Security Parameters
The DESILO FHE library follows the Security Guidelines for Implementing Homomorphic Encryption, providing 128-bit security. The secret distribution is uniform ternary.
The tables below show the exact security parameters used by the library. The shape of the engine determines the security parameters. Using additional features such as bootstrap and multiparty may change the maximum level, but the security parameters remain the same.
For some shapes of the matrix engine, a lattice estimator inspired by On the Concrete Hardness of Learning with Errors was used to determine the maximum size of the LWE modulus \(q\).
The parameters are defined as follows:
- Shape: Input shape of the engine
- N: Dimension of the RLWE instance
- log₂(q): Base-2 logarithm of the LWE modulus \(q\)
Vector Engine
| Shape | N | log₂(q) |
|---|---|---|
| (4096,) | 8192 | 214 |
| (8192,) | 16384 | 430 |
| (16384,) | 32768 | 868 |
| (32768,) | 65536 | 1747 |
Matrix Engine
| Shape | N | log₂(q) |
|---|---|---|
| (256, 16, 16) | 8192 | 214 |
| (256, 32, 32) | 16384 | 430 |
| (256, 64, 64) | 32768 | 868 |
| (162, 32, 32) | 10368 | 271 |
| (162, 64, 64) | 20736 | 546 |
| (162, 128, 128) | 41472 | 1101 |
| (486, 16, 16) | 15552 | 409 |
| (486, 32, 32) | 31104 | 822 |
| (486, 64, 64) | 62208 | 1658 |
Bootstrap
Bootstrapping uses a sparse secret key with a Hamming weight of 128. On the Concrete Hardness Gap Between MLWE and LWE has demonstrated that this choice of Hamming weight provides more than 128-bit security.