JP7096214B2 - Concealment calculation device, concealment calculation method and concealment calculation program - Google Patents

Description

The present invention relates to a secret calculation device, a secret calculation method, and a secret calculation program that perform calculations on a ciphertext.

Conventionally, a secret calculation method has been proposed in which plaintext is calculated while being encrypted.
For example, in Non-Patent Document 1, when the input integer is not converted into a bit value, that is, the plaintext remains an integer value (hereinafter referred to as Integra-wise), it is encrypted by fully homomorphic encryption. A method of performing a binary comparison operation on an encrypted text has been proposed.

In order to perform such a binary comparison operation or the like, an algorithm for determining the sign of the value is required, and in the method of Non-Patent Document 1, the output of the Heaviside step function [H (x) = 1 (x ≧). Polynomial interpolation is used to obtain 0), 0 (x <0)].
Further, in Non-Patent Document 2, as the activation function of the neural network on the cipher, the sign function [sign (x) = 1 (x> 0), -1 (X ≦ 0)] has been proposed.

H. Narumanchi, D.M. Goyal, N.M. Emmadi, and P.M. Gauravaram. Performance Analysis of Sorting of FHE Data: Integer-Wise Comparison vs Bit-Wise Comparison. In 2017 IEEE 31st International Conference on Advanced Information Networking and Applications (AINA), pages 902-908, March 2017. Florian Bourse, Michele Minelli, Matthias Minihold, and Pascal Paillier. Fast homomorphic assessment of deep discretized neural networks. In Hovav Shacham and Alexandra Boldyreva, editors, Advances in Cryptography-CRYPTO 2018, pages 483-512. Springer, 2018.

The calculation of the Heaviside step function in Non-Patent Document 1 is a method based on polynomial interpolation and requires a lot of multiplications, so that the calculation cost is high. Specifically, for example, when the bit length of plaintext is 1 bit and p = 2 ^l , the operation of the polynomial f (x) = c ₀ + c ₁ x + ... + c _p-1 x ^p-1 is encrypted. Since it is performed on the sentence, the depth of multiplication is O (log p) = O (l), and the total number of multiplications is O (p) = O (2 ^l ) and exponentially according to the bit length l. To increase.
Therefore, when executing the secret calculation of the binary comparison operation, it is necessary to perform a large number of boot strappings in order to withstand the increase in noise due to the multiplication, and it also takes a lot of time to execute the boot strapping.

Further, in the method of Non-Patent Document 2, since the sign function can be calculated at the same time as bootstrapping, cost reduction can be expected, but the output is 1 or -1 depending on the sign.
However, for example, in an algorithm or the like that sorts according to the result of a binary comparison operation, it is necessary to express the magnitude as 1 or 0. Therefore, it is necessary to convert the output ciphertext _Cy (-1 or 1) as [ _Cy ′ ← ( _Cy +1) / 2]. However, since this conversion includes the multiplication of constants on the ciphertext, the calculation cost and noise are increased.

An object of the present invention is to provide a secret calculation device, a secret calculation method, and a secret calculation program capable of calculating a Heaviside step function on a ciphertext at low cost.

The concealment calculation device according to the present invention includes a first constant indicating the plain text of the output value, and an initial setting unit for setting a second constant obtained by converting the first constant into a value on the torus and then halving it. , A sample conversion unit that converts an LWE sample on a torus of input values into a sample on an integer, a polynomial definition unit that defines a polynomial with the second constant as a coefficient, and a first secret key of the LWE cipher statement. The polynomial updater that updates the LWE cipher of the polynomial to initialize the noise and the LWE cipher of the constant term of the polynomial by the quasi-homogeneous operation using the bootstrapping key, which is a cipher with plain text. After extraction, the constant term extraction unit for acquiring the LWE cipher using the first constant or the second secret key of 0 by shifting by the second constant, and the LWE cipher using the second secret key. A key conversion unit for converting a sentence into an LWE encrypted sentence using the first private key is provided.

The concealment calculation device has an input unit that accepts the input of the ciphers of the first value and the second value, and the cipher of the second value by subtracting the cipher of the second value from the cipher of the first value. By using the subtraction unit that calculates the cipher of the difference value and the cipher of the difference as the input value, the cipher of 1 or the cipher of 0, which is the output value, is the result of the binary comparison operation. It may be provided with a comparison result output unit which outputs as.

