The H33 Encrypted Compute Platform routes every operation to the right FHE engine automatically, measures real cost before execution, and attests every result with three independent post-quantum signature families. This is the architecture documentation.
Three fully homomorphic encryption engines, each purpose-built for a distinct computation class. One API surface. The FHE-IQ router selects the engine; the caller never chooses manually.
Polynomial arithmetic over encrypted integers. Batch biometric matching, inner products, scoring. N=4096 (fast) or N=32768 (deep). Zero approximation error. The workhorse engine for high-throughput authentication and encrypted search.
Fixed-point arithmetic on encrypted real-number vectors. ML inference, signal processing, statistical analysis. N=8192, RNS-native. Full bootstrapping via Chebyshev polynomial evaluation. Five tuned execution profiles.
Encrypted comparisons, equality tests, and threshold decisions. The only engine that can branch, sort, and match. Linear scaling: every width doubling halves throughput. 96-channel parallelism on commodity ARM CPUs.
| Engine | Algebra | Throughput | Ring Degree | Primary Use | Noise Model |
|---|---|---|---|---|---|
| BFV | Exact integer | 2.2M auth/sec | N=4096 / 32768 | Biometric matching, inner product, scoring | Discrete, bounded |
| CKKS | Approximate real | 1,574 TPS | N=8192 | ML inference, statistics, signal processing | Rescale-controlled |
| TFHE | Boolean gates | 768 TPS (8-bit) | N=1024 | Comparisons, equality, threshold decisions | Bootstrapped per gate |
The FHE-IQ router inspects the operation type, data shape, and precision requirements, then selects the optimal engine with measured latency cost models. Routing overhead is under 500 nanoseconds.
Measured, not static. FHE-IQ cost models are calibrated against actual latency measurements on the target hardware. When a new engine version deploys, cost tables update automatically. The router never guesses — it measures.
Five tuned profiles for CKKS operations. The router selects the profile based on the workload shape. Each profile adjusts modulus chain depth, rotation key pre-computation, memory allocation, and relin scheduling.
The CKKS engine is built for encrypted real-number computation at scale. Every design decision optimizes for throughput on ARM hardware while preserving precision invariants.
Precision contract. Every CKKS operation carries a tracked precision estimate. If accumulated approximation error would exceed the caller's declared tolerance, the operation fails explicitly rather than returning silently degraded results.
Every computation — regardless of engine — produces a 74-byte attestation committed to the H33-74 substrate. Three independent post-quantum signature families. The routing decision itself is included in the attestation.
Module-lattice digital signature (FIPS 204). Lattice-based. Fast signing and verification. Primary attestation signature.
NTRU-lattice signature. Independent mathematical hardness assumption from ML-DSA. Compact signatures.
Stateless hash-based signature (FIPS 205). Zero algebraic structure. Survives even if all lattice assumptions break simultaneously.
Three independent mathematical bets. An attacker must break MLWE lattices, NTRU lattices, AND stateless hash functions simultaneously. Three independent hardness assumptions. Compromise of any single family does not affect the other two.
Measured, tested, and validated against NIST standards. Not aspirational — operational.
Known Answer Tests for ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). Every test vector validated. No exceptions.
Power-on self-tests verify cryptographic module integrity at every startup. Continuous health checks during operation.
Across all engines, routing logic, attestation, key management, and protocol layers. Correctness verified before every benchmark run.
All FHE parameter sets conform to the Homomorphic Encryption Standard v1.1. Ring degrees, modulus sizes, and noise budgets meet or exceed published security levels.
| Standard | Status | Scope |
|---|---|---|
| FIPS 203 (ML-KEM) | All KATs passed | Key encapsulation for all engines |
| FIPS 204 (ML-DSA) | All KATs passed | Primary attestation signature |
| FIPS 205 (SLH-DSA) | All KATs passed | Hash-based attestation signature |
| FIPS 140-3 | Self-tests operational | Module integrity, continuous health |
| HE Standard v1.1 | Compliant | BFV, CKKS, TFHE parameter sets |