d04_d05 small fix

d04-bgv.tex

@@ -283,7 +283,7 @@ \subsection{Modulus Switch}
 \noindent \textbf{- Reference 3:} 
 \href{https://eprint.iacr.org/2012/099.pdf}{Homomorphic Evaluation of the AES Circuit}~\cite{bgv-modswitch3}
 
-Remember that the requirement of modulus switch is that while we change the ciphertext modulus from $q$ to $\hat q$, it should decrypt to the same plaintext $M$. BGV's modulus switch is similar to that of the RLWE modulus switch (\autoref{subsec:modulus-switch-rlwe}), but there is an additional requirement, because BGV applies the scaling factor $\Delta$ not to plaintext $M$, but to noise $E$. In the case of BFV or CKKS, their decryption process only needs to round off the noise in the low-digit area. However, in the case of BGV, the plaintext is in the low-digit area and its decryption process has to remove the noise in the higher-bit area by modulo-$t$ reduction (i.e., the plaintext modulus). More concretely, BGV's modulus switch from $(A, B) \bmod q_{l}$ $\rightarrow$  $(\hat{A}, \hat{B}) \bmod \hat{q}$ should satisfy the decryption relation such that $((\hat{A} \cdot S + \hat{B}) \bmod \hat{q}) \bmod t = M$. In BGV's modulus switch, $\hat{q}$ does not have to be one of the multiplicative levels of the ciphertext, and $\hat{q}$ only needs to satisfy the relationship: $\hat{q}$ and $q_l$ are co-prime, $\hat{q} < q_l$ and $\hat{q} \equiv 1 \bmod t$. BGV's modulus switch procedure is as follows:
+Remember that the requirement of modulus switch is that while we change the ciphertext modulus from $q$ to $\hat q$, it should decrypt to the same plaintext $M$. BGV's modulus switch is similar to that of the RLWE modulus switch (\autoref{subsec:modulus-switch-rlwe}), but there is an additional requirement, because BGV applies the scaling factor $\Delta$ not to plaintext $M$, but to noise $E$. In the case of BFV or CKKS, their decryption process only needs to round off the noise in the low-digit area. However, in the case of BGV, the plaintext is in the low-digit area and its decryption process has to remove the noise in the higher-bit area by modulo-$t$ reduction (i.e., the plaintext modulus). More concretely, BGV's modulus switch from $(A, B) \bmod q_{l}$ $\rightarrow$  $(\hat{A}, \hat{B}) \bmod \hat{q}$ should satisfy the decryption relation such that $((\hat{A} \cdot S + \hat{B}) \bmod \hat{q}) \bmod t = M$. In BGV's modulus switch, $\hat{q}$ does not have to be one of the multiplicative levels of the ciphertext, and $\hat{q}$ only needs to satisfy the relationship: $\hat{q} < q_l$ and $\hat{q} \equiv 1 \bmod t$. BGV's modulus switch procedure is as follows:
 
