Application-Aware Approximate Homomorphic Encryption

Fully Homomorphic Encryption (FHE) is a powerful tool for performing computations on encrypted data. The Cheon-Kim-Kim-Song (CKKS) scheme, an instantiation of approximate FHE, is particularly effective for privacy-preserving machine learning applications over real and complex numbers. Although CKKS offers clear efficiency advantages, confusion persists around accurately describing applications in FHE libraries and securely instantiating the scheme for these applications, particularly after the key recovery attacks by Li and Micciancio (EUROCRYPT'21) for the IND-CPA^D setting. There is presently a gap between the application-agnostic, generic definition of IND-CPA^D, and efficient, application-specific instantiation of CKKS in software libraries, which led to recent attacks by Guo et al. (USENIX Security'24). To close this gap, we introduce the notion of application-aware homomorphic encryption (AAHE) and devise related security definitions. This model corresponds more closely to how FHE schemes are implemented and used in practice, and provides a mechanism to identify and address potential vulnerabilities in popular libraries. We then propose an application specification language (ASL) and formulate guidelines for implementing the AAHE model to achieve IND-IND-CPA^D security for practical applications of CKKS. We present a proof-of-concept implementation of the ASL in the OpenFHE library showing how the attacks by Guo et al. can be countered. Moreover, we show that our new model and ASL can be used for the secure and efficient instantiation of exact FHE schemes and to counter the recent IND-IND-CPA^D attacks by Cheon et al. (CCS'24) and Checri et al. (CRYPTO'24).