papers/gpu-evm-whitepaper/sections/06-fhe-on-gpu-encrypted-evm-computation.tex

\section{FHE on GPU: Encrypted EVM Computation}

\label{sec:fhe}
%% ============================================================================

\subsection{Motivation}

Fully Homomorphic Encryption (FHE) enables computation on encrypted data without
decryption. Applied to the EVM, FHE allows smart contracts to process encrypted inputs
and produce encrypted outputs---enabling private DeFi, sealed-bid auctions, and
confidential token transfers without revealing transaction contents to validators.

The computational cost of FHE operations is 10{,}000--100{,}000$\times$ higher than
plaintext equivalents. GPU acceleration is not optional for practical FHE-EVM; it is
a prerequisite.

\subsection{TFHE on GPU}

cevm implements the TFHE (Fast Fully Homomorphic Encryption over the Torus) scheme
on GPU, targeting the programmable bootstrapping operation that is the computational
bottleneck of all FHE schemes:

\begin{table}[h]
\centering
\small
\begin{tabular}{llp{5.5cm}}
\toprule
\textbf{Shader} & \textbf{Operation} & \textbf{Description} \\
\midrule
\texttt{fhe\_kernels}        & Ciphertext ops  & Add, sub, scalar mul on LWE ciphertexts \\
\texttt{blind\_rotate} (v1)  & PBS core        & Blind rotation of GLWE accumulator \\
\texttt{blind\_rotate} (v2)  & PBS optimized   & Fused blind rotation with key switching \\
\texttt{bsk\_prefetch}       & Memory          & Prefetch bootstrapping key into GPU shared memory \\
\texttt{external\_product} (v1) & GLWE$\times$GGSW & Base decomposition + NTT product \\
\texttt{external\_product} (v2) & Optimized       & Fused decompose-NTT-INTT \\
\texttt{external\_product} (v3) & Batched         & Multiple external products in parallel \\
\bottomrule
\end{tabular}
\caption{FHE GPU shaders. The external product (GLWE $\times$ GGSW multiplication)
is the innermost loop of programmable bootstrapping. Three variants provide
increasing levels of optimization and batching.}
\label{tab:fhe}
\end{table}

\subsection{NTT as the Shared Primitive}

The critical connection between PQ crypto and FHE is the NTT. Both ML-DSA/ML-KEM and
TFHE rely on polynomial multiplication over cyclotomic rings. The same GPU NTT hardware
that accelerates post-quantum signatures also accelerates FHE:

\begin{itemize}
\item \textbf{PQ signatures}: NTT over $\mathbb{Z}_q[x]/(x^{256}+1)$ with small $q$
      (3329 for ML-KEM, 8380417 for ML-DSA).
\item \textbf{TFHE}: NTT over $\mathbb{Z}_q[x]/(x^N+1)$ with large $N$ (1024--32768)
      and 64-bit modulus.
\end{itemize}

The \texttt{twiddle\_cache} shader pre-computes roots of unity for all parameter sets,
stored in persistent GPU buffers. This amortizes the setup cost across all NTT consumers.

%% ============================================================================