 $ $
 
@@ -414,7 +414,7 @@ \subsection{Modulus Switch}
 
 $ $
 
-For successful decryption, every coefficient of the resulting polynomial of the above expression has to be within the range $\mathbb{Z}_{\hat{q}}$ (which means that $K\cdot\hat{q}$ has successfully reduced $(A' + H_A)\cdot S + B' + H_B$ modulo $\hat{q}$). The first term $\dfrac{\hat{q}}{q_{l}}\cdot(A\cdot S + B \bmod q_l)$ can be viewed as the original ciphertext \textsf{ct}'s noise (with the plaintext message) scaled down by $\dfrac{\hat{q}}{q_l}$. The coefficients of the second term $H_A \cdot S$ are also smaller, because $H_A \in \mathbb{Z}_t$ and $S \in \mathbb{Z}_3$. The coefficients of the third term $H_B$ are also small, because $H_B \in \mathbb{Z}_t$. The coefficients of the last term $- \dfrac{\epsilon'_A\cdot S + \epsilon'_B}{q_{l}}$ are also small, because $\dfrac{\epsilon'_A}{q_l}$ and $\dfrac{\epsilon'_B}{q_l}$ are $\in \mathbb{Z}_{\frac{q_l}{\hat{q}}}$. 
+For successful decryption, every coefficient of the resulting polynomial of the above expression has to be within the range $\mathbb{Z}_{\hat{q}}$ (which means that $K\cdot\hat{q}$ has successfully reduced $(A' + H_A)\cdot S + B' + H_B$ modulo $\hat{q}$). The first term $\dfrac{\hat{q}}{q_{l}}\cdot(A\cdot S + B \bmod q_l)$ can be viewed as the original ciphertext \textsf{ct}'s noise (with the plaintext message) scaled down by $\dfrac{\hat{q}}{q_l}$. The coefficients of the second term $H_A \cdot S$ are also small, because $H_A \in \mathbb{Z}_t$ and $S \in \mathbb{Z}_3$. The coefficients of the third term $H_B$ are also small, because $H_B \in \mathbb{Z}_t$. The coefficients of the last term $- \dfrac{\epsilon'_A\cdot S + \epsilon'_B}{q_{l}}$ are also small, because $\dfrac{\epsilon'_A}{q_l}$ and $\dfrac{\epsilon'_B}{q_l}$ are $\in \mathbb{Z}_{\frac{q_l}{\hat{q}}}$. 
 
 $ $
 
@@ -446,7 +446,7 @@ \subsection{Modulus Switch}
 
 \begin{tcolorbox}[title={\textbf{\tboxlabel{\ref*{subsec:bgv-modulus-switch}} BGV's Modulus Switch}}]
 
-Suppose we have the current ciphertext modulus $q_l$ and new ciphertext modulus $\hat{q}$ where $q_l \equiv \hat{q} \equiv 1 \bmod t$, $\hat{q} < q_l$, and $\hat{q}$ and $\hat{q_l}$ are co-prime. Therefore, $\hat{q}$ may or may not be one of the ciphertext moduli comprising a BGV ciphertext's multiplicative level moduli $q_0, q_1, \cdots, q_L$.
+Suppose we have the current ciphertext modulus $q_l$ and new ciphertext modulus $\hat{q}$ where $q_l \equiv \hat{q} \equiv 1 \bmod t$ and $\hat{q} < q_l$. Therefore, $\hat{q}$ may or may not be one of the ciphertext moduli comprising a BGV ciphertext's multiplicative level moduli $q_0, q_1, \cdots, q_L$.
 
 $ $
 
@@ -634,7 +634,7 @@ \subsection{Modulus Bootstrapping}
 
 \begin{enumerate}
 
-\item \textbf{\underline{Modulus Switch} from \boldmath$q_l \rightarrow \hat{q}$:} BFV's bootstrapping initially switches the ciphertext modulus from $q \rightarrow p^{\varepsilon-1}$ where $q \gg p^\varepsilon > t = p$. On the other hand, BGV's bootstrapping switches the ciphertext modulus to $\hat{q}$ that is a special modulus satisfying the relation: $\hat{q} \equiv 1 \bmod p^\varepsilon$ and $\hat{q} > p^\varepsilon$ (where $p^\varepsilon$ will be explained in the next step). In order for a modulus switch from $q_l \rightarrow \hat{q}$ (i.e., the special modulus) to be possible, the prime factor(s) comprising $\hat{q}$ have to be congruent with $q_{0}, \cdots, q_L \bmod t$, so that we can do \textsf{ModRaise} from $q_l \rightarrow q_l\cdot \hat{q}$ and then a modulus switch from $q_l\cdot \hat{q} \rightarrow \hat{q}$ (based on the technique learned in \autoref{subsec:bgv-modulus-switch}). Eventually, this step's modulus switch transforms the ciphertext $(A, B) \bmod q_l$ to $(\hat{A}, \hat{B}) \bmod \hat{q}$, during which the plaintext modulus (i.e., noise's scaling factor) stays the same. 
+\item \textbf{\underline{Modulus Switch} from \boldmath$q_l \rightarrow \hat{q}$:} BFV's bootstrapping initially switches the ciphertext modulus from $q \rightarrow p^{\varepsilon-1}$ where $q \gg p^\varepsilon > t = p$. On the other hand, BGV's bootstrapping switches the ciphertext modulus to $\hat{q}$ that is a special modulus satisfying the relation: $\hat{q} \equiv 1 \bmod p^\varepsilon$ and $\hat{q} > p^\varepsilon$ (where $p^\varepsilon$ will be explained in the next step). In order for a modulus switch from $q_l \rightarrow \hat{q}$ (i.e., the special modulus) to be possible, the prime factor(s) comprising $\hat{q}$ have to be congruent with $q_{0}, \cdots, q_L \bmod t$, so that we can do a modulus switch from $q_l\cdot \hat{q} \rightarrow \hat{q}$ (based on the technique learned in \autoref{subsec:bgv-modulus-switch}). Eventually, this step's modulus switch transforms the ciphertext $(A, B) \bmod q_l$ to $(\hat{A}, \hat{B}) \bmod \hat{q}$, during which the plaintext modulus (i.e., noise's scaling factor) stays the same. 
 