The secret calculation device multiplies the result of the binary comparison operation by the ciphertext of the difference value, and adds the ciphertext of the second value to obtain the first value and the second value. The first sorting unit that calculates the ciphertext of the larger value, the ciphertext of the second value is added to the ciphertext of the first value, and the ciphertext of the larger value is subtracted. By doing so, a second rearrangement unit for calculating the ciphertext of the smaller value of the first value and the second value may be provided.

The concealment calculation method according to the present invention includes an initial setting step of setting a first constant indicating the plain text of the output value and a second constant obtained by converting the first constant into a value on the torus and then halving it. , A sample conversion step that converts an LWE sample on a torus of input values into a sample on an integer, a polynomial definition step that defines a polynomial with the second constant as a coefficient, and a first secret key of the LWE cipher. The polynomial update step of updating the LWE cipher of the polynomial to initialize the noise and the LWE cipher of the constant term of the polynomial by the quasi-isomorphic operation using the bootstrapping key, which is a cipher with plain text. After extraction, the constant term extraction step of acquiring the LWE cipher using the first constant or the second secret key of 0 by shifting by the second constant, and the LWE cipher using the second secret key. The computer executes a key conversion step of converting the statement into an LWE cipher statement using the first private key.

The secret calculation program according to the present invention is for operating a computer as the secret calculation device.

According to the present invention, the Heaviside step function can be calculated on the ciphertext at low cost.

It is a block diagram which shows the functional structure of the secret calculation apparatus in embodiment. It is a figure which shows the algorithm for executing the secret calculation method of embodiment. It is a figure which shows the algorithm of the key conversion processing used for the secret calculation method of embodiment. It is a figure which shows the algorithm of the binary comparison operation in an embodiment. It is a figure which shows the algorithm of the sort operation in an embodiment.

Hereinafter, an example of the embodiment of the present invention will be described.
The concealment computing device in the present embodiment realizes the operation of the Heaviside step function at the same time as the bootstrapping required by the fully homomorphic encryption.
Full homomorphic encryption is configured by combining Somehat type homomorphic encryption with bootstrapping. Here, the Somehat type homomorphic encryption is a method in which noise on the ciphertext becomes large due to repeated operations, and decryption becomes impossible when the size becomes a certain level. The fully homomorphic encryption is a Somehat type homomorphic encryption that can be subjected to an unlimited number of operations by performing a noise removal process called bootstrapping.

FIG. 1 is a block diagram showing a functional configuration of the secret calculation device 1 in the present embodiment.
The secret calculation device 1 is an information processing device (computer) such as a server device or a personal computer, and includes a control unit 10 and a storage unit 20, as well as various data input / output devices and communication devices.

The control unit 10 is a part that controls the entire secret calculation device 1, and realizes each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for various programs (secret calculation program) for making the hardware group function as the secret calculation device 1 and various data, and is a ROM, RAM, flash memory, hard disk drive (HDD), or the like. It may be there.

The control unit 10 includes an initial setting unit 101, a sample conversion unit 102, a polynomial definition unit 103, a polynomial update unit 104, a constant term extraction unit 105, a key conversion unit 106, an input unit 107, and a subtraction unit 108. A comparison result output unit 109, a first rearrangement unit 110, and a second rearrangement unit 111 are provided.

The initial setting unit 101 converts the first constant (1 which is the output of the Heaviside step function) indicating the plain text of the output value, and the second constant which is converted into the value on the torus (μ described later) and halves it. Set a constant (μ'= μ / 2 described later).

The sample conversion unit 102 converts the LWE sample on the torus of the input value into the sample on the integer.

The polynomial definition unit 103 defines a polynomial (testv described later) having a second constant μ'initially set as a coefficient.

The polynomial update unit 104 updates the LWE ciphertext of the polynomial and initializes the noise by a quasi-homogeneous operation using a bootstrapping key, which is a ciphertext in which the first secret key of the LWE ciphertext is a plaintext.

The constant term extraction unit 105 extracts the LWE cipher statement of the constant term of the polynomial updated by the polynomial update unit 104, and then shifts by the second constant μ'to obtain the first constant (= 1) or 0. Obtain the LWE cipher statement with the second private key of.

The key conversion unit 106 converts the LWE ciphertext using the second secret key acquired by the constant term extraction unit 105 into the LWE ciphertext using the first secret key.

