str r rt - PowerPoint PPT Presentation

■t ✐s ❛ ✲♠♦❞✉❧❡✿ ✐s ❞❡✜♥❡❞✦ ■t ✐s ♥♦t ❛ ❘✐♥❣✿ ✐s ♥♦t ❞❡✜♥❡❞✦ ❱❡❝t♦rs✴♠❛tr✐❝❡s ❇② ❡①t❡♥s✐♦♥✱ ✐s ❛ ✲♠♦❞✉❧❡ ❚❤❡ r❡❛❧ t♦r✉s T = R / Z = R mod 1 ( T , + , · ) ✐s ❛ Z ✲♠♦❞✉❧❡ ✭ · : Z × T → T ❛ ✈❛❧✐❞ ❡①t❡r♥❛❧ ♣r♦❞✉❝t✮ ✔ ■t ✐s ❛ ❣r♦✉♣✿ x + y mod 1 ❛♥❞ − x mod 1 ✶✹ ✴ ✹✸

■t ✐s ♥♦t ❛ ❘✐♥❣✿ ✐s ♥♦t ❞❡✜♥❡❞✦ ❱❡❝t♦rs✴♠❛tr✐❝❡s ❇② ❡①t❡♥s✐♦♥✱ ✐s ❛ ✲♠♦❞✉❧❡ ❚❤❡ r❡❛❧ t♦r✉s T = R / Z = R mod 1 ( T , + , · ) ✐s ❛ Z ✲♠♦❞✉❧❡ ✭ · : Z × T → T ❛ ✈❛❧✐❞ ❡①t❡r♥❛❧ ♣r♦❞✉❝t✮ ✔ ■t ✐s ❛ ❣r♦✉♣✿ x + y mod 1 ❛♥❞ − x mod 1 ✔ ■t ✐s ❛ Z ✲♠♦❞✉❧❡✿ 0 · 1 2 = 0 ✐s ❞❡✜♥❡❞✦ ✶✹ ✴ ✹✸

❱❡❝t♦rs✴♠❛tr✐❝❡s ❇② ❡①t❡♥s✐♦♥✱ ✐s ❛ ✲♠♦❞✉❧❡ ❚❤❡ r❡❛❧ t♦r✉s T = R / Z = R mod 1 ( T , + , · ) ✐s ❛ Z ✲♠♦❞✉❧❡ ✭ · : Z × T → T ❛ ✈❛❧✐❞ ❡①t❡r♥❛❧ ♣r♦❞✉❝t✮ ✔ ■t ✐s ❛ ❣r♦✉♣✿ x + y mod 1 ❛♥❞ − x mod 1 ✔ ■t ✐s ❛ Z ✲♠♦❞✉❧❡✿ 0 · 1 2 = 0 ✐s ❞❡✜♥❡❞✦ ✘ ■t ✐s ♥♦t ❛ ❘✐♥❣✿ 0 × 1 2 ✐s ♥♦t ❞❡✜♥❡❞✦ ✶✹ ✴ ✹✸

❚❤❡ r❡❛❧ t♦r✉s T = R / Z = R mod 1 ( T , + , · ) ✐s ❛ Z ✲♠♦❞✉❧❡ ✭ · : Z × T → T ❛ ✈❛❧✐❞ ❡①t❡r♥❛❧ ♣r♦❞✉❝t✮ ✔ ■t ✐s ❛ ❣r♦✉♣✿ x + y mod 1 ❛♥❞ − x mod 1 ✔ ■t ✐s ❛ Z ✲♠♦❞✉❧❡✿ 0 · 1 2 = 0 ✐s ❞❡✜♥❡❞✦ ✘ ■t ✐s ♥♦t ❛ ❘✐♥❣✿ 0 × 1 2 ✐s ♥♦t ❞❡✜♥❡❞✦ ❱❡❝t♦rs✴♠❛tr✐❝❡s ❇② ❡①t❡♥s✐♦♥✱ ( T n , + , . ) ✐s ❛ Z ✲♠♦❞✉❧❡    � 0 . 252 � 1 − 2 0 . 672  · � 3 − 2 4 � · 3 4    0 . 231 0 . 991 5 0 � 0 . 252     1 − 2 � 3 � 0 . 672  · 4 � = − 2 × 3 4   0 . 231 0 . 991 5 0 ✶✹ ✴ ✹✸

❉❡❝♦♠♣♦s❡ ♦✈❡r ✇✐t❤ s♠❛❧❧ ❝♦❡❢s ❊①❛♠♣❧❡s ❚♦r✉s ♣♦❧②♥♦♠✐❛❧s T N [ X ] ( T N [ X ] , + , · ) ✐s ❛ R ✲♠♦❞✉❧❡ ❍❡r❡✱ R = Z [ X ] / ( X N + 1) ❆♥❞ T N [ X ] = T [ X ] mod ( X N + 1) ✶✺ ✴ ✹✸

❉❡❝♦♠♣♦s❡ ♦✈❡r ✇✐t❤ s♠❛❧❧ ❝♦❡❢s ❚♦r✉s ♣♦❧②♥♦♠✐❛❧s T N [ X ] ( T N [ X ] , + , · ) ✐s ❛ R ✲♠♦❞✉❧❡ ❍❡r❡✱ R = Z [ X ] / ( X N + 1) ❆♥❞ T N [ X ] = T [ X ] mod ( X N + 1) ❊①❛♠♣❧❡s (1 + 2 X ) · ( 1 3 + 4 7 X ) = ✶✺ ✴ ✹✸

❉❡❝♦♠♣♦s❡ ♦✈❡r ✇✐t❤ s♠❛❧❧ ❝♦❡❢s ❚♦r✉s ♣♦❧②♥♦♠✐❛❧s T N [ X ] ( T N [ X ] , + , · ) ✐s ❛ R ✲♠♦❞✉❧❡ ❍❡r❡✱ R = Z [ X ] / ( X N + 1) ❆♥❞ T N [ X ] = T [ X ] mod ( X N + 1) ❊①❛♠♣❧❡s 21 X ) mod ( X 2 + 1) mod 1 (1 + 2 X ) · ( 1 3 + 4 7 X ) =( 4 21 + 5 ✶✺ ✴ ✹✸

❚♦r✉s ♣♦❧②♥♦♠✐❛❧s T N [ X ] ( T N [ X ] , + , · ) ✐s ❛ R ✲♠♦❞✉❧❡ ❍❡r❡✱ R = Z [ X ] / ( X N + 1) ❆♥❞ T N [ X ] = T [ X ] mod ( X N + 1) ❊①❛♠♣❧❡s 21 X ) mod ( X 2 + 1) mod 1 (1 + 2 X ) · ( 1 3 + 4 7 X ) =( 4 21 + 5 ❉❡❝♦♠♣♦s❡ ( 3 8 + 7 8 X ) ♦✈❡r [ 1 2 , 1 4 , 1 8 ] ✇✐t❤ s♠❛❧❧ ❝♦❡❢s ✶✺ ✴ ✹✸

❚♦r✉s ♣♦❧②♥♦♠✐❛❧s T N [ X ] ( T N [ X ] , + , · ) ✐s ❛ R ✲♠♦❞✉❧❡ ❍❡r❡✱ R = Z [ X ] / ( X N + 1) ❆♥❞ T N [ X ] = T [ X ] mod ( X N + 1) ❊①❛♠♣❧❡s 21 X ) mod ( X 2 + 1) mod 1 (1 + 2 X ) · ( 1 3 + 4 7 X ) =( 4 21 + 5 ❉❡❝♦♠♣♦s❡ ( 3 8 + 7 8 X ) ♦✈❡r [ 1 2 , 1 4 , 1 8 ] ✇✐t❤ s♠❛❧❧ ❝♦❡❢s ( 3 8 + 7 8 X ) = (0 + X ) · 1 2 + (1 + X ) · 1 4 + (1 + X ) · 1 8 ✶✺ ✴ ✹✸

