Security on kenji.blog

Mathematical Intuition of Lattice-based Cryptography

Fri, 11 Sep 2026 21:00:00 +0900

1. Introduction: The Dawn of Post-Quantum Cryptography (PQC) and the Rise of Lattice-based Cryptography

The digital infrastructure of modern society is supported by public-key cryptography technologies such as RSA cryptography and Elliptic Curve Cryptography (ECC). These cryptographic schemes base their security on the mathematical difficulty of problems like the “prime factorization problem” and the “discrete logarithm problem,” which are believed to be inefficient (requiring exponential time) to solve with conventional classical computers.

However, “Shor’s algorithm,” published by Peter Shor in 1994, sent shockwaves through the cryptographic world. This algorithm mathematically proved that once a large-scale quantum computer is realized, it would be able to solve the prime factorization problem and the discrete logarithm problem in polynomial time. This means that the widely used public-key cryptography of today will become completely decipherable in the future.

To counter such a “Quantum Threat,” research into new cryptographic schemes that are difficult to break even with quantum computers became an urgent task. This field is called “Post-Quantum Cryptography (PQC)” or “quantum-resistant cryptography.”

There are several strong candidates for PQC. Examples include hash-based cryptography, code-based cryptography, multivariate polynomial cryptography, and isogeny-based cryptography. Among them, “Lattice-based cryptography” is currently attracting the most attention and is at the center of the PQC standardization process by NIST (National Institute of Standards and Technology). Compared to other methods, lattice-based cryptography has extremely fast encryption and decryption processing speeds, and it has the outstanding feature of an extremely strong security proof in cryptographic theory: a reduction from “worst-case complexity” to “average-case complexity.”

In this article, starting from the mathematical definition of a “Lattice,” which is the foundation of lattice-based cryptography, we will thoroughly and deeply explain difficult problems on lattices such as SVP (Shortest Vector Problem) and CVP (Closest Vector Problem), and the “LWE (Learning With Errors) problem,” which can be said to be the heart of modern lattice-based cryptography, using mathematical formulas, geometric intuition, and specific numerical examples.

2. Mathematical Definition and Geometric Intuition of a Lattice

2.1 Vector Spaces and Lattices

In mathematics, a “Lattice” is a set of discrete points arranged regularly in an $n$-dimensional real vector space $\mathbb{R}^n$. It is similar to a Vector Space learned in linear algebra, but there is a crucial difference. While a vector space is a continuous space represented by a linear combination of basis vectors with “real coefficients,” a lattice is a discrete space represented by a linear combination of basis vectors with “integer coefficients.”

Let’s give a strict mathematical definition. Consider $n$ ($n \le m$) linearly independent vectors $\mathbf{b}_1, \mathbf{b}_2, \dots, \mathbf{b}_n$ in an $m$-dimensional real vector space $\mathbb{R}^m$. Let a matrix having these vectors as column vectors be $B = [\mathbf{b}_1, \mathbf{b}_2, \dots, \mathbf{b}_n] \in \mathbb{R}^{m \times n}$. This $B$ is called the “Basis” of the lattice.

The lattice $\mathcal{L}(B)$ generated by this basis $B$ is defined as follows:

$$ \mathcal{L}(B) = \left\{ \sum_{i=1}^{n} x_i \mathbf{b}_i \mathrel{\bigg|} x_i \in \mathbb{Z} \right\} = \{ B \mathbf{x} \mid \mathbf{x} \in \mathbb{Z}^n \} $$

What is important here is that the coefficients $x_i$ are limited to integers $\mathbb{Z}$, not real numbers $\mathbb{R}$. As a result, rather than a continuous space with infinitely many points, a “set of discrete points” like equally spaced intersections is formed.

2.2 Geometric Image

Let’s consider an example of a 2-dimensional plane $\mathbb{R}^2$. When $\mathbf{b}_1 = \begin{pmatrix} 1 \\ 0 \end{pmatrix}$ and $\mathbf{b}_2 = \begin{pmatrix} 0 \\ 1 \end{pmatrix}$ are chosen as basis vectors, the lattice generated by them is the set of all integer coordinates $(x, y) \in \mathbb{Z}^2$ on the coordinate plane. This is the simplest “square lattice.”

However, lattices are not always orthogonal. For example, considering the basis $\mathbf{b}_1 = \begin{pmatrix} 2 \\ 1 \end{pmatrix}$ and $\mathbf{b}_2 = \begin{pmatrix} 1 \\ 3 \end{pmatrix}$, the generated points become like the intersections of an obliquely skewed mesh.

2.3 Non-uniqueness of the Basis and Unimodular Transformations

There is an important property related to the foundation of the security of lattice-based cryptography. That is, “there are infinitely many bases that generate the same lattice.”

For example, the $\mathbb{Z}^2$ lattice generated by the previous basis $\mathbf{b}_1 = (1, 0)^T, \mathbf{b}_2 = (0, 1)^T$ can be generated as exactly the same lattice $\mathbb{Z}^2$ using the basis $\mathbf{b}'_1 = (1, 1)^T, \mathbf{b}'_2 = (2, 3)^T$.

The necessary and sufficient condition for a basis $B$ and another basis $B'$ to generate the same lattice is that there exists a matrix with integer components $U \in \mathbb{Z}^{n \times n}$ whose determinant is $\det(U) = \pm 1$, and it can be expressed as:

$$ B' = B U $$

Such a matrix $U$ is called a “Unimodular matrix.”

The basic idea in its application to cryptography is to use a “good basis” (a basis that is close to orthogonal and consists of short vectors) as a secret key, and a “bad basis” (a basis that is extremely skewed relative to each other and consists of very long vectors) as a public key. It becomes very difficult to calculate a good basis from a bad basis as the dimension increases. This is the basic intuition behind lattice-based cryptography.

3. Computationally Hard Problems in Lattices

The security of lattice-based cryptography depends on the difficulty of solving specific mathematical problems on lattices. Here, we introduce the two most fundamental and famous problems.

3.1 Shortest Vector Problem (SVP)

SVP is the most classical and famous problem in lattice theory.

Definition (SVP): Given an arbitrary lattice basis $B$, find the vector $\mathbf{v}$ with the minimum Euclidean norm (length) among the non-zero vectors belonging to that lattice $\mathcal{L}(B)$.

Expressed mathematically, it is the problem of finding $\mathbf{v}$ such that $\min_{\mathbf{v} \in \mathcal{L}(B) \setminus \{\mathbf{0}\}} \| \mathbf{v} \|$. This minimum length is written as $\lambda_1(\mathcal{L})$ and is called the “first successive minimum” of the lattice.

In lower dimensions such as 2D or 3D, you can draw a figure and visually find the shortest vector. Alternatively, it can be efficiently solved using algorithms like Gauss’s lattice reduction algorithm. However, when the dimension $n$ becomes a high dimension such as hundreds to thousands, it is known that strictly solving SVP is NP-hard.

In actual cryptography, instead of the strict shortest vector, an approximate SVP ($\gamma$-SVP) is used, which finds an “approximately short vector.” When the approximation factor $\gamma$ is of polynomial size, this problem is still considered very difficult.

3.2 Closest Vector Problem (CVP)

CVP is also an extremely important problem in lattice-based cryptography.

Definition (CVP): Given an arbitrary lattice basis $B$ and an arbitrary target vector $\mathbf{t} \in \mathbb{R}^m$ in space (which is not necessarily a lattice point), find the lattice point $\mathbf{v} \in \mathcal{L}(B)$ that is closest to $\mathbf{t}$ among the lattice points.

Expressed mathematically, it is the problem of searching for a lattice point $\mathbf{v}$ such that $\min_{\mathbf{v} \in \mathcal{L}(B)} \| \mathbf{v} - \mathbf{t} \|$.

