Towards an efficient LWE‐based fully homomorphic encryption scheme

IET Information SecurityVolume 16, Issue 4 p. 235-252 ORIGINAL RESEARCHOpen Access Towards an efficient LWE-based fully homomorphic encryption scheme Uddipana Dowerah, Uddipana Dowerah orcid.org/0000-0002-0903-0949 Department of Electronics and Electrical Engineering, Indian Institute of Technology Guwahati, Guwahati, IndiaSearch for more papers by this authorSrinivasan Krishnaswamy, Corresponding Author Srinivasan Krishnaswamy srinikris@iitg.ac.in orcid.org/0000-0001-9714-7399 Department of Electronics and Electrical Engineering, Indian Institute of Technology Guwahati, Guwahati, India Correspondence Srinivasan Krishnaswamy, Department of Electronics and Electrical Engineering, Indian Institute of Technology Guwahati, Assam 781039, India. Email: srinikris@iitg.ac.inSearch for more papers by this author Uddipana Dowerah, Uddipana Dowerah orcid.org/0000-0002-0903-0949 Department of Electronics and Electrical Engineering, Indian Institute of Technology Guwahati, Guwahati, IndiaSearch for more papers by this authorSrinivasan Krishnaswamy, Corresponding Author Srinivasan Krishnaswamy srinikris@iitg.ac.in orcid.org/0000-0001-9714-7399 Department of Electronics and Electrical Engineering, Indian Institute of Technology Guwahati, Guwahati, India Correspondence Srinivasan Krishnaswamy, Department of Electronics and Electrical Engineering, Indian Institute of Technology Guwahati, Assam 781039, India. Email: srinikris@iitg.ac.inSearch for more papers by this author First published: 28 April 2022 https://doi.org/10.1049/ise2.12052AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract The security of most early fully homomorphic encryption schemes was based on the hardness of the Learning with Errors (LWE) problem. These schemes were inefficient in terms of per gate computations and public-key size. More efficient schemes were later developed based on the hardness of the Ring-LWE (RLWE) problem. While the hardness of the LWE problem is based on the hardness of the approximate shortest vector problem (GapSVPγ) over regular lattices, the hardness of the RLWE problem is based on the hardness of the approximate shortest vector problem over ideal lattices. As of now, it has not been proved that the (GapSVPγ) problem over ideal lattices is as difficult as the corresponding problem over regular lattices. In this work, the authors propose a multi-bit levelled fully homomorphic encryption scheme using multivariate polynomial evaluations whose security depends on the hardness of the LWE problem. In terms of per gate computation cost, this scheme is more efficient than existing LWE-based schemes. Further, for an appropriate choice of parameters, the per computation cost for homomorphic multiplication can be made asymptotically comparable to RLWE-based schemes in a parallel computing environment. For homomorphic multiplication, the scheme uses a polynomial-based technique that does not require relinearization (and key switching). 1 INTRODUCTION Homomorphic encryption is the ability to evaluate mathematical functions on encrypted data without decryption. In other words, if ϕ denotes a function to be evaluated on the plaintexts m1 and m2, then homomorphic encryption is the ability to compute ϕ(m1, m2) from their respective encryptions E n c ( m 1 ) and E n c ( m 2 ) without the knowledge of m1 and m2. An encryption scheme is said to be fully homomorphic if functions of arbitrary complexity can be evaluated on the ciphertexts. If an encryption scheme can evaluate functions of only limited complexity, then it is said to be somewhat homomorphic. Following the initial construction of a Fully Homomorphic Encryption (FHE) scheme [1], similar schemes were proposed in [2-9]. These schemes are collectively called the first generation of FHE. In these schemes, a somewhat homomorphic scheme is converted to a fully homomorphic one using bootstrapping. Bootstrapping is used to reduce