How exactly is TFHE secure?

Question

TFHE (Fully Homomorphic Encryption over Torus) seems to be a state-of-the-art form of homomorphic encryption.

But, I got a bit confused.

I have recently read the paper Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP from CRYPTO 2012.

The author states in section 1.1 that

For technical reasons, we don't implement the scheme over fractions, but rather mimic the invariant perspective over $\mathbb{Z}_q$ (see Section 1.2 for more details).

However, TFHE seems to be defined over fractions. Does this imply that TFHE overcomes such a technical difficulty? If so, doesn't any security side-effect come?

Answer 1

You have to distinguish "implement" from "define".

Brakerski defines his scheme over fractions, but implements it using integers just because it is easier to implement, more efficient and less error prone. If you represent the fractions with floating values, then you have precision issues. And if you represent them with two integers (denominator and numerator), then you probably use more space than what is needed.

That is why he says in the end of section 1.2:

Finally, working with fractional ciphertexts brings about issues of precision in representation and other problems. We thus implement our scheme over $\mathbb{Z}$ with appropriate scaling.

Thus, this implementation choice has nothing to do with the security aspects of the scheme.

That said, TFHE does something similar: it is defined over $[0, 1[~\subset \mathbb{R}$, but if you check the code, you will see that integers are also used there.

For example, see the following lines on the file torus.h:

// Idea:
// we may want to represent an element x of the real torus by
// the integer rint(2^32.x) modulo 2^32
//  -- addition, subtraction and integer combinations are native operation
//  -- modulo 1 is mapped to mod 2^32, which is also native!
// This looks much better than using float/doubles, where modulo 1 is not
// natural at all.
typedef int32_t Torus32;
typedef int64_t Torus64;