Like SVP, CVP is also NP-hard in high dimensions. From the perspective of application to cryptography, the LWE problem described later is closely related to a special variant of this CVP (Bounded Distance Decoding: BDD).

3.3 Why Are They Unsolvable in High Dimensions? (Limits of LLL and BKZ)

A famous algorithm for solving high-dimensional lattice problems is the LLL algorithm (Lenstra-Lenstra-Lovász algorithm). The LLL algorithm operates in polynomial time and can reduce a lattice basis to a “good basis” to some extent. However, since the shortest vector found by the LLL algorithm has an exponential approximation factor ($2^{\mathcal{O}(n)}$) relative to the length of the true shortest vector, it is not enough to break the security of the cryptography.

By using a more powerful basis reduction algorithm such as the BKZ (Block Korkine-Zolotarev) algorithm, which is an improvement over LLL, a shorter vector can be found, but its computational complexity increases exponentially with respect to the block size. In lattice-based cryptography, secure parameters (such as the size of the dimension $n$) are determined by estimating the execution time of this BKZ algorithm. In current PQC standard parameters, values of dimension $n$ from 500 to over 1000 are chosen, and it is said that it would take more than the age of the universe to decrypt even if supercomputers or future quantum computers were used.

4. Mathematical Formulation of the LWE (Learning With Errors) Problem

Most of modern lattice-based cryptography is based on the “LWE (Learning With Errors) problem” proposed by Oded Regev in 2005. The beauty of the LWE problem lies in the simplicity of its formulation and the fact that it has a powerful mathematical proof of “reduction from worst-case to average-case complexity.”

4.1 Systems of Linear Equations Without Noise

To understand the LWE problem, let’s first consider a simple system of linear equations without noise. Suppose there is an unknown secret vector $\mathbf{s} \in \mathbb{Z}_q^n$ (each component is an integer from $0$ to $q-1$). Here, $q$ is assumed to be a prime number.

Choose random coefficient vectors $\mathbf{a}_1, \mathbf{a}_2, \dots \in \mathbb{Z}_q^n$, and calculate their inner product with the secret vector $\mathbf{s}$ modulo $q$. $b_1 = \langle \mathbf{a}_1, \mathbf{s} \rangle \pmod q$ $b_2 = \langle \mathbf{a}_2, \mathbf{s} \rangle \pmod q$ $\vdots$

Given a sufficient number (at least $n$) of pairs $(\mathbf{a}_i, b_i)$, we can easily recover the secret vector $\mathbf{s}$ by using “Gaussian elimination” in linear algebra. This is a problem that can be easily solved in polynomial time.

4.2 Definition of the LWE Problem: Adding Noise

So, what happens if we add a slight “noise (error)” to this problem? This is the essence of the LWE problem.

For an unknown secret vector $\mathbf{s} \in \mathbb{Z}_q^n$, we add a small error $e_i \in \mathbb{Z}_q$ to the result of each equation. $b_i = \langle \mathbf{a}_i, \mathbf{s} \rangle + e_i \pmod q$

Here, $e_i$ is a small integer value with a mean of 0 and a relatively small standard deviation (for example, chosen from a discrete Gaussian distribution, like a normal distribution). The given information is a list of pairs of a random vector $\mathbf{a}_i$ and $b_i$ calculated by adding an error to it. $( \mathbf{a}_1, b_1 ), ( \mathbf{a}_2, b_2 ), \dots, ( \mathbf{a}_m, b_m )$

This becomes very neat when expressed as a matrix. Using a random matrix $A \in \mathbb{Z}_q^{m \times n}$, a secret vector $\mathbf{s} \in \mathbb{Z}_q^n$, and an error vector $\mathbf{e} \in \mathbb{Z}_q^m$, it can be written as:

$$ \mathbf{b} = A \mathbf{s} + \mathbf{e} \pmod q $$

Only $A$ and $\mathbf{b}$ are given. The problem of finding $\mathbf{s}$ from this is the “Search LWE problem.”

Because the error $e_i$ is included, if one tries to use Gaussian elimination, the errors amplify exponentially during the process of adding and subtracting equations, making it impossible to reach the correct answer. At first glance, it looks like a simple system of linear equations, but just by adding this small noise, the difficulty of the problem jumps to an NP-hard level.

4.3 Decision LWE Problem

What is frequently used in cryptographic theory proofs is the “Decision LWE problem,” a variation of the Search LWE problem.

The Decision LWE problem is the problem of determining which of the following two distributions a given list of samples came from:

LWE Distribution: Intentionally calculated $(A, \mathbf{b} = A\mathbf{s} + \mathbf{e} \pmod q)$
Uniform Random Distribution: $(A, \mathbf{u})$ consisting of a completely randomly chosen matrix $A$ and vector $\mathbf{u}$

Surprisingly, if the parameters of the LWE problem are chosen appropriately, the pairs obtained from the LWE distribution become “Computationally Indistinguishable” from pairs of completely random data. This property provides the foundation for LWE-based cryptography to generate “ciphertexts indistinguishable from random numbers.”

4.4 Reduction from Worst-Case to Average-Case Complexity (Regev’s Theorem)

Oded Regev’s greatest achievement is mathematically linking the difficulty of this LWE problem to the difficulty of the aforementioned lattice problems (SVP and CVP).

Using a quantum reduction, he proved that “if there is a polynomial-time algorithm that can solve the LWE problem on average (for randomly chosen $A$ and $\mathbf{e}$), then there is a polynomial-time quantum algorithm that can solve the Gap-SVP for the worst case (the most difficult case) of any lattice.” (Later, a classical reduction was also demonstrated by Peikert et al.)

This is a dream-like property in cryptographic theory. This is because it dispels the concern that “the cipher might be broken because we happened to choose a weak key (a part of the average case),” and gives a strong guarantee that “if average-case LWE can be solved, all hard problems on lattices can be solved (therefore LWE is absolutely hard).”

graph TD A["Worst-case Lattice Problems (Gap-SVP, SIVP)"] -->|Quantum/Classical Reduction| B["Average-case LWE Problem"] B -->|Cryptographic Construction| C["LWE-based Cryptosystems (PKE, KEM, FHE)"] style A fill:#ffcccc,stroke:#ff0000,stroke-width:2px,color:#000 style B fill:#ccffcc,stroke:#00aa00,stroke-width:2px,color:#000 style C fill:#ccccff,stroke:#0000ff,stroke-width:2px,color:#000

5. Construction of a Public-Key Cryptosystem (Regev’s Cryptosystem) using LWE

Now that we understand the difficulty of the LWE problem, let’s look at the basic public-key cryptosystem proposed by Oded Regev to see how it is used for encryption and decryption. Here, we will explain the most basic mechanism for encrypting a 1-bit message $M \in \{0, 1\}$.

5.1 Key Generation

Determine the system parameters: the modulus prime number $q$, the dimension $n$, and the number of equations $m$ ($m > n \log q$).
As a secret key, choose a vector $\mathbf{s} \in \mathbb{Z}_q^n$ at random.
Generate a random matrix $A \in \mathbb{Z}_q^{m \times n}$.
Choose a small error vector $\mathbf{e} \in \mathbb{Z}_q^m$ from an error distribution such as a discrete Gaussian distribution.
Calculate the vector $\mathbf{b} = A \mathbf{s} + \mathbf{e} \pmod q$.
The Public Key will be $(A, \mathbf{b})$.
The Secret Key will be $\mathbf{s}$.

The public key is exactly an “instance of the LWE problem.” Finding the secret key $\mathbf{s}$ from the public key $(A, \mathbf{b})$ is equivalent to solving the Search LWE problem, thereby ensuring security.

5.2 Encryption

Alice encrypts a 1-bit message $M \in \{0, 1\}$ using Bob’s public key $(A, \mathbf{b})$.

