JP7179788B2 - Secure computing device, secure computing method and secure computing program - Google Patents

Description

The present invention relates to a secure computation device, a secure computation method, and a secure computation program on fully homomorphic encryption.

Conventionally, there have been proposed various methods of concealment operations on ciphertexts. Non-Patent Document 1 proposed TFHE, which is a fully homomorphic scheme, but in this scheme, plaintext is limited to bit values. Non-Patent Document 2 proposes a method that can handle integer plaintext (hereinafter referred to as Integer-wise) and that executes a sign function at the same time as a noise removal process called bootstrapping required for fully homomorphic encryption. It is

Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene. Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds. In Jung Hee Cheon and Tsuyoshi Takagi, editors, Advances in Cryptology - ASIACRYPT 2016, pages 3-33, 2016. Florian Bourse, Michele Minelli, Matthias Minihold, and Pascal Paillier. Fast homomorphic evaluation of deep discretized neural networks. In Hovav Shacham and Alexandra Boldyreva, editors, Advances in Cryptology - CRYPTO 2018, pages 483-512. Springer, 2018.

In Non-Patent Document 2, it is possible to handle integer ciphertexts in TFHE, but only homomorphic addition between integer ciphertexts and sign function operation at the same time as bootstrapping for integer ciphertexts can be performed. , and there was a lack of types of computations that could be performed confidentially.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a secure computation device, a secure computation method, and a secure computation program capable of executing multiplication of an integer and a binary number at the same time as bootstrapping by fully homomorphic encryption.

The secure arithmetic device according to the present invention updates the polynomial LWE ciphertext by homomorphic operation using the bootstrapping key, which is the ciphertext with the secret key of the LWE ciphertext as the plaintext, and initializes the noise. At this time, a bootstrap processing unit that outputs the calculation result of the one-variable function using the values on the torus set for the coefficients of the polynomial, and an input integer of 0 or more and less than B, where B is an odd number, After adding 0 or B, which is a value representing binary 1 or 0, the bootstrap processing unit is set to perform an identity mapping operation as the one-variable function to obtain a first operation result. a first arithmetic unit, after adding the first arithmetic result to the input integer, for the bootstrap processing unit, as the one-variable function, halving an even number and dividing an odd number x by −(x+B); /2 to obtain a second operation result; and an output unit for outputting the second operation result as a multiplication result of the input integer and the input binary number. Prepare.

The confidential operation method according to the present invention updates the polynomial LWE ciphertext by homomorphic operation using the bootstrapping key, which is the ciphertext with the secret key of the LWE ciphertext as the plaintext, and initializes the noise. At that time, a computer equipped with a bootstrap processing unit that outputs the calculation result of the one-variable function using the values on the torus set for the coefficients of the polynomial, when B is an odd number, an input of 0 or more and less than B After adding 0 or B, which is a value representing 1 or 0 of the input binary number, to the integer, the bootstrap processing unit is set to perform an identity mapping operation as the one-variable function, thereby performing a first operation After a first operation step of obtaining a result and adding the first operation result to the input integer, for the bootstrap processing unit, as the one-variable function, even numbers are halved and odd numbers x are a second operation step of setting an operation to -(x+B)/2 to obtain a second operation result; and an output of outputting the second operation result as a multiplication result of the input integer and the input binary number. Execute the step and

A secure computation program according to the present invention is for causing a computer to function as the secure computation device.

According to the present invention, a fully homomorphic encryption scheme performs integer-binary multiplication simultaneously with bootstrapping.

FIG. 2 is a block diagram showing a functional configuration for realizing 1-variable function operation in the secure operation device according to the embodiment; It is a figure which shows the algorithm for performing the confidential operation method of the 1 variable function in embodiment. It is a figure which illustrates the slice of the plaintext space in embodiment. It is a figure which shows the setting method of the value of the 1 variable function in embodiment. It is a figure which shows the algorithm of the key conversion process used for the encryption calculation method in embodiment. It is a block diagram which shows the functional structure of the secure arithmetic unit in embodiment. It is a figure which shows the algorithm of the multiplication of an integer and a binary number in embodiment. FIG. 4 is a diagram showing changes in values on plaintext space accompanying each step that constitutes multiplication in the embodiment;

An example of an embodiment of the present invention will be described below.
In the present embodiment, first, an operation method of an arbitrary one-variable function (mapping) of integer-wise, which is realized simultaneously with the bootstrapping necessary for fully homomorphic encryption, is explained, and then this one-variable function operation is described. A method of secure multiplication of an integer and a binary number realized by using the method will be described.