The input unit 107 accepts the input of the ciphertexts of the first value and the second value for which the magnitude comparison is performed.

The subtraction unit 108 calculates the ciphertext of the difference value by subtracting the ciphertext of the second value from the ciphertext of the first value received by the input unit 107.

The comparison result output unit 109 uses the ciphertext of the difference value as the input value of the sample conversion unit 102, so that the ciphertext of 1 or the ciphertext of 0, which is the output value of the snakeside step function, is subjected to a binary comparison operation. Is output as a result of.

The first sorting unit 110 multiplies the result of the binary comparison operation by the ciphertext of the difference value and adds the ciphertext of the second value, so that the larger of the first value and the second value is obtained. Calculate the ciphertext of the one value.

The second sorting unit 111 adds the ciphertext of the second value to the ciphertext of the first value, and subtracts the ciphertext of the larger value calculated by the first sorting unit 110. Therefore, the ciphertext of the smaller value of the first value and the second value is calculated.

Next, the details of the algorithm will be described with respect to the secret calculation method executed by the secret calculation device 1.

[Definition]
Various definitions in the confidential calculation method of the present embodiment follow the following document A.
References A: Ilaria Chilotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene. Faster full homomorphic encryption: Bootstrapping in less than 0.1 seconds. In Jung Hee Chain and Tsuyoshi Takagi, editors, Advances in Cryptography-ASIACRYPT 2016, pages 3-33, 2016.

Here, the explanation is supplemented as follows.
The i-th element of the vector x of length n is expressed as x _i (x = (x ₁ , ..., X _n )).
Various spaces are described as follows.
-Integer space: Z, real space: R
・ Torus T = R / Z
・ Polynomial:
R [X]: Set of polynomials of arbitrary degree with coefficient ∈ R _TN [X]: = R [X] / (X ^N +1): Set of polynomials of degree N with coefficient ∈ T Also, x ← ^U χ means to sample x uniformly and randomly from the set χ.

を満たす。ここで、ノイズｅは、一般的にガウス分布に従い、パラメータα（エラー率、ｂＴ上においてはノイズの標準偏差となる）を持つ。 The TLWE cipher and the TGSW cipher are defined in Document A and are extensions of the LWE cipher and the GSW cipher, respectively.
For the TLWE cipher, the LWE sample (a, b) ∈ LWE _s (m) of the secret vector s, plaintext m, and noise e is

Meet. Here, the noise e generally follows a Gaussian distribution and has a parameter α (error rate, which is the standard deviation of noise on bT).

となる。
この「秘密鍵の暗号文」ＢＫ_ｉを用いることで、暗号文上の準同型演算により復号に当たる演算を行える。これにより、ブートストラッピングでは、入力の平文と同じ平文を持ち、かつ、ノイズの大きさが初期化された暗号文が生成される。 For the bootstrapping key BK _{s → s ”, α} = (BK ₁ ,…, BK _n ), each BK _i is a TGSW ciphertext of the secret key s _i of the TLWE ciphertext by the secret key s”. .. Here, the TGSW ciphertext can perform homomorphic operations with the TLWE ciphertext.

Will be.
By using this "ciphertext of private key" BK _i , it is possible to perform an operation corresponding to decryption by a homomorphic operation on the ciphertext. As a result, in bootstrapping, a ciphertext having the same plaintext as the input plaintext and with the noise level initialized is generated.

[Plaintext space settings]
In the method of Document A described above, the plaintext space of the ciphertext is limited to the bit value. In this embodiment, this method is extended so that it can handle integer values as well.

Let B be an integer and m ∈ {-B, ..., 0, ..., B} be plaintext. At this time, the structure of the LWE ciphertext is as follows (see Non-Patent Document 2).

を満たす条件の下、復号において，２Ｂ＋１倍しｒｏｕｎｄすることで元の値に戻る。なぜならば、

であるが、式（１）を満たす時、｜ｅ・（２Ｂ＋１）｜＜１／２となり、「（ｂ－＜ｓ，ａ＞）・（２Ｂ＋１）」＝ｍが得られるからである。
また、秘密鍵ｓによる、平文ｍのＬＷＥ暗号文Ｅｎｃ（ｓ，ｍ）＝（ａ，ｂ）を、ＬＷＥ_ｓ（ｍ）とも表記する。 The plaintext of m ∈ [-B, B] is converted to the value of m / (2B + 1) ∈ T in the ciphertext. Here, the noise e is

Under the condition that the condition is satisfied, in decoding, the original value is returned by multiplying by 2B + 1 and rounding. because,

However, when the equation (1) is satisfied, | e · (2B + 1) | <1/2, and "(b− <s, a>) · (2B + 1)" = m is obtained.
Further, the LWE ciphertext Enc (s, m) = (a, b) of the plaintext m by the private key s is also expressed as LWE _s (m).

