Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In LTV-FHE, section 3.3.2 Formal description, a ciphertext looks like this $c=hs+2e+b = (2g/f)s+2e+b$, where $h = 2g/f$ is the public key, $f$ is the secret key, $g, s$ and $e$ are chosen randomly, and $b$ is the bit to be encrypted.
Following the equation $c = (2g/f)s+2e+b$, the bit $b$ can be obtained easily performing a modulo 2 operation for a ciphertext.
What is the hardness that protects against this simple modulo reduction ?
Note that $h\in R_q$, which hides the parity of $2g/f$ since $q$ is a prime. For example, $h=[2x^2-6x-8]_{17}$. In addition, all the operations (including addition and multiplication) to compute $c$ are done in $R_q$.
