GLWE Ciphertext-to-Plaintext Addition

Suppose we have a GLWE ciphertext

C

and a new plaintext polynomial

Λ

as follows:

C = {𝖦𝖫𝖶𝖤}_{S, σ} (Δ M) = (A_{1}, A_{2}, \dots, A_{k - 1}, B) \in R_{⟨ n, q ⟩}^{k + 1}

$⟨$ Summary C-2 $⟩$ GLWE Homomorphic Addition with a Plaintext

${𝖦𝖫𝖶𝖤}_{S, σ} (Δ M) + Δ Λ$

$= ({A_{i}^{⟨ 1 ⟩}}_{i = 0}^{k - 1}, B^{⟨ 1 ⟩}) + Δ Λ$

$= ({A_{i}^{⟨ 1 ⟩}}_{i = 0}^{k - 1}, B^{⟨ 1 ⟩} + Δ Λ)$

$= {𝖦𝖫𝖶𝖤}_{S, σ} (Δ (M + Λ))$

This means that a plaintext polynomial to a TFHE ciphertext and decrypting it gives the same result as adding two original plaintexts.

Proof.

1.

Since

B = \sum_{i = 0}^{k - 1} (A_{i} \cdot S_{i}) + Δ \cdot M + E

$B + Δ \cdot Λ = \sum_{i = 0}^{k - 1} (A_{i} \cdot S_{i}) + Δ \cdot M + E + Δ \cdot Λ = \sum_{i = 0}^{k - 1} (A_{i} \cdot S_{i}) + Δ \cdot (M + Λ) + E$

This means that $(A_{1}, A_{2}, . . . A_{k - 1}, B + Δ Λ)$ form the ciphertext ${𝖦𝖫𝖶𝖤}_{S, σ} (Δ (Λ + M))$

2.

Thus,

{𝖦𝖫𝖶𝖤}_{S, σ} (Δ M) + Δ Λ

= (A_{0}, A_{1}, . . . A_{k - 1}, B + Δ Λ)

= ({A_{i}^{⟨ 1 ⟩}}_{i = 0}^{k - 1}, B + Δ Λ)

= {𝖦𝖫𝖶𝖤}_{S, σ} (Δ (M + Λ))

□

C-2 GLWE Ciphertext-to-Plaintext Addition