[prev][parent][next]

B-4.2 Encryption

Suppose we have an (n −1)-degree polynomial M ∈R(n,t) whose coefficients represent the plaintext numbers to encrypt.

1.
Randomly pick a list of k (n −1)-degree polynomials {Ai}i=0k−1 ←$R⟨n,q⟩k as a one-time public key.
2.
Randomly pick a small polynomial E ←χσR⟨n,q⟩ as a one-time noise, whose n coefficients are small numbers in ℤq randomly sampled from the Gaussian distribution χσ.
3.
Scale M by Δ, which is to compute Δ ⋅M. This converts M ∈R⟨n,t⟩ into Δ ⋅M ∈R⟨n,q⟩.
4.
Compute B = ∑ ⁡ i=0k−1(Ai ⋅Si) + Δ ⋅M + E ∈R⟨n,q⟩.

The GLWE encryption formula is summarized as follows:

⟨Summary B-4.2⟩ GLWE Encryption

Initial Setup: Δ = ⌊q t⌋, {Si}i=0k−1 ←$R⟨n,2⟩k

Encryption Input: M ∈R⟨n,t⟩, {Ai}i=0k−1 ←$R⟨n,q⟩k, E ←χσR⟨n,q⟩

1.
Scale up M→ΔM  ∈R⟨n,q⟩
2.
Compute B = ∑ ⁡ i=0k−1(Ai ⋅Si) + ΔM + E  ∈R⟨n,q⟩
3.
𝖦𝖫𝖶𝖤S,σ(ΔM) = ({Ai}i=0k−1,B)  ∈R⟨n,q⟩k+1

[prev][parent][next]