a590003

So now consider the inner sum in (7). The weights w(e 1 ), . . . , w(e k ) are integers bounded by r
in absolute value, and r is strictly less than m by the assumption 2r 2 ≤ H ≤ m. If any weight,
say
∑
w(e 1 ), is non-zero, then τ w(e1) has multiplicative order dividing m, but not 1, and so the sum
j τ jw(e1) vanishes, and hence
∑
( ∑
)( ∑
)
τ j 1w(e 1 )+···+j k w(e k ) = τ j 1w(e 1 )
τ j 2w(e 2 )+···+j k w(e k )
= 0.
j 1 ,...,j k j 1 j 2 ,...,j k
Otherwise, if all the weights are w(e 1 ), . . . , w(e k ) are zero, then
We therefore have
∑
P ={e 1 ,...,e k }
(H/m) k
∑
j 1 ,...,j k
τ j 1w(e 1 )+···+j k w(e k ) = m k .
∑
j 1 ,...,j k
τ j 1w(e 1 )+···+j k w(e k ) =
∑
P ={e 1 ,...,e k }
w(e 1 )=···=w(e k )=0
H k , (8)
Observe that any partition P = {e 1 , . . . , e k } with w(e 1 ) = · · · = w(e k ) = 0 can be formed by
merging the edges of some perfect matching on the complete bipartite graph with vertex sets
{1, . . . , r} and {r + 1, . . . , 2r}. The total number of such matchings is r! (see (2)). So we have
r!H r ≤
∑
P ={e 1 ,...,e k }
w(e 1 )=···=w(e k )=0
∑r−1
{ r
H k ≤ r!H r + r! H
k}
k
k=1
k=1
∑r−1
{ r
≤ 2r! H
k}
k (by Lemma 2)
= 2r!(H r − H r ) (by (1))
≤ 2r!r 2 H r−1 (by Lemma 1)
Combining this with (7) and (8) proves the theorem.
40
16. Design and Implementation of a Homomorphic-Encryption Library