Leveled homomorphic encryption schemes for homomorphic encryption standard

2.1 Notations

For a positive integer q , define Z q ≔ Z ∩ ( − q ⁄ 2 , q ⁄ 2 ] to be the ring of centered representatives modulo q . For an element v ∈ Z , we denote [ v ] q to be the modular reduction of v into the interval Z q such that q divides v − [ v ] q . When v is a vector or a polynomial, [ v ] q means reducing each entry or coefficient of v modulo q , respectively. Denote R n as the ring

where ϕ ( x ) is a polynomial of degree n and ( ϕ ( x ) ) is the ideal generated by ϕ ( x ) . Often, we will choose ϕ ( x ) to be a power of two cyclotomic polynomial. That is, a polynomial of the form ϕ ( x ) = x n + 1 , where n is a

power of two. For an integer q , we define R n , q as follows:

where ( ϕ ( x ) , q ) is the ideal generated by ϕ ( x ) and q . When v is a polynomial, [ v ] ϕ ( x ) denotes modular reduction of the polynomial into R n . Similarly, when v is a polynomial with integer coefficients, [ v ] ϕ ( x ) , q denotes modular reduction of the polynomial into R n , q , where all the coefficients are in ( − q ⁄ 2 , q ⁄ 2 ] .

For a vector or polynomial v , the infinity norm of v , denoted ‖ v ‖ ∞ , is the maximum entry or coefficient in absolute value of v . Equivalently, if v = ( a 0 , … , a n − 1 ) or v = ∑ i = 0 n − 1 a i x i , then

‖ ⋅ ‖ 2 denotes the standard 2-norm. The symbols ⌊ ⋅ ⌋ and ⌈ ⋅ ⌉ will denote floor and ceiling respectively, whereas ⌊ ⋅ ⌉ will denote rounding to the nearest integer, rounding down in the case of a tie. When applying ⌊ ⋅ ⌋ , ⌈ ⋅ ⌉ , or ⌊ ⋅ ⌉ to a polynomial or vector, we mean the rounding of each entry or coefficient. Define the expansion factor δ R of R n as follows:

where u v must be reduced modulo ϕ ( x ) before applying the norm. When ϕ ( x ) = x n + 1 , where n is a power of two, it is well known that δ R = n .

2.2 Noise distributions and learning with errors problems

For a set S , we denote χ ( S ) as an arbitrary probability distribution χ on S . We denote U as the uniform distribution. Let ρ > 0 be any integer. We denote χ ρ as any probability distribution on R n , where each coefficient is random in [ − ρ , ρ ] and independent. We call χ ρ an error distribution or noise distribution. We allow for flexibility in the exact choice of χ ρ , but most commonly, χ ρ is chosen as uniform random on [ − ρ , ρ ] , or a truncated discrete Gaussian to maintain security [24,25]. Over Z , the discrete Gaussian distribution D Z , α q assigns a probability proportional to exp ( − π x 2 ⁄ ( α q ) 2 ) for each x ∈ Z with standard deviation σ = α q ⁄ 2 π [2,24]. For the cyclotomic polynomial ϕ ( x ) = x n + 1 , an n -dimensional extension of D Z , α q to R n can be constructed by process of sampling each coefficient from D Z , α q . More details on the impact of the error distribution on security can be found in Section 5.

LWE problems. For any secret s ∈ Z q n , we sample e ← χ ( Z ) from some desired distribution χ such that ‖ e ‖ ∞ ≤ ρ , where ρ is a desired parameter, we sample a uniform random a ← U ( Z q n ) , and calculate b via b ≔ [ − ⟨ a , s ⟩ + e ] q . The ordered pair ( a , b ) ∈ Z q n × Z q is called an LWE sample. The search-LWE problem is to find s given many LWE samples. The decision-LWE problem is given many samples that are either LWE samples or sampled at uniform random from Z q n × Z q , decide, which distributions the samples are drawn from [2,24].

