QUANTUM HOMOMORPHIC ENCRYPTION
Christian Schaffner
(joint work with Yfke Dulek and Florian Speelman)
http://arxiv.org/abs/1603.09717
EXAMPLE: IMAGE TAGGING
EXAMPLE: IMAGE TAGGING
EXAMPLE: IMAGE TAGGING
EXAMPLE: IMAGE TAGGING
SKYLINE JED
EXAMPLE: IMAGE TAGGING
EXAMPLE: IMAGE TAGGING
EXAMPLE: IMAGE TAGGING
EXAMPLE: IMAGE TAGGING
EXAMPLE: IMAGE TAGGING
SKYLINE JED
EXAMPLE: IMAGE TAGGING
EXAMPLE: IMAGE TAGGING
SKYLINE JED
1. HOMOMORPHIC ENCRYPTION 2. PREVIOUS RESULTS
3. NEW RESULT
HOMOMORPHIC ENCRYPTION
HOMOMORPHIC ENCRYPTION
KEY GENERATION
HOMOMORPHIC ENCRYPTION
public key
KEY GENERATION
HOMOMORPHIC ENCRYPTION
public key secret key
KEY GENERATION
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION + ↦
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION +
(secure) ↦
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION +
(secure) ↦
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION +
(secure) ↦
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION EVALUATION
(secure) + ↦
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION +
(secure) ↦
HOMOMORPHIC ENCRYPTION
JED
↦
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION EVALUATION DECRYPTION
+ +
(secure) ↦
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION +
(secure) ↦
HOMOMORPHIC ENCRYPTION
↦
↦
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION EVALUATION DECRYPTION
+ + +
(secure) x ↦ x
x f(x)
f(x) f(x)
HOMOMORPHIC ENCRYPTION
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION +
(secure) | ψ ⟩ ↦ | ψ⟩
HOMOMORPHIC ENCRYPTION
↦
↦
public key secret key
evaluation key
KEY GENERATION
ENCRYPTION EVALUATION DECRYPTION
+ + +
(secure) | ψ ⟩ ↦ | ψ⟩
| ψ⟩ U | ψ⟩
U |ψ⟩ U |ψ ⟩
(quantum)
1. HOMOMORPHIC ENCRYPTION 2. PREVIOUS RESULTS
3. NEW RESULT
PREVIOUS RESULTS: OVERVIEW
C. Gentry: Fully homomorphic encryp3on using ideal laJces. STOC’09
A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015 Y. Ouyang, S-H. Tan, J. Fitzsimons. Quantum homomorphic encryp3on from quantum codes. arxiv:1508.00938
PREVIOUS RESULTS: OVERVIEW
Classical homomorphic encryption: solved! [Gentry 2009]
PREVIOUS RESULTS: OVERVIEW
Classical homomorphic encryption: solved! [Gentry 2009]
Quantum homomorphic encryption: only partial results Clifford scheme allowing evaluation of {P, H, CNOT}
schemes for {P, H, CNOT} + limited # of T gates
C. Gentry: Fully homomorphic encryp3on using ideal laJces. STOC’09
A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015 Y. Ouyang, S-H. Tan, J. Fitzsimons. Quantum homomorphic encryp3on from quantum codes. arxiv:1508.00938
PREVIOUS RESULTS: OVERVIEW
Classical homomorphic encryption: solved! [Gentry 2009]
Quantum homomorphic encryption: only partial results
Clifford scheme allowing evaluation of {P, H, CNOT}
SCHEME FOR {P, H, CNOT}
[AMTW00] A. Ambainis, M. Mosca, A. Tapp, and R. De Wolf. Private quantum channels. FOCS’00 [Gentry 09] C. Gentry: Fully homomorphic encryp3on using ideal laJces. STOC’09
SCHEME FOR {P, H, CNOT}
Ingredient 1: quantum encryption (one-time pad)
SCHEME FOR {P, H, CNOT}
Ingredient 1: quantum encryption (one-time pad)
encryption:
