An Efficient Method for Comparing Numbers and Determining the Sign of a Number in RNS for Even Ranges

Abstract

Fully Homomorphic Encryption (FHE) permits processing information in the form of ciphertexts without decryption. It can ensure the security of information in common technologies used today, such as cloud computing, the Internet of Things, and machine learning, among others. A primary disadvantage for its practical application is the low efficiency of sign and comparison operations. Several FHE schemes use the Residue Number System (RNS) to decrease the time complexity of these operations. Converting from the RNS to the positional number system and calculating the positional characteristic of a number are standard approaches for both operations in the RNS domain. In this paper, we propose a new method for comparing numbers and determining the sign of a number in RNS. We focus on the even ranges that are computationally simple due to their peculiarities. We compare the performance of several state-of-art algorithms based on an implementation in C++ and relatively simple moduli with a bit depth from 24 to 64 bits. The experimental analysis shows a better performance of our approach for all the test cases; it improves the sign detection between 1.93 and 15.3 times and the number comparison within 1.55–11.35 times with respect to all the methods and configurations.

1. Introduction

Number comparison and sign detection are simple and basic operations for calculation in computing systems. Both operations are necessary for almost any application area in computing technology: mathematical calculations, rendering, data storage, data transfer, data retrieval, encryption, machine learning, etc. Unfortunately, their application for encrypted data exhibits several limitations.

Sign detection and comparison of numbers in the Residue Number System (RNS) are based on the calculation of the positional characteristic. The algorithms for both operations in RNS are computationally complex because RNS is not a Weighted Number System (WNS). Various methods are used to reduce their computational complexity, such as the Pirlo and Impedovo function [1], Diagonal Function (DF) [2,3], Modified Diagonal Function (MDF) [4], Approximate Method (AM) [5,6], and Core Function (CF) [7].

Both operations are fundamental for the applicability of RNS for both hardware and software implementations. Reducing their computational complexity expands the scope of RNS for solving problems of computational mathematics and mathematical modeling. For instance, the use of RNS in software implementation on the GPU increases the performance of matrix processing [8,9]. Moreover, RNS is a main direction in the implementation of Homomorphic Encryption (HE) software.

Fully HE (FHE) has gained popularity for its applicability in cryptosystems [10]. Performing simple arithmetic operations (homomorphic addition and multiplication) over ciphertexts is its main feature. Hence, the processing of encrypted information does not require its preliminary decryption. This characteristic increases the confidentiality and reliability of the data processing [11,12], for example, in third-party systems such as cloud computing [13,14].

However, comparing ciphertext information is a laborious and computationally complex task [15,16]. Cheon–Kim–Kim–Song (CKKS) [17] and Brakerski/Fan–Vercauteren (BFV) [18] are FHE schemes that use RNS to increase the efficiency of sign detection and numbers’ comparison [4,6,19,20,21].

The comparison operation can be performed in a relatively simple way: subtract one number from another, and if the result of the operation is negative, then the first number is greater than the second one and vice versa. Many methods in RNS work using this property. However, they are often ineffective, since they apply division by large numbers or use computationally complex algorithms to calculate the positional characteristic of the number.

In this paper, we consider a new algorithm for determining the sign of numbers in an even range with RNS. The content of the paper is structured as follows. Section 2 briefly introduces the residue number system. Section 3 describes several methods to determine the sing of numbers in RNS. The performance evaluation is described in Section 4. Finally, we conclude and discuss future works in Section 5.

2. Residue Number System

RNS is a not WNS based on Chinese Remainder Theorem (CRT) [22,23]. It is defined by a vector of coprime numbers called moduli. This vector, also called the RNS basis, can be denoted as $\left(p_1,p_2,\dots ,p_n\right)$. The basis is determined by the product of all the $p_i$ elements: $P=\prod _{i=1}^n{p}_i$, where $n$ is the length of the moduli vector. A positional number $X$ is represented in RNS by the residues $\left(x_1,x_2,\dots ,x_n\right)$, where

$$x_1\equiv X\left(mod{p}_1\right),$$

$$\begin{gathered} x_2\equiv X\left(mod{p}_2\right), \\ \dots \end{gathered}$$

$$x_n\equiv X\left(mod{p}_n\right).$$

A restriction is imposed on the number $X$ such that $X\in \left[0,P-1\right]$; otherwise, the residue of the number $X$ will be obtained from the number $X^{\prime }$, where $X^{\prime }=X-P$. Additionally, the CRT corollary guarantees the uniqueness of the representation of non-negative integers within the interval $\left[0,P-1\right]$. The representation of negative numbers in RNS considers the radix addition, where $-X$ is represented as $-X=P-X$. This property is used to determine the sign of a number based on converting a number from RNS to WNS, i.e., decimal, binary, etc.

