On the IND-CCA1 Security of FHE Schemes

Abstract

Fully homomorphic encryption (FHE) is a powerful tool in cryptography that allows one to perform arbitrary computations on encrypted material without having to decrypt it first. There are numerous FHE schemes, all of which are expanded from somewhat homomorphic encryption (SHE) schemes, and some of which are considered viable in practice. However, while these FHE schemes are semantically (IND-CPA) secure, the question of their IND-CCA1 security is much less studied, and we therefore provide an overview of the IND-CCA1 security of all acknowledged FHE schemes in this paper. To give this overview, we grouped the SHE schemes into broad categories based on their similarities and underlying hardness problems. For each category, we show that the SHE schemes are susceptible to either known adaptive key recovery attacks, a natural extension of known attacks, or our proposed attacks. Finally, we discuss the known techniques to achieve IND-CCA1-secure FHE and SHE schemes. We concluded that none of the proposed schemes were IND-CCA1-secure and that the known general constructions all had their shortcomings.

1. Introduction

Fully homomorphic encryption (FHE) allows meaningful computation to be performed on encrypted material without decrypting it. Slightly more formally: for any circuit C, we require that Dec$\left(C\right(c\left)\right)=C($Dec$\left(c\right))$ for any ciphertext c. The notion was initially suggested in the late 1970s by Rivest et al. [1], and Gentry proposed the first successful FHE scheme in 2009 [2].

Ever since Gentry’s breakthrough, there has been much development in FHE, especially with regard to practicality. Although Gentry’s initial scheme was later implemented [3], it was little more than a proof-of-concept and far from being practical. Today, the situation is very different, with several FHE libraries and examples of practical applications to real-world problems. For instance, recent field trials in the financial sector [4] included applying homomorphic encryption in a machine learning pipeline, making it possible to outsource work and analyses previously limited to in-house treatment. Furthermore, an international ISO/IEC standard is due by 2024 [5], and NIST is tracking the progress of FHE as a privacy-enhancing technology [6].

As FHE moves further into the realm of practicality and real-world application, it is crucial to study the security of these schemes in detail. The security notion most FHE schemes have aimed for, and several provably achieved based on hardness assumptions, is indistinguishability under chosen plaintext attacks (IND-CPA). The security notion captures whether an adversary with access to the public key is able to distinguish between encryptions of messages, i.e., whether a ciphertext leaks information about its content.

However, IND-CPA offers no security guarantees if an adversary can obtain decryptions of ciphertexts. Such a scenario is hardly far-fetched, e.g., if a malicious cloud does not return the ciphertext arising from an honest computation, but rather an adulterine ciphertext, the cloud may observe if the client rejects the ciphertext as invalid by requesting a recomputation. Zhang et al. showed how such an attack may be used to construct a probabilistic decryption oracle [7]. Chillotti et al. [8] demonstrated that the very setup of FHE schemes makes them susceptible to reaction and safe error attacks.

Similarly, a padding oracle attack [9,10] enables one to decrypt arbitrary ciphertexts by making use of a server that only tells whether or not the padding of an encrypted message is valid. Furthermore, it is difficult to rule out any adversarial access to decrypted material in the settings with rich data flows where FHE is being, or suggested to be, used, for example in scenarios with multiple collaborating parties exchanging data or in combination with machine learning [11,12]. Finally, Cheon et al. [13] pointed out that some applications demand that decrypted values be shared with each involved party, not just those in possession of the secret key, and gave multi-party computation and differential privacy as examples of such applications. In short, IND-CPA is not sufficient to guarantee security in some of the scenarios where FHE is being used.

Beyond IND-CPA, there are additional levels of indistinguishability: IND-CCA1, where the adversary obtains a decryption oracle for a limited amount of time, and IND-CCA2, where the adversary obtains a decryption oracle that can be used at any time. It is well known that if an encryption scheme has any homomorphic property, it cannot achieve IND-CCA2 security. Finding a fully homomorphic encryption scheme that achieves IND-CCA1 security is still an open problem (in contrast, group homomorphic schemes can be IND-CCA1-secure, e.g., CS-lite [14]). Some generic constructions of FHE schemes achieving IND-CCA1 security have been suggested, but none of them have been instantiated. Furthermore, although these constructions provably achieve IND-CCA1 security, they do suffer from various shortcomings, as will be discussed in Section 6.

All acknowledged FHE schemes are constructed in the same way. The starting point is a somewhat or levelled homomorphic encryption (SHE or LHE) scheme, with noise-based encryption, able to perform a limited number of homomorphic operations on ciphertexts before correct decryption is not guaranteed. The “base scheme” is then expanded into an FHE scheme by homomorphically evaluating the decryption circuit on a ciphertext, which reduces the amount of noise in the ciphertext. This procedure is called bootstrapping and requires publishing some encrypted secret key material.

It is worth stressing that bootstrapping excludes IND-CCA1 security. After all, if an adversary may decrypt any ciphertext she/he chooses, she/he can simply choose to decrypt the published secret key material, which then allows her/him to decrypt other ciphertexts. Furthermore, several LHE and SHE schemes rely on publishing encrypted versions of various secret keys for other purposes than bootstrapping, such as key switching (e.g., BGV [15]) or relinearisation (e.g., BV11a and BV11b [16,17]), which makes homomorphic evaluations composable. Note that publishing such encryptions also prevents IND-CCA1 security. Hence, it seems that the best we can hope for is an IND-CCA1-secure SHE or LHE scheme that does not rely on key switching, relinearisation, or any other operation that requires publishing encryptions of secret keys. It is therefore precisely these types of schemes we evaluated with respect to IND-CCA1 security in this overview paper. We stress that there is no result stating that homomorphic encryption schemes cannot achieve IND-CCA1 security. However, the presently known methods of constructing these schemes prevent such a level of security from being obtained or introduce some shortcoming.

Almost no published SHE or LHE schemes aim at achieving IND-CCA1 security, but settle for IND-CPA. Furthermore, the schemes that have attempted to achieve IND-CCA1 security have, as we shall see, since been proven insecure. Several SHE and LHE schemes have been shown to be susceptible to adaptive key recovery attacks: an adversary is able to recover the secret key if she/he has access to a decryption oracle. However, since security against adversaries able to decrypt has not been strived for, vulnerable schemes have been developed and improved further in different ways, but not necessarily with any effort to make them IND-CCA1-secure or resilient against adaptive key recovery attacks. Dahab, Galbraith, and Morais [18] made this point as well: “There are adaptive key recovery attacks on many schemes and these schemes were adapted and optimised later; thus such constructions should be assessed in order to verify whether the attacks are still feasible”.

It is worth emphasizing that these adaptive key recovery attacks are not just a theoretical threat: as previously mentioned, it is possible to construct a (probabilistic) decryption oracle using reaction attacks [7], and there are use cases where decrypted material being made available to adversaries is either probable or inevitable. The fact that it is possible to mount attacks that recover the secret key also on LHE and SHE schemes, i.e., schemes that do not employ bootstrapping, makes assessing the security of these schemes especially pressing. These schemes are a natural alternative to bootstrapped FHE schemes if the users wish to avoid the risk of key recovery through the published bootstrapping key, and it is therefore important to assess whether there is still a risk of the secret key being recovered also for LHE and SHE schemes.

1.1. Our Contributions

In this overview paper, we provide precisely the assessment requested by Dahab et al.: we review all acknowledged SHE and LHE schemes with respect to adaptive key recovery attacks and show that all schemes are susceptible to such an attack, and we provide an overview stating which schemes are broken by which attack. We determined if the schemes were vulnerable to a previously published attack and provide novel attacks for those not susceptible to already known attacks. Seeing as schemes strongly inspired by earlier schemes are likely to be susceptible to the same attack, we also provide a table of scheme genealogy: an overview of which schemes have been directly based on which. Additionally, we provide an overview of which schemes are no longer deemed IND-CPA-secure. A summary of our findings with regard to security is listed in

Table 1. IND-CCA1 attacks and affected schemes. The second column lists schemes mentioned by the attack paper, while the third column lists schemes we found to be affected as well. An asterisk (*) denotes schemes that have been shown to not be IND-CPA-secure. Note that the paper by Loftus et al. presented both an attack and a scheme, where the asterisk denotes that the scheme is not IND-CPA-secure, and the attack breaks the schemes listed in the table. The two final rows are novel attacks.

Attack	Affected Schemes	Extends to
Chenal and Tang ((R)LWE) [11]	Bra12 [19], BGV [15], BV11a [16], BV11b [17], GSW [20]	CKKS [21], FV [22], BCIV [23], AN [24], CLPX [25], CIL [26], BV14 [27], BL [28], CCS [29], CM [30], CGGI [31], Jou [32], BP [33], AH [34], PS [35], CS17 [36]
Loftus et al. * (Ideal Lattice) [37]	Gen [2], GH * [3], SV *[38]	SS * [39], SV14 * [40]
Zhang et al. (AGCD) [41] and	CMNT [42], vDGHV [43]	CNT [44], CS15 [45]
Chenal and Tang (AGCD) [11]		CLT [46], CCKLLTY [47], KLYC [48]
Dahab et al. (NTRU) [18]	BLLN [49], LATV * [50]	RC * [51]
Fauzi et al. (other) [52]	LGM [53]
Section 5.2 (AGCD)	Per [54], BBL [55]
Section 5.3 (other)	DHPSSWZ [56], AFFHP [57]

. We also discuss the prospect of noiseless schemes and the existing generic constructions for IND-CCA1-secure homomorphic encryption schemes. However, we do not discuss implemented variants of schemes, e.g., if an implementation improves the bootstrapping procedure of a presented scheme, as it does not affect the achieved security of the basis scheme.

We grouped schemes into five broad categories primarily based on the underlying hardness problem: (R)LWE, ideal lattices, AGCD, NTRU, and “other”. Note that the schemes in the category “ideal lattices” are based on several hardness assumptions, which is why we prefer referring to this category by the structure on which the schemes are based. Furthermore, all the schemes based on AGCD are defined over the integers, and we also refer to these schemes as “integer-based schemes”. The motivation for this categorisation is that it essentially corresponds to groups of schemes susceptible to the same attack. For example, a large majority of the schemes based on AGCD is broken by an attack by Chenal and Tang [11]. The schemes in the fifth “other” category are schemes that are not based on either of the already mentioned hardness assumptions. For each category, we sketch the existing attacks and show that these attacks can be extended to several other SHE schemes in the same category by relatively easy modifications. As mentioned previously, we also provide novel attacks for the schemes not affected by any of the already known attacks or their extensions.

