Our goal: IVC from lattices

Incrementally verifiable computation (IVC) is a cryptographic primitive that allows a long (possibly infinite) computation to be run, such that correctness of the state of the computation can be efficiently verified at any point. IVC and its generalisation, proof-carrying data (PCD), have found numerous applications in succinct blockchains, verifiable delay functions, SNARKs for machine computations, and more.

Originally, IVC and PCD were built on recursive SNARKs, but more recent constructions are built from so-called folding and (split-)accumulation schemes. Informally, a folding scheme “folds” several instances of a certain relation into a single instance, so that correctness of the folded instance implies correctness of all original instances. Until recently, folding (aka accumulation) schemes are instantiated using homomorphic commitments based on the discrete logarithm assumption.

Since we know that there exist homomorphic commitments from lattices, our goal is to construct a folding scheme from lattices. Specifically, we aim for a lattice equivalent of Nova (hence the name Lova 💕). ¹

Lattice-based commitments

We start with the Ajtai commitment, which is secure under the Short Integer Solution (SIS) assumption. To commit to an integer vector $\mathbf{s}$ of length $m$, we sample a public matrix $\mathbf{A}$ of dimensions $n \times m$, and we commit $\mathbf{s}$ as $\mathbf{t} := \mathbf{A}\mathbf{s}$. However, this commitment is only secure as long as $\mathbf{s}$ is short, i.e., $|{\mathbf{s}}|_2 \le \beta$ for an appropriate parameter $\beta$. ²

This follows from the SIS assumption, which posits that given a randomly generated matrix $\mathbf{A}$ of suitable dimensions, it is infeasible to find a short (non-zero) vector $\mathbf{s}$ such that $\mathbf{A}\mathbf{s} = 0$.

A naïve attempt

Our goal is take two commitments $\mathbf{t}_1$ and $\mathbf{t}_2$, and fold them into a single commitment $\mathbf{t}’$.

As a naïve attempt to fold these two commitments, we can try taking a random linear combination of two commitments and witnesses. For example, sampling $c_1$ and $c_2$ from some sampling set (which we don’t define yet), we can define the new folded witness as $\mathbf{s}’ := c_1\mathbf{s}_1 + c_2\mathbf{s}_2$, and the corresponding commitment as $\mathbf{t}’ := c_1\mathbf{t}_1 + c_2\mathbf{t}_2$.

However, this immediately runs into a completeness issue. Even though $\mathbf{s}_1$ and $\mathbf{s}_2$ are short, the folded witness satisfies

This bound can exceed $\beta$. Since witnesses must remain small for the commitment scheme to be secure, this construction allows us to fold only a small constant number of times before the scheme becomes insecure.

A folding scheme with relaxed extraction

Achieving perfect completeness

In order to circumvent this issue, we use decomposition, a standard trick in the lattice literature with which we can ensure that values remain small. Specifically, consider a prover that holds the instances $\mathbf{t}_1, \mathbf{t}_2$ and the corresponding witnesses $\mathbf{s}_1, \mathbf{s}_2$. For simplicity, we write $\mathbf{T} :=\begin{bmatrix}\mathbf{t}_1 & \mathbf{t}_2 \end{bmatrix}$ and $\mathbf{S} :=\begin{bmatrix}\mathbf{s}_1 & \mathbf{s}_2 \end{bmatrix}$ (note that we have $\mathbf{T} := \mathbf{A}\mathbf{S}$). For an appropriate decomposition basis $b$, the prover first decomposes the witnesses as $\mathbf{S}_i = \sum_{j=0}^{k-1}b^j \cdot \tilde{\mathbf{s}}_{i,j}$, where each entry of $\tilde{\mathbf{s}}_{i,j}$ is at most $b$ (i.e., $|| \mathbf{s}_{i,j}||_2 \le b\cdot \sqrt{m}$). For legibility, we write \(\tilde{\mathbf{S}} = \mathbf{G}^{-1}(\mathbf{S}) = \begin{bmatrix}\tilde{\mathbf{s}}\_{1,0} & \cdots & \tilde{\mathbf{s}}_{1,k-1} & \tilde{\mathbf{s}}\_{2,0} & \cdots & \tilde{\mathbf{s}}\_{2,k-1} \end{bmatrix} \in \mathbb{Z}\_q^{m \times 2k}\enspace.\) The prover then commits to this decomposition as $\tilde{\mathbf{T}} := \mathbf{A}\tilde{\mathbf{S}}$, and sends it to the verifier.

