Efficient Fully Homomorphic Encryption from (Standard) LWE

TL;DR: In this article, a fully homomorphic encryption scheme based solely on the (standard) learning with errors (LWE) assumption is presented. But the security of their scheme is based on the worst-case hardness of ''short vector problems'' on arbitrary lattices.

Abstract: We present a fully homomorphic encryption scheme that is based solely on the(standard) learning with errors (LWE) assumption. Applying known results on LWE, the security of our scheme is based on the worst-case hardness of ``short vector problems'' on arbitrary lattices. Our construction improves on previous works in two aspects:\begin{enumerate}\item We show that ``somewhat homomorphic'' encryption can be based on LWE, using a new {\em re-linearization} technique. In contrast, all previous schemes relied on complexity assumptions related to ideals in various rings. \item We deviate from the "squashing paradigm'' used in all previous works. We introduce a new {\em dimension-modulus reduction} technique, which shortens the cipher texts and reduces the decryption complexity of our scheme, {\em without introducing additional assumptions}. \end{enumerate}Our scheme has very short cipher texts and we therefore use it to construct an asymptotically efficient LWE-based single-server private information retrieval (PIR) protocol. The communication complexity of our protocol (in the public-key model) is $k \cdot \polylog(k)+\log \dbs$ bits per single-bit query (here, $k$ is a security parameter).

Summary

1 Introduction

• Fully-homomorphic encryption is one of the holy grails of modern cryptography.
• His solution involved new and relatively untested cryptographic assumptions.
• Ideal lattices are a special breed that the authors know relatively little about.
• Thus, in a nutshell, the authors construct a fully homomorphic encryption scheme whose security is based solely on the classical hardness of solving standard lattice problems in the worst-case.
• See Section 3. 2. We present a dimension-modulus reduction technique, that turns their somewhat homomorphic scheme into a fully homomorphic one, without the need for the seemingly artificial squashing step and the sparse subset-sum assumption.the authors.the authors.

1.1 Re-Linearization: Somewhat Homomorphic Encryption without Ideals

• The starting point of Gentry’s construction is a “somewhat” homomorphic encryption scheme.
• The LWE assumption does not refer to ideals, and indeed, the LWE problem is at least as hard as finding short vectors in any lattice, as follows from the worst-case to average-case reductions of Regev [Reg05] and Peikert [Pei09].the authors.the authors.
• The authors construction of a fully homomorphic encryption scheme from LWE is perhaps a very strong testament to its power and elegance.the authors.the authors.
• The main idea is the following: imagine that the authors publish “encryptions” of all the linear and quadratic terms in the secret key s, namely all the numbers s[i] as well as s[i]s[j], under a new secret key t.
• The authors feel that thinking of these as encryptions may benefit the reader’s intuition.

1.2 Dimension-Modulus Reduction: Fully Homomorphic Encryption Without Squashing

• As explained above, the “bootstrapping” method for achieving full homomorphism requires a Chomomorphic scheme whose decryption circuit resides in C.
• The authors show how to “upgrade” their somewhat homomorphic scheme (explained in Section 1.1) into a scheme that enjoys the same amount of homomorphism but has a much smaller decryption circuit.
• Having the above observation in mind, the authors wonder if they can take t to have not only low dimension but also small modulus p, thus completing the transition from (n, log q) to (k, log p).
• The rounding incurs an additional error of magnitude at most 1/2.
• Specifically, dimension-modulus reduction is used for the scheme in Section 4.2.

1.3 Near-Optimal Private Information Retrieval

• In (single-server) private information retrieval (PIR) protocols, a very large database is maintained by a sender (the sender is also sometimes called the server, or the database).
• 13For the informed reader the authors mention that while k, p are smaller than n, q and therefore seem to imply lesser security, they are able to use much higher relative noise in their k, p scheme since it needs not support homomorphism.
• Fully homomorphic, or even somewhat homomorphic, encryption is known to imply polylogarithmic PIR protocols.
• Most trivially, the receiver can encrypt the index it wants to query, and the database will use that to homomorphically evaluate the database access function, thus retrieving an encryption of the answer and sending it to the receiver.
• The authors stress that even if the size of the public key does count towards the communication complexity, their protocol still has polylogarithmic communication.

