A Multi-Key Homomorphic Scheme Based on Multivariate Polynomial Look-Up Tables Evaluation

Abstract

Multi-key homomorphic encryption (MKHE) is crucial for secure collaborative computing, yet it suffers from high multiplicative depth and computational overhead during Look-Up Table (LUT) evaluations, particularly for large input domains. To address these challenges, this paper proposes an optimized LUT evaluation method based on multivariate polynomial approximation. Specifically, we partition the high-dimensional input space into several lower-dimensional variables to design low-depth multivariate polynomials. By integrating blockwise encoding and tensor-based transformations, we construct a parallelizable evaluation framework that maps multivariate functions into a high-dimensional polynomial-coefficient space. This approach allows for efficient parallel processing and effective noise management. Theoretical analysis demonstrates that our method significantly reduces the multiplicative depth from $O\left(\mathcal{l}\right)$ to $O(\mathcal{l}/\alpha )$, indicating its robustness and efficiency in large-scale LUT scenarios.

1. Introduction

Cloud computing has significantly transformed the way digital services operate in modern society. By enabling centralized resource sharing and elastic scalability, it has greatly reduced computing costs while improving efficiency. From enterprise data storage and online collaboration tools to AI training and medical data analysis, cloud platforms enable users worldwide to access computing resources conveniently. However, data privacy remains a critical challenge in this digital age. As organizations increasingly rely on cloud services to store and process sensitive information, concerns about third-party data leaks and unauthorized access have become more pronounced.

To address these privacy concerns, the concept of privacy-preserving computation has emerged as a crucial area of focus. It aims to protect sensitive data during the processing phase, ensuring that personal and confidential information remains secure from unauthorized access or breaches. Techniques in this domain include secure multi-party computation, differential privacy, and federated learning, each offering mechanisms to compute on encrypted data or process data in a decentralized manner, thereby minimizing exposure to potential security threats. Despite these advancements, ensuring end-to-end data confidentiality in cloud environments continues to pose significant challenges, especially when computations must be performed on sensitive data without exposing it in plaintext. This is where the field of homomorphic encryption (HE) plays a pivotal role, offering a promising solution by enabling computations directly on encrypted data. HE ensures that data remains confidential throughout the computation process, addressing key privacy concerns in cloud computing environments.

This is where the field of homomorphic encryption (HE) plays a pivotal role, enabling computations directly on encrypted data. Since Gentry’s groundbreaking construction of the first fully homomorphic encryption (FHE) scheme in 2009 [1], researchers have continuously worked to improve its performance. In 2012, Fan and Vercauteren proposed a practical RLWE-based FHE scheme, commonly known as the FV scheme, which uses a scaled noise management technique and enables efficient homomorphic computation over the integer domain [2]. In 2014, they proposed the BGV scheme, which reduced computational complexity through a leveled structure and supported efficient SIMD-style batch processing [3]. In 2017, Cheon et al. introduced the CKKS scheme, which made a breakthrough by enabling approximate computation on floating-point numbers [4], laying the foundation for encrypted inference in machine learning models. However, the practicality of FHE has long been constrained by the efficiency of bootstrapping—the process of refreshing ciphertexts to restore their computational capacity. In 2015, Ducas and Micciancio proposed the FHEW scheme, which, for the first time, reduced bootstrapping time to under one second [5]. The Chillotti team further advanced this in 2016 with the TFHE framework, accelerating bootstrapping to the 0.1 s level through improved polynomial operations and hardware optimizations, and later expanded its support for high-precision arithmetic [6]. In 2019, Hao Chen and colleagues proposed multi-key homomorphic encryption, addressing the key heterogeneity issue in collaborative computations. This advancement enabled multiple parties to securely compute on jointly encrypted data, each using independent encryption keys [7].

In 2020, Chillotti et al. proposed a method within the TFHE scheme that uses a CMux (controlled multiplexer) to dynamically select the target TRLWE ciphertext based on a control bit ciphertext [8]. While CMux offers significant advantages in terms of noise growth, its theoretical time complexity remains relatively high. In 2024, Heewon Chung and colleagues introduced a technique using multivariate polynomial fitting for Look-Up Tables (LUTs). Compared to univariate polynomials [9], this approach enables faster evaluation and supports parallel computation. Therefore, exploring the potential application of multivariate polynomial fitting in multi-key homomorphic encryption schemes is a promising direction for future research.

Fully homomorphic encryption (FHE) based on Ring Learning with Errors (RLWE) provides a theoretical foundation for privacy-preserving computation, but still faces numerous challenges in practical applications. Traditional FHE schemes such as BGV and BFV mitigate noise growth through modulus switching on polynomial rings, yet they remain constrained by multiplication depth when handling high-degree logic circuits. In the TFHE framework proposed by Chillotti et al., the Look-Up Table (LUT) evaluation mechanism built on CMux gates enables encrypted computation through tree-structured Boolean circuits [10]. However, its single-bit bootstrapping mode exhibits significant limitations when supporting multivariate polynomial functions: after each layer of logic gate computation, bootstrapping must be triggered to suppress linearly accumulated noise. As a result, complex logic circuits (such as 128-bit AES decryption) may require over 300 bootstrapping operations. This characteristic leads to end-to-end latency reaching the scale of minutes (even several seconds with FPGA acceleration), making it difficult to meet the millisecond-level response requirements of real-time encryption and decryption scenarios.

In 2012, López-Alt et al. proposed an early multi-key FHE (MKFHE) scheme [11], which extended the key space to support multi-party computation. However, during joint decryption, the ciphertext dimension grew linearly with the number of participants, resulting in significant communication overhead. In 2017, Chen et al. introduced a multi-hop multi-key scheme based on the BGV framework, which allowed encryption of entire ring elements instead of single bits, and supported ciphertext packing using the Chinese Remainder Theorem (CRT) technique [12]. In 2019, Chen et al. further designed a multi-key extension scheme to support collaborative multi-party computation by generating relinearization keys for joint ciphertexts using a single encryption algorithm [13]. The core innovation of this approach lies in encoding the algebraic relationships of multiple keys as a tensor structure over polynomial rings, leveraging the composability of the RLWE (Ring Learning with Errors) problem to enable joint operations across different users’ keys.

In recent years, research has seen continuous breakthroughs. In 2018, Micciancio et al. proposed a polynomial encoding technique based on ring algebra structures, enabling the packing of multiple ciphertexts into a single RLWE ring element [14]. While this approach successfully enhanced bootstrapping throughput by 3.5 times and reduced key size by nearly 40% through dynamic modulus switching [15], it is primarily optimized for single-user scenarios. When applied to multi-party computation, the linear growth of ciphertext dimension with the number of users remains a bottleneck that this encoding technique does not address [16,17].

In 2021, Micciancio and colleagues also introduced an amortized bootstrapping technique based on Galois automorphisms, reducing AES round function latency to 50 ms [18]. However, similar to the previous work, this method lacks specific optimizations for the complex key-switching operations required in multi-key environments.

More recently, in 2024, Chung et al. proposed a LUT evaluation method using low-degree multivariate polynomials [8]. By encoding binary streams as roots of unity and leveraging SIMD capabilities, they achieved an amortized decryption time of 280 ms for AES-128 on a single GPU, representing a significant improvement over traditional TFHE schemes [19]. Despite these advantages, Chung et al.’s method is built upon the CKKS scheme, which is designed for approximate arithmetic on real numbers [20]. However, many privacy-preserving applications strictly require exact arithmetic over integers [21,22]. Therefore, directly applying their method to the BFV scheme is non-trivial due to the differences in plaintext encoding and noise management. Furthermore, their work does not account for the noise expansion introduced by multi-key tensor products in a collaborative setting [23].