Choose a random binary vector (components are 0 or 1) $\mathbf{r} \in \{0, 1\}^m$.
As the first half of the ciphertext, compute the vector $\mathbf{u} = A^T \mathbf{r} \pmod q$. ($A^T$ is the transpose of $A$. That is, we are adding up the rows of $A$ where the component of $\mathbf{r}$ is 1).
As the second half of the ciphertext, compute the scalar $v = \mathbf{b}^T \mathbf{r} + M \cdot \lfloor \frac{q}{2} \rfloor \pmod q$. (If the message $M$ is 0, add nothing; if $1$, add exactly half the value of $q$, $\lfloor \frac{q}{2} \rfloor$).
The Ciphertext will be $(\mathbf{u}, v)$.

The intuitive meaning of encryption is to take the “sum of a random subset” for the public key matrix $A$ and vector $\mathbf{b}$. Due to the difficulty of the Decision LWE problem, this ciphertext $(\mathbf{u}, v)$ appears indistinguishable from a completely random vector and uniform random number (Semantic Security).

flowchart LR M["Message M in {0,1}"] --> Enc PK["Public Key (A, b)"] --> Enc r["Random binary vector r"] --> Enc subgraph Enc ["Encryption Process"] direction TB u_calc["u = A^T * r mod q"] v_calc["v = b^T * r + M * floor(q/2) mod q"] end Enc --> CT["Ciphertext (u, v)"]

5.3 Decryption

Bob decrypts the ciphertext $(\mathbf{u}, v)$ using the secret key $\mathbf{s}$.

Compute the following value: $D = v - \mathbf{s}^T \mathbf{u} \pmod q$
If the computed result is closer to $0$, output $M=0$; if it is closer to $\lfloor \frac{q}{2} \rfloor$, output $M=1$.

Let’s expand this mathematically to see why this can decrypt the message. Recall that $\mathbf{b} = A \mathbf{s} + \mathbf{e}$.

$$ \begin{aligned} v - \mathbf{s}^T \mathbf{u} &= (\mathbf{b}^T \mathbf{r} + M \cdot \lfloor \frac{q}{2} \rfloor) - \mathbf{s}^T (A^T \mathbf{r}) \\ &= ((A \mathbf{s} + \mathbf{e})^T \mathbf{r} + M \cdot \lfloor \frac{q}{2} \rfloor) - \mathbf{s}^T A^T \mathbf{r} \\ &= (\mathbf{s}^T A^T \mathbf{r} + \mathbf{e}^T \mathbf{r} + M \cdot \lfloor \frac{q}{2} \rfloor) - \mathbf{s}^T A^T \mathbf{r} \\ &= \mathbf{e}^T \mathbf{r} + M \cdot \lfloor \frac{q}{2} \rfloor \pmod q \end{aligned} $$

Here, $\mathbf{s}^T A^T \mathbf{r}$ perfectly cancelled out from the equation! What remains is $\mathbf{e}^T \mathbf{r} + M \cdot \lfloor \frac{q}{2} \rfloor$.

$\mathbf{e}$ is a noise vector with very small components, and $\mathbf{r}$ is a binary vector whose components are 0 or 1. Therefore, their inner product $\mathbf{e}^T \mathbf{r}$ also remains a relatively small value (if parameters are chosen properly).

If $M=0$, the result is $\mathbf{e}^T \mathbf{r}$, which is a small value close to $0$.
If $M=1$, the result is $\mathbf{e}^T \mathbf{r} + \lfloor \frac{q}{2} \rfloor$, which will be located around half the value of $q$, $\lfloor \frac{q}{2} \rfloor$.

If the parameters are designed so that the absolute value of the error $\mathbf{e}^T \mathbf{r}$ stays under $\frac{q}{4}$, Bob can accurately determine (decrypt) the message $M$ just by seeing whether the computed result is closer to $0$ or $\lfloor \frac{q}{2} \rfloor$. This is the beautiful mechanism by which LWE-based cryptography functions.

flowchart LR CT["Ciphertext (u, v)"] --> Dec SK["Secret Key s"] --> Dec subgraph Dec ["Decryption Process"] direction TB calc["Compute D = v - s^T * u mod q"] check["Check if D is closer to 0 or q/2"] end calc --> check Dec --> M_out["Recovered Message M"]

6. Toy Example of LWE Cryptography Using Specific Numerical Values

Since simply listing formulas might make it hard to get a real sense of it, let’s actually set very small numerical parameters and follow the calculations from encryption to decryption. (* In actual cryptographic systems, values of $n$ of 500 or more and $q$ of several thousands or more are used to ensure security)

[Parameter Settings]

Modulus $q = 17$ (A prime number. Therefore, values take the range from $0$ to $16$)
Dimension $n = 2$
Number of equations $m = 4$
Suppose we want to encrypt the message $M = 1$.
Message shift amount: $\lfloor \frac{q}{2} \rfloor = \lfloor \frac{17}{2} \rfloor = 8$

[1. Key Generation Phase] Bob randomly chooses the secret key $\mathbf{s}$, matrix $A$, and error vector $\mathbf{e}$.

$$ \mathbf{s} = \begin{pmatrix} 3 \\ 4 \end{pmatrix} \in \mathbb{Z}_{17}^2 $$ $$ A = \begin{pmatrix} 2 & 15 \\ 1 & 8 \\ 14 & 5 \\ 9 & 10 \end{pmatrix} \in \mathbb{Z}_{17}^{4 \times 2} $$ $$ \mathbf{e} = \begin{pmatrix} 1 \\ -1 \\ 0 \\ 2 \end{pmatrix} \equiv \begin{pmatrix} 1 \\ 16 \\ 0 \\ 2 \end{pmatrix} \pmod{17} $$

Next, calculate the public key $\mathbf{b}$.

$$ A \mathbf{s} = \begin{pmatrix} 2 & 15 \\ 1 & 8 \\ 14 & 5 \\ 9 & 10 \end{pmatrix} \begin{pmatrix} 3 \\ 4 \end{pmatrix} = \begin{pmatrix} 2\times 3 + 15\times 4 \\ 1\times 3 + 8\times 4 \\ 14\times 3 + 5\times 4 \\ 9\times 3 + 10\times 4 \end{pmatrix} = \begin{pmatrix} 6 + 60 \\ 3 + 32 \\ 42 + 20 \\ 27 + 40 \end{pmatrix} = \begin{pmatrix} 66 \\ 35 \\ 62 \\ 67 \end{pmatrix} $$

Calculate this modulo 17. (e.g., $66 = 17 \times 3 + 15$)

$$ A \mathbf{s} \pmod{17} = \begin{pmatrix} 15 \\ 1 \\ 11 \\ 16 \end{pmatrix} $$

Add the error vector $\mathbf{e}$.

$$ \mathbf{b} = A \mathbf{s} + \mathbf{e} = \begin{pmatrix} 15 \\ 1 \\ 11 \\ 16 \end{pmatrix} + \begin{pmatrix} 1 \\ 16 \\ 0 \\ 2 \end{pmatrix} = \begin{pmatrix} 16 \\ 17 \\ 11 \\ 18 \end{pmatrix} \equiv \begin{pmatrix} 16 \\ 0 \\ 11 \\ 1 \end{pmatrix} \pmod{17} $$

The public key is $A$ and $\mathbf{b} = (16, 0, 11, 1)^T$.

[2. Encryption Phase] Alice encrypts the message $M = 1$. Choose a random vector $\mathbf{r}$. Here, let $\mathbf{r} = (1, 0, 1, 0)^T$.

