a590003

4.1 The Initial Noise from FHE.Enc
Recall that FHE.Enc simply invokes E.Enc for suitable parameters (params L ) that depend on λ and L. In
turn, the noise of ciphertexts output by E.Enc depends on the noise of the initial “ciphertexts” (the encryptions
of 0) implicit in the matrix A output by E.PublicKeyGen, whose noise distribution is dictated by the
distribution χ.
Lemma 5. Let n L and q L be the parameters associated to FHE.Enc. Let d be the dimension of the ring
R, and let γ R be the expansion factor associated to R. (Both of these quantities are 1 when R = Z.)
Let B χ be a bound such that R-elements sampled from the the noise distribution χ have length at most
B χ with overwhelming probability. The length of the noise in ciphertexts output by FHE.Enc is at most
1 + 2 · γ R · √d
· ((2n L + 1) log q L ) · B χ .
Proof. Recall that s ← E.SecretKeyGen and A ← E.PublicKeyGen(s, N) for N = (2n L + 1) log q L ,
where A · s = 2e for e ← χ. Recall that encryption works as follows: c ← m + A T r mod q where
r ∈ R N 2 . We have that the noise of this ciphertext is [〈c, s〉] q = [m + 2〈r, e〉] q , whose magnitude is at most
1 + 2 · γ R · ∑N
j=1 ‖r[j]‖ · ‖e[j]‖ ≤ 1 + 2 · γ R · √d
· N · B χ .
Notice that we are using very loose (i.e., conservative) upper bounds for the noise. These bounds
could be tightened up with a more careful analysis. The correctness of decryption for ciphertexts output
by FHE.Enc, assuming the noise bound above is less than q/2, follows directly from the correctness of the
basic encryption and decryption algorithms E.Enc and E.Dec.
4.2 Correctness and Performance of FHE.Add and FHE.Mult (before FHE.Refresh)
Consider FHE.Mult. One begins FHE.Mult(pk, c 1 , c 2 ) with two ciphertexts under key s j for modulus q j
that have noises e i = [L ci (s j )] qj , where L ci (x) is simply the dot product 〈c i , x〉. To multiply together two
ciphertexts, one multiplies together these two linear equations to obtain a quadratic equation Q c1 ,c 2
(x) ←
L c1 (x) · L c2 (x), and then interprets this quadratic equation as a linear equation L long
c 1 ,c 2
(x ⊗ x) = Q c1 ,c 2
(x)
over the tensored vector x ⊗ x. The coefficients of this long linear equation compose the new ciphertext
vector c 3 . Clearly, [〈c 3 , s j ⊗ s j 〉] qj = [L long
c 1 ,c 2
(s j ⊗ s j )] qj = [e 1 · e 2 ] qj . Thus, if the noises of c 1 and c 2 have
length at most B, then the noise of c 3 has length at most γ R · B 2 , where γ R is the expansion factor of R. If
this length is less than q j /2, then decryption works correctly. In particular, if m i = [〈c i , s j 〉] qj ] 2 = [e i ] 2 for
i ∈ {1, 2}, then over R 2 we have [〈c 3 , s j ⊗ s j 〉] qj ] 2 = [[e 1 · e 2 ] qj ] 2 = [e 1 · e 2 ] 2 = [e 1 ] 2 · [e 2 ] 2 = m 1 · m 2 .
That is, correctness is preserved as long as this noise does not wrap modulo q j .
The correctness of FHE.Add and FHE.Mult (before FHE.Refresh) is formally captured in the following
lemmas.
Lemma 6. Let c 1 and c 2 be two ciphertexts under key s j for modulus q j , where ‖[〈c i , s j 〉] qj ‖ ≤ B and
m i = [[〈c i , s j 〉] qj ] 2 . Let s ′ j = s j ⊗ s j , where the “non-quadratic coefficients” of s ′ j (namely, the ‘1’ and
the coefficients of s j ) are placed first. Let c ′ = c 1 + c 2 , and pad c ′ with zeros to get a vector c 3 such that
〈c 3 , s ′ j 〉 = 〈c′ , s j 〉. The noise [〈c 3 , s ′ j 〉] q j
has length at most 2B. If 2B < q j /2, c 3 is an encryption of
m 1 + m 2 under key s ′ j for modulus q j – i.e., m 1 · m 2 = [[〈c 3 , s ′ j 〉] q j
] 2 .
Lemma 7. Let c 1 and c 2 be two ciphertexts under key s j for modulus q j , where ‖[〈c i , s j 〉] qj ‖ ≤ B and
m i = [[〈c i , s j 〉] qj ] 2 . Let the linear equation L long
c 1 ,c 2
(x ⊗ x) be as defined above, let c 3 be the coefficient
vector of this linear equation, and let s ′ j = s j ⊗ s j . The noise [〈c 3 , s ′ j 〉] q j
has length at most γ R · B 2 . If
γ R · B 2 < q j /2, c 3 is an encryption of m 1 · m 2 under key s ′ j for modulus q j – i.e., m 1 · m 2 = [[〈c 3 , s ′ j 〉] q j
] 2 .
13
2. Fully Homomorphic Encryption without Bootstrapping