Paper 2026/1869

High-Precision Homomorphic ALU over Arbitrary Moduli with $O(1)$ Bootstrapping

Abstract

Homomorphic computation on large integers requires both arithmetic and non-arithmetic (e.g., Boolean) operations. The radix-based method by Cha et al. (EUROCRYPT'26) supports both operation types over arbitrary $n$-bit integers with a complexity of \(O(\log n)\) and \(O(1)\) bootstrapping, respectively. Meanwhile, the triangle encoding method by Gao and Zheng (CRYPTO'26) has a complexity of \(O(1)\) bootstrapping in arithmetic mode, but is restricted to power-of-two integers. Its arithmetic-to-Boolean (A2B) conversions also needs \(O(n)\) bootstrapping and is only \(O(1)\) in the amortized sense. This work improves both methods by supporting computation over arbitrary moduli with \(O(1)\) bootstrapping for both operation types, and is a generalization of Gao and Zheng's approach. Our first contribution is a framework for efficient homomorphic arithmetic over arbitrary plaintext moduli. It supports flexible radix representations and uses a CVP-based method to find defining polynomials with well-conditioned canonical embeddings and small norm growth under ring operations. When the method fails to find suitable defining polynomials, we use homomorphic Montgomery multiplication over radix-friendly plaintext rings, where each Montgomery reduction requires only $O(1)$ bootstrapping calls. Our second contribution is an efficient arithmetic-to-digit (A2D) conversion using $O(1)$ bootstrapping calls, independent of the radix used by the arithmetic representation. We implemented our method in OpenFHE. For P-384 and Curve25519, our arithmetic multiplication achieves $8.67\sim10.26\times$ and $12.57\sim13.41\times$ lower latency than CPL26's LazyMult and ExactMult, respectively. The speedups increase to $17.47\sim27.24\times$ and $25.35\sim35.63\times$ in the amortized setting. For RSA-1024 and RSA-2048, our arbitrary-modulus multiplication achieves $4.25\times$ and $7.58\times$ lower latency and $16.74\times$ and $29.85\times$ lower amortized time than CPL26's ExactMult, respectively. For 64-, 128-, and 256-bit messages, our A2B conversion is $3.75\times$, $6.40\times$, and $14.17\times$ faster than GZ26, respectively.