To bridge this gap, our paper extends the multivariate polynomial evaluation to the Multi-Key Homomorphic Encryption (MKHE) setting. Unlike the aforementioned works, we integrate blockwise encoding with a tensor-based transformation specifically designed to handle multiple keys, thereby enabling efficient parallel LUT evaluation while effectively managing the noise growth characteristic of multi-party computation.

Our Contribution

While recent studies have explored Look-Up Table (LUT) evaluation, most approaches focus on approximate schemes like CKKS, which tolerate precision loss. However, such methods may be less suitable for scenarios requiring strict exact arithmetic. Conversely, many existing BFV-based LUT approaches often rely on straightforward polynomial formulations, leading to prohibitive multiplicative depths and noise growth when scaling to high-dimensional inputs.

To address these limitations, this paper proposes an optimized LUT evaluation framework specifically tailored for the Multi-Key BFV scheme. By integrating multivariate polynomial decomposition with blockwise encoding, we achieve efficient, exact, and scalable homomorphic evaluation.

Specifically, our core contributions are as follows:

• Multivariate Polynomial Framework for BFV: We propose a novel framework that maps complex functions into a multi-dimensional polynomial space. Unlike naive encodings, we employ blockwise encoding and tensor-based transformations to handle multiple keys, significantly reducing ciphertext expansion while preserving exact arithmetic semantics.
• Depth-Optimized Parallel Evaluation: We introduce a parallel evaluation mechanism that partitions high-dimensional inputs into low-dimensional variables. This strategy reduces the multiplicative depth from $O\left(\mathcal{l}\right)$ to $O(\mathcal{l}/\alpha$), effectively controlling the noise accumulation that typically bottlenecks BFV-based LUT evaluation.
• Tensor-Based Multi-Key Management: We address the challenge of key heterogeneity in collaborative computing by encoding algebraic relationships of multiple keys as a tensor structure. This enables joint encryption and evaluation without introducing extra key-switching rounds beyond the standard MK-BFV workflow.

2. Preliminaries

In this paper, ℤ denotes the set of all integers. In this multi-key homomorphic encryption scheme, N denotes the dimension of the RLWE polynomial ring, determining the degree of the polynomial modulus; q is the coefficient modulus, defining the range of values for coefficients within the quotient ring $R_q$; $\mathcal{l}$ represents the bit-length of the Look-Up Table (LUT) input, indicating the scale of the input domain; and $\alpha$ signifies the number of variables into which the input is partitioned, where the scheme splits the $\mathcal{l}$-bit input into $\alpha$ variables to construct low-degree multivariate polynomials, significantly reducing multiplicative depth. Bold lowercase letters represent vectors, such as s denoting the secret key vector, while uppercase letters denote matrices, such as the transformation matrix U. The polynomial ring over integers modulo the cyclotomic polynomial $X^N+1$ is denoted as $R=Z\left[X\right]/(X^N+1)$, and ${\mathcal{R}}_q=(\mathbb{Z}/q\mathbb{Z})\left[X\right]/(X^N+1)$ denotes the quotient ring where coefficients lie in the range (−q/2, q/2) modulo $X^N+1$. For a set S, U(S) represents the uniform distribution over S. The symbol ${\mathrm{D}}_{\mathsf{\sigma }}$ denotes a Gaussian distribution with standard deviation $\sigma (\sigma >0)$. For a positive integer k, the notation [k] represents the index set {1, 2, ……, k}. The symbol $\chi$ denotes a discrete Gaussian distribution. The term $\Delta \mathrm{D}$ represents a tensor error term, and its maximum norm is quantified by the infinity norm $\parallel ·{\parallel }_{\infty }$.

2.1. Ring Learning with Errors

Let $R=\mathbb{Z}\left[X\right]/\left(f\right(X\left)\right)$ be a cyclotomic polynomial ring and let $R_q=R/qR$ for a modulus $q$. Let $\chi$ denote an error distribution over $R$ (e.g., a discrete Gaussian over coefficients). A secret key $s$ is sampled from $R_q$.

RLWE distribution: For a fixed secret $s\in R_q$, an RLWE sample is drawn as

$$a\leftarrow U\left(R_q\right),e\leftarrow \chi ,b=a\cdot s+e\left(\mathrm{m}\mathrm{o}\mathrm{d}q\right),$$

and the sample is the pair $(a,b)\in R_q^2$. (Equivalently, one may use $b=-a\cdot s+e\left(\mathrm{m}\mathrm{o}\mathrm{d}q\right)$; this is an equivalent convention).

Search RLWE: Given polynomially, many samples $(a_i,b_i)$ drawn from the above RLWE distribution for the same secret $s$, recover $s$.

Decision RLWE: Given polynomially many pairs $(a_i,b_i)$, distinguish whether they are drawn from the RLWE distribution $A_{s,\chi }$ for some secret $s$, or from the uniform distribution $U\left(R_q^2\right)$.

In this work, we rely on the hardness of the (search/decision) RLWE assumption with parameters $(R,q,\chi )$, which underpins the security of lattice-based (multi-key) homomorphic encryption schemes.

2.2. CMux

The CMux gate (Controlled Multiplexer gate) has three input ports and one output port: one control input port represented by a TGSW sample, two data input ports each carrying a TLWE sample, and one data output port, which is also of TLWE type. The CMux gate can homomorphically output the message from one of the data input ports, depending on the Boolean value in the control input sport, without decrypting any ciphertext. The working principle of the CMux gate is as follows: The control input is a TGSW sample C, whose message ${\mu }_C$ is a Boolean value (0 or 1). The data inputs are two TLWE samples $d_0$ and $d_1$, whose messages are ${\mu }_{d_0}$ and ${\mu }_{d_1}$, respectively. The output of the CMux gate is a TLWE sample, whose message μ is selected based on the value of the control input: if ${\mu }_C=1$, then the output message $\mu ={\mu }_{d_1}$; if ${\mu }_C=0$, then the output message $\mu ={\mu }_{d_0}$. The mathematical expression of the CMux gate can be represented as

$$CMux\left(C,d_1,d_0\right)=\mathit{C}·\left(d_1-d_0\right)+d_0$$

The expression $C·\left(d_1-d_0\right)$ represents the external product of the TGSW sample C with the TLWE sample $\left(d_1-d_0\right)$. Additionally, the noise amplitude and noise variance of the CMux gate are both influenced by the noise of the input samples and are adjusted through the noise parameters of the control input sample C. This structure and working principle make the CMux gate very useful in homomorphic encryption, allowing it to selectively output the message from the data inputs based on the Boolean value of the control input, while keeping the noise within a controllable range.

2.3. Look-Up Table

A Look-Up Table (LUT) provides an efficient alternative for evaluating complex functions in Homomorphic Encryption (HE) by predefining input-output mapping relationships. Since HE inherently supports only limited operations (e.g., additions and multiplications), direct computation of nonlinear functions or logic gates faces challenges such as noise accumulation and computational depth constraints. LUT circumvents these limitations by pre-encoding all possible function outcomes into polynomial or ciphertext forms, allowing encrypted data to bypass intricate computational steps through direct table Look-Up Table. For instance, during the bootstrapping process, LUT embeds decryption functions into RLWE ciphertexts, leveraging sample extraction techniques to generate LWE ciphertexts carrying target function values—thereby achieving ciphertext refreshment and function evaluation simultaneously. This mechanism not only sidesteps the hierarchical limitations of traditional homomorphic operations but also integrates boxing (data partitioning) and Blind Rotate operations to parallelize multiple LUT tasks, significantly enhancing throughput efficiency.