1.2. Related Work

The security notions mentioned so far all assume the decryption procedure returns an exact message: if m has been encrypted, an unaltered ciphertext will decrypt to exactly m. However, this is not the case for all homomorphic encryption schemes, most notably CKKS [21], where decryption returns an approximation of the message. This discrepancy was noted by Li and Micciancio [58], who also proposed a novel security notion for approximate encryption schemes, termed IND-CPA${}^D$, which reduces to IND-CPA for exact schemes, and showed that CKKS is not IND-CPA${}^D$-secure. They also presented a key recovery attack that does not rely on a decryption oracle, demonstrating the practical implication of the discovered insecurity. Cheon et al. published a report addressing the insecurity, discussed which applications the attack is applicable to, and introduced extensions to libraries to prevent the key recovery attack [13].

Loftus et al. [37] discussed attacks on homomorphic encryption schemes in the verification setting, IND-CVA, where the adversary has access to a verification oracle, rather than a decryption oracle, which determines if the decryption algorithm will output ⊥ when given a specific ciphertext c. Loftus et al. demonstrated that an IND-CCA1-secure scheme may be IND-CVA2-insecure, if the adversary has access to the verification oracle after she/he has received the challenge ciphertext [37]. The vast majority of homomorphic encryption schemes consider all elements in the ciphertext domain as valid inputs to the decryption procedure, though. In these settings, the verification oracle is of no help to the adversary, as all ciphertexts are valid.

However, Chillotti et al. [8] and Zhang et al. [7] argued that the notion of a verification oracle should be extended from whether a ciphertext decrypts, to whether a ciphertext decrypts to something meaningful. They presented the following scenario: A malicious cloud returns a “dishonest” ciphertext to a client who has asked for a computation. If this ciphertext does not decrypt to something the client deems meaningful or valid, the client will ask the cloud for a recomputation, thus leaking that the decryption was not meaningful, and similarly leaking that a decryption was meaningful if no action is taken. Either result leaks information about the decrypted result. Chillotti et al. and Zhang et al. showed that the very structure of homomorphic encryption makes the schemes susceptible to these fault injection, safe-error, and reaction attacks and that the attacks are a viable threat to real-world applications.

Finally, keyed homomorphic encryption is a primitive, suggested by Lai et al. [59], closely related to homomorphic encryption. Here, any homomorphic evaluation of a ciphertext requires access to a particular evaluation key, which does not enable decryption. Lai et al. suggested an instantiation of such a scheme and proved that encrypted messages are indistinguishable even if an adversary has access to a decryption oracle.

2. Preliminaries

2.1. Notation

We use two distinct modular reductions: $p=r$ mod q denotes centrally reducing p modulo q to $r\in (-q/2,q/2]$, whilst $p=rmodq$ denotes the modular reduction to $r\in [0,q-1]$. In both cases, we may also write $p\equiv r$mod q or $p\equiv rmodq$ if we wish to stress that p is equivalent to r modulo q: $p=r+nq$. This convention generalises to vectors and polynomials.

Vectors are denoted by bold lower case letters, whilst matrices are denoted by bold upper case letters. Normal letters are used to denote both integers and polynomials. We aimed to strike a balance between having a consistent notation throughout the paper and also not diverging too much from the original articles. For example, parameters are denoted by Greek letters for schemes defined over the integers, but not for the other schemes.

Several schemes use the gadget vector or matrix with respect to a base b and a parameter l: the gadget vector $\mathbf{g}$ is defined as the column vector ${(1,b,\cdots ,b^{l-1})}^T$, and the gadget matrix is defined as $\mathbf{G}={\mathbf{I}}_n\otimes \mathbf{g}\in {\mathbb{Z}}^{nl\times n}$ (i.e., $\mathbf{G}$ is a matrix with $\mathbf{g}$ on the “diagonal”). For an integer $a<b^l$, we define the function $g^{-1}\left(a\right):\mathbb{Z}\to {\mathbb{Z}}^l$ so that $g^{-1}\left(a\right)$ is the row vector with the (signed) base b decomposition of a, i.e., $g^{-1}(-a)=-g^{-1}\left(a\right)$ for a positive integer a, and $g^{-1}\left(a\right)·\mathbf{g}=a$. This notion extends naturally to vectors, so for an n-length vector $\mathbf{a}$, we define the function $G^{-1}\left(\mathbf{a}\right)=[g^{-1}\left(a_1\right),g^{-1}\left(a_2\right),\cdots ,g^{-1}\left(a_n\right)]\in {\mathbb{Z}}^{nl}$. The function extends similarly to matrices: for a matrix $\mathbf{A}\in {\mathbb{Z}}^{n\times n}$, $G^{-1}\left(\mathbf{A}\right)\in {\mathbb{Z}}^{n\times nl}$ simply applies $G^{-1}$ to each row of $\mathbf{A}$. Moreover, $G^{-1}\left(\mathbf{A}\right)·\mathbf{G}=\mathbf{A}$ [54].

We always denote schemes by the initials of the authors or the first three letters of the surname if there is a single author. This is mostly in line with the naming convention of the field, but we stress that we do this also for schemes with other proposed names, e.g., TFHE (CGGI [31]) and YASHE (BLLN [49]).

2.2. Notions

There are different flavours of homomorphic encryption, and we briefly present them here. As previously mentioned, all suggested schemes use the same approach of adding noise to a message to encrypt it, which builds up as the ciphertext is evaluated. If the noise grows too much, decryption is not guaranteed to be correct. For a more thorough discussion, see Appendix A:

• Somewhat homomorphic encryption (SHE) refers to schemes able to perform a limited number of homomorphic additions and/or multiplications before an evaluated ciphertext is not guaranteed to decrypt correctly. Although the number of operations may be estimated, it cannot be set explicitly;
• Levelled homomorphic encryption (LHE) schemes are similar to SHE schemes in that they allow for a limited amount of operations to be performed on a ciphertext. Here, though, the amount can be set explicitly and is included as a parameter, the “levels” L, in the key generation;
• Fully homomorphic encryption (FHE) allows for an unlimited number of homomorphic operations to be performed on a ciphertext. The only known way of achieving an FHE scheme is to bootstrap an SHE or LHE scheme.

It is required that all these types of schemes achieve compactness (not all definitions insist SHE schemes achieve compactness [60]): there exists a polynomial p such that the size of any evaluated ciphertext is less than $p\left(\lambda \right)$, where $\lambda$ is the security parameter of the scheme in question. In other words, the growth of an evaluated ciphertext should be independent of both the size of the circuit and, in the case of LHE, the level parameter L [60].

We refer to all three types of schemes collectively as *HE schemes to emphasise that the schemes are homomorphic both with respect to addition and multiplication. We also refer to them as “homomorphic encryption schemes”, which must not be confused with group homomorphic schemes.

We recall the notion of indistinguishability under (non-adaptive) chosen ciphertext attack (IND-CCA1) for an encryption scheme $\mathcal{E}=(\mathrm{KeyGen},\mathrm{Enc},\mathrm{Dec})$: any PPT adversary $\mathbb{A}$ has at most a $1/2+ϵ$ chance of winning the following game against a challenger $\mathcal{C}$, where $ϵ$ is negligible in the security parameter $\lambda$:

• $\mathcal{C}$ draws a key pair $(pk,sk)\leftarrow \mathrm{KeyGen}\left(params\right)$ and sends $pk$ to $\mathbb{A}$;
• $\mathbb{A}$ makes polynomially many ciphertext queries to her decryption oracle ${\mathcal{O}}_{\mathrm{Dec}}$, which returns Dec$\left(c\right)$ for any ciphertext c that $\mathbb{A}$ has sent it;
• $\mathbb{A}$ sends two plaintexts of equal length $(m_0,m_1)$ to $\mathcal{C}$;
• $\mathcal{C}$ returns $c\leftarrow \mathrm{Enc}(pk,m_b)$ to $\mathbb{A}$, for a randomly chosen bit $b\in \{0,1\}$;
• $\mathbb{A}$ outputs the bit $b^{*}$ and wins if $b^{*}=b$.

Here, $params$ denotes the security parameter $\lambda$ of the scheme and possibly other parameters output by a SetUp$\left(\lambda \right)$ algorithm. The notion of IND-CPA security is defined in a similar way, but here, $\mathbb{A}$ does not have access to a decryption oracle.

Finally, we note that all the attacks discussed in this paper are adaptive key recovery attacks, where an adversary with access to a decryption oracle is able to recover the secret key. These attacks are strictly stronger than a regular IND-CCA1 attack, as it allows an adversary to decrypt any ciphertext of her/his choosing, not just distinguishing between the encryptions of two chosen messages.

3. Schemes

Most schemes are grouped according to which known attack they are susceptible to, which largely corresponds to which problem they are based on, and we let the titles of the subsections reflect this. There are a handful of schemes that do not fit into either of these groups, i.e., not broken by a known attack nor based on the same problem as previously broken schemes, which are presented separately in Section 3.5. Finally, we briefly discuss noise-free *HE. Unless explicitly stated, none of the schemes or constructions discussed are fully homomorphic.

All the attacks presented in Section 4 and Section 5 only use decryption results of ciphertexts to reconstruct the secret key. We therefore focused on key generation, encryption, and decryption when presenting the schemes. In particular, we do not discuss the addition or multiplication algorithms of the schemes.

As previously mentioned, several schemes are based on earlier work, sometimes more or less copying a “base” scheme. We refer to such a base scheme as a “parent” and a scheme that has been based on it (and greatly resembles it) as its “child”; see

Table 2. The genealogy of various homomorphic schemes. “Children” are schemes directly based on the “parent” scheme. Schemes in bold are based on ideal lattices; schemes in italics are defined over the integers; the rest are schemes based on (R)LWE. Schemes that are not based directly on a parent scheme (“orphans”) are not listed.

Parent	Child(ren)
BGV [15]	CKKS [21]
Bra12 [19]	FV [22]
FV [22]	BCIV [23], AN [24], CLPX [25], CIL [26], AH [34]
GSW [20]	BV14 [27], BL [28], CM [30], CCS [29], CGGI [31], PS [35], BP [33], Jou [32]
Gen [2]	SS [39]
SV [38]	GH [3], LMSV [37], SV14 [40]
vDGHV [43]	CLT [46], KLYC [48], CNT [44], CCKLLTY [47], CMNT [42]

for an overview of this genealogy. Seeing as there are so many schemes with great similarities, we do not present all suggested *HE schemes, but rather the parent schemes, from which others are easily derived, and present a generalisation of all proposed schemes in the (R)LWE case. We also present “orphan” schemes: those that are not directly based on earlier work.

Finally, we note that, for simplicity, some encryption schemes are presented as a symmetric key, rather than as a public key. For all the schemes where this is the case, there is a standard transformation to make the scheme a public key (see, e.g., [43]): the secret key remains the same, and the public key is a set of different encryptions of the additive identity element in the message space, e.g., zero. A message m is then, roughly speaking, encrypted by adding a small, random subset of the public key to m or an encoding of m, whilst decryption is the same as in the symmetric scheme. For details on the transformation of a specific scheme, the reader is referred to the original article of the scheme in question.

