Module transciphering 

Server-side homomorphic conversion of a symmetric-cipher ciphertext into an FHE ciphertext.

It is a way for a client to provide inputs to the server without having to run the FHE encryption, resulting in smaller inputs and removing the need for a zk proof of encryption. The client encrypts data with a lightweight symmetric stream cipher, using a key it generates locally, and ships an FHE encryption of that key to the server once. The server, holding only the encrypted key, applies a transcipher round that turns each symmetric ciphertext into an FHE ciphertext of the same plaintext.

End-to-end example using Kreyvium:

use rand::Rng;
use tfhe::shortint::prelude::*;
use tfhe::shortint::parameters::current_params::V1_8_PARAM_MESSAGE_2_CARRY_2_KS_PBS_TUNIFORM_2M128;
use tfhe::transciphering::{
    KreyviumFheState, KreyviumPlainKey, KreyviumPlainState, StreamCipher, Transcipherer,
};

let (client_key, server_key) =
    gen_keys(V1_8_PARAM_MESSAGE_2_CARRY_2_KS_PBS_TUNIFORM_2M128);

// Client: pick a symmetric key + IV and encrypt a u64 with plain Kreyvium.
let mut rng = rand::thread_rng();
let key_bits: [bool; 128] = std::array::from_fn(|_| rng.gen());
let iv_bits: [bool; 128] = std::array::from_fn(|_| rng.gen());
let input: u64 = 0xDEADBEEFCAFEBABE;
let input_bytes = input.to_le_bytes();

let mut sym = KreyviumPlainState::new(key_bits, iv_bits);
let sym_cipher = sym.encrypt(&input_bytes).unwrap();

// Client → server: ship the FHE-encrypted Kreyvium key (one-time setup).
let enc_key = KreyviumPlainKey::from(key_bits).encrypt(&client_key);

// Server: warm up the FHE-side Kreyvium stream and transcipher.
let mut fhe_stream = KreyviumFheState::new(enc_key, iv_bits, &server_key);
let blocks = fhe_stream.transcipher(&server_key, &sym_cipher).unwrap();

// Client: decrypt to recover `input`.
let recovered: u64 = blocks
    .iter()
    .enumerate()
    .map(|(i, b)| client_key.decrypt(b) << (2 * i))
    .sum();
assert_eq!(recovered, input);

Re-exports

pub use ciphers::aes::AesFheKey;

pub use ciphers::aes::AesFheRoundKeys;

pub use ciphers::aes::AesFheState;

pub use ciphers::aes::AesIv;

pub use ciphers::aes::AesPlainKey;

pub use ciphers::aes::AesPlainState;

pub use ciphers::aes::SerializableAesFheKey;

pub use ciphers::kreyvium::KreyviumFheKey;

pub use ciphers::kreyvium::KreyviumFheState;

pub use ciphers::kreyvium::KreyviumIV;

pub use ciphers::kreyvium::KreyviumPlainKey;

pub use ciphers::kreyvium::KreyviumPlainState;

pub use ciphers::kreyvium::SerializableKreyviumFheKey;

pub use ciphers::one_time_pad::OneTimePadFheSecretMask;

pub use ciphers::one_time_pad::OneTimePadFheState;

pub use ciphers::one_time_pad::OneTimePadPlainSecretMask;

pub use ciphers::one_time_pad::OneTimePadPlainSecretMaskConformanceParams;

pub use ciphers::one_time_pad::OneTimePadPlainState;

Modules

backward_compatibility

ciphers

Implementation of the supported stream ciphers

Structs

CompressedTranscipheringServerKey

Seeded form of TranscipheringServerKey, which is what gets stored and transmitted.

ExpandedTranscipheringServerKey

CompressedTranscipheringServerKey expanded to the standard domain, before the Fourier conversion done by Self::to_fourier.

FheKeyStream

An FHE encrypted keystream that can be xored with an input encrypted with a StreamCipher.

InsufficientKeystream

Returned when a stream cipher state cannot generate enough keystream to satisfy the request.

StreamCiphertext

Output of StreamCipher::encrypt / StreamCipher::encrypt_bits: a stream-cipher ciphertext that the client ships to the server for transciphering.

StreamCiphertextConformanceParams

Parameters used to check StreamCiphertext conformance: the expected cipher family and bit length.

TranscipheringPrivateKey

Secret key material of the transciphering subsystem.

TranscipheringServerKey

Key material of the transciphering subsystem.

Enums

StreamCipherKind

Identifier for a concrete stream-cipher family.

TranscipherError

Errors raised by StreamCipher / Transcipherer operations that consume a StreamCiphertext.

TranscipherSession

Owning, runtime-dispatched Transcipherer. Lets higher layers keep a single concrete type that can hold any in-tree cipher state (Self::Kreyvium, Self::Aes), plus arbitrary out-of-tree implementors via Self::Dynamic.

Traits

StreamCipher

Client-side: a stateful symmetric-cipher session, no FHE.

Transcipherer

Server-side: a stateful FHE-side session that mirrors a StreamCipher. Same shape as StreamCipher, FHE-evaluated.

Functions

apply_keystream

Xor an FHE keystream with a clear StreamCiphertext.