The simplicity to perform basic arithmetic operations is the main advantage of RNS for computing. Addition, multiplication, and subtraction operations are performed according to the following general formula:

$$\begin{gathered} A\ast B=\left(a_1,a_2,\dots ,a_n\right)\ast \left(b_1,b_2,\dots ,b_n\right)=\left(\left(a_1\ast b_1\right)mod{p}_1\right),\dots , \\ \left(\left(a_n\ast b_n\right)mod{p}_n\right), \end{gathered}$$

(1)

where ∗ denotes operations such as addition, multiplication, and subtraction.

The modular arithmetic, or operations in RNS, has several particularities: the value of the number in each residue does not depend on other residues, and one cycle of the processor’s numerical processing is enough to perform such operations, since this processing can be performed in parallel.

Let us prove that the ranges of numbers in RNS and WNS are equal. For example, for moduli RNS $p_1=3$, $p_2=5$, $p_3=17$, $p_4=257$, and $p_5=65537$, the RNS range is $P=\prod _{i=1}^5{p}_i=2^{32}-1$ and WNS range is $2^{32}-1$.

Let RNS be given by the basis $\left(p_1,p_2,\dots ,p_n\right)$ and the number with residues $X=\left(x_1,x_2,\dots ,x_n\right)$. Then, the number $X$ can be represented in the form.

$X=\left(y_n·p_1·p_2·\dots ·p_{n-1}+y_{n-1}·p_1·p_2·\dots ·p_{n-2}+\dots +y_3·p_1·p_2+y_2·p_1+y_1\right),$ where $y_i$ is from $0$ to $p_k$, and $0\le x_k<p_1·p_2·\dots ·p_{k-1}\left(k=1,\dots ,n\right)$ are the coefficients of RNS.

The ranges of numbers represented in RNS and WNS coincide; i.e., we can talk about the presence of a one-to-one correspondence between the set of number representations in RNS and WNS.

The previous equality can be rewritten as:

$$X=y_1+p_1\left(y_2+p_2\left(y_3+\dots +p_{n-2}\left(y_{n-1}+p_{n-1}{y}_n\right)\dots \right)\right),$$

thereby translating numbers into WNS. It establishes the basic concepts of RNS, operations, and translating numbers from WNS to RNS and vice versa.

3. Methods for Determining the Sign of a Number in RNS

3.1. Chinese Remainder Theorem

The following formula is used to convert numbers from RNS to WNS with Chinese Remainder Theorem (CRT)

$$X={\left|{\displaystyle \sum }_{i=0}^n{P}_i·x_i·{\left|P_i^{-1}\right|}_{p_i}\right|}_P$$

(2)

where $P_i=\frac{P}{p_i}$ and ${\left|P_i^{-1}\right|}_{p_i}$ is a multiplicative inverse of $P_i$ modulo $p_i$.

The restored number must be compared with $P/2$. If $X<P/2$, then the number is greater than zero. Two’s complement is the most common method of representing signed integers. Its half of the range (the upper half) denotes a negative number and vice versa. To estimate the time complexity, we assume that all RNS moduli are composed of $l$-bits bit words, so the time complexity is defined by $O\left(n^2·l^2\right).$

Let us consider an example based on this method.

Example 1.

Let the number $X$ be represented in RNS with moduli $(3,5,7)$ and residues $(2,2,3)$. Initially, we calculate the dynamic range $P=3\ast 5\ast 7=105$ and the $P_i$ elements:

$$P_1=\frac{P}{p_1}=\frac{105}{3}=35,$$

$$P_2=\frac{P}{p_2}=\frac{105}{5}=21,$$

$$P_3=\frac{P}{p_3}=\frac{105}{7}=15.$$

Then, we compute the multiplicative inverse, which consists in finding $P_i^{-1}$, such that $P_i^{-1}·P_i\equiv 1mod{p}_i$. Therefore,

$${\left|P_1^{-1}\right|}_3=2,$$

$${\left|P_2^{-1}\right|}_5=1,$$

$${\left|P_3^{-1}\right|}_7=1.$$

Next, we use Formula (2) to calculate the value of $X$:

$$X={\left|35·2·2+21·2·1+15·3·1\right|}_{105}={\left|227\right|}_{105}=17$$

Finally, we compare $X$ with $P/2$; then, $17<\frac{105}{2}$ or $17<52.5$. Therefore, the number is positive.