When drawing elements from distributions on R n and R n , q , we can similarly define the RLWE problems. For a secret s ∈ R n , q , sample a polynomial e ← χ ρ , sample a ← U ( R n , q ) , and compute b ∈ R n , q via b ≔ [ − a s + e ] ϕ ( x ) , q . The ordered pair ( a , b ) ∈ R n , q 2 is called an RLWE sample. The RLWE problems can be defined in an analogous way to the LWE problems. Throughout this paper, when given an RLWE sample or similarly structured ordered pair, we will commonly refer to the polynomial e as the noise term and ‖ e ‖ ∞ as the noise size.

Most leveled homomorphic encryption schemes use RLWE as opposed to LWE. The ciphertexts of homomorphic encryption schemes discussed will all essentially take the form of a modified RLWE sample. Regev originally showed the hardness of the LWE problem [2], which serves as foundation for the security of homomorphic encryption schemes. We discuss more specifics on security in Section 5.

We remark that, in our schemes, we use noise size ρ = n , and the noise distribution can be uniform on integers bounded by ρ or a discrete Gaussian distribution but truncated at ρ . When using a bounded uniform distribution, our choice of noise has standard deviation σ of about n ⁄ 3 . In comparison, most implementations in practice (including the homomorphic encryption standard) use a discrete Gaussian distribution with σ ≈ 3.2 [8,9,19,26]. Our larger noise bound increases the security, which will be discussed later.

2.3 Modulus reductions

Let Q and q be any positive integers. Given an RLWE sample ( a 0 , b 0 ) ∈ R n , Q 2 , where b 0 ≡ − a 0 s + e 0 mod ( ϕ ( x ) , Q ) , we can compute a new RLWE sample ( a 0 ′ , b 0 ′ ) ∈ R n , q 2 satisfying b 0 ′ ≡ − a 0 ′ s + e 0 ′ mod ( ϕ ( x ) , q ) for some new noise term e 0 ′ . Although this is a new RLWE sample with a new integer modulus q , the key observation is that the polynomial s remains the same. Furthermore, if given an initial bound on e 0 , we can guarantee a bound on e 0 ′ dependent on Q and q . Algorithm 1 gives the procedure for modulus reduction, while Lemma 2.1 shows correctness and the resulting bound on e 0 ′ . Although Q and q are any positive integers, we typically choose Q > q and refer to this procedure as a modulus reduction rather than a modulus switch as many other papers do. Note here that we use a subscript of 0 in our RLWE sample, as it will provide more consistency with our later applications of this algorithm to ciphertexts. For this reason, we also label ( a 0 , b 0 ) as ct 0 in Algorithm 1.

Algorithm 1. BFV modulus reduction

What will be more useful than a modulus reduction for a generic RLWE sample will be a modulus reduction for a “modified” RLWE sample that takes the form of a standard BFV ciphertext, hence the algorithm name BFV.Modreduce. By a BFV ciphertext, we mean that our input for Algorithm 1 ct 0 = ( a 0 , b 0 ) ∈ R n , Q 2 satisfies

for some noise term e 0 ∈ R n , where m 0 ∈ R n , t and D Q is a positive integer. This format is further clarified in Section 3.1. Classic BFV [6] uses D Q = ⌊ Q ⁄ t ⌋ . In this article, we will always assume t ∣ ( Q − 1 ) for any given ciphertext modulus Q , meaning that D Q = ( Q − 1 ) ⁄ t when using the same floor definition as in classic BFV. The resulting output ct 0 ′ = ( a 0 ′ , b 0 ′ ) ∈ R n , q 2 of Algorithm 1 satisfies b 0 ′ + a 0 ′ s ≡ D q m 0 + e 0 ′ mod ( ϕ ( x ) , q ) for some e 0 ′ , where D q = ( q − 1 ) ⁄ t when t ∣ ( q − 1 ) . Algorithm 1 and the proof of Lemma 2.2 have a similar style to the proof of Lemma 2.3 in [12].

The final reformulation essentially states that if Q ⁄ q meets a specific bound depending on E , modulus reduction always produces a new noise term e 0 ′ bounded by δ R ‖ s ‖ ∞ . A similar algorithm and lemma can also be constructed for a standard BGV ciphertext [4,5], which is an ordered pair ct 0 = ( a 0 , b 0 ) ∈ R n , Q 2 satisfying

for some noise term e 0 and given message m 0 ∈ R n , t , which is the message space for some integer t > 1 . The procedure for computing the new ciphertext differs from the previous two modulus reduction algorithms. In particular, we use the procedure outlined in Lemma 4.3.1 of [27], which is given here as Algorithm 2.

