Manage keys

Concrete generates keys for you implicitly when they are needed and if they have not already been generated. This is useful for development, but it's not flexible (or secure!) for production. Explicit key management API is introduced to be used in such cases to easily generate and re-use keys.

Definition

Let's start by defining a circuit:

from concrete import fhe

@fhe.compiler({"x": "encrypted"})
def f(x):
    return x ** 2

inputset = range(10)
circuit = f.compile(inputset)

Circuits have a property called keys of type fhe.Keys, which has several utility functions dedicated to key management!

Generation

To explicitly generate keys for a circuit, you can use:

circuit.keys.generate()

Generated keys are stored in memory upon generation, unencrypted.

And it's possible to set a custom seed for reproducibility:

circuit.keys.generate(seed=420)

Do not specify the seed manually in a production environment!

Serialization

To serialize keys, say to send it across the network:

serialized_keys: bytes = circuit.keys.serialize()

Keys are not serialized in encrypted form! Please make sure you keep them in a safe environment, or encrypt them manually after serialization.

Deserialization

To deserialize the keys back, after receiving serialized keys:

keys: fhe.Keys = fhe.Keys.deserialize(serialized_keys)

Assignment

Once you have a valid fhe.Keys object, you can directly assign it to the circuit:

circuit.keys = keys

If assigned keys are generated for a different circuit, an exception will be raised.

Saving

You can also use the filesystem to store the keys directly, without needing to deal with serialization and file management yourself:

circuit.keys.save("/path/to/keys")

Keys are not saved encrypted! Please make sure you store them in a safe environment, or encrypt them manually after saving.

Loading

After keys are saved to disk, you can load them back via:

circuit.keys.load("/path/to/keys")

Automatic Management

If you want to generate keys in the first run and reuse the keys in consecutive runs:

circuit.keys.load_if_exists_generate_and_save_otherwise("/path/to/keys")