	5.992	206.511	2.053
				MP	364.379	-	8, 396.080	-
		30		RNS-flp RNS	85.165 81.225	4.279 4.486	-4, 923.220	-1.705
	2 15			RNS-AVX2	72.665	5.015	5, 063.920	1.658
				MP	180.848	-	2, 680.535	-
		62		RNS-flp	33.310	5.429	-	-
				RNS	31.895	5.670	1, 406.960	1.905

Table 4 :

 4 Timing results. et al. proposed another version of this work in which they have chosen to correct the overflows due to base conversions by computing it with double precision floating-point arithmetic resulting in the same noise growth as the original version.

  1 irreducible factors modulo 2. Proof. Lemma 1.3.3 states that the number of irreducible factors of Φ m modulo 2 is given by = n/d where n = ϕ(m) and d is the order of 2 modulo m. It is not hard to see that the order of 2 modulo each p i is o i = 2l i , and since Z/mZ splits in the cartesian product of the F p i through the CRT we know that 2 has order lcm(o 1 , . . . , o s ) modulo m. Moreover o 1 | o 2 | • • • | o s therefore 2 has order o s modulo m and so = n/o s

Table 6 :

 6 Theoretical speed-up of Alg. 19 when compared with Alg. 17

	m	3855 4369 13107 21845 32767 65535
	n	2048 4096	8192	16384 27000 32768
	Speed-up	2.62	2.62	2.63	2.63	2.63	2.63

Table 7 :

 7 Theoretical depths with and without Montgomery reduction. Values in parenthesis are the depths observed in practice.

Table 8 :

 8 table presents the values of σ max obtained for the different cyclotomics considered in this chapter together with the bound δ p for p = 50. Finally we indicate in the Table below the multiplicative depths obtained for FV with these bounds. It appears that these bounds are still around twice smaller than what is observed in practice, however they are twice larger than the worst-case bounds. Of course to get these bounds we were forced to make Bounds, with faillure probability smaller than 2 -50 , on the expansion factor for different cyclotomic polynomials with the associated multiplicative depths for FV.several approximations (distributions of the a i / a ∞ , independence of the δ i s), thus one could legitimate wonder how reliable our results are. We have run some experiments to check whether our model was far from the reality or not.We present hereafter the results of these experiments for two of the considered cyclotomics.

	m	σ max	δ 50	L max L M max
	4369	122.32	1114	2	2
	13107 410.32	3734	9	7
	21845 1313.88 12088	21	15
	32767 3471.06 32281	33	21
	65535 7004.65 65143	39	26

Table 9 :

 9 Relative errors between the theoretical values and the one observed in practice (in average and in the worst case) for different cyclotomic polynomials.

Table 10 :

 10 Timings (ms) of our different reduction algorithms for the m-th cyclotomic polynomial on a single 62-bit modulus. Values in parenthesis are the speed-up when compared to Alg. 17. Execution time T (ms) (resp. per batching slot T/ (µs)) for multiple reduction strategies for cyclotomic polynomials of index m on a single 62-bit modulus.

		3, 855	4, 369	13, 107	21, 845	32, 767	65, 535
	Alg. 17	0.351	0.763	1.660	3.543	7.907	7.941
	Alg. 18 0.183 (1.92) 0.392 (1.95) 0.927 (1.79) 1.967 (1.8) 5.189 (1.52) 4.976 (1.6)
	Alg. 19 0.138 (2.54) 0.301 (2.53) 0.650 (2.55) 1.402 (2.53) 3.167 (2.5) 3.178 (2.5)

  to 1.33. Detailed timings can be found in Table11.

