# Why is low-degree polynomial preferred on Ring-LWE based somewhat homomorphic encryption?

I'm wondering why Ring-LWE based homomorphic encryption (somewhat homomorphic encryption, not fully) requires low-degree polynomial in order to avoid decryption error. For example, a plaintext $m$ is an element over some polynomial ring, i.e. $m\in \mathbb{Z}_t[X]/(X^N+1)$ where $t$ is a prime and $N$ is a power of two integer.

More redundantly, $m= m_0 + m_1 X + m_2 X^2 + \ldots + m_{N-1}X^{N-1}$. A noise $e$ is also a polynomial sampled from discrete gaussian distribution.

I do not know why polynomial degree is considered. Noise amount on each coefficient violates on each coefficient of the plaintext polynomial. Is this correct?

• First of all, are you sure of that $B$ in the definition of the ring? I guess it is simply $X^N+1$ instead. Mar 29, 2018 at 7:46
• Sorry, it's a typo. I fixed it. Mar 29, 2018 at 7:47
• So, your question is why do we work over $\mathbb{Z}_t[X] / \langle X^N + 1 \rangle$ instead of working over $\mathbb{Z}_t[X]$? Mar 29, 2018 at 7:48