[algorithm]
FIG. 2 is a diagram showing an algorithm for executing the secret calculation method of the present embodiment.
This algorithm executes the Heaviside step function at the same time as bootstrapping.

In step 1, the initial setting unit 101 sets a constant m _set indicating the plaintext (integer value) of the output ciphertext. Specifically, by setting m _set = 1, the Heaviside step function is realized.
Here, the constant μ ∈ T is obtained by converting m _set into a value on T in order to input it into the LWE ciphertext on the torus T, as described above. Further, the initial setting unit 101 sets a constant μ'= μ / 2 that determines the output of the ciphertext.

In step 2, the sample conversion unit 102 rounds the LWE sample (a, b) ∈ T ⁿ × T on the torus T = R / Z by multiplying it by 2N, so that the sample on an integer (a￣, b￣) ) ∈ Z _2N ⁿ × Convert to Z _2N .

In step 3, the polynomial definition unit 103 defines the polynomial testv ∈ _TN [X].

In step 4, the polynomial updater 104 calculates ACC, which is a TLWE ciphertext in which the polynomial X ^b￣ · testv ∈ _TN [X] is encrypted, as an intermediate product.

のＴＬＷＥ暗号文にＡＣＣを更新する。
よって、ループ処理を終えた時点で、ＡＣＣは、

のＴＬＷＥ暗号文となる。また，ＡＣＣ：＝（ａ”，ｂ”）∈Ｔ_Ｎ［Ｘ］×Ｔ_Ｎ［Ｘ］と表記する。 In the loop processing of steps 5 to 7, the polynomial update unit 104 updates the TLWE ciphertext ACC of the polynomial by a homomorphic operation.
Here, each BK _i is a TGSW ciphertext in which the plaintext is the secret key s _i of the TLWE ciphertext by the secret key s. Therefore, the polynomial update unit 104 performs a quasi-isomorphic operation between the TGSW ciphertext and the TLWE ciphertext ACC.

Update ACC to the TLWE ciphertext of.
Therefore, when the loop processing is completed, the ACC

It becomes the TLWE ciphertext of. Further, it is expressed as ACC: = (a ", b") ∈ _TN [X] × _TN [X].

となっている。ｅ_ＡＣＣは、ステップ５～７のループ処理で生じるｒｏｕｎｄｉｎｇノイズ（丸め誤差）の和である。実装においては、トーラス上のＬＷＥサンプル（ａ，ｂ）∈Ｔ^ｎ×Ｔのａ，ｂは（１／２Ｎ）の倍数を用いるため、この丸め誤差は０となり無視できる（ξ_ｉ＝０，ｉ＝０，…，ｎ）。
以下では、ｅ_ＡＣＣ＝０とする。よって、

となる。 here,

It has become. e _ACC is the sum of the rounding noises (rounding errors) generated in the loop processing of steps 5 to 7. In the implementation, since a and b of the LWE sample (a, b) ∈ T ⁿ × T on the torus use a multiple of (1 / 2N), this rounding error is 0 and can be ignored (ξ _i = 0, i =). 0, ..., n).
In the following, e _ACC = 0. Therefore,

Will be.

であり、また、式（１）の下界より、

であることから、

となる。つまり、

であることから、

の定数項は、常にμ’となる。 Then, when 1 ≦ m ≦ B, from the upper bound of the equation (1),

And from the lower world of equation (1)

Because it is

Will be. in short,

Because it is

The constant term of is always μ'.

が得られ、

であることから、

の定数項は、常に－μ’となる。
なお、Ｔ_Ｎ［Ｘ］：＝Ｒ［Ｘ］／（Ｘ^Ｎ＋１）であり、Ｘ^Ｎ＋１≡０、Ｘ^Ｎ≡－１であることから、Ｘ^－ｉ≡－Ｘ^Ｎ－ｉである。 Similarly, when −B ≦ m ≦ 0, the same applies.

