[Paper Review] MATCHA: A Fast and Energy-Efficient Accelerator for Fully Homomorphic Encryption over the Torus

Lei Jiang, Qian Lou+1 more|arXiv (Cornell University)|Feb 17, 2022

Cryptography and Data Security4 citations

TL;DR

MATCHA is a hardware accelerator that accelerates Fully Homomorphic Encryption over the Torus (TFHE) by using approximate multiplication-less integer FFTs/Ideal FFTs and a pipelined datapath with aggressive bootstrapping key unrolling. It achieves 2.3× higher throughput and 6.3× better throughput per watt compared to prior CPU, GPU, FPGA, and ASIC solutions, significantly improving performance and energy efficiency for TFHE gate processing.

ABSTRACT

Fully Homomorphic Encryption over the Torus (TFHE) allows arbitrary computations to happen directly on ciphertexts using homomorphic logic gates. However, each TFHE gate on state-of-the-art hardware platforms such as GPUs and FPGAs is extremely slow ($>0.2ms$). Moreover, even the latest FPGA-based TFHE accelerator cannot achieve high energy efficiency, since it frequently invokes expensive double-precision floating point FFT and IFFT kernels. In this paper, we propose a fast and energy-efficient accelerator, MATCHA, to process TFHE gates. MATCHA supports aggressive bootstrapping key unrolling to accelerate TFHE gates without decryption errors by approximate multiplication-less integer FFTs and IFFTs, and a pipelined datapath. Compared to prior accelerators, MATCHA improves the TFHE gate processing throughput by $2.3 imes$, and the throughput per Watt by $6.3 imes$.

Motivation & Objective

• To address the high latency and poor energy efficiency of TFHE gate processing on existing hardware platforms like CPUs, GPUs, and FPGAs.
• To reduce the bottleneck of FFT/IFFT kernels in TFHE bootstrapping, which dominate execution time.
• To enable aggressive bootstrapping key unrolling (BKU) for improved throughput while maintaining correctness through error tolerance in TFHE.
• To design a pipelined, energy-efficient accelerator architecture that supports approximate integer FFTs/Ideal FFTs without floating-point operations.
• To achieve superior performance and energy efficiency compared to state-of-the-art CPU, GPU, FPGA, and ASIC-based TFHE accelerators.

Proposed method

• MATCHA uses approximate multiplication-less integer FFTs and IFFTs that rely only on additions and bit shifts, reducing area and power while tolerating small errors that are absorbed during decryption.
• It implements a pipelined datapath with dedicated TGSW clusters and external product cores to support aggressive bootstrapping key unrolling (BKU), reducing the number of FFT/IFFT invocations.
• The architecture uses separate register banks for sequential TGSW memory accesses and irregular FFT/IFFT accesses, minimizing data hazards and improving throughput.
• It leverages a CGRA-based modeling framework (OpenCGRA) to schedule and map TFHE operations onto the architecture, enabling accurate latency and energy estimation.
• The design is synthesized using a 16nm process and evaluated against CPU, GPU, FPGA, and ASIC baselines under standardized TFHE parameters (N=1024, k=1, Bg=1024, l=3).
• MATCHA supports m=3 for BKU, enabling higher throughput than GPU (m=4) with lower power consumption.

Experimental results

Research questions

• RQ1 Can approximate, multiplication-less integer FFTs and IFFTs be used effectively in TFHE bootstrapping without introducing decryption errors?
• RQ2 How does aggressive bootstrapping key unrolling (BKU) affect throughput and resource utilization in a hardware accelerator for TFHE?
• RQ3 Can a pipelined datapath with optimized memory access patterns significantly reduce latency and improve energy efficiency in TFHE gate processing?
• RQ4 What is the performance and energy efficiency gain of a custom ASIC accelerator (MATCHA) over CPU, GPU, and FPGA-based TFHE implementations?
• RQ5 To what extent can approximate arithmetic in FFT/IFFT kernels be leveraged in TFHE without compromising security or correctness?

Key findings

• MATCHA reduces the latency of a TFHE NAND gate to 0.37ms when m=3, outperforming GPU (0.18ms at m=4) and significantly reducing latency compared to CPU (6.67ms at m=2).
• MATCHA achieves 2.3× higher throughput than the GPU baseline when both use m=3, due to effective pipelining and BKU support.
• MATCHA improves throughput per watt by 6.3× compared to the ASIC baseline, achieving 6.3× better energy efficiency despite a lower power draw of 39.98W.
• The FPGA and ASIC baselines with m=1 achieve only 2.4× and 8.3× better throughput per watt than CPU, respectively, highlighting the inefficiency of non-pipelined designs.
• The use of approximate integer FFTs and IFFTs enables high performance with only additions and bit shifts, eliminating expensive double-precision floating-point operations and reducing power consumption.
• The pipelined datapath with separate register banks for TGSW and FFT/IFFT operations enables efficient handling of irregular and sequential memory access patterns, enhancing throughput and reducing stalls.