微软开源SEAL 2.3.1：同态加密库的入门与参数详解
需积分: 10 198 浏览量
更新于2024-07-17
收藏 518KB PDF 举报
标题："sealmanual-2-3-1.pdf"文档详细介绍了微软开发的名为Simple Encrypted Arithmetic Library (SEAL)的开源同态加密库，版本为2.3.1。该库的设计目标是克服传统加密方法的局限性，允许在加密数据上直接执行计算，而无需先解密，这对于云计算场景中的数据隐私保护具有重要意义。同态加密是一种特殊的加密技术，它保持了加密数据在特定运算下的性质，如ElGamal（主要是乘法）和Paillier（主要是加法）等方案就是分别支持乘法和加法的同态性。
描述部分首先阐述了传统加密体系的局限性，它们并不考虑明文和密文空间的代数结构，这意味着在加密状态下无法进行任何直接的计算，除非使用私钥，这在许多场景下被视为潜在漏洞。然而，SEAL通过实现同态加密，突破了这一限制，使得在加密数据上执行计算成为可能，这种特性在云计算环境下尤其有用，可以确保客户数据的隐私，抵御内部恶意员工和外部攻击者的威胁。
具体来说，SEAL支持两种主要的同态类型：一是乘法同态，比如ElGamal加密，它可以将加密后的数值相乘，并得到与明文乘积相同的加密结果；二是加法同态，如Paillier加密，可以执行加密数值的加法操作，其结果仍然保持在加密状态。这两种能力对于处理涉及大量数据的计算任务非常关键，例如在大数据分析、机器学习或区块链应用中，数据可以在不泄露原始信息的情况下进行处理和分析。
文档内容还可能涵盖了SEAL库的安装、配置、核心数据结构、API使用、性能评估以及安全性分析等内容，包括如何设置加密参数，如公钥和密钥对的生成，以及如何利用这些功能进行安全的数据处理。此外，还会解释如何处理密文的加解密过程，以及如何确保在执行同态计算时，数据的隐私和计算结果的安全性。
阅读这份SEAL 2.3.1的手册，开发者可以深入理解同态加密的概念，学习如何在其框架内高效地保护数据隐私并进行安全计算。这份资料不仅适合于研究者，也对希望在实际项目中应用同态加密技术的工程师具有很高的实用价值。
5.3 Multiplication
Consider the Multiply function as described in Section 4.3. The first step that outputs the
intermediate ciphertext (c
0
, c
1
, c
2
) defines a function Evaluator::multiply, and causes the
ciphertext to grow in size. The second step defines a function that we call relinearization, im-
plemented as Evaluator::relinearize, which takes a ciphertext of size 3 and an evaluation
key, and produces a ciphertext of size 2, encrypting the same underlying plaintext. Note that
the ciphertext (c
0
, c
1
, c
2
) can already be decrypted to give the product of the underlying plain-
texts (see Section 5.2), so that in fact the relinearization step is not necessary for correctness
of homomorphic multiplication.
It is possible to repeatedly use a generalized version of the first step of Multiply to produce
even larger ciphertexts if the user has a reason to further avoid relinearization. In particular,
let ct
1
= (c
0
, c
1
, . . . , c
j
) and ct
2
= (d
0
, d
1
, . . . , d
k
) be two SEAL ciphertexts of sizes j + 1 and
k + 1, respectively. Let the ciphertext output by Multiply(ct
1
, ct
2
), which is of size j + k + 1,
be denoted ct
mult
= (C
0
, C
1
, . . . , C
j+k
). The polynomials C
m
∈ R
q
are computed as
C
m
=
"$
t
q
X
r+s=m
c
r
d
s
!'#
q
.
In SEAL the function Multiply means this generalization of the first step of multiplication.
It is implemented as Evaluator::multiply.
5.4 Relinearization
The goal of relinearization is to decrease the size of the ciphertext back to (at least) 2 after
it has been increased by multiplications as was described in Section 5.3. In other words,
given a size k + 1 ciphertext (c
0
, . . . , c
k
) that can be decrypted as was shown in Section 5.2,
relinearization is supposed to produce a ciphertext (c
0
0
, . . . , c
0
k−1
) of size k, or – when applied
repeatedly – of any size at least 2, that can be decrypted using a smaller degree decryption
function to yield the same result. This conversion will require a so-called evaluation key (or
keys) to be given to the evaluator, as we will explain below.
In BFV, suppose we have a size 3 ciphertext (c
0
, c
1
, c
2
) that we want to convert into
a size 2 ciphertext (c
0
0
, c
0
1
) that decrypts to the same result. Suppose we are also given a
pair evk =
[−(as + e) + s
2
]
q
, a
, where a
$
← R
q
, and e ← χ. Now set c
0
0
= c
0
+ evk[0]c
2
,
c
0
1
= c
1
+ evk[1]c
2
, and define the output to be the pair (c
0
0
, c
0
1
). Interpreting this as a size 2
ciphertext and decrypting it yields
c
0
0
+ c
0
1
s = c
0
+ (−(as + e) + s
2
)c
2
+ c
1
s + ac
2
s = c
0
+ c
1
s + c
2
s
2
− ec
2
.
This is almost what is needed, i.e. c
0
+ c
1
s + c
2
s
2
(see Section 5.2), except for the additive
extra term ec
2
. Unfortunately, since c
2
has coefficients up to size q, this extra term will make
the decryption process fail.
Instead we use the classical solution of writing c
2
in terms of some smaller base w (see
e.g. [11, 9, 7, 21]) as c
2
=
P
`
i=0
c
(i)
2
w
i
. Instead of having just one evaluation key (pair) as
above, suppose we have + 1 such pairs constructed as in Section 4.3. Then one can show
that instead setting c
0
0
and c
0
1
as in Section 4.3 successfully replaces the large additive term
that appeared in the naive approach above with a term of size linear in w.
This same idea can be generalized to relinearizing a ciphertext of any size k+1 to size k ≥ 2,
as long as a generalized set of evaluation keys is generated in the EvaluationKeyGen(sk, w)
剩余33页未读，继续阅读
2024-12-15 上传
2024-12-15 上传
2024-12-15 上传
极正常
- 粉丝: 0
- 资源: 1
我的内容管理
展开
最新资源
- 创建个性化的Discord聊天机器人教程
- RequireJS实现单页应用延迟加载模块示例教程
- 基于Java+Applet的聊天系统毕业设计项目
- 从HTML到JSX的转换实战教程
- 轻量级滚动到顶部按钮插件-无广告体验
- 探索皇帝多云的天空：MMP 100网站深度解析
- 掌握JavaScript构造函数与原型链的实战应用
- 用香草JS和测试优先方法开发的剪刀石头布游戏
- SensorTagTool: 实现TI SensorTags数据获取的OS X命令行工具
- Vue模块构建与安装教程
- JavaWeb图片浏览小程序毕业设计教程
- 解决 Browserify require与browserify-shim冲突的方法
- Ventuno外卖下载器扩展程序使用体验
- IIT孟买医院模拟申请webapp功能介绍
- 掌握Create React App: 开发Tic-Tac-Toe游戏
- 实现顺序编程与异步操作的wait.for在HarmonyOS2及JavaScript中
