Bootstrapping of FHE over the Integers with Large Message Space

<jats:p>For the decryption of the fully homomorphic encryption (FHE) over the integers with the message space <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M1"><mml:mrow><mml:msub><mml:mrow><mml:mi mathvariant="double-struck">Z</mml:mi></mml:mrow><mml:mrow><mml:mi>Q</mml:mi></mml:mrow></mml:msub></mml:mrow></mml:math>, Nuida and Kurosawa proposed a <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M2"><mml:msup><mml:mrow><mml:mi>Q</mml:mi></mml:mrow><mml:mrow><mml:mn mathvariant="normal">4</mml:mn></mml:mrow></mml:msup><mml:mi>λ</mml:mi></mml:math>-multiplicative-degree circuit to compute it at Eurocrypt 2015, where <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M3"><mml:mrow><mml:mi>λ</mml:mi></mml:mrow></mml:math> is the security parameter and the message size <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M4"><mml:mrow><mml:mi>Q</mml:mi></mml:mrow></mml:math> is a constant. Since the degree of the decryption circuit is polynomial in <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M5"><mml:mrow><mml:mi>Q</mml:mi></mml:mrow></mml:math>, the range of the message size <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M6"><mml:mrow><mml:mi>Q</mml:mi></mml:mrow></mml:math> is limited. In this work, we solve this open problem as long as <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M7"><mml:mrow><mml:mi>Q</mml:mi></mml:mrow></mml:math> is large enough (larger than <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" id="M8"><mml:mrow><mml:mi>λ</mml:mi></mml:mrow></mml:math>). We represent the decryption circuit as a arithmetic polynomial of multiplicative degree <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M9"><mml:mn mathvariant="normal">108</mml:mn><mml:mo>·</mml:mo><mml:mi>λ</mml:mi><mml:mo> </mml:mo><mml:mi mathvariant="normal">l</mml:mi><mml:mi mathvariant="normal">o</mml:mi><mml:msup><mml:mrow><mml:mi mathvariant="normal">g</mml:mi></mml:mrow><mml:mrow><mml:mn mathvariant="normal">3</mml:mn></mml:mrow></mml:msup><mml:mi>λ</mml:mi></mml:math>, which is independent of the message size <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M10"><mml:mrow><mml:mi>Q</mml:mi></mml:mrow></mml:math> except a constraint <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M11"><mml:mi>Q</mml:mi><mml:mo>></mml:mo><mml:mi>λ</mml:mi></mml:math>. Moreover, the bootstrapping process requires only <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M12"><mml:mi>O</mml:mi><mml:mo stretchy="false">(</mml:mo><mml:mi>λ</mml:mi><mml:mo>·</mml:mo><mml:mrow><mml:mrow><mml:mi mathvariant="normal">log</mml:mi></mml:mrow><mml:mo>⁡</mml:mo><mml:mrow><mml:mi>λ</mml:mi></mml:mrow></mml:mrow><mml:mo stretchy="false">)</mml:mo></mml:math> number of multiplications to implement the decryption circuit, which is significantly lower than <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M13"><mml:mi>O</mml:mi><mml:mo stretchy="false">(</mml:mo><mml:msup><mml:mrow><mml:mi>λ</mml:mi></mml:mrow><mml:mrow><mml:mn mathvariant="normal">4</mml:mn></mml:mrow></mml:msup><mml:mo stretchy="false">)</mml:mo></mml:math> of Nuida and Kurosawa’s work. We also show the efficiency of the FHE scheme with message space <mml:math xmlns:mml="http://www.w3. org/1998/Math/MathML" id="M14"><mml:mrow><mml:msub><mml:mrow><mml:mi mathvariant="double-struck">Z</mml:mi></mml:mrow><mml:mrow><mml:mi>Q</mml:mi></mml:mrow></mml:msub></mml:mrow></mml:math> compared to the FHE scheme with binary message space. As a result, we have that the former is preferable. </jats:p>