Algorithm 2. BGV modulus reduction

3.1 Modified BFV scheme

BFV key generation. The key generation process we use is slightly different from the standard BFV scheme [6] in that the public key and evaluation key are generated in a larger modulus [6,14,16,19], which will be useful for reducing the noise size in ciphertexts. Algorithm 3 gives the key generation for the BFV keys needed, which is the secret key sk, the public key pk, and the evaluation key ek. Here, sk is kept secret, while pk and ek are published. The public key pk = ( k 0 , k 1 ) ∈ R n , p 0 q 2 satisfies

for noise term e ← χ ρ . The evaluation key ek = ( k 0 ′ , k 1 ′ ) ∈ R n , p 1 q 2 satisfies

for noise term e 1 ′ ← χ ρ . We remark that in Algorithm 3 we choose s randomly rather than specifying the sampling distribution. This is intentional, as s may be desired to be chosen to satisfy certain properties in practice. For instance, s is often chosen randomly with a predetermined Hamming weight in practice.

Algorithm 3. BFV key generation.

BFV encryption and decryption. We encrypt a message m 0 ∈ R n , t using a modified version of the standard public key procedure for BFV. Note that we choose the plaintext modulus t so that t divides p 0 − 1 and q − 1 , and therefore divides p 0 q − 1 . We immediately reduce the ciphertext modulus from p 0 q to q before adding the message bits, then return the ciphertext. The purpose of this is to ensure the noise term on the returned ciphertext ct 0 ′ is within the constant bound of ρ . Given our description of the secret key selection, it is obvious that ‖ s ‖ ∞ = 1 . Most results we provide can be easily modified for the case of general ‖ s ‖ ∞ however, allowing for some flexibility in key generation if desired. The exact choices of p 0 and q will of course depend on several factors, such as the desired number of homomorphic computations. We will further discuss the choices of these in Section 4. Assuming these parameters, Algorithm 4 describes the encryption procedure for BFV. In many algorithms, we will refer to inputs as “BFV ciphertexts.” By this, we mean some ordered pair ct = ( a , b ) ∈ R n , q 2 satisfying

for some message m ∈ R n , t , some noise term e ∈ R n , ciphertext modulus q , and constant D q = ⌊ q ⁄ t ⌋ = ( q − 1 ) ⁄ t . This encryption style is the classic form of BFV encryption [6]. If ‖ e ‖ ∞ ≤ E , we will say ct = ( a , b ) is a BFV ciphertext with noise bounded by E .

Algorithm 4. Modified BFV encryption

Lemma 3.1 provides correctness and the corresponding noise bound resulting from encryption. The bounds in Lemma 3.1 are assuming that ‖ s ‖ ∞ = ‖ u ‖ ∞ = 1 . However, the bounds can be discussed in terms of more generic u and s , in which case the bound condition on p 0 is p 0 > 2 δ R 2 ( ‖ u ‖ ∞ + ‖ s ‖ ∞ ) + 2 δ R δ R ‖ s ‖ ∞ − 1 . In this case, the resulting noise term from encryption still satisfies ‖ e 0 ′ ‖ ∞ < ρ .

We argue that when δ R ≥ 16 , the condition on p 0 in Lemma 3.1 is satisfied when p 0 is chosen so that p 0 ≥ 5 δ R + 3 as per our parameter specifications, since

This technique of encryption with a built-in modulus reduction in Step 3 was first mentioned in [19], but is overall not especially well outlined in the literature. Implementations do often reduce the modulus immediately after encryption to reduce noise. For instance, Microsoft SEAL [28] chooses p 0 as a “special prime,” then generates all keys with an integer modulus of p 0 q (for q a product of some primes) before reducing down to integer modulus q to house any ciphertext data. SEAL documentation recommends choosing this special prime p 0 to be at least as big as any prime divisor of q , though it is not a strict requirement. In our modification, we propose computing the modulus reduction locally during encryption and doing so before adding the message bits. The advantage to this approach is we can choose p 0 to be much smaller.

Algorithm 5 provides for the decryption of a BFV ciphertext, which is the standard BFV decryption.