3.1. (R)LWE

There are several (R)LWE-based *HE schemes, most of which are children of BGV [15], Bra12 [19], or GSW [20]. These schemes have a common structure:

• The private key is a vector $\mathbf{s}\in R^n$ for some polynomial ring R (in the case of RLWE) or for $R={\mathbb{Z}}_q$ (in the case of LWE). For RLWE, $n=1$. The private key is drawn from either a bounded Gaussian distribution or a uniform distribution over polynomials with binary or ternary coefficients;
• The public key generation first computes an (R)LWE sample ${\mathit{a}}^{\prime }=\mathit{A}\mathit{s}+\mathit{e}$, where $\mathit{A}\in R^{N\times n}$ is a randomly sampled matrix and $\mathit{e}\in R^N$ is sampled from a noise distribution $\chi$. Then, the public key $\mathit{PK}\in R^{N\times (n+1)}$ is constructed using $\mathit{A}$ and ${\mathit{a}}^{\prime }$ such that $\mathit{PK}·(-\mathit{s}\parallel 1)=\mathit{e}$;
• Encryption of a message $m\in \mathbb{M}$ first encodes it as ${\mathit{m}}^{\prime }\in R^{n+1}$ (e.g., ${\mathit{m}}^{\prime }=(0,\dots ,0,m)$), samples some randomness $\mathit{r}\in R^N$, and outputs $c=\mathit{r}·\mathit{PK}+{\mathit{m}}^{\prime }\in R^{n+1}$. In some variants, ${\mathit{m}}^{\prime }$ and $\mathit{r}$ are matrices instead of vectors;
• Decryption parses the ciphertext as $c=(\mathbf{a},b)$ where $\mathit{a}\in R^n$ and $b\in R$, then computes $m=\rho (\langle \mathit{a},\mathit{s}\rangle -b)$ (for LWE) or $m=\rho (\mathit{a}·\mathit{s}-b)$ (for RLWE), where $\rho :R\to \mathbb{M}$ is a rounding function into the plaintext space.

3.2. Ideal Lattices

The most important schemes in this category are Gentry’s original scheme Gen [2] and its most notable children GH [3] and SV [38]. Gentry presented his original scheme in rather general terms, whereas later schemes are specialisations of it. As a consequence, the “general” scheme Gen is based on the bounded distance decoding problem (BDDP) and the sparse subset sum problem (SSSP), but the “specialisation schemes” GH, SV, and their children are based on a different, but related problem, namely the short principal ideal problem (SPIP). This computational assumption has since been proven insecure [61,62,63], meaning in particular that SV and its children (see Table 2) are not IND-CPA-secure.

For this reason, we chose not to present any particular scheme in this subsection, nor any attack later in the article. Instead, we mention that both GH and SV were proven to be susceptible to an adaptive key recovery attack, which also extends to Gen [18,37]. The LMSV scheme was suggested in the same paper as the attack [37], which was considered the only IND-CCA1-secure SHE scheme for many years. The starting point for the LMSV construction was the SV scheme, though, and it is therefore now known to not be IND-CPA-secure. We discuss the LMSV scheme and the construction it relied on in Section 6.1.

3.3. Approximate Greatest Common Divisor

3.3.1. vDGHV

The original homomorphic scheme defined over the integers was presented by van Dijk et al. [43], and we refer to it as vDGHV.

The bit-length $\eta$ of the secret key is chosen according to the security parameter $\lambda$, as is the noise distribution $\chi$. The symmetric encryption scheme is:

• KeyGen: Choose an odd integer p from the interval $[2^{\eta -1},2^{\eta })$. Output $sk=p$;
• Enc($p,m\in \{0,1\}$): Draw $q,r\leftarrow \chi$ such that $2r<p/2$, and output $c=pq+2r+m$;
• Dec($p,c$): Output $(c$ mod $p)mod2$.

The IND-CPA security of vDGHV is based on the difficulty of the approximate greatest common divisor (AGCD) problem: given a collection of ciphertexts, it should not be possible for an adversary to deduce p, the approximate greatest common divisor of the ciphertexts.

3.3.2. BBL

Another scheme based on the AGCD problem is BBL [55], which differs significantly from the vDGHV scheme. The BBL paper presented two schemes: a basic and a batched construction. Since the decryption of the batched construction is a generalisation of the basic one, we present the basic scheme here.

The scheme has public parameters $(\gamma ,\rho ,\eta ,\tau )$, all dependent on the security parameter $\lambda$. The parameter $\gamma$ is the bit-length of a component of the public key, and alongside $\rho$ and the secret key p, it defines the noise distribution ${\chi }_{\gamma ,\rho }$ used during key generation. For the parameters $\gamma ,\rho ,p$, the noise distribution is defined as follows: draw integers $q\leftarrow \mathbb{Z}\cap [0,2^{\gamma })$, $r\leftarrow \mathbb{Z}\cap (-2^{\rho },2^{\rho })$, and output $pq+r$. Additionally, $\tau$ defines the number of components in the public key, and finally, $\eta$ defines the bit-length of the secret key p. Recall that ${\mathbf{g}}^T$ is the $\gamma$-length gadget row vector, and $g^{-1}:\mathbb{Z}\to {\{0,1\}}^{\gamma }$ produces a column vector:

• KeyGen: Sample an $\eta$-bit integer p, and sample an integer $x_0\leftarrow {\chi }_{\gamma ,\rho }$ such that the bit-length is $\gamma$. Then, sample $\tau$ integers $x_i\leftarrow {\chi }_{\gamma ,\rho }$ such that $x_i\le x_0$ for $1\le i\le \tau$; we write $\mathbf{x}=[x_1,\cdots ,x_{\tau }]$. Output $pk=(x_0,\mathbf{x}),sk=p$;
• Enc($pk,m$): Draw a matrix $\mathbf{S}\leftarrow {\{0,1\}}^{\tau \times \gamma }$, and output $\mathbf{c}=m{\mathbf{g}}^T+\mathbf{x}\mathbf{S}$mod $x_0$;
• Dec($p,\mathbf{c}$): Compute $\mu =\mathbf{c}{g}^{-1}(p/2)$ mod p. If $\left|\mu \right|\ge p/4$, return one, else return zero.

3.3.3. Per

The schemes defined over the integers presented so far only encrypt single bits, although BBL may be batched. To remedy this, Pereira proposed a scheme that operates natively on vectors and matrices [54]. Furthermore, the size of the message space is a separate parameter that can be made as large as required.

The parameters of the scheme are similar to those of vDGHV and BBL: $\eta$ is the bit-length of the secret prime p, and $\gamma$ is the bit-length of the integer $x_0$ used for modular reductions of ciphertexts. There is also the noise distribution $\chi$ and noise parameter $\rho$. In addition, the scheme relies on the dimension n of vectors and matrices being encrypted and the bound B on message size: for any integer m being encrypted, we have $\left|m\right|\le B$, which naturally extends to vectors and matrices. Finally, we also have the parameter b, which is the base for the gadget matrix/vector, and the gadget decomposition function $G^{-1}$. We note that the scheme is designed so that the matrix and vector encryption and decryption use the same secret key material and that the scheme only allows for matrix–matrix and vector–matrix multiplications:

• KeyGen($\lambda ,B,n,\eta ,\rho ,{\rho }_0,\gamma$): Draw an $\eta$-bit prime p, then sample $x_0$ from ${\chi }_{{\rho }_0,p}$ such that the bit-length of $x_0$ is $\gamma$ and $x_0=qp+r$ for $\left|r\right|\le 2^{{\rho }_0}$. Sample $\mathbf{K}$ uniformly from ${\mathbb{Z}}_{x_0}^{n\times n}$ until ${\mathbf{K}}^{-1}mod{x}_0$ exists. Finally, define $\alpha =\lfloor \frac{2^{\eta -1}}{2B+1}\rceil$; output $sk=(p,\mathbf{K})$; update the set of public parameters $\{B,n,\eta ,\rho ,{\rho }_0,\gamma \}$ to include $\{\alpha ,x_0\}$;
• EncMat($sk,\mathbf{M}$): Construct the matrix $\mathbf{X}=p\mathbf{Q}+\mathbf{R}$ by sampling each matrix element from $\chi <x_0$, which only outputting elements smaller than $x_0$. Compute $\mathbf{C}=(\mathbf{X}+\mathbf{G}\mathbf{K}\mathbf{M}){\mathbf{K}}^{-1}$ mod $x_0$, and output $\mathbf{C}$;
• DecMat($sk,\mathbf{C}$): Compute ${\mathbf{C}}^{\prime }=G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right)\mathbf{C}\mathbf{K}$ mod $x_0$, then ${\mathbf{C}}^{*}={\mathbf{C}}^{\prime }$ mod p, and finally, output $\lfloor {\mathbf{C}}^{*}/\alpha \rceil$;
• EncVec($sk,\mathbf{m}$): Construct an n-length vector $\mathbf{x}=p\mathbf{q}+\mathbf{r}$, again by sampling every vector element from ${\chi }_{<x_0}$. Compute and output $\mathbf{c}=(\mathbf{x}+\alpha \mathbf{m}){\mathbf{K}}^{-1}$;
• DecVec($sk,\mathbf{c}$): Compute ${\mathbf{c}}^{\prime }=\mathbf{c}\mathbf{K}$ mod $x_0$, then ${\mathbf{c}}^{*}={\mathbf{c}}^{\prime }$ mod p. Return $\lfloor {\mathbf{c}}^{*}/\alpha \rceil$.

The indistinguishability of ciphertexts is based on AGCD, as the hardness of AGCD ensures that the distribution from which $\mathbf{X}$ and $\mathbf{x}$ are drawn is indistinguishable from the uniform distribution over ${\mathbb{Z}}_{x_0}$ (Lemma 3 of [54]). Using this indistinguishability, security is proven by a hybrid argument.

3.4. NTRU

There are three schemes that closely resemble NTRU: LATV [50], RC [51], and BLLN [49]. Despite great similarities, they are based on different problems: BLLN is based on RLWE, whilst LATV and RC are based on the decisional small polynomial ratio (DSPR) problem (defined in [50]), which may be regarded as the standard NTRU problem restricted to a specific set of parameters.

Albrecht et al. [64] found an attack on LATV that recovered the secret key using only the public material, and the same attack was later shown to apply to the RC scheme [65]. The attack takes advantage of precisely the specific parameters of the DSPR problem, implying that neither LATV nor RC are IND-CPA-secure, and we therefore do not discuss these schemes further.

Despite the similarities between the schemes, BLLN is not affected by the Albrecht et al. attack, and we present the scheme below. BLLN is based on the version of NTRU proven by Stehlé and Steinfeld to be as secure as RLWE [66]. The size of the parameters chosen for BLLN ensures that the proof of the security of Stehlé and Steinfeld extends to BLLN as well. This is not the case for LATV or RC, which is why these schemes reduce to the DSPR.

