a590003

a different ciphertext c 2 that encrypts the same message, but is now decryptable under a second secret key
vector s 2 . The vectors c 2 , s 2 may not necessarily be of lower degree or dimension than c 1 , s 1 .
Below, we review the concrete details of Brakerski and Vaikuntanathan’s key switching procedures. The
procedures will use some subroutines that, given two vectors c and s, “expand” these vectors to get longer
(higher-dimensional) vectors c ′ and s ′ such that 〈c ′ , s ′ 〉 = 〈c, s〉 mod q. We describe these subroutines first.
• BitDecomp(x ∈ Rq n , q) decomposes x into its bit representation. Namely, write x = ∑ ⌊log q⌋
j=0
2 j · u j ,
where all of the vectors u j are in R2 n, and output (u n·⌈log q⌉
0, u 1 , . . . , u ⌊log q⌋ ) ∈ R2 .
• Powersof2(x ∈ R n q , q) outputs the vector (x, 2 · x, . . . , 2 ⌊log q⌋ · x) ∈ R
n·⌈log q⌉
q .
If one knows a priori that x has coefficients in [0, B] for B ≪ q, then BitDecomp can be optimized in
n·⌈log B⌉
the obvious way to output a shorter decomposition in R2 . Observe that:
Lemma 2. For vectors c, s of equal length, we have 〈BitDecomp(c, q), Powersof2(s, q)〉 = 〈c, s〉 mod q.
Proof.
〈BitDecomp(c, q), Powersof2(s, q)〉 =
⌊log q⌋
∑
j=0
〈
uj , 2 j · s 〉 =
⌊log q⌋
∑
j=0
〈
2j · u j , s 〉 =
〈 ⌊log q⌋
∑
j=0
2 j · u j , s
〉
= 〈c, s〉 .
We remark that this obviously generalizes to decompositions wrt bases other than the powers of 2.
Now, key switching consists of two procedures: first, a procedure SwitchKeyGen(s 1 , s 2 , n 1 , n 2 , q),
which takes as input the two secret key vectors as input, the respective dimensions of these vectors, and
the modulus q, and outputs some auxiliary information τ s1 →s 2
that enables the switching; and second, a
procedure SwitchKey(τ s1 →s 2
, c 1 , n 1 , n 2 , q), that takes this auxiliary information and a ciphertext encrypted
under s 1 and outputs a new ciphertext c 2 that encrypts the same message under the secret key s 2 . (Below,
we often suppress the additional arguments n 1 , n 2 , q.)
SwitchKeyGen(s 1 ∈ R n 1
q , s 2 ∈ R n 2
q ):
1. Run A ← E.PublicKeyGen(s 2 , N) for N = n 1 · ⌈log q⌉.
2. Set B ← A + Powersof2(s 1 ) (Add Powersof2(s 1 ) ∈ R N q to A’s first column.) Output τ s1 →s 2
= B.
SwitchKey(τ s1 →s 2
, c 1 ): Output c 2 = BitDecomp(c 1 ) T · B ∈ R n 2
q .
Note that, in SwitchKeyGen, the matrix A basically consists of encryptions of 0 under the key s 2 . Then,
pieces of the key s 1 are added to these encryptions of 0. Thus, in some sense, the matrix B consists of
encryptions of pieces of s 1 (in a certain format) under the key s 2 . We now establish that the key switching
procedures are meaningful, in the sense that they preserve the correctness of decryption under the new key.
Lemma 3. [Correctness] Let s 1 , s 2 , q, n 1 , n 2 , A, B = τ s1 →s 2
be as in SwitchKeyGen(s 1 , s 2 ), and let
A · s 2 = 2e 2 ∈ Rq N . Let c 1 ∈ R n 1
q and c 2 ← SwitchKey(τ s1 →s 2
, c 1 ). Then,
〈c 2 , s 2 〉 = 2 〈BitDecomp(c 1 ), e 2 〉 + 〈c 1 , s 1 〉 mod q
9
2. Fully Homomorphic Encryption without Bootstrapping