✶ ❈❤♦♦s❡ ●❛✉ss✐❛♥ ❊rr♦r ✷ ❈❤♦♦s❡ ❛ r❛♥❞♦♠ ♠❛s❦ ✸ ❘❡t✉r♥ t❤❡ ❧♦❝❦❡❞ r❡♣r❡s❡♥t❛t✐♦♥ ▲❲❊ ❊♥❝r②♣t✐♦♥ ▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ ✶✻ ✴ ✹✸

✶ ❈❤♦♦s❡ ●❛✉ss✐❛♥ ❊rr♦r ✷ ❈❤♦♦s❡ ❛ r❛♥❞♦♠ ♠❛s❦ ✸ ❘❡t✉r♥ t❤❡ ❧♦❝❦❡❞ r❡♣r❡s❡♥t❛t✐♦♥ ▲❲❊ ❊♥❝r②♣t✐♦♥ ▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ 2 / 3 1 / 3 0 Example: M = { 0 , 1 / 3 , 2 / 3 } mod 1 µ = 1 / 3 mod 1 ∈ M ✶✻ ✴ ✹✸

✷ ❈❤♦♦s❡ ❛ r❛♥❞♦♠ ♠❛s❦ ✸ ❘❡t✉r♥ t❤❡ ❧♦❝❦❡❞ r❡♣r❡s❡♥t❛t✐♦♥ ▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ 2 / 3 1 / 3 0 ( , ϕ ) Example: M = { 0 , 1 / 3 , 2 / 3 } mod 1 µ = 1 / 3 mod 1 ∈ M ▲❲❊ ❊♥❝r②♣t✐♦♥ ✶ ❈❤♦♦s❡ ϕ = µ + ●❛✉ss✐❛♥ ❊rr♦r ✶✻ ✴ ✹✸

✸ ❘❡t✉r♥ t❤❡ ❧♦❝❦❡❞ r❡♣r❡s❡♥t❛t✐♦♥ ▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ 2 / 3 1 / 3 a 0 ( a , ϕ ) Example: M = { 0 , 1 / 3 , 2 / 3 } mod 1 µ = 1 / 3 mod 1 ∈ M ▲❲❊ ❊♥❝r②♣t✐♦♥ ✶ ❈❤♦♦s❡ ϕ = µ + ●❛✉ss✐❛♥ ❊rr♦r ✷ ❈❤♦♦s❡ ❛ r❛♥❞♦♠ ♠❛s❦ a ∈ T n ✶✻ ✴ ✹✸

▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ secret key : s ∈ { 0 , 1 } n b = s · a + ϕ 2 / 3 1 / 3 a a 0 ( a , ϕ ) ( a , b ) Example: M = { 0 , 1 / 3 , 2 / 3 } mod 1 µ = 1 / 3 mod 1 ∈ M ▲❲❊ ❊♥❝r②♣t✐♦♥ ✶ ❈❤♦♦s❡ ϕ = µ + ●❛✉ss✐❛♥ ❊rr♦r ✷ ❈❤♦♦s❡ ❛ r❛♥❞♦♠ ♠❛s❦ a ∈ T n ✸ ❘❡t✉r♥ t❤❡ ❧♦❝❦❡❞ r❡♣r❡s❡♥t❛t✐♦♥ ( a , b ) ✶✻ ✴ ✹✸

✶ ❯♥❧♦❝❦ t❤❡ r❡♣r❡s❡♥t❛t✐♦♥ ✷ ❘♦✉♥❞ t♦ t❤❡ ♥❡❛r❡st ♠❡ss❛❣❡ ✸ ♣❧♦✉❢✦ ▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ secret key : s ∈ { 0 , 1 } n a ( a , b ) ▲❲❊ ❉❡❝r②♣t✐♦♥ ✶✻ ✴ ✹✸

✷ ❘♦✉♥❞ t♦ t❤❡ ♥❡❛r❡st ♠❡ss❛❣❡ ✸ ♣❧♦✉❢✦ ▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ secret key : s ∈ { 0 , 1 } n a a ϕ = b − s · a ( a , ϕ ) ( a , b ) ▲❲❊ ❉❡❝r②♣t✐♦♥ ✶ ❯♥❧♦❝❦ t❤❡ r❡♣r❡s❡♥t❛t✐♦♥ ( a , ϕ ) ✶✻ ✴ ✹✸

✸ ♣❧♦✉❢✦ ▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ secret key : s ∈ { 0 , 1 } n 2 / 3 1 / 3 a a ϕ = b − s · a 0 ( a , ϕ ) ( a , b ) ▲❲❊ ❉❡❝r②♣t✐♦♥ ✶ ❯♥❧♦❝❦ t❤❡ r❡♣r❡s❡♥t❛t✐♦♥ ( a , ϕ ) ✷ ❘♦✉♥❞ ϕ t♦ t❤❡ ♥❡❛r❡st ♠❡ss❛❣❡ µ ∈ M ✶✻ ✴ ✹✸

▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ secret key : s ∈ { 0 , 1 } n b = s · a + ϕ a a ϕ = b − s · a ( a , ϕ ) ( a , b ) ✶✻ ✴ ✹✸

▲❲❊ s②♠♠❡tr✐❝ ❡♥❝r②♣t✐♦♥ secret key : s ∈ { 0 , 1 } n b = s · a + ϕ 0 a 0 ϕ = b − s · a ( a , b ) ❚r✐✈✐❛❧ ▲❲❊ s❛♠♣❧❡s ▲❲❊ s❛♠♣❧❡s ✇✐t❤ ♠❛s❦ a = 0 ❛r❡ tr✐✈✐❛❧✳ ❚❤❡② ♥❡✈❡r ♦❝❝✉r ✐♥ ❣❡♥❡r❛❧ ✳✳✳❜✉t ❛r❡ st✐❧❧ ✇♦rt❤ ♠❡♥t✐♦♥♥✐♥❣✦ ✶✻ ✴ ✹✸

▲❲❊ ❍♦♠♦♠♦r♣❤✐❝ Pr♦♣❡rt✐❡s a ′′ = x · a + y · a ′ a ′ = a ′′ x a + y b ′′ = x · b + y · b ′ b b ′ b ′′ ✶✼ ✴ ✹✸

▲❲❊ ❍♦♠♦♠♦r♣❤✐❝ Pr♦♣❡rt✐❡s a ′′ = x · a + y · a ′ a ′ = a ′′ x a + y b ′′ = x · b + y · b ′ b b ′ b ′′ x a + y a ′ = a ′′ ϕ ′′ = x · ϕ + y · ϕ ′ ϕ ϕ ′ ϕ ′′ ✶✼ ✴ ✹✸

▲❲❊ ❍♦♠♦♠♦r♣❤✐❝ Pr♦♣❡rt✐❡s a ′′ = x · a + y · a ′ a ′ = a ′′ x a + y b ′′ = x · b + y · b ′ b b ′ b ′′ x a + y a ′ = a ′′ ϕ ′′ = x · ϕ + y · ϕ ′ ϕ ϕ ′ ϕ ′′ µ ′′ = x · µ + y · µ ′ µ ′′ = x · µ + y · µ ′ µ = E ( ϕ ) µ = E ( ϕ ) µ ′ µ ′ µ ′′ µ ′′ ✶✼ ✴ ✹✸

▲❲❊ ❍♦♠♦♠♦r♣❤✐❝ Pr♦♣❡rt✐❡s a ′′ = x · a + y · a ′ a ′ = a ′′ x a + y b ′′ = x · b + y · b ′ b b ′ b ′′ x a + y a ′ = a ′′ ϕ ′′ = x · ϕ + y · ϕ ′ ϕ ϕ ′ ϕ ′′ µ ′′ = x · µ + y · µ ′ µ ′′ = x · µ + y · µ ′ µ = E ( ϕ ) µ = E ( ϕ ) µ ′ µ ′ µ ′′ µ ′′ α ′′ 2 = x 2 α 2 + y 2 α ′ 2 α = stdev( ϕ ) α ′ α ′′ ✶✼ ✴ ✹✸

