# GGSW
In the previous section, we introduced **GLev** as “a list of GLWE ciphertexts” that all encrypt the same message `M`, but at different precise scales (controlled by base `β` and levels `ℓ`).
Now we go one step further: **GGSW**.
TFHE sets up a very clean ladder of structures:
* **GLWE** = a 1D vector of ring elements (think: 1D matrix)
* **GLev** = a 2D structure (a vector of GLWE ciphertexts)
* **GGSW** = a 3D structure (a vector of GLev ciphertexts)
***
## 1) What is GGSW, in one sentence?
A **GGSW ciphertext is a vector of GLev ciphertexts**, meaning it’s like a *3D* stacked structure built on top of GLWE.
It intentionally adds **more redundancy** (“a 3rd dimension”) compared to GLWE and GLev.
***
## 2) Why add this “3rd dimension” of redundancy?
> In a GGSW ciphertext, each GLev ciphertext encrypts the product of the message `M` with one of the secret key polynomials `-S_i`, and the last GLev encrypts the message `M` itself.
So the redundancy is not random, it is structured around the secret key. This structure is what allows GGSW ciphertexts to function as "operators" (like gates) in homomorphic multiplication.
***
## 3) Structure: how a GGSW is built from GLev
Assume a GLWE/GLWE-like secret key: $$\vec{S} = (S\_0, S\_1, \dots, S\_{k-1})$$
A **GGSW(M)** is defined in the post as a list of **(k+1)** GLev ciphertexts:
$$\Big( GLev^{\beta,\ell}*{\vec{S},\sigma}(-S\_0 M);\times;\ldots;\times; GLev^{\beta,\ell}*{\vec{S},\sigma}(-S\_{k-1} M);\times; GLev^{\beta,\ell}*{\vec{S},\sigma}(M) \Big) = GGSW^{\beta,\ell}*{\vec{S},\sigma}(M)$$
### How to read this
* You take the message polynomial `M`.
* For each secret key polynomial `S_i`, you create a **GLev encryption of `-S_i·M`**.
* Then you add one final **GLev encryption of `M`**.
So it’s a “bundle of bundles”:
* **GGSW** = list of **GLev**
* each **GLev** = list of **GLWE**
***
***
## 4) What does “3D matrix” mean here?
We get multiple equivalent viewpoints:
* GLWE: 1D vector of elements from $$\mathcal{R}\_q$$
* GLev: 2D matrix of elements from $$\mathcal{R}\_q$$ (or a vector of GLWEs)
* GGSW: 3D matrix of elements from $$\mathcal{R}\_q$$
* or a **2D matrix of GLWE ciphertexts**
If you like visual mental models:
* **GLWE**: one row (mask polynomials + body polynomial)
* **GLev**: many GLWE rows stacked vertically
* **GGSW**: many GLev stacks placed side-by-side (or stacked again)
***
## 5) Size/dimension (why GGSW is “big”)
The TFHE the space it lives in as:
$$GGSW^{\beta,\ell}\_{\vec{S},\sigma}(M) \subseteq \mathcal{R}\_q^{(k+1)\times \ell(k+1)}$$
You don’t need to memorize the formula, yet the important beginner takeaway is:
> GGSW is significantly larger than GLWE because it includes **(k+1) GLev ciphertexts**, and each GLev contains **ℓ GLWE ciphertexts**.
***
## 6) Secret key and decryption
### Secret key
* **The secret key is the same as for GLWE and GLev.**
### Decryption
Even though GGSW is big, decryption is simple:
* **To decrypt, it is sufficient to decrypt the last GLev ciphertext** (the one encrypting `M`).
So conceptually:
1. Locate the “last” GLev inside the GGSW
2. Decrypt that GLev (and inside it, decrypt one GLWE at the right scale)
3. Recover `M`
***
## 7) Toy example
Let’s pick:
* `k = 2` secret polynomials → `(S0, S1)`
* `ℓ = 3` levels in each GLev
Then:
* A **GLev** contains `ℓ = 3` GLWE ciphertexts.
* A **GGSW** contains `(k+1) = 3` GLev ciphertexts:
1. `GLev(-S0·M)`
2. `GLev(-S1·M)`
3. `GLev(M)` ← Decrypt this one to get `M`
So overall, you have:
* `3` GLev blocks
* each with `3` GLWEs
* total `9` GLWE ciphertexts inside one GGSW (plus all their polynomial components)
This is why people call GGSW “heavy”; it’s deliberately redundant.
***
## 8) ELI5 (Explain Like I’m 5)
* **GLWE** is one locked folder containing your message.
* **GLev** is a stack of locked folders containing the same message at different zoom levels.
* **GGSW** is a bigger binder that contains several GLev stacks:
* Some stacks contain “message times secret-key piece.”
* and one stack contains “the message itself” (used for decryption).
***
## 9) Relationship to GSW and RGSW (what comes next)
The post also notes:
* **GGSW can be specialized into GSW and RGSW** using the same specialization rules used earlier (like GLWE→LWE and GLWE→RLWE).
We’ll cover those as their own sections next.
***
***
## 10) Quick summary
* **GGSW** = a vector of **GLev** ciphertexts (3D structure).
* It adds redundancy via a third dimension.
* In **GGSW(M)**:
* Each GLev encrypts `-S_i·M` for secret key polynomials `S_i`
* The last GLev encrypts `M`
* Same secret key as GLWE/GLev; decrypt by decrypting the last GLev.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://sabanaku77.gitbook.io/fhe-handbook-for-beginners/ggsw.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.