BFV to CKKS switching

Library Questions
1

Hi all, I am trying to build a pipeline to convert some BFV ciphertexts to CKKS ones. I know that the two encodings are somewhat similar (the \Delta term should be adjusted accordingly), and the main step is simply to bootstrap the CKKS ciphertext after a raw conversion to increase the modulus.

As far as I am aware this transformation is also used during the functional CKKS bootstrapping, however I am struggling to use it in a “plain” scenario that does not require any LUT. My setup is kind of simple: I have some {\bf x} vector encoded in a BFV ciphertext, and I would like switch it to a CKKS ciphertext.

Currently, I am using the SchemeletRLWEMP::ConvertRLWEToCKKS function, where the input ciphertext is a BFV one. Something like:

....

uint16_t slots = 16;
BigInteger QBFVInit = BigInteger(1) << 60;
BigInteger PInput = 16;
BigInteger POutput = 16;
BigInteger Q = BigInteger(1) << 30;

auto ep = SchemeletRLWEMP::GetElementParams(keyPair.secretKey, depth);

auto ctxtBFV = SchemeletRLWEMP::EncryptCoeff(x, QBFVInit, PInput, keyPair.secretKey, ep);

SchemeletRLWEMP::ModSwitch(ctxtBFV, Q, QBFVInit);

auto ctxtCKKS = SchemeletRLWEMP::ConvertRLWEToCKKS(*cc, ctxtBFV, keyPair.publicKey, Q, slots,  depth - 1);

The problem is that, if I try to decrypt the message, I will obtain a decryption error. I guess the ciphertext should be converted from coeffs to slots? I tried to print the scaling factor of the CKKS ciphertext and looks fine (approx 2^{30})… have anyone ever done such a conversion and have some suggestions? Thanks!

2

Bear in mind that the CKKS functional bootstrapping’s SchemeletRLWEMP starts with coefficient-encoded BFV. If you want to start with slot-encoded BFV, you need to run the SlotsToCoefficients transform first. You can use an identity function instead of an LUT to just do bootstrapping and not function evaluation.

However, if you want to go back to slot-encoded BFV, you need to leave modulus for the transformation back. Also, SchemeletRLWEMP does not use RNS because we assume we are always on the last level and do not do any multiplications there (MP comes from multi-precision).

3

You

So when doing RLWE → CKKS, the new CKKS ciphertext must be immediately bootstrapped?

4

Think of the RLWE-CKKS-RLWE system as a vectorized FHEW (LWE-GSW-LWE). RLWE is additively homomorphic, so you can perform additions before bootstrapping.

1 Like
5

Ok, thanks! This parallelism makes things more clear:)