BLLN

The BLLN scheme is defined over the ring $R=\mathbb{Z}\left[x\right]/{\Phi }_d\left(x\right)$, where ${\Phi }_d\left(x\right)$ is the dth cyclotomic polynomial. Despite this general definition, we present the case where the ciphertext ring is $R=\mathbb{Z}\left[x\right]/(x^n+1)$ for n a power of two, as this is the parameter the authors mentioned specifically.

The plaintext space is defined as $R_p=R/pR$ and the ciphertext space as $R_q=R/qR$, for integers $p\ll q$, where we also require that $gcd(p,q)=1$. In addition, BLLN uses a bounded noise distribution ${\chi }_k$ defined over $R_q$ for key generation and a separate noise distribution, ${\chi }_e$, for encryption. Both of these noise distributions are typically some truncated discrete Gaussian, with bounds $B_k$ and $B_e$, respectively:

• ParamsGen($\lambda$): Given $\lambda$, fix n to determine the ring $\mathbb{Z}\left[x\right]/(x^n+1)$. The security parameter also determines the moduli q and p, as well as the noise distributions ${\chi }_k$ and ${\chi }_e$;
• KeyGen($n,q,p,{\chi }_k,{\chi }_e$): Draw $f^{\prime },g\leftarrow {\chi }_k$; set $f=p{f}^{\prime }+1$ mod q; compute $f^{-1}\in R_q$ (redrawing if $f^{-1}$ does not exist); output $(pk,sk)=(h=g{f}^{-1},f)$;
• Enc($pk,m\in [-p/2,p/2)$): Draw $r,e\leftarrow {\chi }_e$, and compute $c=\lfloor q/p\rfloor m+r+he$ mod q as an element of R;
• Dec($sk,c$): Compute and output $m=\lceil \frac{p}{q}(fc$ mod $q)\rfloor$ mod $p\in R$.

3.5. Miscellaneous Schemes

3.5.1. AFFHP

Albrecht et al. [57] proposed AFFHP, a scheme whose security relies on the hardness of computing Gröbner bases for ideals of multivariate polynomial rings and the ideal membership (IM) problem. The scheme works over the polynomial ring ${\mathbb{F}}_q[x_0,\dots ,x_{n-1}]$ for a prime q.

The IM problem states that for a general ideal $I\subset {\mathbb{F}}_q[x_0,\dots ,x_{n-1}]$, it is hard to determine if a random polynomial from ${\mathbb{F}}_q[x_0,\dots ,x_{n-1}]$ lies in I or not. AFFHP is designed with respect to general Gröbner bases for ideals in ${\mathbb{F}}_q[x_0,\dots ,x_{n-1}]$. However, homomorphic multiplication only works when a particular parameter d is equal to one, resulting in the reduced Gröbner basis always having the form $\mathsf{G}=\{x_0-a_0,x_1-a_1,\dots ,x_{n-1}-a_{n-1}\}$ for $a_i\in {\mathbb{F}}_q$. Since we were only concerned with schemes that are *HE, we only considered this case. Note that for any $f\in {\mathbb{F}}_q[x_0,\dots ,x_{n-1}]$, we will always have $fmod\mathsf{G}\in {\mathbb{F}}_q$ for Gröbner bases of the mentioned form.

The secret key of the scheme is $\mathsf{G}$, and the message space is $\{0,1\}$. A distribution of “small” polynomials e is used for noise. Encryption and decryption of the symmetric key variant of AFFHP then work as follows:

• Enc(m): Draw f of bounded degree at random from ${\mathbb{F}}_q[x_0,\dots ,x_{n-1}]$. Compute $f_0=f-(fmod\mathsf{G})$, and select $e\leftarrow \chi$ at random. Return $C=f_0+2e+m$;
• Dec(C): Compute and return $(Cmod\mathsf{G})mod2$.

3.5.2. DHPSSWZ

The SHE scheme DHPSSWZ was proposed by Doröz et al. [56], where the security is based on the finite-field isomorphism (FFI) problem. Informally, the FFI problem states that for a prime q, elements chosen from a particular distribution in one representation of the field ${\mathbb{F}}_{q^n}$ are distributed uniformly at random when mapped to a different representation of ${\mathbb{F}}_{q^n}$.

Let f and F be two monic irreducible polynomials of degree n over ${\mathbb{F}}_q$. The message space of the scheme is elements $m\left(x\right)\in \mathbb{X}={\mathbb{F}}_q\left[x\right]/\left(f\left(x\right)\right)$, where the coefficients of $m\left(x\right)$ are taken from $\{0,1\}$. To stunt the growth of the noise when performing operations on the ciphertexts, f has to be sparse and have small coefficients, typically from $\{-1,0,1\}$. The ciphertext space is $\mathbb{Y}={\mathbb{F}}_q\left[y\right]/\left(F\left(y\right)\right)$. The private key consists of f, as well as explicit isomorphisms between $\mathbb{X}$ and $\mathbb{Y}$. More specifically, $\varphi \left(y\right)$ is the particular element of $\mathbb{Y}$, written as a polynomial in y of degree at most $n-1$, which is the root of f denoted by x in $\mathbb{X}$. Likewise, $\psi \left(x\right)$ is the specific element of $\mathbb{X}$ isomorphic to the root of F labelled y in $\mathbb{Y}$. Both $\varphi \left(y\right)$ and $\psi \left(x\right)$ are therefore understood as fixed, known polynomials in the description of the encryption and decryption. The encryption and decryption of the symmetric key variant of the scheme are performed as follows:

• Enc($m\left(x\right)$): Draw $r\left(x\right)$ from a distribution giving small polynomials. Output $C\left(y\right)=2r\left(\varphi \right(y\left)\right)+m\left(\varphi \right(y\left)\right)$ mod $F\left(y\right)$;
• Dec($C\left(y\right)$): Replace y by $\psi \left(x\right)$ in the polynomial C, and output $\left(C\right(\psi \left(x\right))$ mod $f\left(x\right))mod2$.

3.5.3. LGM

As we will see in Section 4.1, schemes based on LWE (e.g., GSW) can leak one bit of the secret key from a small number of decryption queries. Essentially, they have public keys of the form $(\mathit{A},\mathit{A}\mathit{s}+\mathit{e})$ with secret key $\mathit{s}$, and key recovery attacks either compute $\mathit{s}$ or compute the noise $\mathit{e}$ and use Gaussian elimination to derive $\mathit{s}$. Li, Galbraith, and Ma (LGM) [67] proposed a technique to circumvent such attacks. Firstly, they started with a dual version of GSW, where the public key is of the form $(\mathit{A},\mathit{A}\mathit{s})$, and the secret key $\mathit{s}$ has a small norm; security then depends on the hardness of the inhomogeneous short integer solution (ISIS) problem. Secondly, instead of having one secret key vector $\mathit{s}$, they had t of them; decryption works by using a different random linear combination of the secret keys ${\mathit{s}}^{\prime }={\sum }_{i=1}^t{\lambda }_i{\mathit{s}}_i$ for each decryption query. Hence, a decryption query leaks, at best, one bit of ${\mathit{s}}^{\prime }$: An unknown linear combination of secret key vectors that with high probability will not be reused in other decryption queries. Li et al. argued that this would prevent adaptive key recovery attacks, however, such an attack was later found by Fauzi et al. [52].

The attack does not extend to any other scheme, as the LGM is the only scheme that employs the strategy of using “ephemeral” secret keys to thwart adaptive key recovery attacks. We present the LGM scheme and provide the intuition of the attack in Section 4.4 for completeness and refer to Fauzi et al. [52] for further details. Note that, here, $\kappa$ is the security parameter, whilst $\lambda$ is a sampled variable:

• Setup($1^{\kappa },1^L$): Let $n=n(\kappa ,L)$ and $m=m(\kappa ,L)$, and choose a modulus q and bounded noise distribution $\chi =\chi (\kappa ,L)$ on $\mathbb{Z}$ such that at least $2^{\kappa }$ security against known attacks is achieved. Choose the number of secret keys $t=O(logn)$. Let $l=logq+1$ and $N=(t+m)l$. Output $params=(n,q,\chi ,m,t,l,N)$;
• KeyGen($params$): Uniformly sample $\mathbf{B}\in {\mathbb{Z}}_q^{n\times m}$. For $i\in [1,t]$, sample ${\mathit{e}}_i$ from ${\chi }^m$; set ${\mathbf{u}}_i=\mathbf{B}{\mathit{e}}_i$; set ${\mathbf{s}}_i={({\mathbf{r}}_i\parallel -{\mathit{e}}_i^T)}^T$, where ${\mathbf{r}}_i$ is the i-th row of the $t\times t$ identity matrix. Return the public key $\mathbf{A}=[{\mathbf{u}}_1\parallel \dots \parallel {\mathbf{u}}_t\parallel \mathbf{B}]\in {\mathbb{Z}}_q^{n\times (t+m)}$ and the secret key $\mathbf{s}=({\mathbf{s}}_1,\dots ,{\mathbf{s}}_t)$;
• Enc($\mathbf{A},\mu \in {\mathbb{Z}}_2$): Let $\mathbf{G}$ be the $(t+m)\times N$ gadget matrix. Sample $\mathbf{R}\leftarrow {\mathbb{Z}}_q^{n\times N}$ and $\mathbf{X}\leftarrow {\chi }^{(t+m)\times N}$. Output $\mathbf{C}=\mu ·\mathbf{G}+{\mathbf{A}}^T\mathbf{R}+\mathbf{X}\in {\mathbb{Z}}_q^{(t+m)\times N}$;
• Dec($\mathbf{s},\mathbf{C}$): Sample $({\lambda }_1,\dots ,{\lambda }_t)\in {\mathbb{Z}}_q^t\setminus {\left\{0\right\}}^t$ until the generated ${\mathbf{s}}^{\prime }={\sum }_{i=1}^t{\lambda }_i{\mathbf{s}}_i$ has a sufficiently small norm. Let $i\in [1,t],j,I=(i-1)l+j$ be integers such that ${\lambda }_i\ne 0$, $2^{j-1}\in (q/4,q/2]$ and $I\in [1,tl]$. Compute $u=\langle {\mathbf{C}}_I,{\mathbf{s}}^{\prime }\rangle modq$, where ${\mathbf{C}}_I$ is the Ith column of the ciphertext matrix $\mathbf{C}$. Finally, output $|u/2^{j-1}|\in \{0,1\}$.

3.6. Noise-Free Attempts

All known *HE schemes have a non-constant ciphertext expansion. Gjøsteen and Strand [68] went further and conjectured that the security of a *HE scheme either depends on a massive ciphertext expansion or a weak or strange algebraic structure, limiting the applicability of the scheme. To support their conjecture, they showed that no noise-free and secure schemes can exist in vector spaces or fields; however, there were no final conclusions in the case of rings.