[AMTW00] A. Ambainis, M. Mosca, A. Tapp, and R. De Wolf. Private quantum channels. FOCS’00 [Gentry 09] C. Gentry: Fully homomorphic encryp3on using ideal laJces. STOC’09
SCHEME FOR {P, H, CNOT}
Ingredient 1: quantum encryption (one-time pad)
encryption: pick a,b ∈ R {0,1} a,b
SCHEME FOR {P, H, CNOT}
Ingredient 1: quantum encryption (one-time pad)
| ψ ⟩ a,b
encryption: pick a,b ∈ R {0,1} a,b
| ψ ⟩ ↦ X a Z b | ψ ⟩ =
[AMTW00] A. Ambainis, M. Mosca, A. Tapp, and R. De Wolf. Private quantum channels. FOCS’00 [Gentry 09] C. Gentry: Fully homomorphic encryp3on using ideal laJces. STOC’09
SCHEME FOR {P, H, CNOT}
Ingredient 1: quantum encryption (one-time pad)
| ψ ⟩ a,b
encryption: pick a,b ∈ R {0,1} a,b
| ψ ⟩ ↦ X a Z b | ψ ⟩ decryption:
=
SCHEME FOR {P, H, CNOT}
Ingredient 1: quantum encryption (one-time pad)
| ψ ⟩ a,b
encryption: pick a,b ∈ R {0,1} a,b
| ψ ⟩ ↦ X a Z b | ψ ⟩ decryption: X a Z b | ψ ⟩ ↦ | ψ ⟩
=
[AMTW00] A. Ambainis, M. Mosca, A. Tapp, and R. De Wolf. Private quantum channels. FOCS’00 [Gentry 09] C. Gentry: Fully homomorphic encryp3on using ideal laJces. STOC’09
SCHEME FOR {P, H, CNOT}
Ingredient 1: quantum encryption (one-time pad)
| ψ ⟩ a,b
encryption: pick a,b ∈ R {0,1} a,b
| ψ ⟩ ↦ X a Z b | ψ ⟩ decryption: X a Z b | ψ ⟩ ↦ | ψ
=
SCHEME FOR {P, H, CNOT}
Folklore, last formalized by [BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015
SCHEME FOR {P, H, CNOT}
| ψ⟩
a,b
SCHEME FOR {P, H, CNOT}
| ψ⟩
a,b
Folklore, last formalized by [BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015
a,b
SCHEME FOR {P, H, CNOT}
| ψ⟩
a,b
a,b
SCHEME FOR {P, H, CNOT}
| ψ⟩
b,a
a,b H
H|ψ⟩Folklore, last formalized by [BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
a,b H
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
H | ψ ⟩ b,a
a,b H
H ( | ψ⟩ a,b )
=
HX a Z b | ψ ⟩
=
X b Z a H | ψ ⟩
=
H | ψ ⟩ b,a
Folklore, last formalized by [BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
a,b H
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
H | ψ ⟩ b,a
a,b
H
Folklore, last formalized by [BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
a,b
H
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
H | ψ ⟩ b,a
a,b
b,a
UPDATE FUNCTION
(x,y) ↦ (y,x) H
Folklore, last formalized by [BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
a,b
UPDATE FUNCTION
(x,y) ↦ (y,x) H
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
H | ψ ⟩ b,a
a,b
b,a
UPDATE FUNCTION
(x,y) ↦ (y,x) H
Folklore, last formalized by [BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
a,b
UPDATE FUNCTION
(x,y) ↦ (y,x) H
a,b
SCHEME FOR {P, H, CNOT}
|ψ⟩
H | ψ ⟩
a,b
b,a
UPDATE FUNCTION
(x,y) ↦ (y,x) H
Folklore, last formalized by [BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015
THE CHALLENGE: T GATE
THE CHALLENGE: T GATE
H
THE CHALLENGE: T GATE
a,b
| ψ ⟩
H
THE CHALLENGE: T GATE
a,b
| ψ ⟩
H | ψ⟩ b,a
H
THE CHALLENGE: T GATE
a,b
| ψ ⟩
H T
THE CHALLENGE: T GATE
a,b
| ψ ⟩
H | ψ⟩ b,a
0,b
| ψ ⟩
H T
THE CHALLENGE: T GATE
a,b
| ψ ⟩ | ψ ⟩ 0,b
H T
THE CHALLENGE: T GATE
a,b
| ψ ⟩
H | ψ⟩ b,a
0,b
| ψ ⟩
H
T | ψ ⟩ 0,b
1,b
| ψ ⟩
T T
THE CHALLENGE: T GATE
a,b
| ψ ⟩ | ψ ⟩ 0,b
H
1,b
| ψ ⟩
T T
THE CHALLENGE: T GATE
a,b
| ψ ⟩
H | ψ⟩ b,a
0,b
| ψ ⟩
H
T | ψ ⟩ 0,b P ( T | ψ ⟩ 1,b )
1,b
| ψ ⟩
T T
error!
