a590003

The first time that ImportSecKey is called for a specific instance, it also generates a public
encryption key relative to this first secret key. Namely, for the first secret key s it chooses at random
a polynomial c ∗ 1 ∈ R A Qct (where Q ct is the product of all the ciphertext primes) as well as a low-norm
error polynomial e ∗ ∈ A Qct (with Gaussian coefficients), then sets c ∗ 0 := [ptxtSpace · e∗ − s · c ∗ 1 ] Q ct
.
Clearly the resulting pair (c ∗ 0 , c∗ def
1 ) satisfies m∗ = [c ∗ 0 + s · c∗ 1 ] Q ct
= ptxtSpace · e ∗ , and the noise
estimate for this public encryption key is noiseVar ∗ = E[|m ∗ (τ m )| 2 ] = p 2 σ 2 · φ(m).
Decryption. The decryption process is rather straightforward. We go over all the ciphertext
parts in the given ciphertext, multiply each part by the secret key that this part points to, and sum
the result modulo the current BGV modulus. Then we reduce the result modulo the plaintext-space
modulus, which gives us the plaintext. This is implemented in the method
void Decrypt(ZZX& plaintxt, const Ctxt &ciphertxt) const;
that returns the result in the plaintxt argument. For debugging purposes, we also provide the
method void Decrypt(ZZX& plaintxt, const Ctxt &ciphertxt, ZZX& f) const, that returns
also the polynomial before reduction modulo the plaintext space modulus. We stress that it would
be insecure to use this method in a production system, it is provided only for testing and debugging
purposes.
Generating key-switching matrices.
matrices, using the method:
We also provide an interface for generating key-switching
void GenKeySWmatrix(long fromSPower, long fromXPower, long fromKeyIdx=0,
long toKeyIdx=0, long ptxtSpace=0);
This method checks if the relevant key-switching matrix already exists, and if not then it generates
it (as described in Section 3.2.1) and inserts into the list keySwitching. If left unspecified, the
plaintext space defaults to 2 r , as defined by context.mod2r.
Secret-key encryption. We also provide a secret-key encryption method, that produces ciphertexts
with a slightly smaller noise than the public-key encryption method. Namely we have the
method
long FHESecKey::Encrypt(Ctxt &c, const ZZX& ptxt, long ptxtSpace, long skIdx) const;
that encrypts the polynomial ptxt relative to plaintext-space modulus ptxtSpace, and the secret
key whose index is skIdx. Similarly to the choise of the public encryption key, the Encrypt
method chooses at random a polynomial c 1 ∈ R A Qct (where Q ct is the product of all the ciphertext
primes) as well as a low-norm error polynomial e ∈ A Qct (with Gaussian coefficients), then sets
c 0 := [ptxtSpace · e + ptxt − s · c 1 ] Qct . Clearly the resulting pair (c 0 , c 1 ) satisfies m def = [c 0 + s ·
c 1 ] Qct = ptxtSpace · e + ptxt, and the noise estimate for this public encryption key is noiseVar ≈
E[|m(τ m )| 2 ] = p 2 σ 2 · φ(m).
3.3 The KeySwitching module: What matrices to generate
This module implements a few useful strategies for deciding what key-switching matrices for automorphism
to choose during key-generation. Specifically we have the following methods:
28
16. Design and Implementation of a Homomorphic-Encryption Library