To maximize LUT’s practicality, hardware-algorithm co-optimization pathways are proposed. On the hardware front, LUT serves as a core unit in FPGA programmable logic, enabling flexible mappings via circuit designs like CMux gates to reduce physical resource consumption. Algorithmically, techniques such as the Residue Number System (RNS) and Number Theoretic Transform (NTT) accelerate polynomial operations, while key-switching reduces modulus sizes, thereby compressing storage and computational costs. Additionally, dynamic precision adjustment, interpolation techniques, and hash-based compression balance speed and error control. The deep integration of LUT with HE now supports privacy-preserving computations for complex functions like piecewise polynomials and logic circuits. However, large-scale deployment in multi-party computation scenarios requires overcoming parallel scalability bottlenecks and addressing error propagation challenges in high-dimensional data scenarios.

2.4. Basic Multi-Key Scheme

Unlike single-key homomorphic schemes, which only allow ciphertexts encrypted under a single key, multi-key homomorphic schemes enable multiple participants to engage in joint computations, with each party holding its own private key. The workflow of multi-key homomorphic schemes consists of the following steps:

Setup: $pp\leftarrow MKHE.Setup\left(1^{\mathsf{\lambda }}\right)$, $\mathsf{\lambda }$ is a security parameter that returns the public parameter $pp$.

Key Generation: $(sk,pk)\leftarrow MKHE.KeyGen\left(pp\right)$ generate the public key pk and secret key $sk$ based on the public parameters pp.

Encryption: ${\overline{ct}}_i\leftarrow MKHE.Enc({\mu }_i,\{{pk}_i{\}}_{\mathrm{i}\in \left[\mathrm{k}\right]})$ the ciphertext ${\overline{ct}}_i$ is generated by encrypting the plaintext $m_i$ with the public key ${pk}_i$, where i represents the party with index i.

Decryption: $m\leftarrow \overline{MKHE}.Dec(\overline{\overline{ct}},\{{sk}_i{\}}_{\mathrm{i}\in \left[\mathrm{k}\right]})$ for a given ciphertext $\overline{\overline{ct}}$, there is a corresponding key ${sk}_i$ to decrypt the ciphertext into plaintext m.

Evaluation: $\overline{ct}\leftarrow \mathrm{M}\mathrm{K}\mathrm{H}\mathrm{E}.\mathrm{E}\mathrm{v}\mathrm{a}\mathrm{l}(\mathcal{C},\{{\overline{ct}}_i{\}}_{\mathrm{i}\in \left[\mathrm{k}\right]},\left\{{pk}_i{\}}_{\mathrm{i}\in \left[\mathrm{k}\right]}\right)$ for a given circuit $\mathcal{C}$, there is a set of multi-key ciphertext ${\overline{ct}}_1,\dots ,{\overline{ct}}_1$ and the corresponding key ${pk}_1,\dots ,{pk}_k$ to perform corresponding operations to output ciphertext $\overline{\overline{ct}}$.

2.5. Number Theory Transformations

In the mathematical foundations of cryptography and coding theory, the core properties of finite fields and their primitive roots provide key support for complex functions and matrix constructions. Let a prime p define the finite field $Z_p$, whose multiplicative group $Z_p^{*}$, as a cyclic group, must have a primitive root g, that is, an element satisfying $g^{p-1}\equiv 1 \mathrm{m}\mathrm{o}\mathrm{d} p$ and $g^k\not\equiv 1 \mathrm{m}\mathrm{o}\mathrm{d} p(0<k<n)$, this property allows the powers of g to traverse all non-zero elements of $Z_p^{*}$. Based on the algebraic properties of primitive roots, multivariate combination functions can be further defined.

$$f_j(u_0,\dots ,u_{b-1})=\sum _{a_0=0}^{n-1} \dots \sum _{a_{b-1}=0}^{n-1} C_j[a_0,\dots ,a_{b-1}]\cdot u_0^{a_0}\dots u_{b-1}^{a_{b-1}}$$

The combination coefficient $C_j$ weights the contributions of different powers, and this function maps discrete variables to structured polynomials on a finite field through a multi-exponential summation form. At the same time, a matrix with Vandermonde form is constructed. In the finite field $Z_p$, where p is a prime number, the primitive root g modulo p satisfies $g^n\equiv 1 \mathrm{m}\mathrm{o}\mathrm{d} p$, and $g^k\not\equiv 1$.

$$U=\left[\begin{array}{cccc}{g}^{0\times 0}& g^{0\times 1}& \cdots & g^{0\times 1}\\ g^{1\times 0}& g^{1\times 1}& & g^{1\times (n-1)}\\ & & \ddots & \\ g^{(n-1)\times 0}& g^{(n-1)\times 1}& \cdots & g^{(n-1)\times (n-1)}\end{array}\right]$$

The elements of the matrix are composed of linear combinations of the powers of the primitive root and the variable $x_j$. This design not only inherits the traversal and linear independence properties of the primitive root but also provides the matrix with efficient invertibility and computational advantages in determinant calculations, number-theoretic transforms (NTT), and error-correcting codes (such as Reed-Solomon codes).

3. Look-Up Table Evaluation

3.1. Univariate Polynomials

Traditional LUTs achieve input-to-output mapping through direct indexing. However, in Homomorphic Encryption (HE), ciphertexts cannot reveal plaintext index positions, rendering traditional Look-Up Table methods ineffective. To address this, encoding the LUT as a univariate polynomial can solve the plaintext exposure problem. This involves constructing a polynomial f(x) in the plaintext space such that for all inputs $x_i$, $f\left(x_i\right)=T\left(x_i\right)$. Using Lagrange interpolation, the polynomial can be expressed as

$$f\left(x\right)=\sum _{i=0}^{2^n-1} T\left(x_i\right)\prod _{j\ne i} {\displaystyle \frac{x-x_j}{x_i-x_j}}$$

In plaintext computation, a LUT resembles an array, allowing direct retrieval of output results through indexing. For instance, if the input has k bits, the LUT contains $2^k$ entries, each corresponding to an output result. However, in homomorphic encryption, the situation differs as encrypted data cannot directly index specific positions, rendering traditional array indexing methods ineffective. It is necessary to convert this into a form suitable for ciphertext computation, with a common method being polynomial interpolation. If the input has k bits, the polynomial will have k coefficients corresponding to them, fitting a polynomial of the form

$$f\left(x\right)=a_0+a_{1}x+a_2{x}^2+\cdots +a_{k-1}{x}^{k-1}$$

Univariate polynomials can accurately fit a LUT with k input items, where k output results correspond to k unique coefficients. However, the drawbacks are evident, with the highest degree being n − 1. For example, an 8-bit input requires a 255-degree polynomial, and computing $x^{255}$ requires approximately 8 squaring operations (since ${\mathrm{l}\mathrm{o}\mathrm{g}}_2\left(255\right)\approx 8$), leading to exponential growth in multiplicative depth and noise. Additionally, there is a sparsity issue; even if the actual LUT has only a few non-zero entries, all high-degree terms must still be explicitly computed. While univariate polynomials are theoretically feasible, they face challenges in HE due to high computational depth and uncontrolled noise, making it difficult to support large input LUTs.