The verifer first then samples random challenges $c_1, \ldots, c_{2k}$, and sends $\mathbf{c} := \begin{bmatrix} c_1 & \cdots & c_{2k}\end{bmatrix}^{\top}$ to the prover.

Finally, the prover takes a random linear combination of its witness as the folded witness $\mathbf{S}’ := \tilde{\mathbf{S}} \mathbf{c}$, and the verifier does the same to compute the folded instance $\mathbf{T}’ := \tilde{\mathbf{T}} \mathbf{c}$. The verifier also needs to perform some consistency checks, namely, that the commitment to the decomposed witness matches the original commitment to the non-decomposed witness, i.e., $\mathbf{T} \overset{?}{=} \tilde{\mathbf{T}}\mathbf{G}$, where $\mathbf{G} := \begin{bmatrix}1 & b & \cdots & b^{k-1} \end{bmatrix} \otimes \mathbf{I}$ is a gadget matrix that contains powers of the basis $b$; in essence, we leverage the homomorphism of the commitment to link the new folded instance to the original instance.

Note that $\mathbf{T}’ = \mathbf{A}\mathbf{S}’$, and furthermore $||\mathbf{S}’_{:,i}|| \le 2k \cdot |\mathbf{c}_i|\cdot b\cdot \sqrt{m}$. By sampling $\mathbf{c}_i$ from $\{-1, 0, 1\}$ we ensure that $|\mathbf{c}_i| = 1$, and we can set the scheme parameters to ensure that $2k b \sqrt{m} \le \beta$.
This is a perfectly complete scheme for a lattice commitment, and the norm of the folded witness does not grow when folding!

Extractability

Let’s analyze the knowledge soundness of this construction. We can run a malicous prover $2k$ times with the same initial message $\tilde{\mathbf{T}}$, different challenges $\mathbf{c}^{(i)}$, and observe the prover’s folded witness output $\mathbf{S}’^{(i)}$ for $i \in [2k]$. Assuming that $\tilde{\mathbf{T}}\mathbf{c}^{(i)} = \mathbf{A}\mathbf{S}’^{(i)}$, and with the additional requirement that $\mathbf{c}^{(i)}$ and $\mathbf{c}^{(j)}$ differ in exactly one location (say, $\ell$), and such that $\mathbf{c}^{(i)}_\ell \neq - \mathbf{c}^{(j)}_\ell$ (i.e., one of those values is $0$, and the other is $\pm 1$). ³

By setting $\bar{\mathbf{S}}_{:,\ell} := \frac{1}{\mathbf{c}^{(i)}_\ell - \mathbf{c}^{(j)}_\ell}(\mathbf{S}’^{(i)} - \mathbf{S}’^{(j)})$, we have that \(\begin{align*} \mathbf{A}\bar{\mathbf{S}}\_{:,\ell} &= \mathbf{A} \frac{1}{\mathbf{c}^{(i)}\_\ell - \mathbf{c}^{(j)}\_\ell} \left(\tilde{\mathbf{S}}\mathbf{c}^{(i)} - \tilde{\mathbf{S}}\mathbf{c}^{(j)}\right) \\\\\\ &= \mathbf{A} \frac{1}{\mathbf{c}^{(i)}\_\ell - \mathbf{c}^{(j)}\_\ell} \left(\mathbf{c}^{(i)}\_\ell \tilde{\mathbf{S}}- \mathbf{c}^{(j)}\_\ell \tilde{\mathbf{S}}\right) \\\\\\ &= \mathbf{A} \tilde{\mathbf{S}} \\\\\\ &= \mathbf{T}\_{:,\ell}\enspace, \end{align*}\)
and thus $\bar{\mathbf{S}}_{:,\ell}$ is a valid witness for the original instance (or, we’ve found a valid SIS solution, which is infeasible if we set our parameters right).

However, this extracted witness has norm $2\beta$, and if we extract $T$ consecutive folding, we’ll get a witness that has norm $(2\beta)^T$, which is essentially meaningless when $T$ is large.

Achieving perfect extractability

In order to get rid of this norm growth in the extracted witness, we will force the prover to provide additional information about the norm of its witness to the verifier. We thus augment our instance to also contain an inner product matrix $\mathbf{D}$, which should correspond to all inner products of columns of the witness, i.e., $\mathbf{D} := \mathbf{S}^\top \mathbf{S}$.

