Abstract. Threshold Fully Homomorphic Encryption (Th-FHE) is an extension of Fully Homomorphic Encryption (FHE) where the decryption capacity is splitted across multiple parties. As shown by Boneh et al [CRYPTO'18], Th-FHE may be used to thresholdize a cryptographic function CF, by publicly providing Th-FHE encryptions of CF's secrets, letting each party homomorphically evaluating CF and running the Th-FHE decryption protocol. In this presentation, we will show how to transform the CKKS FHE scheme of Cheon et al [ASIACRYPT'17] into an efficient Th-FHE, and use it to thresholdize several cryptographic functions. Concerning the Th-FHE version of CKKS, we will first highlight the performance of CryptoLab's HEaaN library, both for approximate and exact computations. We will then describe a distributed key generation algorithm to obtain a Th-FHE parametrization that is as efficient as the best FHE parametrizations, without relying on a trusted dealer. Finally, we will describe how to efficiently perform noise flooding in threshold decryption. In the second part of the talk, we will highlight applications of threshold CKKS: one-round threshold AES128 in < 0.1s, two-round threshold Dilithium in <1s and near real-time 1:N identification based on irises for millions of users.
Based on works with: Jung Hee Cheon, Hyeongmin Choe, François Colin de Verdière, Jincheol Ha, Guillaume Hanrot, Jaehyung Kim, Jung Woo Kim, Seonhong Min, Taeyeong Noh, Jai Hyun Park, Alain Passelègue, Damien Stehlé, Elias Suvanto. Made possible with CryptoLab's HEaaN library.
[Slides] Suggested reading: DKG for Threshold CKKS-FHE (ia.cr/2025/2057); Threshold FHE with Synchronized Decryptors (ia.cr/2026/031)
