Electronics Guide

Encryption Schemes and Capabilities

Homomorphic encryption schemes differ in their computational capabilities and efficiency. Partially homomorphic encryption (PHE) supports either addition or multiplication on encrypted data, offering good performance but limited functionality; the RSA and Paillier cryptosystems are classic examples. Somewhat homomorphic encryption (SWHE) allows a bounded number of both additions and multiplications before accumulated noise prevents further computation. Fully homomorphic encryption (FHE) enables unlimited computation through bootstrapping, an operation that refreshes ciphertexts and resets their noise budget. The first plausible FHE construction was published by Craig Gentry in 2009; the schemes used today descend from that work but are far more efficient.

The most prominent FHE schemes include BGV (Brakerski-Gentry-Vaikuntanathan), BFV (Brakerski-Fan-Vercauteren), CKKS (Cheon-Kim-Kim-Song), and TFHE (Fast Fully Homomorphic Encryption over the Torus, also cited as CGGI after its authors). BGV and BFV operate on integers modulo a plaintext modulus and suit exact arithmetic, while CKKS supports approximate fixed-point arithmetic on real and complex numbers, making it well matched to machine learning and statistics. TFHE and its predecessor FHEW (cited as DM) encrypt small messages, commonly single bits, and provide fast programmable bootstrapping with low latency per operation. The security of all four rests on the hardness of lattice problems, principally Learning With Errors (LWE) and its ring variant (RLWE). Each scheme presents a distinct balance among computational overhead, supported operations, and precision.

No single scheme wins outright, so mature libraries increasingly support scheme switching: a workload may evaluate its arithmetic-heavy stages under CKKS or BGV and switch to TFHE for comparisons, sign tests, and table lookups that arithmetic schemes handle poorly. Hardware that targets only one scheme therefore risks stranding part of a real application, and flexible accelerators expose the primitives common to all of them—polynomial arithmetic, key switching, and automorphisms—rather than one scheme's fixed operation set.

Computational Primitives

A handful of computational primitives dominate execution time. Polynomial multiplication is the core operation, typically implemented with the number-theoretic transform (NTT), which converts convolution into pointwise multiplication in the transform domain and reduces the cost of multiplying degree-n polynomials from quadratic to roughly n log n. Modular reduction on wide integers requires specialized arithmetic. The residue number system (RNS) decomposes a large modulus into several smaller coprime moduli, allowing coefficient arithmetic to proceed in independent parallel channels that fit native machine word sizes. Implementations typically size these residue moduli at 30 to 60 bits so that each coefficient multiplication maps onto a single machine-word multiply followed by a reduction, and the number of residues, or limbs, shrinks as a leveled computation consumes its modulus budget.

Relinearization reduces ciphertext size after multiplication, converting higher-degree terms back to the base ciphertext format using evaluation keys. Key switching enables operations under a different secret key, which is what relinearization, rotation, and multi-party protocols all reduce to. Automorphisms and Galois transformations support rotations and permutations on the encrypted vectors produced by batching, and each distinct rotation amount requires its own Galois key.

Key switching, rather than multiplication itself, is usually the dominant cost. It decomposes a ciphertext into digits, multiplies each digit by a large evaluation key, and accumulates the results, so its work scales with both the number of RNS limbs and the decomposition width. The consequence for hardware is that a key-switch moves far more data than it performs arithmetic on, which is why accelerator designs are judged as much by their key-handling and memory paths as by their multiplier count.

Arithmetic Unit Design

The arithmetic demands of homomorphic encryption differ substantially from those of conventional public-key cryptography. Polynomial coefficients may be hundreds or thousands of bits wide, though RNS decomposition usually breaks these into machine-word-sized residues. NTT accelerators implement fast polynomial multiplication through butterfly networks and pipelined modular multipliers. Barrett and Montgomery reduction circuits compute modular operations efficiently without integer division.

Implementations exploit the inherent parallelism of coefficient-wise operations by deploying many arithmetic units that process different coefficients simultaneously. Vector and SIMD-style architectures treat polynomials as long vectors and apply uniform operations across their coefficients. Deeply pipelining NTT butterflies and modular multipliers raises throughput at the cost of per-operation latency. The chosen granularity of parallelism balances silicon area against performance.

