HE Engine 0.5.0

The rename (PRs #133 and #134) and Phases 8 to 10 (PRs #135 to #137): more types
and operations, proven inputs, programs with lookup tables and several results,
batches and compressed results, and the project published as open source.

Added

• MIT licence. The project is open source under the MIT licence (LICENSE);
  the packages and the OpenAPI document declare it. TFHE-rs's own licence and
  Zama's patent terms for commercial use still apply.
• Documentation site at https://yog-sotho.github.io/Homomorphic-Encryption-Service/,
  built from docs/ with MkDocs Material, with a rendered API reference, and
  checked for broken links on every pull request.
• Signed releases. Tagging vX.Y.Z publishes the heaas CLI (Linux x86_64 and
  arm64, macOS on Apple silicon) and the he-backend server (Linux) with Sigstore
  signatures and checksums, and multi-arch container images on GHCR signed with
  cosign and carrying build provenance.
• Community files: a support guide, a code of conduct, issue forms, a pull
  request template and code owners.
• Lookup tables. A lookup program step (TFHE-rs match_value_or) maps an
  encrypted value through a plaintext table of up to 256 entries, with a default:
  lookup(a, [1, 4, 9, 16]) or lookup(a, [-1: 10, 5: 50], 0) in expressions.
  Signed types too.
• Several results. A program's outputs names up to 16 steps whose values are
  its results; expressions separated by commas (a + b, a < b) compile to them.
  Jobs report result_types, and GET …/result?output=N returns result N. The
  dashboard, the jobs page, the SDK (Client::results) and the CLI (run prints
  one per line, result --output) handle them.
• Compressed results. Keys made with heaas keygen --compression
  (fhe::generate_compressing_keys) hold TFHE-rs compression keys; a job sent with
  compress_results returns all its results as one CompressedCiphertextList of
  about 2 KB instead of 130–530 KB per value (fhe::decrypt_compressed,
  heaas decrypt --compressed). Key info reports supports_compression. TFHE-rs's
  browser build cannot make or unpack these, so the dashboard does not offer it.
• Programs. operation: "program" runs several operations in one job, every
  intermediate value encrypted: a list of steps over the inputs, earlier steps and
  plaintext constants. New step operations: divide, remainder, bitwise and
  logical and/or/xor/not, neg, abs, shifts and rotations by a constant,
  and select (an encrypted if-then-else). Division by an encrypted zero follows
  TFHE-rs's results.
• Expressions. (a + b) * 3 < c ? a : b compiles into a program: in the
  dashboard (an Expression mode that checks as you type), the CLI (--expr) and
  the SDK (parse_expression). The Rust and browser compilers share one file of
  test cases.
• Batches. POST /api/v1/compute/jobs/batch queues up to 16 jobs together or
  not at all; the SDK's submit_batch.
• Property tests on random well-typed programs against the plaintext oracle.
• More types. Jobs compute on u8, u16, u32, u64 and i8, i16, i32,
  i64 (integer_type in the request, u16 if absent).
• More operations. The comparisons eq, ne, lt, le, gt, ge (an
  encrypted boolean result), and sum of 2 to 16 inputs. Jobs report a
  result_type to decrypt as.
• Plain operands. Binary operations can take their right-hand side as a
  decimal scalar the server sees, instead of a ciphertext.
• Proven inputs. proven_inputs: one TFHE-rs ProvenCompactCiphertextList
  with a zero-knowledge proof of well-formed encryption, checked against the
  key's public key (PUT /api/v1/keys/{id}/public-key) and a CRS the server
  generates and serves (GET /api/v1/he/crs). Proofs are bound to the key id.
• The dashboard, the SDK and the heaas CLI support all of the above (heaas run --type i32 --scalar 5 --prove …, heaas prove); keys are generated with a
  public key, which heaas keygen saves as heaas-public.key.
• Property tests (homomorphic results against the plaintext oracle, corrupted
  keys, ciphertexts and proven lists), a scheduled workflow for the heavy ones,
  and coverage floors in CI (Rust and frontend).

Changed

• A submission refused for the daily quota no longer counts against it, and a
  batch that does not fit leaves what is left of it.
• GET /api/v1/he/crs is rate-limited per client IP.
• The default MAX_SERVER_KEY_BYTES is 128 MiB (was 80 MiB), and the sample nginx
  configuration accepts 136 MB, so keys with compression keys (~106 MB) fit.
• New keys are made with Zama's dedicated compact-public-key parameters on top of
  ConfigBuilder::default(). Keys made before are still accepted, but cannot take
  proven inputs.
• Results that TFHE-rs leaves partly unencrypted because a plain operand makes
  them known (e.g. x * 0) are re-encrypted, so every result is a conformant
  ciphertext.
• Renamed to Homomorphic Encryption Engine (HE Engine), formerly HEaaS, and
  described as what it is: a self-hosted server whose operator runs it for its
  users, not a hosted service. New banner, logo and wording in the app, emails,
  API description and documentation. Code names (he-backend, heaas-core,
  heaas-sdk, the heaas CLI, environment variables, metric and cookie names)
  are unchanged.

Downloads

• heaas-0.5.0-<target>.tar.gz: the command-line tool (Linux x86_64 and arm64, macOS on Apple silicon).
• he-backend-0.5.0-<target>.tar.gz: the server (Linux).
• Container images: ghcr.io/yog-sotho/he-engine-backend:0.5.0 and ghcr.io/yog-sotho/he-engine-frontend:0.5.0 (linux/amd64, linux/arm64).
• he-engine-openapi-0.5.0.json: the API description.

Verifying

Check a download against SHA256SUMS (sha256sum -c SHA256SUMS --ignore-missing), and its Sigstore signature:

pip install sigstore
python -m sigstore verify github \
  --cert-identity "https://github.com/Yog-Sotho/Homomorphic-Encryption-Service/.github/workflows/release.yml@refs/tags/v0.5.0" \
  heaas-0.5.0-x86_64-unknown-linux-gnu.tar.gz

Container images are signed with cosign (keyless) and have build provenance:

cosign verify ghcr.io/yog-sotho/he-engine-backend:0.5.0 \
  --certificate-identity "https://github.com/Yog-Sotho/Homomorphic-Encryption-Service/.github/workflows/release.yml@refs/tags/v0.5.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/yog-sotho/he-engine-backend:0.5.0 --repo Yog-Sotho/Homomorphic-Encryption-Service