a590003

We can now plug in what we know about c 1 , c 2 from Eq. (1) in the lemma statement:
⌊ q
⌊ q
⟨˜c add , ˜s i ⟩ = · m 1 + e 1 + · m 2 + e 2 (mod q)
⌊
2⌋
2⌋
q
= · [m 1 + m 2 ]
2⌋
2
− ˜m + e 1 + e
} {{ } 2 , (mod q)
δ 2
where ˜m ∈ {0, 1} is defined as:
{
˜m
and |δ 2 | ≤ 1 + 2E.
Putting it all together,
Where the bound on e add is
0, if q is even,
1
2 · (m 1 + m 2 − [m 1 + m 2 ] 2
), if q is odd,
⌊ q
⟨c add , (1, s i )⟩ =
2⌋
· [m 1 + m 2 ] 2
+ δ 1 + δ 2
} {{ }
=e add
(mod q) .
|e add | = |δ 1 + δ 2 | ≤ O(n 2 log 3 q) · B + O(1) · E ≤ O(n log q) · max { E, (n log 2 q) · B } .
This finishes the argument for addition.
Analysis for Multiplication.
The analysis for multiplication starts very similarly to addition:
and as before
⟨c mult , (1, s i )⟩ = ⟨˜c mult , ˜s i ⟩ + ⟨BitDecomp(˜c mult ), e i−1:i ⟩
} {{ }
δ 1
(mod q) ,
|δ 1 | = O(n 2 log 3 q) · B .
Let us now focus on ⟨˜c mult , ˜s i ⟩. We want to use the properties of tensoring to break the inner
product into two smaller inner products, as we did before. This time, however, ˜c mult is a rounded
tensor:
⟨ ⌊ ⌉
2
⟩
⟨˜c, ˜s i ⟩ =
q · (PowersOfTwo(c 1) ⊗ PowersOfTwo(c 2 )) , ˜s i−1 (mod q) .
We start by showing that the rounding does not add much noise. Intuitively this is because
˜s i−1 is a binary vector and thus has low norm. We define
⟨ ⌊ ⌉
2
⟩
δ 2
q · (PowersOfTwo(c 1) ⊗ PowersOfTwo(c 2 )) , ˜s i−1
⟨ 2
⟩
−
q · (PowersOfTwo(c 1) ⊗ PowersOfTwo(c 2 )), ˜s i−1 ,
and for convenience we also define
⌊ ⌉
2
c ′
q · (PowersOfTwo(c 1) ⊗ PowersOfTwo(c 2 ))
− 2 q · (PowersOfTwo(c 1) ⊗ PowersOfTwo(c 2 )) .
15
6. FHE without Modulus Switching