Is obtained,

Because it is

The constant term of is always -μ'.
Since _TN [X]: = R [X] / (X ^N +1) and X ^N +1 ≡ 0 and X ^N ≡ -1, it is X ⁻ⁱ ≡ −X ^N−i .

となる。よって、ｕ：＝（０，μ’）＋ＳａｍｐｌｅＥｘｔｒａｃｔ（ＡＣＣ）について、

となる。 In step 8, the constant term extraction unit 105 extracts the LWE ciphertext of the constant term from the TLWE ciphertext ACC of the polynomial.
(A', b'): = SimpleExtract (ACC), a'∈ T ^N is the coefficient sequence vector of the polynomial a "∈ _TN [X], and b'∈ T is the polynomial b" ∈ _TN [ Only the constant term of [X] is extracted. Here, (a ”, b”) ∈ _TN [X] × _TN [X] is the ACC after the loop processing in steps 5 to 7.

Will be. Therefore, regarding u: = (0, μ') + SimpleExtract (ACC),

Will be.

In step 9, the key conversion unit 106 converts u, which is the LWE ciphertext with the secret key s', into the LWE ciphertext with the secret key s by operating the keySwitch using the keyswitching key KS _{s'→ s, γ} . ..
FIG. 3 is a diagram showing an algorithm of the key conversion process used in the confidential calculation method of the present embodiment.
The key conversion process (KeySwitch) is the same as that shown in Document A.

_In this way, the concealment calculation device 1 executes the snakeside step function at the same time as boot strapping, and if 1 ≤ _min ≤ B, m _set (=) for the input constant min ciphertext. If the ciphertext of 1) is _−B ≦ min ≦ 0, the ciphertext of 0 is output.

[Bivalue comparison operation]
The secret calculation device 1 can further execute a binary comparison operation by using the Heaviside step function executed at the same time as the bootstrapping described above.

FIG. 4 is a diagram showing an algorithm for binary comparison operation in the present embodiment.
In this algorithm, the ciphertexts C _a and C _b whose plaintexts are the integers a, b ∈ {1, ..., B} are input, and the ciphertext C _{(a> b)} of 0 or 1 is the result of binary comparison. It is output.

In step 11, the subtraction unit 108 subtracts the ciphertext C _b of the second value _b from the ciphertext C a of the first value a received by the input unit 107, and the ciphertext C _a-b of the difference value: = C _a -C _b is calculated.

In step 12, the comparison result output unit 109 inputs the ciphertext C _a of the difference value and executes the algorithm of the snakeside step function H at the same time as the boot strapping described above (FIG. 2), thereby a>. When b, the ciphertext of 1 (m _set ) is calculated, and when a ≦ b, the ciphertext of 0 is calculated as the result of the binary comparison operation C _{(a> b)} : = CMP (C _a , C _b ).

In step 13, the comparison result output unit 109 outputs the result C _{(a> b)} of the binary comparison operation.

[Sort operation]
The secret calculation device 1 can further execute a binary sort operation by using the above-mentioned binary comparison operation.
At this time, the result of the binary comparison operation needs to be 0 or 1.

FIG. 5 is a diagram showing an algorithm for sorting operations in the present embodiment.
In this algorithm, the result of the binary comparison operation C _{(a> b)} , the binary ciphertexts C _a and C _b , and the difference value ciphertext C _ab are input, and the smaller value C _small and the larger one are input. The value of C _range is output.

In step 21, the first sorting unit 110 multiplies the result C _{(a> b)} of the binary comparison operation by the ciphertext C _ab of the binary difference value, and the cipher of the second value b. By adding the sentence C _b , the _ciphertext C range of the larger value of the binary values a and b is calculated.

In step 22, the second sorting unit 111 adds the ciphertext C _b of the second value _b to the ciphertext C a of the first value a, and subtracts the ciphertext C _rage of the larger value. Thereby, the ciphertext C _small of the smaller value of the binary values a and b is calculated.

In step 23, the control unit 10 outputs C _small and C _rage as a result of binomial sorting.