1.4 Other Related Work

• Aside from Gentry’s scheme (and a variant thereof by Smart and Vercauteren [SV10] and an optimization by Stehle and Steinfeld [SS10]), there are two other fully homomorphic encryption schemes [DGHV10, BV11a].
• They cannot, however, reduce their assumption to worst-case hardness.
• Smart and Vercauteren [SV10], as well as Gentry and Halevi [GH11b] conduct a study on reducing the complexity of implementing the scheme.
• The authors now describe some followup work that appeared since the publication of the conference version of this paper [BV11b].
• First, the work of Brakerski, Gentry and Vaikuntanathan [BGV12] presented a considerable refinement and simplification of their modulus reduction technique, and used it to construct a leveled fully homomorphic encryption scheme without bootstrapping.

1.5 Paper Organization

• Some preliminaries and notation are described in Section 2.
• The authors formally define somewhat and fully homomorphic encryption and present the bootstrapping theorem in Section 3.
• The main technical section of this paper is Section 4, where their scheme is presented and fully analyzed.
• Lastly, their private information retrieval protocol is presented in Section 5.

2 Preliminaries

• The authors utilize “noise” distributions over integers.
• The only property of these distributions the authors use is their magnitude.
• The authors use the convention that v[0] , 1. The authors use the following variant of the leftover hash lemma [ILL89].
• There are known quantum [Reg05] and classical [Pei09] reductions between DLWEn,m,q,χ and approximating short vector problems in lattices.
• Then there exists an efficiently sampleable B-bounded distribution χ such that if there is an efficient algorithm that solves the (average-case) DLWEn,q,χ problem.

2.2 Symmetric Encryption

• A symmetric encryption scheme SYM = (SYM. Keygen(1κ) takes a unary representation of the security parameter and outputs symmetric encryption/decryption key sk.
• Encsk(µ) takes the symmetric key sk and a message µ ∈Mκ and outputs a ciphertext c. Decryption.
• Enc and the coins of the adversary A. Namely, no adversary can distinguish between an oracle that encrypts messages of its choice and an oracle that only returns encryptions of 0 (where 0 is some arbitrary element in the message space).

3 Homomorphic Encryption: Definitions and Tools

• In this section the authors discuss the definition of homomorphic encryption and its properties as well as some related subjects.
• The authors start by defining homomorphic and fully homomorphic encryption in Section 3.1.
• Then, in Section 3.2 the authors discuss Gentry’s bootstrapping theorem.
• The authors note that there are a number of ways to define homomorphic encryption and to describe the bootstrapping theorem.
• The authors chose the definitions that best fit the constructions and they urge even the knowledgeable reader to go over them so as to avoid confusion in interpreting their results.

3.1 Homomorphic Encryption – Definitions

• The authors now define homomorphic encryption and its desired properties.
• The only security notion the authors consider in this chapter is semantic security, namely security w.r.t. passive adversaries.
• Note that a C-homomorphic scheme is not necessarily compact.

3.2 Gentry’s Bootstrapping Technique

• Gen09a] which implies that a bootstrappable scheme can be converted into a fully homomorphic one.the authors.
• Then there is a fully homomorphic encryption scheme as per Definition 3.5.
• Eval (regardless of the length of the ciphertext produced by HE.

4 The New Fully Homomorphic Encryption Scheme

• The authors present their fully homomorphic encryption scheme and analyze its security and performance.
• In Section 4.4 the authors analyze the homomorphic properties of SH and BTS which enables us to prove (in Section 4.5) that the bootstrapping theorem is indeed applicable to BTS, and obtain a fully homomorphic scheme based on LWE.
• During the homomorphic evaluation, the authors will generate ciphertexts of the form c = ((v, w), `), where the tag ` indicates the multiplicative level at which the ciphertext has been generated (hence fresh ciphertexts are tagged with 0).

