## 3 Building Block
### Optimizing the Key Switching  
The key switching technology was first proposed in the BGV [11] scheme, which is usually used after a homomorphic evaluation of the ciphertext to solve the problem of the dimensions of the ciphertext expanding after the tensor product. This technology converts the long ciphertext that can be decrypted by the key \(s_{1}\cdot s_{1}\) into a short ciphertext \(c_{2}\) that can be decrypted by another key \(s_{2}\). Some form of a key \(s_{1}\cdot s_{1}\) is encrypted under the key \(s_{2}\) as a hint, which is called the evaluation key, to complete this transformation. The noise introduced in the conversion process is compressed using BitDecomp technology. BitDecomp has low efficiency in the binary expansion of polynomials. Therefore, the FHE scheme based on RLWE will not transplant the key switching technology based on LWE into RLWE. The re-linearization technology is used to compress the ciphertext dimensions without changing the key. With the re-linearization technology, it is also necessary to use the evaluation key to assist in the completion of the ciphertext compression. However, this evaluation key is a masking version containing the secret key, which is neither a real sample of the RLWE distribution nor a real encryption method. The scheme relies on a weak circular security assumption that the scheme is still secure even if the adversary obtains the evaluation key, which is not strictly proven. Moreover, there are problems that the size of the key is inversely proportional to the noise introduced by the re-linearization process, and the re-linearization process requires multiple multiplication evaluations. In the following, we propose a new key switching technology based on RLWE, which does not need to use the BitDecomp technology, meaning we can replace the key to avoid the circular security assumption. We use the'modulus scaling' method to reduce the noise using a large modulus. There is some performance loss due to the security enhancement, but our approach has more advantages during storage. Since we have proven in Section 2.2 that the key \(s\) can be selected with a small noise distribution, we can further reduce the size of our evaluation key. Our key switching method includes two processes. First, SwitchKeyGen\((\mathbf{s_{1}},\mathbf{s_{2}},p)\) inputs two keys and a large integer \(p\), and the output key \(s_{2}\) encrypts the key \(s_{1}\) by \(p\) times as the evaluation key \(\mathbf{W_{s_{1}\to s_{2}}}\). The modulus of the key is also amplified to accommodate additional noise. SwitchKey\((\mathbf{W_{s_{1}\to s_{2}}},\mathbf{c_{s_{1}}})\) inputs the evaluation key and the ciphertext \(\mathbf{c_{s_{1}}}\) encrypted under the key \(\mathbf{s_{1}}\) and outputs the new ciphertext \(\mathbf{c_{s_{2}}}\) encrypted under the key \(\mathbf{s_{2}}\). The ciphertext \(\mathbf{c_{s_{1}}}\) and the ciphertext \(\mathbf{c_{s_{2}}}\) are encrypted for the same plaintext message with the same modulus. * SwitchKeyGen\((\mathbf{s_{1}},\mathbf{s_{2}},p)\) : Input two keys \(\mathbf{s_{1}}\in R_{q}^{n_{1}},\mathbf{s_{2}}\in R_{q}^{n_{2}}\) and a large integer \(p\). Let \(Q=p\cdot q\). Uniformly sample a matrix composed of polynomials \(\mathbf{A_{s_{1}\to s_{2}}}\gets R_{Q}^{n_{1}\times n_{2}}\) and an error vector \(\mathbf{e_{s_{1}\to s_{2}}}\leftarrow\chi^{n_{1}}\), where \(\chi^{n_{1}}\) is the noise distribution over \(R_{Q}^{n_{1}}\). The output is a matrix of polynomials. 1. Compute \(\mathbf{b_{s_{1}\to s_{2}}}=\left[\mathbf{A_{s_{1}\to s_{2}}}\cdot\mathbf{s_{2}}+\mathbf{e_{s_{1 }\to s_{2}}}+p\cdot\mathbf{s_{1}}\right]_{Q}\in R_{Q}^{n_{1}}\). 2. Output the evaluation key \(\mathbf{W_{s_{1}\to s_{2}}}\).