a590003

constant (i.e. |poly(τ m )| 2 ), or else we use the default value size = φ(m) · (p/2) 2 , and this value
(times f 2 ) is added to our noise estimate.
Multiplication by constant. Implemented by the methods
void Ctxt::multByConstant(const ZZX& poly, double size=0.0);
void Ctxt::multByConstant(const DoubleCRT& poly, double size=0.0);
All the parts of *this are multiplied by the constant, and the noise estimate is multiplied by the
size of the constant. As before, the application can specify the size, or else we use the default value
size = φ(m) · (p/2) 2 .
Multiplication. “Raw” multiplication is implemented by
Ctxt& Ctxt::operator*=(const Ctxt& other);
If needed, we modulus-switch down to the intersection of the prime-sets of both arguments, then
compute the tensor product of the two, namely the collection of all pairwise products of parts from
*this and other.
The noise estimate of the result is the product of the noise estimates of the two arguments, times
a factor which is computed as follows: Let r 1 be the highest power of s (i.e., the powerOfS value)
in all the handles in *this, and similarly let r 2 be the highest power of s in all the handles other.
The extra factor is then set as ( r 1 +r 2
)
r 1
. Namely, noiseVar ′ = noiseVar · other.noiseVar · (r 1 +r 2
)
r 1
.
The reason for the ( r 1 +r 2
)
r 1
factor is that the ciphertext part in the result, obtained by multiplying
the two parts with the highest powerOfS value, will have powerOfS value of the sum, r = r 1 + r 2 .
Recall from Section 3.1.4 that we estimate E[|s(τ m ) r | 2 ] ≈ r! · H r , where H is the Hamming weight
of the coefficient-vector of s. Thus our noise estimate for the relevant part in *this is r 1 ! · H r 1
and
the estimate for the part in other is r 2 ! · H r 2
. To obtain the desired estimate of (r 1 + r 2 )! · H r 1+r 2
,
we need to multiply the product of the estimates by the extra factor (r 1+r 2 )!
r 1 !·r 2 !
= ( r 1 +r 2
)
r 1
.
1
Higher-level multiplication. We also provide the higher-level methods
void Ctxt::multiplyBy(const Ctxt& other);
void Ctxt::multiplyBy(const Ctxt& other1, const Ctxt& other2);
The first method multiplies two ciphertexts, it begins by removing primes from the two arguments
down to a level where the rounding-error from modulus-switching is the dominating noise term (see
findBaseSet below), then it calls the low-level routine to compute the tensor product, and finally
it calls the reLinearize method to get back a canonical ciphertext.
The second method that multiplies three ciphertexts also begins by removing primes from the
two arguments down to a level where the rounding-error from modulus-switching is the dominating
noise term. Based on the prime-sets of the three ciphertexts it chooses an order to multiply them
(so that ciphertexts at higher levels are multiplied first). Then it calls the tensor-product routine
to multiply the three arguments in order, and then re-linearizes the result.
We also provide the two convenience methods square and cube that call the above two-argument
and three-argument multiplication routines, respectively.
1 Although products of other pairs of parts may need a smaller factor, the parts with highest powerOfS value
represent the largest contribution to the overall noise, hence we use this largest factor for everything.
22
16. Design and Implementation of a Homomorphic-Encryption Library