Nuida [69] proposed a generic construction of noise-free FHE based on surjective group homomorphisms $\pi :\mathbb{C}\to \mathbb{M}$. The generic construction is secure if elements in the kernel of $\pi$ are indistinguishable from elements in the ciphertext space $\mathbb{C}$, which is a variant of the subgroup hiding assumption. Nuida provided a candidate construction using combinatorial group theory; however, it is non-compact (i.e., the ciphertext size can be unbounded) and does not have an explicit proof of IND-CPA security. Since other existing candidate constructions have similar issues, we disregarded noise-free *HE constructions in our work.

4. Existing Attacks

4.1. (R)LWE Attacks

Chenal and Tang [11] presented attacks on several schemes based on (R)LWE, for example BGV [15] and GSW [20]; see Table 1 for a full overview. The attacks recover the secret key bit by bit, and coefficient by coefficient (wherever this applies), by using the result of the decryption queries to perform a binary search on secret values.

Recall from Section 3.1 that schemes based on LWE have ciphertexts of the form $c=(\mathbf{a},b)$ where $\mathbf{a}\in R^n$ and $b\in R$, for the ring $R={\mathbb{Z}}_q$. The private key is a vector $\mathit{s}\in R^n$, and decryption is computed as $m=\rho (\langle \mathbf{a},\mathbf{s}\rangle -b)$, where $\rho$ is some rounding function that maps elements from R into the plaintext space. In fact, any scheme with this type of decryption function is vulnerable to the following adaptive key recovery attack.

In the LWE case, the adversary asks for decryptions of $c=({\mathit{e}}_i,b)$, where ${\mathit{e}}_i\in R^n$ is the unit vector with one at position i and zero everywhere else, which leaks information on ${\mathit{s}}_i$. Performing a binary search with different values for b allows the adversary to find a $b_0$ such that:

$$\rho (\langle (0,\dots ,1,\dots ,0),\mathbf{s}\rangle -b_0)=m_0\ne m_1=\rho (\langle (0,\dots ,1,\dots ,0),\mathbf{s}\rangle -b_0+ϵ),$$

for an arbitrarily “small” value of $ϵ$. Note that $ϵ$ is an element in a general ring R, but for the homomorphic properties to work with the correct decryption, the elements of R need to have the notions of size and distance. Knowing exactly where the border $b_0$ is, where $\rho ({\mathbf{s}}_i-b_0)$ is rounded to either $m_0$ or $m_1$, allows the adversary to determine ${\mathit{s}}_i$ to any degree of accuracy. Repeating for all positions $1\le i\le n$ gives an adaptive key recovery attack on these schemes.

In the RLWE case, the general attack is equally simple. RLWE uses ciphertexts of the form $c=\left(a\right(x),b(x\left)\right)$ where $a\left(x\right),b\left(x\right)\in R\left[x\right]$ for some polynomial ring $R\left[x\right]$ modulo an ideal I. For a secret key $s\left(x\right)\in R\left[x\right]$, the decryption function in this case takes the form $\mathrm{Dec}\left(c\right)=\rho \left(a\right(x)·s(x)-b(x\left)\right)$, where $a\left(x\right)·s\left(x\right)$ denotes polynomial multiplication in $R\left[x\right]modI$ and $\rho$ is some rounding function into the plaintext space. Simply querying the decryption oracle with ciphertexts of the form $c=(1,b(x\left)\right)$ for various choices of $b\left(x\right)$ allows one to perform a binary search on the coefficients of $s\left(x\right)$ in the same way as in the LWE case.

4.2. AGCD Attacks

There are two attacks on homomorphic encryption schemes defined over the integers. The attack by Zhang et al. [41] recovers the secret key of the vDGHV scheme, an attack the authors themselves pointed out is directly transferable to CMNT [42]. Chenal and Tang later gave a more efficient key recovery attack against vDGHV [11]. The two attacks differ in strategy, and we therefore present both approaches. We remind the reader that a ciphertext in vDGHV is of the form $c=m+2r+qp$, where the odd integer $p\in [2^{\eta -1},2^{\eta }-1]$ is the secret key. Decryption first reduces the ciphertext modulo the secret key p, then modulo two.

Zhang et al. constructed several encryptions of zero, which they then altered so that all the different ciphertexts had a fixed noise. Given a ciphertext c encrypting zero, this construction is achieved by performing a binary search for an added noise term $\rho$ such that Dec($c+\rho$) $=0$, but Dec($c+\rho +1$) $=1$, and defining the new ciphertext $c_i=c+\rho +1$. Given the constructed ciphertexts $c_0,c_1,\dots ,c_k$, they computed $gcd(c_0-c_1,c_1-c_2,\dots ,c_{k-1}-c_k)$, which will be p with overwhelming probability. The attack requires $O\left({\lambda }^2\right)$ operations, where $\lambda$ is the security parameter of the scheme.

Whereas Zhang et al. attacked the scheme by essentially constructing ciphertexts such that the underlying problem was easy, Chenal and Tang proposed a more direct search for the secret key. Initially, an adversary has both a lower and upper bound for p, namely $l_p=2^{\eta -1}+1$ and $u_p=2^{\eta }-1$, respectively. She/he then takes advantage of the following: if she/he queries the decryption oracle with an even number $c\in (l_p,u_p)$, it will return zero if $c<p$ and one if $c>p$, as Dec$\left(c\right)=(cmodp)mod2$ and $c<2p$. Therefore, if she/he finds the even integer c such that Dec$\left(c\right)=0$ and Dec$(c+2)=1$, she/he knows that $p=c+1$. The attack requires roughly $\eta$ oracle queries, which is more efficient than the Zhang et al. attack.

4.3. NTRU Attack

An adaptive key recovery attack against the NTRU-based scheme BLLN was presented by Dahab, Galbraith, and Morais [18]; we give the main idea of the attack and its complexity and refer to the original article for further details. The attack is not applied to other schemes later, and we state it for completeness.

The attack itself is fairly simple. It takes advantage of the fact that the decryption of BLLN involves multiplying the ciphertext with the secret key and then performing two modular reductions: first modulo q, then p. The idea is to query the decryption oracle with rounded fractions divisible by p. The fractions are also designed so that as long as the denominator is large compared to the secret key f, the fraction is not reduced modulo q, and the decryption algorithm will therefore output zero. However, as the denominator of the queried fraction becomes just smaller than f, the fraction becomes large enough to be reduced modulo q when multiplied with the secret key. This will cause the second modular reduction to result in something nonzero, making it easy to detect when the denominator became smaller than f, and hence calculate the secret key.

For BLLN, the complexity of the attack depends on the parameters of the scheme. If $p>2$ and the coefficients of $f^{\prime },g$ are all in $\{-1,0,1\}$, it takes a single query to recover the secret key. In the more general case where $p\ge 2$ and no restrictions are placed on the polynomials, the complexity is $O(nlog\left(B_k\right))$, where n is the order of the polynomial defining the ciphertext space and $B_k$ is a bound on the largest coefficient of f.

4.4. LGM Attack

Recall that the LGM scheme has a secret key vector consisting of t secret keys $({\mathbf{s}}_1,\cdots ,{\mathbf{s}}_t)$, where each key is of the form ${\mathit{s}}_i=({\mathit{e}}_i\parallel r_i)$ for some noise vector ${\mathit{e}}_i$ and that an ephemeral secret key ${\mathbf{s}}^{\prime }={\sum }_{i=0}^t{\lambda }_i{\mathbf{s}}_i$ is generated for each decryption procedure.

Although Li et al. discussed several possible distributions to sample ${\lambda }_i$ from, their main focus was ${\lambda }_i$ drawn uniformly from $\{0,1\}$. We therefore present the attack for this scenario and refer to Fauzi et al. [52] for details on the attack for more general $\lambda$ distributions. The attack recovers a vector ${\mathit{e}}_i$ one component $e_{k,i}$ at a time, and each vector and component is recovered independently of each other. In particular, it is possible to calculate a single vector ${\mathit{e}}_i$ to recover ${\mathbf{s}}_i$ and use it for decryption, and we therefore only discuss how to recover ${\mathit{e}}_1$.

Note that we can construct a ciphertext matrix $\mathbf{C}$ such that the inner product during decryption always results in $\alpha +{\sum }_{i=0}^t{\lambda }_i{e}_{i,1}$, by ensuring that for each possible index I, the column ${\mathbf{C}}_I$ has $\alpha$ in position i and one in position $t+1$. By repeated queries of this “diagonal” matrix, one obtains an estimate of $1/2{\sum }_{i=0}^t{e}_{i,1}$ by observing how often the decryption oracle returns zero and one for a specific value of $\alpha$, as the decryption results in zero if $\alpha +{\sum }_{i=0}^t{\lambda }_i{e}_{i,1}<2^{j-2}$, and one otherwise. Essentially, the attack searches for the value of $\alpha$ where the resulting ciphertext decrypts as often to zero as one, as this indicates that the average value $\alpha +{\sum }_{i=0}^t{e}_{i,1}$ is very close to $2^{j-2}$, and the adversary can now estimate ${\sum }_{i=0}^t{e}_{i,1}$

After this estimation of $1/2{\sum }_{i=0}^t{e}_{i,1}$ is obtained, the decryption oracle is repeatedly queried with ciphertext matrices where every column is identical and has a value a in position i and a one in position $t+1$. Decryption of such a matrix will always result in ${\lambda }_{i}a+\lambda e_{i,1}+{\sum }_{k\ne i}{\lambda }_k{e}_{k,1}$, which will provide an estimate of $e_{i,1}+1/2{\sum }_{k\ne i}{\lambda }_k{e}_{k,1}$, again by observing how often the decryption oracle returns zero and one for different values of a. Combining these two estimations provides an estimation of $e_{i,1}$, and repeating this for the other indices of ${\mathit{e}}_1$ allows the adversary to recover the secret key ${\mathbf{s}}_1={({\mathbf{r}}_1\parallel -{\mathit{e}}_1^T)}^T$.

5. Attacking Other Schemes

We now discuss how to apply known attacks to other schemes, as the susceptibility of an adaptive key recovery attack is inherited from a parent scheme to a child. Because the schemes over ideal lattices and those based on NTRU are, with a few exceptions, not IND-CPA-secure, we limit this discussion to schemes based on (R)LWE and AGCD. We also present novel attacks against schemes that are not affected by the attacks presented in Section 4.

5.1. Applying the (R)LWE Attack on Other Schemes

Many schemes based on (R)LWE are built on or slightly adapted from earlier schemes, as is clear from Table 2 in Section 3. For example, the CKKS scheme [21] is the result of a general framework being applied to the BGV scheme. The framework allows for the recovery of the message by computing the MSB of a ciphertext, modulo some modulus. Because the structure of the BGV scheme is intact, the key recovery attack on BGV described in [11] is directly applicable to CKKS.