▲❲❊ ❍♦♠♦♠♦r♣❤✐❝ Pr♦♣❡rt✐❡s a ′′ = x · a + y · a ′ a ′ = a ′′ x a + y b ′′ = x · b + y · b ′ b b ′ b ′′ x a + y a ′ = a ′′ ϕ ′′ = x · ϕ + y · ϕ ′ ϕ ϕ ′ ϕ ′′ µ ′′ = x · µ + y · µ ′ µ ′′ = x · µ + y · µ ′ µ = E ( ϕ ) µ = E ( ϕ ) µ ′ µ ′ µ ′′ µ ′′ α ′′ 2 = x 2 α 2 + y 2 α ′ 2 α = stdev( ϕ ) α ′ α ′′ Ω: The only proba. space where this intuitive picture makes sense! ✶✼ ✴ ✹✸

■♥ ♦✉r ♣❛♣❡r ▲❲❊✿ ❞❡✜♥✐t✐♦♥ s✐♠✐❧❛r t♦ ❬❇▲P❘❙✶✸❪✱❬❈❙✶✺❪✱❬❈●●■✶✻❪ ❚▲❲❊✿ ❣❡♥❡r❛❧✐③❡❞ ❞❡✜♥✐t✐♦♥ s✐♠✐❧❛r t♦ ❬❇●❱✶✷❪ ▲❲❊ ▲❲❊ ❂ ▲❡❛r♥✐♥❣ ❲✐t❤ ❊rr♦rs ❬❘❡❣✵✺❪ ❘✐♥❣✲▲❲❊ ❬▲P❘✶✵❪ ✶✽ ✴ ✹✸

▲❲❊ ▲❲❊ ❂ ▲❡❛r♥✐♥❣ ❲✐t❤ ❊rr♦rs ❬❘❡❣✵✺❪ ❘✐♥❣✲▲❲❊ ❬▲P❘✶✵❪ ■♥ ♦✉r ♣❛♣❡r ▲❲❊✿ ❞❡✜♥✐t✐♦♥ s✐♠✐❧❛r t♦ ❬❇▲P❘❙✶✸❪✱❬❈❙✶✺❪✱❬❈●●■✶✻❪ ❚▲❲❊✿ ❣❡♥❡r❛❧✐③❡❞ ❞❡✜♥✐t✐♦♥ s✐♠✐❧❛r t♦ ❬❇●❱✶✷❪ ✶✽ ✴ ✹✸

❚▲❲❊ ❊♥❝r②♣t✐♦♥ N [ X ] k +1 �→ T ϕ s : N [ X ] T ( a , b ) → b − s · a H N [ X ] k +1 T TLWE Samples ✶✾ ✴ ✹✸

❚▲❲❊ ❊♥❝r②♣t✐♦♥ N [ X ] k +1 �→ T ϕ s : N [ X ] T ( a , b ) → b − s · a Im ϕ s µ H M isom N [ X ] k +1 T { ( 0 , µ ) } Trivial TLWE samples Samples ✶✾ ✴ ✹✸

❚▲❲❊ ❊♥❝r②♣t✐♦♥ N [ X ] k +1 �→ T ϕ s : N [ X ] T ( a , b ) → b − s · a Im ϕ s µ H M Γ = ⊕ isom N [ X ] k +1 T ker ϕ s { ( 0 , µ ) } Trivial TLWE Homogeneous samples samples Samples ✶✾ ✴ ✹✸

❚▲❲❊ ❊♥❝r②♣t✐♦♥ N [ X ] k +1 �→ T ϕ s : N [ X ] T ( a , b ) → b − s · a Im ϕ s µ H M Γ = ⊕ isom N [ X ] k +1 T ker ϕ s { ( 0 , µ ) } Trivial TLWE Homogeneous samples samples Samples c = z + ( 0 , µ ) µ encrypt: add z ∈ ker ϕ s µ = ϕ s ( c ) c decrypt: apply ϕ s ✶✾ ✴ ✹✸

❚▲❲❊ ❊♥❝r②♣t✐♦♥ N [ X ] k +1 �→ T ϕ s : N [ X ] T ( a , b ) → b − s · a Im ϕ s µ H M Γ = ⊕ isom N [ X ] k +1 T ker ϕ s { ( 0 , µ ) } Trivial TLWE Homogeneous samples samples Samples ( Approx of R -module ) c = z + ( 0 , µ ) µ encrypt: add approx( z ∈ ker ϕ s ) approx( µ ) c decrypt: apply ϕ s ... = ϕ s ( c ) ✶✾ ✴ ✹✸

❚▲❲❊ ❊♥❝r②♣t✐♦♥ N [ X ] k +1 �→ T ϕ s : N [ X ] T ( a , b ) → b − s · a ! ! Im ϕ s How to recover µ exactly ? µ H M Γ = ⊕ isom µ = E ( ϕ s ( c )) Option 1: N [ X ] k +1 T (in the relevant proba. space) ker ϕ s { ( 0 , µ ) } The Ω-space logic Trivial TLWE Homogeneous samples samples Samples µ = round( ϕ s ( c )) Option 2: ( Approx of R -module ) On a given finite message space M The logic of the decryption algorithm c = z + ( 0 , µ ) µ encrypt: add approx( z ∈ ker ϕ s ) approx( µ ) c decrypt: apply ϕ s ... = ϕ s ( c ) ✶✾ ✴ ✹✸

❚❛❜❧❡ ♦❢ ❝♦♥t❡♥ts ✶ ❋✉❧❧② ❍♦♠♦♠♦r♣❤✐❝ ❊♥❝r②♣t✐♦♥ ❆♣♣❧✐❝❛t✐♦♥s ✷ ❚▲❲❊ ❚❤❡ r❡❛❧ t♦r✉s ▲❲❊ ❛♥❞ ❚▲❲❊ ✸ ❚●❙❲ ❛♥❞ t❤❡ ❡①t❡r♥❛❧ ♣r♦❞✉❝t ❊♥❝r②♣t✐♦♥ ❛♥❞ ●❛❞❣❡t ❚▲❲❊ ❛♥❞ ❚●❙❲ ✹ ❋❛st❡r ❇♦♦tstr❛♣♣✐♥❣ ●❛t❡ ❜♦♦tstr❛♣♣✐♥❣ ❙❡❝✉r✐t② ❛♥❛❧②s✐s ✺ ❈♦♥❝❧✉s✐♦♥ ✷✵ ✴ ✹✸

❚●❙❲✿ ✧●❙❲✧ ♦♥ ■♥ t❤✐s t❛❧❦ ❆❜str❛❝t✐♦♥ ♦❢ ❬●❙❲✶✸❪ ❜② ❬●■◆❳✶✻❪ ●❙❲ ❬●❙❲✶✸❪ ✐s ❛ ❋❍❊ s❝❤❡♠❡ ❜❛s❡❞ ♦♥ ▲❲❊ ❘❡❧✐❡s ♦♥ ❛ ❣❛❞❣❡t ❞❡❝♦♠♣♦s✐t✐♦♥ ❢✉♥❝t✐♦♥ ●❙❲ ❲❡ ✇❛♥t ❋❍❊✦ ❲❤❛t ✐s st✐❧❧ ♠✐ss✐♥❣ t♦ ❤❛✈❡ ❋✉❧❧② ❍♦♠♦♠♦r♣❤✐❝ ❊♥❝r②♣t✐♦♥❄ ✷✶ ✴ ✹✸