4.3 Security Analysis

• The authors analyze the security of BTS based on LWE and then, using known connections, based on worst case hardness of lattice problems.the authors.
• The scheme BTS is CPA secure under the DLWEn,q,χ and the DLWEk,p,χ̂ assumptions.
• Essentially, this is the class of arithmetic circuits over GF(2) with bounded fan-in and bounded depth, with an additional final “collation”: a high fan-in addition gate at the last level.
• The authors assume that all samples from χ̂ are indeed of magnitude at most B̂.

4.5 Bootstrapping and Full Homomorphism

• The authors now show how to apply Gentry’s bootstrapping theorem (Theorems 3.1, 3.2) to achieve full homomorphism.
• Lemma 4.5 guarantees that the decryption circuit is in Arith[O(log k), 1] (note that log log p = o(log k)), since the augmented decryption circuit just adds 1 to the depth, it follows that the augmented decryption circuits are also in Arith[O(log k), 1].
• Finally, the authors conclude that there exists an LWE based fully homomorphic encryption based on Theorem 4.1 and Lemma 4.6.the authors.
• The decryption algorithm is essentially the same as Regev’s.
• This will enable generating short ciphertexts that will be “bootstrapped up” during the homomorphic evaluation.

5 LWE-Based Private Information Retrieval

• The authors present a single-server private information retrieval (PIR) protocol with nearly optimal communication complexity.
• Then, in Section 5.2, the authors show a generic construction of PIR from somewhat homomorphic encryption.
• Finally, in Section 5.3, the authors instantiate the generic construction using their own scheme from Section 4 and analyze its parameters.

5.1 Definitions of Single Server PIR

• The authors define single server private information retrieval in the public-key setting.
• The response resp is then sent back to the receiver.
• The authors note that the definition of privacy above differs from the one usually found in literature.
• Thus the protocol needs to be exponentially secure in the security parameter.

5.2 PIR via Somewhat Homomorphic and Symmetric Encryption

• In this section the authors describe a generic PIR protocol that uses a somewhat homomorphic encryption and an arbitrary symmetric encryption as building blocks.
• The authors PIR protocol relies on two building blocks – a semantically secure symmetric encryption scheme SYM = (SYM.
• The authors recall that in Section 4, they get a leveled fully homomorphic scheme without relying on any circular security assumptions, this means that it can be used together with any symmetric scheme.
• In H2, the view of the adversary is independent of the queried indices.

5.3 Instantiating the Components: The PIR Protocol

• The authors show how to implement the primitives required in Section 5.2 in two different ways.
• Then there exists a DLWEk,p,χ̂-secure symmetric encryption scheme whose ciphertext length is O(k log k + `) for `-bit messages, and whose decryption circuit has the same depth as that of BTS.
• There exists a PIR protocol with communication complexity O(k log k+logN) based on the DLWEn,q,χ and DLWEk,p,χ̂ assumptions, for n = poly(k) and the remainder of the parameters as in Theorem 4.2.
• The authors also thank Microsoft Research for hosting the first author during the course of this work.