Algorithm 1 presents the pseudocode of the CRT method.

Algorithm 1: CRT Method.

Input: $P$$,\left(x_1,x_2,\dots ,x_n\right)$$,\left(p_1,p_2,\dots ,p_n\right)$,$\mathrm{and}\left(P_1,P_2,\dots ,P_n\right)$ Output:$S$ $1.sum=0$ $2.\mathrm{for}i=1$$\mathrm{to}n$ do: $2.1sum+=x_i{\left|P_i^{-1}\right|}_{p_i}{P}_i$ $3.X=sum\mathrm{mod}P$ $4.\mathrm{if}X<P/2$: 4.1 $S=1$ 5. else: $5.1S=0$

However, this method has a significant drawback due to the divisions to obtain $X$. The division of large numbers by a large $P$ increases the time required for calculations.

3.2. Mixed Radix Conversion Method

The Mixed Radix Conversion (MRC) method consists of a consecutive translation of a number from RNS to WNS. In addition, a pattern in the number in a generalized form is traced by $y_i={\left(U_i·V_i\right)}_{{\rho }_i}$, where $U_i$ is known as the conversion coefficient and defines an increasing series

$$U_1=x_1,$$

$$U_2={\left|x_2-x_1\right|}_{p_1},$$

$$U_3={\left|x_3-x_2-x_1{U}_2\right|}_{p_1}.$$

Yassin and Moore [24] found that

$$V_1=1,$$

$$V_2={\left|\frac{1}{p_1}\right|}_{p_2}=1,$$

$$V_3={\left|\frac{1}{p_1{p}_2}\right|}_{p_3}=1.$$

Example 2.

The initial data are a set of moduli $(127,63,50,13)$, a set of residues $(78,41,47,7)$, $V_1=1,V_2=1,V_3=1,$ and $V_4=1$.

First, we find the $y_i$ coefficients:

$$y_1=U_1·V_1=78,$$

$$y_2=U_2·V_2={\left|41-78\right|}_{63}·1=26,$$

$$y_3=U_3·V_3={\left|47-78-127·26\right|}_{50}·1=17,$$

$$y_4=U_4·V_4={\left|7-78-127·26-127·63·17\right|}_{13}·1=9.$$

Second, the number is restored by (2)

$$X=78+26·127+17·127·63+9·127·633·50=\mathrm{3,739,847}.$$

Finally, we compare $X$ with $P/2$; then, $\mathrm{3,739,847}<\mathrm{5,200,650}$. Therefore, the number is positive. Time complexity is $O\left(n^2·l^2\right).$

Algorithm 2 describes the pseudocode of the MRC method.

Algorithm 2: MRC Method.

Input: $\left(x_1,x_2,\dots ,x_n\right)$ and $\left(p_1,p_2,\dots ,p_n\right)$ Output:$S$ 1. $U_1=x_1$, $k_1=0$, $h=1$, and $P=1$ 2. for $i=2$ to $n$ do 2.1 $h\ast =n_{i-1}$ 2.2 $U_i=\left(x_i-x_1-k_{i-1}\right)mod{p}_i$ 2.3 $k_i=U_i\ast h-k_{i-1}$ 3. $sum+=U_{i}mod{p}_i$ 4. for $i=1$ to $n$ do 4.1 $P\ast =p_i$ 4.2 $sum+=P\ast \left(U_i\right)mod{p}_i$ 5 $X=sum$ 6 if$X<P/2$: 6.1 $S=1$ 7. else: $7.1S=0$

Effective implementation of this method allows avoiding division by a large $P$. However, the method uses many modular operations related to the vector $\left(p_1,p_2,\dots ,p_n\right)$.

3.3. Approximate Method

The algorithm for finding the Euclidean division by the range RNS is computationally complex. To reduce the computational complexity of the Approximate Method (AM), it is proposed to use weighted coefficients, which allow replacing the operation of Euclidean division with the operation of taking a fractional part.

AM is based on the mapping from $\left[0,P-1\right]$ to $\left[0,2\right)$ to avoid the division by a large $P$.