The Chenal and Tang (R)LWE attack also works on all children of GSW mentioned in Table 2. For most of these, the structure and decryption functions are almost identical; hence, the attack trivially extends. A special case is CGGI [31], where the plaintext space is a subset of a torus (the torus is defined as the set of real numbers modulo one, which can be identified with the half-open interval $[0,1)$ on the number line), but the decryption function is otherwise very similar to GSW and CKKS: it takes the inner product of a ciphertext with the private key, subtracts an element, and rounds the result to the nearest element in the plaintext space. Hence, the attack in Section 4.1 can still be adapted to CGGI.

Similarly, the attack also works on FV [22] and its children, found in Table 2. First, observe that FV itself is essentially an RLWE variant of the LWE-based Bra12 [19], where in particular, the decryption function is the same formula, but in the ring setting. Moreover, all the children follow FV’s structure, including almost identical decryption functions; the differences in specific message spaces and algorithms for homomorphic evaluations do not affect the success rate of the Chenal and Tang attack.

The CS17 [36] scheme is a bit different from other (R)LWE schemes in that it relies on the learning with rounding (LWR) problem, which is closely related to (R)LWE. We verified that the attack procedure from Section 4.1 still applies to the CS17 scheme; the decryption oracle can be made to return the secret key plus a scalable term, rounded into the plaintext space. A binary search on the scalable term allows the adversary to determine each component of the secret key to any degree of accuracy.

5.2. Attacks on AGCD-Based Schemes

5.2.1. Applying the Known Attack on Other Schemes

The adaptive key recovery attack by Chenal and Tang [11] on vDGHV described in Section 4.2 is applicable to all the children of vDGHV listed in Table 2, as well as CS15 [45]. The attack is either directly transferable or requires a trivial generalisation to account for vectors of messages and/or a larger message space than $\{0,1\}$.

5.2.2. BBL

The BBL scheme presented in Section 3.3 is not immediately affected by any of the attacks presented in Section 4.2 We therefore present a novel adaptive key recovery attack against the scheme.

Recall that the decryption algorithm Dec($p,\mathbf{c}$) first computes $\mu =\mathbf{c}{g}^{-1}(p/2)$ mod p, then outputs one if $\left|\mu \right|\ge p/4$, and zero otherwise.

We note that the bit-length $\eta$ of p is part of the public parameters, so the adversary has both a lower and an upper bound on p: $2^{\eta -1}$ and $2^{\eta }-1$, respectively. She/he therefore also has the lower bound $2^{\eta -2}$ for $p/2$, and we emphasise that $2^{\eta -2}$ is not reduced mod p, for any value of p.

The attack proceeds as follows: The adversary will recover the ith element of $g^{-1}(p/2)$ by querying the decryption oracle with the ciphertext with $2^{\eta -2}$ in position i, and zero elsewhere. If the ith component of $g^{-1}(p/2)$ is one, the decryption oracle returns one, and zero otherwise. The vector $g^{-1}(p/2)$ is then completely recovered after $\eta -1$ queries, after which the adversary may simply multiply with the corresponding gadget vector $\mathbf{g}$ to recover $p/2$.

5.2.3. Per

As for the BBL scheme, the Per scheme is not broken by any of the attacks presented in Section 4.2, and we therefore provide a novel adaptive key recovery attack against it. Although the Per scheme is defined for ciphertexts in both matrix and vector form, we only used the matrix version of the scheme to recover the secret key $sk=(p,\mathbf{K})$. We explain how to recover the secret integer p first, then how to recover the secret matrix $\mathbf{K}$. Recall that the decryption works as follows: for an input $\mathbf{C}$, compute ${\mathbf{C}}^{\prime }=G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right)\mathbf{C}\mathbf{K}$ mod $x_0$, then ${\mathbf{C}}^{*}={\mathbf{C}}^{\prime }$ mod p, and finally, output $\lfloor {\mathbf{C}}^{*}/\alpha \rceil$.

We denote the greatest common divisor of $\alpha$ and $x_0$ as d, and note that $1\le d\le \alpha$. Since $\alpha \le \frac{p}{2B+1}<\frac{p}{2}$, we also have that d mod $p=d$. Irrespective of the value of d, we let ${\alpha }^{-1}$ denote the integer such that ${\alpha }^{-1}\alpha \equiv d$ mod $x_0$.

Step 1:

Recovering p

Our first observation is that, using $G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right)\mathbf{G}=\alpha {\mathbf{K}}^{-1}$ over ${\mathbb{Z}}_{x_0}$ (see [54] (Section 3.3)), the decryption of $\mathbf{C}={\alpha }^{-1}\mathbf{G}$ proceeds as follows: ${\mathbf{C}}^{\prime }=G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right){\alpha }^{-1}\mathbf{G}\mathbf{K}={\alpha }^{-1}\alpha {\mathbf{K}}^{-1}\mathbf{K}=d·{\mathbf{I}}_n$, where ${\mathbf{I}}_n$ is the $n\times n$ identity matrix. Then, ${\mathbf{C}}^{*}=(d·{\mathbf{I}}_n)$ mod $p=d·{\mathbf{I}}_n$ and $\mathbf{M}=\lfloor d/\alpha \rceil {\mathbf{I}}_n$.

We use the ciphertext ${\alpha }^{-1}\mathbf{G}$ as a starting point to perform a binary search for a factor t such that $td<p/2$, but $(t+1)d\ge p/2$. If $td\le p/2$, the decryption of $t{\alpha }^{-1}\mathbf{G}$ will return approximately $td/\alpha {\mathbf{I}}_n$, which has positive entries when $td<p/2$. If $td\ge p/2$, then the decryption of $t{\alpha }^{-1}\mathbf{G}$ will return a matrix with negative entries, or zero if the entries have a too small absolute value. It is therefore easy to detect the exact t that produces $td<p/2\le (t+1)d$.

For $d=1$, $p=2t+1$ is now recovered. For $d\ge 2$, note that the inequality $td<p/2\le (t+1)d$ implies $3td<3p/2\le 3(t+1)d$ and that we can narrow the interval by querying to see if $(3t+1)d<3p/2$ or $(3t+2)d<3p/2$. During decryption of $(3t+i){\alpha }^{-1}\mathbf{G}$$(i=1,2)$, we know that one whole multiple of p will be subtracted from $(3t+i)d$ when reducing modulo p. If such a subtraction happens, it is because $(3t+i)d\ge 3p/2$, and the decryption result will be negative. If there is no such subtraction, the decryption result will be positive, and we know that $(3t+i)d<3p/2$. Hence, we can narrow down the search interval for p by a factor of three, e.g., if it was determined that $(3t+1)d>3p/2$, then $2td<p<2(3t+1)d/3$. We continue multiplying the inequalities by three and narrowing down the interval for p by a factor of three in each iteration. After ${log}_{3}d$ iterations, i.e., $O(\eta +{log}_3\left(d\right))$ decryption queries, the interval contains a single digit and p is recovered.

The attack hinges on the assumption that the ciphertext is not reduced modulo $x_0$ during decryption. In order to avoid this modular reduction, we need $3^{{log}_3\left(d\right)}td<x_0/2$. We have $3^{{log}_3\left(d\right)}td=t{d}^2<td\alpha \le p/2\alpha <2^{\eta -1}{2}^{\eta -2}=2^{2\eta -3}$, where we used the fact that $\alpha =\lfloor 2^{\eta -1}/(2B+1)\rfloor$ and $B\ge 1$. Furthermore, we have that $x_0>2^{\gamma -1}$ and, finally, that it is required that $\gamma \ge 2\eta$ [54], so we conclude that the ciphertext queries will never be reduced modulo $x_0$, and our attack recovers p successfully.

Step 2:

Recovering $\mathbf{K}$

Successfully recovering p already displays a serious weakness of the scheme, but for a full key recovery attack, we also need to recover the secret matrix $\mathbf{K}$. We show how to find $\mathbf{K}$ for $b=2$ here and sketch an attack procedure for a general b.

We took advantage of the decryption procedure including $G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right)$ and, rather, attempted to reconstruct this matrix instead of $\mathbf{K}$ directly. Note that the elements of $G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right)$ are all in the interval $[0,b-1]$.

Let ${\mathbf{E}}_{i,j}$ denote the matrix with one in position $(i,j)$, and zero elsewhere. Querying ${\mathbf{E}}_{i,j}$ from the decryption oracle will produce:

$${\mathbf{C}}^{\prime }=\left[\begin{array}{cccc}{b}_{1,i}{k}_{j,1}& b_{1,i}{k}_{j,2}& \cdots & b_{1,i}{k}_{j,n}\\ b_{2,i}{k}_{j,1}& b_{2,i}{k}_{j,2}& \cdots & b_{2,i}{k}_{j,n}\\ ⋮& ⋮& \cdots & ⋮\\ b_{n,i}{k}_{j,1}& b_{n,i}{k}_{j,2}& \cdots & b_{n,i}{k}_{j,n}\end{array}\right],$$

where $b_{u,v}$ is the $(u,v)$-th element of $G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right)$ and $k_{u,v}$ is the $(u,v)$-th element of $\mathbf{K}$. We note that $1\le u\le nl$ and $1\le v\le n$, where $l=\lceil {log}_b\left(2^{\gamma }\right)\rceil$. We query the decryption oracle for all possible matrices ${\mathbf{E}}_{i,j}$.

If $b=2$, $G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right)$ is a binary matrix. We then use the decryption results to determine if a particular element $b_{i,j}$ is non-zero by checking whether the vector of the form $\lfloor b_{i,j}\left[\begin{array}{cc}{k}_{i,1}& \cdots k_{i,n}\end{array}\right]/\alpha \rceil$, obtained from the i-th row of the decryption query on ${\mathbf{E}}_{j,i}$, is non-zero. If it is, we set $b_{i,j}=1$, else we set it to zero. We can thus obtain $G^{-1}\left(\alpha {\mathbf{K}}^{-1}\right)$, and hence also $\alpha {\mathbf{K}}^{-1}$. It is then easy to reconstruct $\mathbf{K}$.

We now sketch how an attack for a general b can work, but leave out the rigorous procedure. First, we note the sizes of various parameters as recommended by [54]: $x_0\approx 2^{160},p\approx 2^{80},2^{60}\le \alpha \le 2^{78},b\approx 2^7$, and $r\approx 2^{40}$, where $x_0=qp+r$.

