# How to hide result of FHE?

Lets say we are given BFV encryption of x, let this encryption is represented as E(x). In FHE, the client can decrypt and get the value of x but what if we dont want the client to learn x. This paper suggests that:

• the servers samples random r and perform E(x)+r and send that to client
• The client decrypts and get x+r
• The paper suggests that this is like a secret sharing of x. More concretely Server share is r and client share is x+r mod p. (p is plaintext mod)

My question is which ring r is sampled from ? is it from R_p or R_q

The vector $$\mathbf{r}$$ serves as a one-time pad. So, it is sufficient to use a uniform $$\mathbf{r}$$ sampled from a vector space where the plaintext $$\mathbf{x}$$ is in. What really matters is how to add up the HE ciphertext $$[\mathbf{x}]$$ and the plaintext $$\mathbf{r}$$ to get a new HE ciphertext $$[\mathbf{x} + \mathbf{r}]$$. This operation is easy for any linear HE.
• I understand that this vector is going to server as OTP. I am worried about the following issue, if encryption is a, as+e+m \mod q then after addition it will become a, as+e+m+r mod q the client who holds secret key could remove as so she gets m+r+e mod q I am not sure how this is OTP in mod q ? or am I missing something (I know m+r mod p is secure as its uniform ) Jul 20, 2022 at 16:04
• I think that $\vec{m} + \vec{r} + \vec{e} \in R_q$ is only an intermediate result in the decryption of HE ciphertext $[\vec{m} + \vec{r}]$. For non-approximate HE schemes, the error should be then removed using the plaintext modulus. It may be helpful to view $(\vec{a}, \vec{a} \vec{s} + (\vec{m} + \vec{r}) + \vec{e})$ as the HE ciphertext for the plaintext $\vec{m} + \vec{r} \in R_p$ (which is the information can be learned by the client at most). Now, the OTP $\vec{r}$ works. Jul 21, 2022 at 0:54