Along with the commitment to the decomposed witness, the prover now also sends the inner product matrix $\tilde{\mathbf{D}} := \tilde{\mathbf{S}}^\top \tilde{\mathbf{S}}$. Note that the diagonal of $\tilde{\mathbf{D}}$ contains the squared norm of the norm of the columns of $\tilde{\mathbf{S}}$.

To fold this second part of the instance, the verifier computes $\mathbf{D}’ := \mathbf{c}^\top \tilde{\mathbf{D}}\mathbf{c}$, which is consistent with the folded witness computed by an honest prover.

As before, the verifier needs to ensure consistency of this decomposed “instance” that the prover sends with the original instance, which it does by checking that $\mathbf{D} \overset{?}{=} \mathbf{G}^\top \tilde{\mathbf{D}}\mathbf{G}$.

Intuitively, adding this information about the norm of the witness to the relation itself ensures that it is directly checkable after all folding steps have concluded, and we can argue that with a malicious prover cannot get the verifier to output the verifier to output a folded instance that does not correspond to the norm of the witness except with some probability. To see why, note that if $\mathbf{D}$ and $\mathbf{D}’$ are not consistent, then the prover passed a polynomial identity check of degree 2, which by the Schwartz-Zippel-Demillo-Lipton lemma, will only succeed with probablity $\frac{2}{3}$ (the denominator of $3$ comes from our sampling set).

$\frac{2}{3}$ is obviously still a large error, which is why we need to boost the protocol by considering witness of size $m \times t$ for some security parameter $t$, which will drive the error of this check down to roughly $\left(\frac{2}{3}\right)^t$.

Is Lova concretely efficient?

Lova has some nice properties for concrete efficiency:

• Because we use plain SIS, we don’t need any special structure of the modulus, so we can choose the hardware-friendly modulus $q= 2^{64}$, and we don’t need to do any modular reduction.
• Almost all operations are also purely linear algebra, which can optimized very efficiently.
• Because the protocol is very algebraic and consists of a single round, it is also very recursion-friendly, as we only need to hash out a single matrix of ternary challenges.

However, because of the high soundness error (see section above), the security parameter we need to use is quite large ($t > 300$), which leads to concretely large proof sizes (dozens of megabytes for witnesses of length $>2^{17}$) and prover times ($>10$ minutes).

Lova vs Latticefold

Concurrently to our work, Dan Boneh and Binyi Chen have proposed Latticefold, which is also a folding scheme from lattices. They use structured lattice assumptions, and focus much more on practical efficiency (for example, targeting CCS as their constraint system, and drilling down on an NTT-friendly variant of sumcheck). Because of this, it is to be expected that Latticefold will be more efficient in practice than Lova, from the additional structure of the R-SIS assumption.

However, Latticefold uses the sumcheck protocol to get around the relaxed extractability issue. Intuitively, this seems like a tool that is “too heavy” for the simple task of folding ⁴. For example, the folding approaches based on DLog are much more algebraic, and do little more than taking a random linear combination of the folding inputs.

Our goal with Lova was to provide a foundation for “algebraic” folding from lattices, and we believe that more efficient follow-ups to Lova, using similar techniques but more structured assumptions are very promising avenues for efficient post-quantum folding schemes.

While this new production is breath of fresh air after more than a decade of Christian Spuck’s rule over the Ballet Zürich, it unfortunately fails to impress. Beyond a lack of proper technique (both on stage and in the orchestra pit), there seems to be somewhat of a rift between the London-born play and the Zürich cast.

The play itself is very biographical (almost ostentatiously so), closely following du Pré’s life from childhood to stardom, wedding, illness, and death. The dancing style is quite modern (especially the cello’s part, which requires some novel contorting techniques), but still more classical than what we have been accustomed to by Spuck. All of it colour-coded for your convenience, which borders on the Disney-like at times.

Giulia Tonelli (the Cellist) is fantastic, and extremely virtuosic in the last scenes, where she very delicately dances an ill and stiff du Pré. The pas de deux between the Cellist and the Cello are (mostly) very nicely executed, airy and dreamy. The pas de trois however do not work; they appear stiff and unprepared.

The dancer’s technique in general leaves to be desired (I heard there were still many mistakes during the general repetition). Lack of training time in order to bring a ballet by Marston on stage before the summer pause, or stylistic incompatibilities between continental Zürich and british London.

