The earliest “first generation” FHE constructions [Gen09b, vDGHV10] were based on ad-hoc average- case assumptions about ideal lattices and the “approximate GCD” problem, respectively. In a sequence of works, Brakerski and Vaikuntanathan (hereafter BV) [BV11a, BV11b] gave a “second generation” of FHE constructions, which were based on standard assumptions supported by worst-case hardness, namely, (ring-)LWE. Here we describe the main ideas behind the LWE-based scheme from [BV11b], with additional improvements from a subsequent work with Gentry [BGV12].
The BV scheme encrypts a single bit per ciphertext, and supports homomorphicadditionandmultiplica- tionmodulo two.1With some important caveats (as explained below), this is sufficient for FHE because by composing such operations, one can homomorphically evaluate any boolean circuit. In the BV system, a secret key is an LWE secret, and an encryption of a bit is simply an LWE sample for an odd modulusq, where the error termeencodes the message as its least-significant bit. More precisely, a ciphertext that encrypts
µ∈Z2under a secret keys∈Znis a vectorc∈Znq such that
hs,ci=st·c=e (modq), (6.1.1) wheree∈Zis some small error such thate=µ(mod 2), i.e.,e∈µ+ 2Z. To decryptcusings, one just
computeshs,ci ∈Zq, lifts the result to its unique representativee∈Z∩[−q2,q2), and outputsµ=emod 2. Notice that by taking s = (−¯s,1), a ciphertext vector c = (¯c, c) is just an LWE sample with an (n−1)-dimensional secret¯s and error term e, because c = h¯s,¯ci+e(modq). In the symmetric-key setting, such a ciphertext can be produced directly using¯s; in the asymmetric-key setting we can just add a random combination of LWE samples with respect to¯s, which are given in the public key. (Note that this is essentially how all LWE public-key encryption schemes work; see Section 5.2.) Using these observations it is straightforward to show that ciphertexts are pseudorandom, hence the encryption is passively secure, assuming the hardness of decision-LWE.
We remark that the decryption relation expressed in Equation (6.1.1), wheree∈µ+ 2Z, is sometimes
called the “least significant bit” encoding of the message, as opposed to the “most significant bit” encoding used throughout Chapter 5, wherehs,ci ≈µ· bq2e(modq). It turns out that the two encodings are equivalent when the plaintext and ciphertext moduli are coprime, because one can easily and losslessly switch between them without knowing the secret key; see [AP13, Appendix A] for a simple proof.
Homomorphic operations. We now describe homomorphic addition and multiplication. Fori = 1,2, letci ∈Znq be a ciphertext that encryptsµi ∈Z2 under secret keys, with small error termei ∈µi+ 2Z.
Homomorphic addition is simple: c1+c2 ∈Znq encryptsµ1+µ2 ∈Z2, because
hs,c1+c2i=hs,c1i+hs,c2i=e1+e2 (modq),
and of coursee1+e2 ∈(µ1+µ2) + 2Zis still small. Notice, however, that we cannot add an unbounded
number of ciphertexts, because eventually the magnitude of the error will grow larger thanq/2, in which case decryption may fail; we return to this issue shortly.
Homomorphic multiplication is a bit trickier. We start with the observation that thetensor(or Kronecker) productc1⊗c2 = (c1,i·c2,j)i,j ∈Znq2 is a valid encryption ofµ1µ2 ∈Z2under analternative secret key
s⊗s∈Zn 2
q , i.e., the secret key tensored with itself. This is because by the mixed-product property of tensor products,
hs⊗s,c1⊗c2i=hs,c1i · hs,c2i=e1·e2 (modq),
ande1·e2 ∈µ1µ2+ 2Zis still rather small, as long as the original errors were small enough to begin with.
So just as with homomorphic addition, the number of homomorphic multiplications is bounded a priori. Key switching. Homomorphic multiplication as described above has an even more significant problem than the error growth: thedimensionof the ciphertext also grows extremely fast, i.e., exponentially with the
1The scheme is easily generalizable to a message space of
number of multiplied ciphertexts, due to the use of the tensor product. To resolve this issue, BV introduced a cleverdimension reduction—also calledkey switching—technique. Suppose we have annin-dimensional
ciphertext cin (e.g.,cin = c1 ⊗c2 as above) that encrypts some message µunder a secret keysin (e.g., sin =s⊗sas above), under the “most-significant bit” encoding:
hsin,cini=stin·cin ≈µ· bq2e (modq).