Calculate $\mathbf{u}$.

$$ \mathbf{u} = A^T \mathbf{r} = \begin{pmatrix} 2 & 1 & 14 & 9 \\ 15 & 8 & 5 & 10 \end{pmatrix} \begin{pmatrix} 1 \\ 0 \\ 1 \\ 0 \end{pmatrix} = \begin{pmatrix} 2 \times 1 + 14 \times 1 \\ 15 \times 1 + 5 \times 1 \end{pmatrix} = \begin{pmatrix} 16 \\ 20 \end{pmatrix} \equiv \begin{pmatrix} 16 \\ 3 \end{pmatrix} \pmod{17} $$

Calculate $v$.

$$ \mathbf{b}^T \mathbf{r} = (16, 0, 11, 1) \begin{pmatrix} 1 \\ 0 \\ 1 \\ 0 \end{pmatrix} = 16 \times 1 + 11 \times 1 = 27 \equiv 10 \pmod{17} $$

Add the value $\lfloor 17/2 \rfloor = 8$ corresponding to the message $M=1$.

$$ v = \mathbf{b}^T \mathbf{r} + M \cdot 8 = 10 + 1 \times 8 = 18 \equiv 1 \pmod{17} $$

Alice sends the ciphertext $(\mathbf{u}, v) = \left( \begin{pmatrix} 16 \\ 3 \end{pmatrix}, 1 \right)$ to Bob.

[3. Decryption Phase] Bob, upon receiving the ciphertext, decrypts it using the secret key $\mathbf{s} = (3, 4)^T$. Calculate the decryption formula: $D = v - \mathbf{s}^T \mathbf{u} \pmod{17}$.

$$ \mathbf{s}^T \mathbf{u} = (3, 4) \begin{pmatrix} 16 \\ 3 \end{pmatrix} = 3 \times 16 + 4 \times 3 = 48 + 12 = 60 \equiv 9 \pmod{17} $$ $$ D = v - \mathbf{s}^T \mathbf{u} = 1 - 9 = -8 \pmod{17} $$

Here, in the modulo 17 world, $-8$ is equal to $9$ ($-8 + 17 = 9$). Determine whether the obtained value $D = 9$ is closer to $0$ or $8$ ($\lfloor 17/2 \rfloor$). Since $9$ is clearly closer to $8$ than to $0$, Bob correctly restored $M = 1$!

Why did it become $9$? Let’s recall the previous proof. The error part is $\mathbf{e}^T \mathbf{r} = (1, -1, 0, 2) (1, 0, 1, 0)^T = 1 \times 1 + 0 \times 1 = 1$. Therefore, the calculation result is $\mathbf{e}^T \mathbf{r} + M \cdot 8 = 1 + 8 = 9$, confirming that the theoretically expected value was calculated.

7. Evolution Towards Practical Application: Ring-LWE and Module-LWE

The Standard LWE problem explained so far has an extremely strong security proof, but it has a fatal flaw in practical use. That is, “the size of the keys becomes huge” and “the computational cost is high.”

In Standard LWE, the public key includes a huge matrix $A \in \mathbb{Z}_q^{m \times n}$. When the parameter $n$ goes up to hundreds or thousands, the size of this matrix reaches several megabytes, making it too heavy to transmit and receive every time over Internet communication protocols (such as TLS). Also, multiplying a matrix and a vector requires a computational complexity of $\mathcal{O}(n^2)$.

To solve this problem, “Ring-LWE (RLWE)” and “Module-LWE (MLWE)” were introduced, incorporating an algebraic structure called polynomial rings into the lattice.

7.1 Intuition of Ring-LWE

In Ring-LWE, vectors and matrices are replaced with elements (polynomials) over a polynomial ring $\mathcal{R}_q = \mathbb{Z}_q[X]/(X^n + 1)$. (Here, $n$ is chosen as a power of 2).

Whereas the public key of Standard LWE was a matrix $A$, Ring-LWE uses a single polynomial $a(x)$. The secret key $s(x)$ and the error $e(x)$ also become polynomials. The equation looks like this:

$$ b(x) = a(x) \cdot s(x) + e(x) \pmod q $$

Since this is polynomial multiplication, by using the “Number Theoretic Transform (NTT),” which is similar to the Fast Fourier Transform (FFT), the computational complexity can be dramatically reduced to $\mathcal{O}(n \log n)$. Furthermore, because the size of the public key shrinks from a matrix to a single polynomial, the data size is reduced to $\mathcal{O}(n)$. This brings an overwhelming advantage in communication bandwidth.

Mathematically speaking, Ring-LWE reduces to a problem on a lattice with a special symmetry called an “Ideal Lattice” rather than a general lattice.

7.2 Module-LWE and NIST Standardization (Kyber / ML-KEM)

While Ring-LWE is efficient, there was some concern that the special algebraic structure of ideal lattices might become a clue for future attacks. Therefore, “Module-LWE (MLWE)” was created to take the “best of both worlds”: the conservative security of Standard LWE and the efficiency of Ring-LWE.

Module-LWE considers small matrices and vectors whose elements are polynomials. In other words, it handles modules over a ring. Currently, “CRYSTALS-Kyber” (standardized name: ML-KEM), which NIST selected as the standard for PQC key encapsulation mechanisms (KEM), is built precisely on the difficulty of this Module-LWE problem.

8. Why is it Secure Against Quantum Computers?

Finally, let’s touch upon the core issue: “Why is lattice-based cryptography considered unbreakable even when using quantum computers?”

Shor’s algorithm, which allows quantum computers to break RSA cryptography and Elliptic Curve Cryptography, is essentially an algorithm that solves the “Hidden Subgroup Problem (HSP).” The mathematical structure (finite abelian groups) behind RSA and ECC has periodicity, and by using a specific operation of quantum algorithms called the Quantum Fourier Transform (QFT), this period (hidden subgroup) can be extracted all at once.

However, lattice problems are fundamentally different. Although lattices also have periodicity, what is required in SVP and CVP is a geometric, non-linear property such as “shortest distance” or “removal of noise.” Even if a “Quantum Fourier Transform over an abelian group” like Shor’s algorithm is applied directly, useful information that would be the answer to the lattice problem cannot be efficiently extracted. To date, no quantum algorithm that can solve SVP or LWE in polynomial time has been discovered, and it is widely believed that even with the parallel computing power of quantum computers, the only effective means is near-brute-force search (about the level of square root speedup by Grover’s algorithm).

9. Conclusion

In this article, we explained the mathematical intuition of lattice-based cryptography in detail, starting from the geometric definition of a lattice, to the formulation of the LWE problem, and the construction of a public-key cryptosystem.

A Lattice is a discrete space represented by integer-coefficient linear combinations of basis vectors, and finding a “good basis” close to orthogonal (SVP) becomes difficult in high dimensions.
The LWE (Learning With Errors) problem is the problem of solving a system of linear equations with noise, and since it is tied to the difficulty of worst-case problems on lattices, it provides a powerful security foundation.
By using the LWE problem, encryption and decryption (Regev’s Cryptosystem) are realized through an ingenious mechanism of intentionally adding and removing noise.
In real-world protocols, Ring-LWE and Module-LWE using polynomial rings are adopted to improve communication efficiency and computation speed, serving as the foundation for the NIST-standard ML-KEM.

As the unprecedented computational paradigm shift of quantum computers approaches, it is quite romantic that “lattice-based cryptography,” born from the depths of classical linear algebra and number theory, will bear the foundation of future internet security. The math that forms the foundation of lattice-based cryptography is by no means too esoteric, and anyone with a basic knowledge of linear algebra and probability can fully understand its beautiful structure. We hope this article has helped you understand lattice-based cryptography, the core of PQC.

How Zero-Knowledge Proofs (ZKP) Work and Their Latest Applications in Web3 and Security

Fri, 11 Sep 2026 19:00:00 +0900

Introduction

In modern digital society, data privacy and scalability have become two of the most critical challenges. As the risks of personal information leaks and unauthorized use increase, there is a strong demand for technology that allows you to “prove that you have certain information without revealing the information itself to the other party.” This is realized by Zero-Knowledge Proofs (ZKP).