For the music, the orchestra in general is quite alright, and Philip Feeney’s score patchworked from Elgar, Beethoven, Fauré, etc. is quite lovely, even if a bit too sentimental at times. The main cello soloist (Lev Sivkov) however, had the arduous task of holding up to Jacqueline du Pré’s best performances and now widely known style and timbre; unfortunately for the audience, this falls short (especially in the Elgar cello concerto, du Pré’s most well-known piece): too slow, not energetic and not melancholic enough. Dommage!

Let’s hope that the next production of Marston for the Ballet Zürich and the first few seasons of her era look a bit brighter.

Die Zauberflöte is, in my uneducated opinion, one of the most difficult operas to bring to the stage. On top of the technical challenges it poses (which are wholly manageable for any decent opera house), die Zauberflöte is among the most frequently performed of all operas, meaning one has to wow the neophyte opera-goer—who wouldn’t risk the hefty ticket price on anything not Mozart-Wagner-Verdi—and the seasoned, binoculars-clasping, loge-supervising audience, who might get bored if something on stage comes to close to any famous production from the last 230+ years. And let’s not forget the many famed arias that will inevitably draw the intense scrutiny of every spectator. Combined with the the general oniric vibe and the free-masonic imagery of the play, this can lead to some interesting choices in costume and stage directions.

To top it off, the libretto is incredibly sexist throughout, and fraught with racist stereotypes, notably the Monostatos problem: a Moor (the only dark-skinned character in the play), whose main appearances on stage include getting unjustly punished by his master, and a long aria of lamenting the hideousness of his blackness and the beauty of Pamina’s whiteness, leading to his attempted rape of Pamina. This quite disconcerting material has lead some operas to refuse to show the play altogether, to rewrite the libretto to be less offensive (which is hard, as the sexism and racism are both ubiquitous in the libretto and intimately intertwined with the plot), or at the very least conducted long consultations with experts and the public on how to contextualise the material as a product of its time.

Given all of this, I was very interested in seeing how the Opernhaus Zürich would bring die Zauberflöte on stage. Without deflowering the rest of this post, it was a hot mess, and the worst production I’ve seen in Zurich.

Crack-house meets Pirates of the Caribbean (and also live chickens?)

This performance was directed by Tatjana Gürbaca, and features the Opernhaus’ signature rotating stage (the advantages of which are still not entirely clear to me). The stage features a three-story house facade (the two upper floors being used only minimally during the play), and each housefront features a barren tree and a fireplace. The stage is often littered with trash and random debris, and the fireplace alternatively smouldering and extinguished—and sometimes converted to a makeshift barbecue using a wacky cinderblock construction, leading to what I can only describe as a crackhouse aesthetic. Perplexingly, these fireplaces are also transformed into makeshift barbecue fire pits with an elaborate cinderblock construction. Perhaps a redneck take on the free-masonic Eingeweihten? We’ll never know, and the barbecue will not be used anyway.

The costumes only reinforce this general shoddy vibe. Papageno however looks like a kid dressed as a pirate for his first birthday party, and together with the three disheveled dames gives vibes of a cheap “Pirates of the Caribbean” knock-off. The queen of the night, on the other hand, is dressed as a cancan (?) dancer draped in big, white feather fans—an interesting idea, which could have been explored more: the queen of the nightlife revealing in her “debauchery” against the bourgeois order of the Eingeweihten—, but is never seen in a similar costume again. All in all, a very confusing choice of costumes in my opinion, and a scene aesthetic that doesn’t really serve the play.

On top of being dressed in random bits and scraps of fabric, the three Dames also wear beards. Again, the significance of this choice is still a mystery to me, as it is never actually used in the play—even though one could have easily made an interesting statement about gender, especially given the mysoginistic libretto, but no such thing awaits the spectator.

This production was also supposed to feature live chicken, which I find a rather perplexing choice.

Helf’ eine mir nur aus der Noth,
Sonst gräm’ ich mich wahrlich zu Tod’.
— Papageno verzweifelter Zuschauer

Among other oddities in the production which I cannot explain: Papagena appears to Papageno perched on one of the trees and spits a copious amount onto a table below (?), and an annoying tendency to force some standup-comedy bits in-between scenes—it happens often enough that good singers are not good actors, and it is even rarer that they are good comedians.

However, I really liked the choice of having the queen of the knight present a variety of weapons each more improbable as the other to Pamina to kill Zarastro—humourous and discreet, but still fitting to the universe of the play.

