Amortized Bootstrapping Revisited: Simpler, Asymptotically-Faster, Implemented


Micciancio and Sorrel (ICALP 2018) proposed a bootstrapping algorithm that can refresh many messages at once with sublinearly many homomorphic operations per message. However, despite the attractive asymptotic cost, it is unclear if their algorithm could ever be practical, which reduces the impact of their results. In this work, we follow their general framework, but propose an amortized bootstrapping procedure that is conceptually simpler and asymptotically cheaper. We reduce the number of homomorphic multiplications per refreshed message from p̌hantomȟantomO(3textasciicircumbackslashrho backslashcdot ntextasciicircum1/backslashrho vǎntom backslashcdot backslashlog n)vpňtomvphťomO(3ρ·n1/ρ·logn)to vphaǒmO(backslashrho backslashcdot ntextasciicircum1/backslashrho vphanm̌)vphanťvphantǒO(ρ·n1/ρ), and the noise overhead from vphantom̌backslashwidetildeO(ntextasciicircum2 + 3 backslashcdot backslashrho vphantom̌)vphantom̌vphantom̌Otextasciitilde(n2+3·ρ)to vphantom̌backslashwidetildeO(ntextasciicircum1 + backslashrho vphantom̌vphantomp̌hantomǑtextasciitilde(n1+ρ), where n is the security level and vphantomvǎntom̧̌kslashrho backslashge 1vphantomρ≥š a free parameter. We also make it more general, by handling non-binary messages and applying programmable bootstrapping. To obtain a concrete instantiation of our bootstrapping algorithm, we describe a double-CRT (aka RNS) version of the GSW scheme, including a new operation, called shrinking, used to speed-up homomorphic operations by reducing the dimension and ciphertext modulus of the ciphertexts. We also provide a C++ implementation of our algorithm, thus showing for the first time the practicability of the amortized bootstrapping. Moreover, it is competitive with existing bootstrapping algorithms, being even around 3.4 times faster than an equivalent non-amortized version of our bootstrapping.

Advances in Cryptology – ASIACRYPT 2023