Memory Hierarchy and Bandwidth

Homomorphic encryption generates enormous data volumes. A single ciphertext may occupy hundreds of kilobytes to several megabytes, and computations operate on many ciphertexts at once. Evaluation keys for relinearization and key switching can reach hundreds of megabytes to gigabytes. The resulting memory bandwidth requirements, rather than raw arithmetic throughput, dominate many designs, which are therefore memory-bound rather than compute-bound.

Effective memory hierarchies use large on-chip SRAM to buffer frequently accessed coefficients and evaluation-key components, cutting off-chip traffic. The access patterns of NTT operations have predictable structure that careful scheduling and memory-banking schemes can exploit to avoid conflicts. Compression reduces evaluation-key size at the cost of extra computation, and hybrid approaches trade arithmetic for bandwidth by recomputing values rather than storing them. High-end accelerators pair these techniques with high-bandwidth memory (HBM), whose stacked DRAM supplies hundreds of gigabytes per second and, in recent generations, more than a terabyte per second per device. Arithmetic intensity remains low regardless: most homomorphic kernels perform only a few operations per byte fetched, so sustained bandwidth, not peak multiply rate, sets the achievable throughput.

Noise Management Circuits

Noise accumulation fundamentally limits computation depth. Every operation adds noise to a ciphertext, and once that noise exceeds a threshold, decryption fails. Hardware must track the remaining noise budget and apply reduction strategies. Modulus switching lowers noise by reducing the ciphertext modulus, which requires careful management of precision and coefficient ranges and underlies the leveled approach used by BGV, BFV, and CKKS.

Noise-estimation logic predicts noise growth across a computation, enabling operation scheduling and parameter choices that maximize the achievable depth. Some architectures support adaptive parameter selection that responds to the remaining budget. Monitoring noise can trigger automatic bootstrapping when necessary, though bootstrapping carries substantial overhead. Efficient noise management is one of the clearest dividing lines between practical systems and naive ones.

Bootstrapping Fundamentals

Bootstrapping refreshes a noisy ciphertext by homomorphically evaluating the decryption circuit on it, producing a new ciphertext that encrypts the same value with reduced noise. This operation enables unbounded computation depth and is what makes an encryption scheme truly "fully" homomorphic. It is also expensive, frequently dominating execution time in deep computations and serving as the primary target for hardware acceleration.

Different schemes employ different bootstrapping techniques. BGV and BFV use digit-extraction methods that decompose the decryption circuit into manageable pieces. CKKS bootstrapping approximates the modular-reduction step with polynomial evaluation, typically a trigonometric approximation surrounded by homomorphic linear transforms; a single invocation costs seconds on a CPU but refreshes every slot in a fully packed ciphertext at once, so its amortized cost per value is small. TFHE instead performs programmable bootstrapping built on a blind rotation over the torus, refreshing one small ciphertext at a time while applying an arbitrary lookup table in the same step. Early TFHE implementations needed tens of milliseconds per gate on a single CPU core; optimized CPU and GPU implementations have since brought a single programmable bootstrap below one millisecond.

The two families therefore stress different resources, and hardware must be optimized for the bootstrapping algorithm of its target scheme. CKKS bootstrapping is bandwidth-hungry, deeply pipelined, and tolerant of latency, rewarding wide NTT arrays and large on-chip buffers. TFHE bootstrapping is latency-critical and comparatively compact, rewarding many small independent engines and low-overhead scheduling. An accelerator tuned for one profile rarely performs well on the other.

Accelerating Bootstrapping Operations

Specialized hardware accelerates bootstrapping with dedicated datapaths for its most expensive steps. Polynomial-evaluation units compute the approximations used in CKKS bootstrapping. Digit-extraction circuits exploit the structured computation patterns of BGV and BFV. TFHE bootstrapping benefits from circuits that combine blind rotation with accumulation.