Full text

Efficient Fully Homomorphic Encryption from (Standard) LWE
∗
Zvika Brakerski
†
Vinod Vaikuntanathan
‡
Abstract
We present a fully homomorphic encryption scheme that is based solely on the (standard)
learning with errors (LWE) assumption. Applying known results on LWE, the security of our
scheme is based on the worst-case hardness of “short vector problems” on arbitrary lattices.
Our construction improves on previous works in two aspects:
1. We show that “somewhat homomorphic” encryption can be based on LWE, using a new re-
linearization technique. In contrast, all previous schemes relied on complexity assumptions
related to ideals in various rings.
2. We deviate from the “squashing paradigm” used in all previous works. We introduce a
new dimension-modulus reduction technique, which shortens the ciphertexts and reduces
the decryption complexity of our scheme, without introducing additional assumptions.
Our scheme has very short ciphertexts and we therefore use it to construct an asymptotically
efficient LWE-based single-server private information retrieval (PIR) protocol. The communi-
cation complexity of our protocol (in the public-key model) is k · polylog(k) + log |DB| bits per
single-bit query (here, k is a security parameter).
∗
A preliminary version appeared in Proceedings of the 52
nd
IEEE Foundations of Computer Science, 2011.
†
Weizmann Institute of Science. Email: zvika.brakerski@weizmann.ac.il. The author’s research was supported
by ISF grant 710267, BSF grant 710613, and NSF contracts CCF-1018064 and CCF-0729011.
‡
University of Toronto. Email: vinodv@cs.toronto.edu. Part of this work was done while the author was
at Microsoft Research, Redmond. This work was also partially supported by an NSERC Discovery Grant, and by
DARPA under Agreement number FA8750-11-2-0225. The U.S. Government is authorized to reproduce and distribute
reprints for Governmental purposes notwithstanding any copyright notation thereon. The views and conclusions
contained herein are those of the author and should not be interpreted as necessarily representing the official policies
or endorsements, either expressed or implied, of DARPA or the U.S. Government.

1 Introduction
Fully-homomorphic encryption is one of the holy grails of modern cryptography. In a nutshell, a
fully homomorphic encryption scheme is an encryption scheme that allows evaluation of arbitrar-
ily complex programs on encrypted data. The problem was suggested by Rivest, Adleman and
Dertouzos [RAD78] back in 1978, yet the first plausible candidate came thirty years later with
Gentry’s breakthrough work in 2009 [Gen09b, Gen10] (although, there has been partial progress in
the meanwhile [GM82, Pai99, BGN05, IP07]).
Gentry’s breakthrough work demonstrated the first construction of fully homomorphic encryp-
tion in 2009. However, his solution involved new and relatively untested cryptographic assumptions.
Our work aims to put fully homomorphic encryption on firm grounds by basing it on the hardness
of standard, well-studied mathematical problems.
The main building block in Gentry’s construction (a so-called “somewhat” homomorphic en-
cryption scheme) was based on the (worst-case, quantum) hardness of problems on ideal lattices.
1
Although lattices have become standard fare in cryptography and lattice problems have been rela-
tively well-studied, ideal lattices are a special breed that we know relatively little about. Ideals are
a natural mathematical object to use to build fully homomorphic encryption in that they natively
support both addition and multiplication (whereas lattices are closed under addition only). Indeed,
all subsequent constructions of fully homomorphic encryption [SV10, DGHV10, BV11a] relied on
ideals in various rings in an explicit way. Our first contribution is the construction of a “somewhat”
homomorphic encryption scheme whose security relies solely on the (worst-case, classical) hardness
of standard problems on arbitrary (not necessarily ideal) lattices.
Secondly, in order to achieve full homomorphism, Gentry had to go through a so-called “squash-
ing step” which forced him to make an additional, strong hardness assumption – namely, the hard-
ness of the (average-case) sparse subset-sum problem. As if by a strange law of nature, all the
subsequent solutions encountered the same difficulty as Gentry did in going from a “somewhat”
to a fully homomorphic encryption, and they all countered this difficulty by relying on the same
sparse subset-sum assumption. This additional assumption was considered to be the main caveat
of Gentry’s solution and removing it has perhaps been the main open problem in the design of
fully homomorphic encryption schemes. Our second contribution is to remove the necessity of this
additional assumption.
Thus, in a nutshell, we construct a fully homomorphic encryption scheme whose security is based
solely on the classical hardness of solving standard lattice problems in the worst-case.
2
Specifically,
out scheme is based on the learning with errors (LWE) assumption that is known to be at least as
difficult as solving hard problems in general lattices. Thus our solution does not rely on lattices
directly and is fairly natural to understand and implement.
To achieve our goals, we deviate from two paradigms that ruled the design of (a handful of)
candidate fully homomorphic encryption schemes [Gen09b, SV10, DGHV10, BV11a]:
1. We introduce the re-linearization technique, and show how to use it to obtain a somewhat
homomorphic encryption that does not require hardness assumptions on ideals.
1
Roughly speaking, ideal lattices correspond to a geometric embedding of an ideal in a number field. See [LPR10]
for a precise definition.
2
Strictly speaking, under this assumption, our scheme can evaluate polynomial-size circuits with a-priori bounded
(but arbitrary) depth. A fully homomorphic encryption scheme independent of the circuit depth can be obtained by
making an additional “circular security” assumption. See Section 3.
1