the noise in a ciphertext before it becomes too large to decrypt the ciphertext correctly. However, the complexity of bootstrapping is very high and, as an alternative, the second generation schemes [10-14] starting with the Brakerski-Gentry-Vaikuntanathan scheme called BGV [10] were proposed. In these constructions, a levelled FHE scheme can be obtained from a somewhat homomorphic one without bootstrapping. The security of most of the second generation schemes depends on the hardness of the Learning with Errors (LWE) problem [15] or its ring variant Ring Learning with Errors (RLWE) [16]. The BGV scheme can be instantiated based on either of these problems. It employs relinearization (or key switching) and modulus switching for ciphertext size reduction and noise reduction, respectively, to obtain a levelled FHE scheme without bootstrapping. Further, a scale-invariant levelled FHE scheme without modulus switching was proposed in [11] followed by its ring variant [12] called the BFV scheme. These schemes require a public evaluation key in order to perform homomorphic multiplication. Further, the third generation schemes [17-19] based on the Gentry-Sahai-Waters scheme (GSW) [17] were proposed without the expensive relinearization procedure. It is based on the approximate eigenvector method and the ciphertexts in GSW are square matrices. Homomorphic addition and multiplication are roughly matrix addition and multiplication, respectively. Therefore, it removes the need for an evaluation key. The noise growth in ciphertexts is controlled using a technique called flattening, and hence, a scale-invariant levelled FHE scheme can be obtained without modulus switching. Further, it was observed in [20] that the noise during homomorphic multiplication in GSW grows in an asymmetric fashion and this can be used to achieve bootstrapping with weaker hardness assumptions. A simpler variant of GSW with an efficient bootstrapping technique was then proposed in [21]. GSW is conceptually simpler than previous LWE-based schemes. However, matrix multiplication in GSW induces a large performance overhead and the size of the ciphertexts becomes a bottleneck to its efficiency. The performance of GSW is improved significantly by relying the hardness on the RLWE problem. Efficient ring-LWE variants of the GSW scheme were developed in [18, 19, 22]. The GSW scheme [17] together with BGV [10] and BFV [11, 12] are standard constructions of homomorphic encryption [23]. A levelled FHE scheme can be obtained without bootstrapping using these constructions. However, the performance overhead of a levelled FHE scheme depends on the maximum multiplication level L. A pure FHE scheme where the performance overhead is independent of L can only be obtained using bootstrapping. Various optimizations like SIMD (Single Instruction Multiple Data) style batching [6, 24] and faster-bootstrapping techniques were proposed to improve the efficiency of the second-generation schemes [7, 25-28]. Further improvements of second-generation schemes include the CKKS scheme [29] that introduces homomorphic encryption for approximate numbers, and various software and hardware implementations of the BFV scheme [30-36]. Optimizations for GSW and its variants mainly focus on achieving faster-bootstrapping techniques [18, 19, 22, 37]. For instance, a single bootstrapping can be executed in less than a second in [18], which was further sped up to less than a 0.1 s in [19]. All of these improvements and optimizations have led to the development of various FHE libraries [18, 30, 31, 38, 39] and compilers [40-46]. Other extensions of levelled FHE constructions include identity-based levelled FHE schemes [47-49], multi-identity and multi-key levelled FHE schemes [50, 51], levelled certificateless FHE schemes [52, 53], leakage resilient levelled FHE schemes [54] etc. 1.1 Related work The starting point of second-generation LWE-based schemes such as [10, 11, 55] is the initial cryptosystem