The mapping allows calculating the positional characteristic of the number, hence, to determine the sign of the number or compare numbers with each other. The positional characteristic is originally calculated as:

$$V\left(X\right)={\left|\sum _{i=1}^n{\left(\frac{2}{p_i}\left|{\left|P_i^{-1}\right|}_{p_i}·x_i\right|\right)}_{2^{-N}}\right|}_2.$$

(3)

However, the use of (3) as a positional characteristic requires the use of rational fractions or their approximation using numbers with a fixed precision, which increases the computational complexity of the algorithm. In [25], a modification of the methods from [5] was proposed, which allows retaining the advantages of the method from [5] but at the same time avoiding the use of rational numbers.

$$VC\left(X\right)={\left|\sum _{i=1}^n{W}_i·x_i\right|}_{2^N},$$

(4)

where $W_i=\lceil 2^N{\left|P_i^{-1}\right|}_{p_i}/p_i\rceil$, with $N=\lceil {\log }_2\left(P\rho \right)\rceil$, and $\rho =-n+\sum _{i=1}^n{p}_i$. If $VC\left(X\right)<2^{N-1}$ then $X>0$ else $X<0$. Time complexity is $O\left(\left(n+1\right)l·{\log }_2\left(\left(n+1\right)l\right)\right).$

Example 3.

$X=(1,2,3)$, moduli RNS: $(11,12,13)$, $P=p_1·p_2·p_3=1716$, $P_1=\frac{P}{p_1}=156$, $P_2=\frac{P}{p_2}=143$, $P_3=\frac{P}{p_3}=132,$$\rho =-3+11+12+13=33$, and $N=\lceil {log}_2(33·1716)\rceil =16$.

We calculate the coefficients $W_i$:

$$W_1=\lceil \frac{2^N{\left|P_1^{-1}\right|}_{p_1}}{p_i}\rceil =\lceil \frac{2^{16}{\left|{156}^{-1}\right|}_{11}}{11}\rceil =\mathrm{35,747},W_2=\lceil \frac{2^N{\left|P_2^{-1}\right|}_{p_2}}{p_2}\rceil =\lceil \frac{2^{16}{\left|{143}^{-1}\right|}_{12}}{12}\rceil =\mathrm{60,075},$$

$$W_3=\lceil \frac{2^N{\left|P_3^{-1}\right|}_{p_3}}{p_3}\rceil =\lceil \frac{2^{16}{\left|{132}^{-1}\right|}_{13}}{13}\rceil =\mathrm{35,289}$$

Thus, we can translate the number based on the coefficients

$$VC\left(X\right)={\left|\mathrm{35,747}·1+\mathrm{60,075}·2+\mathrm{35,289}·3\right|}_{2^{16}}=\mathrm{65,156}$$

Therefore, the number is negative because $\mathrm{65,156}>2^{15}$.

Algorithm 3 shows the pseudocode of the AM.

Algorithm 3: AM Method.

Input: $\left(x_1,x_2,\dots ,x_n\right)$, $\left(W_1,W_2,\dots ,W_n\right),$ and N Output:$S$ 1. for $i=1$ to $n$ do 1.1 $sum+=W_i·x_i$ 2 $X=summod{2}^N$ 3. if$\left(X\gg \left(N-1\right)\right)==1$: 3.1 $S=1$ 4. else: $4.1S=0$

3.4. Diagonal Function

The positional characteristic of a number in RNS can be also determined by the so-called Diagonal Function (DF), which is defined by $D\left(X\right)=\sum _{i=1}^n\lfloor \frac{X}{p_i}\rfloor$ [2]. To calculate $D\left(X\right)$ using moduli RNS, use the following formula:

$$D\left(X\right)={\left|\sum _{i=1}^n{k}_i^{*}·x_i\right|}_{SQ},$$

(5)

where $k_i^{*}={\left|-P_i^{-1}\right|}_{SQ}$, $SQ=P_1+P_2+\dots +P_n$.

The sign of the number depends on the comparison of $D\left(X\right)$ and $SQ/2$. Let us look at an example of comparing numbers. The time complexity of the algorithm is $O\left({\left(\left(n-1\right)l+{\log }_{2}n\right)}^2\right).$

Example 4.

We consider the numbers of previous examples, $X=(2,2,3)$ and moduli $(3,5,7)$. First, we calculate the values $SQ=35+21+15=71$ and $k_i^{\ast }$.

$$k_1^{*}={\left|-p_1^{-1}\right|}_{71}={\left|-3^{-1}\right|}_{71}=47,$$

$$k_2^{*}={\left|-p_2^{-1}\right|}_{71}={\left|-5^{-1}\right|}_{71}=14,$$

$$k_3^{*}={\left|-p_3^{-1}\right|}_{71}={\left|-7^{-1}\right|}_{71}=10.$$

Then, we find the value of the DF:

$$D\left(X\right)={\left|2·47+2·14+3·10\right|}_{71}=10.$$

Since $10<71/2$, then $X$ is positive.