2. We present a dimension-modulus reduction technique, that turns our somewhat homomorphic
scheme into a fully homomorphic one, without the need for the seemingly artificial squashing
step and the sparse subset-sum assumption.
We provide a detailed overview of these new techniques in Sections 1.1 and 1.2 below.
Interestingly, the ciphertexts of the resulting fully homomorphic scheme are very short. This is
a desirable property which we use, in conjunction with other techniques, to achieve very efficient
private information retrieval protocols. See also Section 1.3 below.
1.1 Re-Linearization: Somewhat Homomorphic Encryption without Ideals
The starting point of Gentry’s construction is a “somewhat” homomorphic encryption scheme. For
a class of circuits C, a C-homomorphic scheme is one that allows evaluation of any circuit in the
class C. The simple, yet striking, observation in Gentry’s work is that if a (slightly augmented)
decryption circuit for a C-homomorphic scheme resides in C, then the scheme can be converted (or
“bootstrapped”) into a fully homomorphic encryption scheme.
It turns out that encryption schemes that can evaluate a non-trivial number of addition and
multiplication operations
3
are already quite hard to come by (even without requiring that they are
bootstrappable).
4
Gentry’s solution to this was based on the algebraic notion of ideals in rings.
In a very high level, the message is considered to be a ring element, and the ciphertext is the
message masked with some “noise”. The novelty of this idea is that the noise itself belonged to
an ideal I. Thus, the ciphertext is of the form m + xI (for some x in the ring). Observe right
off the bat that the scheme is born additively homomorphic; in fact, that will be the case with
all the schemes we consider in this paper. The ideal I has two main properties: first, a random
element in the ideal is assumed to “mask” the message; and second, it is possible to generate a
secret trapdoor that “annihilates” the ideal, i.e., implementing the transformation m + xI → m.
The first property guarantees security, while the second enables decrypting ciphertexts. Letting c
1
and c
2
be encryptions of m
1
and m
2
respectively,
c
1
c
2
= (m
1
+ xI)(m
2
+ yI) = m
1
m
2
+ (m
1
y + m
2
x + xyI)I = m
1
m
2
+ zI
When decrypting, the ideal is annihilated and the product m
1
m
2
survives. Thus, c
1
c
2
is indeed an
encryption of m
1
m
2
, as required. This nifty solution required, as per the first property, a hardness
assumption on ideals in certain rings. Gentry’s original work relied on hardness assumptions on
ideal lattices, while van Dijk, Gentry, Halevi and Vaikuntanathan [DGHV10] presented a different
instantiation that considered ideals over the integers.
Our somewhat homomorphic scheme is based on the hardness of the “learning with errors”
(LWE) problem, first presented by Regev [Reg05]. The LWE assumption states that if s ∈ Z
n
q
is an
n dimensional “secret” vector, any polynomial number of “noisy” random linear combinations of
3
All known scheme, including ours, treat evaluated functions as arithmetic circuits. Hence we use the terminology
of “addition and multiplication” gates. The conversion to the Boolean model (AND, OR, NOT gates) is immediate.
4
We must mention here that we are interested only in compact fully homomorphic encryption schemes, namely ones
where the ciphertexts do not grow in size with each homomorphic operation. We will also look at mildly non-compact
homomorphic encryption schemes where the ciphertexts grow as a sub-linear function of the size of the evaluated
circuit. If we do allow the ciphertexts to grow linearly with the size of the evaluated circuit, a number of solutions
are possible. See, e.g., [SYY99, GHV10a, MGH10].
2

