Implement a Fully Homomorphic Version of the AES-128 Cryptosystem using TFHE-rs #135
Comments
|
Hi @zaccherinij, could you please explain where homomorphic encryption should be applied in this process? Are you suggesting encrypting the key and block using homomorphic encryption first, and then performing AES encryption? |
|
hello @Jineshbansal We expect the given IV and the key provided in command line to be encrypted in FHE, then as indicated in the summary we expect both KeyDerivation and Encrypt/Decrypt to be implemented and tested. The Key derivation time must be measured standalone and then the time to run the AES in counter mode for the given key and IV for the given number of output is going to be measured, fully in FHE, we don't expect the encryption time of the IV and Key to FHE to be measured. Does that clear things up for you ? Cheers |
|
Hey @IceTDrinker, This clears up most of our doubts. However, I wanted to confirm: will we be getting the client key or a decryption key to access the encrypted data? In AES, the S-Box is used during the encryption process. However, if the data is already encrypted, we can’t directly work with the S-Box without the decryption key, to access specific elements in the S-Box, we rely on indexes provided by the FHE-encrypted vector. Since these indexes are themselves encrypted, we cannot directly access the required elements in the S-Box by this way : // [[ 0, 1, 2, 3]
// [ 4, 5, 6, 7]
// [ 8, 9, 10, 11]
// [ 12, 13, 14, 15]]
let xss: FheArrayBase<&[..], tfhe::FheUint32Id> = xs.slice(&[0..1, 0..0]);
//[[ 1, 1, 1, 1]
// [ 1, 1, 1, 1]
// [ 1, 1, 1, 1]
// [ 1, 1, 1, 1]]
let yss: FheArrayBase<&[..], tfhe::FheUint32Id> = ys.slice(&[0..xss(encrypted thing), 0..xss(encrypted thing)]);Let me know your thoughts! |
|
Like if we want to set a bool parameter in the while loop like this but it is of type while b != 0 (type: FheBool) {
..
} Normally we would just decrpyt the |
|
Hello @Jineshbansal and @lla-dane, You likely don't know the following primitives: https://docs.rs/tfhe/latest/tfhe/prelude/trait.IfThenElse.html and match_value: https://docs.rs/tfhe/latest/tfhe/struct.FheUint.html#method.match_value Cheers |
|
Note that the number of outputs is in clear, so you can iterate n times knowing how many values we want as output |
|
nice work
*** *** ***@***.***> 于2025年1月17日周五 17:13写道：
… Note that the number of outputs is in clear, so you can iterate n times
knowing how many values we want as output
—
Reply to this email directly, view it on GitHub
<#135 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/A3YIDCDXKSGZC4QJNUHEHH32LDCSDAVCNFSM6AAAAABTEOZJFKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKOJXG43DQNRXGI>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
|
What is the meaning of |
|
Do we had to build a library in which a user can call the function like aes_encryption. So does this mean that user will call the |
number-of-outputs is how many times the executable should run the AES in counter mode, yielding number-of-outputs encrypted values that must match the clear evaluation of the AES in CTR mode on the clear IV an key The benchmarking will be done by us to avoid unfaithful results. having the user cal set_server_key is fine as long as you indicate it in the usage of your function @lla-dane |
can you please elaborate on this, we didn't understand anything. @IceTDrinker |
you have to enable the |
|
I run into an error when I enable the Here are the errors when I compile: I’m wondering if the errors are due to my laptop not supporting AVX-512 optimization or if they stem from some mismatches on the tfhe.rs side. Could you help me check this? Thank you! |
|
We should not only implement a FHE-AES block cipher but also FHE-AES in counter mode. Is right correct? If we only provide |
|
@TianWZhang for the issue you encounter use the toolchain written in toolchain.txt the AES counter mode mode just encrypts the same values incremented several times https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR) |
|
@IceTDrinker Thank you very much. Using the toolchain written in toolchain.txt solved my problem. |
|
Hi @IceTDrinker. I was wondering what is the approximate value of |
we'll likely adapt to the runtimes we measure to have something long enough that we avoid variability but short enough that it does not take hours to get a representative benchmark of a solution |
|
|
That looks correct, key and IV are FHE encrypted, then you do the AES computation that yield C1, ... CN |
|
Hey, so is there any way to pull this off ? @IceTDrinker let mut file = File::create("output.txt").expect("Unable to create file");
for i in 0..16 {
let result: FheUint<FheUint8Id> = output_encryption[i];
writeln!(file, "{:?}", result).expect("Unable to write data");
}because this is giving me error that, Would we also have to return the |
What are you trying to achieve here ? Here having the values returned is not necessary as it could be that ciphertexts are used directly in memory. We do require a check at the end that all decrypted FHE values correspond to the clear AES 128 computations |
We are already doing this. Just wanted to see what the |
you can try into_raw_parts to get access to lower level entities some of them should have the debug trait enabled |
|
We are nearly completed with the implementation here , Would It be possible to get our code reviewed once? @IceTDrinker |
That's what the submission process is about, once at the deadline we'll review the code, normally you should have tested against the clear equivalent of AES 128 |
|
Do we also include the time (~5sec) it take to execute |
This is way too slow for a set_server_key do you use the release flag of cargo ? |
|
Haah !! now I run it will the release flag, and it takes almost no time with trivial encryption. How did that happen ? |
that’s the power of compiler optimization |
Here in this line or just the (encryption + decryption) part |
one you have encrypted IV and key in FHE we want all the FHE computation before you verify it's correct @lla-dane |
|
Hi! How are the encryption scheme parameters defined in |
We have an optimization method to generate such parameters, you can check an implementation of such an optimizer in the concrete project: https://github.com/zama-ai/concrete/tree/main/compilers/concrete-optimizer |
