a590003

variable s(τ m ) (defined over the choice of each of these coefficients as ±1) is a zero-mean complex
random variable with variance exactly H (since it is a sum of exactly H random variables, each
obtained by multiplying a uniform ±1 by a complex constant of magnitude 1). For r > 1, it is
clear that E[|s(τ m ) r | 2 ] ≥ E[|s(τ m )| 2 ] r = H r , but the factor of r! may not be clear. We obtained that
factor experimentally for the most part, by generating many polynomials s of some given Hamming
weight and checking the magnitude of s(τ m ). Then we validated this experimental result the case
r = 2 (which is the most common case when using our library), as described in the appendix. The
rules that we use for computing and updating the data member noiseVar during the computation,
as described below.
Encryption. For a fresh ciphertext, encrypted using the public encryption key, we have noiseVar =
σ 2 (1 + φ(m) 2 /2 + φ(m)(H + 1)), where σ 2 is the variance in our RLWE instances, and H is
the Hamming weight of the first secret key.
When the plaintext space modulus is p > 2, that quantity is larger by a factor of p 2 . See
Section 3.2.2 for the reason for these expressions.
Modulus-switching. The noise magnitude in the ciphertexts scales up as we add primes to the
prime-set, while modulus-switching down involves both scaling down and adding some term
(corresponding to the rounding errors for modulus-switching). Namely, when adding more
primes to the prime-set we scale up the noise estimate as noiseVar ′ = noiseVar · ∆ 2 , with
∆ the product of the added primes.
When removing primes from the prime-set we scale down and add an extra term, setting
noiseVar ′ = noiseVar/∆ 2 +addedNoise, where the added-noise term is computed as follows:
We go over all the parts in the ciphertext, and consider their handles. For any part j with a
handle that points to s r j
j
(X t j
), where s j is a secret-key polynomial whose coefficient vector
has Hamming-weight H j , we add a term (p 2 /12) · φ(m) · (r j )! · H r j
j
. Namely, when modulusswitching
down we set
noiseVar ′ = noiseVar/∆ 2 + ∑ j
See Section 3.1.5 for the reason for this expression.
p 2
12 · φ(m) · (r j)! · H r j
j
.
Re-linearization/key-switching. When key-switching a ciphertext, we modulus-switch down to
remove all the “special primes” from the prime-set of the ciphertext if needed (cf. Section 2.7).
Then, the key-switching operation itself has the side-effect of adding these “special primes”
back. These two modulus-switching operations have the effect of scaling the noise down, then
back up, with the added noise term as above. Then add yet another noise term as follows:
The key-switching operation involves breaking the ciphertext into some number n ′ of “digits”
(see Section 3.1.6). For each digit i of size D i and every ciphertext-part that we need to
switch (i.e., one that does not already point to 1 or a base secret key), we add a noise-term
φ(m)σ 2 · p 2 · D 2 i /4, where σ2 is the variance in our RLWE instances. Namely, if we need to
switch k parts and if noiseVar ′ is the noise estimate after the modulus-switching down and
up as above, then our final noise estimate after key-switching is
∑
noiseVar ′′ = noiseVar ′ + k · φ(m)σ 2 · p 2 · Di 2 /4
17
n ′
i=1
16. Design and Implementation of a Homomorphic-Encryption Library