a590003

• SI-HE.Enc pk (m): Identical to Regev’s, output c←Regev.Enc pk (m).
• SI-HE.Eval evk (·): As usual, we describe homomorphic addition and multiplication over GF(2),
which allows to evaluate depth L arithmetic circuits in a gate-by-gate manner. The convention
for a gate at level i of the circuit is that the operand ciphertexts are decryptable using s i−1 , and
the output of the homomorphic operation is decryptable using s i .
Since evk contains key switching parameters from ˜s i−1 to s i , homomorphic addition and multiplication
both first produce an intermediate output ˜c that corresponds to ˜s i−1 , and then use
key switching to obtain the final output. 10
− SI-HE.Add evk (c 1 , c 2 ): Assume w.l.o.g that both input ciphertexts are encrypted under the
same secret key s i−1 . First compute
then output
˜c add :=PowersOfTwo(c 1 + c 2 ) ⊗ PowersOfTwo((1, 0, . . . , 0)) ,
c add ←SwitchKey(P (i−1):i , ˜c add ) ∈ Z n+1
q .
Let us explain what we did: We first added the ciphertext vectors (as expected) to obtain
c 1 + c 2 . This already implements the homomorphic addition, but provides an output that
corresponds to s i−1 and not s i as required. We thus generate ˜c add by tensoring with a “trivial”
ciphertext. The result corresponds to ˜s i−1 , and allows to finally use key switching to obtain
an output corresponding to s i . We use powers-of-two representation in order to control the
norm of the secret key (as we explain in Section 1.2).
− SI-HE.Mult evk (c 1 , c 2 ): Assume w.l.o.g that both input ciphertexts are encrypted under the
same secret key s i−1 . First compute
then output
2
(
˜c mult :=⌊
q · PowersOfTwo(c 1 ) ⊗ PowersOfTwo(c 2 )) ⌉ ,
c mult ←SwitchKey(P (i−1):i , ˜c mult ) ∈ Z n+1
q .
As we explain in Section 1.2, The tensored ciphertext ˜c mult mimics tensoring in the “invariant
perspective”, which produces an encryption of the product of the plaintexts under the
tensored secret key ˜s i−1 . We then switch keys to obtain an output corresponding to s i .
• Decryption SI-HE.Dec sk (c): Assume w.l.o.g that c is a ciphertext that corresponds to s L (=sk).
Then decryption is again identical to Regev’s, output
m←Regev.Dec sk (c) .
10 The final key switching replaces the more complicated “refresh” operation of [BGV12].
11
6. FHE without Modulus Switching