Design and Implementation of a Homomorphic ... - Researcher

‖a‖ canon
2 .
The basic operations that we have in this scheme are the usual key-generation, encryption, and
decryption, the homomorphic evaluation routines for addition, multiplication and automorphism
(and also addition-of-constant and multiplication-by-constant), and the “ciphertext maintenance”
operations of key-switching and modulus-switching. These are described in the rest of this report,
but first we describe our plaintext encoding conventions and our Double-CRT representation of
polynomials.
1.1 Plaintext Slots
The native plaintext space of our variant of BGV are elements of A 2 , and the polynomial Φ m (X)
factors modulo 2 into l irreducible factors, Φ m (X) = F 1 (X)·F 2 (X) · · · F l (X) (mod 2), all of degree
d = φ(m)/l. Just as in [2, 4, 10] each factor corresponds to a “plaintext slot”. That is, we can
view a polynomial a ∈ A 2 as representing an l-vector (a mod F i ) l i=1 .
More specifically, for the purpose of packing we think of a polynomial a ∈ A 2 not as a binary
polynomial but as a polynomial over the extension field F 2 d (with some specific representation),
and the plaintext values that are encoded in a are its evaluations at l specific primitive m-th roots
of unity in F 2d . In other words, if ρ ∈ F 2 d is a particular fixed primitive m-th root of unity, and our
distinguished evaluation points are ρ t 1
, ρ t 2
, . . . , ρ t l
(for some set of indexes T = {t 1 , . . . , t l }), then
the vector of plaintext values encoded in a is:
(
a(ρ
t j
) : t j ∈ T ) .
See Section 2.4 for a discussion of the choice of representation of F 2 d and the evaluation points.
It is standard fact that the Galois group Gal = Gal(Q(ρ m )/Q) consists of the mappings κ k :
a(X) ↦→ a(X k ) mod Φ m (X) for all k co-prime with m, and that it is isomorphic to Z ∗ m. As noted
in [4], for each i, j ∈ {1, 2, . . . , l} there is an element κ k ∈ Gal which sends an element in slot i to
an element in slot j. Indeed if we set k = t −1
j
· t i (mod m) and b = κ k (a) then we have
b(ρ t j
) = a(ρ t jk ) = a(ρ t j·t −1
j t i
) = a(ρ t i
),
so the element in the j’th slot of b is the same as that in the i’th slot of a. In addition to these “datamovement
maps”, Gal contains also the Frobenius maps, X −→ X 2i , which also act as Frobenius
on the individual slots separately.
We note that the values that are encoded in the slots do not have to be individual bits, in
general they can be elements of the extension field F 2 d (or any sub-field of it). For example, for the
AES application we may want to pack elements of F 2 8 in the slots, so we choose the parameters so
that F 2 8 is a sub-field of F 2 d (which means that d is divisible by 8).
1.2 Our Modulus Chain and Double-CRT Representation
We define the chain of moduli by choosing L + 1 “small primes” p 0 , p 1 , . . . , p L and the l’th modulus
in our chain is defined as q l = ∏ l
j=0 p j. The primes p i ’s are chosen so that for all i, Z/p i Z
contains a primitive m-th root of unity (call it ζ i ) so Φ m (X) factors modulo p i to linear terms
Φ m (X) = ∏ j∈Z ∗ (X − ζj m i ) (mod p i).
A key feature of our implementation is that we represent an element a ∈ A ql via double-CRT
representation, with respect to both the integer factors of q l and the polynomial factor of Φ m (X)
2