proposed in [15, 56]. The ciphertext and the secret key are vectors of size O ( n ) and the plaintext is recovered by computing their inner product. Homomorphic multiplication is performed by taking the tensor product of two ciphertexts. The corresponding secret key is the tensor product of the original secret key with itself. As a result, homomorphic multiplication squares the size of the ciphertext. This blow up in ciphertext size can be scaled back down to its original size by relinearizing the ciphertext after multiplication. Relinearization is the process of compressing the tensored ciphertext encrypted under the tensored secret key (each of size O ( n 2 ) ) to a ciphertext of size O ( n ) encrypted under a new secret key of size O ( n ) . It requires multiplying the tensored ciphertext by an O ̃ ( n 2 ) × n matrix and the evaluation key must consist of L such matrices in order to evaluate a circuit of depth L. In [10, 55], homomorphic multiplication squares the noise and is countered using modulus switching introduced in [55]. In [11], the noise grows linearly and a levelled FHE scheme can be obtained without modulus switching. The RLWE variant of the BGV scheme [10] performs better than its LWE counterpart. A depth L arithmetic circuit can be evaluated in O ̃ ( n ⋅ L 3 ) time in the RLWE setting compared to O ̃ ( n 3 ⋅ L 5 ) per-gate computation in the LWE setting. Similarly, the BFV scheme [12] performs better than the LWE variant [11] (homomorphic multiplication can be executed in O ̃ ( n log n ) time as compared to O ̃ ( n 3 ⋅ L 4 ) in the LWE variant), which led to extremely efficient software and hardware implementations of BFV [30-36] in the RLWE setting. The method of packing multiple plaintext bits in a single ciphertext was introduced in [24]. It was observed that RLWE (or other ideal lattice assumptions) based ciphertexts can pack multiple plaintext bits and, thus, support SIMD style homomorphic operations. Similar operations were introduced in [57] for LWE-based schemes [10, 11] using the method of [58]. We will refer to [57] as the BGH13 scheme. Another multi-bit levelled FHE scheme similar to BGH13 was proposed in [59]. Both BGH13 and [59] use key switching to obtain a levelled FHE scheme. An LWE-based GSW variant was proposed in [60] that encrypts matrices and supports SIMD homomorphic operations. Similar to other LWE based GSW schemes, it primarily focusses on optimizing the bootstrapping operation and has large ciphertexts. Other schemes that use SIMD style batching to achieve efficient FHE schemes are [6, 59-63]. A family of schemes called Polly Cracker [64] also uses multivariate polynomials and naturally inherits homomorphic properties. More efficient variants include [65, 66]. However, all Polly Cracker based constructions are vulnerable to linear-algebra-based attacks and attacks using efficient Gröbner basis construction algorithms [67]. In an attempt to overcome these limitations, noisy variants of Polly Cracker were proposed in [68-70]. However, in all variants of Polly Cracker, the size of the ciphertext expands exponentially after homomorphic multiplication. Another fully homomorphic encryption scheme using multivariate polynomials was proposed in [71], which was broken immediately in [72]. In this work, our primary aim is to construct an LWE-based levelled FHE scheme without relinearization using multivariate polynomial evaluations whose performance asymptotically approaches that of the RLWE-based schemes. Remark 1.An attempt to use polynomials for homomorphic multiplication was made in [73]. However, this process required an increase in the ciphertext size with each multiplication. 