3.2. Multivariate Polynomials

For the univariate polynomial $f\left(x\right)={\sum }_{i=0}^{n-1}{a}_i{x}^i$, where $a_i$ are the polynomial coefficients ($a=\left[\begin{array}{ccc}{a}_0& \cdots & a_{n-1}\end{array}\right],\mathit{d}=\left[\begin{array}{ccc}{\mathit{d}}_0& \cdots & {\mathit{d}}_{n-1}\end{array}\right]$), there is a unique set of coefficients a corresponding to the outputs d. This can be represented as

$$\left[\begin{array}{ccc}{a}_0& \cdots & a_{n-1}\end{array}\right]\cdot \mathit{U}=\left[\begin{array}{ccc}{\mathit{d}}_0& \cdots & {\mathit{d}}_{n-1}\end{array}\right]$$

Thus, the target values can be computed from the coefficient matrix $\left[\begin{array}{ccc}{a}_0& \cdots & a_p\end{array}\right]$ and a prime number p. The matrix $\mathit{U}$ is constructed from the powers of a primitive root g of p. Solving for d can be accelerated using the Number Theoretic Transform (NTT). The coefficients a can be solved using the inverse NTT [24]. By selecting a prime number p and its primitive root g, the number-theoretic transform matrix $\mathit{U}\in {\mathbb{Z}}_{\mathrm{p}}^{\mathrm{n}\times \mathrm{n}}$ can be constructed.

$$\mathit{U}\cdot {\mathit{U}}^{-1}\equiv \mathit{I} mod p$$

$$\mathit{U}=\left[\begin{array}{cccc}{g}^{0\times 0}& g^{0\times 1}& \cdots & g^{0\times (n-1)}\\ g^{1\times 0}& g^{1\times 1}& & g^{1\times (n-1)}\\ & & \ddots & \\ g^{(n-1)\times 0}& g^{(n-1)\times 1}& \cdots & g^{(n-1)\times (n-1)}\end{array}\right]mod p$$

As shown in the equation, the fitting polynomial constructed with a single variable x has high multiplicative depth. The high-degree terms in univariate polynomials have strong interdependencies, making parallel computation impossible and resulting in low computational efficiency. To address the high-degree drawback of univariate polynomials, multivariate polynomial decomposition employs a divide-and-conquer strategy. It splits kl-bit inputs into k low-dimensional sub-blocks, constructing a multivariate function $f(u_1,u_2,\dots ,u_k)$, where $u_i$ represents the encoded value of the i-th sub-block. This approach shifts to using multivariate polynomials.

$$f_j(u_1,\dots ,u_k)=\sum _{a_0=0}^{2^l} \dots \sum _{a_{k-1}=0}^{2^l} C_j[a_0,\dots ,a_{k-1}]\cdot u_0^{a_0}\dots u_{k-1}^{a_{k-1}}$$

Taking bivariate decomposition as an example, the input x is split into higher bits u and lower bits v (where u and v each consist of m bits). The polynomial form is

$$f\left(u,v\right)=\sum _{i=0}^{2^m-1} \sum _{j=0}^{2^m-1} a_{ij}{u}^i{v}^j$$

The coefficient matrix a for the bivariate polynomial is

$$a=\left[\begin{array}{cccc}{a}_{\mathrm{0,0}}& a_{\mathrm{0,1}}& \cdots & a_{0,2^m-1}\\ a_{\mathrm{1,0}}& a_{\mathrm{1,1}}& & a_{1,2^m-1}\\ & & \ddots & \\ a_{2^m-\mathrm{1,0}}& a_{2^m-\mathrm{1,1}}& \cdots & a_{2^m-1,2^m-1}\end{array}\right]$$

Definition 1. 

For a given dimension index k, the contraction operation of a multi-dimensional tensor $\mathit{C}\in {\mathbb{C}}^{n\times \cdots \times n}$ with a vector $\mathit{u}\in {\mathbb{C}}^{n_k}$ along the k-th axis produces a reduced-dimensional tensor B. For $k,\alpha \in \mathbb{N}$ where k < α, an α-dimensional tensor $\mathit{C}\in \mathbb{C}{\prod }_{i=0}^{\alpha -1} n_i$ (with $n_i$ being the dimension sizes) undergoes this operation.

$${\odot }_k:{\mathbb{C}}^{{\prod }_{i=0}^{\alpha -1} n_i}\times {\mathbb{C}}^{n_k}⟶{\mathbb{C}}^{{\prod }_{i=0}^{\alpha -1} n_i/n_k}$$

$\mathit{B}=\mathit{C}{\odot }_k\mathit{u}$ is as follows:

$$\begin{array}{c}\hfill \mathit{B}\left[i_0,\dots ,i_{k-1},i_{k+1},\dots ,i_{\alpha -1}\right]\hfill \\ \hfill ={\displaystyle \sum _{j=0}^{n-1}} \mathit{C}[i_0,\dots ,i_{k-1},j,i_{k+1},\dots ,i_{\alpha -1}]\cdot \mathit{u}[j]\hfill \end{array}$$

This formula performs a linear combination of the tensor C along the k-th axis, compressing one dimension of the high-dimensional tensor into a scalar, thereby achieving dimensionality reduction. All slices of the tensor along this axis undergo a dot product operation with the vector, ultimately eliminating that axis dimension. Additionally, Definition 2 can be derived from Definition 1.

Definition 2. 

Along the k-th axis, a multi-dimensional tensor C undergoes a linear transformation with a matrix $\mathit{U}\in {\mathbb{C}}^{n_k\times n_k}$, resulting in a tensor whose dimensions remain unchanged. For $k, \alpha \in \mathbb{N}$ where $k<\alpha$, there exists a matrix $\mathit{U}\in {\mathbb{C}}^{n_k\times n_k}$.

$${\otimes }_k:{\mathbb{C}}^{{\prod }_{i=0}^{\alpha -1} n_i}\times {\mathbb{C}}^{n_k\times n_k}⟶{\mathbb{C}}^{{\prod }_{i=0}^{\alpha -1} n_i}$$

$\mathit{D}=\mathit{C}{\otimes }_k\mathit{U}$ is as follows:

$$\mathit{D}[i_0,\dots ,i_{\alpha -1}]=\sum _{j=0}^{n-1} \mathit{C}[i_0,\dots ,i_{k-1},j,i_{k+1},\dots ,i_{\alpha -1}]\cdot \mathit{U}[j,i_k]$$

This formula applies a matrix transformation to the tensor slices along the specified k-th axis, achieving a feature space mapping of the axis dimension while keeping the dimension unchanged but reconstructing the feature space. According to Definition 2, for an invertible matrix $\mathit{U}\in {\mathbb{C}}^{n_k\times n_k}$, there exists an inverse matrix ${\mathit{U}}^{-1}$

$$\begin{array}{c}\hfill \mathit{C}{\otimes }_k\mathit{U}{\otimes }_k{\mathit{U}}^{-1}\hfill \\ \hfill =\left({\displaystyle \sum _{j=0}^{n-1}} \mathit{C}\left[i_0,\dots ,i_{k-1},j,i_{k+1},\dots ,i_{b-1}\right]\cdot \mathit{U}\left[j,i_k\right]\right){\odot }_k{\mathit{U}}^{-1}\hfill \\ \hfill ={\displaystyle \sum _{r=0}^{n-1}} {\displaystyle \sum _{j=0}^{n-1}} \mathit{C}\left[i_0,\dots ,i_{k-1},j,i_{k+1},\dots ,i_{b-1}\right]\cdot \mathit{U}\left[j,r\right]\cdot {\mathit{U}}^{-1}\left[r,i_k\right]\hfill \\ \hfill ={\displaystyle \sum _{r=0}^{n-1}} \mathit{C}[i_0,\dots ,i_{k-1},j,i_{k+1},\dots ,i_{b-1}]\cdot \left({\displaystyle \sum _{j=0}^{n-1}} \mathit{U}[r,j]\cdot {\mathit{U}}^{-1}[j,i_k]\right)\hfill \end{array}$$

$$\sum _{j=0}^{n-1} \mathit{U}[r,j]\cdot {\mathit{U}}^{-1}[j,i_k]={\delta }_{r,i_k}$$

