# Squaring the coefficients in homomorphic encryption

In homomorphic encryption scheme FV, I can multiply an encrypted polynomial for any integer scalar, obtaining the same effect on the plain polynomial. For example, given the plain polynomial $\sum_ia_ix^i$, and its encrypted version $\sum_ib_ix^i$, I could multiply the latter by $c$ and decipher it, to obtain $\sum_i(ca_i)x^i$. Is there a way to do the same with squaring? Can I perform some operation on $\sum_ib_ix^i$ and then decipher it, to get $\sum_ia_i^2x^i$? I already tried with $\sum_ib_i^2x^i$, but it just dosen't work.

About the reasons I'm doing this, it's because I have to use a polynomial activation function in a neural network that uses homomorphic encryption, as explained in this paper

• could you please put a link to some description of the homomorphic encryption scheme you're using? there are many of them, and depending on the one you're using, the multiplication operation might be different. Mar 19, 2018 at 14:49
• Ehy, thanks for the reply! The software library I am using is SEAL from Microsoft, and as far as I know it is an implementation of the Fan-Vercauteren (FV) scheme. Mar 19, 2018 at 16:21
• So, you have $c$ which encrypts a polynomial $f(x) = a_0 + a_1x + ... + a_nx^n$ and you want to operate homomorphically to generate some ciphertext that encrypt $a_0^2 + a_1^2x + ... + a_n^2x^n$, right? Mar 20, 2018 at 9:35
• Exactly!! I would like to understand if this is possible! If not, it means that I misinterpreted the data encoding. Unfortunately there are not many details about the relationship between the square activation layer and the management of polynomials in the paper. Mar 20, 2018 at 12:04

In the Fan-Vercauteren scheme, ciphertexts are composed of 2 polynomials, call them $ct_0$ and $ct_1$.
The homomorphic multiplication is composed of 2 steps. First, you compute an intermediary ciphertext (it is not a real ciphertext because it's composed of 3 elements and not 2): $$\frac{t}{q}ct_0ct'_0, \;\; \frac{t}{q}(ct_0ct'_1+ct_1ct'_0), \;\; \frac{t}{q}ct_1ct'_1$$ all of them rounded and taken modulo q. This intermediate can be obtained with the SEAL library using Evaluator::multiply.
This operation is used to go back to a ciphertext containing only 2 elements, and can be obtained with the SEAL library using Evaluator::relinearize (it needs a key as a second argument that can be generated using KeyGenerator::generate_evaluation_keys.
• But if $c$ encrypts a polynomial $f(x) = a_0 + a_1x + ... + a_nx^n$, then $c^2$ doesn't decrypt to $a_0^2 + a_1^2x + ... + a_n^2x^n$. Mar 20, 2018 at 9:33
• I have already tried this way, but as Hilder also states, this does not elevate the polynomial coefficients squarely, but the polynomial itself. As an example, if we take $2x+3$, we encrypt it, multiply it by itself and decode it, the result is not $4x+9$, but instead $4x^2+6x+9$. Mar 20, 2018 at 12:32