Design and Implementation of a Homomorphic ... - Researcher

homomorphic automorphism operation we get a two-polynomial ciphertext (c 0 , c 1 ) but relative to
the key s ′ = κ(s) (where κ is the same automorphism that we applied to the ciphertext, namely
s ′ (X) = s(X t ) for some t ∈ Z ∗ m).
To support all of these options, a ciphertext in our library consists of an arbitrary-length vector
of “ciphertext parts”, where each part is a polynomial, and each part contains a “handle” that
points to the secret-key that this part should be multiply by during decryption. Handles, parts,
and ciphertexts are implemented using the classes SKHandle, CtxtPart, and Ctxt, respectively.
3.1.1 The SKHandle class
An object of the SKHandle class “points” to one particular secret-key polynomial, that should
multiply one ciphertext-part during decryption. Recall that we allow multiple secret keys per
instance of the cryptosystem, and that we may need to reference powers of these secret keys (e.g.
s 2 after multiplication) or polynomials of the form s(X t ) (after automorphism). The general form
of these secret-key polynomials is therefore s r i (Xt ), where s i is one of the secret keys associated
with this instance, r is the power of that secret key, and t is the automorphism that we applied to
it. To uniquely identify a single secret-key polynomial that should be used upon decryption, we
should therefore keep the three integers (i, r, t).
Accordingly, a SKHandle object has three integer data members, powerOfS, powerOfX, and
secretKeyID. It is considered a reference to the constant polynomial 1 whenever powerOfS= 0,
irrespective of the other two values. Also, we say that a SKHandle object points to a base secret
key if it has powerOfS = powerOfX = 1.
Observe that when multiplying two ciphertext parts, we get a new ciphertext part that should
be multiplied upon decryption by the product of the two secret-key polynomials. This gives
us the following set of rules for multiplying SKHandle objects (i.e., computing the handle of
the resulting ciphertext-part after multiplication). Let {powerOfS, powerOfX, secretKeyID} and
{powerOfS ′ , powerOfX ′ , secretKeyID ′ } be two handles to be multiplied, then we have the following
rules:
• If one of the SKHandle objects points to the constant 1, then the result is equal to the other
one.
• If neither points to one, then we must have secretKeyID = secretKeyID ′ and powerOfX =
powerOfX ′ , otherwise we cannot multiply. If we do have these two equalities, then the result
will also have the same t = powerOfX and i = secretKeyID, and it will have r = powerOfS +
powerOfS ′ .
The methods provided by the SKHandle class are the following:
SKHandle(long powerS=0, long powerX=1, long sKeyID=0); // constructor
long getPowerOfS() const; // returns powerOfS;
long getPowerOfX() const; // returns powerOfX;
long getSecretKeyID() const; // return secretKeyID;
void setBase(); // set to point to a base secret key
void setOne(); // set to point to the constant 1
bool isBase() const; // does it point to base
14