Fully homomorphic encryption is configured by combining Somewhat-type homomorphic encryption with bootstrapping. Here, Somewhat-type homomorphic encryption is a scheme in which the noise in the ciphertext increases with repeated operations, and when the noise reaches a certain level, decryption becomes impossible. Fully homomorphic encryption is obtained by subjecting Somewhat-type homomorphic encryption to a noise removal process called bootstrapping so that unlimited operations can be executed.

[1-variable function operation]
FIG. 1 is a block diagram showing a functional configuration for realizing a 1-variable function operation in a secure operation device 1 according to this embodiment.
The secure computing device 1 is an information processing device (computer) such as a server device or a personal computer, and includes a control unit 10, a storage unit 20, input/output devices for various data, communication devices, and the like.

The control unit 10 is a part that controls the entire security computing device 1, and implements each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. FIG. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for various programs (encryption operation programs) for causing the hardware group to function as the encryption operation device 1, various data, and the like. It's okay.

The control unit 10 includes an input unit 111 , a sample conversion unit 112 , a polynomial definition unit 113 , a polynomial update unit 114 , a constant term extraction unit 115 and a key conversion unit 116 .

The input unit 111 receives, as parameters, a value for defining an arbitrary one-variable function (mapping) and an input value to this function for an algorithm that performs bootstrapping, which will be described later.

The sample conversion unit 112 converts the LWE samples on the torus of the input value to samples on the integer space.

The polynomial definition unit 113 defines a polynomial (a vector described later) in which the values on the torus of the function values for the input values assigned to the integer space by the sample transform unit 112 are the coefficients of the terms whose degrees are negative in this integer space. testv).

The polynomial updating unit 114 updates the LWE ciphertext of the polynomial by homomorphic operation using the bootstrapping key, which is the ciphertext in which the first secret key of the LWE ciphertext is the plaintext, and initializes the noise. .

The constant term extraction unit 115 extracts the LWE ciphertext of the constant term of the polynomial updated by the polynomial update unit 114, thereby obtaining the LWE ciphertext of the function value based on the second secret key.

The key conversion unit 116 converts the LWE ciphertext with the second secret key acquired by the constant term extraction unit 115 into the LWE ciphertext with the first secret key.

Next, the details of the algorithm of the secure computation method executed by the secure computation device 1 will be described.

[definition]
Various definitions in the secure computation method of this embodiment conform to Non-Patent Documents 1 and 2, but the explanation is supplemented as follows.
The i-th element of a vector x of length n is denoted by x _i (x=(x ₁ , . . . , x _n )).
Various spaces are described as follows.
・Integer space: Z, real number space: R
・Torus T=R/Z
・Polynomial:
R[X]: set of polynomials of any degree with coefficients εR T _N [X]:=R[X]/(X ^N +1): polynomials of degree N (eg, 1024) with coefficients εT Also, x← ^U χ means sample x uniformly at random from the set χ.

を満たす。ここで、ノイズｅは、一般的にガウス分布に従い、パラメータα（エラー率、ｂＴ上においてはノイズの標準偏差となる）を持つ。 The TLWE and TGSW ciphers are defined in Non-Patent Document 1 and are extensions of the LWE and GSW ciphers, respectively.
For a TLWE cipher, LWE samples (a,b) ∈ LWE _s (m) of secret vector s, plaintext m, noise e are

meet. Here, the noise e generally follows a Gaussian distribution and has a parameter α (error rate, standard deviation of noise on bT).

となる。
この「秘密鍵の暗号文」ＢＫ_ｉを用いることで、暗号文上の準同型演算により復号に当たる演算を行える。これにより、ブートストラッピングでは、入力の平文と同じ平文を持ち、かつ、ノイズの大きさが初期化された暗号文が生成される。 For bootstrapping keys _{BK s→s", α =} ( _{BK 1} , . be. Here, the TGSW ciphertext can be homomorphically operated with the TLWE ciphertext,

becomes.
By using this "secret key ciphertext" BK _i , it is possible to carry out an operation corresponding to decryption by a homomorphic operation on the ciphertext. As a result, in bootstrapping, a ciphertext having the same plaintext as the input plaintext and with the magnitude of noise initialized is generated.

[Plaintext space settings]
In the method of Non-Patent Document 1 mentioned above, the plaintext space of the ciphertext is limited to bit values. In this embodiment, this method is extended to handle integer values as in Non-Patent Document 2.

