RLWE

We assume the ciphertext is a polynomial, e.g., the ciphertext polynomial is taken from the encryption scheme NTRU over RLWE, our design method also can be applied to construct FHE.

Both the first two exist in LWE-based encryption scheme and RLWE-based encryption scheme, while only the last one exists in the NTRU over RLWE where s is a secret polynomial.

Note that RLWE encryption also has the similar form.

(ii) RLWE.KeyGen(params): for input parameters M, let N = [phi](M) and choose a random sparse s [left arrow] [{0, [+ or -]1}.sup.N].

(iii) RLWE.Enc(m, pk): for the input plaintext m = [[SIGMA].sub.i][m.sub.i][X.sup.i] [member of] [R.sub.t], choose a small polynomial v [member of] R and two Gaussian polynomials [e.sub.0], [e.sub.1] [left arrow] R, and output the ciphertext ct:

(iv) RLWE.Dec(ct, sk): given the ciphertext ct = ([c.sub.0], [c.sub.1]), output the plaintext m:

(v) RLWE.Add([ct.sub.1], [ct.sub.2], [ct.sub.3], sk): given three ciphertexts [ct.sub.1], [ct.sub.2], [ct.sub.3] with the same secret key sk, output the ciphertext ct = [ct.sub.1], [ct.sub.2], [ct.sub.3] [member of] [R.sup.2.sub.Q].

Conversion technique can change an RLWE ciphertext of m = [[SIGMA].sub.i][m.sub.i][X.sup.i] [member of] [R.sub.t] into an

In this paper, we use its RLWE version introduced by Ducas and Micciancio [23], and its encryption algorithm is given below:

(i) RGSW.ParamsGen(-): given the same parameters and secret key s as in the RLWE scheme, set the decomposition base B0 and exponent d0 satisfying [mathematical expression not reproducible].

Reference [17] defines a hybrid multiplication between an RLWE ciphertext ct [member of] [R.sup2.sub.Q] and an RGSW ciphertext CT [mathematical expression not reproducible].