Paper 2024/451

Towards Verifiable FHE in Practice: Proving Correct Execution of TFHE's Bootstrapping using plonky2

Louis Tremblay Thibault, Zama
Michael Walter, Zama

In this work we demonstrate for the first time that a full FHE bootstrapping operation can be proven using a SNARK in practice. We do so by designing an arithmetic circuit for the bootstrapping operation and prove it using plonky2. We are able to prove the circuit on an AWS C6i.metal instance in about 20 minutes. Proof size is about 200kB and verification takes less than 10ms. As the basis of our bootstrapping operation we use TFHE's programmable bootstrapping and modify it in a few places to more efficiently represent it as an arithmetic circuit (while maintaining full functionality and security). In order to achieve our results in a memory-efficient way, we take advantage of the structure of the computation and plonky2's ability to efficiently prove its own verification circuit to implement a recursion-based IVC scheme.

Note: Added benchmarks for Hpc7a instance.

Available format(s)
Publication info
Verifiable FHESNARKTFHEplonky2
Contact author(s)
louis tremblay thibault @ zama ai
michael walter @ zama ai
2024-04-03: last of 3 revisions
2024-03-15: received
See all versions
Short URL
Creative Commons Attribution


      author = {Louis Tremblay Thibault and Michael Walter},
      title = {Towards Verifiable {FHE} in Practice: Proving Correct Execution of {TFHE}'s Bootstrapping using plonky2},
      howpublished = {Cryptology ePrint Archive, Paper 2024/451},
      year = {2024},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.