Addressing the Monostatos in the room

I almost left during the intermission, but I was curious to see how the Opernhaus dealt with Monostatos in aria 13 (the rape of Pamina). I did not have high hopes given the first half, but I thought that a differentiated Ausseinandersetzung with the character of monostatos could at least not make this any worse.

Alas, I should have known from the way the sexism in the liberator was treated—i.e., not—that Monostatos’ aria would be a disaster. And indeed, Monostatos is dressed as a primitive man, wearing a hairy fur suit under his clothes and a hirsute beard—at least we were spared a Blackface. The libretto is kept as in the original, and everything is played with the utmost lack of arrangements or even context. Even on the website, there is not a single word explaining the choice of the Opernhaus regarding their production of this scene. I’m just terribly disappointed.

Stille, Stille, Stille

Putting aside the awful content of the production, the quality of the voices is also very variable. I was annoyed from the start by the lack of exact coordination between the three Dames in the very first scene—when half of the verses end on a hard germanic /t/ sound, a coordinated tempo is of utmost importance, lest the spectator falls victim to a stuttering cascade of t-t-t’s.

Vitalij Kowaljow (Zarastro) and Thomas Erlank (Tamino) were particularly good, with a consistent and solid performance and a very natural fit to the text. Christina Poulitsi (Königin der Nach) was also quite good, but lacked both tempo and power in her crucial aria.

Mit jedem Tone meinen Dank

At least, the musical performance of the Philarmonia Zurich (dir. Nikolaj Szeps-Znaider) was very good (albeit played a little too slowly for my taste), with a special mention for the flute (even wandering around on stage in the last few scenes).

In my recent work, me and my co-authors show the shortcomings of existing FHE integrity approaches, and propose a new notion for maliciously-secure verifiable FHE.

We then instantiate this new notion with a range of techniques (notably using zero-knowledge proofs), analyzing them and evaluating their performance in a range of different settings. We highlight their potential, but also show where future work on tailored integrity solutions for FHE is still required.

Introduction

Fully Homomorphic Encryption (FHE), which enables computations on encrypted data, has recently emerged into practice. Thanks to theoretical improvements, and optimizations in both software and hardware implementations, it is starting to see use in real-world deployments (e.g., the Microsoft Edge Password Monitor).

Computing on encrypted data inherently requires malleable ciphertexts (e.g., the addition of two ciphertexts is also valid ciphertext). This malleability raises the issue of integrity, as the server can deviate from the computation requested by the client. This has obvious implications for correctness, but can also have more severe consequences, allowing a malicious server to carry out key-recovery attacks and undermining the confidentiality of FHE.

So far, most work on FHE schemes and applications has chosen to side-step this issue by assuming a weak adversarial model. However, as FHE is starting to be deployed to protect critical information, we must move beyond these assumptions to a threat model that accurately reflects real-world adversaries.

Honest-but-Curious Assumption

Historically, the FHE research community has extensively made use of the assumption that the server running an FHE application would be honest-but-curious, rather than actively malicious.

This assumption may be reasonable in some deployment scenarios (e.g., when FHE is used by trusted institutions cooperating on their own data). However, the necessity to trust the server to this extent is very limiting to the scope of application scenarios, since a violation of the assumption threatens not only correctness but also confidentiality. In addition, this weak threat model does not protect against bugs in the application code, or temporary breaches of an otherwise trusted party.

A class of attacks known as reaction attacks exploits the interactive nature of real-world deployments to recover the FHE secret key. These exploit the fact that a server can craft a ciphertext that fails to decrypt correctly for certain secret keys, using the client’s reaction or lack thereof as an oracle. Practical key-recovery attacks have been developed for all major FHE schemes. Therefore, there is an urgent need to strengthen FHE to maintain strong guarantees in the context of these attacks.

Existing FHE Integrity Approaches

In order to remediate these attacks, a line of approaches has ported techniques from verifiable computation to FHE, with the aim to guarantee that a function was correctly executed. While some of these approaches are concretely efficient, there is a significant gap between the assumptions made by existing work and the way state-of-the-art FHE schemes are used in practice. In particular, existing schemes can only tolerate adversaries limited to verification oracles, much weaker than the decryption oracles present in most real-world settings. While these approaches give robust correctness guarantees, they do not offer significantly stronger confidentiality guarantees compared to standard FHE.

