Encryption returns a structure, not one scrambled integer
A fresh secret-key ciphertext always has two polynomial components, conventionally named c₀ and c₁. Do not try to assign an English meaning to either component alone. They are constructed specifically so that the client, which knows the secret polynomial s, can combine them:
Each c is itself stored across many coefficient positions and residue limbs. “Two components” is not “two values”; it is two massive full polynomial objects. The server may add and multiply those objects without ever possessing s.
Worked example
Treat s as a symbol before treating it as a secret
Temporarily ignore cryptography entirely and read a ciphertext as the linear expression a₀+a₁s. Another ciphertext is b₀+b₁s. Ordinary distributivity—not a special FHE rule—determines the exact shape of their product. Cryptography explains why the coefficients hide messages; algebra explains why multiplication creates another power of s.
Plaintext corpus mode
Multiplying (c₀,c₁) by a plaintext polynomial B yields (c₀B,c₁B). The result still has exactly two ciphertext components and decrypts to the query message times B.
Encrypted corpus mode
Multiply (a₀+a₁s)(b₀+b₁s) and just distribute:
What would repeated ciphertext multiplication do?
Multiplying a degree-two expression in s by a fresh degree-one expression can produce degree three. Component degree therefore grows relentlessly with multiplicative depth unless a complex key-switching operation like relinearization reduces it. This scorer deliberately has an extremely shallow multiplication shape, so keeping three components is a very targeted system tradeoff, not a universal rule.
Check your understanding
Why does ciphertext-times-ciphertext produce a third component?
Section summary
- Fresh ciphertexts have c₀ and c₁ polynomial components.
- Plaintext multiplication safely preserves two components.
- Ciphertext multiplication naturally produces e₀,e₁,e₂.
- Lazy relinearization keeps nasty key switching out of scoring.
Repository layer · second pass
Why does ciphertext multiplication create a third component?
A two-component ciphertext represents a linear expression c₀+c₁s in the secret s. Multiplying two such expressions distributes exactly like ordinary binomials: c₀d₀ +(c₀d₁+c₁d₀)s + c₁d₁s². The three output components are coefficients of powers of s.
Relinearization can later return to two components using an evaluation key, but the rotation-free score datapath may deliberately expose the raw three-component product. Ciphertext components, polynomial coefficients, and RNS limbs must never be conflated.
Reasoning chain
- 1
Write each ciphertext as a polynomial in s.
- 2
Distribute four component products.
- 3
Group by s degree.
- 4
Identify e₀,e₁,e₂.
- 5
Decide whether the consumer requires relinearization.
Worked trace
Four products, three groups
- c=(c₀,c₁), d=(d₀,d₁).
- c₀d₀ belongs to degree 0.
- Cross products share degree 1 and add.
- c₁d₁ belongs to degree 2.
Result. e=(c₀d₀,c₀d₁+c₁d₀,c₁d₁).
Executable lens · Python
Make the hidden state visible
def component_product(c, d):
c0,c1=c; d0,d1=d
return (c0*d0, c0*d1+c1*d0, c1*d1)
assert component_product((2,3),(5,7)) == (10,29,21)Retype this example, predict each intermediate value, and then change one input that touches a boundary.
Misconception clinic
Tempting mistakes
- Calling the third component a third modulus limb.
- Dropping the cross term or failing to add its two halves.
Retrieval and transfer
Close the book first
- Expand a three-component times two-component product.
- Explain relinearization at a contract level.
- Map component products to time-shared hardware phases.