Developer’s Checklist: How to Build an FHE Application

Developing fully homomorphic encryption (FHE) applications can seem daunting for most developers, as it involves unique parameters and concepts that differ from traditional programming. However, approaching FHE development methodically can make the process more manageable. Here's a step-by-step checklist for building an FHE application:

1. Design your architecture for a clean client-server handoff. In an FHE application, the client encrypts plaintext data and sends it to the server. The server performs computations on the encrypted data and returns the results. The client is the only entity with the decryption keys, and the server should be able to execute calculations without querying the client during computation.

2. Build a plaintext version of your application. Since working with encrypted data can make debugging difficult, start with a non-encrypted version of your application. Use this plaintext application as a control sample, testing every version and update against it using robust test data.

3. Stripping branches is essential in FHE application development. Conditional branching based on intermediate values is not allowed in FHE applications. Instead, use branchless computation, evaluating both sides of a conditional and employing an arithmetic selector to choose the result. This replaces branching logic with linear algebra.

4. Mind your noise budget. Every multiplication step in an FHE application consumes noise, and too many multiplications can overwhelm the encrypted data, rendering the results unreadable. Monitor the multiplicative depth, which refers to the longest single chain of dependent multiplications in an application. Opt for shorter chains, avoid multiplications when additions suffice, favor tree-structured reductions over sequential accumulation, and seek the shortest critical path.

Bootstrapping can be employed to refresh the noise on encrypted data, allowing for additional computation, but this technique is computationally expensive and should be used sparingly.

5. Approximate non-linear functions since FHE doesn't have native support for functions like division, comparison, root, and sigmoid operations. You can either remove such functions or replace them with polynomial approximations (e.g., Chebyshev series). Polynomial approximations add multiplication, increasing multiplicative depth, and the higher the accuracy of the approximation, the more it consumes the noise budget.

Weigh the tradeoffs between accuracy and computational cost, as polynomial approximations are usually only applicable to a specific bounded input range.

6. Convert your application to integers and constrain precision. FHE operates solely on integers, so every variable in the application must be converted from floating-point to integer or fixed-point arithmetic. Precision must also be constrained, typically in the 16–32-bit range depending on the parameter choices made in Step 7.

7. Define the scheme, parameters, and SIMD strategy. The encryption scheme you choose determines the kind of math you can perform in your FHE application. BFV and BGV are integer-only schemes typically used in image processing, while CKKS is approximate and better suited for real values (using fixed-point representation). Alongside the encryption scheme, define the degree of polynomials used in ciphertexts (usually 2¹⁵ or 2¹⁶), known as the ring dimension.

This parameter, in combination with previous decisions, impacts security level, slot count, and multiplicative depth.