Is the int8 type ciphertext realized by only a single LWE ciphertext?

Zama TFHE-rs
1

I wonder that if the LWE ciphertext support the int8 type arithmetic? If so, how large is the ring dimension N used in blind rotation?

2

hello @GuLu_GuLu it can in shortint, but the parameters we have for it don’t allow to make much computations on it except bootstrapping IIRC because there is no margin for noise for leveled operations

pub const PARAM_MESSAGE_8_CARRY_0_KS_PBS_GAUSSIAN_2M64: ClassicPBSParameters =
    ClassicPBSParameters {
        lwe_dimension: LweDimension(1110),
        glwe_dimension: GlweDimension(1),
        polynomial_size: PolynomialSize(32768),
        lwe_noise_distribution: DynamicDistribution::new_gaussian_from_std_dev(StandardDev(
            3.038278019865525e-08,
        )),
        glwe_noise_distribution: DynamicDistribution::new_gaussian_from_std_dev(StandardDev(
            2.168404344971009e-19,
        )),
        pbs_base_log: DecompositionBaseLog(15),
        pbs_level: DecompositionLevelCount(2),
        ks_base_log: DecompositionBaseLog(2),
        ks_level: DecompositionLevelCount(11),
        message_modulus: MessageModulus(256),
        carry_modulus: CarryModulus(1),
        max_noise_level: MaxNoiseLevel::new(1),
        log2_p_fail: -64.011,
        ciphertext_modulus: CiphertextModulus::new_native(),
        encryption_key_choice: EncryptionKeyChoice::Big,
    };
1 Like
3

Thanks for the reply. My understanding is: to support any binary arithmetic for int8 type, the ring dimension N should at least (8 + e) -bits, where the noise part e mainly comes from the modulus switching, for example, e can be 9-bit if the LWE dimension is 1024. Is that right?

4

Hello @GuLu_GuLu

the ring dimension N should at least (8 + e) -bits, where the noise part e mainly comes from the modulus switching

you are right. In practice e is composed of the input noise and some additional noise due to the modulus switch. This additional noise is drawn from a gaussian distribution with a variance ~ n/24. So for an LWE dimension n of 1024, the modulus switching part of the noise e will be written on 5-6 bits.

1 Like
5

Thanks, @Sam .
I got what you mean. I want to know more details about the implementation of the FHEint8 in TFHE.rs. As you described above, the modulus switching will incur about 5~6 bits of noise, as a result, to enable the look-up table, the ring dimension N should be at least 2^(8 + 6) = 16384 ?

I have also have an another question, how does the multiplication performed about the FHEint8 type? Is it similar to the ciphertext multiplication in BFV?