		10	BGV
				10 6
	(µs)	10	(µs)	10 5
	T		T
		10
				10 4
		10
			4369 13107 21845 32767 65535	4369 13107 21845 32767 65535
			m	m
			NTT with NWC (NFLlib)	NTT with NWC (NFLlib)
			Barrett (Alg. 17)	Barrett (Alg. 17)
			Optimized Barrett (Alg. 18)	Optimized Barrett (Alg. 18)
			Montgomery (Alg. 19)	Opt. Barrett/Montgomery(Alg. 18 and 19)

Table 11 :

 11 Timings (ms) of homomorphic multiplication plus relinearization for BGV and FV encryption schemes (plus modulus switching for BGV) on the m-th cyclotomic polynomial. Values in parenthesis correspond to the speed-up compared to Alg. 17.

Table 12 :

 12 Experimental Setup

	Platform	Micro-architecture	Nbr. of threads/ Frequency Main Memory CUDA cores (MHz) (GB)
	NVIDIA GTX 980	Maxwell	2048	1126	4
	NVIDIA GTX 680	Kepler	1536	1006	2
	Intel i7-5960X	Haswell	16	3000	32

Table 14 :

 14 Efficiency of Homomorphic Sign Evaluation

	Method	# of its/ Mult. β Depth	m	log 2 q	Mean of Abs. Value	Std. Dev. of Execution Abs. Value Time (s)
	Regular	2	4	2 15	372	0.73	0.30	0.076
	Regular	4	8	2 15	620	0.87	0.24	0.32
	Regular	8	16	2 16 1116	0.98	0.12	3.31
	Noisy	2	4	2 15	372	0.85	0.32	0.089
	Noisy	4	8	2 15	620	0.94	0.21	0.35
	Noisy	8	16	2 16 1116	0.99	0.10	3.54
	[CDSM15]	4	5	2 15	434	69957	128272	0.29
	[CDSM15]	16	8	2 15	620	5.64×10 7	1.55×10 8	0.75
	[CDSM15]	32	9	2 15	682	543	3066	4.64
	[CDSM15]	64	11	2 16	806	0.97	0.45	23.33

Table 15 :

 15 Datasets to Test Private SVM Classification

Table 16 :

 16 . Polynomials of degree 18, computed with Remez algorithm, used for approximating tanh and e -γ on the interval [-a, a] with γ = 0.00048828100000000002.

		Coefficients
	index	x → tanh(x)	x → e -γx
		a = 0.51225306238208002	a = 115
	0	1.4009642707414478e-17	1.0000000000000002
	1	0.99999999999995082	-0.00048828100000000192
	2	-2.1227219660455179e-14 1.1920916748065294e-07
	3	-0.33333333332155596	-1.9402523836879882e-11
	4	1.9300123814730566e-12	2.3684705729457643e-15
	5	0.1333333325110871	-2.3129124018455077e-19
	6	-6.5224256206901339e-11 1.9064448146349986e-23
	7	-0.053968227901277463	-4.4241699170007713e-27
	8	1.1171625055134562e-09 -7.4394009787886375e-29
	9	0.021869040479270206	9.4733594535281552e-31
	10	-1.0923689311744991e-08 1.2314188912818555e-32
	11	-0.0088586960556909129 -1.5386535912138098e-34
	12	6.3527986719020514e-08 -1.1349649205298355e-36
	13	0.0035641099208678808	1.3779247892196034e-38
	14	-2.170761532109173e-07	5.6034063188191365e-41
	15	-0.0013512032562647397 -6.4143854972872915e-43
	16	4.0192953621050575e-07 -1.2528959902659904e-45
	17	0.00036617202103725164	1.2116502342840465e-47
	18	-3.108838239985658e-07	6.3734555982768629e-51

Table 17 :

 17 Performance of the Proposed Homomorphic SVM Classification

	dataset	kernel	mult. depth	m	log 2 q	λ (bits) / ct (MB) keys (GB) accuracy platform (%)	exec. time (s)
							0.43		GTX 980	1.14
	Australian (4.1.2)	9	2 15	682	80	/	86.32	GTX 680	2.80
							3		i7-5960X	3.32
							1.71		GTX 980	13.28
	Sonar	(4.1.3)	13	2 16	930	100	/	89.58	GTX 680	8.68
							8		i7-5960X	25.73
							2.47		GTX 980	21.14
	Diabetes	(4.1.4)	16	2 16 1116	89	/	76.79	GTX 680	51.17
							9		i7-5960X	64.33
							2.47		GTX 980	21.42
	Heart	(4.1.5)	16	2 16 1116	89	/	81.43	GTX 680	52.11
							9		i7-5960X	66.08