Zero-Knowledge Proofs is a concept in cryptography first proposed in the 1980s by Shafi Goldwasser, Silvio Micali, and Charles Rackoff, but for a long time, it remained primarily a theoretical research topic. However, with the rise of blockchain technology and Web3, the situation completely changed. ZKP has suddenly been thrust into the spotlight as the “magic wand” that simultaneously solves the scalability problems (limits of processing capacity) and privacy problems (the fact that all transactions are public) faced by public blockchains like Ethereum.

In this article, we will provide a highly detailed and technically deep explanation, ranging from the basic concepts of Zero-Knowledge Proofs to the profound mathematical and cryptographic mechanisms of the currently mainstream zk-SNARKs and zk-STARKs, and finally to the latest application examples in Web3 and security, such as ZK-Rollups and Decentralized Identity (DID).

What is a Zero-Knowledge Proof (ZKP)?

A Zero-Knowledge Proof (ZKP) refers to a protocol in which a prover can prove to a verifier that a certain proposition is true, “without transmitting any information other than the fact that the proposition is true.”

The 3 Requirements for ZKP

To be established as a ZKP, the following three properties must be strictly satisfied:

Completeness If the proposition is true, and both the prover and the verifier follow the protocol correctly, the verifier must accept the proof with an overwhelming probability.
Soundness If the proposition is false, no matter how computationally powerful and malicious the prover is, it is impossible (except for a negligibly small probability) to deceive the verifier into accepting the proof.
Zero-Knowledge If the proposition is true, the verifier cannot obtain any information from the proof process other than the fact that “the proposition is true.” From the verifier’s perspective, this is proven by the mathematical definition that it is possible to simulate the proof process (a simulator exists).

Interactive and Non-Interactive Proofs

There are two types of ZKPs: Interactive Proofs, where the prover and verifier communicate multiple times, and Non-Interactive Proofs, where the prover sends the proof data only once.

Interactive ZKP

Early ZKPs were designed as interactive protocols. The famous “Ali Baba’s Cave” allegory falls under this category. The general flow of the protocol is as follows:

sequenceDiagram participant Prover as "Prover" participant Verifier as "Verifier" Note over Prover, Verifier: "Basic Flow of the Interactive Proof Protocol" Prover->>Verifier: "1. Send Commitment" Verifier->>Prover: "2. Send Random Challenge" Prover->>Verifier: "3. Calculate and Send Response" Note over Verifier: "Verify the Response" Verifier-->>Prover: "4. Accept / Reject" Note over Prover, Verifier: "* Repeat this dozens of times to increase certainty"

This method is powerful, but the verifier must be online, making it inconvenient to apply to asynchronous distributed systems like blockchains. In a blockchain, anyone must be able to verify past proofs at any time.

Fiat-Shamir Heuristic and Non-Interactivity

A breakthrough technique for converting interactive proofs into Non-Interactive Zero-Knowledge Proofs (NIZK) is the Fiat-Shamir Heuristic.

Instead of the “random challenge” sent by the verifier, the prover self-generates a “pseudo-random challenge” using their own commitment and the hash value of public information. Assuming that a cryptographic hash function (such as SHA-256 or Keccak) functions as a random oracle, the prover cannot predict or manipulate the challenge in advance, allowing the proof to be completed with a single message transmission while maintaining the same level of security as an interactive proof.

Technical Details of zk-SNARKs

Currently, the most widely used ZKP is zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge). As the name suggests, it is an Argument of Knowledge that has zero-knowledge properties (zk), features very small proof sizes and fast verification (Succinct), and is Non-Interactive.

The foundation of zk-SNARKs is advanced algebraic geometry and cryptography. It converts the execution and computation of programs into the verification of specific polynomial equations.

1. Conversion to Arithmetic Circuits and R1CS (Rank-1 Constraint System)

First, any computation you want to prove (such as an algorithm or smart contract logic) is converted into an Arithmetic Circuit consisting of addition and multiplication gates.

Next, this arithmetic circuit is converted into a set of matrix equations called R1CS (Rank-1 Constraint System). R1CS is the problem of finding matrices $A, B, C$ that satisfy the following constraint for a variable vector $x$:

$$ (A \cdot x) \circ (B \cdot x) = C \cdot x $$

Here, $\circ$ represents the Hadamard product (element-wise product). This constraint ensures that all logic gates (especially multiplication gates) in the circuit are calculated correctly.

2. Conversion to QAP (Quadratic Arithmetic Program)

Since there are countless R1CS matrix constraints, verifying them individually is highly inefficient. Therefore, Lagrange interpolation is used to compress these constraints into a single polynomial equation. This is the QAP (Quadratic Arithmetic Program).

Through the conversion to QAP, the problem to be proven is reduced to the question: “Is a specific polynomial $P(x)$ divisible by another known polynomial $Z(x)$?”

$$ P(x) = L(x) \cdot R(x) - O(x) $$

Here, $L(x), R(x), O(x)$ are combinations of polynomials corresponding to each row of matrices $A, B, C$, respectively. If the prover knows the correct solution (Witness), the value becomes 0 at each root (evaluation point) of $P(x)$, so $P(x)$ will have the target polynomial $Z(x)$ as a factor. In other words, there exists a polynomial $H(x)$ such that the following equation holds:

$$ P(x) = H(x) \cdot Z(x) $$

The verifier only needs to check whether this equation $P(s) = H(s) \cdot Z(s)$ holds at a certain random secret point $s$ to instantly verify that the entire computation was performed correctly. This is the secret of its “Succinctness.”

3. Elliptic Curve Cryptography and Bilinear Pairings

However, if the verifier knows the secret point $s$, it would be possible for the prover to fabricate a fake polynomial to satisfy the equation (a collapse of soundness). Therefore, it is necessary to perform computations while keeping $s$ encrypted (using homomorphic encryption) so that no one knows it.

This is achieved using Bilinear Pairings on elliptic curves. A pairing $e$ is a special function that can calculate a value equivalent to the encryption of the product of two encrypted values.

$$ e(g_1^a, g_2^b) = e(g_1, g_2)^{ab} $$

Even without knowing $s$ itself, the prover calculates the encrypted values of the polynomials $P(s)$ and $H(s)$ using encrypted values of powers of $s$ (this is called the CRS: Common Reference String). The verifier uses the pairing function to verify whether the relationship $P(s) = H(s) \cdot Z(s)$ holds while the values remain encrypted.

4. Trusted Setup

The biggest weakness of zk-SNARKs (especially early ones like Groth16) is that they require a process to generate the secret point $s$, known as a Trusted Setup. If the creator of $s$ retains the value without destroying it, they can generate arbitrary fake proofs (the Toxic Waste problem).

To prevent this, a ritual called a “Ceremony” is conducted using Multi-Party Computation (MPC). Numerous participants cooperate to provide randomness, and as long as at least one participant honestly destroys their random value, the security of the entire system is maintained. However, research to eliminate this dependency has been ongoing for many years.

Technical Details of zk-STARKs

zk-STARKs (Zero-Knowledge Scalable Transparent Argument of Knowledge) emerged as an answer to the reliance on trusted setups and the risk of elliptic curve cryptography being decrypted by quantum computers.

Developed by Eli Ben-Sasson and others, STARKs feature no need for a trusted setup, living up to the name “Transparent,” and maintain efficient proof sizes and verification times even as the amount of computation increases, living up to the name “Scalable.”

1. Polynomial Commitments and the FRI Protocol

zk-STARKs base their security entirely on hash functions, rather than elliptic curve cryptography. Therefore, they have the properties of Post-Quantum Cryptography.

Computation verification is performed by utilizing the properties of one-dimensional or multi-dimensional polynomials after being converted into a format called AIR (Algebraic Intermediate Representation). The core of STARKs lies in the FRI (Fast Reed-Solomon Interactive Oracle Proof of Proximity) protocol.

