Intelligent FHE Routing

One API Call.
The Right Backend. Every Time.

FHE-IQ automatically selects the optimal encryption backend — BFV-64, CKKS, or BFV-32 — based on your workload, security requirements, and hardware. You write one line of Rust. We handle the cryptographic complexity.

3
FHE Backends
5
Product Tiers (H0–H256)
<500ns
Routing Decision
0
Config Required

FHE Is Hard.
Choosing the Right FHE Is Harder.

Three encryption schemes. Five security tiers. Four hardware platforms. Dozens of parameter combinations. One wrong choice and your ciphertexts are incompatible, your latency blows up, or your security is insufficient.

Every other FHE library forces you to be a cryptographer.

  • 1 BFV for integers, CKKS for floats — pick wrong, silent data corruption
  • 2 N=4096 vs N=16384 — 3x latency difference for the same operation
  • 3 ARM NEON vs AVX-512 — 32-bit paths 2x faster on mobile, useless on x86
  • 4 Ciphertexts are backend-locked — mix BFV and CKKS and everything breaks
// Without FHE-IQ: you manage everything
let tier = ProductTier::H33;
let config = tier.resolve();
let ctx = BfvContext::new(config.poly_degree, &config.coeff_moduli, config.plain_modulus);
let keygen = KeyGenerator::new(&ctx);
let (pk, sk) = (keygen.public_key(), keygen.secret_key());
let encoder = BatchEncoder::new(&ctx);
let encryptor = Encryptor::new(&ctx, &pk);
let decryptor = Decryptor::new(&ctx, &sk);
let evaluator = Evaluator::new(&ctx);
// Hope you picked the right scheme...
// Hope the parameters match your security needs...
// Hope your hardware can handle it...
let pt = encoder.encode(&values)?;
let ct = encryptor.encrypt(&pt)?;

Describe Your Workload. We Handle the Rest.

Tell us what you're computing on — integers, floats, the security tier you need. FHE-IQ's policy router selects the optimal backend in under 500 nanoseconds.

Your Request
data_type: "integer"
tier: "h33"
needs_rotation: true
Policy Router
Phase 1: Hard filters
Phase 2: Weighted scoring
<500ns
BFV-64 Selected
N=4096 · 128-bit security
Score: 0.92 · Session created
Ready to encrypt
40%
Latency Fit
How close is the backend's observed latency to your budget? Tighter fit = higher score.
25%
Security Margin
Excess bits beyond your requirement. 128-bit when you asked for 86-bit = headroom.
20%
Hardware Affinity
BFV-32 on ARM NEON = 1.0. BFV-64 on AVX-512 = 1.0. Mismatched = penalized.
15%
Health Signal
Live error rates and p99 latency from the telemetry layer. Unhealthy backends get routed around.

Three Engines. Automatic Selection.

Each backend is a full FHE implementation. FHE-IQ knows which one to use based on your data type, security tier, and hardware.

Backend Data Type Product Tiers Integers Floats Rotation Multiply Hardware
BFV-64 Default Integer (u64) H0, H1, H2, H33, H-256 x86 AVX-512, ARM
CKKS ML / Float Float (f64) H0, H1, H2, H33 x86, ARM
BFV-32 Mobile Integer (u32) H0, H1 ARM NEON native
Hard filters eliminate ineligible backends instantly. Float data → only CKKS. H-256 → only BFV-64. ARM NEON + low security → prefer BFV-32.

One Line to Encrypt. Zero Cryptographic Decisions.

FHE-IQ exposes a clean Rust API. Create a session, encrypt, compute, decrypt — the router handles backend selection, parameter tuning, and session stickiness.

use h33::{FabricSessionStore, RoutingRequest, DataType, ProductTier, SecurityTier};

// Initialize the fabric (typically at server startup)
let fabric = FabricSessionStore::new(Default::default());

// Create a session — FHE-IQ picks the optimal backend
let request = RoutingRequest {
    data_type: DataType::Integer,
    product_tier: ProductTier::H33,      // 128-bit NIST Level 1
    security_tier: SecurityTier::Q128,
    needs_rotation: true,
    needs_bootstrapping: false,
    latency_budget_us: 5_000,            // 5ms budget
    multiplicative_depth: 3,
    ..Default::default()
};

let session = fabric.create_session(request, "user-42")?;

// Router selected BFV-64 with score 0.92
println!("Backend: {:?}", session.backend_id);   // Bfv64
println!("Session: {}", session.session_id);      // "fab_a1b2c3..."
println!("Tier: {:?}", session.product_tier);     // H33
// Encrypt integers — the session knows which backend to use
let values = vec![42, 100, 7, 255];
let ct_a = fabric.encrypt(&session.session_id, &values)?;

// Encrypt a second vector
let ct_b = fabric.encrypt(&session.session_id, &[10, 20, 30, 40])?;

// Homomorphic addition (on encrypted data)
let ct_sum = fabric.add(&session.session_id, &ct_a, &ct_b)?;