❚●❙❲✿ ✧●❙❲✧ ♦♥ ■♥ t❤✐s t❛❧❦ ❆❜str❛❝t✐♦♥ ♦❢ ❬●❙❲✶✸❪ ❜② ❬●■◆❳✶✻❪ ●❙❲ ❲❡ ✇❛♥t ❋❍❊✦ ❲❤❛t ✐s st✐❧❧ ♠✐ss✐♥❣ t♦ ❤❛✈❡ ❋✉❧❧② ❍♦♠♦♠♦r♣❤✐❝ ❊♥❝r②♣t✐♦♥❄ ●❙❲ ❬●❙❲✶✸❪ ✐s ❛ ❋❍❊ s❝❤❡♠❡ ❜❛s❡❞ ♦♥ ▲❲❊ ❘❡❧✐❡s ♦♥ ❛ ❣❛❞❣❡t ❞❡❝♦♠♣♦s✐t✐♦♥ ❢✉♥❝t✐♦♥ ✷✶ ✴ ✹✸

●❙❲ ❲❡ ✇❛♥t ❋❍❊✦ ❲❤❛t ✐s st✐❧❧ ♠✐ss✐♥❣ t♦ ❤❛✈❡ ❋✉❧❧② ❍♦♠♦♠♦r♣❤✐❝ ❊♥❝r②♣t✐♦♥❄ ●❙❲ ❬●❙❲✶✸❪ ✐s ❛ ❋❍❊ s❝❤❡♠❡ ❜❛s❡❞ ♦♥ ▲❲❊ ❘❡❧✐❡s ♦♥ ❛ ❣❛❞❣❡t ❞❡❝♦♠♣♦s✐t✐♦♥ ❢✉♥❝t✐♦♥ ■♥ t❤✐s t❛❧❦ ❆❜str❛❝t✐♦♥ ♦❢ ❬●❙❲✶✸❪ ❜② ❬●■◆❳✶✻❪ ❚●❙❲✿ ✧●❙❲✧ ♦♥ T ✷✶ ✴ ✹✸

❚●❙❲ ❚❤❡ ❣❛❞❣❡t h ❣❡♥❡r❛t✐♥❣ ❢❛♠✐❧② ♦❢ H v = ( v 1 | . . . | v k +1 ) ∈ H h ∈ M ℓ ′ ,k +1 ( T N [ X ])  1 / 2 . . . 0  h ✐s ❜❧♦❝❦ ❞✐❛❣♦♥❛❧ 1 / 2 2 . . . 0 s✉♣❡r✲✐♥❝r❡❛s✐♥❣   ✳ ✳ ✳✳✳   ✳ ✳ ❲❡ ❛r❡ ❛❜❧❡ t♦ ❞❡❝♦♠♣♦s❡  ✳ ✳    ❡❧❡♠❡♥ts ✐♥ t❤❡ s✉❜✲♠♦❞✉❧❡ H 1 / 2 ℓ  . . . 0    ✳ ✳  ✳✳✳  ❚❤❡ ❝♦❡✣❝✐❡♥ts ✐♥ t❤❡ ✳ ✳ h =   ✳ ✳   ❞❡❝♦♠♣♦s✐t✐♦♥ ❛r❡ s♠❛❧❧   0 . . . 1 / 2   ❆♣♣r♦①✐♠❛t❡❞ ❞❡❝♦♠♣♦s✐t✐♦♥ ✭✉♣   1 / 2 2 0 . . .   t♦ s♦♠❡ ♣r❡❝✐s✐♦♥ ♣❛r❛♠❡t❡rs✮   ✳ ✳ ✳✳✳ ✳ ✳   ✳ ✳   ■♠♣r♦✈❡ t✐♠❡ ❛♥❞ ♠❡♠♦r② 1 / 2 ℓ 0 . . . r❡q✉✐r❡♠❡♥ts ❢♦r ❛ s♠❛❧❧ ❛♠♦✉♥t ♦❢ ❛❞❞✐t✐♦♥❛❧ ♥♦✐s❡ ✷✷ ✴ ✹✸

❊♥❝r②♣t✐♦♥✿ ✇❤❡r❡ ❍♦♠♦♠♦r♣❤✐❝ ♦♣❡r❛t✐♦♥s✿ ▲❡t ❛♥❞ ▲✐♥❡❛r ❝♦♠❜✐♥❛t✐♦♥s✿ ❡♥❝r②♣ts ✭ ✮ ▼✉❧t✐♣❧✐❝❛t✐♦♥ ✿ ❡♥❝r②♣ts ❚●❙❲ P❛r❛♠❡t❡rs ▲❡t H = T N [ X ] k × T N [ X ] h = ( h 1 , . . . , h l ) ∈ H ℓ ′ ❛ s✉♣❡r✲✐♥❝r❡❛s✐♥❣ ❣❡♥❡r❛t✐♥❣ ❢❛♠✐❧② ♦❢ H Dec h t❤❡ ✧s♠❛❧❧✧ ❞❡❝♦♠♣♦s✐t✐♦♥ ❢✉♥❝t✐♦♥ ❢r♦♠ H → R ℓ ′ ✭ R = Z [ X ] / ( X N + 1) ✮ s✉❝❤ t❤❛t Dec h ( x ) · h = x ❢♦r ❛❧❧ x ∈ H Γ = ker ϕ s ❞❡♥♦t❡s ❤♦♠♦❣❡♥❡♦✉s ❚▲❲❊ s❛♠♣❧❡s ✷✸ ✴ ✹✸

❍♦♠♦♠♦r♣❤✐❝ ♦♣❡r❛t✐♦♥s✿ ▲❡t ❛♥❞ ▲✐♥❡❛r ❝♦♠❜✐♥❛t✐♦♥s✿ ❡♥❝r②♣ts ✭ ✮ ▼✉❧t✐♣❧✐❝❛t✐♦♥ ✿ ❡♥❝r②♣ts ❚●❙❲ P❛r❛♠❡t❡rs ▲❡t H = T N [ X ] k × T N [ X ] h = ( h 1 , . . . , h l ) ∈ H ℓ ′ ❛ s✉♣❡r✲✐♥❝r❡❛s✐♥❣ ❣❡♥❡r❛t✐♥❣ ❢❛♠✐❧② ♦❢ H Dec h t❤❡ ✧s♠❛❧❧✧ ❞❡❝♦♠♣♦s✐t✐♦♥ ❢✉♥❝t✐♦♥ ❢r♦♠ H → R ℓ ′ ✭ R = Z [ X ] / ( X N + 1) ✮ s✉❝❤ t❤❛t Dec h ( x ) · h = x ❢♦r ❛❧❧ x ∈ H Γ = ker ϕ s ❞❡♥♦t❡s ❤♦♠♦❣❡♥❡♦✉s ❚▲❲❊ s❛♠♣❧❡s ❊♥❝r②♣t✐♦♥✿ C = Z + µ · h ✇❤❡r❡ Z ∈ Γ ℓ ′ ✷✸ ✴ ✹✸

❚●❙❲ P❛r❛♠❡t❡rs ▲❡t H = T N [ X ] k × T N [ X ] h = ( h 1 , . . . , h l ) ∈ H ℓ ′ ❛ s✉♣❡r✲✐♥❝r❡❛s✐♥❣ ❣❡♥❡r❛t✐♥❣ ❢❛♠✐❧② ♦❢ H Dec h t❤❡ ✧s♠❛❧❧✧ ❞❡❝♦♠♣♦s✐t✐♦♥ ❢✉♥❝t✐♦♥ ❢r♦♠ H → R ℓ ′ ✭ R = Z [ X ] / ( X N + 1) ✮ s✉❝❤ t❤❛t Dec h ( x ) · h = x ❢♦r ❛❧❧ x ∈ H Γ = ker ϕ s ❞❡♥♦t❡s ❤♦♠♦❣❡♥❡♦✉s ❚▲❲❊ s❛♠♣❧❡s ❊♥❝r②♣t✐♦♥✿ C = Z + µ · h ✇❤❡r❡ Z ∈ Γ ℓ ′ ❍♦♠♦♠♦r♣❤✐❝ ♦♣❡r❛t✐♦♥s✿ ▲❡t C 1 = Z 1 + µ 1 · h ❛♥❞ C 2 = Z 2 + µ 2 · h ▲✐♥❡❛r ❝♦♠❜✐♥❛t✐♦♥s✿ δ 1 C 1 + δ 2 C 2 ❡♥❝r②♣ts δ 1 µ 1 + δ 2 µ 2 ✭ δ i ∈ R ✮ ▼✉❧t✐♣❧✐❝❛t✐♦♥ ✿ Dec h ( C 1 ) · C 2 ❡♥❝r②♣ts µ 1 µ 2 ✷✸ ✴ ✹✸

