A New Gadget Decomposition Algorithm with Less Noise Growth in HE Schemes

Abstract

A gadget decomposition algorithm can invert a specific gadget matrix and produce an output with specific statistical properties. Such algorithms are commonly used in GSW-type homomorphic encryption schemes, like TFHE, to enable homomorphic multiplication on ciphertexts while controlling noise growth.

In this paper, we propose a new decomposition algorithm that has lower noise growth compared to existing algorithms. Our work is inspired by Genise et al.’s algorithm [EUROCRYPT 2018] and can be considered an improved version of their algorithm. Our decomposition procedure is designed using the idea of Babai’s nearest plane algorithm. Our experimental result show that both the noise growth and efficiency are superior to Genise et al.’s algorithm, and Zhang-Yu’s algorithm [PKC 2022].

Appendices

A Nearest Plane Algorithm

Babai’s Nearest Plane Algorithm [3] is given in Algorithm 3. The inputs for this algorithm is a lattice basis $\textbf{B}$, its GSO $\tilde{\textbf{B}}$, and a target $\textbf{t}\in \mathbb {R}^n$. It returns a lattice point $\textbf{x}$ such that $\textbf{x}-\textbf{t}\in \mathcal {P}_{1/2}(\mathcal {\textbf{B}})$. The correctness can be checked by represented $\textbf{x}$ and $\textbf{t}$ in the GSO basis $\tilde{\textbf{B}}$. One can verify that the coordinate (coefficient of $\tilde{\textbf{b}}_i$) of $\textbf{x}-\textbf{t}$ is $c_i-\lfloor c_i\rceil <1/2$.

B Decomposition in CRT Form

For $q=\Pi _{j=1}^rq_j$, each coprime factor $q_j$ fix the base-$b_j$ gadget vector $\textbf{g}_j^T=(1,b_j,\cdots ,b_j^{k_j-1})$ with $k_j=\lceil log_{b_j} (q_j)\rceil$. An element $u\in \mathbb {Z}_q$ can be represented as its Chinese Remainder Theorem form (CRT form) as ($u\mod q_1,\cdots ,u\mod q_r)=(u_1,\cdots ,u_r)\in \mathbb {Z}_{q_1}\times \cdots \times \mathbb {Z}_{q_r}$. Then, for this CRT form, the decomposition algorithm can be performed for every $\textbf{g}^{-1}_j$. Samping in CRT form for $(u_1,\cdots ,u_r)$ is given in Algorithm 4. The result is given in the following theorem.

Theorem 4

Let q have factorization $q=\Pi _{j=1}^rq_j$ into coprime factors $\{q_j\}$, $(b_j)_{j=1}^r$ be an r-tuple of base such that $b_j<q_j$, and let $k=\sum k_j$ with $k_j=\lceil log_{b_j}q_j\rceil$. Then, there exists subgaussian decomposition algorithm can be performed in-parallel with r processors, each using time and space $O(k_i)$ and with parameter at most $\frac{max_j(b_j)+1}{2}\sqrt{2\pi }$.

Since except for the $\textbf{g}^{-1}_j$ component, the Algorithm 4 is same with the Algorithm 4 in [13], for more details about the decomposition in CRT form, please see [13].