a590003

Lemma 4. Let prime p = ω(N 2 ). There is a prime r = O(N) and a univariate polynomial f(x)
of degree O(N 2 ) such that, for all ciphertexts (c, {u ′ i }, {u′′ i }) that encrypt m ∈ {0, 1}, we have
m = f(t r ) mod p where
def
t r = [2 κ · c] r + ∑ i s i · [−2 κ · u ′ i − u ′′
i ] r . (3)
Proof. Let t = 2 κ( c − ∑ s i · u ′ ∑
i)
− si · u ′′
i . The original decryption formula (Equation 2) is
m = c − ∑ s i · u ′ i − ⌊2 −κ · ∑ s i · u ′′
i ⌉ = ⌊2 −κ · t⌉ mod p
Thus, m can be recovered from t. Since there are only 2 possibilities for m, the (consecutive)
support of t has size 2 κ+1 = O(N). Set r to be a prime ≥ 2 κ+1 . Since the mapping x ↦→ [x] r has
no collisions over the support of t, t can be recovered from [t] r . Note that [t] r = [t r ] r . Thus m can
be recovered from t r (via [t r ] r = [t] r , then t). Since there are O(N · r) = O(N 2 ) possibilities for t r ,
the lemma follows.
Theorem 3. Let prime p = ω(N 2 ). There is a prime r = O(N) and a multilinear symmetric
polynomial M such that, for all “hashed” ciphertexts ([2 κ · c] r , {[−2 κ · u ′ i − u′′ i ] r}) that encrypt
m ∈ {0, 1}, we have
m = M(1, . . . , 1, 0, . . . , 0, . . . s
} {{ } } {{ } 1 , . . . , s 1 , 0, . . . , 0
} {{ } } {{ }
[2 κ·c] r r−[2 κ·c] r [−2 κ·u ′ 1 −u′′ 1 ]r
r−[−2 κ·u ′ 1 −u′′
Proof. This follows easily from Lemmas 4 and 2.
, . . . s N , . . . , s N , 0, . . . , 0 ) mod p
} {{ } } {{ }
1 ]r [−2 κ·u ′ N −u′′ N ]r r−[−2 κ·u ′ N −u′′ N ]r
Thus, decryption can be turned into a purely multilinear symmetric polynomial M whose
product gates output λ j · P (a j ) (for known ciphertext-independent λ j ’s), where P (z) is similar
to the polynomial described in Section 4.1. Using the optimization of Section 4.1, we can compress
the entire leveled FHE ciphertext down to a single MHE ciphertext that encrypts P (a 1 ).
Acknowledgments This material is based on research sponsored by DARPA under agreement
number FA8750-11-C-0096. The U.S. Government is authorized to reproduce and distribute reprints
for Governmental purposes notwithstanding any copyright notation thereon. The views and conclusions
contained herein are those of the authors and should not be interpreted as necessarily
representing the official policies or endorsements, either expressed or implied, of DARPA or the
U.S. Government. Distribution Statement “A” (Approved for Public Release, Distribution Unlimited)
References
[BV11]
[ElG85]
Zvika Brakerski and Vinod Vaikuntanathan. Fully homomorphic encryption for ringlwe
and security for key dependent messages. In Advances in Cryptology - CRYPTO
2011, Lecture Notes in Computer Science. Springer, 2011.
T. ElGamal. A public key cryptosystem and a signature scheme based on discrete
logarithms. In Advances in Cryptology – CRYPTO ’84, volume 196 of Lecture Notes
in Computer Science, pages 10–18. Springer-Verlag, 1985.
12
1. Fully Homomorphic Encryption without Squashing