Fully Homomorphic Encryption without Modulus Switching

This scheme proposed by Brakerski has a number of advantages over previous candidates such as BGV. In particular, it uses the same modulus throughout the evaluation process, so there's no need for modulus switching. Security of these scheme is baed on the hardness of the GapSVP problem.

Preliminaries

For an integer $q$, write $\mathbb {Z} _{q}:=\left(-q/2,q/2\right]\cap \mathbb {Z}$. This is not the same with the ring $\mathbb {Z} /q\mathbb {Z}$. For any $x\in \mathbb {Q}$, write $[x]_{p}$ for the unique value in $\left(-q/2,q/2\right]\cap \mathbb {Z}$ that is congruent to $x$ modulo $q$.

If $v,w$ are two $n$-dimensional vectors, then the tensor product $v\otimes w$ is the $n^{2}$ dimensional vector containing all elements of the form $v[i]w[j]$. Note that

$<v\otimes w,x\otimes y>=<v,x>\cdot <w,y>.$

Building Blocks of a homomorphic encryption scheme

We start by presenting Regev's basic public-key encryption scheme.

The Regev scheme

Let $q=q(n)$ be an integer function and let $\chi (n)$ be a distribution over $\mathbb {Z}$. The scheme 'Regev' is defined as follows:

• Regev.SecretKeygen( $1^{n}$ ): Sample $s\leftarrow \mathbb {Z} _{q}^{n}$ uniformly. Output $sk=s$.

• Regev.PublicKeygen($s$): Let $N:=(n+1)(\log q+O(1))$. Sample uniformly $A\leftarrow \mathbb {Z} _{q}^{N\times n}$ then sample $e\leftarrow \chi ^{N}$. Compute $b:=[A\cdot s+e]_{q}$. Here we apply $[\cdot ]_{q}$ to every entry in the $N$-dimensional vector $A\cdot s+e$ and define

$P:=[b\vert -A]\in \mathbb {Z} _{q}^{N\times (n+1)}$.

Output $pk=P$.

• Regev.Enc($pk,m$): To encrypt a message $m\in \{0,1\}$ using $pk=P$, sample $r\in \{0,1\}^{N}$ uniformly and output the ciphertext

$c:=\left[P^{T}\cdot r+\left\lfloor {\frac {q}{2}}\right\rfloor \cdot {\hat {m}}\right]_{q}\in \mathbb {Z} _{q}^{n+1},$

where ${\hat {m}}:=(m,0,\dots ,0)\in \{0,1\}^{n+1}$.

• Regev.Dec($sk,c$): To decrypt $c\in \mathbb {Z} _{q}^{n+1}$ using the secret key $sk=s$, compute

$m:=\left[\left\lfloor 2\cdot {\frac {[<c,(1,2)>]_{q}}{q}}\right\rceil \right]_{2}.$

In order to prove corectness, the author first shows (Lemma 3.1 in [1]) that if $q,n,N$ and $\chi$- $B$-bounded are parameters for the 'Regev' scheme described above and if $c$ is the fresh encryption of some message $m\in \{0,1\}$, then

$<c,(1,s)>=\left\lfloor {\frac {q}{2}}\right\rfloor \cdot m+e$

for some $e$ with $|e|\leq N\cdot B$.

Then, Lemma 3.2 in the same article asserts that if $s\in \mathbb {Z} ^{n}$ is some vector and $c\in \mathbb {Z} _{q}^{n+1}$ is such that

$<c,(1,s)>=\left\lfloor {\frac {q}{2}}\right\rfloor \cdot m+e$

with $m\in \{0,1\}$ and $|e|<\lfloor q/2\rfloor /2$, then

Regev.Dec($s,c$ )= $m$ .

Brakerski claims that the security of this scheme reduces to the hardness of (a decisional variant of) LWE problem by classical arguments (originally due to Regev [2]).

Vector decompositions

Recall from BGV the procedures

$BitDecomp_{q}(x):\mathbb {Z} ^{n}\to \{0,1\}^{n\cdot \lceil \log q\rceil }$

and

$PowersOfTwo_{q}(y):\mathbb {Z} ^{n}\to \mathbb {Z} _{q}^{n\cdot \lceil \log q\rceil }.$

When the modulus $q$ is clear from the context we will omit its writing.

We also recall the property

$<x,y>=<BitDecomp_{q}(x),PowersOfTwo_{q}(y)>{\pmod {q}}$.

Key switching

In the functions described below $q$ is an integer and $\chi$ is a distribution over $\mathbb {Z}$.

• Failed to parse (MathML with SVG or PNG fallback (recommended for modern browsers and accessibility tools): Invalid response ("Math extension cannot connect to Restbase.") from server "https://en.wikipedia.org/api/rest_v1/":): {\displaystyle SwitchKeyGen_{q, \ci}(s,t } ): For a 'source' key $s\in \mathbb {Z} ^{n_{s}}$ and target key $t\in \mathbb {Z} ^{n_{t}}$ this outputs matrix with $n_{s}\cdot \lceil \log q\rceil$ rows and $(n_{t}+1)$ columns, very similar to an encryption of $PowersOfTwo_{q}(s)$ under the secret key $t$. Let us call this matrix $P_{s:t}$.

• $SwithcKey_{q}(P_{s:t},c_{s})$: To switch a ciphertext from a secret key $s$ to $(1,t)$, output

$c_{t}:=[P_{s:t}^{T}\cdot BitDecomp_{q}(c_{s})]_{q}$.

Details on the correctness and security of this scheme are given at the end of Section 3 in [1].