HEAX: An Architecture for Computing on Encrypted Data With the rapid increase in cloud computing, concerns surrounding data privacy, security, and confidentiality also have been increased significantly. Not only cloud providers are susceptible to internal and external hacks, but also in some scenarios, data owners cannot outsource the computation due to privacy laws such as GDPR, HIPAA, or CCPA. Fully Homomorphic Encryption (FHE) is a groundbreaking invention in cryptography that, unlike traditional cryptosystems, enables computation on encrypted data without ever decrypting it. However, the most critical obstacle in deploying FHE at largescale is the enormous computation overhead.  :89,this paper, we present HEAX, a novel hardware architecture for FHE that achieves unprecedented performance improvement. HEAX leverages multiple levels of parallelism, ranging from ciphertextlevel to finegrained modular arithmetic level. Our first contribution is a new highlyparallelizable architecture for numbertheoretic transform (NTT) which can be of independent interest as NTT is frequently used in many latticebased cryptography systems. Building on top of NTT engine, we design a novel architecture for computation on homomorphically encrypted data. We also introduce several techniques to enable an endtoend, fully pipelined design as well as reducing onchip memory consumption. Our implementation on reconfigurable hardware demonstrates 164268x performance improvement for a wide range of FHE parameters.

FPGAbased Accelerators of Fully Pipelined Modular Multipliers for Homomorphic Encryption Homomorphic encryption (HE) is an important cryptographic primitive which allows privacy preserving computations. Current HE schemes are all based on modular arithmetic. Modular multiplication (ModMult) is one of the most frequently used modular operations, but in practice it is often prohibitively slow due to a reduction operation with high computational complexity. To address this speed problem, we demonstrate a set of novel FPGAbased accelerators for fully pipelined ModMults in this paper. For a highthroughput integer multiplier (IntMult) in the ModMult designs, digital signal processing (DSP) slices on FPGAs are efficiently exploited with optimized IntMult designs. For the full RNSHEAAN scheme, which is our target HE scheme, our proposed Barrett ModMult design is optimized using specific moduli and extended to the Shoup ModMult algorithm. Our proposed Barrett and Shoup ModMult designs implemented on a Xilinx Virtex UltraScale FPGA show a 2 xc3x97 shorter delay, 14xc3x97 higher throughput at the same frequency, and 3xc3x97 higher throughputDSP than the previous nonfully pipelined Barrett ModMult design on average. In particular, our Barrett ModMult design with the specific moduli shows the highest throughputDSP value although precomputation required in the Shoup ModMult design is not used. Compared with a reference software implementation, our ModMult designs show 679xc3x97 faster average processing speeds when we deploy multiple ModMult cores that fully use DSP slices on our target FPGA.