La cryptanalyse de manière opposée, a pour but de récupérer des informations à partir d'une communication protégée afin de corrompre l'une, ou plusieurs, des quatre propriétés précédentes et ce sans avoir nécessairement connaissance de la clé.Historiquement la cryptographie avait surtout pour but d'assurer la confidentialité des messages, les autres propriétés sont essentiellement apparues avec la cryptographie moderne et sont d'autant plus importantes de nos jours avec l'internet. La confidentialité d'un message est assurée en utilisant une clé, afin de le rendre inintelligible à toute personne ne connaissant pas la clé. On parle alors de messages chiffré.En cas de guerre, il est essentiel de s'assurer qu'un message intercepté demeure inintelligible pour l'adversaire. C'est pourquoi historiquement les innovations en matière de chiffrement et de cryptanalyse sont principalement apparues au cours de différents conflits. Parmi les chiffrements célèbres nous pouvons citer la scytale utilisée par les Spartiates lors de la guerre du Péloponnèse, ou encore le chiffrement de César utilisé par les Romains lors de la guerre des Gaules.Plus récemment, lors des deux grands conflits du XX ème siècle, la cryptologie eut une importance décisive. En 1917, les renseignements Britanniques ont intercepté et déchiffré

https://github.com/CryptoExperts/FV-NFLlib

https://heat-project.eu/

Remerciements

by introducing the error r a , like in (1.2.19), due to the rounding:

We obtain:

(2.2.6)

Below we give some useful bounds:

Next, by bounding each term of (2.2.6) with (1.2.6), (1.2.17), (1.2.18) and (1.2.19) and by putting all the pieces together we obtain:

which concludes the proof.

Going back to q

Lemma 2.2.3 states that we have got back DR 2 (ct ) + b in B sk so far, where we have denoted

To be able to perform future computations modulo q, we need to convert it back in basis q. However, the conversion has to be exact because extra multiples of B = b 1 . . . b cannot be tolerated this time otherwise the noise would blow-up. The extra modulus b sk allows us to perform a complete Shenoy and Kumaresan like conversion described in the next lemma. It is stated for a more general context where the input can be either positive or negative, and can be larger, in absolute value, than B.

Lemma 2.2.5. Let B be an RNS base and b sk be a modulus coprime to B = b ∈B b. Let x be an integer such that |x| < λ B (for some real number λ 1) and whose residues are given By definition of c i , we can write:

(3.3.5) Moreover, since δ i ∞ q j t 2q l , we get the following bound:

Thus, from the above and by considering the hypothesis on the norm of [c 0 + c 1 • s] q j , we deduce that:

and then that

Hence, from this previous equality and by bounding the norm of last member of (3.3.5), we obtain (3.3.4). Finally, we get (3.3.3) by:

From this lemma, we can see that the Montgomery representation of the ciphertext impacts the modulus switching procedure by the addition of an extra factor δ R M -1 ∞ to the last term on the bound of the hypothesis and of (3.3.4) compared to those given in Section 1.2.1. We will discuss the sizes of δ R and M -1 ∞ in the next sections.

