Design and Implementation of a Homomorphic ... - Researcher
Design and Implementation of a Homomorphic ... - Researcher
Design and Implementation of a Homomorphic ... - Researcher
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
constant (i.e. |poly(τ m )| 2 ), or else we use the default value size = φ(m) · (p/2) 2 , <strong>and</strong> this value<br />
(times f 2 ) is added to our noise estimate.<br />
Multiplication by constant. Implemented by the methods<br />
void Ctxt::multByConstant(const ZZX& poly, double size=0.0);<br />
void Ctxt::multByConstant(const DoubleCRT& poly, double size=0.0);<br />
All the parts <strong>of</strong> *this are multiplied by the constant, <strong>and</strong> the noise estimate is multiplied by the<br />
size <strong>of</strong> the constant. As before, the application can specify the size, or else we use the default value<br />
size = φ(m) · (p/2) 2 .<br />
Multiplication. “Raw” multiplication is implemented by<br />
Ctxt& Ctxt::operator*=(const Ctxt& other);<br />
If needed, we modulus-switch down to the intersection <strong>of</strong> the prime-sets <strong>of</strong> both arguments, then<br />
compute the tensor product <strong>of</strong> the two, namely the collection <strong>of</strong> all pairwise products <strong>of</strong> parts from<br />
*this <strong>and</strong> other.<br />
The noise estimate <strong>of</strong> the result is the product <strong>of</strong> the noise estimates <strong>of</strong> the two arguments, times<br />
a factor which is computed as follows: Let r 1 be the highest power <strong>of</strong> s (i.e., the powerOfS value)<br />
in all the h<strong>and</strong>les in *this, <strong>and</strong> similarly let r 2 be the highest power <strong>of</strong> s in all the h<strong>and</strong>les other.<br />
The extra factor is then set as ( r 1 +r 2<br />
)<br />
r 1<br />
. Namely, noiseVar ′ = noiseVar · other.noiseVar · (r 1 +r 2<br />
)<br />
r 1<br />
.<br />
The reason for the ( r 1 +r 2<br />
)<br />
r 1<br />
factor is that the ciphertext part in the result, obtained by multiplying<br />
the two parts with the highest powerOfS value, will have powerOfS value <strong>of</strong> the sum, r = r 1 + r 2 .<br />
Recall from Section 3.1.4 that we estimate E[|s(τ m ) r | 2 ] ≈ r! · H r , where H is the Hamming weight<br />
<strong>of</strong> the coefficient-vector <strong>of</strong> s. Thus our noise estimate for the relevant part in *this is r 1 ! · H r 1<br />
<strong>and</strong><br />
the estimate for the part in other is r 2 ! · H r 2<br />
. To obtain the desired estimate <strong>of</strong> (r 1 + r 2 )! · H r 1+r 2<br />
,<br />
we need to multiply the product <strong>of</strong> the estimates by the extra factor (r 1+r 2 )!<br />
r 1 !·r 2 !<br />
= ( r 1 +r 2<br />
)<br />
r 1<br />
.<br />
1<br />
Higher-level multiplication. We also provide the higher-level methods<br />
void Ctxt::multiplyBy(const Ctxt& other);<br />
void Ctxt::multiplyBy(const Ctxt& other1, const Ctxt& other2);<br />
The first method multiplies two ciphertexts, it begins by removing primes from the two arguments<br />
down to a level where the rounding-error from modulus-switching is the dominating noise term (see<br />
findBaseSet below), then it calls the low-level routine to compute the tensor product, <strong>and</strong> finally<br />
it calls the reLinearize method to get back a canonical ciphertext.<br />
The second method that multiplies three ciphertexts also begins by removing primes from the<br />
two arguments down to a level where the rounding-error from modulus-switching is the dominating<br />
noise term. Based on the prime-sets <strong>of</strong> the three ciphertexts it chooses an order to multiply them<br />
(so that ciphertexts at higher levels are multiplied first). Then it calls the tensor-product routine<br />
to multiply the three arguments in order, <strong>and</strong> then re-linearizes the result.<br />
We also provide the two convenience methods square <strong>and</strong> cube that call the above two-argument<br />
<strong>and</strong> three-argument multiplication routines, respectively.<br />
1 Although products <strong>of</strong> other pairs <strong>of</strong> parts may need a smaller factor, the parts with highest powerOfS value<br />
represent the largest contribution to the overall noise, hence we use this largest factor for everything.<br />
22