a590003

ool isCorrect() const; and double log of ratio() const; The method isCorrect() compares
the noise estimate to the current modulus, and returns true if the noise estimate is
less than half the modulus size. Specifically, if √ noiseVar < q/2. The method double
log of ratio() returns log(noiseVar)/2 − log(q).
Access methods.
Read-only access the data members of a Ctxt object:
const FHEcontext& getContext() const;
const FHEPubKey& getPubKey() const;
const IndexSet& getPrimeSet() const;
const xdouble& getNoiseVar() const;
const long getPtxtSpace() const; // the plaintext-space modulus
const long getKeyID() const; // key-ID of the first part not pointing to 1
3.2 The FHE module: Keys and key-switching matrices
Recall that we made the high-level design choices to allow instances of the cryptosystem to have
multiple secret keys. This decision was made to allow a leveled encryption system that does not
rely on circular security, as well as to support switching to a different key for different purposes
(which may be needed for bootstrapping, for example). However, we still view using just a single
secret-key per instance (and relying on circular security) as the primary mode of using our library,
and hence provided more facilities to support this mode than for the mode of using multiple keys.
Regardless of how many secret keys we have per instance, there is always just a single public
encryption key, for encryption relative to the first secret key. (The public key in our variant of
the BGV cryptosystem is just a ciphertext, encrypting the constant 0.) In addition to this public
encryption key, the public-key contains also key-switching matrices and some tables to help finding
the right matrices to use in different settings. Ciphertexts relative to secret keys other than the
first (if any), can only be generated using the key-switching matrices in the public key.
3.2.1 The KeySwitch class
This class implements key-switching matrices. As we described in Section 3.1.6, a key-switching
matrix from s ′ to s, denoted W [s ′ ⇒ s], is a 2 × n matrix of polynomials from A Q , where Q is the
product of all the small primes in our chain (both ciphertext-primes and special-primes). Recall
that the ciphertext primes are partitioned into n digits, where we denote the product of primes
corresponding the i’th digit by D i . Then the i’th column of the matrix W [s ′ ⇒ s] is a pair of
elements (a i , b i ) ∈ AQ 2 that satisfy
[b i + a i · s] Q = ( ∏ j