Paper 2026/1209

Latency-Aware, High-Throughput Homomorphic AES Evaluation with CKKS

Jonghoo Lee, CryptoLab, Inc.

Taeyeong Noh, CryptoLab, Inc.

Jung Hee Cheon, Seoul National University, CryptoLab, Inc.

Guillaume Hanrot, CryptoLab, Inc.

Abstract

Homomorphic Advanced Encryption Standard (AES) evaluation refers to evaluating the AES circuit with a fully homomorphic encryption (FHE)-encrypted secret key. Applications include in particular Transciphering, which converts AES-encrypted data into FHE ciphertexts without exposing the secret key. Existing homomorphic AES evaluations show a clear separation between latency-oriented solutions and throughput-oriented solutions. CKKS-based methods exploit massive SIMD parallelism and focus on throughput by processing many AES blocks in parallel. They are hardly suitable for latency-critical settings. In contrast, TFHE-based methods process a small number of blocks efficiently. They are preferable for low-latency settings, but provide very limited throughput. In this work, we show that AES-CKKS evaluation can achieve both interactive latency and high throughput. Our first variant is optimized for latency and decrypts a single AES block in only 26ms on an NVIDIA RTX-5090. This is more than 6× faster than recent TFHE-based state-of-the-art approaches; further, an extension of it processes 4 AES blocks at once in 29ms. Our second variant is based on a new embedding of $\textrm{GF}(16)$, the finite field with 16 elements, into CKKS message space. It is optimized for throughput and processes up to 2048 AES blocks at once, achieving 238KB/s throughput (a more than 3.41× improvement over the state-of-the-art CKKS-based approaches), while maintaining latency comparable to TFHE-based methods. To the best of our knowledge, this is the first AES-FHE evaluation algorithm combining good latency and throughput properties, bringing homomorphic outsourcing with AES within reach of real-time applications on constrained devices. Our main ingredients are redundant structures that maximize SIMD utilization, improved algorithms for the SubBytes step (one of them being based on inversion in $\textrm{GF}(256)$ using CKKS), fusion of linear layers into bootstrapping, and carefully crafted FHE parameters.

@misc{cryptoeprint:2026/1209,
      author = {Taeseong Kim and Jonghoo Lee and Taeyeong Noh and Jung Hee Cheon and Guillaume Hanrot},
      title = {Latency-Aware, High-Throughput Homomorphic {AES} Evaluation with {CKKS}},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/1209},
      year = {2026},
      url = {https://eprint.iacr.org/2026/1209}
}