Jeremy Kun

Also, I have heard that other backends like lattigo support more fine-tuned parameter settings, so choosing a different backend is also a workaround.

I think that's right, with the only caveat being that we have tests that use `tensor_ext` without any secret IR (and `tensor_ext` has no internal concept of `secret`). Hence my...

Sure! The basic idea is that an arith.muli lowers to the ops bgv.mul and bgv.relin. The relin is necessary to return the key basis from (1, s, s^2) to (1,...

I think we could perhaps also migrate the `bgv::Ciphertext` type to the `lwe` dialect as an RLWE ciphertext type, which does not currently exist but we want to have it...

I didn't realize that relinearizing after repeated multiplications is a thing people do. I assume that: - The key basis for that would be (1, s, s^2, s^3, s^4) -...

Agreed with Asra. I intended the current attribute to be generic enough to model both BFV and BGV (isn't it? For LSB, the messages start bits would be a small...

Taking a second look, yes I see how the docs are confusing. I think for BGV the interpretation of ```mlir #lwe_encoding = #lwe.bit_field_encoding ``` Would be this: where `n` stands...

This is fixed now since we moved BGV to use LWE types and attributes.

I do worry a little bit that the key basis in the attributes would explode for some mul-heavy IRs, but I'm down to try it. Another approach would be to...

I think perhaps the simplest initial test case would be ```mlir %x = bgv.mul %0, %1 %x_relin = bgv.relinearize %x %y = bgv.mul %3, %4 %y_relin = bgv.relinearize %y %z...