the coefficients of s are computationally indistinguishable from uniformly random elements in Z
q
.
Mathematically,

a
i
, ha
i
, si + e
i

poly(n)
i=1
c
≈

a
i
, u
i

poly(n)
i=1
,
where a
i
∈ Z
n
q
and u
i
∈ Z
q
are uniformly random, and the “noise” e
i
is sampled from a noise distri-
bution that outputs numbers much smaller than q (an example is a discrete Gaussian distribution
over Z
q
with small standard deviation).
The LWE assumption does not refer to ideals, and indeed, the LWE problem is at least as hard
as finding short vectors in any lattice, as follows from the worst-case to average-case reductions of
Regev [Reg05] and Peikert [Pei09]. As mentioned earlier, we have a much better understanding of
the complexity of lattice problems (thanks to [LLL82, Ajt98, Mic00] and many others), compared
to the corresponding problems on ideal lattices. In particular, despite considerable effort, the best
known algorithms to solve the LWE problem run in time nearly exponential in the dimension n.
5
The
LWE assumption also turns out to be particularly amenable to the construction of simple, efficient
and highly expressive cryptographic schemes (e.g., [Reg05, GPV08, AGV09, ACPS09, CHKP10,
ABB10] and many others). Our construction of a fully homomorphic encryption scheme from LWE
is perhaps a very strong testament to its power and elegance.
Constructing a (secret-key) encryption scheme whose security is based on the LWE assumption
is rather straightforward. To encrypt a bit m ∈ {0, 1} using secret key s ∈ Z
n
q
, we choose a random
vector a ∈ Z
n
q
and a “noise” e and output the ciphertext
c = (a, b = ha, si + 2e + m) ∈ Z
n
q
× Z
q
The key observation in decryption is that the two “masks” – namely, the secret mask ha, si and
the “even mask” 2e – do not interfere with each other.
6
That is, one can decrypt this ciphertext
by annihilating the two masks, one after the other: The decryption algorithm first re-computes
the mask ha, si and subtracts it from b, resulting in 2e + m (mod q).
7
If we choose e to be small
enough, then 2e + m (mod q) = 2e + m. Removing the even mask is now easy – simply compute
2e + m modulo 2.
8
As we will see below, the scheme is naturally additive homomorphic, yet multiplication presents
a thorny problem. In fact, a recent work of Gentry, Halevi and Vaikuntanathan [GHV10b] showed
that (a slight variant of) this scheme supports just a single homomorphic multiplication, but at the
expense of a huge blowup to the ciphertext which made further advance impossible.
To better understand the homomorphic properties of this scheme, let us shift our focus away
from the encryption algorithm, on to the decryption algorithm. Given a ciphertext (a, b), consider
the symbolic linear function f
a,b
: Z
n
q
→ Z
q
defined as:
f
a,b
(x) = b − ha, xi (mod q) = b −
n
X
i=1
a[i] · x[i] ∈ Z
q
5
The nearly exponential time is for a large enough error (i.e., one that is a 1/poly(n) fraction of the modulus q).
For smaller errors, as we will encounter in our scheme, there are better – but not significantly better – algorithms.
In particular, if the error is a 1/2
n

fraction of the modulus q, the best known algorithm runs in time approx. 2
n
1−
.
6
We remark that using 2e instead of e as in the original formulation of LWE does not adversely impact security,
so long as q is odd (since in that case 2 is a unit in Z
q
).
7
Throughout this paper, we use x (mod q) to denote the unique residue of x in the interval [−q/2, q/2).
8
Although our simplified presentation of Gentry’s scheme above seems to deal with just one mask (the “secret
mask”), in reality, the additional “even mask” existed in the schemes of [Gen09b, DGHV10] as well. Roughly speaking,
they needed this to ensure semantic security, as we do.
3