Let B be a natural number and m _in ε{0, . . . , B−1} be plaintext. At this time, the configuration of the LWE ciphertext is as follows.

を満たす条件の下、復号において、２Ｂ倍しｒｏｕｎｄすることで元の値に戻る。なぜならば、

であるが、式（１）を満たす時、｜２Ｂｅ｜＜１／２となり、「（ｂ－＜ｓ，ａ＞）・２Ｂ」＝ｍ_ｉｎが得られるからである。
また、秘密鍵ｓによる、平文ｍのＬＷＥ暗号文Ｅｎｃ（ｓ，ｍ）＝（ａ，ｂ）を、ＬＷＥ_ｓ（ｍ）とも表記する。 The plaintext min is transformed into the value min/ _{2BεT in the} ciphertext. Here, the noise e is

Under the condition that satisfies the condition, in decoding, the original value is restored by multiplying by 2B and rounding. because,

However, when the formula (1) is satisfied, | _2Be |<1/2, and "(b−<s, a>)·2B"=min is obtained.
Also, the LWE ciphertext Enc(s,m)=(a,b) of the plaintext m with the secret key s is also written as LWE _s (m).

[One-variable function algorithm]
FIG. 2 is a diagram showing an algorithm for executing the method of concealment operation of a function of one variable in this embodiment.
This algorithm executes an arbitrary one-variable function f: {0, . . . , B-1}→{0, .

First, the input unit 111 inputs min _{ε { 0} , . bootstrapping key BK _s→s″,α , _keyswitch key KS _s′→s,γ , and coefficients { _{μ 0} , . is accepted as input.

は、φ（ｍ_ｉｎ）に応じて、特定範囲のμ_ｉが定数項として表れる。 Here, for the range of values φ( _min ) that can be taken on the min _plaintext space,

, a certain range of μ _i appears as a constant term depending on φ( _min ).

となっている。ｅ_ＡＣＣは、ループ処理で生じるｒｏｕｎｄｉｎｇノイズ（丸め誤差）の和である。実装においては、トーラス上のＬＷＥサンプル（ａ，ｂ）∈Ｔ^ｎ×Ｔのａ，ｂは（１／２Ｎ）の倍数を用いるため、この丸め誤差は０となり無視できる（ξ_ｉ＝０，ｉ＝０，…，ｎ）。
以下では、ｅ_ＡＣＣ＝０とする。よって、ｍ_ｉｎの平文空間上で取り得る値の範囲φ（ｍ_ｉｎ）は、

となる。 again,

It has become. e _ACC is the sum of rounding noise (rounding error) generated in loop processing. In our implementation, the LWE samples (a,b) ∈ T ⁿ ×T on the torus use multiples of (1/2N), so this rounding error is 0 and negligible (ξ _i =0,i= 0,...,n).
In the following, e _ACC =0. Therefore, the range of values φ( _min ) that can be taken on the _plaintext space of min is

becomes.

となる。したがって、

の定数項となりうる係数は、

である。これらの係数μ∈Ｍ_０が、μ：＝ｆ（０）／２Ｂ∈Ｔと予め設定される。
なお、Ｔ_Ｎ［Ｘ］：＝Ｒ［Ｘ］／（Ｘ^Ｎ＋１）であり、Ｘ^Ｎ＋１≡０、Ｘ^Ｎ≡－１であることから、Ｘ^－ｉ≡－Ｘ^Ｎ－ｉ、Ｘ^ｉ≡－Ｘ^{－（Ｎ－ｉ）}である。 When m _in =0, φ(0)=2Ne, and

becomes. therefore,

The coefficient that can be the constant term of

is. These coefficients μεM ₀ are preset as μ:=f(0)/2BεT.
Note that T _N [X]:=R [X]/(X ^N +1), and since X ^N +1 ≡ 0 and X ^N ≡ -1, X ⁱ ≡ -X ^N-i , X ⁱ ≡-X- ^(Ni) .

であるから、

となる。したがって、

の定数項となりうる係数は、

である。これらの係数μ∈Ｍ_ｍ＿ｉｎが、μ：＝ｆ（ｍ_ｉｎ）／２Ｂ∈Ｔと予め設定される。 When _{min ∈ {1,..., B-1}, φ(m in )=2N(e+m in / 2B} ), and from equation (1),

Because

becomes. therefore,

The coefficient that can be the constant term of

is. These coefficients μεM _{m_in} are preset as μ:=f(m _in )/2BεT.