1.2 Our contribution The security of the most efficient implementations of homomorphic encryption schemes, such as those described in [30-36], is based on the hardness of the RLWE problem. While the hardness of the LWE problem is based on the hardness of the approximate shortest vector problem (GapSVPγ) over regular lattices, the hardness of the RLWE problem is based on the hardness of the approximate shortest vector problem over ideal lattices. Although it is widely believed that the GapSVP problem over ideal lattices is difficult to solve, to the best of the authors' knowledge, it has not been proved that this problem is as difficult as the corresponding problem over regular lattices. Further, a recent result proposed in [74] has claimed that the RLWE problem over two-to-power cyclotomic integer rings is not hard. If this claim turns out to be true, then all the RLWE-based constructions will be affected. This motivates the need to improve the performance of LWE-based constructions. This work is a step in the direction of creating an efficient LWE-based scheme whose performance is comparable to that of RLWE-based schemes in terms of per gate time complexity. In this work, we propose a multi-bit levelled fully homomorphic encryption scheme based on multivariate polynomial evaluations. The security of the scheme depends on the hardness of the LWE problem. Here, multiple plaintext bits are encrypted in a single ciphertext. Homomorphic addition and multiplication can be performed simultaneously on multiple plaintext bits. Therefore, the proposed scheme supports SIMD style operations. Schemes with this property include the ones described in [6, 24, 57, 58]. As in RLWE-based schemes, the secret key here is related to polynomial ideals and multiplicative homomorphism is inherited from the corresponding property of polynomial rings. Multiplication is performed by evaluating a bilinear map on the ciphertexts. This map is represented by a 3-way tensor, which is given as the public evaluation key for multiplication. We introduce the proposed scheme as a symmetric key scheme and then extend it to a public-key variant. The proposed scheme is first presented in a manner similar to the LWE variants of BGV [10] and BFV [11, 12]. However, unlike these schemes, homomorphic multiplication does not increase the size of the ciphertexts in the proposed scheme. Therefore, there is no need for relinearization. The noise associated with the ciphertexts increases only linearly with each homomorphic operation. Hence, a scale-invariant levelled FHE scheme can be obtained without modulus switching. The per gate computation of the scheme is O ( n 2 ⋅ L 2 ) where L denotes the multiplicative depth of the circuit. Although, in this form, this scheme is more efficient than other LWE based schemes, its performance is not comparable to that of RLWE-based schemes (a comparison of the per-gate computation time with previous LWE-based schemes is given in Table 1). We finally suggest a few modifications to improve the efficiency of this scheme with respect to the per gate computation time of this scheme. In order of magnitude terms, the per gate time complexity of the modified scheme is comparable to that of RLWE-based schemes in a parallel environment. TABLE 1. Per gate computation overhead of LWE-based schemes Scheme Message bits Per-gate computation BGV [10] 1 O ̃ ( n 3 L 5 ) Bra [11] 1 O ̃ ( n 3 L 4 ) GSW [17] 1 O ̃ ( ( n L ) 2.37 ) BGH13 [57] O ( n ) O ̃ ( n 3 L 2 ) HAO15 [60] O ( n ) O ̃ ( n 2 L 2 ) Proposed scheme O ( n ) O ̃ ( n 2 L 2 ) 1.3 Paper organization The remainder of the paper is organised as follows. Section 2 contains the preliminaries for the proposed work. In Section 3, we propose a levelled fully homomorphic encryption scheme based on the hardness of the LWE problem. In Section 4, we discuss the public-key variant of the scheme. Finally, in Section 5, we suggest a few modifications to improve the performance of the scheme. 