a590003

The Unpack function should accept the output of a batched computation, namely a ciphertext c ′ such that
m i = [[〈c ′ , s ′ 1 〉] q] pi for all i, and then de-aggregate this ciphertext by outputting ciphertexts c ′ 1 , . . . , c′ d under
some possibly different common secret key s ′ 2 such that m i = [[〈c ′ i , s′ 2 〉] q] p1 for all i. Now that all of the
ciphertexts are under a common key and plaintext slot, normal homomorphic operations can resume. With
such Pack and Unpack functions, we could indeed batch the bootstrapping operation. For circuits of large
width (say, at least d) we could reduce the per-gate bootstrapping computation by a factor of d, making it
only quasi-linear in λ. Assuming the Pack and Unpack functions have complexity at most quasi-quadratic
in d (per-gate this is only quasi-linear, since Pack and Unpack operate on d gates), the overall per-gate
computation of a batched-bootstrapped scheme becomes only quasi-linear.
Here, we describe suitable Pack and Unpack functions. These functions will make heavy use of the
automorphisms σ i→j over R that map elements of p i to elements of p j . (See Section 5.1.1.) We note that
Smart and Vercauteren [21] used these automorphisms to construct something similar to our Pack function
(though for unpacking they resorted to bootstrapping). We also note that Lyubashevsky, Peikert and Regev
[14] used these automorphisms to permute the ideal factors q i of the modulus q, which was an essential tool
toward their proof of the pseudorandomness of RLWE.
Toward Pack and Unpack procedures, our main idea is the following. If m is encoded in the free term
as a number in {0, . . . , p − 1} and if m = [[〈c, s〉] q ] pi , then m = [[〈σ i→j (c), σ i→j (s)〉] q ] pj . That is, we can
switch the plaintext slot but leave the decrypted message unchanged by applying the same automorphism
to the ciphertext and the secret key. (These facts follow from the fact that σ i→j is a homomorphism, that
it maps elements of p i to elements of p j , and that it fixes free terms.) Of course, then we have a problem:
the ciphertext is now under a different key, whereas we may want the ciphertext to be under the same key
as other ciphertexts. To get the ciphertexts to be back under the same key, we simply use the SwitchKey
algorithm to switch all of the ciphertexts to a new common key.
Some technical remarks before we describe Pack and Unpack more formally: We mention again that
E.PublicKeyGen is modified in the obvious way so that A·s = p·e rather than 2·e, and that this modification
induces a similar modification in SwitchKeyGen. Also, let u ∈ R be a short element such that u ∈ 1 + p 1
and u ∈ p j for all j ≠ 1. It is obvious that such a u with coefficients in (−p/2, p/2] can be computed
efficiently by first picking any element u ′ such that u ′ ∈ 1 + p 1 and u ′ ∈ p j for all j ≠ 1, and then reducing
the coefficients of u ′ modulo p.
PackSetup(s 1 , s 2 ): Takes as input two secret keys s 1 , s 2 . For all i ∈ [1, d], it runs τ σ1→i (s 1 )→s 2
←
SwitchKeyGen(σ 1→i (s 1 ), s 2 ).
Pack({c i } d i=1 , {τ σ 1→i (s 1 )→s 2
} d i=1 ): Takes as input ciphertexts c 1, . . . , c d such that m i = [[〈c i , s 1 〉] q ] p1 and
0 = [[〈c i , s 1 〉] q ] pj for all j ≠ 1, and also some auxiliary information output by PackSetup. For all i, it does
the following:
• Computes c ∗ i ← σ 1→i(c i ). (Observe: m i = [[〈c ∗ i , σ 1→i(s 1 )〉] q ] pi while 0 = [[〈c ∗ i , σ 1→i(s 1 )〉] q ] pj for
all j ≠ i.)
• Runs c † i ← SwitchKey(τ σ 1→i (s 1 )→s 2
, c ∗ i ) (Observe: Assuming the noise does not wrap, we have that
m i = [[〈c † i , s 2〉] q ] pi and 0 = [[〈c † i , s 2〉] q ] pj for all j ≠ i.)
Finally, it outputs c ← ∑ d
i=1 c† i . (Observe: Assuming the noise does not wrap, we have that m i =
[[〈c, s 2 〉] q ] pi for all i.)
UnpackSetup(s 1 , s 2 ): Takes as input two secret keys s 1 , s 2 . For all i ∈ [1, d], it runs τ σi→1 (s 1 )→s 2
←
SwitchKeyGen(σ i→1 (s 1 ), s 2 ).
21
2. Fully Homomorphic Encryption without Bootstrapping