❙❛♠♣❧❡s ❚♦② ❡①❛♠♣❧❡ ✭✇✐t❤♦✉t ♥♦✐s❡✮ ϕ s = · 4 Im ϕ s ) = m ⊕ o 1 s 1 i 100 Z / Z 1 25 Z / Z ( 4 Z / Z P❛r❛♠❡t❡rs 100 Z / Z = 1 1 4 Z / Z ⊕ 1 H = 25 Z / Z ✭✐s ❛ Z ✲♠♦❞✉❧❡✮ � 1 2 100 , 10 5 100 , 20 100 , 50 � h = 100 , 100 , 100 Dec h ✿ ❞❡❝♦♠♣♦s✐t✐♦♥ ✐♥ ❊✉r♦ ❝♦✐♥s Γ = 1 4 Z / Z ⊂ H ✿ ♠♦❞✉❧♦ ♦❢ t❤❡ ❝♦❞❡ ✷✹ ✴ ✹✸

❚♦② ❡①❛♠♣❧❡ ✭✇✐t❤♦✉t ♥♦✐s❡✮ ϕ s = · 4 Im ϕ s ) = m ⊕ o 1 s 1 i 100 Z / Z 1 25 Z / Z ( 4 Z / Z P❛r❛♠❡t❡rs 100 Z / Z = 1 1 4 Z / Z ⊕ 1 H = 25 Z / Z ✭✐s ❛ Z ✲♠♦❞✉❧❡✮ � 1 2 100 , 10 5 100 , 20 100 , 50 � h = 100 , 100 , 100 Dec h ✿ ❞❡❝♦♠♣♦s✐t✐♦♥ ✐♥ ❊✉r♦ ❝♦✐♥s Γ = 1 4 Z / Z ⊂ H ✿ ♠♦❞✉❧♦ ♦❢ t❤❡ ❝♦❞❡ ❙❛♠♣❧❡s � 32 100 , 14 100 , 60 100 , 45 100 , 90 0 � � 1 4 , 0 4 , 1 4 , 3 4 , 2 4 , 2 � C 1 = 100 , = + 7 · h 100 4 � 73 � � 3 � 100 , 21 100 , 40 100 , 35 5 100 , 50 4 , 1 4 , 2 4 , 1 4 , 3 4 , 2 C 2 = 100 , = − 2 · h 100 4 ✷✹ ✴ ✹✸

❚♦② ❡①❛♠♣❧❡ ✭✇✐t❤♦✉t ♥♦✐s❡✮ ▼✉❧t✐♣❧✐❝❛t✐♦♥✿    73 / 100  0 1 0 1 1 0 0 2 0 1 0 0 21 / 100         0 0 0 1 0 1 40 / 100     Dec h ( C 1 ) · C 2 =     0 0 1 0 2 0 5 / 100         0 0 0 0 2 1 35 / 100     0 0 0 0 0 0 50 / 100 � 61 � 100 , 47 100 , 55 100 , 10 100 , 20 100 , 0 = 100 ❱❡r✐✜❝❛t✐♦♥✿ ❞♦❡s ❡♥❝♦❞❡ 7 · ( − 2) = 11 mod 25 � 61 100 , 47 100 , 55 100 , 10 100 , 20 100 , 0 � � 2 4 , 1 4 , 0 4 , 0 4 , 0 4 , 2 � = + 11 · h 100 4 ✷✺ ✴ ✹✸

❚♦② ❡①❛♠♣❧❡ ✭✇✐t❤♦✉t ♥♦✐s❡✮ ▼✉❧t✐♣❧✐❝❛t✐♦♥✿     0 1 0 1 1 0 73 / 100 0 2 0 1 0 0 21 / 100         0 0 0 1 0 1 40 / 100     Dec h ( C 1 ) · C 2 =     0 0 1 0 2 0 5 / 100         0 0 0 0 2 1 35 / 100     0 0 0 0 0 0 50 / 100 � 61 � 100 , 47 100 , 55 100 , 10 100 , 20 100 , 0 = 100 ❱❡r✐✜❝❛t✐♦♥✿ ❞♦❡s ❡♥❝♦❞❡ 7 · ( − 2) = 11 mod 25 � 61 100 , 47 100 , 55 100 , 10 100 , 20 100 , 0 � � 2 4 , 1 4 , 0 4 , 0 4 , 0 4 , 2 � = + 11 · h 100 4 ✷✺ ✴ ✹✸

❚▲❲❊ ❛♥❞ ❚●❙❲ ϕ s N [ X ] T = ⊕ m o Γ = ker ϕ s H M s i TLWE ✷✻ ✴ ✹✸

❚▲❲❊ ❛♥❞ ❚●❙❲ ϕ s N [ X ] T = ⊕ m o Γ = ker ϕ s H M s i TLWE R ⊃ ⊕ H ℓ ′ Γ ℓ ′ R · h TGSW ✷✻ ✴ ✹✸

❚▲❲❊ ❛♥❞ ❚●❙❲ ϕ s N [ X ] T = ⊕ m o Γ = ker ϕ s H M s i TLWE R ⊃ ⊕ H ℓ ′ Γ ℓ ′ R · h TGSW ∀ e ∈ R ℓ ′ , ∀ A ∈ R , ∀ b ∈ T N [ X ]: e · TGSW ( A ) is a TLWE of A · ϕ s ( e · h ) ✷✻ ✴ ✹✸

❚▲❲❊ ❛♥❞ ❚●❙❲ ϕ s N [ X ] T = ⊕ m o Γ = ker ϕ s H M s i TLWE R ⊃ ⊕ H ℓ ′ Γ ℓ ′ R · h TGSW ∀ e ∈ R ℓ ′ , ∀ A ∈ R , ∀ b ∈ T N [ X ]: e · TGSW ( A ) is a TLWE of A · ϕ s ( e · h ) = ⇒ Decomp h ( TLWE ( b )) · TGSW ( A ) is a TLWE of A · b ✷✻ ✴ ✹✸

❚♦② ❡①❛♠♣❧❡ ✭❲■❚❍ ♥♦✐s❡✮ P❛r❛♠❡t❡rs 100 Z / Z = 1 1 4 Z / Z ⊕ 1 H = 25 Z / Z ✭✐s ❛ Z ✲♠♦❞✉❧❡✮ � 1 2 100 , 10 5 100 , 20 100 , 50 � h = 100 , 100 , 100 Dec h ✿ ❞❡❝♦♠♣♦s✐t✐♦♥ ✐♥ ❊✉r♦ ❝♦✐♥s Γ = 1 4 Z / Z ⊂ H ✿ ♠♦❞✉❧♦ ♦❢ t❤❡ ❝♦❞❡ ❙❛♠♣❧❡s � 31 � 100 , 16 100 , 63 100 , 46 100 , 89 0 C 1 = 100 , 100 �� 1 4 , 0 4 , 1 4 , 3 4 , 2 4 , 2 � � − 1 2 3 100 , − 1 1 1 �� = + 100 , 100 , 100 , 100 , + 7 · h 4 100 � 71 � 100 , 23 100 , 37 100 , 33 5 100 , 48 C 2 = 100 , 100 �� 3 4 , 1 4 , 2 4 , 1 4 , 3 4 , 2 � � − 2 100 , − 3 2 100 , − 2 0 100 , − 2 �� = + 100 , 100 , − 2 · h 4 100 ✷✼ ✴ ✹✸