where x = (x[1], . . . , x[n]) denotes the variables, and the ciphertext (a, b) defines the public coeffi-
cients of the linear equation. Clearly, decryption of the ciphertext (a, b) is nothing but evaluating
this function on the secret key s (and then taking the result modulo 2).
9
Homomorphic addition and multiplication can now be described in terms of this function f.
Adding two ciphertexts corresponds to the addition of two linear functions, which is again another
linear function. In particular, f
(a+a
0
,b+b
0
)
(x) = f
a,b
(x)+ f
(a
0
,b
0
)
(x) is the linear function correspond-
ing to the “homomorphically added” ciphertext (a + a
0
, b + b
0
). Similarly, multiplying two such
ciphertexts corresponds to a symbolic multiplication of these linear equations
f
(a,b)
(x) · f
(a
0
,b)
(x) = (b −
X
a[i]x[i]) · (b
0
−
X
a
0
[i]x[i])
= h
0
+
X
h
i
· x[i] +
X
h
i,j
· x[i]x[j] ,
which results in a degree-2 polynomial in the variables x = (x[1], . . . , x[n]), with coefficients h
i,j
that can be computed from (a, b) and (a
0
, b
0
) by opening parenthesis of the expression above.
Decryption, as before, involves evaluating this quadratic expression on the secret key s (and then
reducing modulo 2). We now run into a serious problem – the decryption algorithm has to know
all the coefficients of this quadratic polynomial, which means that the size of the ciphertext just
went up from n + 1 elements to (roughly) n
2
/2.
This is where our re-linearization technique comes into play. Re-linearization is a way to reduce
the size of the ciphertext back down to n + 1. The main idea is the following: imagine that we
publish “encryptions” of all the linear and quadratic terms in the secret key s, namely all the
numbers s[i] as well as s[i]s[j], under a new secret key t. Thus, these ciphertexts (for the quadratic
terms) look like (a
i,j
, b
i,j
) where
b
i,j
= ha
i,j
, ti + 2e
i,j
+ s[i] · s[j] ≈ ha
i,j
, ti + s[i] · s[j] .
10
where the expression x ≈ y means that the absolute difference between x and y is small.
Now, the sum h
0
+
P
h
i
· s[i] +
P
h
i,j
· s[i]s[j] can be written (approximately) as
h
0
+
X
h
i
(b
i
− ha
i
, ti) +
X
i,j
h
i,j
· (b
i,j
− ha
i,j
, ti) ,
which, lo and behold, is a linear function in t! The bottom-line is that multiplying the two linear
functions f
(a,b)
and f
(a
0
,b
0
)
and then re-linearizing the resulting expression results in a linear function
(with n + 1 coefficients), whose evaluation on the new secret key t results in the product of the two
original messages (upon reducing modulo 2). The resulting ciphertext is simply the coefficients of
this linear function, of which there are at most n + 1. This ciphertext will decrypt to m · m
0
using
the secret key t.
In this semi-formal description, we ignored an important detail which has to do with the fact
that the coefficients h
i,j
are potentially large. Thus, even though (b
i,j
− ha
i,j
, ti) ≈ s[i]s[j], it may
be the case that h
i,j
· (b
i,j
− ha
i,j
, ti) 6≈ h
i,j
· s[i]s[j]. This is handled by considering the binary
9
The observation that an LWE-based ciphertext can be interpreted as a linear equation of the secret was also used
in [BV11a].
10
Actually, calling these “encryptions” is inaccurate: s[i] · s[j] ∈ Z
q
is not a single bit and therefore the “ciphertext”
cannot be decrypted. However, we feel that thinking of these as encryptions may benefit the reader’s intuition.
4

Frequently asked questions

Q1. What are the contributions mentioned in the paper "Efficient fully homomorphic encryption from (standard) lwe∗" ?