Impact of the Montgomery representation in FV

We recall that the first step of the FV homomorphic multiplication corresponds to the extension of ciphertexts to a larger RNS basis, so that coefficients of the product are not reduced modulo q. In order to improve efficiency, an approximate extension is used which introduces an important noise growth which has to be reduced through Algorithm 15, in the end the norm of the polynomials is bounded by q 2 (1 + ρ) for a parameter ρ > 0 (cf. Lemma 2.2.1). Once the ciphertexts to multiply, given in Montgomery representation, have their residues in both bases, the product and the scaling are performed resulting in the degree 2 ciphertext given below:

q and ct = (c 0 , c 1 ) ∈ R 2 q two ciphertexts with inherent noise v and v respectively and ct mult = ( c 0 , c 1 , c 2 ) be the degree 2 ciphertext given in equation (3.3.6). By denoting

we have:

with the following bound on the noise:

Proof. First notice that similarly to equation (1.2.16), any valid ciphertext ct = ( c 0 , c 1 ) ∈ R 2 q in Montgomery representation satisfies:

Thus when multiplying two valid ciphertexts ct = ( c 0 , c 1 ) and ct = ( c 0 , c 1 ), in Montgomery representation, encrypted under the key we obtain:

We recall the following useful equalities:

Concerning the expansion factor δ R , when m is a power of two, it is equal to n but for other m it can be much larger (even super polynomial in m [START_REF] Erdös | On the coefficients of the cyclotomic polynomial[END_REF]). We can derive an upper bound on the expansion factor for the m-th cyclotomic by considering

Since F m is a linear map between two vector spaces of finite dimension it is continuous, then we obtain

These two parameters, are given in Table 7 for the different cyclotomic polynomials considered in this chapter. From now, we assume that the key distribution χ key and the error distribution χ err output elements whose infinity norms are bounded by B key and B err = 6σ err respectively.

BGV

Similarly to Section 1.2.1, if the two level i ciphertexts have a noise whose norm is bounded by V (V < q 0 /2t ), we can show that the level i -1 ≥ 0 ciphertext resulting from the multiplication plus relinearization plus modulus switching procedures has its noise bounded by:

where b relin is the noise caused by the relinearization procedure (cf. Equation (1.2.9)), or its equivalent RNS version (cf. Section 2.3), which remains unchanged with the Montgomery representation, and b

∞ b scale ∞ with b scale the noise caused by the scaling in the original setting (cf. Equation (1.2.4)). Therefore if the parameters are selected such that:

The results were measured by performing 2 13 products of polynomials whose coefficients were sampled uniformly in [-2 -25 , 2 25 ] by using the rand function of the C standard library. The left part of the folllowing graphics presents the values observed on our experiments for each coefficient (maximal and average) while the right part presents the values given by our model (expected values and 2σ i ).

Experimental and theoretical values of |δ i | for the 13107-th cyclotomic on 8192 tests. Table 9 presents some indicators of the differences between the model and our experiments. It contains the average (resp. the biggest) relative error ε a (resp. ε max a ) between the expected value √ 2/πσ i and the values observed in average. It also indicates the average relative error ε m (resp. the smallest relative error ε min m ) between, 2σ i and the maximal value observed. Despite our gross approximations, the results are quite accurate: the expected and average values differ from less than 0.7% in average and less than 3.3% in the worst case, moreover all the values obtained were smaller than 2σ max (around 33% in average and 5% in the closest case). Although further statistical analysis of these results would be required, the first results reduction procedure.

Part of this work was presented in the 24 th Selected Areas of Cryptography (SAC) conference ([BEH + 18]). y (0) y 0 , y 1 , y 2 , y 3 , y 4 , 0, 0, 0, . . . Rotate 2 0 (y (0) ) y 1 , y 2 , y 3 , y 4 , 0, 0, 0, , y 8 , . . . y (1) = y (0) + Rotate 2 0 (y (0) ) y 0 + y 1 , y 1 + y 2 , y 2 + y 3 , y 3 + y 4 , y 4 , 0, 0, y 8 , . . . Rotate 2 1 (y (1) ) y 2 + y 3 , y 3 + y 4 , y 4 , 0, 0, y 8 , y 8 + y 9 , , y 9 + y 10 , . . .

