Design and Implementation of a Homomorphic ... - Researcher

ool isOne() const; // does it point to 1
bool operator==(const SKHandle& other) const;
bool operator!=(const SKHandle& other) const;
bool mul(const SKHandle& a, const SKHandle& b); // multiply the handles
// result returned in *this, returns true if handles can be multiplied
3.1.2 The CtxtPart class
A ciphertext-part is a polynomial with a handle (that “points” to a secret-key polynomial). Accordingly,
the class CtxtPart is derived from DoubleCRT, and includes an additional data member of
type SKHandle. This class does not provide any methods beyond the ones that are provided by the
base class DoubleCRT, except for access to the secret-key handle (and constructors that initialize
it).
3.1.3 The Ctxt class
A Ctxt object is always defined relative to a fixed public key and context, both must be supplied
to the constructor and are fixed thereafter. As described above, a ciphertext contains a vector of
parts, each part with its own handle. This type of representation is quite flexible, for example you
can in principle add ciphertexts that are defined with respect to different keys, as follows:
• For parts of the two ciphertexts that point to the same secret-key polynomial (i.e., have the
same handle), you just add the two DoubleCRT polynomials.
• Parts in one ciphertext that do not have counter-part in the other ciphertext will just be
included in the result intact.
For example, suppose that you wanted to add the following two ciphertexts. one “canonical” and
the other after an automorphism X ↦→ X 3 :
⃗c = (c 0 [i = 0, r = 0, t = 0], c 1 [i = 0, r = 1, t = 1])
and ⃗c ′ = (c ′ 0[i = 0, r = 0, t = 0], c ′ 3[i = 0, r = 1, t = 3]).
Adding these ciphertexts, we obtain a three-part ciphertext,
⃗c + ⃗c ′ = ((c 0 + c ′ 0)[i = 0, r = 0, t = 0], c 1 [i = 0, r = 1, t = 1], c ′ 3[i = 0, r = 1, t = 3]).
Similarly, we also have flexibility in multiplying ciphertexts using a tensor product, as long as all
the pairwise handles of all the parts can be multiplied according to the rules from Section 3.1.1
above.
The Ctxt class therefore contains a data member vector parts that keeps all of
the ciphertext-parts. By convention, the first part, parts[0], always has a handle pointing to
the constant polynomial 1. Also, we maintain the invariant that all the DoubleCRT objects in the
parts of a ciphertext are defined relative to the same subset of primes, and the IndexSet for this
subset is accessible as ctxt.getPrimeSet(). (The current BGV modulus for this ciphertext can
be computed as q = ctxt.getContext().productOfPrimes(ctxt.getPrimeSet()).)
15