## 5 Parameter and Performance Analysis and Comparison  
In this paper, the settings for parameters such as the RLWE assumption parameters \((N,Q,\chi)\), the plaintext modulus \(p\), and the decomposition degree \(t\) for the gadget decompositions can follow the classical choices used in advanced schemes such as [5; 16; 17; 19; 23], as no modifications have been made to these parameters. Tables 1 and 2 present a comparison of our schemes with several prominent recent MKFHE schemes. Schemes [16; 17] are BGV-type MKFHE schemes of the same type as ours, while Scheme [19] is a BFV(CKKS)-type MKFHE scheme, which is of a similar type to ours. For our batched scheme \(\textbf{BMK}-\textbf{BGV}\), we focus on its amortized performance. A notable aspect that is difficult to display in tables is that the input ciphertexts in \(\textbf{MK}-\textbf{BGV}\). **CText** and \(\textbf{BMK}-\textbf{BGV}\). **CText**, as well as \(\textbf{MK}-\textbf{BGV}\). **Eval** and \(\textbf{BMK}-\textbf{BGV}\). **Eval**, can either be fresh or intermediate results from any homomorphic operations. This demonstrates the multi-hop property of our schemes. Unlike the schemes in [16] and [17], which also support multi-hop capabilities, their designs require a predefined upper bound \(K\) on the number of parties (keys) in the system, whereas our schemes \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Scheme** & **Public Key Size** & **Ciphertext Size** & **Evaluation Key Size** & **Security** \\ \hline BP16 [15] & \(nN^{2}\lceil\log Q\rceil(1+N\lceil\log Q\rceil)\) & \(nN\lceil\log Q\rceil\) & \((2n-1)N^{2}\lceil\log Q\rceil\) & IND-CPA with circular security assumption \\ CZW17 [16] & \(4(L+1)tnN\lceil\log Q\rceil\) & \(2 nN\lceil\log Q\rceil\) & \(4 tn^{2}N\lceil\log Q\rceil\) & IND-CPA \\ LZY+19 [17] & \(4(L+1)tnN\lceil\log Q\rceil\) & \((n+1)N\lceil\log Q\rceil\) & \(t(n+1)^{2}N\lceil\log Q\rceil\) & IND-CPA with circular security assumption \\ CCS19 [18] & \(tnNb\) & \((nN+1)b\) & \(tn^{2}(N+1)Nb\) & IND-CPA with circular security assumption \\ CDKS19 [19] & \(tnN\lceil\log Q\rceil\) & \((n+1)N\lceil\log Q\rceil\) & \(3 tnN\lceil\log Q\rceil\) & IND-CPA with circular security assumption \\ ZCC+21 [24] & \((t+1)nN\lceil\log PQ\rceil\) & \(2N\lceil\log PQ\rceil\) & \(8N\lceil\log PQ\rceil\) & IND-CPA with circular security assumption \\ \(\textbf{MK}-\textbf{BGV}\) & \((L+1)tnN\lceil\log Q\rceil\) & \((n+1)N\lceil\log Q\rceil\) & \(4 tnN\lceil\log Q\rceil\) & IND-CPA \\
**BMK** – **BGV** & \((L+1)tnN\lceil\log Q\rceil\)\(\xi^{-1}\) & \((n+1)N\lceil\log Q\rceil\)\(\xi^{-1}\) & \(4 tnN\lceil\log Q\rceil\)\(\xi^{-1}\) & IND-CPA \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of parameter sizes (in bits) and properties of recent mainstream schemes. Here, \(n\) represents the number of parties, \(N\) is the dimension of the (R)LWE assumption, \(t\) is the decomposition degree, \(Q\) is the ciphertext modulus, \(b\) is the torus precision, \(P\) is the raising modulus factor, \(L\) is the circuit depth, and \(\xi\) denotes the number of packed plaintexts. Figure 1: Multi-party privacy-preserving computation model of the \(\textbf{BMK}-\textbf{BGV}\) scheme. impose no such limitation. Therefore, our schemes are actually closer to the stronger \"fully dynamic\" property as proposed in [15], but unlike [15], we do not require the introduction of the expensive bootstrapping procedure. However, due to the level-based BGV-type design, our schemes do require predefined maximum computation depths \(L\), which can be of arbitrary polynomial magnitude. Nonetheless, the size of the extended ciphertexts in our schemes increases only linearly with the number of parties, the same as in [15]. Additionally, in [16; 17], each public key is set to a very large size to accommodate their auxiliary GSW-type MKFHE schemes.