Memory optimization is critical, because bootstrapping consumes large amounts of evaluation-key material. Prefetching hides memory latency by anticipating access patterns, and on-chip caching of reused key components reduces bandwidth demand. Some architectures apply lossy compression to bootstrapping keys, accepting a slight noise increase in exchange for large memory savings. The ratio between the cost of bootstrapping and the cost of ordinary operations often determines whether an FHE system is practical for a given workload.

Security and Performance Trade-offs

Parameter selection involves intertwined trade-offs among security level, performance, and supported depth. Larger polynomial degrees increase security but raise computation time more than linearly. Higher ciphertext moduli support deeper computations but demand wider arithmetic and more memory. The number of moduli in an RNS representation affects both the available parallelism and the memory footprint. The Homomorphic Encryption Standard, published by the HomomorphicEncryption.org community in 2018, provides recommended parameter sets that meet stated security levels. Its tables bound the ciphertext modulus admissible at each ring dimension: for 128-bit classical security, a ring dimension of 2¹⁴ supports a modulus of roughly 438 bits and 2¹⁵ supports roughly 881 bits. Since the achievable multiplicative depth follows directly from that modulus budget, ring dimension is the single parameter that most strongly determines both hardware cost and useful computation depth.

Implementations often support configurable parameter sets to serve different security levels and applications. Flexible architectures parameterize arithmetic-unit widths so a design can target the 128-bit, 192-bit, or 256-bit security levels. Reconfigurable polynomial-degree support lets the same hardware shift between latency-critical and throughput-oriented workloads. Runtime parameter selection requires validation to ensure the security properties hold across the entire supported parameter space.

Application-Specific Optimization

Different applications stress different parts of the hardware. Privacy-preserving machine learning inference relies mostly on additions and multiplications at moderate depth, favoring CKKS implementations tuned for vector operations. Private database queries may issue many relatively shallow computations, rewarding high-throughput designs. Some secure-computation protocols bootstrap frequently and therefore prioritize bootstrapping efficiency above all else.

Application-specific accelerators match hardware resources to expected workloads. Inference accelerators add circuits for the polynomial approximations of common activation functions and for pooling. Database-query processors optimize for batching and SIMD-style parallelism across encrypted rows. Custom instruction sets expose homomorphic primitives at an abstraction level suited to the target domain. This specialization yields better performance and efficiency than a general-purpose homomorphic encryption processor.

FPGA Implementations

Field-programmable gate arrays are an attractive platform for homomorphic encryption accelerators. Their reconfigurability allows optimization for different schemes, parameter sets, and operation mixes. DSP blocks efficiently implement modular multipliers and NTT butterflies, while on-package HBM on data-center FPGAs supplies the data rates that large polynomial operations require. Modern devices with hardened floating-point resources can also accelerate CKKS operations.

FPGAs excel at prototyping and research but face limits in power efficiency and unit cost at scale. Resource-utilization optimization packs maximum functionality into the available logic and block RAM, and time-multiplexing balances throughput against area. High-level synthesis tools accelerate design-space exploration, though hand-tuned register-transfer-level designs still achieve better efficiency. In practice, FPGA platforms serve both as research vehicles and as production accelerators for moderate-volume deployments.

Published FPGA accelerators illustrate the range. HEAX, from Microsoft Research, targeted CKKS evaluation and demonstrated that a data-center FPGA could accelerate key switching by a large factor over optimized software. Intel's HEXL-FPGA offered a high-level-synthesis path for BGV, BFV, and CKKS primitives. Later designs such as FAB and Poseidon, both built on Xilinx Alveo U280 cards with on-package HBM, went further and executed full CKKS bootstrapping on a single FPGA, which earlier designs could not fit. FPT, by contrast, targets TFHE with fixed-point arithmetic and optimizes for programmable-bootstrap throughput rather than for deep leveled arithmetic.

ASIC Designs

Application-specific integrated circuits deliver the highest performance and energy efficiency at sufficient volume. Custom memory hierarchies with specialized banking and buffering match the access patterns of polynomial operations, and precisely sized datapaths eliminate wasted resources. Advanced process nodes enable higher clock frequencies and lower power than reconfigurable alternatives. The DARPA Data Protection in Virtual Environments (DPRIVE) program, announced in 2021, funded four such ASIC efforts—teams led by Intel Federal, Duality Technologies, SRI International, and Galois—over a roughly three-and-a-half-year effort whose stated goal was to bring computation on encrypted data within one order of magnitude of the speed of the equivalent unencrypted computation. That target was set against a baseline in which FHE ran on the order of a million times slower than plaintext arithmetic.

