D-4.1 Encoding and Decoding

BGV uses almost the same plaintext encoding scheme as BFV as described in Summary D-2.2.5 in §D-2.2.5, with the only difference that the scaling factor Δ = q0 t is not applied to the plaintext polynomial M(X) like BFV does. Instead, BGV applies its own scaling factor Δ = t to the noise polynomial E(X) whenever it encrypts a new ciphertext (will be explained in §D-4.2).

The following is BGV’s encoding and decoding scheme.

Summary D-4.1 BGV’s Encoding and Decoding

Input: An n-dimensional integer modulo t vector v = (v0,v1,,vn1) tn

Encoding:

Convert v tn into m tn by applying the transformation m = W~ InR v n

, where W~ is a basis of the n-dimensional vector space crafted as follows:

W~ = [ 1 1 1 1 1 1 (ωJ(n2 1)) (ωJ(n2 2)) (ωJ(0)) (ωJ(n2 1)) (ωJ(n2 2)) (ωJ(0)) (ωJ(n2 1))2 (ωJ(n2 2))2 (ωJ(0))2 (ωJ(n2 1))2 (ωJ(n2 2))2 (ωJ(0))2 (ωJ(n2 1))n1 (ωJ(n2 2))n1 (ωJ(0))n1 (ωJ(n2 1))n1 (ωJ(n2 2))n1 (ωJ(0))n1 ]

# where ω = gt1 2n mod t (g is a generator of t×)

The final output is M = i=0n1miXi  t[X](Xn + 1), which we can also treat as

M = i=0n1miXi  q[X](Xn + 1) during encryption/decryption later, because the initial fresh coefficients mi are guaranteed to be smaller than any q where q = {q0,q1,,qL}.

Decoding: For the plaintext polynomial M = i=0n1miXi, compute v = W~m, where

W~ = [ 1 (ωJ(0)) (ωJ(0))2 (ωJ(0))n1 1 (ωJ(1)) (ωJ(1))2 (ωJ(1))n1 1 (ωJ(2)) (ωJ(2))2 (ωJ(2))n1 1 (ωJ(n 2 1)) (ωJ(n 2 1))2 (ωJ(n 2 1))n1 1 (ωJ(0)) (ωJ(0))2 (ωJ(0))n1 1 (ωJ(1)) (ωJ(1))2 (ωJ(1))n1 1 (ωJ(2)) (ωJ(2))2 (ωJ(2))n1 1 (ωJ(n 2 1)) (ωJ(n 2 1))2 (ωJ(n 2 1))n1 ]