Algorithm 4 describes the pseudocode of the DF method.

Algorithm 4: DF Method.

Input$:SQ$$,\left(x_1,x_2,\dots ,x_n\right)$$,\mathrm{and}\left(k_1^{*},k_2^{*},\dots ,k_n^{*}\right)$ Output$:S$ $1.\mathrm{for}i=1$$\mathrm{to}n$ do $1.1sum+=k_i^{*}·x_i$ $2X=summodSQ$  $3.\mathrm{if}X<SQ/2$: $3.1S=1$ 4. else: $4.1S=0$

3.5. Core Function

Burgess [26] proposed the minimal Akushsky Core Function (CF) based on the result obtained in [27,28]. This approach is similar to the DF method, and it does not need to calculate the critical cores.

The analytical form of the Pirlo function is calculated as:

$$Pi\left(X\right)={\left|\sum _{i=1}^n{k}_i^{**}·x_i\right|}_{P_n},$$

(6)

where $k_i^{**}=\left|\frac{{\left|P_i^{-1}\right|}_{p_i}·P_i}{p_n}\right|.$

If $Pi\left(X\right)<P_n/2$, then the number is positive, since the function under study is monotonically increasing. Time complexity is $O({\left(n-1\right)}^2{l}^2).$

Let us consider an example of comparing numbers.

Example 5.

We take the numbers of previous examples, $X=(2,2,3)$ and moduli $(3,5,7)$. First, let us calculate the values $P_3=15$ and $k_i^{**}$ as:

$$k_1^{**}=\left|\frac{{\left|P_1^{-1}\right|}_{p_1}·P_1}{p_3}\right|=\left|\frac{2·35}{7}\right|=10,$$

$$k_1^{**}=\left|\frac{{\left|P_2^{-1}\right|}_{p_2}·P_2}{p_3}\right|=\left|\frac{1·21}{7}\right|=3,$$

$$k_1^{**}=\left|\frac{{\left|P_3^{-1}\right|}_{p_3}·P_3}{p_3}\right|=\left|\frac{1·15}{7}\right|=2.$$

Then, we compute the Pirlo function:

$$Pi\left(X\right)={\left|2·10+2·3+3·2\right|}_{15}=2.$$

Since $2<15/2$, the number is positive.

Algorithm 5 describes the pseudocode of the CF method.

Algorithm 5: CF Method.

Input$:P_n$$,\left(x_1,x_2,\dots ,x_n\right)$$,\mathrm{and}\left(k_1^{**},k_2^{**},\dots ,k_n^{**}\right)$ Output$:S$ $1.\mathrm{for}i=1$$\mathrm{to}n$ do $1.1sum+=k_i^{**}·x_i$ $2.X=summod{P}_n$ $3.\mathrm{if}X<P_n/2$: $3.1S=1$ 4. else: $4.1S=0$

3.6. Determining the Sign of a Number

Knowing the sign of a number can increase the performance of number comparison in RNS; the difference between numbers $X$ and $Y$ provides information about their comparison. Determining the Sign of a Number (DSN) in RNS is based on the fact that the residues $\overline{x_i}$ of the negative number $X$ are the complement of $x_i$ to the modulus $p_i$. Hence, the following relationship holds:

$$S\left(X\right)=\{\begin{array}{c}0,if0\le X<\frac{P-1}{2},\\ 1,if\frac{P-1}{2}\le X<P.\end{array}$$

(7)

The formula based on CRT and an AM allows determining the sign of the number based on the following equation [29].

$$\frac{X}{P}={\left|{\sum }_{i=1}^n\frac{x_i·{\left|P_i^{-1}\right|}_{p_i}}{p_i}\right|}_1<\frac{1}{2}.$$

(8)

$X>0$ if the equation holds; otherwise, $X<0$.

Let us consider the algorithm for comparing numbers in RNS based on DSN.

Example 6.

Let the number in RNS be $(1,0,4)$ with the basis $(3,5,7)$. We determine the sign of the number by calculating Formula (8):

$$\frac{X}{P}={\left|\sum _{i=1}^3\frac{x_i·{\left|P_i^{-1}\right|}_{p_i}}{p_i}\right|}_1={\left|\frac{2}{3}+\frac{4}{7}\right|}_1=\frac{5}{21}<\frac{1}{2}.$$

So, the number is positive.

