--- title: Multi-Key CKKS Homomorphic Encryption url: https://www.emergentmind.com/topics/multi-key-ckks-mk-ckks-homomorphic-encryption type: topic --- # Multi-Key CKKS Homomorphic Encryption Multi-Key CKKS (MK-CKKS) Homomorphic Encryption enables homomorphic computations over ciphertexts encrypted under different public keys, supporting secure, collaborative computation of approximate real-number arithmetic without requiring key sharing among participants. The MK-CKKS framework generalizes the single-key CKKS scheme by introducing mechanisms for ciphertext extension, multi-party key management, joint evaluation, and distributed decryption, with additional complexity arising from noise growth and relinearization. MK-CKKS serves as a foundation for secure multiparty machine learning, privacy-preserving federated analytics, and other aggregate-data scenarios where parties cannot or will not unify under a common public key. ## 1. Algebraic Foundations and System Parameters All MK-CKKS constructions utilize RLWE-based rings for security and arithmetic operations. Let $R = \mathbb{Z}[x]/(x^N + 1)$ denote a cyclotomic ring of degree $N$, with the modulus $q \gg t$ for ciphertext and plaintext arithmetic, respectively. The CKKS encoding embeds complex (or real) vectors as elements of $R_t$, using a canonical embedding and scaling parameter $\Delta$ (typically $\Delta \approx 2^{40}$). For circuits of multiplicative depth $L$, a chain of moduli $q_L \gg \cdots \gg q_0$ supports modulus switching and noise management. The RLWE assumption over $R_q$ underpins semantic security, with discrete Gaussian or uniform binary distributions for secret and error sampling. The CRS (common reference string) includes the ring dimension, modulus chain, error distributions, and a random public vector $\mathbf{a}$ in $R_q^d$ for gadget decompositions [2104.06824], [2506.20101], [2007.09270]. ## 2. Key Generation, Aggregation, and Ciphertext Structures Each party $i$ samples secret $s_i \leftarrow \chi$ and corresponding error $e_i \leftarrow \chi$, generating public key $\text{pk}_i = (b_i = -a \cdot s_i + e_i, a)$ and secret $s_i$. To enable ciphertext operations involving multiple key owners, several aggregation techniques are employed: - **Slotwise ciphertext extension** embeds a fresh ciphertext, originally in $R_q^2$, into a vector $(c_0, \ldots, c_K) \in R_q^{K+1}$, directly associating each slot with a key index [2007.09270]. - **Aggregated/threshold keys:** Protocols such as xMK-CKKS aggregate parties' public keys into a joint public key $\mathbf{b}_{\mathrm{agg}} = \sum_{i=1}^N \mathbf{b}_i$ that supports compact ciphertexts and reduction in communication/computation overhead [2104.06824], [1911.04101]. - **Joint threshold secret:** For decryption of the computation result under the joint model, each party holds partial knowledge of the aggregate secret and releases only a partial decryption share, ensuring that no strict subset of the parties can recover the plaintext [1911.04101]. - **Evaluation/relinearization keys:** Each party generates auxiliary evaluations (e.g., RGSW encryptions of the secret's bits) to enable relinearization/key-switching after multiplication, generalizing CKKS’s single-key relinearization [1911.04101], [2007.09270], [2506.20101]. ## 3. Encryption, Homomorphic Operations, and Relinearization Encryption of a plaintext $m \in R_t$ under $\text{pk}_i$ follows CKKS principles: \[ c_0 = w \cdot b_i + m + e_0, \quad c_1 = w \cdot a + e_1 \quad \bmod Q, \] outputting $(c_0, c_1)$ and key index $i$ [2007.09270], [2506.20101]. Single-key ciphertexts are extended to multi-key vectors or matrices, with zeros in slots for non-owning parties. Homomorphic addition is componentwise across the $(K+1)$-element vector structure. Multiplication forms the outer product $(K+1) \times (K+1)$ tensor, followed by a joint relinearization step—implemented via RGSW or RNS gadget decompositions—to compress back to the $(K+1)$-slot structure. For example, SMHE uses the RNS-external-product formulas to absorb cross-terms and enforce ciphertext compactness [2506.20101]. Efficient dimension-reduction protocols, such as forming a joint key for $N$ owners and combining with the client key, enable constant-size ciphertexts (e.g., $2 \times 2$ matrices rather than $2(N+1)$-dimensional vectors), providing a linear speedup in both storage and operations [1911.04101]. ## 4. Decryption, Masking, and Security Models Decryption requires combining the contributions of all involved parties' secrets. Each party $j$ computes a share $\rho_j = c_j s_j$ (possibly adding independent "smudging" noise) and broadcasts $\rho_j$; the result is $\mu = c_0 + \sum_{j=1}^K \rho_j \bmod Q$, followed by CKKS decoding [2007.09270], [2506.20101]. **Vulnerability in standard CDKS MK-CKKS:** In a distributed setting, if each client's partial decryption share and the matching ciphertext component are visible, plaintext leakage is possible: $m_i = c_0^i + \nu_i \bmod Q$ [2506.20101]. **SMHE masking:** To address this, SMHE introduces a masked multi-key decryption flow. Each party produces: - A standard ciphertext $ct_i$. - A zero-encryption $cz_i = r_i \cdot pk_i + \text{error}$. - A gadget encryption $\Gamma_i$ of the mask $r_i$. During aggregation, pairwise mask cancellations ensure that no party or server can isolate $c_0^i + \nu_i$ for any $i$, thus restoring IND-RLWE security even under honest-but-curious collusions up to $k < N-1$ participants plus server [2506.20101], [2104.06824]. Security proofs for all major constructions reduce to the RLWE assumption in $R_q$. Masking introduces additional gadget noise but can be bounded to avoid exceeding the noise budget for typical circuit depths and parameter settings [2506.20101]. ## 5. Noise Growth, Ciphertext Size, and Computational Complexity Noise growth mirrors that of single-key CKKS: additive after encryption and addition, multiplicative (and complex) after multiplication, with reduction at each rescale. In multi-key settings: - Ciphertext size is $K+1$ (or $O(1)$ in optimized threshold aggregations) ring elements; the reduction from $2(N+1)$ to $4$ polynomials via threshold joins is empirically significant [1911.04101]. - Homomorphic addition complexity is $O(K)$ ring additions; multiplication is quadratic, dominated by $O(K^2)$ ring multiplications and $O(K)$ gadget operations for relinearization [2007.09270]. - State-of-the-art schemes (SMHE) add at most a $2\times$ communication and runtime overhead over unmasked CDKS, with runtimes for deep networks on hundreds of slots well within seconds per iteration, and ciphertext sizes $<$140 MB even for complex models (AlexNet) [2506.20101]. ## 6. Applications, Security Guarantees, and Practical Recommendations MK-CKKS is foundational for privacy-preserving federated learning, multi-party statistics, and secure collaborative machine learning, allowing multiple data owners to contribute encrypted data without cross-key exposure. Deployments such as xMK-CKKS and SMHE demonstrate robust privacy guarantees against party-server collusions, minimal accuracy loss ($<1\%$ for deep learning tasks), and efficient scaling to $N=50$ parties and large slot counts [2104.06824], [2506.20101]. A table summarizing representative schemes: | Scheme | Ciphertext Size | Homomorphic Ops | Security Model | |----------------|--------------------------|---------------------|-----------------------| | CDKS MK-CKKS | $K+1$ ring elements | $O(K^2)$ multiply | RLWE, leaky to parties| | SMHE | $K+1$ + mask terms | $O(K^2)$ mult, mask | RLWE, collusion safe | | xMK-CKKS | 2 ring elements/agg. key | $O(N)$ addition | RLWE, robust to $k