Lattice Part 7: Gadget Decomposition and Fully Homomorphic Encryption

maocred@gmail.com (Halois) — Thu, 25 Jul 2024 12:00:00 +0800

Reading: Peikert’s wide-angle survey for the lattice backbone¹, Brakerski’s FHE survey for the leveled-to-full control argument², and the Gentry / BGV / BV / GSW / FV papers for the actual mechanism³⁴⁵⁶⁷. Beyond Parts 0-3, the only extra objects needed here are introduced locally: noisy LWE-style decryptions, structured ring or module arithmetic, gadget bases, and evaluation keys. Part 7 is where those objects become one controlled evaluation procedure.

The procedure fails at a very specific point. Addition keeps decryption inside the same noisy linear relation. Multiplication does not. It lifts the decryption equation from a linear secret-key basis to a higher-degree basis, enlarges the ciphertext object, and spends decoding margin at the same time. If FHE is to support general evaluation, it needs a control layer exactly at that break.

That control layer is gadget decomposition plus evaluation keys. Once that interface is explicit, key switching becomes a noisy basis change, relinearization becomes the special case that removes post-multiplication secret-key degree, and the leveled-versus-fully-homomorphic split becomes a question of whether the noise budget can be managed forever or only up to a fixed depth.²

Key Switching on As it was

Lattice Part 7: Gadget Decomposition and Fully Homomorphic Encryption