THE CHALLENGE: T GATE
a,b
| ψ ⟩ | ψ ⟩ 0,b
H
1,b
| ψ ⟩
T T
PREVIOUS RESULTS: OVERVIEW
(comparison based on Stacey Jeffery’s slides)
[BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015 [OTF15] Y. Ouyang, S-H. Tan, J. Fitzsimons. Quantum homomorphic encryp3on from quantum codes. arxiv:1508.00938
PREVIOUS RESULTS: OVERVIEW
homomorphic for compactness security
Not encrypting Quantum circuits yes no
append evaluation
description Quantum circuits Complexity of Dec
prop to (# gates) yes
Quantum OTP no yes inf theoretic
Clifford Scheme Clifford circuits yes computational
PREVIOUS RESULTS: OVERVIEW
homomorphic for compactness security
Not encrypting Quantum circuits yes no
append evaluation
description Quantum circuits Complexity of Dec
prop to (# gates) yes
Quantum OTP no yes inf theoretic
Clifford Scheme Clifford circuits yes computational
[BJ15]: AUX QCircuits with
constant T-depth yes computational
[BJ15]: EPR Quantum circuits Comp of Dec is prop
to (#T-gates)^2 computational [OTF15] QCircuits with
constant #T-gates yes inf theoretic
(comparison based on Stacey Jeffery’s slides)
[BJ15] A. Broadbent, S. Jeffery. Quantum Homomorphic Encryp3on for Circuits of Low T-gate Complexity. CRYPTO 2015 [OTF15] Y. Ouyang, S-H. Tan, J. Fitzsimons. Quantum homomorphic encryp3on from quantum codes. arxiv:1508.00938
PREVIOUS RESULTS: OVERVIEW
homomorphic for compactness security
Not encrypting Quantum circuits yes no
append evaluation
description Quantum circuits Complexity of Dec
prop to (# gates) yes
Quantum OTP no yes inf theoretic
Clifford Scheme Clifford circuits yes computational
[BJ15]: AUX QCircuits with
constant T-depth yes computational
[BJ15]: EPR Quantum circuits Comp of Dec is prop
to (#T-gates)^2 computational
1. HOMOMORPHIC ENCRYPTION 2. PREVIOUS RESULTS
3. NEW RESULT
ERROR-CORRECTION “GADGET”
A quantum state that:
can be efficiently constructed and used
ERROR-CORRECTION “GADGET”
GADGET
A quantum state that:
can be efficiently constructed and used
applies correction iff error was present (iff a = 1)
ERROR-CORRECTION “GADGET”
GADGET
A quantum state that:
can be efficiently constructed and used
applies correction iff error was present (iff a = 1)
ERROR-CORRECTION “GADGET”
P ( T | ψ ⟩ 1,b )
GADGET
A quantum state that:
can be efficiently constructed and used
applies correction iff error was present (iff a = 1)
ERROR-CORRECTION “GADGET”
GADGET
A quantum state that:
can be efficiently constructed and used
applies correction iff error was present (iff a = 1)
ERROR-CORRECTION “GADGET”
T | ψ ⟩ 0,b
GADGET
A quantum state that:
can be efficiently constructed and used
applies correction iff error was present (iff a = 1)
ERROR-CORRECTION “GADGET”
GADGET
A quantum state that:
can be efficiently constructed and used
applies correction iff error was present (iff a = 1) is destroyed after a single use
ERROR-CORRECTION “GADGET”
GADGET
A quantum state that:
can be efficiently constructed and used
applies correction iff error was present (iff a = 1) is destroyed after a single use
ERROR-CORRECTION “GADGET”
EXCURSION
Theoretical Computer Science
PERMUTATION BRANCHING PROGRAM
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y)
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y)
list of instructions:
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
x k 0: π’’
…
0: π
1: σ’
1: σ’’
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
0: π
1: σ’
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
x k 0: π’’
…
0: π
1: σ’
1: σ’’
permutations of {1,2, …, k}
∈ S k
∈ S k
∈ S k
∈ S k
∈ S k
∈ S k
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
output: … ° σ ’’ ° σ ’ ° π 0: π
1: σ’
permutations of {1,2, …, k}
∈ S k
∈ S k