We wish to convertcinto annout-dimensional ciphertextcoutthat still encryptsµ, but with respect to some
possibly different secret keysout. The first main insight is that
hsin,cini=stin·cin= (stinG)·G
−1(c
in)≈µ· bq2e (modq), (6.1.2)
whereGis the gadget matrix withninrows as defined in Section 5.4.3; also recall thatG−1(cin)is ashort
integer vector. Key-switching is made possible by publishing a suitable “encryption” ofsinundersout, namely,
a matrixKoverZqsuch that
stoutK≈stinG (mod q), (6.1.3) where the approximation hides small errors. Essentially, the columns ofKare LWE samples with respect tosout, withstinGadded to the last row. Assuming the hardness of LWE, it is easy to prove that such aKis
pseudorandom and hence safe to publish, as long assinandsoutare independent.2
To key-switch the ciphertextcin usingK, we simply outputcout=K·G−1(cin). Combining this with
Equations (6.1.2) and (6.1.3), we see that
stout·cout = (stoutK)·G
−1(c
in)≈(stinG)·G
−1(c
in)≈µ· bq2e (modq),
where the first approximation holds by Equation (6.1.3) and because G−1(cin)is a short integer vector.
Therefore,coutencryptsµundersout, as desired.
Error management and modulus switching. Recall from above that homomorphic addition and multi- plication increase the magnitude of the error terms in the resulting ciphertexts; in particular, the error in a homomorphic product of ciphertexts is the product of the individual errors (plus a little more, due to key- switching). This severely limits the homomorphic capacity and the hardness/efficiency tradeoff of the scheme: the modulusqmust be larger than the error in the final ciphertext, so freshly encrypted ciphertexts must have very small error rate relative toq. More specifically, the scheme as described so far can homomorphically evaluate circuits of only a fixedlogarithmicdepthd=O(logλ)in the security parameterλ, because the modulus must beq=λΩ(2d).
A very simple but powerfulmodulus reductiontechnique, first used in [BV11b] and then exploited to its full potential in [BGV12], greatly extends the homomorphic capacity to circuits of any a-priori bounded polynomialdepthd = poly(λ) in the security parameter. The idea is that by strategicallyscaling down the modulus by somepoly(n)factor (typically, before homomorphic multiplication), we can decrease the absoluteerror|e|to some small fixed polynomial, even though the relative errorrate|e|/qremains essentially unchanged. Because the absolute error is what determines the error growth in homomorphic multiplication, modulus reduction yields an arbitrage that allows us to evaluate a depth-dcircuit with an (original) modulus of onlyq=λΩ(d). More specifically, after evaluatingdlayers of a circuit, our original modulusqshrinks to
2
Note that if we want to switch from keysin=s⊗sback to theoriginalsout=s, then the keys are not independent. In such a
case we can simply make the “circular security” assumption that publishingKis safe, though this assumption is still not very well understood.
q/nO(d)while the absolute error remainspoly(n). So it suffices to set the original modulus asq=nΘ(d)in order to ensure correct decryption after a depth-dcomputation.
The modulus reduction technique relies on the normal form of the LWE problem, where the secrets∈Zn
is a rather short integer vector drawn from the error distribution (see Section 4.2.1). The main idea is that roundingan LWE sample (having a short secret) fromZqtoZq0 scales the absolute error by aq0/q factor,
plus a small additive term:
hs,ci ∈e+qZ =⇒ hs,bceq0i ∈
s,qq0 ·c+ [−12,12]n
⊆(qq0 ·e+ksk√n·[−12,12]) +q0Z.
In the FHE context, one can verify that the above rounding also preserves the encrypted message, when the ciphertext is in most-significant bit form (i.e.,hs,ci ≈µ· bq2e(modq)).
We also mention that Brakerski [Bra12] gave an alternative “scale invariant” method of homomorphic multiplication that increases the error rate by only a fixedpoly(n)factor, regardless of the absolute error of the input ciphertexts. Using this method, modulus reduction becomes optional. However, it can still be useful because the ciphertext sizes and computation times become smaller as the modulus shrinks.