|
@IceTDrinker Thanks, it makes sense now. Except the noise distribution parameters, e.g.: How do you calculate them based on the output of concrete optimizer? |
Normally the optimizer has so called security curves that allow to estimate secure noise for a given security level and a given input lwe dimension, I'm unclear on how exactly the optimizer outputs those |
|
Hi,
Thanks |
|
Hello @rostin79s
Regards |
|
@IceTDrinker If you have an output like this from What |
|
ln2 = log norm 2 so norm2 = 2^(ln2) and then max_noise_level = floor(sqrt(norm2)) |
|
and it gives you the max number of addition/max clear multiplication you can do you can at most do max_noise_level additions, or mulitply by max_noise_level at most |
|
How do I set the max noise level for the "WopbsParameters" parameter set? it is not defined in its struct. |
|
wopbs is experimental... try to define a PBS Parameters struct linked to your params with the right MaxNoiseLevel if you have a pbs and wopbs param set it won't bother you as far as I can tell |
|
This worked thanks. |
|
I don't think we have that at the moment in shortint/integer, asking people who know these primitives better. |
One thing to note is that once you have your extracted bits you can "just" evaluate 3 lookups with those bits, there is a chance of it being the most efficient (and it can be parallelized per LUT by running each one in a separate thread). Otherwise you can apply a so called "Many LUT" technique to the wopbs You pretend to work over 10 bits, which will give you enough space for 4 LUTs of 8 bits, then your task is encoding the lookup tables in this big lookup table, you can check how the many lut works for the classic PBS here for the LUT generation: https://github.com/zama-ai/tfhe-rs/blob/afdb30aa77b1edbbf3948ba76e0304576d073c30/tfhe/src/shortint/server_key/mod.rs#L784 and here for the procedure to extract each result: https://github.com/zama-ai/tfhe-rs/blob/afdb30aa77b1edbbf3948ba76e0304576d073c30/tfhe/src/shortint/server_key/mod.rs#L1326 (you will have to adapt it to the wopbs case as we don't have primitives for it). |
|
Hello everyone please let me know when testnet live ✨ |
Overview
The goal of this bounty is to implement a homomorphic version of the AES-128 cryptosystem using the TFHE-rs library. The primary focus of the implementation should be on performance optimization. The implementation is expected to consist of two main blocks: KeyExpansion and Encryption/Decryption. This split is motivated by the possibility of performing key expansion as an offline phase, which may not always be required for all use cases.
You are encouraged to utilize recent research results and optimization techniques. If new cryptographic primitives or parameters are introduced, they must ensure:
Alternatively, you may focus on achieving the fastest possible implementation using the existing parameter sets provided in TFHE-rs. If you decide to use the WoPBS primitives, the parameter sets might need adjustment to meet the requirements above, as the provided sets are only examples for an experimental feature.
What We Expect
We expect a complete FHE AES-128 implementation. For reference, you may consult:
You are allowed to use any API from the TFHE-rs library. The implementation must:
main). We recommend starting with the commit 38a7e4feef7d398b8e7a6f8f8d02e285855396ecor any later commit that includes bug fixes or performance improvements.
Additionally, you are required to provide a small executable that:
Program Inputs
You can use the
claplibrary to parse command-line flags. The program inputs should be named as follows:--number-of-outputs--iv--keyRuntime Output
The executable must print FHE runtime details (excluding encryption and decryption times) in the following format:
AES key expansion took: {key_expansion_elapsed:?}
AES of #{number_of_outputs} outputs computed in: {elapsed:?}
The
elapsedvariables should be computed usingstd::time::Instant::elapsed()on the relevant start instant.Additional Requirements
A README file must accompany the submission, explaining:
Benchmarking
All benchmarks will be conducted on an AWS hpc7a.96xlarge instance. When benchmarking, ensure that:
nightly-avx512feature.Reward
🥇Best submission: up to $5,000
To be considered best submission, a solution must be efficient, effective and demonstrate a deep understanding of the core problem. Alongside the technical correctness, it should also be submitted with a clean code, clear explanations and a complete documentation.
🥈Second-best submission: up to $3,000
For a solution to be considered the second best submission, it should be both efficient and effective. The code should be neat and readable, while its documentation might not be as exhaustive as the best submission, it should cover the key aspects of the solution.
🥉Third-best submission: up to $2,000
The third best submission is one that presents a solution that effectively tackles the challenge at hand, even if it may have certain areas of improvement in terms of efficiency or depth of understanding. Documentation should be present, covering the essential components of the solution.
Register
Step 1: Registration
Click here to register for the TFHE-rs Bounty. Fill out the registration form with your information. Once you fill out the form, you will receive a confirmation email with a link to the submission portal for when you are ready to submit your code.
Note
Check your spam folder in case you don't receive the confirmation email. If you haven't received it within 24 hour, please contact us by email at [email protected].
Step 2: Work on the Challenge
Read through the Bounty details and requirements carefully. Use the provided resources and create your own GitHub repository to store your code.
If you have any questions during your work, feel free to comment directly in the Bounty issue and our team will be happy to assist you.
Step 3: Submission
Once you have completed your work, upload your completed work to the submission portal using the link provided in the confirmation email.
Note
The deadline for submission is February, 9th 2025 (23:59, Anywhere On Earth). Late submissions will not be considered.
We wish you the best of luck with the challenge!
Support
The text was updated successfully, but these errors were encountered: