Show HN: Fully Homomorphic Encryption from Scratch(daniellowengrub.com) |
Show HN: Fully Homomorphic Encryption from Scratch(daniellowengrub.com) |
If rounding were not part of decryption, then one could implement bootstrapping without all that blind rotate magic, because the first step in bootstrap is to homomorphically apply b - <a,s>, and that is purely a linear operation. Sec 5.2 of https://eprint.iacr.org/2021/1402 explains this in a bit more detail.
I completely agree that it is possible to homomorphically evaluate b - <a,s> much more easily using homomorphic addition and multiplication. However, wouldn't we still need some sort of blind rotate magic to bound the output error?