The secret elements $k_{i,j}$ are random in ${\mathbb{Z}}_{x_0}$ and are multiplied with $b_{i^{\prime },j^{\prime }}$ where $b_{i^{\prime },j^{\prime }}<b$. Since r and b are relatively small compared to the other parameters, we found that first reducing $b_{i^{\prime },j^{\prime }}{k}_{i,j}$ modulo $x_0$ and then reducing the result modulo p are approximately the same as just reducing modulo p directly:

$$\begin{array}{c}\hfill |\left(b_{i^{\prime },j^{\prime }}{k}_{i,j}\underline{\mathrm{mod}}p\right)-\left(\left(b_{i^{\prime },j^{\prime }}{k}_{i,j}\underline{\mathrm{mod}}{x}_0\right)\underline{\mathrm{mod}}p\right)|\le br.\end{array}$$

With $b\approx 2^7$ and $r\approx 2^{40}$, this difference will be mostly negligible when dividing by $\alpha \ge 2^{60}$ before the output. The result will be the same with a high probability, or just one off if not the same. Hence, we simplified the analysis further by just reducing modulo p.

The adversary gets to see the values $\lfloor (b_{i^{\prime },j^{\prime }}{k}_{i,j}$ mod $p)/\alpha \rceil$ for all choices of $i,j,i^{\prime },j^{\prime }$. Looking at ${\mathbf{C}}^{\prime }$, we see that all elements in one column share the same $k_{i,j}$. Assume for concreteness that $\alpha =2^{70}$, and that $\lfloor (b_{1,1}{k}_{1,1}$ mod $p)/\alpha \rceil$ is the smallest positive value among the values $\lfloor (b_{i,1}{k}_{1,1}$ mod $p)/\alpha \rceil$ that the attacker sees, which will be in the range $[-511,512]$.

We then know that $\lfloor (a{b}_{1,1}{k}_{1,1}$ mod $p)/\alpha \rceil \approx a\lfloor (b_{1,1}{k}_{1,1}$ mod $p)/\alpha \rceil$ for some small values of a, since they will not lead to new reductions modulo p. We can estimate when $b_{i,1}=a{b}_{1,1}$ by looking at the ratio:

$$\begin{array}{c}\hfill \frac{\lfloor \frac{\left(b_{i,1}{k}_{1,1}\underline{\mathrm{mod}}p\right)}{\alpha }\rceil }{\lfloor \frac{\left(b_{1,1}{k}_{1,1}\underline{\mathrm{mod}}p\right)}{\alpha }\rceil }\approx \frac{b_{i,1}}{b_{1,1}}=a.\end{array}$$

Repeating with different $k_{j,1}$ produces n different estimates of this ratio, which should give approximately the same value for all cases where $\lfloor (b_{1,1}{k}_{j,1}$ mod $p)/\alpha \rceil$ is smaller than $512/a$. We then learn the linear relation $b_{1,1}=a{b}_{1,i}$. Repeating for different $b_{i,j}$-elements allows the adversary to create a linear system between them, which can either be solved or whose solution space is small enough to be exhaustively searched as b is only of size $2^7$.

5.3. Attacks on AFFHP and DHPSSWZ

We now present new attacks on AFFHP and DHPSSWZ using a variant of binary search. Consider the value of $(kamodq)modp$ for an unknown a and chosen multiple k, where q is prime and $q\gg p$. We show how to recover a in this scenario. In the following, we identify ${\mathbb{F}}_q$ with $[0, q-1]$, and to ease notation, we let $D\left(ka\right)\in {\mathbb{F}}_p$ denote the oracle that returns $(kamodq)modp$.

First, query $D\left(a\right)$. As $a<q$, this will simply give us the value of $amodp$. As long as $ka<q$, we know that $D\left(ka\right)=(kmodp)(amodp)$, and we can check how long this property holds by asking for $D\left(ka\right)$ for $k\in \mathbb{N}$. For some k, we reach the point where $D\left(ka\right)=kamodp$, but $D\left(\right(k+1\left)a\right)=\left(\right(k+1)amodp)-(qmodp)$. Note that $qmodp\ne 0$ as q is prime. We are therefore able to determine the exact value $k=k_0$ such that $k_{0}a<q\le (k_0+1)a$. Since a is uniformly distributed over ${\mathbb{F}}_q$, we expect $O\left(1\right)$ queries to determine $k_0$.

We now have the following inequalities:

$$k_{0}a<q\le (k_0+1)a\iff \frac{q}{k_0+1}\le a<\frac{q}{k_0}$$

Multiplying through by two, we obtain $2k_{0}a<2q\le (2k_0+2)a$. Ask for $D\left((2k_0+1)a\right)$. Knowing the value of $amodp$, we can determine if the reduction of $(2k_0+1)a$ modulo q subtracted q or $2q$ before reducing modulo p. This determines whether $2k_{0}a\le 2q\le (2k_0+1)a$ or $(2k_0+1)a\le 2q\le (2k_0+2)a$. In other words, we can find $k_1$ such that $k_1{a}_0<2q\le (k_1+1)a_0$. This gives the following inequalities:

$$k_{1}a<2q\le (k_1+1)a\iff \frac{2q}{k_1+1}\le a<\frac{2q}{k_1}.$$

We continue this way, multiplying through with two and asking the oracle $D\left((2k_1+1)a\right)$ to determine the value $k_2$ such that $k_{2}a<4q\le (k_2+1)a$, etc. After t iterations, we have the following inequalities:

$$k_{t}a<2^{t}q\le (k_t+1)a\iff \frac{2^{t}q}{k_t+1}\le a<\frac{2^{t}q}{k_t}.$$

We now show that the interval where a can be found shrinks exponentially fast with increasing t, and only $O(logq)$ queries are needed to determine a exactly.

First note that $k_0\ge 1$, and by induction, $k_t\ge 2^t$ for all $t\ge 0$. Define $d\left(t\right)$ to be the size of the interval where a can be found after t iterations. We then obtain:

$$\begin{array}{cc}\hfill \frac{2^{t}q}{k_t}-\frac{2^{t}q}{k_t+1}& =d\left(t\right)\Rightarrow 2^{t}q=d\left(t\right)k_t(k_t+1)>d\left(t\right)2^{2t}\Rightarrow \frac{q}{2^t}>d\left(t\right)\hfill \end{array}$$

Hence, after $O(logq)$ queries, the attacker is able to determine a.

5.3.1. CCA Key Recovery Attack on AFFHP

Recall that the secret key of AFFHP is a Gröbner basis $\mathsf{G}=\{x_0-a_0,\dots ,x_{n-1}-a_{n-1}\}\subset {\mathbb{F}}_q[x_0,\dots ,x_{n-1}]$, where the $a_i$ are unknown coefficients from ${\mathbb{F}}_q$. For a given ciphertext $C\in {\mathbb{F}}_q[x_0,\dots ,x_{n-1}]$, the decryption function returns $(Cmod\mathsf{G})mod2$. Setting $C=x_i$ will then yield $x_{i}mod\mathsf{G}=a_i$, so the decryption oracle will output $a_{i}mod2$. More generally, the decryption of $C=k{x}_i$ for some $k\in {\mathbb{F}}_q$ will return $k{a}_{i}mod2$. The attacker can therefore recover all the unknown $a_i$ by using the method described above. The complexity for this attack is $O(nlogq)$ decryption queries.

5.3.2. CCA Key Recovery Attack on DHPSSWZ

Recall that the decryption function of DHPSSWZ for a ciphertext $C\left(y\right)$ is given as Dec($C\left(y\right)$)$=\left(C\right(\psi \left(x\right))$ mod $f\left(x\right))mod2$, where $\psi \left(x\right)$ and $f\left(x\right)$ are part of the secret key. We first show that the attacker can determine $\psi \left(x\right)$ by asking for polynomially many decryptions of some chosen ciphertexts. All ciphertexts will take the form $C\left(y\right)=ky$, for selected choices of $k\in {\mathbb{F}}_q$. Note that if the attacker only asks for decryptions of linear polynomials, i.e., $C\left(\psi \right(x\left)\right)=k\psi \left(x\right)$, no reduction modulo $f\left(x\right)$ will occur. Hence, we can disregard $f\left(x\right)$ in the decryption function, and the decryption oracle will simply output $k\psi \left(x\right)mod2$ for all ciphertexts for which the attacker asks.

Let $\psi \left(x\right)=a_{n-1}{x}^{n-1}+\dots +a_{1}x+a_0$ with $a_i\in {\mathbb{F}}_q$. The decryption oracle will output $(k{a}_{n-1}mod2)x^{n-1}+\dots +(k{a}_{0}mod2)$ for the chosen ciphertexts $C\left(y\right)=ky$. By focusing on one coefficient $a_i$ at a time, we can now use the method described at the start of this subsection to recover all $a_0,\dots ,a_{n-1}$, and hence the exact $\psi \left(x\right)$, by asking for $O(nlogq)$ decryptions.

Finally, given $\psi \left(x\right)$ and the public polynomial $F\left(y\right)$, the secret polynomial $f\left(x\right)$ can easily be recovered as follows. We know that $y\in \mathbb{Y}$ and $\psi \left(x\right)\in \mathbb{X}$ are two different representations of the same element of ${\mathbb{F}}_q$. This element is defined by being a root of the polynomial F. Hence, we have $G\left(x\right):=F\left(\psi \right(x\left)\right)=0$, where $deg\left(G\right(x\left)\right)\le n(n-1)$ and x is the element of $\mathbb{X}$ defined by being a root of f. Therefore, $f\left(x\right)\left|G\right(x)$, and we can find $f\left(x\right)$ by factoring $G\left(x\right)$ and seeing which of the irreducible factors has the particular property of having degree n and only small coefficients. Factoring a univariate polynomial of degree d over ${\mathbb{F}}_q$ has complexity $O(d^{2}logq)$ (or even smaller; see [70]), so the complexity of recovering $f\left(x\right)$ in this step is at most $O(n^{4}logq)$.

6. Generic Constructions of IND-CCA1-Secure *HE

We present here the various more generic approaches for constructing an IND-CCA1-secure *HE scheme; see

Table 3. Generic constructions of IND-CCA1 *HE. The first construction has an insecure instantiation, while the other constructions only have a generic instantiation. Hence, none of these generic strategies provide a concrete instantiation.

Generic Construction	Instantiation	Notes
*HE + PA-1 [37,71]	GH variant of SV + lattice knowledge assumption [37]	SV now insecure; PA-1 uses non-falsifiable assumption
Multi-key IBHE [72,73]	Multi-key *HE + IBE [74]	Only compact w.r.t. circuit complexity
	SubExp LWE + random oracle [30]	Only compact w.r.t. circuit complexity
	SubExp iO + SubExp DDH [73,75]	SubExp iO is a very strong assumption
FHE + zk-SNARK [73,76]	FHE without bootstrapping + knowledge assumptions [73]	FHE without bootstrapping currently only known using SubExp iO

for a summary. The constructions apply existing generic constructions from group-homomorphic cryptosystems to the *HE setting and provide novel (generic) instantiations. The main problem with these constructions is that the resulting schemes are typically not compact and are rather impractical. Therefore, none of the generic constructions have, to the best of our knowledge, been implemented.