Algorithm 6 shows the pseudocode of the DSN method.

Algorithm 6: DSN Method.

Input$:\left(x_1,x_2,\dots ,x_n\right)$$,\left(p_1,p_2,\dots ,p_n\right)$$,\mathrm{and}\left({\left|P_1^{-1}\right|}_{p_1},{\left|P_2^{-1}\right|}_{p_2},\dots ,{\left|P_n^{-1}\right|}_{p_n}\right)$ Output$:S$ $1.\mathrm{for}i=1$$\mathrm{to}n$ do: $1.1S+=\frac{x_i·{\left(P_i^{-1}\right)}_{p_i}}{p_i}$ $2.S=Smod1$ $3.\mathrm{if}S<\frac{1}{2}$: $3.1S=1$ 4. else: $4.1S=0$

3.7. Modified Diagonal Function

The Modified Diagonal Function (MDF) method reduces the computational complexity of comparing numbers in the RNS [5]. It proposes a new positional characteristic based on the DF and an AM. The essence of the MDF method is to calculate the relative value of the DF to $SQ$, which allows replacing the computationally complex operation of finding the residue of division by $SQ$ by taking the fractional part of the number, and the coefficients $k_i^{*}$ are replaced by the relative value $k_i^{*}$ of $SQ$ in Formula (5).

$$D^{\prime }\left(X\right)={\left|\sum _{i=1}^n{\widehat{k}}_i·x_i\right|}_{2^{N_M}},$$

(9)

where ${\widehat{k}}_i=\left[k_i^{\ast }·\frac{2^{N_M}}{SQ}\right]$, $N_M>\left[{\log }_2(SQ·\left(m-1\right))\right]$, and $m=\underset{1\le i\le n}{\max }{p}_i$.

Let us look at an example of comparing numbers. Time complexity is

$$O\left(\left(\left(n-1\right)l+{\log }_{2}n\right){\log }_2\left(\left(n-1\right)l+{\log }_{2}n\right)\right).$$

Example 7.

We use the previously numbers $X=(2,2,3)$ and moduli $(3,5,7)$. Then, we take $2^{N_M}=8.755$ and value $k_i^{*}$ from the diagonal function:

$$SQ=35+21+15=71,$$

$$k_1^{*}={\left|-p_1^{-1}\right|}_{71}={\left|-3^{-1}\right|}_{71}=47,$$

$$k_2^{*}={\left|-p_2^{-1}\right|}_{71}={\left|-5^{-1}\right|}_{71}=14.$$

We calculate ${\widehat{k}}_i$

$${\widehat{k}}_1=47·\frac{8.755}{71}=5.795,$$

$${\widehat{k}}_2=14·\frac{8.755}{71}=1.722,$$

$${\widehat{k}}_3=10·\frac{8.755}{71}=1.23.$$

We find the value of the MDF:

$$D^{\prime }\left(X\right)={\left|2·5.795+2·1.722+3·1.23\right|}_{8.755}=1.214.$$

The number is positive, since $1.214<8.755/2$. Algorithm 7 shows the pseudocode of the MDF method.

Algorithm 7: MDF Method.

Input$:\left(x_1,x_2,\dots ,x_n\right)$$,\left({\hat{k}}_1,{\hat{k}}_2,\dots ,{\hat{k}}_n\right)$$,\mathrm{and}{2}^{N_M}$ Output$:S$ $1.\mathrm{for}i=1$$\mathrm{to}n$ do $1.1sum+={\widehat{k}}_i·x_i$ $2.X=summod{2}^{N_M}$ $3.\mathrm{if}X<2^{N_M}/2$: $3.1S=1$ $4.\mathrm{else}:$ $4.1S=0$

3.8. Determining the Sign of a Number in RNS with an Even Range

Here, we propose the efficient method Determining the Sign of a Number (DSN) in RNS with an Even Range (DSN-EN) for comparing numbers and determining the sign of a number for the case of an even RNS range.

Since the RNS range is an Even Number (EN), one of the RNS moduli is an EN. Without loss of generality, we assume that the module $p_n$ is even; then, using the property $\lfloor \frac{\lfloor \frac{X}{a}\rfloor }{b}\rfloor =\lfloor \frac{X}{a·b}\rfloor$, the determination of a sign is reduced to a two-stage algorithm.

The first stage is dividing by an integer $P_n=\frac{P}{p_n}$. The second stage is dividing by an integer $\frac{p_n}{2}$.

