Choosing a scheme¶
A scheme is named "family/variant": the family says who encrypts and
who decrypts, the variant which hardness assumption and construction it
uses. This page explains the families and variants, what the registry
records about each scheme, and which scheme fits which task. The registry
answers the same questions at runtime:
import pyfe4ai
pyfe4ai.list_schemes("mcfe", capabilities="labels", status="reviewed")
pyfe4ai.list_schemes(kind="ring_lwe")
scheme = pyfe4ai.get_scheme("mcfe/ring_lwe_threshold")
print(scheme.status.status, sorted(scheme.capabilities), scheme.refused or "accepted under standard")
Families¶
Family |
Who encrypts, who decrypts |
Use it for |
|---|---|---|
|
one encryptor; a key holder learns |
one party’s vector scored by another party’s linear model |
|
|
one-shot joint inputs; not for repeated rounds such as gradients (see Security & Status) |
|
|
federated aggregation, one label per round |
|
as MCFE, but functional keys need no authority: the clients derive shares of each functional key, and the decryptor combines them. The setup is still trusted: in this library one key generator samples every client’s keys, including the pairwise zero-sum secrets, in process; a deployment without a trusted party needs a distributed setup (e.g. pairwise key exchange), which the library does not provide |
aggregation without a key authority for functional keys (trusted setup) |
|
the functional key is shared among |
no single party able to decrypt; see Threshold decryption and the ML adapter |
|
functional keys also hide the weights |
private models |
|
the key holder learns |
quadratic scores, e.g. a bilinear model |
Assumptions¶
The variant names the hardness assumption; the registry’s kind groups
the schemes by how the security profiles size them
(KINDS).
Kind |
Variants |
Properties |
|---|---|---|
|
|
3072-bit groups under |
|
|
DDH in the ristretto255 group (about 126-bit, fixed size); small ciphertexts and fast with the Rust extension; unreviewed |
|
|
Paillier moduli of 3072 bits under |
|
the MCFE |
dense LWE without a public matrix (ABMPSW20); a label is hashed per element, so it suits short vectors |
|
|
LWE with a seeded public matrix; large public keys and slow key
generation under |
|
|
adaptive security, but refused under |
|
|
one ciphertext carries many values (packed tensors), and the Rust extension makes it the fastest choice for large vectors and gradients; post-quantum assumption |
|
the function-hiding and quadratic schemes |
BLS12-381, about 120 to 126-bit security (below the 128-bit target); needs the Rust extension (or charm-crypto for other curves) |
Capabilities¶
Each scheme lists its capabilities
(CAPABILITIES):
labels– ciphertexts and functional keys are bound to a label (the MCFE family);threshold– the functional key is shared amongsservers, andtpartial decryptions decrypt (share_decrypt,combine_decrypt);decentralized– the clients derive shares of each functional key (derive_function_decryption_key_share,combine_function_decryption_key_share);pairing– runs over a pairing group (pairing_group_param);ml_servers– the ML adapter runs the decryption servers in-process (mcfe/ring_lwe_threshold);binary_ct– binary ciphertexts (ct_format="binary", about a third of the JSON size);rns– an RNS modulus, a product of NTT primes (ring_modulus="rns").
Review status¶
Every scheme carries a review status (the full table is on
Security & Status): reviewed – checked against its paper, faithful or
adapted with the deviations listed; experimental – the construction or
its security argument is the project’s own (the threshold layers of
tMIFE-LWE, tMCFE-LWE, tMCFE-Ring-LWE and tMCFE-FH-Multi-IPE, and the carry
mask of dMCFE-DDH); unreviewed – not yet checked (the three
ddh_ristretto255 schemes). No scheme is currently known-insecure.
Which scheme for which task¶
Task |
Schemes |
|---|---|
Aggregate the gradients of many clients at one aggregator |
|
The same without a key authority for functional keys (the setup is still trusted) |
|
The same without a single decryptor |
|
Score one party’s features with another party’s linear model |
|
Adaptive (not only selective) security |
|
Hide the model weights too |
|
Quadratic functions |
|
Post-quantum assumptions |
the |
The registered schemes¶
Classes, kind, capabilities and whether the standard profile accepts
each scheme, from the registry (pyfe4ai.core.registry):
The ML adapter takes the family and the variant as two arguments
(FESchemeWrapper("mcfe", "ring_lwe", config)), not the id. Its
federated helpers accept the labelled schemes (MCFE; SIFE for one client),
not MIFE, and of the threshold and decentralized variants only
mcfe/ring_lwe_threshold, whose servers it runs; the others are used
through their scheme classes. python benchmarks/run.py fl-coverage in a
source checkout lists, scheme by scheme, whether the federated path works.