{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T03:56:32Z","timestamp":1767930992151,"version":"3.49.0"},"reference-count":38,"publisher":"International Association for Cryptologic Research","issue":"4","license":[{"start":{"date-parts":[[2025,10,6]],"date-time":"2025-10-06T00:00:00Z","timestamp":1759708800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2025,12,2]]},"abstract":"<jats:p>The dream of achieving data privacy during external computations has become increasingly concrete in recent years. Indeed, since the early days of Fully Homomorphic Encryption (FHE) more than a decade ago, new cryptosystems and techniques have constantly optimized the efficiency of computation on encrypted data. However, one of the main disadvantages of FHE, namely its significant ciphertext expansion factor, remains at the center of the efficiency bottleneck of FHE schemes.<\/jats:p>\n                  <jats:p>To tackle the issue of slow uplink FHE data transmission,  we use transciphering. With transciphering, the client naturally encrypts its data under a symmetric scheme and sends them to the server with (once and for all) an FHE encryption of the symmetric scheme's key. With its larger computing power, the server then evaluates the symmetric scheme's decryption algorithm within the homomorphic domain to obtain homomorphic ciphertexts that allow it to perform the requested calculations. Since the first use of this method a bit more than ten years ago, papers on the homomorphic evaluation of AES have been numerous. And as the AES execution is the application chosen by NIST in the FHE part of its recent call for proposals on threshold encryption, the stakes of such work go up another level. But what about other standardized block ciphers? Is the AES the more efficient option? In this work, we leverage on two methods which have successfully been applied to the homomorphic evaluation of AES to study several state-of-the-art symmetric block ciphers (namely CLEFIA, PRESENT, PRINCE, SIMON, SKINNY). That is to say, we implement a representative set of symmetric block ciphers using TFHE. These implementations allow us to compare the efficiency of this set of symmetric schemes and to categorize them. We highlight the characteristics of block ciphers that are fast to execute in the homomorphic domain and those that are particularly costly. Finally, this classification of operation types enables us to sketch out what the ideal block cipher for transciphering homomorphic data in integer mode might look like.<\/jats:p>","DOI":"10.62056\/avom-4tw9","type":"journal-article","created":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T23:39:47Z","timestamp":1767915587000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":0,"title":["Running Standard Block Ciphers Beyond AES with TFHE: Experiments and Lessons Learnt"],"prefix":"10.62056","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-0548-8825","authenticated-orcid":false,"given":"Daphn\u00e9","family":"Trama","sequence":"first","affiliation":[{"name":"Universit\u00e9 Paris-Saclay, CEA-List, Palaiseau","place":["France"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6717-8848","authenticated-orcid":false,"given":"Aymen","family":"Boudguiga","sequence":"additional","affiliation":[{"name":"Universit\u00e9 Paris-Saclay, CEA-List, Palaiseau","place":["France"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4720-9269","authenticated-orcid":false,"given":"Renaud","family":"Sirdey","sequence":"additional","affiliation":[{"name":"Universit\u00e9 Paris-Saclay, CEA-List, Palaiseau","place":["France"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"48349","published-online":{"date-parts":[[2026,1,8]]},"reference":[{"key":"ref1:our_aes","doi-asserted-by":"publisher","first-page":"79","DOI":"10.1145\/3605759.3625260","article-title":"A Homomorphic AES Evaluation in Less than 30 Seconds by\n  Means of TFHE","author":"D. Trama","year":"2023"},{"key":"ref2:hippo","doi-asserted-by":"publisher","DOI":"10.62056\/ahmp-4tw9","article-title":"Further Improvements in AES Execution over TFHE","volume":"2","author":"Sonia Bela\u00efd","year":"2025","journal-title":"IACR Communications in Cryptology"},{"key":"ref3:gentry_BGV","doi-asserted-by":"publisher","first-page":"850","DOI":"10.1007\/978-3-642-32009-5_49","article-title":"Homomorphic