Does TFHE support only homomorphic addition for two LWE/RLWE ciphertexts and multiplication with constants (polynomials in RLWE)? AFAIK, it supports homomorphic multiplication of only two RGSW ciphertexts, or external product of a RLWE ciphertext with RGSW ciphertext? Why is this so? I figure out that GSW based schemes use decomposition instead of relinearisation to control noise growth. Just wanted to confirm my understanding and reason for it

Your understanding looks good to me. The main idea behind ciphertext multiplication in TFHE-like schemes is to control the magnitude of one operand to be small enough to ensure the noise does not blow up. There are many details on how this is achieved, and I donâ€™t think they can be summarized here. However, here is a great resource on how TFHE-like schemes work, and I highly recommend reading it.

Thanks a lot for confirming. Does TFHE support relinearisation by any means? Or is the idea of TFHE based on only supporting GSW ciphertexts for ciphertext multiplications ?

There is a conceptual difference between TFHE-like schemes and BGV-like schemes especially in the multiplication structure. While we would like to build an arithmetic multiplication in BGV-like schemes, the main goal in TFHE-like schemes is mostly building a universal gate (usually NAND).

I assume by *Relinearization* in BGV-like schemes, you refer to the procedure done after the homomorphic multiplication to reduce the multiplication result from 3 (or more) components down to 2 components. This is not the case in TFHE, and I am not aware of any TFHE-like scheme that uses this procedure except this work.

That said, it is noteworthy that in some literature, *Relinearization* is referred to as *Key-Switching*, a more generalized operation than *Relinearization*. What I want to say is that *Key-Switching* is used in almost all TFHE-like schemes as part of bootstrapping.