❚♦② ❡①❛♠♣❧❡ ✭❲■❚❍ ♥♦✐s❡✮ P❛r❛♠❡t❡rs 100 Z / Z = 1 1 4 Z / Z ⊕ 1 H = 25 Z / Z ✭✐s ❛ Z ✲♠♦❞✉❧❡✮ � 1 2 100 , 10 5 100 , 20 100 , 50 � h = 100 , 100 , 100 Dec h ✿ ❞❡❝♦♠♣♦s✐t✐♦♥ ✐♥ ❊✉r♦ ❝♦✐♥s Γ = 1 4 Z / Z ⊂ H ✿ ♠♦❞✉❧♦ ♦❢ t❤❡ ❝♦❞❡ ❙❛♠♣❧❡s � 31 � 100 , 16 100 , 63 100 , 46 100 , 89 0 C 1 = 100 , 100 �� 1 4 , 0 4 , 1 4 , 3 4 , 2 4 , 2 � � − 1 2 3 100 , − 1 1 1 �� = + 100 , 100 , 100 , 100 , + 7 · h 4 100 � 71 � 100 , 23 100 , 37 100 , 33 5 100 , 48 C 2 = 100 , 100 �� 3 4 , 1 4 , 2 4 , 1 4 , 3 4 , 2 � � − 2 100 , − 3 2 100 , − 2 0 100 , − 2 �� = + 100 , 100 , − 2 · h 4 100 ✷✼ ✴ ✹✸

❚♦② ❡①❛♠♣❧❡ ✭❲■❚❍ ♥♦✐s❡✮ ▼✉❧t✐♣❧✐❝❛t✐♦♥✿   71 / 100 23 / 100   37 / 100   Dec h ( C 1 , 1 ) · C 2 = [ 1 0 ] 0 0 1 1   5 / 100     33 / 100   48 / 100 � 9 � Dec h ( C 1 , 1 ) · C 2 = 100 ❱❡r✐✜❝❛t✐♦♥✿ ❞♦❡s ❡♥❝♦❞❡ 7 · ( − 2) = 11 mod 25 � 9 � 2 � �� 0 � �� = − + 11 · h 1 100 4 100 ✷✽ ✴ ✹✸

■♥t❡r♥❛❧ ♣r♦❞✉❝t ✭❝❧❛ss✐❝❛❧✮ ✳ ✳ ✳ Pr♦❞✉❝t ❊①t❡r♥❛❧ ♣r♦❞✉❝t ✭❢♦✉♥❞ ✐♥❞❡♣❡♥❞❡♥t❧② ❜② ❬❇P✶✻❪✮ ⊡ : TGSW × TLWE − → TLWE ( A, b ) �− → A ⊡ b = Dec h ,β,ǫ ( b ) · A ( µ A , µ b ) �− → µ A · µ b ✇❤❡r❡ Dec h ,β,ǫ ✐s t❤❡ ❛♣♣r♦①✐♠❛t❡ ❣❛❞❣❡t ❞❡❝♦♠♣♦s✐t✐♦♥ ✷✾ ✴ ✹✸

Pr♦❞✉❝t ❊①t❡r♥❛❧ ♣r♦❞✉❝t ✭❢♦✉♥❞ ✐♥❞❡♣❡♥❞❡♥t❧② ❜② ❬❇P✶✻❪✮ ⊡ : TGSW × TLWE − → TLWE ( A, b ) �− → A ⊡ b = Dec h ,β,ǫ ( b ) · A ( µ A , µ b ) �− → µ A · µ b ✇❤❡r❡ Dec h ,β,ǫ ✐s t❤❡ ❛♣♣r♦①✐♠❛t❡ ❣❛❞❣❡t ❞❡❝♦♠♣♦s✐t✐♦♥ ■♥t❡r♥❛❧ ♣r♦❞✉❝t ✭❝❧❛ss✐❝❛❧✮ ⊠ : TGSW × TGSW − → TGSW   A ⊡ b 1 ✳ ✳ ( A, B ) �− → A ⊠ B =   ✳   A ⊡ b ( k + 1 ) ℓ ( µ A , µ B ) �− → µ A · µ B ✷✾ ✴ ✹✸

Pr♦❞✉❝t µ A T-GSW η A µ A · µ b T-LWE � µ A � 1 η b + O ( η A ) µ b T-LWE η b � ❊rr ( A ⊡ b ) � ∞ ≤ ℓ ′ Nβη A + � µ A � 1 (1 + kN ) ǫ + � µ A � 1 η b ✇❤❡r❡ β ❛♥❞ ǫ ❛r❡ t❤❡ ♣❛r❛♠❡t❡rs ✉s❡❞ ✐♥ t❤❡ ❞❡❝♦♠♣♦s✐t✐♦♥ Dec h ,β,ǫ ( b ) ✳ ✸✵ ✴ ✹✸

❚❛❜❧❡ ♦❢ ❝♦♥t❡♥ts ✶ ❋✉❧❧② ❍♦♠♦♠♦r♣❤✐❝ ❊♥❝r②♣t✐♦♥ ❆♣♣❧✐❝❛t✐♦♥s ✷ ❚▲❲❊ ❚❤❡ r❡❛❧ t♦r✉s ▲❲❊ ❛♥❞ ❚▲❲❊ ✸ ❚●❙❲ ❛♥❞ t❤❡ ❡①t❡r♥❛❧ ♣r♦❞✉❝t ❊♥❝r②♣t✐♦♥ ❛♥❞ ●❛❞❣❡t ❚▲❲❊ ❛♥❞ ❚●❙❲ ✹ ❋❛st❡r ❇♦♦tstr❛♣♣✐♥❣ ●❛t❡ ❜♦♦tstr❛♣♣✐♥❣ ❙❡❝✉r✐t② ❛♥❛❧②s✐s ✺ ❈♦♥❝❧✉s✐♦♥ ✸✶ ✴ ✹✸

❲❡ r❡♣❧❛❝❡❞ ❛❧❧ t❤❡ ✐♥t❡r♥❛❧ ♣r♦❞✉❝ts ✐♥ t❤❡ ❜♦♦tstr❛♣♣✐♥❣ ♣r♦❝❡❞✉r❡ ✇✐t❤ t❤❡ ❡①t❡r♥❛❧ ♦♥❡✳ ❘❡s✉❧t✿ ✭✇✐t❤ ❢✉rt❤❡r ♦♣t✐♠✐③❛t✐♦♥s✮ ✇❡ ❤❛❞ ❛ s♣❡❡❞✲✉♣ ♦❢ ❛ ❢❛❝t♦r ✭❜♦♦tstr❛♣♣✐♥❣ ✐♥ s❡❝♦♥❞s✮ ❋❛st❡r ❜♦♦tstr❛♣♣✐♥❣ ❲❡ ❛♣♣❧✐❡❞ ♦✉r r❡s✉❧t t♦ t❤❡ ❢❛st ❜♦♦tstr❛♣♣✐♥❣ ♣r♦♣♦s❡❞ ❜② ❉✉❝❛s ❛♥❞ ▼✐❝❝✐❛♥❝✐♦ ✭❊✉r♦❝r②♣t ✷✵✶✺✮ ❬❉▼✶✺❪✿ ❤♦♠♦♠♦r♣❤✐❝ ◆❆◆❉ ❣❛t❡ ✇✐t❤ ❢❛st ❜♦♦tstr❛♣♣✐♥❣ ✐♥ ∼ 0 . 69 s❡❝♦♥❞s ✸✷ ✴ ✹✸

