a590003

In particular (recall that E < ⌊q/2⌋ /2 ≤ q/4):
|δ 3 | ≤ 2(2E + 1)O(n log q) + 2E + 1 + 2E2
q
= O(n log q) · E .
where
Putting everything together, we get that
⌊ q
⟨c mult , (1, s i )⟩ = · m 1 m 2 + δ 1 + δ 2 + δ 3 (mod q) ,
2⌋
} {{ }
=e mult
and the lemma follows.
Acknowledgments
|e mult | = |δ 1 + δ 2 + δ 3 | ≤ O(n log q) · E + O(n 2 log 3 q) · B ,
We thank Vinod Vaikuntanathan for fruitful discussions and advice, and Dan Boneh for his comments
on an earlier version of this manuscript. We thank the reviewers of CRYPTO 2012 for their
constructive comments. In addition, we thank various readers for pointing out typos in earlier
versions of this manuscript.
References
[ACPS09]
[AD97]
[BGV12]
[BV11a]
[BV11b]
Benny Applebaum, David Cash, Chris Peikert, and Amit Sahai. Fast cryptographic
primitives and circular-secure encryption based on hard learning problems. In Shai
Halevi, editor, CRYPTO, volume 5677 of Lecture Notes in Computer Science, pages
595–618. Springer, 2009.
Miklós Ajtai and Cynthia Dwork. A public-key cryptosystem with worst-case/averagecase
equivalence. In Frank Thomson Leighton and Peter W. Shor, editors, STOC, pages
284–293. ACM, 1997.
Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. (leveled) fully homomorphic
encryption without bootstrapping. ITCS, 2012. See also http://eprint.iacr.org/
2011/277.
Zvika Brakerski and Vinod Vaikuntanathan. Fully homomorphic encryption from ring-
LWE and security for key dependent messages. In CRYPTO, volume 6841, page 501,
2011.
Zvika Brakerski and Vinod Vaikuntanathan. Efficient fully homomorphic encryption
from (standard) LWE. In Ostrovsky [Ost11], pages 97–106. References are to full
version: http://eprint.iacr.org/2011/344.
[CMNT11] Jean-Sébastien Coron, Avradip Mandal, David Naccache, and Mehdi Tibouchi. Fully
homomorphic encryption over the integers with shorter public keys. In Rogaway
[Rog11], pages 487–504.
17
6. FHE without Modulus Switching