Another line of works aims to construct FHE schemes that achieve indistinguishability against chosen ciphertext attacks (IND-CCA1).
These schemes remain secure even in the presence of decryption oracles. Unfortunately, many of these constructions assume the presence of cryptographic primitives even stronger than FHE, and/or are too inefficient to implement in practice.
Additionally, IND-CCA1-security does not imply any correctness guarantee, which is needed for real-world FHE applications.,

Finally, approaches from both of these lines of work are often not compatible with state-of-the-art FHE schemes as implemented and used in practice (and on their way to standardization), and thus of limited value for practitioners.

Contributions

This work is the first to consider integrity in the context of real-world FHE deployment settings, addressing the issue of FHE integrity holistically. This work aims to both highlight the issues arising from the gap between existing notions and real-world scenarios, and to propose efficient instantiations of a new robust notion for FHE integrity that effectively addresses these challenges.

Maliciously-Secure Verifiable FHE

We define a new notion of integrity for FHE that captures real-world FHE deployment settings, addressing the issues we identified in our analysis. Existing notions are usually ported from conventional cryptography to FHE in a black-box manner, and often fail to address the specific characteristics of modern FHE schemes and applications. In contrast, we present a natural clean-slate notion of verifiable FHE that composes the standard notion of FHE with modular integrity properties.

Verifiable FHE

Our core notion of verifiable FHE (vFHE) can be seen at the intersection of the notion of IND-CCA1-security for FHE, together with the notion of correctness in the verifiable computation literature (against a stronger, IND-CCA1-style adversary). On top of this core notion, we define additional modular integrity notions, outlined below (formal definitions can be found in the extended version of our preprint.

Approximate FHE

Some FHE schemes (e.g., CKKS) operate over floating point numbers, and only guarantee approximate correctness. While more efficient than exact FHE schemes for many use cases (e.g., machine learning), these schemes have been shown to offer even weaker confidentiality guarantees, and integrity is harder to achieve for these schemes.

Server Inputs

Real-world FHE applications are usually not restricted to an outsourced computation setting, but often operate in a client-server 2-party setting, where the server provides input to the computation. These inputs offer a new attack surface for a malicious server, which is why we model them explicitly in our definitions.

Plaintext Inputs

Modern FHE schemes support ciphertext-plaintext operations, which are much faster than their ciphertext-ciphertext equivalents, and are heavily used in practice. We explicitly model these in our notions, which allows us to present a simpler generic integrity construction.

Input Predicates

For real-world applications, a client may want to enforce additional constraints on the server inputs. These predicates are a natural extension of the well-formedness predicate for server inputs, which is a necessary condition to achieve our core vFHE notion.

Server Privacy

We additionally incorporate the idea of circuit privacy from the FHE world, which states that the client is not allowed to learn anything besides the output of the computation. In particular, the server’s input should remain hidden from the client.

Instantiating Verifiable FHE in Practice

Generic Construction

Previous approaches IND-CCA1-secure FHE relied either on very strong cryptographic constructs (e.g., indistinguishability obfuscation), on non-standard complexity assumptions (later shown not to hold in practice), or on an expensive double-encryption paradigm, Somewhat surprisingly, we show that all of our notions (which include IND-CCA1-security) can be achieved by combining any FHE scheme with a generic zero-knowledge proof (ZKP) system. This much simpler construction is made possible by taking advantage of the IND-CPA^D-security achieved by most modern FHE schemes, and of the additional specificities of real-world FHE applications (e.g., plaintext inputs).

Concrete Constructions

We instantiate our notion of maliciously-secure verifiable FHE using a variety of different state-of-the-art ZKP systems. In the process, we highlight a series of fundamental challenges in bringing together FHE and ZKP systems, including the mismatch between the rings used in modern FHE schemes and the fields used in the vast majority of ZKP systems. We investigate several approaches to bridge this gap, and explore the trade-offs offered by novel ring-based ZKPs. We evaluate our instantiations on a variety of different workloads and compare them to a hardware-attestation–based approach (FHE-in-TEE) as a point of comparison. We show that verifiable FHE can be practical, but also highlight the need for future work on ZKP systems specifically designed for the unique characteristics of FHE.

The stage is quaintly arranged, albeit a bit boring, as a pink-ish cupboard-laden kitchen, with doors opening to reveal various backgrounds as the play progresses.

The technical quality is superb, both in the voices of Juan Diego Flórez (Werther) and Anna Stéphany (Charlotte) as well as the music, I just find the libretto and the play in general incredibly boring—one wishes Werther would just die right away, instead of languishing and singing on and on for a good 20 minutes. An exception though, the “Vivat Bacchus, Semper vivat” aria is fantastic and quite entertaining.