であるから、同様に、

となる。したがって、

の定数項となりうる係数は、

である。これらの係数μ∈Ｍ_ｍ＿ｉｎが、μ：＝ｆ（ｍ_ｉｎ）／２Ｂ∈Ｔと予め設定される。 It should be noted that, instead of _min ∈ _{ 1, .

Therefore, similarly,

becomes. therefore,

The coefficient that can be the constant term of

is. These coefficients μεM _{m_in} are preset as μ:=f(m _in )/2BεT.

FIG. 3 is a diagram illustrating a slice of plaintext space in this embodiment.
The plaintext is initially a value on the torus T (a real number between 0 and 1), but is multiplied by 2N in the bootstrapping algorithm (Fig. 2) to become a value on Z _2N . FIG. 3 shows a slice of plaintext space on Z _2N .

A slice is a possible width of noise in an LWE ciphertext, and the plaintext can be arranged by defining the widths so that they do not overlap.
Here, a case is shown where the range of plaintext values is B=8, and 0 to 2N are divided into 2B slices.
That is, the width of each slice is N/B, and plaintext "3", for example, is assigned to a range of ±N/2B around 3N/B.

FIG. 4 is a diagram showing a method of setting the value of the one-variable function in this embodiment.
The positions on the circle correspond to negative orders in the vector testvεT _N [X] above, and each slice is assigned a mapping f(m _in ). Then, as the coefficient μ _i (0≦i≦N-1)εT of each order of testv, f(m _in )/2B is set in advance as described above.
As can be seen in the transformation of the above testv formula, since X ⁻ⁱ ≡-X ^N−i and X ⁱ ≡−X ^−(N−i) , symmetrical positions on the circumference have opposite signs value is set.

Returning to FIG. 2, in step 1, the sample conversion unit 112 multiplies the LWE samples (a, b)εT ⁿ ×T on the torus T=R/Z by 2N and rounds them, thereby obtaining samples on the integer ( a ~, b ~) ∈ Z _2N ⁿ x Z _2N .

In step 2, the polynomial definition unit 113 defines a polynomial testv:=μ ₀ +μ ₁ X ⁻¹ + . . . +μ _N−1 X ^−(N−1) εT _N [X].

In step 3, the polynomial updating unit 114 calculates ACC, which is a TLWE ciphertext obtained by encrypting the polynomial X ^b (0, testv)εT _N [X]×T _N [X], as an intermediate product. .

のＴＬＷＥ暗号文にＡＣＣを更新する。
よって、ループ処理を終えた時点で、ＡＣＣは、

のＴＬＷＥ暗号文となる。 In the loop processing of steps 4 to 6, the polynomial update unit 114 updates the polynomial TLWE ciphertext ACC by homomorphic operations.
where each BK _i is a TGSW ciphertext with a secret key s _i whose plaintext is a TLWE ciphertext with a secret key s″. Therefore, the polynomial updating unit 114 performs a homomorphic operation on the TGSW ciphertext and the ACC, which is the TLWE ciphertext, to obtain

update the ACC to the TLWE ciphertext of
Therefore, when the loop processing ends, ACC

TLWE ciphertext.

In step 7, the constant term extraction unit 115 extracts a constant term, that is, an _LWE ciphertext of f(min)/2B set as a coefficient of testv from the polynomial TLWE ciphertext ACC.

In step 8, the key conversion unit 116 converts u, which is the LWE ciphertext by the secret key s′, into LWE ciphertext by the secret key s by operating the KeySwitch using the key switch key KS _s′→s,γ . Convert.

FIG. 5 is a diagram showing an algorithm for key conversion processing used in the encryption calculation method according to this embodiment.
Note that this key conversion process (KeySwitch) is the same as that shown in Non-Patent Document 1.

_In this way, the secure computing device 1 executes an arbitrary one-variable function f at the same time as bootstrapping, and _f (min) ciphertext _{Cf for input min ciphertext Cm_in .} Output _{(m_in)} .

[Anonymous Multiplication of Integers and Binary Numbers]
FIG. 6 is a block diagram showing the functional configuration of the secure computing device 1 in this embodiment.
The control unit 10 includes the input unit 111, the sample conversion unit 112, the polynomial definition unit 113, the polynomial update unit 114, the constant term extraction unit 115, and the key conversion unit 116. In addition to the above, a first calculation unit 12, a second calculation unit 13, and an output unit 14 are provided.

