# A Quantum-Resistant FHE Framework for Privacy-Preserving Image Processing in the Cloud
## 3 Proposed Framework
### Phase 2: FHE Setup and SIMD Encryption  
Following secure key establishment, the FHE environment is initialized in a client-centric manner. The server first generates and sends only the public FHE parameters (e.g., polynomial degree and coefficient moduli) to the client (Algorithm 3). Crucially, these parameters contain no secret material. ```
0: Security parameter \(\lambda\geq 128\), client identifier \(\mathcal{C}_{ID}\)
0: Server context \(\mathcal{C}_{server}\), public params \(\Pi_{pub}\)
1: Initialize CKKS Parameters:
2:\(n\leftarrow\) 8192 [Polynomial degree for \(\lambda\)-bit security]
3:\(\mathbf{q}\leftarrow[q_{0},q_{1},q_{2},q_{3}]=[2^{31},2^{26},2^{26},2^{26}]\) [Modulus chain with equal middle primes]
4:\(\Delta\gets 2^{26}\) [Scale matches middle prime size]
5: Construct Parameter Set:
6:\(\Pi\leftarrow(n,\mathbf{q},\Delta,\lambda)\)
7: Generate FHE Context:
8:\(\mathcal{C}_{server}\leftarrow\textsc{InitializeCKKS}(\Pi)\)
9: Extract Public Parameters:
10:\(\Pi_{pub}\leftarrow\{\text{scheme},\,n,\mathbf{q},\Delta,\text{global\_scale}\}\) from \(\mathcal{C}_{server}\)
11: Security Validation:
12:if\(\textsc{ValidateSecurityLevel}(\Pi_{pub},\lambda)=\textsc{False}\)then
13:return\(\perp\) [Parameter validation failed]
14:endif
15:return\((\mathcal{C}_{server},\Pi_{pub})\)
```  
**Algorithm 3** Server-Side FHE Context Initialization  
The client receives these parameters and generates its own FHE key pair (\(pk_{FHE},sk_{FHE}\)), keeping the secret key \(sk_{FHE}\) private. To ensure the integrity of this process against errors or potential manipulation, the client performs a self-verification check, as detailed in Algorithm 4 (lines 15-17). This involves encrypting and immediately decrypting a known test vector to confirm that the key pair is valid before sending the public materials to the server. The image encryption phase then capitalizes on CKKS's slot-packing capabilities. The client flattens the entire image into a single vector and encrypts it with one call, producing a single, compact ciphertext that is sent to the server. ```
0: Public params \(\Pi_{pub}\), client identifier \(\mathcal{C}_{ID}\)
0: Client context \(\mathcal{C}_{client}\), keys \((pk,sk)\), eval keys \(evk\) or \(\perp\)
1: Context Initialization:
2:\(\mathcal{C}_{client}\leftarrow\textsc{InitializeCKKS}(\Pi_{pub})\)
3: Key Pair Generation:
4:\((pk,sk)\leftarrow\textsc{KeyGen}(\mathcal{C}_{client})\)
5: Evaluation Key Generation:
6:\(\mathcal{S}\leftarrow\{\pm 1,\pm 2,\pm 4,\pm 8,\pm 16,\pm 32,n/2\}\) {Comprehensive rotation set}
7:\(evk_{rot}\leftarrow\textsc{RotKeyGen}(sk,\mathcal{S})\)
8:\(evk_{retin}\leftarrow\textsc{RelNK}\textsc{KeyGen}(sk)\)
9:\(evk\leftarrow(evk_{rot},evk_{retin})\)
10: Key Validation:
11:\(\mathbf{m}_{test}\leftarrow(1.0,2.0,3.0)^{T}\) {Test vector}
12:\(ct_{test}\leftarrow\textsc{Enc}_{pk}(\mathbf{m}_{test})\)
13:\(\mathbf{m}^{\prime}\leftarrow\textsc{Dec}_{sk}(ct_{test})\)
14:if\(\|\mathbf{m}^{\prime}-\mathbf{m}_{test}\|_{2}>\epsilon\) where \(\epsilon=10^{-3}\)then
15:return\(\perp\) [Key validation failed]
16:endif
17:return\((\mathcal{C}_{client},pk,sk,evk)\)
```  
**Algorithm 4** Client-Side FHE Key Generation Protocol  
The client features the entire image into a single vector and encrypts it with one call, producing a single, compact ciphertext that is sent to the server.