+Rotate 2 1 (y (1) ) The computation of inner products has a central role in the evaluation of kernels. To compute the inner product of h copies of x and h support-vectors, one starts by homomorphically multiplying the two ciphertexts that respectively encode them. Afterwards, a binary addition tree is used to add their values, with Algorithm 20, logSep = 0 and logAmount = log 2 h . In Algorithm 20, the Rotate 2 logSep (y) function rotates the slots of y 2 logSep places in a circular fashion (mapping slot i to |i -2 logSep | n/2 ), and HomAdd homomorphically adds the two ciphertexts. The steps of the Algorithm are illustrated in Figure 14. We pick up the example of Figure 13, for vectors of 5 features and additions of slots for the first 5 elements are illustrated. When the function terminates, the results of the inner products will be located in the slots

After the computation of the inner product, the kernel functions operate on y without performing any rotation, producing a value z. The summation in (4.1.1) will thus require adding the slots k •2 log 2 h , for all 0 ≤ k < h , of z. This can be achieved with Algorithm 20 by setting logSep = log 2 h and logAmount = log 2 n-log 2 h -1. When more than n/2 log 2 h +1 supportvectors are used, z will be spread over several ciphertexts. After applying Algorithm 20 to each of them, their sum is computed homomorphically.

Polynomial evaluation

The homomorphic evaluation of (4.1.3), (4.1.4) and (4.1.5) relies on the evaluation of polynomials. In particular, (4.1.3) can be interpreted as a polynomial with a single nonzero coefficient. Similarly, the functions e -γx and tanh(x) in (4.1.5) and (4.1.4) are approximated by polynomials with Remez' algorithm ([Rem34]). While a truncated Taylor series would procedure can be efficiently computed in the RNS domain. Since the value [a] q k is readily available, the scaling of a ∈ R q can be computed as a-[a] q k q k q . As stated in Section 4.1.3, one should choose ∆ as ∆ q/q . In order to achieve this, we have chosen ∆ as q 1 since q 1 . . . q k . Relinearisation accounts for most of the complexity because it requires k 2 NTT (cf. Section 2.3.4). First, an inverse-NTT is applied to a so that D RNS,q (a) can be computed. Then, a forward-NTT has to be applied to each a q 1 q q 1 , . . . , a q k q q k , so that they can be multiplied by the relinearisation-key. We have reduced the number of times the relinearisation operation was executed, by only applying it at the beginning of the next homomorphic multiplication operation, and by performing homomorphic additions on "non-linear" elements by adding the three corresponding polynomials. In particular, for the homomorphic evaluation of an expression such as x 0 x 1 + x 2 x 3 and denoting by c (x i ,0) , c (x i ,1) ∀i ∈ {0, 1, 2, 3} the "linear" encryption of x i , one would first compute

Afterwards, one would add the two encryptions, producing:

If this result were applied to another homomorphic multiplication, it would require applying a relinearisation operation to bring the number of elements of c x 0 x 1 +x 2 x 3 back to two. Nevertheless, one relinearisation operation was saved in comparison to a straightforward implementation.

Another important aspect with regards to delaying relinearisation is how this strategy interplays with the permutation of the batching slots. During the permutation procedure, key-switching needs to be applied, introducing noise that has the same magnitude as ∆. If this procedure were applied directly to a permuted "linear" ciphertext, the introduced noise could be large enough to change the most-significant bits of the encrypted message. We mitigate this problem with two approaches. When permuting a three-element ciphertext, we first relinearise it but do not apply modulus-switching. In this case, the message has a multiplicative factor of ∆ 2 , and the introduced noise will be small when compared with ∆ 2 . When permuting a two-element ciphertext, we first multiply it by it by an encoding of '1', implicitly changing the multiplicative factor to ∆ 2 , so that the previous reasoning about reducing the impact of the introduced noise is valid. In order to remove the extra ∆ factor, one needs to apply modulus-switching after the key-switching procedure. We do so lazily, following a similar reasoning to the previous one that allowed us to reduce the number of relinearisations: when adding several permuted ciphertexts, we only apply modulus-switching at the end of the sum.

List of publications