Academic ASIC proposals mapped much of the design space ahead of commercial silicon. F1, published in 2021, was the first programmable FHE accelerator with an architecture dedicated to the workload rather than borrowed from vector processing, and it raised NTT throughput roughly two orders of magnitude over contemporary FPGA and GPU implementations. Successors including CraterLake, BTS, and ARK extended the approach to support fully packed bootstrapping, so that unbounded-depth computation—not merely a fixed number of levels—fits within the accelerator. Each of these designs devotes most of its area to on-chip memory and interconnect rather than to arithmetic, confirming that the workload is bandwidth-bound.

ASIC development requires large upfront investment and long design cycles, so it suits high-volume or standardized workloads. The lack of reconfigurability makes parameter selection a difficult bet as schemes evolve. Successful designs therefore retain some flexibility through configurable parameters or programmable sequencers that drive otherwise fixed hardware units. For cloud providers deploying homomorphic encryption at scale, the economics favor ASICs.

GPU Acceleration

Graphics processing units offer the massive parallelism that homomorphic encryption's coefficient-level operations can use, with thousands of threads operating on different polynomial coefficients at once. High-bandwidth memory sustains the required throughput, and mature software ecosystems and tooling lower the barrier to implementation.

GPU implementations contend with limited on-chip memory and less specialized arithmetic units than custom hardware. Efficient mapping of coefficients to threads maximizes utilization while respecting memory-coalescing rules, and NTT kernels must manage access patterns carefully to avoid bank conflicts. The relatively high power draw of GPUs raises total cost of ownership in data centers. Even so, GPUs serve medium-scale deployments and research well, where programmability outweighs energy efficiency. Vendor libraries that expose CUDA kernels for NTT, key switching, and bootstrapping have made the GPU the default platform for practical experimentation.

From Prototypes to Silicon

Dedicated FHE silicon reached public demonstration in the middle of the decade. Intel presented Heracles, the accelerator developed under DPRIVE, at the International Solid-State Circuits Conference in early 2026. The published design places sixty-four compute cores in an eight-by-eight grid connected by an on-chip mesh, runs at 1.2 GHz on an Intel 3-nanometer process, and pairs 64 MB of on-chip cache with 48 GB of high-bandwidth memory reached over an 819 GB/s interface. Reported speedups across seven core homomorphic operations range from roughly one thousand to about five thousand times a Xeon server processor, with the number-theoretic transform among the largest gains.

A commercial ecosystem has formed alongside the research programs. Startups including Niobium, Chain Reaction, Optalysys, and Fabric Cryptography are developing FHE and general cryptographic accelerators, with approaches ranging from conventional ASICs fabricated at established foundries to photonic computation of the transforms. Several of these companies, together with software and cloud participants, formed the FHE Technical Consortium for Hardware to align interfaces between libraries and accelerators.

Two cautions apply when reading the numbers this field publishes. First, many headline speedups come from simulation or from projections of an unfabricated design rather than from measured silicon, and they are usually quoted against a single-threaded CPU baseline. Second, speedups are reported for specific parameter sets and specific kernels; an accelerator that excels at fully packed CKKS bootstrapping may offer little advantage on a shallow, latency-sensitive TFHE workload. Comparing designs fairly requires matching schemes, parameters, security levels, and baselines.

Secure Cloud Outsourcing

Homomorphic encryption enables secure outsourcing, in which a cloud provider processes encrypted data without ever seeing the plaintext. Clients encrypt sensitive data locally, send the ciphertexts to the cloud, and receive encrypted results that only they can decrypt. This model removes the need to trust cloud infrastructure with confidential information, addressing a major barrier to cloud adoption for sensitive workloads.