In this context, ${\delta }_{r,i_k}$ is 1 when $r=i_k$ and 0 otherwise. Therefore, $\mathit{C}{\otimes }_k\mathit{U}{\otimes }_k{\mathit{U}}^{-1}=\mathit{C}$. The output matrix D can be obtained by performing α continuous multiplications of the tensor C with $\mathit{U}$.

$$\mathit{D}=\mathit{C}{\otimes }_0\mathit{U}{\otimes }_1\mathit{U}\cdots {\otimes }_{\alpha -1}\mathit{U}$$

The matrix $\mathit{U}$ serves as a basis transformation matrix, encoding the polynomial coefficients into a multi-dimensional tensor space. If the polynomial variables are $u_1,u_2,\cdots ,u_k$, the basis functions corresponding to each variable can be represented by the rows or columns of the matrix $\mathit{U}$. The matrix ${\mathit{U}}^{-1}$ is used for decoding, restoring the tensor computation results back to polynomial values. The tensor C can be recovered from the resulting tensor D through continuous inverse matrix operations.

$$\mathit{C}{\otimes }_0\mathit{U}{\otimes }_1\mathit{U}\cdots {\otimes }_{\alpha -1}\mathit{U}{\otimes }_{\alpha -1}{\mathit{U}}^{-1}\cdots {\otimes }_0{\mathit{U}}^{-1}=\mathit{C}$$

$$\mathit{C}=\mathit{D}{\otimes }_{\alpha -1}{\mathit{U}}^{-1}{\otimes }_{\alpha -2}{\mathit{U}}^{-1}\cdots {\otimes }_0{\mathit{U}}^{-1}$$

For the tensor C, the computational complexity for solving is $O\left(\alpha n^2\right)$. The overall complexity remains unchanged, but the computations for each variable are independent of each other. When constructing a multivariate polynomial, the maximum power for each variable $u_i$ is set to n − 1, satisfying $u^n=1 mod p$. This creates equivalence relations between higher-order and lower-order terms, avoiding redundant calculations. Additionally, choosing n as the degree results in a significantly lower maximum degree compared to univariate polynomials, greatly reducing the multiplicative depth.

3.3. Multiplicative-Depth Model and Depth Analysis

We measure homomorphic complexity using the standard arithmetic-circuit model consisting of addition and multiplication gates. We treat additions as depth-0 operations (they may increase noise but do not increase multiplicative depth). The multiplicative depth $\mathit{D}\left(\mathit{C}\right)$ of a circuit $\mathit{C}$ is the maximum number of multiplication layers along any input–output path.

Notation: Let $l$ denote the input dimensionality (the number of input variables) and let $\alpha$ be the block size with $1\le \alpha \le l$. We partition the $l$ plaintext input variables $\left(x_1,\dots ,x_l\right)$ into $K=\lceil l/\alpha \rceil$ blocks, and write the variable vector in block $j$ as ${\mathit{x}}^{\left(j\right)}$, where $\mid {\mathit{x}}^{\left(j\right)}\mid \le \alpha$ and $\left\{{\mathit{x}}^{\left(j\right)}{\}}_{j=1}^K\right.$ forms a partition of $\left\{{\mathit{x}}_i{\}}_{i=1}^l\right.$. We denote by $F$ the target function to be evaluated homomorphically, by $F_j$ the intra-block subfunction that depends only on ${\mathit{x}}^{\left(j\right)}$, and by $G$ the combining function that aggregates $\left\{F_j\left({\mathit{x}}^{\left(j\right)}\right){\}}_{j=1}^K\right.$ into the final output. Finally, $\mathit{D}(\cdot )$ denotes the multiplicative depth of an arithmetic circuit, and we define ${\mathit{D}}_{\mathrm{in}}={\mathrm{m}\mathrm{a}\mathrm{x}}_{j }\mathit{D}\left(F_j\right)$ as the maximum multiplicative depth among the intra-block evaluations.

Equivalently, define depth recursively: for an addition gate and a multiplication gate,

$$\mathit{D}(u+v)=max\left(\mathit{D}\right(u),\mathit{D}(v\left)\right)$$

$$\mathit{D}(u\cdot v)=max\left(\mathit{D}\right(u),\mathit{D}(v\left)\right)+1.$$

Our multivariate decomposition rewrites the target function as

$$F\left(x_1,\dots ,x_l\right)=G\left(F_1\left({\mathit{x}}^{\left(1\right)}\right),\dots ,F_K\left({\mathit{x}}^{\left(K\right)}\right)\right)$$

where each ${\mathit{x}}^{\left(j\right)}$ contains at most $\alpha$ variables and can be processed independently.

Lemma 1. 

Depth bound via blockwise parallelism.

Assumption 1. 

Each intra-block subfunction  $F_j$ can be evaluated with multiplicative depth at most ${\mathit{D}}_{\mathrm{in}}$.

Assumption 2. 

The combining function  $G$ over $K$ inputs admits a homomorphic evaluation schedule whose multiplicative depth is at most ${\mathit{D}}_G\left(K\right)$. Then the overall multiplicative depth satisfies

$$\mathit{D}\left(F\right)\le {\mathit{D}}_{\mathrm{i}\mathrm{n}}+{\mathit{D}}_G\left(K\right).$$

In particular, if $G$ is implemented via a sequential multiplication chain, then

$$\mathit{D}\left(F\right)\le {\mathit{D}}_{\mathrm{i}\mathrm{n}}+O\left(K\right)={\mathit{D}}_{\mathrm{i}\mathrm{n}}+O(\lceil l/\alpha \rceil ).$$

Proof . 

$$y_j=F_j\left({\mathit{x}}^{\left(j\right)}\right),j=1,\dots ,K.$$

By Assumption 1, each $y_j$ is produced by a circuit of depth $\le {\mathit{D}}_{\mathrm{in}}$. Since the $F_j$’s depend on disjoint variable blocks, the K computations can be carried out in parallel, and parallelism does not increase multiplicative depth beyond the maximum depth among them. Therefore, after computing all $y_j$, the intermediate results have depth at most $D_{\mathrm{in}}$.

Next, we evaluate $G(y_1,\dots ,y_K)$. Consider any valid homomorphic schedule for $G$ with multiplicative depth $D_G\left(K\right)$. The inputs to this stage are the $y_j$’s, each already at depth $\le D_{\mathrm{in}}$. Every multiplication layer used in the evaluation of $G$ increases depth by at most 1 relative to the current depth of its inputs. Hence, stacking the evaluation of $G$ on top of the already-computed $y_j$’s yields total depth at most $D_{\mathrm{in}}+D_G\left(K\right)$, proving the first inequality.

For the second statement, an explicit sequential chain schedule is

$$z_1=y_1,z_j=z_{j-1}\cdot y_j(j=2,\dots ,K)$$

which uses $K-1$ multiplications and thus has multiplicative depth $D_G\left(K\right)=K-1=O\left(K\right)$. Substituting $K=\lceil l/\alpha \rceil$ gives $D\left(F\right)\le D_{\mathrm{in}}+O(\lceil l/\alpha \rceil )$. □

Example 1. 