 $ $
 
@@ -738,7 +738,7 @@ \subsection{Modulus Bootstrapping}
 
 $ $
 
-\item \textbf{\textsf{\underline{Noise Term Re-interpretation}}:} The output of the \textsf{SlotToCoeff} step is $\textsf{RLWE}_{S, \sigma}(M + K''p)$, which also contains some noise term $E'p$ generated during the homomorphic operations of step $2 \sim 6$. Therefore, we can view the $K''p$ term in the plaintext as part of the noise of the ciphertext. In other words, we can view $\textsf{RLWE}_{S, \sigma}(M + K''p)$ with some noise term $E'p$ as a ciphertext $\textsf{RLWE}_{S, \sigma}(M)$ with the noise term $E'p + K''p = (E' + K'')\cdot p$. This step does not require any additional computation. The size of the coefficients of $K''$ is upper-bounded because the operations of the \textsf{CoeffToSlot}, digit extraction, and \textsf{SlotToCoeff} steps are fixed. With a proper setup of the cryptographic parameters of BGV, we can guarantee that the noise-to-ciphertext modulus ratio always gets decreased after BGV's bootstrapping (i.e., $\dfrac{||E + K'||_{\infty}}{q_L} < \dfrac{||E' + K''||_{\infty}}{q_l} < \dfrac{||E||_{\infty}}{\hat{q}}$, where $||P||_\infty$ denotes the maximum absolute coefficient value of polynomial $P$).
+\item \textbf{\textsf{\underline{Noise Term Re-interpretation}}:} The output of the \textsf{SlotToCoeff} step is $\textsf{RLWE}_{S, \sigma}(M + K''p) \bmod q_{l'}$, which also contains some noise term $E'p$ generated during the homomorphic operations of step $2 \sim 6$. Therefore, we can view the $K''p$ term in the plaintext as part of the noise of the ciphertext. In other words, we can view $\textsf{RLWE}_{S, \sigma}(M + K''p)$ with some noise term $E'p$ as a ciphertext $\textsf{RLWE}_{S, \sigma}(M)$ with the noise term $E'p + K''p = (E' + K'')\cdot p$. This step does not require any additional computation. The size of the coefficients of $K''$ is upper-bounded because the operations of the \textsf{CoeffToSlot}, digit extraction, and \textsf{SlotToCoeff} steps are fixed. With a proper setup of the cryptographic parameters of BGV, we can guarantee that the noise-to-ciphertext modulus ratio always gets decreased after BGV's bootstrapping (i.e., $\dfrac{||E + K'||_{\infty}}{q_L} < \dfrac{||E' + K''||_{\infty}}{q_{l'}} < \dfrac{||E||_{\infty}}{\hat{q}}$, where $\hat{q} < q_l < q_{l'} < q_L$, and $||P||_\infty$ denotes the maximum absolute coefficient value of polynomial $P$).
 
 \end{enumerate}