As described above, the bootstrap processing unit 11 updates the LWE ciphertext of the polynomial by the homomorphic operation using the bootstrapping key, which is the ciphertext with the private key of the LWE ciphertext as the plaintext, and initializes the noise. At the time of conversion, the values on the torus set for the coefficients of this polynomial are used to output the calculation result of the one-variable function.

The first arithmetic unit 12 adds 0 or B (or −B) representing the input binary number 1 or 0 to the input integer of 0 or more and less than B, and then supplies the bootstrap processing unit 11 with a one-variable function , an operation that returns an integer as it is is set, and the first operation result is obtained.
Here, the integer B that determines the plaintext space {−(B−1), . . . , 0, .

After adding the first calculation result to the input integer, the second calculation unit 13 halves the even number and divides the odd number x by -(x+B)/2 as a one-variable function for the bootstrap processing unit 11 . to obtain the second calculation result.

The output unit 14 outputs the third calculation result as the multiplication result of the input integer and the input binary number.

FIG. 7 is a diagram showing an algorithm for multiplication of integers and binary numbers in this embodiment.
Here, a ciphertext C _{m_int} of an integer m _{int ∈ {} 0, _. C _{m_int} is output when , and C ₀ when m _bin =−B or B is output as the result (ciphertext C _{m_out} ) of multiplication MultibyBin(C _{m_int} , C _{m_bin} ).
Note that m _bin =0 represents binary 1 (true), and m _bin =−B or B represents binary 0 (false).

In step 1, the first calculator 12 calculates a ciphertext _Ctmp =Bootstrap( _{Cm_int} + _{Cm_bin} , _{fid_int} ) by bootstrapping with execution of a one-variable function _{fid_int} (identity map).

Here, f _{id_int} : _{{ 0} , . . . , B−1}→{0, _. It is realized by defining ₁ εT as follows.

In step 2, the second calculator 13 calculates the ciphertext _{Cm_out} =Bootstrap( _{Cm_int} + _{Cm_tmp} , _fmultbin ) by bootstrapping with execution of the one-variable function _fmultbin .

であり、この演算は、ｔｅｓｔｖの係数μ_０，…，μ_Ｎ－１∈Ｔを、次のように定義することで実現される。

where f _multbin is

, and this operation is realized by defining the coefficients μ ₀ , . . . , μ _N−1 εT of testv as follows.

FIG. 8 is a diagram showing changes in values on the plaintext space accompanying each step of multiplication in this embodiment.
For example, the input integer m _int =1 is assigned to the slice containing N/B, and adding m _bin ∈ {−B, 0, B} results in m _bin =0 (true). If m _bin =−B or B(false), it is located in the slice containing (N/B)+N. By bootstrapping the f _{id_int} operation on this operation result, the operation result tmp is stored at the position of the result of f(1) if m _bin =0, that is, in the slice containing N/B, m _bin = If -B or B, it is located in the slice containing the minus position of the result of f(1), ie -N/B.

Thus, in step 1 of the above algorithm (FIG. 7), if C _{m_bin} is a ciphertext of -B or B, the phase of C _{m_int} moves to a position symmetrical to the origin as shown in FIG. , f _{id_int} , the phase of the ciphertext is moved to the position of the x-axis symmetry. That is, the sign of C _tmp is inverted, and C _tmp =C - _{m_int} .
Also, if C _{m_bin} is a ciphertext of 0, since 0 is simply added, C _tmp remains unchanged and C _tmp =C _{m_int} .

Then add tmp to min _int , if m _bin =0 then add the same value, so doubled and the result is located in the slice containing the original 2N/B. On the other hand, if m _bin =−B or B, then add the same positive and negative values, so the result is located in the slice containing 0. The value is halved by bootstrapping the f _multbin operation on this operation result, and the operation result m _out is the slice containing N/B if m _bin =0, m _bin =−B or B is located in the slice containing 0.

Thus, in step 2 of the above algorithm (FIG. 7), if C _{m_bin} was −B or B ciphertext, then C _{m_int} +C _tmp =C ₀ and C _{m_bin} was 0 ciphertext , then _{Cm_int} + _Ctmp = _{Cm_int} + _{Cm_int} .
Then, bootstrapping with the operation of f _{multbin halves} C _{m_int} +C _{m_int} to C _{m_int} and C ₀ remains C ₀ .