❋❛st❡r ❜♦♦tstr❛♣♣✐♥❣ ❲❡ ❛♣♣❧✐❡❞ ♦✉r r❡s✉❧t t♦ t❤❡ ❢❛st ❜♦♦tstr❛♣♣✐♥❣ ♣r♦♣♦s❡❞ ❜② ❉✉❝❛s ❛♥❞ ▼✐❝❝✐❛♥❝✐♦ ✭❊✉r♦❝r②♣t ✷✵✶✺✮ ❬❉▼✶✺❪✿ ❤♦♠♦♠♦r♣❤✐❝ ◆❆◆❉ ❣❛t❡ ✇✐t❤ ❢❛st ❜♦♦tstr❛♣♣✐♥❣ ✐♥ ∼ 0 . 69 s❡❝♦♥❞s ❲❡ r❡♣❧❛❝❡❞ ❛❧❧ t❤❡ ✐♥t❡r♥❛❧ ♣r♦❞✉❝ts ✐♥ t❤❡ ❜♦♦tstr❛♣♣✐♥❣ ♣r♦❝❡❞✉r❡ ✇✐t❤ t❤❡ ❡①t❡r♥❛❧ ♦♥❡✳ ❘❡s✉❧t✿ ✭✇✐t❤ ❢✉rt❤❡r ♦♣t✐♠✐③❛t✐♦♥s✮ ✇❡ ❤❛❞ ❛ s♣❡❡❞✲✉♣ ♦❢ ❛ ❢❛❝t♦r ∼ 12 ✭❜♦♦tstr❛♣♣✐♥❣ ✐♥ ∼ 0 . 052 s❡❝♦♥❞s✮ ✸✷ ✴ ✹✸

❇♦♦tstr❛♣♣✐♥❣ 1 2 3 1 4 4 0 ✸✸ ✴ ✹✸

❇♦♦tstr❛♣♣✐♥❣ 1 2 3 1 4 4 0 ✸✸ ✴ ✹✸

❇♦♦tstr❛♣♣✐♥❣ [Gentry09]-style bootstrap 1 2 3 1 4 4 0 ✸✸ ✴ ✹✸

❇♦♦tstr❛♣♣✐♥❣ [Gentry09]-style bootstrap 1 2 3 1 4 4 0 ✸✸ ✴ ✹✸

❇♦♦tstr❛♣♣✐♥❣ [DM15]-style bootstrap 1 2 3 1 4 4 0 ✸✸ ✴ ✹✸

●❛t❡ ❇♦♦tstr❛♣♣✐♥❣ false := LWE( − 1 1 8 ), noise < 16 1 2 3 1 4 4 − 1 1 8 8 0 ✸✹ ✴ ✹✸

●❛t❡ ❇♦♦tstr❛♣♣✐♥❣ 1 true := LWE(+ 1 1 8 ), noise < 2 16 3 1 4 4 − 1 1 8 8 0 ✸✹ ✴ ✹✸

●❛t❡ ❇♦♦tstr❛♣♣✐♥❣ c 1 c 2 + 1 2 = 3 1 4 4 − 1 1 8 8 0 ✸✹ ✴ ✹✸

●❛t❡ ❇♦♦tstr❛♣♣✐♥❣ NAND( c 1 , c 2 ) : 1 2 return false 3 1 4 4 return true − 1 1 8 8 0 ✸✹ ✴ ✹✸

●❛t❡ ❇♦♦tstr❛♣♣✐♥❣ NAND( c 1 , c 2 ) : 1 2 return false 3 1 4 4 return true − 1 1 8 8 0 ✸✹ ✴ ✹✸

●❛t❡ ❇♦♦tstr❛♣♣✐♥❣ [DM15/BR15]-(revisited) v i +1 1 2 v i 3 1 [ . . . ] 4 4 v 2 v 1 0 v 2 N − 1 v 0 ✸✹ ✴ ✹✸

✇✐t❤ ✱ ✇❤❡r❡ ❇❑ ✭ ✮ ✇❤❡♥ ✐s ❦♥♦✇♥ ✭ ✮ ✇❤❡♥ ✐s ✉♥❦♥♦✇♥ ✶ ▼✉❧t✐♣❧② ❜② ✷ ❋♦r ♠✉❧t✐♣❧② ❜② ❘♦t❛t❡ ❜② ♣♦s✐t✐♦♥s t❤❡ ❝♦❡✣❝✐❡♥ts ❍♦✇ t♦ r♦t❛t❡ ❜② ❄ ❇♦♦tstr❛♣♣✐♥❣ ❆❧❣♦r✐t❤♠ ✭❛♥✐♠❛t✐♦♥✮ ❇♦♦tstr❛♣♣✐♥❣ ❛❧❣♦r✐t❤♠ ♦❢ ( a , b ) ✶ ❙t❛rt ❢r♦♠ ✭❛ tr✐✈✐❛❧✮ TLWE ( v 0 + v 1 X + · · · + v N − 1 X N − 1 ) ❛ ✷ ❘♦t❛t❡ ✐t ❜② p = − ϕ s ( a , b ) ♣♦s✐t✐♦♥s ✸ ❊①tr❛❝t t❤❡ ❝♦♥st❛♥t t❡r♠ ✭✇❤✐❝❤ ❡♥❝r②♣ts v p ✮ ❛ N ❝♦❡❢s ♠♦❞ X N + 1 ❝❛♥ ❜❡ ✈✐❡✇❡❞ ❛s 2 N ❝♦❡❢s ♠♦❞ X 2 N − 1 s✳t✳ v N + i = − v i ✸✺ ✴ ✹✸

✇✐t❤ ✱ ✇❤❡r❡ ❇❑ ✭ ✮ ✇❤❡♥ ✐s ❦♥♦✇♥ ✭ ✮ ✇❤❡♥ ✐s ✉♥❦♥♦✇♥ ✶ ▼✉❧t✐♣❧② ❜② ✷ ❋♦r ♠✉❧t✐♣❧② ❜② ❘♦t❛t❡ ❜② ♣♦s✐t✐♦♥s t❤❡ ❝♦❡✣❝✐❡♥ts ❍♦✇ t♦ r♦t❛t❡ ❜② ❄ ❇♦♦tstr❛♣♣✐♥❣ ❆❧❣♦r✐t❤♠ ✭❛♥✐♠❛t✐♦♥✮ ❇♦♦tstr❛♣♣✐♥❣ ❛❧❣♦r✐t❤♠ ♦❢ ( a , b ) ✶ ❙t❛rt ❢r♦♠ ✭❛ tr✐✈✐❛❧✮ TLWE ( v 0 + v 1 X + · · · + v N − 1 X N − 1 ) ❛ ✷ ❘♦t❛t❡ ✐t ❜② p = − ϕ s ( a , b ) ♣♦s✐t✐♦♥s ✸ ❊①tr❛❝t t❤❡ ❝♦♥st❛♥t t❡r♠ ✭✇❤✐❝❤ ❡♥❝r②♣ts v p ✮ ❛ N ❝♦❡❢s ♠♦❞ X N + 1 ❝❛♥ ❜❡ ✈✐❡✇❡❞ ❛s 2 N ❝♦❡❢s ♠♦❞ X 2 N − 1 s✳t✳ v N + i = − v i ✸✺ ✴ ✹✸

✇✐t❤ ✱ ✇❤❡r❡ ❇❑ ✶ ▼✉❧t✐♣❧② ❜② ✷ ❋♦r ♠✉❧t✐♣❧② ❜② ✭ ✮ ✇❤❡♥ ✐s ❦♥♦✇♥ ✭ ✮ ✇❤❡♥ ✐s ✉♥❦♥♦✇♥ ❍♦✇ t♦ r♦t❛t❡ ❜② ❄ ❇♦♦tstr❛♣♣✐♥❣ ❆❧❣♦r✐t❤♠ ✭❛♥✐♠❛t✐♦♥✮ ❇♦♦tstr❛♣♣✐♥❣ ❛❧❣♦r✐t❤♠ ♦❢ ( a , b ) ✶ ❙t❛rt ❢r♦♠ ✭❛ tr✐✈✐❛❧✮ TLWE ( v 0 + v 1 X + · · · + v N − 1 X N − 1 ) ❛ ✷ ❘♦t❛t❡ ✐t ❜② p = − ϕ s ( a , b ) ♣♦s✐t✐♦♥s ✸ ❊①tr❛❝t t❤❡ ❝♦♥st❛♥t t❡r♠ ✭✇❤✐❝❤ ❡♥❝r②♣ts v p ✮ ❛ N ❝♦❡❢s ♠♦❞ X N + 1 ❝❛♥ ❜❡ ✈✐❡✇❡❞ ❛s 2 N ❝♦❡❢s ♠♦❞ X 2 N − 1 s✳t✳ v N + i = − v i ❘♦t❛t❡ ❜② p ♣♦s✐t✐♦♥s t❤❡ ❝♦❡✣❝✐❡♥ts c ∈ TLWE ✸✺ ✴ ✹✸