∈ S k
∈ S
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
x k 0: π’’
…
output: … ° σ ’’ ° σ ’ ° π id
0: π
1: σ’
1: σ’’
permutations of {1,2, …, k}
∈ S k
∈ S k
∈ S k
∈ S k
∈ S k
∈ S k
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
output: … ° σ ’’ ° σ ’ ° π id
(fixed) cycle 0: π
1: σ’
permutations of {1,2, …, k}
∈ S k
∈ S k
∈ S k
∈ S
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
x k 0: π’’
…
output: … ° σ ’’ ° σ ’ ° π id
(fixed) cycle 0: π
1: σ’
1: σ’’
f(x,y) = 0 permutations of {1,2, …, k}
∈ S k
∈ S k
∈ S k
∈ S k
∈ S k
∈ S k
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
output: … ° σ ’’ ° σ ’ ° π id
(fixed) cycle 0: π
1: σ’
f(x,y) = 0 f(x,y) = 1 permutations of {1,2, …, k}
∈ S k
∈ S k
∈ S k
∈ S
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
x k 0: π’’
…
output: … ° σ ’’ ° σ ’ ° π id
(fixed) cycle 0: π
1: σ’
1: σ’’
f(x,y) = 0 f(x,y) = 1 length: # of instructions
permutations of {1,2, …, k}
∈ S k
∈ S k
∈ S k
∈ S k
∈ S k
∈ S k
PERMUTATION BRANCHING PROGRAM
computes some Boolean function f(x,y) list of instructions:
x i
1: σ y j 0: π’
output: … ° σ ’’ ° σ ’ ° π id
(fixed) cycle 0: π
1: σ’
f(x,y) = 0 f(x,y) = 1 permutations of {1,2, …, k}
∈ S k
∈ S k
∈ S k
∈ S
EXAMPLE PBP (OR)
length 4, width 5:
EXAMPLE PBP (OR)
x 1
y 1
x 1
1: id
0: (12453) 0: (54321) 0: (12345)
1: id 1: id
length 4, width 5:
EXAMPLE PBP (OR)
x 1
y 1
x 1
y 1
OR(0,0)
output: id
0 1: id
0: (12453) 0: (54321) 0: (12345)
1: id 1: id
0: (15243)
1: (14235)
length 4, width 5:
EXAMPLE PBP (OR)
x 1
y 1
x 1
OR(0,0) OR(0,1) 1: id
0: (12453) 0: (54321) 0: (12345)
1: id 1: id
length 4, width 5:
EXAMPLE PBP (OR)
x 1
y 1
x 1
y 1
OR(0,0) OR(0,1) OR(1,0) OR(1,1)
output: id
0
(14235) 1
(14235) 1
1: id
0: (12453) 0: (54321) 0: (12345)
1: id 1: id
0: (15243)
1: (14235)
length 4, width 5:
EXAMPLE PBP (OR)
x 1
y 1
x 1
OR(0,0) OR(0,1) OR(1,0) OR(1,1) 1: id
0: (12453) 0: (54321) 0: (12345)
1: id 1: id
length 4, width 5:
BARRINGTON’S THEOREM
Theorem (variation): if f : {0,1} n x {0,1} m → {0,1} is in NC 1 ,
then there exists a permutation branching program for f with:
[Barrington 89] Bounded-Width Polynomial-Size Branching Programs Recognize Exactly Those Languages in NC1, J. Comput. Syst. Sci. 38 (1): 150–164, 1989 [BV11] Z. Brakerski, V. Vaikuntanathan. Efficient fully homomorphic encryp3on from (standard) LWE. FOCS 2011
BARRINGTON’S THEOREM
Theorem (variation): if f : {0,1} n x {0,1} m → {0,1} is in NC 1 ,
then there exists a permutation branching program for f with:
width 5
BARRINGTON’S THEOREM
Theorem (variation): if f : {0,1} n x {0,1} m → {0,1} is in NC 1 ,
then there exists a permutation branching program for f with:
width 5
length polynomial in (n+m)
[Barrington 89] Bounded-Width Polynomial-Size Branching Programs Recognize Exactly Those Languages in NC1, J. Comput. Syst. Sci. 38 (1): 150–164, 1989 [BV11] Z. Brakerski, V. Vaikuntanathan. Efficient fully homomorphic encryp3on from (standard) LWE. FOCS 2011
BARRINGTON’S THEOREM
Theorem (variation): if f : {0,1} n x {0,1} m → {0,1} is in NC 1 ,
then there exists a permutation branching program for f with:
width 5
length polynomial in (n+m)
P
NC 1 L
NP no proof that
NP≠NC 1
BARRINGTON’S THEOREM
Theorem (variation): if f : {0,1} n x {0,1} m → {0,1} is in NC 1 ,
then there exists a permutation branching program for f with:
width 5
length polynomial in (n+m)
Classical homomorphic decryption functions happen to be in NC 1 … [BV11]
[Barrington 89] Bounded-Width Polynomial-Size Branching Programs Recognize Exactly Those Languages in NC1, J. Comput. Syst. Sci. 38 (1): 150–164, 1989 [BV11] Z. Brakerski, V. Vaikuntanathan. Efficient fully homomorphic encryp3on from (standard) LWE. FOCS 2011
