a590003

largest radius of a ball that is circumscribed by P q , and the smallest radius of a ball that circumscribes P q . It
is possible to choose q so that the ratio r q,out /r q,in is poly(d). For example, this is true when q is an integer.
For a suitable value of f(x) that determines our ring, such as f(x) = x d + 1, the expected value of ratio
will be poly(d) even if q is sampled uniformly (e.g., according to discrete Gaussian distribution centered at
0). More generally, we will refer to r B,out as the outer radius associated to the parallelepiped determined by
basis B. Also, in the field Q(x)/f(x) overlying this ring, it will be true with overwhelming probability, if q
is sampled uniformly, that ‖q −1 ‖ = 1/‖q‖ up to a poly(d) factor. For convenience, let α(d) be a polynomial
such that ‖q −1 ‖ = 1/‖q‖ up to a α(d) factor and moreover r q,out /r q,in is at most α(d) with overwhelming
probability. For such an α, we say q is α-good. Finally, in the lemma, γ R denotes the expansion factor of R
– i.e., max{‖a · b‖/‖a‖‖b‖ : a, b ∈ R}.
Lemma 11. Let q 1 and q 2 , ‖q 1 ‖ < ‖q 2 ‖, be two α-good elements of R. Let B I be a short basis (with outer
radius r BI ,out) of an ideal I of R such that q 1 −q 2 ∈ I. Let c be an integer vector and c ′ ← Scale(c, q 2 , q 1 , I)
– that is, c ′ is an R-element at most 2r BI ,out distant from (q 1 /q 2 ) · c such that c ′ − c ∈ I. Then, for any s
with
(
)
‖[〈c, s〉] q2 ‖ < r q2 ,in/α(d) 2 − (‖q 2 ‖/‖q 1 ‖)γ R · 2r BI ,out · l (R)
1 (s) /(α(d) · γR)
2
we have
[ 〈 c ′ , s 〉 ] q1 = [〈c, s〉] q2 mod I and ‖[ 〈 c ′ , s 〉 ] q1 ‖ < α(d) · γ 2 R · (‖q 1 ‖/‖q 2 ‖) · ‖[〈c, s〉] q2 ‖ + γ R · 2r BI ,out · l (R)
1 (s)
where l (R)
1 (s) is defined as ∑ i ‖s[i]‖.
Proof. We have
for some k ∈ R. For the same k, let
[〈c, s〉] q2 = 〈c, s〉 − kq 2
e q1 = 〈 c ′ , s 〉 − kq 1 ∈ R
Note that e q1 = [〈c ′ , s〉] q1 mod q 1 . We claim that ‖e q1 ‖ is so small that e q1 = [〈c ′ , s〉] q1 . We have:
‖e q1 ‖
= ‖ − kq 1 + 〈(q 1 /q 2 ) · c, s〉 + 〈 c ′ − (q 1 /q 2 ) · c, s 〉 ‖
≤ ‖ − kq 1 + 〈(q 1 /q 2 ) · c, s〉 ‖ + ‖ 〈 c ′ − (q 1 /q 2 ) · c, s 〉 ‖
≤ γ R · ‖q 1 /q 2 ‖ · ‖[〈c, s〉] q2 ‖ + γ R · 2r BI ,out · l (R)
1 (s)
≤ γ 2 R · ‖q 1 ‖ · ‖q 2 −1 ‖ · ‖[〈c, s〉] q2 ‖ + γ R · 2r BI ,out · l (R)
1 (s)
≤ α(d) · γ 2 R · (‖q 1 ‖/‖q 2 ‖) · ‖[〈c, s〉] q2 ‖ + γ R · 2r BI ,out · l (R)
1 (s)
By the final expression above, we see that the magnitude of e q1 may actually be less than the magnitude
of e q2 if ‖q 1 ‖/‖q 2 ‖ is small enough. Let us continue with the inequalities, substituting in the bound for
‖[〈c, s〉] q2 ‖:
(
)
‖e q1 ‖ ≤ α(d) · γR 2 · (‖q 1 ‖/‖q 2 ‖) · r q2 ,in/α(d) 2 − (‖q 2 ‖/‖q 1 ‖)γ R · 2r BI ,out · l (R)
1 (s) /(α(d) · γR)
2
+γ R · 2r BI ,out · l (R)
1 (s)
(
)
≤ (‖q 1 ‖/‖q 2 ‖) · r q2 ,in/α(d) 2 − (‖q 2 ‖/‖q 1 ‖)γ R · 2r BI ,out · l (R)
1 (s)
(
)
≤ r q1 ,in − γ R · 2r BI ,out · l (R)
1 (s) + γ R · 2r BI ,out · l (R)
1 (s)
= r q1 ,in
23
+ γ R · 2r BI ,out · l (R)
1 (s)
2. Fully Homomorphic Encryption without Bootstrapping