2 PRELIMINARIES 2.1 Notations λ denotes the security parameter. The set of integers and natural numbers are denoted by Z and N, respectively. R and Q denote the set of real and rational numbers, respectively. Given a set S, x → $ S means that x is sampled uniformly at random from S. For a real number x, ⌊x⌋, ⌈x⌉ and ⌊x⌉ denote the rounding of x down, up or to the nearest integer, respectively. For a prime q, Z q denotes a finite field of cardinality q and its elements are represented by the integers in the interval [ − ⌊ q 2 ⌋ , ⌊ q 2 ⌋ ]. For some a ∈ Z, we use (a mod q) and [a]q interchangeably to denote the modular reduction of a by q into the interval ( − q / 2 , q / 2 ] ∩ Z. We use Z q [ x 1 , … , x n ] to denote the ring of polynomials in indeterminates x1, …, xn with coefficients in Z q . Given polynomials f 1 , … , f t ∈ Z q [ x 1 , … , x n ] , 〈f1, …, ft〉 denotes the ideal generated by f1, …, ft. For a polynomial ring R and an ideal I, R ≤ r and I ≤ r denote the set of polynomials in R and I, respectively, of degree at most r for some r ∈ N. We use 'log' to denote logarithm to the base 2. Vectors are denoted by lowercase bold letters and matrices by uppercase bold letters. The ith row or column of a matrix A is denoted using A(i, :) or A(:, i), respectively. A matrix with row vectors a1, a2, …, an is denoted using A = [ a 1 ; a 2 ; … ; a n ]. Tensors are denoted using uppercase bold script letters A , B , … etc. A vector v is usually a row vector unless stated otherwise. We use (v, w) to denote the vector [ v ‖ w ] . The one norm of a vector v is denoted by ‖ v ‖ 1 and the infinity norm by ‖ v ‖ ∞ . The inner product of two vectors v1, v2 is denoted using 〈 v 1 , v 2 〉 ≔ v 1 v 2 T . The notation v1 ⊙ v2 denotes the component-wise product of v1 and v2. A function n e g l ( x ) : N → R is called negligible if, for every c ∈ N, there exists an integer nc such that | n e g l ( x ) | < 1 x c for all x > nc. We write negl(⋅) to denote an arbitrary negligible function. 2.2 Learning with Errors Learning with Errors is the problem of solving a system of noisy linear equations over Z q . The LWE problem was introduced in [15] and is an extension of the Learning Parity with Noise (LPN) problem. It can also be seen as the problem of decoding random linear codes. The LWE problem can be defined as follows. Definition 1.(Learning with Errors). For positive integers q , n ∈ N, let X be a probability distribution on Z and s be a secret vector in Z q n , chosen uniformly at random. Given polynomially many samples of the form ( a i , b i ) ∈ Z q n × Z q where ai is sampled uniformly at random from Z q n and bi ≔ 〈ai, s〉 + ei (mod q) for some e i ← X, the search variant of the learning with errors problem, denoted by L W E n , q , X , is to output the vector s ∈ Z q n with overwhelming probability. The decisional variant of the problem denoted by D L W E n , q , X is to distinguish LWE samples from samples chosen uniformly at random from Z q n × Z q . The DLWE problem has been shown to be equivalent to the LWE problem [56]. In terms of the game playing framework adopted from [75], the LWE problem (search and decision) can be defined in terms of the games shown in Figures 1 [70] and 2. The advantage of a PPT adversary A in solving the L W E n , q , X problem is given by A d v n , q , X LWE , A ( λ ) ≔ P r [ LWE n , q , X A ( λ ) = 1 ] (1) FIGURE 1Open in figure viewerPowerPoint L W E n , q , X game FIGURE 2Open in figure viewerPowerPoint D L W E n , q , X game The advantage of a DLWE adversary can be similarly defined. The noise in the LWE problem is usually sampled from a discrete Gaussian distribution. Definition 2.(Discrete Gaussian distribution). For α > 0 and q = q(n), X α is a discrete Gaussian distribution on Z with mean zero and standard deviation σ ≔ αq if for an integerx in (−q/2, q/2] P r [ x ← $ X α ] ≔ exp ( − π x 2 / σ 2 ) ∑ y ∈ ( − q / 2 , q / 2 ] ∩ Z exp ( − y 2 / σ 2 ) (2) A distribution over the integers is said to be bounded when it takes values within a specific interval. Definition 3.