FULLY HOMOMORPHIC ENCRYPTION: CURRENT STATE OF THE ...

Security of SWHE over Cyclotomic Rings
� The Ring Learning-with-Errors (RLWE) Problem
� Let B ¿ q. Choose s randomly from Rq. Given many
(linear) polynomials ai(y) = ai0+ai1·y 2 R[y] such that
ai(s) = ei (an Rq-element whose coefficients are smaller than B)
output s.
� How hard is the RLWE Problem?
� [LPR10]: As hard as solving the (q/B)-approximate
shortest vector problem (SVP) on ideal lattices in R.
� As q/B increases, RLWE becomes easier (unless n grows).
� For B ~ poly(k), best known attacks for require 2 k time when
n (the ring dimension) ~ k log(q/B).