# How does the Efficient Fully Homomorphic Encryption from (Standard) LWE work?

I am interesting to learn the low level implementation of Efficient Fully Homomorphic Encryption from (Standard) LWE and I am wondering if anyone can answer the following questions:

1. Does the BV scheme work on binary numbers (0,1) or not?

2. Does the BV scheme encrypt and decrypt each bit separately?

3. Is there any difference between the original paper of BV andthe updated version in terms of encryption and decryption processes?

• What do you mean by "work on binary numbers" ? Do you want to know if this scheme is able to encrypt and decrypt these numbers? Sep 28 '15 at 12:25
• I want to know whether is integers converted to binary numbers and then encrypted separately or not! Sep 28 '15 at 18:51
• The scheme is described regarding only encryption, decryption and operations over the bits 1 and 0. Anyone that wants to use it to work over integers have to find his or her own way to do so (which is typically by encrypting each bit). Sep 29 '15 at 13:12
• BGV is definitely better than BV. A good paper for BGV-beginners is the updated version of the paper "Homomorphic Evaluation of the AES Circuit" by Gentry, Halevi, Smart from the iacr e-print server (see ia.cr/2012/099 - the outdated appendix C should be replaced by ia.cr/2015/889).
– j.p.
Sep 29 '15 at 13:52

The BV scheme presented in the article works for plaintext messages in $GF(2)$ (that is $m$ $\in$ $\{0,1\}$) but can be extended to support encrypting messages that are in $GF(t)$ where $t$ is prime with the modulus $Z_q$.
This means that if you want to encrypt a message in $\{0,1\}^n$ you have to do it for each bit separately in $GF(2)$ (or in $GF(t)$ and the message $m$ $\in \{0,1,...t-1\}^n$)
The BGV scheme instantiated with the LWE problem is the same as in BV. The main difference in BGV is that the scheme supports a more general context, namely it could be also instantiated with the Ring-LWE problem providing a more efficient circuit (inner operations are done inside a ring $R$ instead from $Z_q$ as in LWE).