(B-bounded distribution). A distribution X over the set of integers is said to be B-bounded if P r [ | x | > B | x ← X ] = n e g l ( n ) (3) 2.2.1 Hardness of LWE Given that X in LWE is a discretized Gaussian distribution with σ ≥ 2 n , statistically indistinguishable from a B-bounded distribution for some appropriate B, there exists a quantum reduction of LWE to approximating the decisional Shortest Vector Problem (GapSVPγ) [15, 56] where γ is called the approximation factor and depends on the ratio q / B ( γ = ( q / B ) ⋅ O ̃ ( n ) ) . Further, the authors in [76, 77] gave classical reductions of LWE from the worst-case lattice problems for an exponential modulus and a polynomial modulus, respectively. The best-known algorithms for GapSVPγ require 2 Ω ̃ ( n / log γ ) time [78, 79]. The hardness of LWE can be summarised in terms of the following theorem, which summarises the results in [56, 76, 77]. We state the results in terms of the bound B as stated in [11, 17]. Theorem 2.[56, 76, 77]. Let q = q(n) be prime and let B ≥ ω ( l o g n ) ⋅ n . Then, there exists an efficiently sampleable B-bounded distribution X such that if there is an efficient algorithm that solves the average-case D L W E n , q , X problem, then There exists an efficient quantum algorithm for solving Gap S V P O ∼ ( n ⋅ q / B ) on any n-dimensional lattice [56]. If q ≥ 2n/2, then there exists an efficient classical algorithm that solves the Gap S V P O ∼ ( n ⋅ q / B ) problem on any n-dimensional lattice [76]. There exists an efficient classical algorithm that solves the Gap S V P O ∼ ( n ⋅ q / B ) problem on any lattice of dimension n [77]. 2.3 Tensors Let ϕ T : V 1 × V 2 × ⋯ × V n → W be a multilinear map, where V 1 , … , V n and W are finite-dimensional vector spaces. Given fixed bases for the vector spaces, ϕ T can be represented by a multidimensional array T called a tensor. The order of a tensor is the number of indices required to represent a component of the array. Slices in a tensor are two-dimensional sections generated by fixing all indices except two. In a third-order tensor, matrices generated by keeping the last index fixed are called frontal slices. Therefore, a third-order tensor T I 1 × I 2 × I 3 is an I3 array of I1 × I2 matrices. An order-3 tensor T can be used to represent a bilinear map ϕ : V × V → V, on the vector space V. If dim ( V ) = n and {b1, …, bn} denotes a basis for V, then ϕ ( b i , b j ) = ∑ i = 1 n ∑ j = 1 n ∑ k = 1 n T i j k ⋅ b k (4) For a fixed k, T k ≔ ( T i j k ) 1 ≤ i , j ≤ n represents a unique matrix of order n × n. For 1 ≤ k ≤ n, Tk forms the frontal slices of the tensor T. The bilinear map ϕ then acts on two arbitrary vectors v 1 = [ v 1 , 1 v 2 , 1 ⋯ v n , 1 ] , v 2 = [ v 1 , 2 v 2 , 2 ⋯ v n , 2 ] ∈ V as ϕ ( v 1 , v 2 ) = ∑ i , j = 1 n v i , 1 ϕ ( b i , b j ) v j , 2 = [ v 1 T 1 v 2 T … v 1 T n v 2 T ] (5) 2.3.1 The n-mode product The n-mode product defines multiplication of a tensor by a matrix. In general, the elementwise n-mode product of a tensor T I 1 × I 2 × ⋯ × I n × ⋯ × I N and a matrix M J × I n is defined as: ( T × M ) i 1 i 2 ⋯ i n − 1 j i n + 1 ⋯ i N = ∑ i n = 1 I n T i 1 i 2 ⋯ i N M j , i n (6) The resultant tensor is of the order of (I1 × I2 ×⋯× In−1 × J × In+1 ×⋯× IN). 3 THE PROPOSED LEVELLED FHE SCHEME In this section, we discuss the construction of the levelled FHE scheme. For simplicity, we present a private key variant of this scheme. Subsequently, we explain its conversion to a public-key scheme. Let R be the polynomial ring R ≔ Z q [ x 1 , … , x v ] / 〈 x 1 q − x 1 , … , x v q − x v 〉 where q = q(λ) is prime. Let us consider an ideal I of the ring R. For some r < q ∈ N, R ≤ r is a vector space of dimension N ≔ ( v + r r ) over Z q . Let I ≤ r denote the set of polynomials in I with degree ≤ r. Then, I ≤ r is a subspace of R ≤ r . Let n be the dimension of I ≤ r . A polynomial f ∈ R ≤ r evaluated at all points of Z q v generates a vector in Z q q v . The set of such vectors obtained by evaluating all polynomials in R ≤ r constitutes an N-dimensional subspace of Z q q v . Similarly, evaluating polynomials in I ≤ r gives us an n-dimensional subspace of Z q q v . We, therefore, have the following lemma. Lemma 3.Let R = Z q [ x 1 , … , x v ] / 〈 x 1 q − x 1 , … , x v q − x v 〉. We can find n + 1 distinct points { z i ∈ Z q v } 1 ≤ i ≤ n + 1 such that evaluating polynomials in I ≤ r ⊆ R ≤ r with dim ( I ≤ r ) ≔ n at (z1, …, zn+1) spans an n-dimensional subspace, S I , of the vector space Z q n + 1 . We choose a set of n + 1 evaluation points { z 1 , … , z n + 1 } ∈ Z q v , which satisfy the following conditions: Every vector in Z q n + 1 can be got by evaluating a polynomial in R ≤ r at (z1, …, zn+1). Every vector in Z q n can be got by evaluating a polynomial in I ≤ r at (z1, …, zn). Because of the conditions imposed on (z1, …, zn+1), there exists a vector in ( S I ) ⊥ , which is of the form [ s 1 … s n 1 ]. 3.1 The basic Encryption scheme We describe the basic encryption scheme in terms of the following algorithms (the homomorphic operations are described separately in Section 3.2). For some ℓ ∈ N with ℓ > n, the plaintext space is {0, 1}ℓ−n and the ciphertexts are vectors in Z q ℓ . Further, we restrict ourselves to the case where I is a principal ideal. Setup(1λ, 1L): Takes as input the security parameter λ and a parameter L and outputs n = n(λ, L), ℓ = ℓ(λ, L), modulus q = q(λ, L) and noise distribution X = X ( λ , L ) such that | X | ≤ B. Here, L denotes the depth of the circuit that can be homomorphically evaluated. Let p a r a m = ( n , ℓ , q , X ) . KeyGen(param): Choose two positive integers v and r′ such that n = ( v + r ′ r ′ ) . Note that the set of polynomials in v variables having degree less than or equal to r′ is an n-dimensional vector space. Choose n distinct points, z1, …, zn, from Z q v such that every vector in Z q n can be got by evaluating a polynomial in R ≤ r ′ at (z1, …, zn). Now, the evaluation of any polynomial in R ≤ r ′ at any point in Z q v is a linear combination of its evaluations at z1, …, zn. Choose the point zn+1 such that this linear combination has all non-zero coefficients. Further, zn+1 should be chosen such that every vector in Z q n + 1 can be got by evaluating a polynomial in R ≤ r ′ + 1 at (z1, …, zn+1). From the uniform distribution of polynomials in v variables with degree less than or equal to r′ + 1 that do not evaluate to zero at the points z1, …, zn+1, randomly choose polynomials g1, g2, …, gℓ−n. Let I 1 , I 2 , … , I ℓ − n be the respective ideals generated by these polynomials. Note that each I ≤ ( r ′ + deg ( g i ) ) i is an n-dimensional subspace of I i . For 1 ≤ i ≤ ℓ − n, let S i be the vector subspace got by evaluating the polynomials in I ≤ ( r ′ + deg ( g i ) ) i at z1, …, zn+1. As we have already seen, each S i is an n-dimensional subspace of Z q n + 1 . For 1 ≤ i ≤ ℓ − n, calculate the vector s i ∈ Z q n such that (si, 1) is perpendicular to S i . Generate a matrix S ∈ Z q ( ℓ − n ) × n whose ith row is si, that is, S = [s1; s2; …; sℓ−n]. Choose a matrix R ∈ Z q ℓ × ℓ such that R is of the form R ≔ [ R 1 n × n | 0 n × ( ℓ − n ) R 2 ( ℓ − n ) × n | I ℓ − n ] (7)where R 1 ∈ Z q n × n is a full rank matrix and the entries of R2 are chosen uniformly at random from Z q . Iℓ−n denotes the identity matrix of size ℓ − n. The secret key is sk = (S, R1, R2). The public parameters are n, ℓ and q. Encrypt(param, sk, m): To encrypt a message m ∈ {0,1}ℓ−n, sample a vector y, uniformly at random from Z q n and a vector e = ( 0 , e n + 1 , … , e ℓ ) ∈ Z q ℓ , where 0 denotes the zero vector of order n and each ej is chosen independently from the distribution X for n + 1 ≤ j ≤ ℓ. Let p be the vector given by p = ( 0 , m ) = ( 0 , m n + 1 , … , m ℓ ) ∈ Z q ℓ . If S enc ≔ [ I n − S T ] ∈ Z q n × ℓ , then the ciphertext can be computed as: c = ( p ⋅ ⌊ q 2 ⌋ + y ⋅ S enc + e ) R mod q ∈ Z q ℓ (8) Given any y ∈ Z q n , we can find polynomials f 1 ∈ I ≤ ( r ′ + deg ( g 1 ) ) 1 , … , f ℓ − n ∈ I ≤ ( r ′ + deg ( g ℓ − n ) ) ℓ − n such that their evaluations at the points z1, …, zn are the respective entries of y (all these polynomials evaluate to the same values at these points). Therefore, the last ℓ − n