Fully Homomorphic Encryption: Overview and Cryptanalysis

Scheme. Gentry starts with a definition of an abstract scheme using rings and ideals, omitting instantiation details at first. His scheme is as follows (additional remarks appear after the description): KeyGen(R,BI). On input a ring R and the basis BI of an ideal I, this randomised algorithm generates via (Bsk J , B pk J ) ←R IdealGen(R,BI) two bases for an ideal J and outputs the public key pk = (R,BI , B pk J ,Samp) and secret key sk = (pk,B sk J ). Encrypt(pk, π). On input a public key pk and a plaintext π, this algorithm generates ψ∗ ← Samp(BI , π) and outputs ψ := ψ∗ mod B J . Decrypt(sk, ψ). On input a secret key sk and a ciphertext ψ, this algorithm outputs π := ψ mod Bsk J mod BI = ψ −Bsk J · ⌊ Bsk J · ψ ⌉ mod BI . Evaluate(pk, C,Ψ). On input a public key pk, a circuit C with t inputs (of some special set C of “allowed” circuits) and a set of t ciphertexts Ψ = (ψ1, . . . , ψt), this algorithm invokes the evaluation of the embedded additions (ψi + ψj) mod B pk J and multiplications (ψi · ψj) mod B J in the circuit C in the right order to obtain a ciphertext ψ which it outputs. Remarks. 1. The plaintext space is (a subset of) R mod BI . 2. The (randomised) algorithms IdealGen and Samp remain abstract, but – roughly speaking – IdealGen(R,BI) constructs a secret and public basis for an ideal J coprime to the input ideal I and Samp(BI , x) samples the coset x+ I.