About TFHE schemes

Question

I'm starting to read about TFHE, however my background is not that deep. Mostly, I've learnt about it thanks to this paper, and I am trying to delve deeper into it. I've also read the Zama blog post about it. I understand that there are three kinds of schemes defined by Chillotti et al. in the original TFHE paper: LWE-like, GLev and GSW-like. The last one, if I understood correctly, is the only one that provides a true homomorphic product property without having to rely on techniques such as relinearisation.

I want to explore basic examples of this schemes, and for that, I've started using OpenFHE, which provides in particular support for this kind of encryption. However, when trying to understand the implemented scheme, I don't really get it, because there's the symmetric and the PKE variants, and also they mix it with the FHEW scheme, which I haven't read that much about, but I know it's the immediate precursor of TFHE.

So I have some questions regarding this:

• What's each TFHE scheme really like? Because I understand the ciphertext structure, but I fail to understand how key generation, encryption and decryption work at all.
• How is TFHE implemented with public key encryption? Because on the blog series they only talk about secret key encryption.
• What's the actual TFHE scheme implemented in OpenFHE (key generation, encryption, decryption, and bootstrapping)?

Answer 1

What's each TFHE scheme really like? Because I understand the ciphertext structure, but I fail to understand how key generation, encryption and decryption work at all.

You can find a lot of information on https://www.zama.ai/post/tfhe-deep-dive-part-1 (series of 4 blogs).

How is TFHE implemented with public key encryption? Because on the blog series they only talk about secret key encryption.

A rough idea is:

• the one who has the sk can create a lot of encryptions of 0's. Let's call them z_i. z_i's are the pk
• the one who wants to encrypt in pk just select randomly some z_i, and add them to the plaintext m: it's going to be an encryption of m, thanks to the homomorphic properties

What's the actual TFHE scheme implemented in OpenFHE (key generation, encryption, decryption, and bootstrapping)?

In my knowledge, OpenFHE implements only the boolean version of TFHE, ie messages are just boolean. If you want to use Zama's version, ie with larger messages, you can use TFHE-rs, Zama's open-source library. https://docs.zama.ai/tfhe-rs

And in general, if you want to discuss on Zama's product, a good way is to go on discord.fhe.org, where there are support channels for Zama-and-others's products.