$\mathcal{l}=8, \alpha =2$ We have $K=\lceil 8/2\rceil =4$ blocks: $(x_1,x_2),(x_3,x_4),(x_5,x_6),(x_7,x_8).$ Compute $y_1,\dots ,y_4$ in parallel with depth $\le D_{\mathrm{in}}$. Using the sequential chain $z_1=y_1$, $z_2=y_1{y}_2, z_3=z_2{y}_3, z_4=z_3{y}_4,$

The combining stage adds 3 multiplication layers, so $D\left(F\right)\le D_{\mathrm{in}}+3$, consistent with $K-1=\lceil l/\alpha \rceil -1$.

4. Multi-Key Homomorphic Encryption

We build the MKHE layer on top of the standard multi-key BFV construction introduced by Chen et al. [12]. For completeness, we provide a concise description of the algorithms used in our implementation; the full correctness and IND-CPA security proofs are given in CDKS19 under the (decisional) RLWE assumption. Our contributions focus on LUT-oriented encoding and evaluation strategies and do not modify the underlying MK-BFV cryptosystem. Therefore, the confidentiality guarantees of our scheme are inherited from the security of CDKS19.

Unlike single-key homomorphic schemes, which only allow operations on ciphertexts encrypted under a single key, multi-key homomorphic schemes enable multiple participants to engage in joint computations, with each party holding its own private key. This scheme introduces a multivariate polynomial-based LUT (Look-Up Table) evaluation mechanism on top of the standard Multi-Key Homomorphic Encryption (MKHE) framework. The general workflow of such schemes is illustrated in Figure 1 and consists of the following fundamental steps.

Figure 1. The overall workflow of the proposed MK-BFV LUT evaluation scheme, consisting of an offline preprocessing phase (LUT decomposition and coefficient encoding) and an online evaluation phase.

MKHE.Setup($1^{\lambda }$): input the security parameter $\lambda$, the common parameter $pp=(N,q,\chi ,\psi ,a)$, where N is the dimension of RLWE, q is the modulus, $\chi$ is the key distribution, $\psi$ is the error distribution, and a is the randomly generated vector $a\leftarrow U\left(R_q^d\right)$.

MKHE.KenGen(pp): input the common parameter pp, where i represents the index of the party. The key of the i-th party is generated $s_i\leftarrow \chi$, the error vector is sampled $e\leftarrow {\psi }^d$, then the public key is $b_i=-s_i\cdot a_i+e(mod q)$, and the public key b and key s are output.

MKHE.Enc($m_i$, $b_i$, $a_i$): For a plaintext $m\in R_t$, let a = $a_i$ [0] and b = $b_i$ [0]. Sample $v\leftarrow \chi$, and sample noise $e_0,e_1\leftarrow \psi$. Then, $c_0=v\cdot b_i+\Delta \cdot m_i+e_0\left(modq\right)$ and we denote by t the plaintext modulus and $\Delta =⌊q/t⌉$ be the scaling factor of the BFV scheme. $c_1=v\cdot a+e_1(mod q)$. Output the ciphertext ${ct}_i=(c_0,c_1)\in R_q^2$.

MKHE.Eval(LUT) $(pp,T_{\alpha l\to \beta l},\{{ct}_k\},evk)$: input the common parameter pp. α. Input a Look-Up Table T that maps an $\alpha l$-bit input to a $\beta l$-bit output, a set of $\alpha$ multi-key ciphertexts $\{c{t}_0,\dots ,c{t}_{\alpha -1}\}$ encrypting the original input data, and a relinearization key evk.

The procedure is divided into two phases. The tensor transform and (inverse) NTT in our framework are used only in the offline plaintext-domain preprocessing to recover the coefficient tensor $C$ from the LUT value tensor $D$. During the online phase, the evaluator does not perform tensor/NTT operations over ciphertexts; it only applies native MK-BFV homomorphic additions, multiplications, and post-multiplication relinearization to evaluate $f_j(\cdot )$. Hence, tensor-NTT should be viewed as a coefficient-generation and evaluation-scheduling framework, rather than a new homomorphic operator. The first is an offline pre-computation phase, where the large Look-Up Table T is decomposed into $\beta$ sub-tables, each responsible for a l-bit slice of the output result. For each sub-table T(j), the coefficient tensor $C_j$ of its corresponding multivariate polynomial $f_j(u_0,\dots ,u_{\alpha -1})$ is computed using a tensor inverse transform (such as the inverse NTT transform).

The second is the online homomorphic evaluation phase. For each output bit slice j, the corresponding multivariate polynomial $f_j(u_0,\dots ,u_{\alpha -1})$ is homomorphically evaluated on the input ciphertexts $\{c{t}_0,\dots ,c{t}_{\alpha -1}\}$. This process involves homomorphic addition and multiplication between ciphertexts, using the keys in the evk to perform relinearization after each multiplication in order to control the growth of the ciphertext dimension. Then the algorithm outputs a set of $\beta$ multi-key ciphertexts $\{c{t}_0^{\prime },\dots ,c{t}_{\beta -1}^{\prime }\}$, which jointly encrypt the $\beta l$-bit output result corresponding to the Look-Up Table T.

In MK-BFV, decryption can be written as a linear form $d=⟨ct,\tilde{s}⟩$ with $\tilde{s}=(1,s_1,\dots ,s_k)$ and $ct\in R_q^{k+1}$. Multiplying two multi-key ciphertexts introduces quadratic terms ${\tilde{s}}_i{\tilde{s}}_j$ (which can be viewed as a tensor/outer-product structure). Without relinearization, the ciphertext representation must carry these quadratic terms, leading to an expansion from $O\left(k\right)$ to $O\left(k^2\right)$ components. Following the standard MK-BFV workflow in CDKS19, we apply relinearization using evk after each multiplication to map quadratic terms back to a linear form in $\tilde{s}$, keeping the ciphertext dimension at $k+1$ components (i.e., $O\left(k\right)$).

MKHE.Dec($ct;\{s_i{\}}_{i=1}^k$). Given a ciphertext $ct=(c_0,c_1,\dots ,c_k)\in R_q^{k+1}$ and the $k$ secret keys $s_1,\dots ,s_k$, the parties perform the standard collective decryption procedure as in CDKS19. Concretely, they compute

$$d = c_0+\sum _{i=1}^k{c}_i{s}_i(\mathrm{m}\mathrm{o}\mathrm{d}q),m = \lfloor {\displaystyle \frac{t}{q}}\cdot d\rceil mod t.$$

For notational convenience, we sometimes define an aggregated secret-key vector

$$\tilde{s}=(1,s_1,\dots ,s_k)$$

and write $d=⟨ct,\tilde{s}⟩$. Note that $\tilde{s}$ is only a symbolic representation for correctness exposition; it is not a new secret key generated or held by any single party.