6.1. LMSV

The SHE scheme presented by Loftus et al. [37] was for a long time the only *HE scheme thought to be IND-CCA1-secure, but it has since been broken.

The strategy was to construct an SHE scheme that achieves both IND-CPA and plaintext awareness (PA-1), which is known to result in an IND-CCA1-secure scheme [71]. Informally, plaintext awareness states that if an adversary is able to construct a valid ciphertext, she/he already knows the plaintext it encrypts. Then, intuitively, the decryption oracle is of no use to the adversary in an IND-CCA1 game, as she/he must already know the plaintext of any ciphertext she/he queries. In particular, the adversary is unable to query the decryption oracle with adulterine ciphertexts designed specifically to reveal information about the secret key, seeing as she/he must already know the secret key to be able to construct such valid ciphertexts. Hence, IND-CPA results in IND-CCA1 security. We state the formal definition of the PA-1 notion in Appendix B and refer to [71] for further details on both PA-1 and the construction IND-CPA + PA-1 → IND-CCA1.

The LMSV scheme added a ciphertext check to the decryption procedure of an IND-CPA-secure *HE scheme. The check aims to ensure that only honestly generated ciphertexts are decrypted, as this ensures that the scheme also achieves PA-1 security. The ciphertext check is based on a novel lattice knowledge assumption. Informally, this lattice knowledge assumption states that if an adversary is able to produce a vector c suitably close to a lattice point p when given only the basis of the lattice, then there is an extractor able to output p, given c and the random coins of the adversary. In other words, if an adversary is able to construct a vector sufficiently close to a lattice point, she/he must already know that lattice point. In the security proof, ciphertexts are likened to the vector c output by an adversary against the lattice knowledge assumption.

The starting scheme of LMSV, SV [38], based its IND-CPA security on SPIP, which was later broken [61,62,63], meaning that LMSV is not IND-CPA and hence not IND-CCA1-secure. Note, however, that the lattice knowledge assumption is unaffected by the attacks on SPIP. Therefore, it is conceivable to rely on this assumption to create a different IND-CCA1-secure scheme, but such a scheme would have to avoid relying on SPIP for IND-CPA security. It should also be noted that the lattice knowledge assumption is highly nonstandard and not well studied.

Despite these drawbacks, the approach of “adding” PA-1 security to an SHE scheme that is IND-CPA-secure is in and of itself both sound and interesting. However, it appears to be challenging to achieve both of these notions for SHE schemes, in particular PA-1, seeing as the LMSV scheme is the only one to suggest such a construction.

6.2. Constructions from Multi-Key Identity-Based Encryption

Canetti et al. [73] gave a construction for IND-CCA1-secure *HE schemes based on multi-key identity-based homomorphic encryption (IBHE) schemes. The construction is a simple transformation as follows:

• KeyGen: Same as for the multi-key IBHE scheme. The secret key is the master secret key $msk$, and the public key is the master public key $mpk$;
• Enc($mpk,m$): Sample a random identity $id$; compute $c={\mathrm{Enc}}_{\mathrm{IBHE}}(mpk,id,m)$; output $(c,id)$;
• Dec($msk,(\mathbf{c},id)$): Parse $\mathbf{c}=(c,id)$; compute $s{k}_{id}=\mathrm{Ext}(id,msk)$; output $m={\mathrm{Dec}}_{\mathrm{IBHE}}(s{k}_{id},id,c)$;
• Eval: Uses the IBHE evaluation function.

The IND-CCA1 security of the encryption scheme rests on the selective security for random identities of the multi-key IBHE scheme, which, informally, ensures that an adversary has a negligible advantage of distinguishing between encryptions of two messages of her/his choosing under a random identity, even if she/he has access to an oracle that provides her/him with the decryption key of any identity of her/his choosing. For a formal definition of the security notion, the interested reader is referred to Canetti et al. [73].

It is important to note that for an evaluated ciphertext to be decrypted, it will need to contain the identities of all the ciphertexts used in the evaluation. This means that the length of an evaluated ciphertext depends on the number of input ciphertexts, so the resulting scheme is not compact. We stress that this entails that the construction results in a scheme that, technically speaking, does not satisfy the definition of *HE schemes.

The authors also gave a generic instantiation that achieves multi-key IBHE by combining a multi-key FHE scheme and an identity-based encryption scheme and also suggested concrete schemes as building blocks. They also provided a generic instantiation that achieves multi-key IBHE in the random oracle model using sub-exponentially secure LWE.

In a concurrent work, Yasuda et al. [77] used the same generic construction based on multi-key IBHE to achieve a non-compact IND-CCA1-secure SHE scheme, with a similar proof for IND-CCA1 security as the one described above. A concrete instantiation for this construction was not suggested.

6.3. (Probabilistic) iO-Based

As discussed previously, Canetti et al. [73] showed that it is possible to construct a (non-compact) *HE scheme from a multi-key IBHE scheme. In the same article, the authors also suggested constructing a multi-key IBHE from a sub-exponentially secure iO (from which a probabilistic iO is constructed) and sub-exponentially secure lossy encryption (which can be based on DDH).

We note that Wang et al. found a technical weakness regarding how identities were handled in the evaluations, which enabled an attack on the PiO-based construction. However, Wang et al. also provided a patched version of the construction and proved that their construction achieved IND-CCA1 security [75].

The constructions differ in certain aspects, such as the setup and generation of keys for identities. Still, there are also important similarities, such as both constructions using a trapdoor encryption scheme during the encryption procedure of the IB *HE scheme. The most important common factor is that the evaluation hinges on PiO: the circuit given as the input is parsed as an algebraic circuit with separate addition and multiplication gates, which are then evaluated using obfuscations of different probabilistic programs. For further details on either construction, we refer to the respective article. Neither construction currently has a concrete instantiation.

6.4. zk-SNARK Construction

Canetti et al. [73] also gave a generic construction of IND-CCA1-secure FHE from IND-CPA-secure FHE using the Naor–Yung paradigm [76]. Essentially, the public key consists of two different public keys $p{k}_1,p{k}_2$ of the same FHE scheme along with a common reference string $crs$ for the zk-SNARK. An encryption of a message m is then of the form $(\mathrm{Enc}(p{k}_1,m),\mathrm{Enc}(p{k}_2,m),\pi )$, where $\pi$ is a proof of knowledge that the first two elements encrypt the same message m. Intuitively, this construction ensures IND-CCA1 security because the only way an adversary would be able to construct a ciphertext of a message the decryption oracle accepts is to actually encrypt the message, as she/he should not be able to construct a valid proof $\pi$ otherwise. Thus, the decryption oracle cannot reveal to the adversary anything that she/he does not already know.

Note here that the Canetti et al. construction requires a zk-SNARK, instead of the usual NIZK used in the general Naor–Yung paradigm, to ensure $\pi$ stays compact and hence preserves the compactness of the resulting IND-CCA1-secure FHE. However, due to the black-box separation of SNARKs and falsifiable assumptions [78], IND-CCA1 security would then require a non-falsifiable assumption. Furthermore, note that the construction requires an IND-CPA-secure FHE scheme without bootstrapping or key publication. It is not known whether or not a scheme with such properties is possible under standard assumptions.

7. Discussion

We gave an overview of the state of IND-CCA1 security for *HE schemes, both for concrete schemes and generic constructions. We showed that several schemes are susceptible to the same adaptive key recovery attacks, mainly because many schemes are optimisations of earlier work, so attacks carry over more or less trivially. We also presented new adaptive key recovery attacks against schemes that had not been studied w.r.t. IND-CCA1 security before now.

It is worth discussing why chosen ciphertext attacks are so devastating against *HE schemes. We repeat a point made by Chillotti et al. [8], namely that if the proof of IND-CPA relies on a search-to-decision reduction of a problem, an adversary with access to a decryption oracle may simply follow the steps of this very reduction to recover the secret key. Most *HE schemes rely on such a reduction, in particular all schemes based on LWE and RLWE.

Moreover, the requirement of both addition and multiplication being homomorphic might make achieving IND-CCA1 harder, as there are few mathematical structures to define encryption schemes over that allow for a more or less natural homomorphic evaluation of ciphertexts. It could be the case that these structures themselves complicate achieving IND-CCA1 security. The result by Gjøsteen and Strand showing that secure noiseless schemes cannot exist in vector spaces or fields might suggest that this is the case [68]. Furthermore, there are group homomorphic schemes that achieve IND-CCA1 security, e.g., CS-lite [14], and although there is no proof that it cannot be homomorphic in both multiplication and addition, CS-lite is strongly believed to be strictly group homomorphic. It could be the case that requiring both operations to be homomorphic forces the message or secret key to be so “accessible” in the ciphertext that some information is always leaked once an adversary has access to a decryption oracle.

An important point in this discussion is that all the adaptive key recovery attacks we presented, both novel and prior work, take advantage of the fact that decryption is a relatively “easy” procedure, where the secret key is typically just multiplied with the ciphertext or it is applied in a modular reduction. This is a stark contrast to, e.g., block ciphers where the secret key is carefully scrambled, and changing one bit of the ciphertext will result in an avalanche effect so that several bits of the decrypted ciphertext are changed. A naive remedy would be to create a scheme with a more “convoluted” decryption procedure. However, bootstrapping a scheme hinges both on circular security and on the decryption circuit being as easy as possible: if this is not the case, the homomorphic evaluation of the decryption circuit will not reduce the noise in the ciphertext sufficiently to allow for further evaluations of it. In other words, the scheme would not be fully homomorphic. The easy decryption procedure is therefore inherent in all bootstrappable schemes. Furthermore, all suggested SHE and LHE schemes have been designed to be bootstrapped so that they may be expanded to an FHE scheme, meaning they all have a shallow decryption circuit. The overview we provided strongly suggests that this approach is not compatible with providing security against adaptive key recovery attacks or IND-CCA1 security.

We repeat the point from Zhang et al. [7], namely that as the use cases of *HE schemes increase the probability of the leakage of decrypted material, IND-CCA1 is an essential requirement for a secure homomorphic encryption scheme. We believe that a good starting point for creating an *HE scheme that achieves IND-CCA1 security would be the generic construction using zk-SNARKs by Canetti et al. [73]. As mentioned in Section 6.4, the construction relies on non-falsifiable assumptions. However, as the authors noted, one may use weaker primitives such as designated-verifier zk-SNARKs, and it is an interesting open problem to determine the minimum flavour of zero-knowledge that is needed to achieve IND-CCA1 security using the Canetti et al. construction. Alternatively, developing pure SHE or LHE schemes that are not designed to be bootstrappable might be a fruitful strategy, as this could allow for a decryption procedure “convoluted” enough to result in IND-CCA1 security or protection against adaptive key recovery attacks.