// Homomorphic multiplication
let ct_prod = fabric.multiply(&session.session_id, &ct_a, &ct_b)?;

// Decrypt — results computed entirely on ciphertext
let sum: Vec<i64> = fabric.decrypt_integers(&session.session_id, &ct_sum)?;
let prod: Vec<i64> = fabric.decrypt_integers(&session.session_id, &ct_prod)?;

assert_eq!(sum[0], 52);   // 42 + 10
assert_eq!(prod[0], 420); // 42 * 10

// Check noise budget (how many more operations before decryption fails)
let budget = fabric.noise_budget(&session.session_id, &ct_prod)?;
println!("Noise budget remaining: {} bits", budget);
// Request float computation — router auto-selects CKKS
let request = RoutingRequest {
    data_type: DataType::Float,           // This triggers CKKS selection
    product_tier: ProductTier::H33,
    security_tier: SecurityTier::Q128,
    needs_bootstrapping: true,          // Unlimited depth
    ..Default::default()
};

let session = fabric.create_session(request, "ml-pipeline")?;
assert_eq!(session.backend_id, BackendId::Ckks);

// Encrypt floating-point data (ML embeddings, scores, etc.)
let embeddings = vec![0.85, 0.92, -0.31, 0.67];
let ct = fabric.encrypt_floats(&session.session_id, &embeddings)?;

// Homomorphic dot product, scoring, aggregation...
let ct_doubled = fabric.add(&session.session_id, &ct, &ct)?;

// Decrypt
let result: Vec<f64> = fabric.decrypt_floats(&session.session_id, &ct_doubled)?;
// result[0] ≈ 1.70  (0.85 + 0.85, CKKS gives approximate results)
// Stateless recommendation — see what FHE-IQ would pick
// without creating a session (zero cost, useful for planning)

let decision = fabric.recommend(&RoutingRequest {
    data_type: DataType::Integer,
    product_tier: ProductTier::H256,     // Maximum security
    security_tier: SecurityTier::Q256,   // NIST Level 5
    needs_rotation: true,
    ..Default::default()
})?;

println!("Recommended: {:?}", decision.backend_id);  // Bfv64
println!("Score: {:.2}", decision.score);              // 0.87
println!("Disqualified:");
for (id, reason) in &decision.disqualified {
    println!("  {:?}: {}", id, reason);
    // Ckks: "Integer data type requires integer backend"
    // Bfv32: "H-256 tier not supported (max: H1)"
}

// Check all backend capabilities
let backends = fabric.list_backends();
for b in &backends {
    println!("{:?}: max_tier={:?}, floats={}, rotation={}",
        b.id, b.max_product_tier, b.supports_float, b.supports_rotation);
}

HTTP Endpoints for Every Language

The same intelligence is exposed via REST. Nine endpoints under /api/v1/fhe/fabric/* — fully compatible with the existing H33 API.

MethodEndpointDescription
POST/api/v1/fhe/fabric/sessionCreate session (router selects backend)
DELETE/api/v1/fhe/fabric/session/:idDestroy session (zeroize keys)
GET/api/v1/fhe/fabric/session/:idSession info (backend, tier, stats)
POST/api/v1/fhe/fabric/encryptEncrypt integers or floats
POST/api/v1/fhe/fabric/decryptDecrypt ciphertext handle
POST/api/v1/fhe/fabric/computeHomomorphic op (add / multiply / rotate)
POST/api/v1/fhe/fabric/batch-encryptBatch encrypt multiple vectors
POST/api/v1/fhe/fabric/recommendStateless: what would the router pick?
GET/api/v1/fhe/fabric/backendsList backends + capabilities

FHE-IQ + ZK + Dilithium — One Pipeline

FHE-IQ is the compute layer. Combine it with H33's zero-knowledge proofs and post-quantum signatures for a complete encrypted identity pipeline.

FHE-IQ Compute
Intelligent encrypted computation. BFV for biometrics, CKKS for ML scoring, BFV-32 for mobile. Auto-selected per request.
Latency~1,375µs / batch
Throughput1.2M auth/sec
Routing<500ns
ZK Proof Layer
STARK lookup proofs verify computation integrity without revealing inputs. SHA3-256 — fully post-quantum.
Proof Time0.067µs
Verify Time<1µs
PQ SecureSHA3-256
Dilithium Attestation
ML-DSA digital signatures attest every computation result. FIPS 204 compliant. Batch attestation: 1 sign per 32 users.
Sign + Verify~240µs
StandardFIPS 204
Batch Savings31×
Total Pipeline: ~50µs per auth
FHE encrypt + match + ZK proof + Dilithium attestation — fully post-quantum, single API call

Stop Configuring FHE Parameters.
Start Encrypting.

One API call. Optimal backend. Post-quantum security. Your data never decrypted.

View Per-Auth Pricing →
🧠 AI-Adaptive Routing
🔒 128-bit NIST Level 1
<500ns Routing Decision
62 Fabric Tests
🛡 Session-Sticky Ciphertexts
H33 FHE Deep Dive →
Verify It Yourself