Evaluation of the AES Circuit","author":"C. Gentry","year":"2012"},{"key":"ref4:lowMC","first-page":"430","article-title":"Ciphers for MPC and FHE","author":"M. Albrecht","year":"2015"},{"key":"ref5:PRINCE","first-page":"208","article-title":"PRINCE - A Low-Latency Block Cipher for Pervasive\n  Computing Applications","author":"J. Borghoff","year":"2012"},{"key":"ref6:Chaghri","doi-asserted-by":"publisher","first-page":"139","DOI":"10.1145\/3548606.3559364","article-title":"Chaghri - A FHE-Friendly Block Cipher","author":"T. Ashur","year":"2022"},{"key":"ref7:Elisabeth","doi-asserted-by":"publisher","first-page":"32","DOI":"10.1007\/978-3-031-22969-5_2","article-title":"Towards Case-Optimized Hybrid Homomorphic Encryption","author":"O. Cosseron","year":"2022"},{"key":"ref8:pasta","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2023.i3.30-73","article-title":"Pasta: A Case for Hybrid Homomorphic Encryption","author":"C. Dobraunig","year":"2023","journal-title":"IACR TCHES"},{"key":"ref9:kreyvium","doi-asserted-by":"publisher","first-page":"313","DOI":"10.1007\/978-3-662-52993-5_16","article-title":"Stream Ciphers: A Practical Solution for Efficient\n  Homomorphic-Ciphertext Compression","author":"A. Canteaut","year":"2016"},{"key":"ref10:Guimaraes_Borin_Aranha_2021","doi-asserted-by":"publisher","first-page":"229","DOI":"10.46586\/tches.v2021.i2.229-253","article-title":"Revisiting the functional bootstrap in TFHE","author":"A. Guimar\u00e3es","year":"2021","journal-title":"IACR TCHES"},{"key":"ref11:nicolas","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2024.i3.302-341","article-title":"Optimized Homomorphic Evaluation of Boolean Functions","author":"N. Bon","year":"2024","journal-title":"IACR TCHES"},{"key":"ref12:fregata","doi-asserted-by":"publisher","first-page":"392","DOI":"10.1007\/978-3-031-49187-0_20","article-title":"Fregata: Faster Homomorphic Evaluation of AES via TFHE","author":"B. Wei","year":"2023"},{"key":"ref13:thunderbird","doi-asserted-by":"publisher","first-page":"530","DOI":"10.46586\/tches.v2024.i3.530-573","article-title":"Thunderbird: Efficient Homomorphic Evaluation of Symmetric\n  Ciphers in 3GPP by combining two modes of TFHE","author":"B. Wei","year":"2024","journal-title":"IACR TCHES"},{"key":"ref14:reviewer","doi-asserted-by":"publisher","first-page":"205","DOI":"10.46586\/tches.v2024.i4.205-230","article-title":"Fast Transciphering Via Batched And Reconfigurable LUT\n  Evaluation","volume":"2024","author":"L. Schild","year":"2024","journal-title":"IACR Transactions on Cryptographic Hardware an d Embedded\n  Systems"},{"key":"ref15:meaux","doi-asserted-by":"publisher","first-page":"311","DOI":"10.1007\/978-3-662-49890-3_13","article-title":"Towards Stream Ciphers for Efficient FHE with Low-Noise\n  Ciphertexts","author":"P. M\u00e9aux","year":"2016"},{"key":"ref16:stream1","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1007\/978-3-031-08147-7_2","article-title":"Revisiting Stream-Cipher-Based Homomorphic Transciphering in\n  the TFHE Era","author":"A.-A. Bendoukha","year":"2021"},{"key":"ref17:kreyvium-2","doi-asserted-by":"publisher","DOI":"10.1145\/3605759.3625255","article-title":"Trivial Transciphering With Trivium and TFHE","author":"T. Balenbois","year":"2023"},{"key":"ref18:stream2","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1007\/978-3-031-37586-6_6","article-title":"Optimized Stream-Cipher-Based Transciphering by Means of\n  Functional-Bootstrapping","author":"A.-A. Bendoukha","year":"2023"},{"key":"ref19:transistor","doi-asserted-by":"publisher","first-page":"530","DOI":"10.1007\/978-3-032-01901-1_17","article-title":"Transistor: a TFHE-friendly Stream Cipher","author":"J. Baudrin","year":"2025"},{"key":"ref20:sorting_hat","doi-asserted-by":"publisher","first-page":"563","DOI":"10.1145\/3548606.3560702","article-title":"SortingHat: Efficient Private Decision Tree Evaluation via\n  Homomorphic Encryption and Transciphering","author":"K. Cong","year":"2022"},{"key":"ref21:towards","doi-asserted-by":"publisher","DOI":"10.62056\/anxrxrxqi","article-title":"Towards Practical Transciphering for FHE with Setup\n  Independent of the Plaintext Space","volume":"1","author":"P. M\u00e9aux","year":"2024","journal-title":"IACR