Commutable Encryption Possibilty Based on RLWE Encryption

Question

I would like to ask whether the ciphertext encrypted by RLWE-based encryptions can be exchanged?(equivalent to whether RLWE-based encryption is commutative encryption)

Specifically speaking, given one plaintext $m$, two different secret keys $s_{k_1}, s_{k_2}$based on RNS-CKKS encryption and following operations:

Step1: plaintext $m$ is encrypted into ciphertext1 $Enc_{s_{k_1}}(m)$ by secret key $s_{k_1}$ based on RNS-CKKS encryption

Step2: ciphertext1 $Enc_{s_{k_1}}$ is double encrypted into ciphertext2 $Enc_{s_{k_2}}(Enc_{s_{k_1}}(m))$ based on RNS-CKKS encryption

Step3: decrypt ciphertext2 with secret key $s_{k_1}$ can obtain ciphertext3 $Enc_{s_{k_2}}(m)$

I would like to ask whether the above steps can be achieved?

[Update]

The original expression of commutative encryption can be found in the link's appendix B. Here I post them below:

Answer 1

This is generally not going to be true, but something that you likely view as being morally equivalent is true.

First, for why this isn't true (it's rather basic). Note that for RLWE-type encryption (just private-key for simplicity) $\mathsf{Enc}_{s}$ maps $m(x)\in R\mapsto [a(x), b(x)]\in R^2$. In other words, expressions like

$$ \mathsf{Enc}_{s_2}(\mathsf{Enc}_{s_1}(m(x))) $$ imply that $\mathsf{Enc}_{s_2}$ must be able to encrypt pairs of polynomials (that are moreover mod $q$, rather than mod $p$, e.g. are larger in "dimension" and "modulus size"). It is therefore unclear how you could even propose running $\mathsf{Dec}_{s_1}$ on this (larger) $s_2$ ciphertext.

That being said, there are variants of FHE where one can

1. encrypt under multiple keys, and then
2. decrypt with "some" of the keys, yielding "partial" ciphertexts that are
3. still secure until one decrypts with "enough" of the keys.

Terms to search on are "Threshold FHE" ("Multi-Key FHE" is also vaguely related)(. Theoretically both have been constructed for CKKS. This post makes it sound like OpenFHE does not support Multi-Key FHE currently, while this doc page states that they do support threshold FHE for CKKS. It doesn't clarify that this is RNS CKKS. I would guess that it is, but I haven't looked in depth (nor have I checked for other libraries).