According to the present embodiment, the concealment calculation device 1 realizes a Heaviside step function that outputs a ciphertext of 0 or 1 depending on the sign of the input value in the boot strapping operation.
As a result, the secret calculation device 1 can calculate the Heaviside step function on the ciphertext at low cost. In addition, the output ciphertext has noise already initialized, and arbitrary processing using the Heaviside step function can be executed without any inconvenience.

Further, the secret calculation device 1 can execute a binary comparison operation with an output of 0 or 1 on the ciphertext at low cost by using the Heaviside step function at the same time as the boot strapping.

Further, the secret calculation device 1 can execute the binary sorting operation on the ciphertext at low cost by using the binary comparison operation having an output of 0 or 1.
By repeating this binary sorting operation, the secret calculation device 1 can realize a secret sort operation, a secret max function operation, and the like on the ciphertext at low cost.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely a list of the most suitable effects resulting from the present invention, and the effects according to the present invention are not limited to those described in the embodiments.

The secret calculation method by the secret calculation device 1 is realized by software. When realized by software, the programs that make up this software are installed in the information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

1 Concealed calculation device 10 Control unit 20 Storage unit 101 Initial setting unit 102 Sample conversion unit 103 Polynomial definition unit 104 Polynomial update unit 105 Constant term extraction unit 106 Key conversion unit 107 Input unit 108 Subtraction unit 109 Comparison result output unit 110 First Sorting section 111 Second sorting section

Claims (5)

With the initial setting unit that sets the first constant as the plaintext corresponding to the ciphertext that is the result of the binary comparison operation , and the second constant that is further halved after converting the first constant to the value on the torus. ,
An input unit that accepts the input of the ciphertexts of the first value and the second value, and
A subtraction unit that calculates a ciphertext of a difference value by subtracting the ciphertext of the second value from the ciphertext of the first value, and a subtraction unit.
A sample conversion unit that converts an LWE sample on the torus of the ciphertext of the difference value into a sample on an integer,
A polynomial definition unit that defines a polynomial with the second constant as a coefficient, and
A polynomial updater that updates the LWE ciphertext of the polynomial and initializes noise by a quasi-isomorphic operation using a bootstrapping key, which is a ciphertext with the first secret key of the LWE ciphertext as plaintext.
After extracting the LWE cipher of the constant term of the polynomial updated by the polynomial update unit, the LWE cipher by the first constant or the second secret key of 0 is obtained by shifting by the second constant. The constant term extractor to be acquired and
A key conversion unit that converts the LWE ciphertext using the second private key into the LWE ciphertext using the first private key,
A secret calculation device including a comparison result output unit that outputs an LWE ciphertext using the first secret key as a result of the binary comparison operation . The secret calculation device according to claim 1, wherein the first constant is 1 . By multiplying the result of the binary comparison operation by the ciphertext of the difference value and adding the ciphertext of the second value, the larger value of the first value and the second value is obtained. The first sorting part that calculates the ciphertext,
By adding the ciphertext of the second value to the ciphertext of the first value and subtracting the ciphertext of the larger value, the smaller of the first value and the second value is obtained. The secret calculation device according to claim 2, further comprising a second sorting unit for calculating a ciphertext of the value of. The computer
The initial setting unit sets the first constant as the plaintext corresponding to the ciphertext that is the result of the binary comparison operation , and the second constant that is further halved after converting the first constant to the value on the torus. And
The input unit accepts the input of the ciphertexts of the first value and the second value, respectively.
The subtraction unit calculates the ciphertext of the difference value by subtracting the ciphertext of the second value from the ciphertext of the first value.
The sample conversion unit converts the LWE sample on the torus of the ciphertext of the difference value into the sample on the integer.
The polynomial definition unit defines a polynomial with the second constant as a coefficient.
The polynomial updater updates the LWE ciphertext of the polynomial and initializes the noise by quasi-homogeneous operation using the bootstrapping key, which is a ciphertext with the first secret key of the LWE ciphertext as plaintext.
The constant term extraction unit extracts the LWE code statement of the constant term of the polynomial updated by the polynomial update unit, and then shifts by the second constant to obtain the first constant or the second secret of 0. Obtain the LWE coded text with the key,
The key conversion unit converts the LWE ciphertext using the second private key into the LWE ciphertext using the first private key.
A secret calculation method in which the comparison result output unit outputs the LWE ciphertext using the first secret key as the result of the binary comparison operation . A secret calculation program for operating a computer as the secret calculation device according to any one of claims 1 to 3.

Images