5. Analysis

5.1. Noise Analysis

In multivariate polynomial factorization, the coefficient tensor $C\in {\mathbb{Z}}_p^{n\times \dots \times n}$ is recovered from tensor D via the inverse NTT matrix $U^{-1}$.

$$C\equiv D\cdot (U^{-1}{)}^{\otimes \alpha }mod p$$

In multivariate polynomial factorization, where the NTT matrix $U\in {\mathbb{Z}}_p^{n\times n}$ has elements defined as $U_{j,r}=g^{j\cdot rmod \phi \left(p\right)} mod p$ (with g being a primitive root modulo p and $\phi \left(p\right)=p-1$, and its inverse $U^{-1}\in {\mathbb{Z}}_p^{n\times n}$, given the number of input blocks κ, a prime p satisfying $n\mid p-1$, the coefficient tensor recovery error satisfies

$$\parallel C-\widehat{C}{\parallel }_{\infty }\le \kappa \cdot \parallel U^{-1}{\parallel }_{\infty }\cdot \parallel D-\widehat{D}{\parallel }_{\infty }mod p$$

Here, $\widehat{C}$ and $\widehat{D}$ are noisy estimates, and $\parallel \cdot {\parallel }_{\infty }$ denotes the maximum absolute value over tensor elements. The NTT matrix U is invertible under prime p, with its inverse $U^{-1}\equiv n^{-1}\cdot U^{\mathrm{\top }}mod p$, where n − 1 is the modular inverse of n modulo p.

Lemma 2. 

For a given $k\in [0, \alpha -1]$ and a tensor $D\in {\mathbb{Z}}_q^{n^{\alpha }}$, construct $C=D{\otimes }_k{U}^{-1}$. Then, each entry of C satisfies the same error bound as previously stated:

$$\parallel C[{\Delta }_0,\dots ,{\Delta }_{\alpha -1}]{\parallel }_{\infty }\le n^{-1}\cdot \parallel D[{\Delta }_0,\dots ,{\Delta }_{\alpha -1}]{\parallel }_{\infty }\cdot q$$

Proof. 

$$\begin{array}{c}\hfill C[{\Delta }_0,\dots ,{\Delta }_{\alpha -1}]={\displaystyle \sum _{j=0}^{n-1}} D[{\Delta }_0,\dots ,j,\dots ,{\Delta }_{\alpha -1}]\cdot U^{-1}[j,{\Delta }_k](modq)\hfill \\ \hfill \parallel C\left[{\Delta }_0,\dots ,{\Delta }_{\alpha -1}\right]{\parallel }_{\infty }\hfill \\ \hfill \le {\displaystyle \sum _{j=0}^{n-1}} \parallel D[{\Delta }_0,\dots ,j,\dots ,{\Delta }_{\alpha -1}]{\parallel }_{\infty }\cdot \parallel U^{-1}[j,{\Delta }_k]{\parallel }_{\infty }\hfill \\ \hfill \parallel C\left[{\Delta }_0,\dots ,{\Delta }_{\alpha -1}\right]{\parallel }_{\infty }\hfill \\ \hfill \le \parallel D[{\Delta }_0,\dots ,j,\dots ,{\Delta }_{\alpha -1}]{\parallel }_{\infty }\cdot {\displaystyle \frac{q}{2n}}\cdot n=\parallel D[\dots ]{\parallel }_{\infty }\cdot {\displaystyle \frac{q}{2}}\hfill \end{array}$$

Since computations are performed modulo q, the final result must be mapped to $[-\mathrm{q}/2,\mathrm{q}/2)$:

$$\parallel C[{\Delta }_0,\dots ,{\Delta }_{\alpha -1}]{\parallel }_{\infty }\le \parallel D[{\Delta }_0,\dots ,j,\dots ,{\Delta }_{\alpha -1}]{\parallel }_{\infty }\cdot n^{-1}\cdot q$$

□

Lemma 3. 

Let the coefficient tensor of a multivariate polynomial $\mathrm{f}:{\mathbb{Z}}_{\mathrm{q}}^{\mathsf{\alpha }}\to {\mathbb{Z}}_{\mathrm{q}}$ be

$$\mathrm{C}=\mathrm{D}{\otimes }_{\mathsf{\alpha }-1}{\mathrm{U}}^{-1}{\otimes }_{\mathsf{\alpha }-2}{\mathrm{U}}^{-1}\cdots {\otimes }_0{\mathrm{U}}^{-1}$$

where the input noise $\mathsf{ϵ}=({\mathsf{ϵ}}_0,\dots ,{\mathsf{ϵ}}_{\mathsf{\alpha }-1})$ satisfies $\parallel {\mathsf{ϵ}}_{\mathrm{i}}{\parallel }_{\infty }\le \mathsf{\delta }$. Then, the output error satisfies

$$\parallel f(u+ϵ)-f(u){\parallel }_{\infty }\le \alpha \cdot \parallel D{\parallel }_{\infty }\cdot \delta \cdot {\left(\frac{q}{n}\right)}^{\alpha -1}$$

Proof. 

$$\begin{array}{c}\hfill f\left(u+ϵ\right)-f\left(u\right)\hfill \\ \hfill ={\displaystyle \sum _{j_0,\dots ,j_{\alpha -1}}} C[j_0,\dots ,j_{\alpha -1}]\left({\displaystyle \prod _{k=0}^{\alpha -1}} (u_k+{ϵ}_k{)}^{j_k}-{\displaystyle \prod _{k=0}^{\alpha -1}} u_k^{j_k}\right)\hfill \end{array}$$

Since $f$ is a polynomial over ${\mathbb{Z}}_q$, we analyze perturbations using an algebraic expansion in the ring, without any smoothness/derivative-based approximation. For each $k$, we use the identity

$$(u_k+{ϵ}_k{)}^{j_k}-u_k^{j_k}={ϵ}_k\sum _{r=0}^{j_k-1}(u_k+{ϵ}_k{)}^r u_k^{ j_k-1-r}( mod q)$$

Working with the centered representative in $[-{\displaystyle \frac{q}{2}},{\displaystyle \frac{q}{2}})$ (where $\mid \cdot \mid$ denotes the absolute value of this centered lift) and assuming the noise does not cause wrap-around ($\mid u_k\mid +\delta <{\displaystyle \frac{q}{2}}$ and $\mid {ϵ}_k\mid \le \delta$), we obtain the bound

$$\mid (u_k+{ϵ}_k{)}^{j_k}-u_k^{j_k}\mid \le j_k(\mid u_k\mid +\delta {)}^{j_k-1}\delta$$

Substituting this bound into the subsequent derivation yields the stated error bound.

The leading error term is ${\sum }_{j_0,\dots ,j_{\alpha -1}} C\left[\dots \right]\cdot {\prod }_{k=0}^{\alpha -1} j_k{u}_k^{j_k-1}{ϵ}_k$, combined with the above expression $\parallel C{\parallel }_{\infty }\le \parallel D{\parallel }_{\infty }\cdot (q/n{)}^{\alpha }$.

$$\parallel f(u+ϵ)-f(u){\parallel }_{\infty }\le \parallel D{\parallel }_{\infty }\cdot {\left(\frac{q}{n}\right)}^{\alpha }\cdot {\delta }^{\alpha }\cdot \prod _{k=0}^{\alpha -1} j_k$$

$$\parallel f(u+ϵ)-f(u){\parallel }_{\infty }\le \alpha \cdot \parallel D{\parallel }_{\infty }\cdot \delta \cdot {\left(\frac{q}{n}\right)}^{\alpha -1}$$

For multivariate polynomials $f:{\mathbb{Z}}_q^{\alpha }\to {\mathbb{Z}}_q$ defined over integer rings, their coefficient tensors are constructed via Number Theoretic Transform (NTT) as $C=D{⊠}_{\alpha -1}{U}^{-1}{⊠}_{\alpha -2}{U}^{-1}\dots {⊠}_0{U}^{-1}$ (where U is the NTT matrix). When input noise $ϵ=({ϵ}_0,\dots ,{ϵ}_{\alpha -1})$ satisfies $\parallel {ϵ}_i{\parallel }_{\infty }\le \delta$, the dominant error term is bounded via the algebraic difference identity in Lemma 3 under the centered lift (without any smoothness/derivative assumption), assuming the noise does not induce wrap-around. Combining coefficient tensor norm constraints $\parallel C{\parallel }_{\infty }\le \parallel D{\parallel }_{\infty }\cdot (q/n{)}^{\alpha }$ with modulus-dimension balance relations of q and n, the output error bound is rigorously derived as $\parallel f(u+ϵ)-f(u){\parallel }_{\infty }\le \alpha \cdot \parallel D{\parallel }_{\infty }\cdot \delta \cdot {\left(\frac{q}{n}\right)}^{\alpha -1}$ This result establishes a quantitatively adjustable error analysis framework for NTT-based homomorphic encryption schemes, enabling parameter optimization through constraints on modulus q, polynomial degree α, and noise strength δ to ensure computational correctness and security. □

5.2. Security Analysis

We adopt the Multi-Key BFV (MK-BFV) cryptosystem from Chen et al. [12] as the underlying encryption layer. Our contributions are limited to LUT-oriented encoding, decomposition, and evaluation scheduling, and do not modify the core cryptographic algorithms or key-switching/relinearization mechanisms of MK-BFV.