Hardware accelerators in data centers make the model practical by raising performance to acceptable levels. Server-side accelerators attached over PCIe, or integrated into the CPU package, handle the heavy operations transparently to applications. Client-side hardware assists with encryption and decryption to reduce user-perceived latency. Load balancing distributes encrypted computations across accelerator resources to maximize utilization. Together these enable service models in which the computation provider has zero knowledge of the data it processes.

Deployed examples remain narrow but real. Apple's Live Caller ID Lookup, introduced with iOS 18, uses BFV-based private information retrieval so that a server can return information about a phone number without learning which number was queried; the supporting library was released as open source under the Apache 2.0 license. Notably, the feature runs acceptably on commodity hardware, which illustrates the pattern of early adoption: the workloads that reach production first are shallow, heavily batched, and co-designed with their parameter sets, while general deep computation still waits on accelerators.

Privacy-Preserving Analytics

Analytics on encrypted datasets can yield useful insight while preserving privacy. Healthcare providers can study patient populations without exposing individual records. Financial institutions can detect patterns across combined datasets without sharing customer information. Marketing teams can analyze user behavior without compromising individual privacy.

Analytics accelerators optimize for the computation patterns common to these workloads. Aggregation circuits compute sums and averages over encrypted values efficiently, while comparison and sorting hardware enables encrypted database operations. Machine learning inference accelerators support classification and regression on encrypted features. For their target workloads, these specialized units far outperform general-purpose homomorphic encryption hardware.

Batching and SIMD Operations

Batching packs many plaintext values into a single ciphertext, amortizing per-operation overhead across all of them. The Chinese Remainder Theorem partitions the plaintext space into independent slots, enabling parallel processing of many values under one homomorphic operation. This SIMD (single instruction, multiple data) style dramatically improves throughput for applications that operate on vectors or batches.

Hardware support for batching includes encoding and decoding circuits that pack and unpack batched ciphertexts, slot-wise units that process many encoded values in parallel, and rotation and permutation networks that move data between slots. Effective batching can improve throughput by a factor close to the packing density, which reaches thousands of values per ciphertext in typical parameter sets, making it one of the most impactful optimization techniques available.

Circuit Depth Minimization

Reducing the multiplicative depth of a computed function limits noise growth and the frequency of bootstrapping. Depth-minimized circuits use parallel structures and algebraic transformations to express a computation with fewer sequential multiplication levels. Supporting hardware includes circuits for Karatsuba multiplication, which lowers the count of multiplications at the cost of more additions, and comparison circuits with logarithmic depth.

Some toolchains apply automatic circuit optimization that transforms high-level operations into depth-minimized homomorphic sequences. Programmable bootstrapping and lookup-table evaluation can replace deep Boolean circuits with table interpolation for small input functions, a technique that TFHE exploits especially well. Approximate computation trades precision for reduced depth where small errors are tolerable. These optimizations matter most in deep computations, where bootstrapping would otherwise dominate.

Hybrid Approaches

Combining homomorphic encryption with other privacy-preserving techniques often improves overall performance. Garbled circuits handle some operations, such as comparisons, more efficiently than homomorphic evaluation. Secure multi-party computation can reduce the volume of data that needs homomorphic encryption. Trusted execution environments can offload portions of a computation while preserving isolation.

Hardware for hybrid protocols provides interfaces between homomorphic encryption accelerators and other security technologies. Conversion circuits translate between encrypted representations, and protocol accelerators implement the communication and cryptographic steps that hybrid schemes require. Such systems use each technique where it is strongest, reserving homomorphic encryption for the cases that genuinely need its unique capabilities.

Side-Channel Protection

Homomorphic encryption provides strong computational privacy, but hardware implementations must still guard against side-channel attacks that leak information through power consumption, timing, or electromagnetic emanation. Constant-time implementations eliminate data-dependent timing variation. Power-analysis countermeasures, such as masking and hiding, randomize observable power patterns. Fault-injection protections detect and respond to attempts to corrupt a computation.

The large, complex operations of homomorphic encryption create more surface for leakage than conventional cryptography. NTT operations must avoid data-dependent memory access. Modular-reduction circuits require constant-time behavior that does not reveal coefficient values. Noise management must proceed without timing that depends on noise magnitude. These protections add overhead but are essential where strong security guarantees are required.

