TFHE (Fully Homomorphic Encryption over Torus) seems to be a state-of-the-art form of homomorphic encryption.

But, I got a bit confused.

I have recently read the paper Fully Homomorphic Encryption without Modulus Switching from Classical GapSVP from CRYPTO 2012.

The author states in section 1.1 that

For technical reasons, we don't implement the scheme over fractions, but rather mimic the invariant perspective over $\mathbb{Z}_q$ (see Section 1.2 for more details).

However, TFHE seems to be defined over fractions. Does this imply that TFHE overcomes such a technical difficulty? If so, doesn't any security side-effect come?


1 Answer 1


You have to distinguish "implement" from "define".

Brakerski defines his scheme over fractions, but implements it using integers just because it is easier to implement, more efficient and less error prone. If you represent the fractions with floating values, then you have precision issues. And if you represent them with two integers (denominator and numerator), then you probably use more space than what is needed.

That is why he says in the end of section 1.2:

Finally, working with fractional ciphertexts brings about issues of precision in representation and other problems. We thus implement our scheme over $\mathbb{Z}$ with appropriate scaling.

Thus, this implementation choice has nothing to do with the security aspects of the scheme.

That said, TFHE does something similar: it is defined over $[0, 1[~\subset \mathbb{R}$, but if you check the code, you will see that integers are also used there.

For example, see the following lines on the file torus.h:

// Idea:
// we may want to represent an element x of the real torus by
// the integer rint(2^32.x) modulo 2^32
//  -- addition, subtraction and integer combinations are native operation
//  -- modulo 1 is mapped to mod 2^32, which is also native!
// This looks much better than using float/doubles, where modulo 1 is not
// natural at all.
typedef int32_t Torus32;
typedef int64_t Torus64;
  • $\begingroup$ Thank you for clarifying my doubt. By the way, TFHE is still defined over real torus, which seems different from other FHE schemes based on integer. The choice of using real or integer is independent of security? $\endgroup$ Aug 10, 2019 at 20:49
  • $\begingroup$ @user9414424 Indeed defining the scheme over real numbers has security implications because LWE is defined over discrete sets only! If you want to understand that better, you have to check the paper where Cheon and Stehlé present a reduction from "discrete" LWE to "continuous" LWE. But, the implementation issue is basically the same in TFHE and in the paper you linked. $\endgroup$ Aug 11, 2019 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.