Fully Homomorphic Encryption (FHE) is a cryptographic primitive that allows performing arbitrary operations on encrypted data. Since the conception of the idea in [RAD78], it has been considered a holy grail of cryptography. After the first construction in 2009 [Gen09], it has evolved to become a practical primitive with strong security guarantees. Most modern constructions are based on well-known lattice problems such as Learning With Errors (LWE). Besides its academic appeal, in recent years FHE has also attracted significant attention from industry, thanks to its applicability to a considerable number of real-world use-cases. An upcoming standardization effort by ISO/IEC aims to support the wider adoption of these techniques. However, one of the main challenges that standards bodies, developers, and end users usually encounter is establishing parameters. This is particularly hard in the case of FHE because the parameters are not only related to the security level of the system, but also to the type of operations that the system is able to handle. In this paper we provide examples of parameter sets for LWE targeting particular security levels, that can be used in the context of FHE constructions. We also give examples of complete FHE parameter sets, including the parameters relevant for correctness and performance, alongside those relevant for security. As an additional contribution, we survey the parameter selection support offered in open-source FHE libraries.

Homomorphic encryption (HE) is one of promising cryptographic candidates resolving privacy issues in machine learning on sensitive data such as biomedical data and financial data. However, HE-based solutions commonly suffer from relatively high computational costs due to a large number of iterations in the optimization algorithms such as gradient descent (GD) for the learning phase. In this paper, we propose a new method called ensemble GD for logistic regression, a commonly used machine learning technique for binary classification. Our ensemble method reduces the number of iterations of GD, which results in substantial improvement on the performance of logistic regression based on HE in terms of speed and memory. The convergence of ensemble GD based on HE is guaranteed by our theoretical analysis on the erroneous variant of ensemble GD. We implemented ensemble GD for the logistic regression based on an approximate HE scheme HEAAN on MNIST data set and Credit data set from UCI machine learning repository. Compared to the standard GD for logistic regression, our ensemble method requires only about 60% number of iterations, which results in 60-70% reduction on the running time of total learning procedure in encrypted state, and 30-40% reduction on the storage of encrypted data set.

We propose the RLizard key encapsulation mechanism (KEM), whose security depends on the ring learning with errors (RLWE) and ring learning with rounding (RLWR) problems. Because RLizard operates on a special type of ring, it is more efficient in terms of both the clock cycles required for key generation and the key size compared to the original Lizard scheme. To demonstrate the superiority of the proposed method over other well-known KEMs, we compared their performances in the 32-bit ARM Internet of Things (IoT) environment. The performance analysis showed that the RLizard KEM requires the fewest clock cycles for key generation, encapsulation, and decapsulation when the parameters are set to support a security level comparable with that of AES-128. In summary, the RLizard KEM is expected to be used for secure communication and authentication between IoT endpoint devices, whose computational power is generally limited.