International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Pasta: A Case for Hybrid Homomorphic Encryption

Authors:
Christoph Dobraunig , Lamarr Security Research, Graz, Austria
Lorenzo Grassi , Digital Security Group, Radboud University, Nijmegen, Netherlands
Lukas Helminger , IAIK, Graz University of Technology, Graz, Austria; Know-Center GmbH, Graz, Austria
Christian Rechberger , IAIK, Graz University of Technology, Graz, Austria
Markus Schofnegger , IAIK, Graz University of Technology, Graz, Austria
Roman Walch , IAIK, Graz University of Technology, Graz, Austria; Know-Center GmbH, Graz, Austria
Download:
DOI: 10.46586/tches.v2023.i3.30-73
URL: https://tches.iacr.org/index.php/TCHES/article/view/10956
Search ePrint
Search Google
Abstract: The idea of hybrid homomorphic encryption (HHE) is to drastically reduce bandwidth requirements when using homomorphic encryption (HE) at the cost of more expensive computations in the encrypted domain. To this end, various dedicated schemes for symmetric encryption have already been proposed. However, it is still unclear if those ideas are already practically useful, because (1) no cost-benefit analysis was done for use cases and (2) very few implementations are publicly available. We address this situation in several ways. We build an open-source benchmarking r framework, we explore properties of the respective HHE proposals. It turns out that even medium-sized use cases are infeasible, especially when involving integer arithmetic. Next, we propose Pasta, a cipher thoroughly optimized for integer HHE use cases. Pasta is designed to minimize the multiplicative depth, while also leveraging the structure of two state-of-the-art integer HE schemes (BFV and BGV) to minimize the homomorphic evaluation latency. Using our new benchmarking environment, we extensively evaluate Pasta in SEAL and HElib and compare its properties to 8 existing ciphers in two use cases. Our evaluations show that Pasta outperforms its competitors for HHE both in terms of homomorphic evaluation time and noise consumption, showing its efficiency for applications in real-world HE use cases. Concretely, Pasta outperforms Agrasta by a factor of up to 82, Masta by a factor of up to 6 and Hera up to a factor of 11 when applied to the two use cases.
BibTeX
@article{tches-2023-33282,
  title={Pasta: A Case for Hybrid Homomorphic Encryption},
  journal={IACR Transactions on Cryptographic Hardware and Embedded Systems},
  publisher={Ruhr-Universität Bochum},
  volume={2023, Issue 3},
  pages={30-73},
  url={https://tches.iacr.org/index.php/TCHES/article/view/10956},
  doi={10.46586/tches.v2023.i3.30-73},
  author={Christoph Dobraunig and Lorenzo Grassi and Lukas Helminger and Christian Rechberger and Markus Schofnegger and Roman Walch},
  year=2023
}