The FRI protocol is a technique for verifying “whether a certain function is sufficiently close to a polynomial of a specific degree (Proximity).” The prover commits the polynomial’s values as leaves of a Merkle Tree (Polynomial Commitment).

graph TD Root["Merkle Root (Commitment)"] --> Node0["Node 0"] Root --> Node1["Node 1"] Node0 --> Leaf0["P(x_0)"] Node0 --> Leaf1["P(x_1)"] Node1 --> Leaf2["P(x_2)"] Node1 --> Leaf3["P(x_3)"]

The verifier requests the disclosure of several random points and uses Merkle proofs to confirm that they are included in the commitment. By repeating this recursively, it guarantees with overwhelming probability that the original polynomial actually has a low degree.

Comparison of zk-SNARKs and zk-STARKs

Feature	zk-SNARKs	zk-STARKs
Cryptographic Assumptions	Elliptic curves, Pairings	Collision-resistant hash functions
Trusted Setup	Required (Universal for Plonk, etc.)	Not required (Transparent)
Quantum Resistance	No	Yes
Proof Size	Very small (~200 Bytes)	Somewhat large (Tens of KB)
Proof Generation Computational Cost	High	Relatively lower than SNARKs
Verification Cost (Gas Fee)	Very low (Constant)	Low (Increases logarithmically)

In recent years, SNARKs that “do not require a trusted setup, or only require it once” like Plonk and Halo2 have appeared, and the boundary between SNARKs and STARKs is gradually blurring, but the fundamental difference in mathematical approaches remains important.

Latest Applications of Zero-Knowledge Proofs in Web3 and Security

Having transitioned from theory to practice, ZKPs are now sparking a revolution at the forefront of Web3 and cybersecurity.

1. Ultimate Scaling of Ethereum with ZK-Rollups

L1 (Layer 1) blockchains like Ethereum have significant constraints on scalability (the trilemma) due to their emphasis on decentralization and security. The definitive L2 (Layer 2) solution to solve this is ZK-Rollups.

In a ZK-Rollup, thousands of transactions are executed and processed off-chain (L2), generating a “single ZKP (Validity Proof)” indicating that they were all executed correctly. The smart contract on the L1 chain only needs to verify this proof.

flowchart LR Users["Users (Tx Submission)"] --> Sequencer["Sequencer (Tx Collection & Execution)"] Sequencer --> Prover["Prover (ZKP Generation)"] Sequencer --> L1Contract["L1 Smart Contract (Tx Data Publication)"] Prover --> L1Contract["ZKP (Proof) Submission"] L1Contract --> Verify["Verification & State Update"]

The biggest advantage of ZK-Rollups is that, unlike Optimistic Rollups (such as Arbitrum and Optimism), they do not require a challenge period (typically 7 days) for Fraud Proofs. Because correctness is cryptographically guaranteed, fund withdrawals to L1 (Finality) are completed the moment the proof is verified. Currently, projects like zkSync, Starknet, Scroll, and Polygon zkEVM are engaged in fierce development competition, and the realization of zkEVMs, which are compatible with the EVM (Ethereum Virtual Machine), is driving rapid ecosystem growth.

2. Privacy-Preserving Identity (ZKP for Identity)

The nature of personal authentication in the digital world will also be fundamentally changed by ZKPs. For example, in response to the question, “Are you 18 or older?”, conventional systems required presenting a driver’s license or passport, handing over unnecessary personal information like name and address to the other party.

By using ZKPs, based on a digital certificate (Verifiable Credential) issued by a public institution, it becomes possible to mathematically prove only the fact that “calculated from my date of birth, I am 18 or older on the current date.” The verifier only needs to verify the certificate’s signature and the ZKP, without knowing the user’s date of birth or identity.

Projects for Proof of Personhood like Worldcoin also incorporate a mechanism to prove only that one is a “unique human” using ZKPs, rather than storing and sharing iris data directly.

3. Confidential Smart Contracts and Enterprise Use

The property of public blockchains that “all data is public” has been a major barrier for companies handling confidential transactions and supply chain information on the blockchain.

By using ZKP technology (such as privacy-focused networks like Aleo and Aztec), the input values, output values of transactions, and even the smart contract logic executed can be kept encrypted, while only the validity of state updates is etched onto the public chain. This makes it possible to prevent front-running (MEV) in DeFi (Decentralized Finance) and to build confidential consortium networks among enterprises, all while enjoying the high security of public chains.

Future Challenges and Prospects for ZKP

While ZKPs are undoubtedly a next-generation foundational technology, several challenges remain.

Proof Generation Computational Costs and Hardware Acceleration Generating a ZKP requires massive polynomial operations, FFT (Fast Fourier Transform), and MSM (Multi-Scalar Multiplication). Currently, research into dedicated hardware (FPGAs and ASICs) to accelerate this proof generation, known as ZKP Mining (Prover Networks), is rapidly advancing.
Standardization and Improvement of Developer Experience (DX) Dedicated languages for writing ZKP circuits, such as Circom, Cairo, Noir, and Leo, are proliferating. A standard unifying these and the maturation of compilers that automatically generate ZKP circuits from existing languages like Rust and C++ will be key to general software engineers adopting ZKPs.

Conclusion

Zero-Knowledge Proofs (ZKP) have evolved from merely a “technology to enhance cryptocurrency anonymity” to a “general-purpose technology redefining trust across the internet.” Small proofs calculated deep within mathematics and cryptography will infinitely scale blockchain capabilities and act as a strong shield protecting our privacy.

Towards true mass adoption of Web3 and the construction of a secure and private next-generation internet, Zero-Knowledge Proofs will continue to function as the most crucial piece. We must keep a close eye on the future evolution of ZKP technology.

References and Related Links

Groth, J. (2016). “On the Size of Pairing-based Non-interactive Arguments”
Ben-Sasson, E., et al. (2018). “Scalable, transparent, and post-quantum secure computational integrity”
Vitalik Buterin’s blog on zk-SNARKs and zk-STARKs

What is Fully Homomorphic Encryption (FHE)? Explaining the Keystone of Next-Generation Security

Fri, 11 Sep 2026 11:00:00 +0900

As cloud computing and AI technologies become established as societal infrastructure, the tradeoff between “data privacy” and “data utilization” has become one of the most critical challenges. While there is a growing demand to have AI analyze highly sensitive data—such as medical records, financial information, and personal biometric data—on the cloud, many companies hesitate to send data externally due to security concerns.

Traditional encryption technologies (like AES and RSA) excel at protecting data stored in storage (Data at Rest) and data flowing over networks (Data in Transit). However, when performing processing (computations) such as searching or machine learning on the server side (Data in Use), the ciphertext must first be decrypted back into plaintext. If the server is hacked at this decrypted moment, or if a malicious internal administrator peeks at the data, it directly leads to information leakage.

The dream technology that overcomes this fundamental weakness of “decryption during processing” is Fully Homomorphic Encryption (FHE). By using FHE, it becomes possible to perform computational processing while keeping the data encrypted, without ever decrypting it, and returning only the resulting ciphertext to the client.

In this article, we will thoroughly and deeply explain FHE, the keystone of next-generation security, covering everything from its concept and history, the groundbreaking breakthrough by Craig Gentry, mathematical foundations (such as Ring-LWE), its biggest challenge “noise” and its solution (bootstrapping), up to the latest implementation libraries.

1. What is Homomorphic Encryption? Basic Concepts

“Homomorphic” is an algebraic term referring to the property where mappings can be made between sets with a certain structure while preserving the structure of the operations. “Homomorphism” in cryptography is the property where operations in the plaintext space correspond to operations in the ciphertext space.

