Consider a threshold FHE scheme based on RLWE like this: Refer to this paper


Every party generates his own secret key $s_i$, then uses the common polynomial $a$ to generate his public key $pk_i=(p_{i,0},p_{i,1})=(-as_i+e_i,a)$. Therefore, the ideal public key is $pk = (p_0,p_1)=(\sum p_{i,0}, a)$.


The party $P_i$ has his own data $x_i$, he encrypts it under the $pk$ and sends the ciphertext to some receiver. The receiver computes some function and then sends the result $(c_0,c_1)$ to every party.For the parties, they perform the partial decryption: $h_i = c_1s_i+e_{smudge}$.

My Question: Why smudge? Why not use a common noise $\chi$ distribution? Could you give a simple derivation?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.