Parameter Security Analysis

Choosing secure parameters demands careful cryptanalytic assessment. The Learning With Errors problem that underlies these schemes has security estimates that depend on the polynomial dimension, the coefficient modulus, and the noise distribution. Hardware must enforce parameter constraints that maintain the target security level, rejecting configurations that trade away security for speed.

Tooling such as the lattice-estimator project assesses proposed configurations against the best known lattice-reduction attacks, and validation logic can reject insecure parameter combinations at configuration time. As cryptanalysis advances, parameter requirements shift, so flexible hardware that can adopt revised estimates without a full redesign is valuable. This is one reason many accelerators favor configurable parameters over hard-wired ones.

Software-Hardware Co-Design

Effective systems require close integration between software libraries and hardware accelerators. Frameworks such as Microsoft SEAL, OpenFHE (the open-source successor to PALISADE, which also draws on HElib, HEAAN, and FHEW), IBM HElib, Lattigo, and the Rust TFHE toolchains provide high-level programming interfaces while exposing hooks for acceleration. Hardware abstraction layers allow accelerator-agnostic application development, with platform-specific backends that use whatever hardware is available.

Compiler infrastructure translates high-level homomorphic programs into efficient sequences of accelerated operations, and compiler projects built on general intermediate representations aim to make one front end target several schemes and several accelerators. Scheduling optimizers arrange operations to maximize hardware utilization and minimize memory traffic. Autotuning frameworks explore parameter spaces to find good configurations for a given workload and platform. This software-hardware co-design is essential to achieving both programmability and performance, since neither layer can deliver practical results alone.

Simulation and Verification

The complexity of homomorphic encryption hardware demands thorough simulation and verification. Functional simulators confirm correctness across parameter ranges and operation sequences. Performance models predict throughput and latency for representative workloads. Noise-tracking simulators verify that the noise-management strategy keeps ciphertexts decryptable throughout a computation.

Formal verification proves critical properties of arithmetic units and control logic, and equivalence checking confirms that an implementation matches its reference specification. Coverage analysis surfaces untested corner cases. FPGA-based emulation verifies ASIC designs at near-real-time speed. Comprehensive verification prevents costly errors in these complex, performance-critical systems.

Emerging Schemes and Techniques

Research continues to produce more efficient schemes with lower computational overhead. New bootstrapping techniques promise faster noise refresh, and scheme switching lets a single application route each stage of a computation to the construction that handles it best. Transciphering attacks the ciphertext-expansion problem from the client side: the client encrypts data with a lightweight symmetric cipher chosen for low multiplicative depth, transmits the compact result, and the server homomorphically evaluates the cipher's decryption circuit to obtain a ciphertext it can compute on. This shifts work from constrained clients and narrow links to the accelerator, and it changes what hardware must be good at.

Integration with other cryptographic primitives opens new possibilities. Combining homomorphic encryption with functional encryption enables fine-grained access control over encrypted computations. Zero-knowledge proofs can attest that a homomorphic evaluation was performed correctly without revealing inputs or intermediate values, addressing the verifiability that homomorphic encryption alone does not provide. These combinations call for flexible hardware that supports multiple primitives efficiently.

Standardization and Adoption

Standardization efforts aim to establish common interfaces and security levels. The community Homomorphic Encryption Standard already codifies recommended parameters. ISO/IEC 18033-6:2019 standardizes two partially homomorphic mechanisms, ElGamal and Paillier, and the multipart ISO/IEC 28033 series under development extends coverage to fully homomorphic encryption: a general part establishing definitions and security models, followed by parts specifying BGV and BFV, CKKS, the DM and CGGI constructions, and switching between them. NIST tracks the field through its Privacy-Enhancing Cryptography project but has not begun standardizing FHE algorithms. Hardware that targets standardized schemes and parameter sets will support a wider ecosystem and improve application portability.

As performance improves and costs fall, homomorphic encryption will move from specialized use toward mainstream adoption. Cloud providers may offer it as a standard service, database systems may add native support for encrypted queries, and machine learning frameworks may enable inference on encrypted data. Hardware acceleration will be central to this transition, turning once-impractical computations into routine ones.