Expressed in simple formulas, let $m_1$ and $m_2$ be plaintexts, $E(\cdot)$ be the encryption function, and $D(\cdot)$ be the decryption function. If we let $\circ$ be an operation on the plaintext (such as addition or multiplication) and $\diamond$ be an operation on the ciphertext, the following relationship holds:

$$ D(E(m_1) \diamond E(m_2)) = m_1 \circ m_2 $$

In other words, if you decrypt the result of applying some operation $\diamond$ to the ciphertexts $E(m_1)$ and $E(m_2)$, it matches the result of operating $\circ$ on the original plaintexts.

Data Flow in Cloud Computing

The architecture of cloud processing using FHE is completely different from traditional ones. The following diagram shows the flow of secure data processing utilizing FHE.

The server receives the encrypted data $E(x)$, but since it does not have the secret key, it can never know the contents of the data. However, by utilizing the properties of FHE, it can apply a function $f$ (for example, an inference model for machine learning) to the ciphertext and generate $E(f(x))$. The client receives this and decrypts it with their own secret key to obtain the desired result $y = f(x)$.

2. History of Homomorphic Encryption Evolution: PHE, SHE, FHE

Homomorphic encryption did not reach its current “fully” form all at once. It is broadly classified into three stages depending on the types and number of operations it can achieve.

Partially Homomorphic Encryption (PHE)

PHE is an encryption scheme that can perform only one of either addition or multiplication indefinitely. In fact, ciphers with this property have existed for a long time.

RSA Encryption (Homomorphism for multiplication) RSA encryption unintentionally possessed a multiplicative homomorphic property. Given plaintexts $m_1, m_2$ and a public key $(e, N)$: $$ E(m_1) = m_1^e \pmod N $$ $$ E(m_2) = m_2^e \pmod N $$ Multiplying these gives: $$ E(m_1) \times E(m_2) = (m_1 \cdot m_2)^e \pmod N = E(m_1 \times m_2) $$ Thus, the multiplication of ciphertexts corresponds to the multiplication of plaintexts.
Paillier Encryption (Homomorphism for addition) The Paillier cryptosystem, invented in 1999, has an additive homomorphic property. It has been put to practical use in applications like electronic voting (aggregating encrypted votes and decrypting only the final result).

Somewhat Homomorphic Encryption (SHE)

This scheme can execute both addition and multiplication, but there is a limit to the number of operations (circuit depth) that can be performed. Due to the accumulation of “noise,” which will be discussed later, decryption becomes impossible after a certain number of multiplications. The BGN (Boneh-Goh-Nissim) cryptosystem of 2005 falls under this category, but it had limitations in performing practical, complex computations (like deep learning).

Fully Homomorphic Encryption (FHE)

This is an encryption scheme that can execute both addition and multiplication an unlimited number of times. Similar to Turing completeness in information theory, if addition (equivalent to XOR) and multiplication (equivalent to AND) can be combined infinitely, it means that in principle, any computable function or algorithm can be executed while remaining encrypted.

FHE was long called the “holy grail of cryptography” and was even said to be impossible to realize. However, in 2009, Craig Gentry, who was a doctoral student at Stanford University at the time, proposed the first FHE scheme using Ideal Lattices, sending shockwaves through the world.

3. Mathematical Foundations of FHE: The LWE Problem and Ring-LWE

Many of the current mainstream FHE schemes are based on the LWE (Learning With Errors) problem, a mathematical hard problem in “Lattice-based Cryptography,” which is also known as Post-Quantum Cryptography.

Intuitive Understanding of the LWE Problem

Solving a system of linear equations is easy if you use methods like Gaussian elimination.

$$ \begin{cases} 3s_1 + 4s_2 + 2s_3 \equiv 12 \pmod{17} \\ 1s_1 + 9s_2 + 5s_3 \equiv 8 \pmod{17} \\ \vdots \end{cases} $$

However, what happens if we add a very small “random error (noise)” $e$ to the results of these equations?

$$ \begin{cases} 3s_1 + 4s_2 + 2s_3 + e_1 \equiv 13 \pmod{17} \\ 1s_1 + 9s_2 + 5s_3 + e_2 \equiv 7 \pmod{17} \\ \vdots \end{cases} $$

With just the addition of this error $e$, the problem of finding the secret variable vector $\vec{s}$ transforms into an NP-hard problem that is difficult to decipher even using current supercomputers or quantum computers. This is the LWE problem.

Ring-LWE Problem (RLWE)

The standard LWE problem involves matrix operations, which means the key size is extremely large (sometimes in gigabytes) and computational efficiency is poor. To solve this, the Ring-LWE (RLWE) problem, which uses operations over polynomial rings, was introduced.

In RLWE, elements belong to the polynomial ring $R_q = \mathbb{Z}_q[x] / (x^N + 1)$ (where $N$ is a power of 2, and $q$ is the modulus prime). Let the secret key be a polynomial $s(x)$, and with a random polynomial $a(x)$ and a small noise polynomial $e(x)$, the public key becomes the following pair:

$$ (a(x), b(x)) \quad \text{where} \quad b(x) = -a(x) \cdot s(x) + e(x) \pmod q $$

During encryption, the plaintext $m(x)$ is encoded using the properties of this polynomial to generate the ciphertext.

4. The Biggest Barrier “Noise” and Gentry’s Bootstrapping

The most important concept in understanding FHE is “noise management.”

In LWE/RLWE-based cryptography, small “noise (errors)” are intentionally included to ensure security. The process of decrypting a ciphertext $c$ of a plaintext $m$ can be roughly represented by the following formula:

$$ D(c) = (c \cdot s) \pmod q = m + \text{noise} $$

During decryption, this noise is removed through rounding processes or similar to obtain the correct plaintext $m$. However, when homomorphic operations (especially multiplication) are performed between ciphertexts, this noise is dramatically amplified.

Homomorphic Addition: Noise increases additively ($e_1 + e_2$). This is a relatively gradual increase.
Mathematical Representation of Homomorphism by Homomorphic Addition: $$ E(m_1) \oplus E(m_2) = E(m_1 + m_2) $$
Homomorphic Multiplication: Noise explodes multiplicatively (because it includes terms like $e_1 \times e_2$). After just a few multiplications, the noise exceeds the threshold $q/2$, preventing correct rounding and causing decryption to fail.
Mathematical Representation of Homomorphism by Homomorphic Multiplication: $$ E(m_1) \otimes E(m_2) = E(m_1 \times m_2) $$

This is the reason why FHE could not be realized for a long time and remained at the level of SHE (with a limited number of operations).

The Magic of Bootstrapping

Craig Gentry’s genius contribution was inventing a noise reduction technique called “bootstrapping.” This was a paradigm shift in cryptography.

Intuitively, it is the operation of “‘decrypting’ the ciphertext to clean it while it remains encrypted, and putting it into a new ciphertext before it becomes too noisy and breaks.”

Suppose we have a highly noisy ciphertext $C_{noisy}$.
The client provides the server in advance with the secret key $sk$ “encrypted with the public key,” $E_{pk}(sk)$ (this is called the bootstrapping key).
The server runs a Decryption Circuit homomorphically on $C_{noisy}$.
Specifically, it performs a “decryption within the encrypted space” on $E_{pk}(C_{noisy})$ using $E_{pk}(sk)$.
Since this decryption circuit itself is a homomorphic operation, it generates new noise, but the noise of the newly output ciphertext $C_{fresh}$ is reset to a fixed “constant level.”

graph LR A["High noise ciphertext C_noisy"] --> B["Homomorphic decryption circuit (Eval_Dec)"] C["Encrypted secret key E(sk)"] --> B B --> D["Low noise ciphertext C_fresh"] style B fill:#ffeeba,stroke:#ffc107

By executing this bootstrapping periodically during computation, it theoretically became possible to compute circuits of infinite depth (achieving FHE). However, Gentry’s early scheme was desperately expensive computationally, with a single bootstrapping operation taking anywhere from tens of minutes to hours.

