a590003

Homomorphic Evaluation of the AES Circuit
Craig Gentry
IBM Research
Shai Halevi
IBM Research
June 15, 2012
Nigel P. Smart
University of Bristol
Abstract
We describe a working implementation of leveled homomorphic encryption (without bootstrapping)
that can evaluate the AES-128 circuit in three different ways. One variant takes under over 36 hours to
evaluate an entire AES encryption operation, using NTL (over GMP) as our underlying software platform,
and running on a large-memory machine. Using SIMD techniques, we can process over 54 blocks
in each evaluation, yielding an amortized rate of just under 40 minutes per block. Another implementation
takes just over two and a half days to evaluate the AES operation, but can process 720 blocks in
each evaluation, yielding an amortized rate of just over five minutes per block. We also detail a third
implementation, which theoretically could yield even better amortized complexity, but in practice turns
out to be less competitive.
For our implementations we develop both AES-specific optimizations as well as several “generic”
tools for FHE evaluation. These last tools include (among others) a different variant of the Brakerski-
Vaikuntanathan key-switching technique that does not require reducing the norm of the ciphertext vector,
and a method of implementing the Brakerski-Gentry-Vaikuntanathan modulus-switching transformation
on ciphertexts in CRT representation.
Keywords.
AES, Fully Homomorphic Encryption, Implementation
The first and second authors are sponsored by DARPA under agreement number FA8750-11-C-0096. The
U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding
any copyright notation thereon. The views and conclusions contained herein are those of the authors and
should not be interpreted as necessarily representing the official policies or endorsements, either expressed
or implied, of DARPA or the U.S. Government. Distribution Statement “A” (Approved for Public Release,
Distribution Unlimited).
The third author is sponsored by DARPA and AFRL under agreement number FA8750-11-2-0079. The
same disclaimers as above apply. He is also supported by the European Commission through the ICT
Programme under Contract ICT-2007-216676 ECRYPT II and via an ERC Advanced Grant ERC-2010-
AdG-267188-CRIPTO, by EPSRC via grant COED–EP/I03126X, and by a Royal Society Wolfson Merit
Award. The views and conclusions contained herein are those of the authors and should not be interpreted as
necessarily representing the official policies or endorsements, either expressed or implied, of the European
Commission or EPSRC.
5. Homomorphic Evaluation of the AES Circuit