Communications in Cryptology"},{"key":"ref22:akram","doi-asserted-by":"publisher","first-page":"88","DOI":"10.1007\/978-3-031-30122-3_6","article-title":"Practical Homomorphic Evaluation of Block-Cipher-Based Hash\n  Functions with Applications","author":"A. A. Bendoukha","year":"2023"},{"key":"ref23:survey","volume-title":"A Survey on Transciphering and Symmetric Ciphers for\n  Homomorphic Encryption","author":"I. Thakur","year":"2025"},{"key":"ref24:TFHE","volume-title":"TFHE: Fast Fully Homomorphic Encryption Library","author":"I. Chillotti"},{"key":"ref25:combo","doi-asserted-by":"publisher","first-page":"317","DOI":"10.1007\/978-3-031-37679-5_14","article-title":"ComBo: A Novel Functional Bootstrapping Method for Efficient\n  Evaluation of Nonlinear Functions in the Encrypted Domain","author":"P.-E. Clet","year":"2023"},{"key":"ref26:d8fp","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2025.i2.535-578","article-title":"Designing a General-Purpose 8-bit (T)FHE Processor\n  Abstraction","author":"D. Trama","year":"2025","journal-title":"IACR TCHES"},{"key":"ref27:carpov_mvb","doi-asserted-by":"publisher","first-page":"106","DOI":"10.1007\/978-3-030-12612-4_6","volume-title":"CT-RSA 2019","author":"S. Carpov","year":"2019"},{"key":"ref28:zama1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-78086-9_1","article-title":"Programmable Bootstrapping Enables Efficient Homomorphic\n  Inference of Deep Neural Networks","author":"I. Chillotti","year":"2021"},{"key":"ref29:FDFB","doi-asserted-by":"publisher","first-page":"501","DOI":"10.46586\/tches.v2023.i1.501-537","article-title":"FDFB: Full Domain Functional Bootstrapping Towards\n  Practical Fully Homomorphic Encryption","author":"K. Kluczniak","year":"2025","journal-title":"IACR TCHES"},{"key":"ref30:TOTA","volume-title":"TOTA: Fully Homomorphic Encryption with Smaller Parameters\n  and Stronger Security","author":"Z. Yang","year":"2021"},{"key":"ref31:WoPPBS","doi-asserted-by":"publisher","first-page":"670","DOI":"10.1007\/978-3-030-92078-4_23","volume-title":"ASIACRYPT","author":"I. Chillotti","year":"2021"},{"key":"ref32:rijndael","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-60769-5","volume-title":"The Design of Rijndael: AES - The Advanced Encryption\n  Standard (Information Security and Cryptography)","author":"J. Daemen","year":"2002"},{"key":"ref33:clefia","doi-asserted-by":"publisher","first-page":"181","DOI":"10.1007\/978-3-540-74619-5_12","article-title":"The 128-Bit Blockcipher CLEFIA","author":"T. Shirai","year":"2007"},{"key":"ref34:present","doi-asserted-by":"publisher","first-page":"450","DOI":"10.1007\/978-3-540-74735-2_31","article-title":"PRESENT: An Ultra-Lightweight Block Cipher","author":"A. Bogdanov","year":"2007"},{"key":"ref35:doroz","doi-asserted-by":"publisher","first-page":"208","DOI":"10.1007\/978-3-662-44774-1_17","article-title":"Toward Practical Homomorphic Evaluation of Block Ciphers\n  Using Prince","author":"Y. Dor\u00f6z","year":"2014"},{"key":"ref36:simon","doi-asserted-by":"publisher","DOI":"10.1145\/2744769.2747946","article-title":"The SIMON and SPECK lightweight block ciphers","author":"R. Beaulieu","year":"2015"},{"key":"ref37:lepoint","doi-asserted-by":"publisher","first-page":"318","DOI":"10.1007\/978-3-319-06734-6_20","article-title":"A Comparison of the Homomorphic Encryption Schemes FV and\n  YASHE","author":"T. Lepoint","year":"2014"},{"key":"ref38:skinny","doi-asserted-by":"publisher","first-page":"123","DOI":"10.1007\/978-3-662-53008-5_5","article-title":"The SKINNY Family of Block Ciphers and Its Low-Latency\n  Variant MANTIS","author":"C. Beierle","year":"2016"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2026,1,8]],"date-time":"2026-01-08T23:41:24Z","timestamp":1767915684000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/2\/4\/19"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,8]]},"references-count":38,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2026,1,8]]}},"URL":"https:\/\/doi.org\/10.62056\/avom-4tw9","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,8]]},"assertion":[{"value":"2025-10-06","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-12-02","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc2-4-38"}}