Formally, it is determined by the following formula:

$$S\left(X\right)=\lfloor \frac{2·X}{P}\rfloor =\lfloor \lfloor \frac{X}{P_n}\rfloor ·\frac{2}{p_n}\rfloor .$$

(10)

The correctness of (10) follows from the proof of the following Theorem 1.

Theorem 1.

If $X,a,$ and $b$ are integer numbers with $a,b\ge 2$, then the equality holds:

$$\lfloor \lfloor \frac{X}{a}\rfloor ·\frac{1}{b}\rfloor =\lfloor \frac{X}{a·b}\rfloor .$$

(11)

Proof. 

Due to $\frac{X}{a}=\frac{X-{\left|X\right|}_a}{a}$, Equality (11) takes the form:

$$\lfloor \lfloor \frac{X}{a}\rfloor ·\frac{1}{b}\rfloor =\lfloor \frac{X-{\left|X\right|}_a}{a·b}\rfloor .$$

(12)

We represent $X$ in the form $X=a·b·\lfloor \frac{X}{a·b}\rfloor +{\left|X\right|}_{a·b}$. Substituting it in (12), we have:

$$\lfloor \frac{X-{\left|X\right|}_a}{a·b}\rfloor =\lfloor \frac{X}{a·b}\rfloor +\lfloor \frac{{\left|X\right|}_{a·b}-{\left|X\right|}_a}{a·b}\rfloor .$$

(13)

Let $X=\omega ·a+\gamma$, where $0\le \gamma \le a-1,$ we obtain:

$${\left|\omega ·a\right|}_{a·b}=\omega ·a-\lfloor \frac{\omega ·a}{a·b}\rfloor ·a·b=a\left(\omega -\lfloor \frac{\omega }{b}\rfloor ·b\right)=a·{\left|\omega \right|}_b.$$

(14)

Considering that $0\le {\left|\omega \right|}_b\le b-1$, then

$$0\le a·{\left|\omega \right|}_b+\gamma \le a·\left(b-1\right)+a-1=a·b-1$$

and

$${\left|X\right|}_{a·b}={\left|\omega ·a+\gamma \right|}_{a·b}={\left|{\left|\omega ·a\right|}_{a·b}+\gamma \right|}_{a·b}={\left|a·{\left|\omega \right|}_b+\gamma \right|}_{a·b}=a·{\left|\omega \right|}_b+\gamma .$$

Hence, ${\left|X\right|}_{a·b}-{\left|X\right|}_a=a·{\left|\omega \right|}_b+\gamma -\gamma =a·{\left|\omega \right|}_b$ and

$$\lfloor \frac{{\left|X\right|}_{a·b}-{\left|X\right|}_a}{a·b}\rfloor =\lfloor \frac{{\left|\omega \right|}_b}{b}\rfloor =0.$$

Substituting this result in (13), we have:

$$\lfloor \frac{X-{\left|X\right|}_a}{a·b}\rfloor =\lfloor \frac{X}{a·b}\rfloor .$$

The theorem is proved. □

Corollary 1.

Equation (10) is correct.

Proof. 

Let $a=P_n$ and $b=\frac{p_n}{2}$. Since $p_n$ is an even number, then $\frac{p_n}{2}$ is an integer number. Therefore, the conditions of Theorem 1 are satisfied and the corollary is proved. The time complexity of the algorithm is $O\left(n^{2}l\right)$. □

Example 8.

Let the RNS be given by the moduli $p_1=17,p_2=19,p_3=23,$ and $p_4=32$. We determine the sign of a number $X=(16,18,22,15)$ and $Y=(0,0,0,16)$. Let us calculate the synoptic weights:

$$w_{1,2}={\left|p_1^{-1}\right|}_{p_2}={\left|\frac{1}{17}\right|}_{19}=9,$$

$$w_{1,3}={\left|p_1^{-1}\right|}_{p_3}={\left|\frac{1}{17}\right|}_{23}=19,$$

$$w_{1,4}={\left|p_1^{-1}\right|}_{p_4}={\left|\frac{1}{17}\right|}_{32}=17,$$

$$w_{2,3}={\left|p_2^{-1}\right|}_{p_3}={\left|\frac{1}{19}\right|}_{23}=17,$$

$$w_{2,4}={\left|p_2^{-1}\right|}_{p_4}={\left|\frac{1}{19}\right|}_{32}=27,$$

$$w_{3,4}={\left|p_3^{-1}\right|}_{p_4}={\left|\frac{1}{23}\right|}_{32}=7.$$

The number $X$ is positive since

$$S\left(X\right)=\lfloor 2·\frac{x_4^{\left(3\right)}}{p_4}\rfloor =\lfloor 2·\frac{15}{32}\rfloor =0<1,$$

and $Y$ is negative because

$$S\left(Y\right)=\lfloor 2·\frac{y_4^{\left(3\right)}}{p_4}\rfloor =\lfloor 2·\frac{16}{32}\rfloor =1.$$

Algorithm 8 shows the pseudocode of the DSN with the EN method.

