Here PK(Ek(s2)), PK Ek(ck−1 i s) andPK Ek(ck−1 j s)
are computed using Ck as described in EquationE.16,E.23.
Figure E.2: Algorithm to evaluate on public key.
E.2 Error Analysis.
As discussed in Section 6, we have the level 2 encoding E2(x
ixj+p0·µij) is computed as E2(xixj+p0·µij) =E2(cicj−uicjs−ujcis+uiujs2)
=cicj−uiE2(cjs)−ujE2(cis) +uiujE2(s2)
Thus, computing a level 2 encoding of xixj from level 1 encodings ofxi and level 2 encodings E2(c
i·s) entails:
1. Adding noise to the messagexixj itself: The level 2 encoding that gets computed is for the message xixj+p0·µij not purelyxixj. This noiseµij results from the BV FHE evaluation process.
2. Adding noise to protect the encoding: Above, the encoding noise for the noisy message
xixj+p0·µij is the linear combination
Nse E2(xixj+p0·µij) =uiNse E2(cjs) −ujNse E2(cis) +uiujNse E2(s2)
Now, we have an encoding of a noisy functional value at level 2, which has the same structure as level 1 and we may propagate the computation up the circuit.
AlgorithmEvalkCT( ∪ i∈[k]
Ci, `)
To compute the encoding for the`thwire in the levelkcircuit, do:
1. If the`thwire at levelkis the addition of the ithandjthwire at levelk−1, then do the following:
• Ifk= 3 (base case), then computec3` =c2i +c2j as in EquationE.9.
• LetCTki−1=EvalkCT−1( ∪ j∈[k−1]C j, i) andCTk−1 j =Eval k−1 CT ( ∪ i∈[k−1]C i, j), • LetCTk` =CTik−1+CTkj−1
2. If the`thwire at levelkis the multiplication of theithandjthwire at levelk−1, then do the following:
• Ifk= 4 (base case) then compute c4
` (for any`) using EquationsE.11 andE.12.
• Letcki−1=EvalkCT−1( ∪ j∈[k−1]C j, i) andck−1 j =Eval k−1 CT ( ∪ i∈[k−1]C i, j), • Letck ` =c k−1 i c k−1 j +u k−1 i u k−1 j E k(s2)−uk−1 j E k(ck−1 i s)−u k−1 i E k(ck−1 j s) as in EquationE.24. Here, the termsEk(s2),Ek(ck−1
i s) andEk(c k−1
j s) are computed using Ck as described in claim
E.4
Figure E.3: Algorithm to evaluate on ciphertext.
1. The noise that is used to protect the encoding (this may be viewed as the noise within an
RLWEsample). For an encoding at levelk, this noise is a multiple of pk−1. We refer to this
noise as “encoding noise”.
2. The noise that is added to the message as part of the FHE evaluation procedure, which takes place within the message space of the encoding. We refer to this noise as “message noise”. We observe that message noise is a quadratic function of the encoding noise terms of theprevious level. We may compute the resultant noise term in the challenge ciphertext by proceeding bottom-up, computing the message noise created by each quadratic operation.
At the level 3 addition layer, for any gate the noise terms of the input gates are added. To compute the function fg4 for a multiplication gateg at the 4th layer, which takes as input wiresa
and bat layer 3, note that we may compute:
1. Encodings of level 3 messages, i.e. encodings c3 of messages the form y =xkxk0 +p0·µkk0+
x`x`0+p0·µ``0
2. Encodings of advice termsE4(c3
a·s+p1·µ3a) andE4(c3b·s+p1·µ3b) for some noise termsµ3a, µ3b. When we compute an encoding of product ya·yb whereya, yb are constructed asy above, we obtain an encoding of the desired value (xixj+xi0xj0)(xkx`+xk0x`0) plus noise which is computed as the sum of:
1. Noise created by FHE decryption given encodings of ya andyb. This noise has the form
2. Noise created by applying the quadratic method to compute the advice, as discussed in detail in the base case analysis. For instance, the encoding of adviceE4(c3
`s) is only computed as E4(c3
`s+p1·µ2`) where µ2` =µ2ij +µ2mt. Please see EquationsE.15 and E.16for more details. 3. ya·yb is itself only a noisy version of the desired value, since
ya·yb = xkxk0+p0·µkk0+x`x`0 +p0·µ``0 xmxm0 +p0·µmm0 +xtxt0+p0·µtt0
Constructing Message Noise forEd(f(x)). We have by LemmaE.3that the encodingsEk(ck−1· s) may be expressed as quadratic polynomials in levelk−1 encodings and the levelkadvice encodings Ck. Each quadratic k−1 encoding induces a quadratic noise term, which is a product of level k−2 encoding noise terms (a multiple of pk−2). Since there are at most k−1 quadratic encodings of
levelk−1, the noise terms are added together to give the message noise for ck−1·s.
When these are combined to construct the levelkencodingck, the BV FHE decryption equation forfk(x) adds additional noise to the message, where the noise is a again a quadratic polynomial in the encoding noise terms in levelk−1 encodings (analogous to noise µij at level 2). Thus, the total message noise at levelk isLinComb(Nse(Ek−1(·)Ek−1(·)), where the linear combination depends on
the functionf being computed.
Starting at level 2, we proceed up the circuitf to compute noise as a function of noise terms in the encodings. The function applied to the noise terms is related to but not exactly the same as the functionf, as discussed above.