Jean-Philippe Bossuat

Hi @WeiDaiWD, Could you elaborate on the security issue of not choosing Q and T as coprime? If so, the standard should be updated because it only specifies that Q...

@WeiDaiWD This is very reassuring :) I suppose however that this requirement remains true for BGV, since in this case the error is multiplied by T.

@tbrezot Actually, if T and Q are not coprime then the division by Q/T is easier, since the division by all the primes except T can be done with the...

Hello @xuann6, 1. Yes, if you have a ciphertext modulo `Q = q0 * q1`, represented as two polynomials, one modulo q0, and one modulo q1, then dropping the polynomial...

Hi @xuann6, You wouldn't want to use this one because it adds additional multiples of the original modulus, instead the one from [An Improved RNS Variant of the BFV Homomorphic...

Plaintext multiplication in CKKS is actually one of the most efficient operation (its a series of point-wise vector multiplications if both operands are in the NTT domain), hence it has...

You cannot "avoid" consuming an additional level, but you can reduce the number of bits of the total modulus Q that you use by using smaller scales for plaintext multiplications....

There is no special requirement for the modulus used in RLWE based scheme outside of an upper bound on its bit-size given the ring degree and the error distribution. So...

Multiplication in BFV requires more than tensoring (unlike CKKS). Because of how the plaintext is encoded (in the higher bits), the tensoring must be done without modular reduction and is...

Vs plaintext sure, because to multiply with a plaintext you do not need to scale it by Q/t, so it reduces to two polynomial multiplications in Z[X]_{Q}/(X^{N}+1) (`2*(NTT -> MulVec...