5. Generations of FHE and the Evolution of Major Schemes

In the race toward practical FHE, cryptographers around the world have competed to improve the algorithms. Currently, FHE is mainly classified into four generations or families.

2nd Generation: Exact Integer Arithmetic (BGV, BFV)

The BGV (Brakerski-Gentry-Vaikuntanathan) and BFV (Brakerski/Fan-Vercauteren) schemes appeared between 2011 and 2012. These are based on RLWE and are suitable for integer modular arithmetic (exact calculations). They support batching techniques like SIMD (Single Instruction, Multiple Data), characterized by the ability to pack thousands of data slots into a single large polynomial ciphertext and compute them in parallel all at once.

3rd Generation: Accelerated Bootstrapping (GSW, FHEW, TFHE)

The GSW (Gentry-Sahai-Waters) scheme of 2013 made the structure of FHE simpler. This was developed further into TFHE (Fast Fully Homomorphic Encryption over the Torus), one of the mainstream schemes today. The hallmark of TFHE is its extremely fast bootstrapping (on the order of milliseconds). It excels at gate-level operations (logic circuits like AND, XOR), and since the ciphertext size is relatively small, it is suited for fast evaluation of arbitrary logic circuits.

4th Generation: Specialization for Approximate Calculation and Machine Learning (CKKS)

The CKKS (Cheon-Kim-Kim-Song) scheme proposed by Cheon et al. in 2017 can be called the definitive technology for privacy protection in current AI and machine learning. While previous FHEs insisted on “exact integer calculations,” CKKS supports “approximate calculations of floating-point numbers” while remaining encrypted. It demonstrates overwhelming performance in real number calculations where small errors are tolerable, such as the training and inference of neural networks.

The table below summarizes how to choose a scheme by purpose.

Scheme Name	Preferred Data Type	Recommended Use Cases	Features
BFV / BGV	Integer	Exact statistical calculations, financial data aggregation, DB queries	High throughput via SIMD batching
CKKS	Real/Complex	Machine learning (DNN, logistic regression), signal processing	Acceleration via approximate calculation, rescaling
TFHE	Boolean	Arbitrary logic circuits, string search, evaluation of non-linear functions	Ultra-fast bootstrapping (millisecond range)

6. Practice: FHE Libraries and Conceptual Code

Today, many open-source libraries are provided that allow you to use FHE without deep cryptographic knowledge.

Microsoft SEAL (Simple Encrypted Arithmetic Library): A C++ library supporting BFV, BGV, and CKKS. One of the industry standards. Its Python binding, TenSEAL, is popular among AI engineers.
Zama (Concrete): A framework based on TFHE. You can write in Rust/Python, and it provides functionality (Concrete ML) to compile existing PyTorch models and run them on FHE.
OpenFHE: The successor to PALISADE, a comprehensive C++ library supporting all major schemes.

Example of FHE Programming using Python (TenSEAL)

Here, we show a conceptual Python code example using the CKKS scheme to add and multiply real number vectors while they remain encrypted.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


import tenseal as ts

# 1. Context setup (including key generation)
# Use CKKS scheme, set polynomial degree to 8192
context = ts.context(
 ts.SCHEME_TYPE.CKKS,
 poly_modulus_degree=8192,
 coeff_mod_bit_sizes=[60, 40, 40, 60]
)
context.generate_galois_keys()
context.global_scale = 2**40 # Scaling factor for real numbers

# 2. Client side: Data encryption
vector1 = [1.5, 2.5, 3.5]
vector2 = [2.0, 3.0, 4.0]

# Convert plaintext vectors to ciphertexts (should be executed on the client side)
enc_v1 = ts.ckks_vector(context, vector1)
enc_v2 = ts.ckks_vector(context, vector2)

# 3. Server side: Computations while encrypted (Protection of Data in Use)
# The server does not know the plaintexts but can perform addition and multiplication
enc_add = enc_v1 + enc_v2
enc_mul = enc_v1 * enc_v2

# 4. Client side: Decryption of results
# Only the client with the secret key can view the results
res_add = enc_add.decrypt()
res_mul = enc_mul.decrypt()

print(f"Decrypted addition result: {res_add}")
# Example output: [3.5000001, 5.5000001, 7.5000002] (Includes minute errors due to approximate calculation)

print(f"Decrypted multiplication result: {res_mul}")
# Example output: [3.0000002, 7.5000005, 14.0000003]

As you can see from the code above, you can intuitively describe computations between ciphertexts by overloading normal Python operators, such as enc_v1 + enc_v2. On the server side, vector operations are completed without knowing the contents of the vectors.

7. FHE Challenges: Performance and Hardware Acceleration

While FHE provides theoretically perfect security, its biggest challenge for practical use is “performance overhead.”

Computational Overhead: Compared to computing in plaintext, computing in ciphertext is thousands to tens of thousands of times slower on a CPU. Polynomial multiplications and bootstrapping require massive amounts of FFT (Fast Fourier Transform) or NTT (Number Theoretic Transform) calculations.
Ciphertext Expansion: A few bytes of plaintext can expand to several megabytes when encrypted. This puts severe pressure on memory bandwidth and network bandwidth.

Approaches to Hardware Solutions

To overcome this overhead, the development of dedicated FHE hardware accelerators (ASIC, FPGA, GPU support) is progressing worldwide.

GPU Acceleration: Efforts are underway to parallelize NTT operations and bootstrapping using powerful GPUs from NVIDIA and others, with reports of speeds tens of times faster than software implementations (e.g., 100x.ai, Zama’s TFHE-rs CUDA backend).
DARPA DPRIVE Project: The US Defense Advanced Research Projects Agency (DARPA) is promoting the “DPRIVE (Data Protection in Virtual Environments)” project to develop dedicated hardware to bring the computational speed of FHE to parity with plaintext processing (within a 10x overhead). Intel, Microsoft, and Intellectual Ventures are participating.
Emergence of FPUs (FHE Processing Units): Startups like Cornami and Optalysys are embarking on the development of FHE-specific chips using optical computing and specialized silicon architectures.

In the near future, an era may come where “FPUs” become a standard feature in server and cloud infrastructure, just like NPUs (Neural Processing Units) in AI.

8. Expected Use Cases

Now that FHE is approaching practical speeds, disruptive innovations are expected in areas such as:

Privacy Protection in Medical and Genomic Analysis: By having a cloud AI learn from patients’ medical records and DNA data held by multiple hospitals while keeping it encrypted with FHE, highly accurate cancer diagnostic models and new drug development can be performed without violating privacy laws (like HIPAA or GDPR).
Fraud Detection and Anti-Money Laundering (AML) for Financial Institutions: Competing banks can cross-analyze data in an encrypted state to detect massive illegal money transfer networks, without revealing customer account information or transaction histories to each other.
Secure AI Inference APIs (MaaS: Model as a Service): Users encrypt their voice, facial images, and prompts before sending them to AI services (like LLMs such as ChatGPT). The AI provider generates the answer without ever knowing the user’s input and returns it as a ciphertext. This completely dispels the concern of “AI learning or peeking at personal information.”

9. Conclusion: The Future of Cryptography is “Unseen Computation”

Just as the invention of public key cryptography (RSA) in the 1970s enabled secure communication on the Internet (such as HTTPS), Craig Gentry’s invention of FHE is one of the most important milestones in the history of cryptography.

Today, Fully Homomorphic Encryption (FHE) has leapt from the theories of laboratories into the stage where Microsoft, IBM, Intel, Google, and many startups are fiercely competing toward practical application. While challenges regarding computational cost and data size still exist, thanks to the refinement of algorithms and the evolution of hardware accelerators, performance improvements continue at a pace exceeding Moore’s Law.

In a few years, “computing data while keeping it encrypted” will not be something special, but will likely become the standard data protection best practice in cloud services. FHE is the keystone of next-generation security, realizing the ultimate combination of privacy and data utilization in a data-driven society.