a590003

down by a factor of p t . Let’s recall what this means: we want to output c ′ ∈ A, represented via double-CRT
format (as its matrix of evaluations modulo the primes p 0 , . . . , p t−1 ), such that
1. c ′ = c mod 2.
2. c ′ is very close (in terms of its coefficient vector) to c/p t .
In the main body we explained how this could be performed in dble-CRT representation. This made explicit
use of the fact that the two ciphertexts need to be equivalent modulo two. If we wished to replace two with
a general prime p, then things are a bit more complicated. For completeness, although it is not required in
our scheme, we present a methodology below. In this case, the conditions on c † are as follows:
1. c † = c · p t mod p.
2. c † is very close to c.
3. c † is divisible by p t .
As before, we set c ′ ← c † /p t . (Note that for p = 2, we trivially have c · p t = c mod p, since p t will be odd.)
This causes some complications, because we set c † ← c + δ, where δ = −¯c mod p t (as before) but now
δ = (p t − 1) · c mod p. To compute such a δ, we need to know c mod p. Unfortunately, we don’t have
c mod p. One not-very-satisfying way of dealing with this problem is the following. Set ĉ ← [p t ] p·c mod q t .
Now, if c encrypted m, then ĉ encrypts [p t ] p · m, and ĉ’s noise is [p t ] p < p/2 times as large. It is obviously
easy to compute ĉ’s double-CRT format from c’s. Now, we set c † so that the following is true:
1. c † = ĉ mod p.
2. c † is very close to ĉ.
3. c † is divisible by p t .
This is easy to do. The algorithm to output c † in double-CRT format is as follows:
1. Set ¯c to be the coefficient representation of ĉ mod p t . (Computing this requires a single “small FFT”
modulo the prime p t .)
2. Set δ to be the polynomial with coefficients in (−p t · p/2, p t · p/2] such that δ = 0 mod p and
δ = −¯c mod p t .
3. Set c † = ĉ + δ, and output c † ’s double-CRT representation.
(a) We already have ĉ’s double-CRT representation.
(b) Computing δ’s double-CRT representation requires t “small FFTs” modulo the p j ’s.
E
Other Optimizations
Some other optimizations that we encountered during our implementation work are discussed next. Not all
of these optimizations are useful for our current implementation, but they may be useful in other contexts.
29
5. Homomorphic Evaluation of the AES Circuit