LWR-Based Fully Homomorphic Encryption, Revisited

Table 1

Comparison with LWE-based FHEs: GSW13 and AP14.

FHE	Modulus	Security loss	Gaussian noise
GSW13 and AP14			Yes
Our LWR-based FHE			No

(1) We consider a leveled FHE scheme where the depth of circuits is polynomial . The homomorphic evaluation capability, efficiency, and security of the FHE scheme mainly depend on modulus , under the same dimension . Note that the modulus of AP14 is relatively smaller than that of GSW13, for the sub-Gaussian in AP14 results in a tighter noise growth than the Gaussian. Here, we ignore this little difference. (2) Here, the security loss is caused by the reduction between the security of the FHE scheme and the LWE problem. Since the security of our FHE scheme is directly based on the LWR problem, the security loss involves the reduction loss incurred by the reduction between LWE and LWR (see Theorem 7 in Section 2).