# Squaring the coefficients in homomorphic encryption

In homomorphic encryption scheme FV, I can multiply an encrypted polynomial for any integer scalar, obtaining the same effect on the plain polynomial. For example, given the plain polynomial $\sum_ia_ix^i$, and its encrypted version $\sum_ib_ix^i$, I could multiply the latter by $c$ and decipher it, to obtain $\sum_i(ca_i)x^i$. Is there a way to do the same with squaring? Can I perform some operation on $\sum_ib_ix^i$ and then decipher it, to get $\sum_ia_i^2x^i$? I already tried with $\sum_ib_i^2x^i$, but it just dosen't work.

About the reasons I'm doing this, it's because I have to use a polynomial activation function in a neural network that uses homomorphic encryption, as explained in this paper

• could you please put a link to some description of the homomorphic encryption scheme you're using? there are many of them, and depending on the one you're using, the multiplication operation might be different. – Florian Bourse Mar 19 '18 at 14:49
• Ehy, thanks for the reply! The software library I am using is SEAL from Microsoft, and as far as I know it is an implementation of the Fan-Vercauteren (FV) scheme. – Armando Mar 19 '18 at 16:21
• So, you have $c$ which encrypts a polynomial $f(x) = a_0 + a_1x + ... + a_nx^n$ and you want to operate homomorphically to generate some ciphertext that encrypt $a_0^2 + a_1^2x + ... + a_n^2x^n$, right? – Hilder Vitor Lima Pereira Mar 20 '18 at 9:35
• Exactly!! I would like to understand if this is possible! If not, it means that I misinterpreted the data encoding. Unfortunately there are not many details about the relationship between the square activation layer and the management of polynomials in the paper. – Armando Mar 20 '18 at 12:04

In the Fan-Vercauteren scheme, ciphertexts are composed of 2 polynomials, call them $ct_0$ and $ct_1$.
The homomorphic multiplication is composed of 2 steps. First, you compute an intermediary ciphertext (it is not a real ciphertext because it's composed of 3 elements and not 2): $$\frac{t}{q}ct_0ct'_0, \;\; \frac{t}{q}(ct_0ct'_1+ct_1ct'_0), \;\; \frac{t}{q}ct_1ct'_1$$ all of them rounded and taken modulo q. This intermediate can be obtained with the SEAL library using Evaluator::multiply.
This operation is used to go back to a ciphertext containing only 2 elements, and can be obtained with the SEAL library using Evaluator::relinearize (it needs a key as a second argument that can be generated using KeyGenerator::generate_evaluation_keys.
• But if $c$ encrypts a polynomial $f(x) = a_0 + a_1x + ... + a_nx^n$, then $c^2$ doesn't decrypt to $a_0^2 + a_1^2x + ... + a_n^2x^n$. – Hilder Vitor Lima Pereira Mar 20 '18 at 9:33
• I have already tried this way, but as Hilder also states, this does not elevate the polynomial coefficients squarely, but the polynomial itself. As an example, if we take $2x+3$, we encrypt it, multiply it by itself and decode it, the result is not $4x+9$, but instead $4x^2+6x+9$. – Armando Mar 20 '18 at 12:32