## 5 Parameter Setting and Efficiency Analysis  
The batch scheme in this paper is mainly based on the RLWE problem, and the difficulty of the RLWE problem is analyzed according to [26].  
Let \(q\) denote the modulus and \(d\) represent the degree of polynomial ring \(R\), then let \(\sigma^{2}\) denote the variance of the probability distribution \(\chi\).  
Definition 4: ([9]). Let an \(m\)-dimensional lattice \(\Lambda\) based on \(B\) have a factor \(\delta^{m}\) satisfying \(\|b\|<\delta^{m}\cdot det(\Lambda)^{1/m}\), where \(b\) is the shortest vector of \(B\), then \(\delta^{m}\) is called the Hermite root factor.  
Theorem 4: ([9]) Given \(\delta\), the time required to reduce the lattice basis with the Hermite factor \(\delta^{m}\) mainly depends on \(\delta\)  
Theorem 5: ([9]). _For a Hermite factor \(\delta^{m}\), the length of the shortest vector is computed to be \(\alpha\cdot\frac{q}{\sigma}\leq 2^{\sqrt{d\log_{2}{(q)\log_{2}{(\delta)}}}}\). The base time is about \(\log_{2}(time)=\frac{1.8}{\log_{2}(\delta)}-110\), where \(\alpha=\sqrt{\ln(1/\epsilon)/\pi}\), and \(\epsilon\) is the advantage in distinguishing attacks._  
According to the above theorem, it can be quickly deduced that for a fixed \(d\) and a fixed security level, as long as \(\sigma_{k}>\alpha^{1-\sqrt{k}}\cdot q^{k-\sqrt{k}}\cdot\sigma^{\sqrt{k}}\) is selected, an effective parameter pair \((q,\sigma)\) can be transformed into another effective parameter pair \(\left(q^{k},\sigma^{k}\right)\), where \(k>1\) is the arbitrary real number. During key switching, \(B_{k}\) also uses this bound.  
To obtain the parameters that guarantee that the homomorphism scheme of a circuit with depth \(L\) can be executed, we choose the degree \(d\) and then calculate the effective value of \(q\). Let \(B=10\cdot\sigma\), then the distribution \(\chi\) can be considered \(B\) bounded. According to Theorem 3, the maximum multiplication depth that Batch.RFHE can handle satisfies:  
\[10\cdot 4\cdot\delta_{R}{}^{L}\cdot(\delta_{R}+1)^{L+1}<\frac{q}{\sigma} \tag{4}\]  
In the above inequality, we assume that the noise introduced by key switching is less than that after the first multiplication. Therefore, we can get:  
\[\alpha\cdot 10\cdot 4\cdot\delta_{R}{}^{L}\cdot(\delta_{R}+1)^{L+1}<2^{2\sqrt{d \log_{2}{(q)}}\log_{2}{(\delta)}} \tag{5}\]  
According to Theorem 5, if we set the security level at \(\lambda\), then we can set the time as \(2^{\lambda}\). Then, the minimum \(\delta\) can be obtained as \(\log_{2}(\delta)=1.8/(\lambda+110)\). Assuming \(\lambda=128\), we obtain \(\delta\simeq 1.0052\), \(\log_{2}(\delta)=0.0076\). If we let \(\epsilon=2^{-64}\), we get \(\alpha\simeq 3.758\). To ensure that the circuit with depth \(L\) can be executed, the sizes of \(d\) and module \(q\) at different circuit depths are shown in Table 1.  
Next, we compare our batch FHE scheme with the FV12 [13] and MB18 [28] schemes. The comparison shows that there is obvious optimization. In Table 2, all parameter sizes are in bits.  
Compared with the FV12 scheme, since we do not rely on the circular security assumption, the scheme requires \(\mathbf{L}\) evaluation keys for the circuit depth \(\mathbf{L}\). The evaluation key size of our scheme is slightly larger than that of the FV12 scheme, but we can encrypt more plaintext bits at a time, making it more secure. Compared with the MB18 scheme (\(l=\lfloor log_{T}q\rfloor\), \(T<q\) is used to reduce noise), the number of encrypted plaintext bits is the same, but the size of the secret key and the evaluation key in our scheme is better.