The authors present a fully homomorphic encryption scheme that is based solely on the ( standard ) learning with errors ( LWE ) assumption. Their construction improves on previous works in two aspects: 1. the authors show that “ somewhat homomorphic ” encryption can be based on LWE, using a new relinearization technique. The authors introduce a new dimension-modulus reduction technique, which shortens the ciphertexts and reduces the decryption complexity of their scheme, without introducing additional assumptions. The author ’ s research was supported by ISF grant 710267, BSF grant 710613, and NSF contracts CCF-1018064 and CCF-0729011. Part of this work was done while the author was at Microsoft Research, Redmond. This work was also partially supported by an NSERC Discovery Grant, and by DARPA under Agreement number FA8750-11-2-0225. The U. S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon. The views and conclusions contained herein are those of the author and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of DARPA or the U. S. Government. 

Q2. What is the main reason for the creation of a fully homomorphic encryption scheme?

Ideals are a natural mathematical object to use to build fully homomorphic encryption in that they natively support both addition and multiplication (whereas lattices are closed under addition only). 

Q3. What is the level of homomorphism required for the protocol?

The level of somewhat homomorphism required for the protocol depends on the symmetric scheme being used (in particular, the decryption complexity of the symmetric scheme). 

Q4. How can the authors use the GGM transformation to base security on LWE?

If the authors want to base security solely on LWE, the authors can use the LWE-based PRF that is obtained by applying the GGM transformation [GGM86] to an LWE based pseudorandom generator. 

Q5. What is the simplest way to take modulo p?

In order to take modulo p, one needs to subtract, in parallel, all possible multiples of p (there are at most O(k log p) options) and check if the result is in Zp. 

Q6. How many parameters are needed to compare different PIR protocols?

As for the sender’s response, their dimension-modulus reduction technique guarantees very short ciphertexts (essentially as short14It is hard to compare the performance of different PIR protocols due to the multitude of parameters. 

Q7. What is the definition of a leveled homomorphic scheme?

the leveled homomorphic scheme is such that only the length of the evaluation key depends on the level L. All other parameters of the scheme are distributed identically regardless of the value of L. 

Q8. What is the definition of the learning with errors problem?

For an integer q = q(n) and an error distribution χ = χ(n) over Zq, the learning with errors problem LWEn,m,q,χ is defined as follows: Given m independent samples from As,χ (for some s ∈ Znq ), output s with noticeable probability. 

Q9. What is the value of treating the evaluation key as a separate entity?

The authors note that while one can treat the evaluation key as a part of the public key, as has been done in the literature so far, the authors feel that there is an expository value to treating it as a separate entity and to distinguishing between the public elements that are used for encryption and those that are used only for homomorphic evaluation. 

Q10. How can one reduce the overhead of a ciphertext?

The authors remark that in terms of retrieving large blocks of consecutive data, one can slightly reduce the overhead to O(logN) bits of communication for every bit of retrieved data. 

Q11. What is the ciphertext that is used to evaluate a gate?

The authors show how to multiply ciphertexts c, c′ where c = ((v, w), `) and c′ = ((v′, w′), `) (recall that multiplication gates have fan-in 2), to obtain an output ciphertext cmult = ((vmult, wmult), `+ 1). 

Q12. What is the ciphertext that is used to evaluate a gate?

The authors show how to multiply ciphertexts c, c′ where c = ((v, w), `) and c′ = ((v′, w′), `) (recall that multiplication gates have fan-in 2), to obtain an output ciphertext cmult = ((vmult, wmult), `+ 1). 

Q13. What is the class of arithmetic circuits over GF(2)?

this is the class of arithmetic circuits over GF(2) with bounded fan-in and bounded depth, with an additional final “collation”: a high fan-in addition gate at the last level. 

Q14. What is the proof of the augmented decryption circuit?

Lemma 4.5 guarantees that the decryption circuit is in Arith[O(log k), 1] (note that log log p = o(log k)), since the augmented decryption circuit just adds 1 to the depth, it follows that the augmented decryption circuits are also in Arith[O(log k), 1]. 

Q15. What is the trivial way to get the answer?

Most trivially, the receiver can encrypt the index it wants to query, and the database will use that to homomorphically evaluate the database access function, thus retrieving an encryption of the answer and sending it to the receiver.