2

Going through LowMC, one of the main advantage of it seems to be useful in Fully Homomorphic Encryption (FHE), Multi-party Computation (MPC) and Zero Knowledge (ZK) proofs. I have no idea about any of these, but it seems lowering the number of AND gates is a big deal. Similar claim is made for the Kreyvium cipher as well.

Could anyone explain it to me, how having a low number of AND gates help in those 3 cases? Mainly, how come a private key cryptographic algorithm helps in those areas which are not at all related? Also, does it mean the cost for linear operation (Exclusive-OR gates) is zero in FHE/MPC/ZK?

hola
  • 613
  • 6
  • 23

2 Answers2

1

In general, AND gates are no big deal. In practice however, many zero-knowledge systems are based on rank-1-constraint systems (R1CS, often "arithmetic circuits" in folklore), and the concern that LowMC tries to address is linked to this practicality. Note that I'm talking from the perspective of ZK, although the principles probably carry over to FHE and MPC.

In R1CS, you declare constraints between inputs and outputs, and these constraints are of arithmetic form. For instance, you would write "(input[0] + 1)*secret[0] = output[0]". In most R1CS systems (read: all that I know of), it is the multiplication gates that weigh heavy in the prove/verify functions, and the additions mostly come for free.

Now, most encryption/decryption functions are defined in terms of bitwise operations, not in terms of + and *. To prove that you know the decryption of a certain value and its associated key, you would thus need to convert all those bitwise operators into arithmetic operations. You can imagine these equations become quite large. The main operations in this context are, as you correctly identified, AND, OR and XOR. Depending on the convention you use, you will encode True as 1 and False as 0, or vice versa. It is then relatively easy to see that x AND y becomes $x * y$ and x XOR y becomes $x + y - 2 * x * y$, and x OR y becomes $x + y - x * y$.

Now, there are quite some optimizations that you can carry out here. For example, if you would use a stream cipher to show decryption, then you have to XOR your cipher stream $s[..]$ with the cipher text $c[..]$. The former is a result of your circuit, but often the latter is a public value. If this is the case, you can make that specific XOR more efficient by doing something like

let xor = if c[i] == 0 {
    s[i]
} else {
    1 - s[i]
};

which requires no multiplications for this specific XOR.

A related optimization exists for OR: if you take the convention False as 0, True as anything else, then x OR y just becomes $x + y$, as long as your field is large enough.

TL;DR: AND becomes multiplication, multiplication costs processing time. XOR can sometimes be optimized out a bit. By the way, if you're interested in low-multiplier-count symmetric crypto, have a look at Poseidon too!

Ruben De Smet
  • 2,530
  • 15
  • 27
1

In most FHE schemes, the ciphertexts contain noise which grows after performing operations. Its growth for additions is usually negligible compared to multiplications. In addition, the cost of operations is different. Therefore, one wants to minimize the multiplicative depth but also the number of multiplications as they are more costly.

For example, in the fully homomorphic encryption over integers, the ciphertext is $$c = pq + 2r + m,$$ where $p$ is the secret key, $q$ and $r$ is noise, $m$ is the message bit.

If you add two such ciphertexts, you get $$c' = c_1 + c_2 = p(q_1 + q_2) + 2(r_1 + r_2 + \epsilon) + (m_1 \oplus m_2).$$ The size of $q$ and $r$ at most increased by 1 bit.

If you multiply two such ciphertexts, you get $$c' = c_1 * c_2 = p(q_1q_2 + \ldots) + 2r_1r_2 + \ldots + m_1 m_2.$$ The size of $q$ and $r$ is roughly doubled. This limits the number of consequent multiplications that can be done before becoming too large and slow, requiring further costly bootstrapping (re-encrypting the ciphertexts with fresh small noise).

Fractalice
  • 3,107
  • 13
  • 10