Algorithm 8: DSN-EN.

Input$:\left(x_1,x_2,\dots ,x_n\right)$$,\left(p_1,p_2,\dots ,p_n\right)$$,\mathrm{and}\left(w_{1,2},w_{1,3},\dots ,w_{n,n}\right)$ Output$:S$ $1\mathrm{for}i=1$$\mathrm{to}n$ do $1.1\mathrm{for}j=i+1$$\mathrm{to}n$ do 1.1.1 $x_j={\left|\left(x_j-x_i\right)·w_{i,j}\right|}_{p_j}$ $2.\mathrm{if}\left|2·\frac{x_n}{p_n}\right|<1$: $2.1S=1$ $4.\mathrm{else}:$ $4.1S=0$

4. Performance Evaluation

The proposed algorithm described in Section 3.8 has the advantage among the methods described in Section 3.

To confirm the properties, we implement all the algorithms using the high-level language C++ and compare their performance. The experiments are carried out on operating systems Windows 10 Home Edition on a computer with Intel Core i5-8250U 1.60 GHz, RAM DDR4 8 GB 1196 MHz, and SSD 512 GB.

For the analysis, we use a 128-bit number transferred to RNS, a set of six RNS moduli, and a width of 24 to 64 bits. We vary a vector length of 3 to 8 moduli with a 32-bit width.

The experimental results report the maximum, minimum, and average of 10,000 runs of each method. Additionally, we incorporate the average calculated based on the maximum and minimum values.

The information of the execution is presented in Appendix A. For simplicity, we only analyze the significant discoveries of the results. The average values have stable linear growth. The minimum values are prevailing because the average values of each method are very close to them. Hence, the maximum values are not common causes.

To avoid time measuring biases, the mean values are calculated as the average of 10,000 measuring of the maximum values and 10,000 measuring of the minimum values. We also consider the medium values of all methods to determine the most efficient ones.

Comparative Analysis

The performance of all methods for the operations of determining the sign of a number and number comparison is presented in Figure 1. DSN-EN has the highest performance for both operations with different numbers of modules $p$ and dynamic bit width. AM, DF, and MDF are in the group of the second most efficient methods for all operations.

The results with a different number of modules $p$ show: Considering the sign detection with respect to DSN-EN, the efficiency of AM is between 1.93 and 5.64 times worst. Likewise, DF and MDF are from 2.44 to 6.1 and from 2.11 to 5.64 times worst, respectively. Similar results present the comparison of numbers, DSN-EN improves AM within 1.55–4.6 times, DF among 1.75–4.47 times, and MDF within 1.93–4.57 times.

The results of comparison with different dynamic bit widths exhibit that DSN-EN is more efficient than MDF from 2.68 to 3.61 times, AM within 2.93–3.46 times, and MD between 2.97 and 3.44 times. For comparison of numbers, the differences are in 2.45–3.47, 2.48–3.47, and 2.56–3.43 for AM, DF, and MDF, respectively.

Figure 2 present a comparison between DSN-EN and AM, both methods with the best overall performance. From Figure 2a, we observe that the time difference is increased with respect to the number of modules for both operations. Figure 2b shows the execution time varying a dynamic bit width.

In general, the proposed method is several times more productive than AM, which was determined as the most efficient of the existing state-of-the-art ones. We consider that the DSN-EN can be applied efficiently in systems that use RNS.

5. Conclusions

Determining the sign of a number is fundamental for the implementation of several techniques with privacy preserving in untrusted environments. Current homomorphic encryption approaches try to make the implementation of this operation more efficient by using a residual number system. Unfortunately, the methods based on converting a number to a weight number system and determining the sign are inefficient and slow. The calculation of positional characteristics is better in performance but not efficient.

We propose a new method to determine the sign of a number in RNS and provide a theoretical foundation for when one modulo is an even number. We provide its performance evaluation compared with other determining the sign methods. The results show the advantages of our approach for different modules numbers and dynamic bit widths. In the future, we will study determining the sign of a number and comparing numbers in RNS for odd ranges.