✇✐t❤ ✱ ✇❤❡r❡ ❇❑ ✶ ▼✉❧t✐♣❧② ❜② ✷ ❋♦r ♠✉❧t✐♣❧② ❜② ✭ ✮ ✇❤❡♥ ✐s ✉♥❦♥♦✇♥ ❍♦✇ t♦ r♦t❛t❡ ❜② ❄ ❇♦♦tstr❛♣♣✐♥❣ ❆❧❣♦r✐t❤♠ ✭❛♥✐♠❛t✐♦♥✮ ❇♦♦tstr❛♣♣✐♥❣ ❛❧❣♦r✐t❤♠ ♦❢ ( a , b ) ✶ ❙t❛rt ❢r♦♠ ✭❛ tr✐✈✐❛❧✮ TLWE ( v 0 + v 1 X + · · · + v N − 1 X N − 1 ) ❛ ✷ ❘♦t❛t❡ ✐t ❜② p = − ϕ s ( a , b ) ♣♦s✐t✐♦♥s ✸ ❊①tr❛❝t t❤❡ ❝♦♥st❛♥t t❡r♠ ✭✇❤✐❝❤ ❡♥❝r②♣ts v p ✮ ❛ N ❝♦❡❢s ♠♦❞ X N + 1 ❝❛♥ ❜❡ ✈✐❡✇❡❞ ❛s 2 N ❝♦❡❢s ♠♦❞ X 2 N − 1 s✳t✳ v N + i = − v i ❘♦t❛t❡ ❜② p ♣♦s✐t✐♦♥s t❤❡ ❝♦❡✣❝✐❡♥ts c ∈ TLWE ✭ X p · c ✮ ✇❤❡♥ p ✐s ❦♥♦✇♥ ✸✺ ✴ ✹✸

✇✐t❤ ✱ ✇❤❡r❡ ❇❑ ✶ ▼✉❧t✐♣❧② ❜② ✷ ❋♦r ♠✉❧t✐♣❧② ❜② ❍♦✇ t♦ r♦t❛t❡ ❜② ❄ ❇♦♦tstr❛♣♣✐♥❣ ❆❧❣♦r✐t❤♠ ✭❛♥✐♠❛t✐♦♥✮ ❇♦♦tstr❛♣♣✐♥❣ ❛❧❣♦r✐t❤♠ ♦❢ ( a , b ) ✶ ❙t❛rt ❢r♦♠ ✭❛ tr✐✈✐❛❧✮ TLWE ( v 0 + v 1 X + · · · + v N − 1 X N − 1 ) ❛ ✷ ❘♦t❛t❡ ✐t ❜② p = − ϕ s ( a , b ) ♣♦s✐t✐♦♥s ✸ ❊①tr❛❝t t❤❡ ❝♦♥st❛♥t t❡r♠ ✭✇❤✐❝❤ ❡♥❝r②♣ts v p ✮ ❛ N ❝♦❡❢s ♠♦❞ X N + 1 ❝❛♥ ❜❡ ✈✐❡✇❡❞ ❛s 2 N ❝♦❡❢s ♠♦❞ X 2 N − 1 s✳t✳ v N + i = − v i ❘♦t❛t❡ ❜② p ♣♦s✐t✐♦♥s t❤❡ ❝♦❡✣❝✐❡♥ts c ∈ TLWE ✭ X p · c ✮ ✇❤❡♥ p ✐s ❦♥♦✇♥ ✭ TGSW ( X p ) ⊡ c ✮ ✇❤❡♥ p ✐s ✉♥❦♥♦✇♥ ✸✺ ✴ ✹✸

✇✐t❤ ✱ ✇❤❡r❡ ❇❑ ✶ ▼✉❧t✐♣❧② ❜② ✷ ❋♦r ♠✉❧t✐♣❧② ❜② ❇♦♦tstr❛♣♣✐♥❣ ❆❧❣♦r✐t❤♠ ✭❛♥✐♠❛t✐♦♥✮ ❇♦♦tstr❛♣♣✐♥❣ ❛❧❣♦r✐t❤♠ ♦❢ ( a , b ) ✶ ❙t❛rt ❢r♦♠ ✭❛ tr✐✈✐❛❧✮ TLWE ( v 0 + v 1 X + · · · + v N − 1 X N − 1 ) ❛ ✷ ❘♦t❛t❡ ✐t ❜② p = − ϕ s ( a , b ) ♣♦s✐t✐♦♥s ✸ ❊①tr❛❝t t❤❡ ❝♦♥st❛♥t t❡r♠ ✭✇❤✐❝❤ ❡♥❝r②♣ts v p ✮ ❛ N ❝♦❡❢s ♠♦❞ X N + 1 ❝❛♥ ❜❡ ✈✐❡✇❡❞ ❛s 2 N ❝♦❡❢s ♠♦❞ X 2 N − 1 s✳t✳ v N + i = − v i ❘♦t❛t❡ ❜② p ♣♦s✐t✐♦♥s t❤❡ ❝♦❡✣❝✐❡♥ts c ∈ TLWE ✭ X p · c ✮ ✇❤❡♥ p ✐s ❦♥♦✇♥ ✭ TGSW ( X p ) ⊡ c ✮ ✇❤❡♥ p ✐s ✉♥❦♥♦✇♥ ❍♦✇ t♦ r♦t❛t❡ ❜② − ϕ s ( a , b ) = − b + � n i =1 a i s i ❄ ✸✺ ✴ ✹✸

✇✐t❤ ✱ ✇❤❡r❡ ❇❑ ✷ ❋♦r ♠✉❧t✐♣❧② ❜② ❇♦♦tstr❛♣♣✐♥❣ ❆❧❣♦r✐t❤♠ ✭❛♥✐♠❛t✐♦♥✮ ❇♦♦tstr❛♣♣✐♥❣ ❛❧❣♦r✐t❤♠ ♦❢ ( a , b ) ✶ ❙t❛rt ❢r♦♠ ✭❛ tr✐✈✐❛❧✮ TLWE ( v 0 + v 1 X + · · · + v N − 1 X N − 1 ) ❛ ✷ ❘♦t❛t❡ ✐t ❜② p = − ϕ s ( a , b ) ♣♦s✐t✐♦♥s ✸ ❊①tr❛❝t t❤❡ ❝♦♥st❛♥t t❡r♠ ✭✇❤✐❝❤ ❡♥❝r②♣ts v p ✮ ❛ N ❝♦❡❢s ♠♦❞ X N + 1 ❝❛♥ ❜❡ ✈✐❡✇❡❞ ❛s 2 N ❝♦❡❢s ♠♦❞ X 2 N − 1 s✳t✳ v N + i = − v i ❘♦t❛t❡ ❜② p ♣♦s✐t✐♦♥s t❤❡ ❝♦❡✣❝✐❡♥ts c ∈ TLWE ✭ X p · c ✮ ✇❤❡♥ p ✐s ❦♥♦✇♥ ✭ TGSW ( X p ) ⊡ c ✮ ✇❤❡♥ p ✐s ✉♥❦♥♦✇♥ ❍♦✇ t♦ r♦t❛t❡ ❜② − ϕ s ( a , b ) = − b + � n i =1 a i s i ❄ ✶ ▼✉❧t✐♣❧② ❜② X − b ✸✺ ✴ ✹✸