Threat model. We consider a standard semi-honest (honest-but-curious) adversary who observes all ciphertexts, evaluation transcripts, and public/auxiliary keys, and may corrupt a subset of parties. Security is guaranteed as long as the adversary does not obtain all parties’ secret keys required for decryption, consistent with the model in CDKS19.

Security claim. Under the decisional RLWE assumption with parameters $(R,q,\chi )$, the MK-BFV scheme of CDKS19 is IND-CPA secure. Since our framework only changes plaintext encoding and homomorphic evaluation strategies while preserving the same ciphertext distribution and key material as CDKS19, the confidentiality of our scheme directly inherits the IND-CPA security of CDKS19.

Proof sketch. Suppose there exists a PPT adversary that distinguishes encryptions produced in our scheme with non-negligible advantage. We construct an adversary that breaks the IND-CPA security of CDKS19 by using the challenger’s ciphertexts as the inputs to our (evaluation/encoding) procedures. Because our transformations are deterministic or public-randomness–driven operations over ciphertexts and do not require secret information, any advantage against our scheme translates to an advantage against CDKS19, contradicting its IND-CPA security under decisional RLWE.

Parameter selection. We choose $(n,q,t,\sigma )$ to meet the target security level following standard RLWE security estimation tools, and ensure the noise budget suffices for the maximum multiplicative depth of our LUT evaluation.

5.3. Performance Analysis

Traditional methods for fitting $\mathcal{l}$-bit Look-Up Tables (LUTs) often utilize a single-variable polynomial formulation, $f\left(x\right)={\sum }_{i=0}^{n-1}{a}_i{x}^i$, where $n=2^{\mathcal{l}}$, which unfortunately results in exponential coefficient growth and a high multiplicative depth, reaching up to degree $2^{\mathcal{l}}-1$. These characteristics lead to significant noise amplification and subsequent performance degradation in Fully Homomorphic Encryption (FHE) systems due to the increased number of homomorphic operations needed.

In contrast, the multivariate polynomial methods detailed in this work partition $\mathcal{l}$-bit inputs into α variables (effectively creating $\alpha$ sub-bit strings) and then construct $\beta$ low-degree multivariate polynomials $f_j(u_0,\dots ,u_{\alpha -1})$ to represent the output bit segments. This approach reduces the number of variable occurrences from $2^{\mathcal{l}}$ to $2^{\mathcal{l}/\alpha }$, and the multiplicative depth from $O\left(\mathcal{l}\right)$ to $O(\mathcal{l}/\alpha )$.

The multivariate strategy allows for efficient coefficient matrix construction using Number Theoretic Transform (NTT) or tensor product techniques, which directly supports SIMD-parallel LUT evaluation. Literature has shown that this approach offers controlled noise propagation while maintaining decryption accuracy through the use of noise cancellation functions. Consequently, compared to univariate methods, multivariate techniques provide substantial advantages in reduced multiplicative depth (to $\mathcal{l}/\alpha$) and better noise control, enabling the parallel execution of multiple LUTs without increasing ciphertext dimension and maintaining security guarantees.

As highlighted in Table 1, the proposed scheme shows a homomorphic evaluation time complexity of $O\left(\alpha 2^{\mathcal{l}/\mathsf{\alpha }}\right)$ and a multiplication depth of $O\left(2^{\mathcal{l}/\mathsf{\alpha }}\right)$ with low noise growth, contrasting with the CDKS19 scheme’s $O\left(2^{\mathcal{l}}\right)$ complexities and fast noise growth. This makes multivariate methods particularly well-suited for large-scale LUT implementations and high-precision circuit simulations within FHE system.

Table 1. Performance comparison of multi-key schemes, where $\mathcal{l}$ denotes LUT input bits, $\alpha$ denotes the number of variables in the decomposition, and $k$ denotes the number of participating parties.

Scheme	LUT Size	Homomorphic Multiplication Depth	Noise Growth	Bootstrapping	Mul Cost
CZW17	$O\left(2^{\mathcal{l}}\right)$	$O\left(\mathcal{l}\right)$	$O\left(2^{\mathcal{l}}\right)$	None	$O\left(k^2\right)$
CDKS19	$O\left(2^{\mathcal{l}}\right)$	$O\left(\mathcal{l}\right)$	$O\left(2^{\mathcal{l}}\right)$	Yes	$O\left(k^2\right)$
KKS + 23	$O\left(2^{\mathcal{l}}\right)$	$O\left(\mathcal{l}\right)$	$O\left(2^{\mathcal{l}}\right)$	None	$O\left(k\right)$
Ours	$O\left(2^{\mathcal{l}}\right)$	$O(\mathcal{l}/\alpha )$	$O\left(2^{\mathcal{l}/\mathsf{\alpha }}\right)$	Yes	$O\left(k^2\right)$

6. Conclusions

Homomorphic encryption techniques enable direct computation on ciphertexts, effectively mitigating privacy leakage risks for data owners in cloud computing scenarios. However, operating on encrypted data drastically increases computational overhead, making scheme efficiency a central research focus. This paper proposes a multi-key homomorphic encryption scheme based on multivariate polynomial Look-Up Table (LUT) evaluation, overcoming existing limitations through structured tensor encoding and key-space decoupling design. The core contributions include introducing multivariate polynomial tensor products and linearization techniques to map multivariable functions into high-dimensional polynomial-coefficient spaces, enabling parallel computation across multiple variables; implementing batch processing over multiple plaintext slots through ciphertext-packing techniques combined with noise decomposition and dynamic error-injection mechanisms to achieve secure storage and efficient computation of high-precision plaintexts; and constructing a BFV-compatible bootstrapping framework to significantly reduce computational complexity in multi-key ciphertext operations.

Traditional multi-key homomorphic encryption (MKHE) schemes still face significant bottlenecks. TFHE-type schemes, which are bit-level, feature highly optimized CMux operations that select between two inputs based on an encrypted control bit. For gate-circuit-based TFHE schemes, controlling circuit depth is crucial. While CMux operations can be directly mapped to Boolean logic gates, polynomial fitting may increase multiplicative depth, thereby raising the frequency and cost of bootstrapping. Moreover, LUT evaluation may require a large number of CMux operations, and the cost grows rapidly with LUT size, making CMux-based implementations suboptimal for large-scale LUTs. The potential of applying polynomial (and multivariate polynomial) fitting to TFHE, along with performance trade-offs between CMux and polynomial fitting, remains a critical research question.