Algorithm 5. BFV decryption

BFV additions and linear combinations. We allow for linear combinations of ciphertexts with scalars from Z . Based on the sum of absolute values of these scalars, we can guarantee a bound on the resulting ciphertext noise. In particular, we discuss the case of linear combinations with scalars α 0 , … , α k − 1 ∈ Z such that ∑ i = 0 k − 1 ∣ α i ∣ ≤ M . Assuming each input ciphertext has noise bounded by E , a linear combination of k ciphertexts using these scalars results in noise bounded by M ( E + 1 ) . Algorithm 6 gives the algorithm for linear combinations, while Lemma 3.3 gives the resulting noise bound for BFV ciphertexts.

Algorithm 6. Linear combinations

We remark that we allow for inputs of Algorithm 6 to also be in R n , q 3 . For the input of Algorithm 6, when using elements of the form ( c 0 , c 1 , c 2 ) ∈ R n , q 3 satisfying

for some m ∈ R n , t and e ∈ R n , we still refer to e as a noise term (and refer to a bound on ‖ e ‖ ∞ as a noise bound). If each input has noise bounded by E , we can slightly adjust the proof of Lemma 3.3 to obtain an element in R n , q 3 with noise bounded by M ( E + 1 ) from the output of Algorithm 6. This alternate choice of inputs will be utilized when discussing budgeted operations in Section 4.1.

BFV multiplication. As expected, multiplication incurs much bigger increase in ciphertext noise and more tedious noise analysis. The procedure is again standard for the BFV scheme as in the study by Fan and Vercauteren [6]. The proof is similar to that presented in the study by Fan and Vercauteren [6], but we give a simpler worst-case noise bound with Lemma 3.4.

Algorithm 7. BFV multiplication

The simple bound provided in Lemma 3.4 will allow us to choose parameters easily and stack moduli as we will do in Section 4, while having minimal influence on functionality.

Comparison to current bounds. As mentioned earlier, we can see that our bound is on the order of E t δ R 2 when choosing ‖ s ‖ ∞ =1, where E is the bound on the noise term of each ciphertext before multiplication. Comparing to more current works, [16] achieves a similar multiplication noise bound. Rather than restricting choices of t and q , [16] achieves this bound by an alternative encryption method, namely, by computing b 0 + a 0 s ≡ ⌊ q m ⁄ t ⌉ + e mod ( ϕ ( x ) , q ) rather than standard BFV, which computes b 0 + a 0 s ≡ ⌊ q ⁄ t ⌋ m + e mod ( ϕ ( x ) , q ) . We provide a short comparison of multiplication noise bounds, with e ′ being the noise term resulting from multiplication. Most notably, we assume two ciphertext noise terms are both bounded by E rather than having separate input bounds. Note this comparison does not include relinearization noise. We discuss the additional relinearization noise accumulated for our modified BFV scheme in Lemma 3.5.

Classic BFV [6]:

Improved BFV [16]:

Our BFV variant:

In the study by Kim et al. [16], the dominant noise term is δ R t 2 ( δ R ‖ s ‖ ∞ ) 2 E = E t δ R 2 ‖ s ‖ ∞ . We note that, by going through their proof for the worst-case bound, the factor δ R ⁄ 2 in their bound should be δ R ‖ s ‖ ∞ , which is what we used in our proof. Hence, the dominant term should be 2 E t δ R 2 ‖ s ‖ ∞ . In comparison, our bound for all the noise terms is 3.5 E t δ R 2 ‖ s ‖ ∞ 2 , which is slightly bigger than their bound. Our goal was to provide a simple bound that is easier to use in practice. We will expand upon how we use this simple bound further in Section 4.

BFV relinearization. To convert a returned ciphertext from Algorithm 7 back to the proper form of a BFV ciphertext, we can employ a relinearization (or keyswitch) algorithm [6]. The algorithm converts a linear form in s and s 2 to a linear form in only s , while introducing a small additional noise term. Note that to accomplish this, we must use the published evaluation key, from Algorithm 3, denoted as ek. Algorithm 8 gives the relinearization algorithm for BFV. Lemma 3.5 provides for the resulting noise bound.

Algorithm 8. BFV Relinearization