As a result, when m _bin =0 (true), the original m _int is output in ciphertext, and when m _bin =−B or B (false), 0 is output in ciphertext.

Here, the operation of f _multbin that halves the value will be described using the case of B=5 as an example.
For a value of min _int less than B/2, for example min _int =1, since min _int + min _int =2, the operation result of the slice of “2” is set to “1”. Similarly, for m _int =2, the operation result of the slice of "4" is set to "2".

For a value of min _int larger than B/2, for example, min _int =3, since min _int +min _int =6, the operation result of the “−1” slice is set to “3”. In other words, this is the same as setting the operation result of the "1" slice located at the point symmetrical to the "-1" slice to "-3". Similarly, for m _int =4, the operation result of the “−3” slice is set to “4”, that is, the operation result of the “3” slice is set to “−4”.

That is, the operation results of slices 1, 2, 3 and 4 may be set to {-3, 1, -4, 2} in order. If this is expressed by a mathematical formula, it becomes the above-mentioned formula (1).
Here, since B is an odd number, the value of min _int +tmp is an even number less than B when _{min int} is less than B/2, and a negative odd number when min _int is greater than B/2. Therefore, by setting the operation result for slices 0 to B−1, the operation of f _multbin , which halves the value, is realized.

According to the present embodiment, the secure arithmetic device 1 uses the process of executing a one-variable function at the same time as bootstrapping, the first arithmetic operation that executes the function f _{id_int} after adding the input binary number to the input integer. A second operation is performed in sequence that adds the result of the first operation to an integer and then performs the function f _{- - multbin} .
As a result, the secure arithmetic device 1 can perform multiplication of an input integer and an input binary number at the same time as bootstrapping by fully homomorphic encryption.

In addition, in Japanese Patent Application No. 2019-211426, the present inventor proposes a method of realizing multiplication of an input integer and an input binary number by executing bootstrapping processing that realizes a single-variable function three times. did.
On the other hand, in this embodiment, the number of times of bootstrapping processing is reduced to two, and the processing efficiency is improved.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely enumerations of the most suitable effects produced by the present invention, and the effects of the present invention are not limited to those described in the embodiments.

The secure computation method by the secure computation device 1 is implemented by software. When it is implemented by software, a program that constitutes this software is installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to users' computers via a network. Furthermore, these programs may be provided to the user's computer as a web service through the network without being downloaded.

1 secret arithmetic device 10 control unit 11 bootstrap processing unit 12 first arithmetic unit 13 second arithmetic unit 14 output unit 20 storage unit 111 input unit 112 sample conversion unit 113 polynomial definition unit 114 polynomial update unit 115 constant term extraction unit 116 key converter

Claims (3)

When updating the LWE ciphertext of the polynomial and initializing the noise by homomorphic operation using the bootstrapping key, which is the ciphertext with the secret key of the LWE ciphertext as the plaintext, set to the coefficient of the polynomial A bootstrap processing unit that outputs the operation result of the one-variable function using the value on the torus obtained;
When B is an odd number, after adding 0 or B, which is a value representing an input binary number of 1 or 0, to an input integer greater than or equal to 0 and less than B, the one-variable function is given to the bootstrap processing unit a first calculation unit that sets an identity map calculation and obtains a first calculation result;
After adding the first operation result to the input integer, the bootstrap processing unit performs an operation to halve an even number and to -(x+B)/2 an odd number x as the one-variable function. a second calculation unit that sets and obtains a second calculation result;
and an output unit that outputs the second operation result as a multiplication result of the input integer and the input binary number. When updating the LWE ciphertext of the polynomial and initializing the noise by homomorphic operation using the bootstrapping key, which is the ciphertext with the secret key of the LWE ciphertext as the plaintext, set to the coefficient of the polynomial A computer equipped with a bootstrap processing unit that outputs the operation result of a one-variable function using the values on the torus obtained,
When B is an odd number, after adding 0 or B, which is a value representing an input binary number of 1 or 0, to an input integer greater than or equal to 0 and less than B, the one-variable function is given to the bootstrap processing unit a first calculation step of setting an identity map calculation and obtaining a first calculation result;
After adding the first operation result to the input integer, the bootstrap processing unit performs an operation to halve an even number and to -(x+B)/2 an odd number x as the one-variable function. a second calculation step of setting and obtaining a second calculation result;
an output step of outputting the result of the second operation as a multiplication result of the input integer and the input binary number. A secure computation program for causing a computer to function as the secure computation device according to claim 1 .

Images