SoK: Fully Homomorphic Encryption Accelerators

TL;DR

Fully Homomorphic Encryption accelerators promise privacy-preserving computation but remain bottlenecked by polynomial workload and ciphertext maintenance. This SoK provides a two-pronged view: a qualitative evolution of 14 accelerators (CPU/GPU/FPGA/ASIC) and a quantitative testbed-based comparison of representative open-source designs, supplemented by end-to-end performance data from closed-source systems. It identifies core challenges in accelerating polynomial operations (NTT/FFT), key-switching, and bootstrapping, and shows how ASIC-based solutions increasingly address memory and depth at the cost of development openness. The paper also outlines future directions, including application-driven design, mixed-scheme support, software/hardware co-design, scale-out architectures, and renewed focus on NTRU-based schemes, aiming to bridge the gap between practical FHE workloads and deployable accelerators.

Abstract

Fully Homomorphic Encryption~(FHE) is a key technology enabling privacy-preserving computing. However, the fundamental challenge of FHE is its inefficiency, due primarily to the underlying polynomial computations with high computation complexity and extremely time-consuming ciphertext maintenance operations. To tackle this challenge, various FHE accelerators have recently been proposed by both research and industrial communities. This paper takes the first initiative to conduct a systematic study on the 14 FHE accelerators -- cuHE/cuFHE, nuFHE, HEAT, HEAX, HEXL, HEXL-FPGA, 100$\times$, F1, CraterLake, BTS, ARK, Poseidon, FAB and TensorFHE. We first make our observations on the evolution trajectory of these existing FHE accelerators to establish a qualitative connection between them. Then, we perform testbed evaluations of representative open-source FHE accelerators to provide a quantitative comparison on them. Finally, with the insights learned from both qualitative and quantitative studies, we discuss potential directions to inform the future design and implementation for FHE accelerators.

Figures (9)

• Figure 1: Overview of the operations used in FHE schemes.
• Figure 2: Cooley-Tukey butterfly
• Figure 3: Gentlemen-Sande butterfly
• Figure 4: Workflow of NTT/FFT with $n=8$ with CT butterfly
• Figure 5: Performance of NTT. The performance of HEXL, HEXL-FPGA and 100$\times$ is measured on our testbed while the performance results of HEAX and F1 are from their original paper.