# GLev
So far in the handbook:
* **LWE**: encrypts a *single value* (scalar).
* **GLWE / RLWE**: encrypts a *polynomial* (a packed “bundle” of values).
* RLWE is the special case of GLWE with `k = 1` and `N` a power of 2.
Now we introduce **GLev,** an *intermediate* ciphertext type that sits between **GLWE** and **GGSW** and is used heavily in later TFHE operations.
***
## 1) What is GLev, in one sentence?
A **GLev ciphertext is a list of GLWE ciphertexts** that all encrypt the **same message** `M`, but each one uses a **different (very precise) scaling factor**.
This adds **redundancy on purpose,** and that redundancy becomes extremely useful when we start doing leveled multiplications and building GGSW.
***
## 2) Why does GLev exist?
* a named “bridge” between GLWE and GGSW (the term was used in [CLOT21](https://eprint.iacr.org/2021/729.pdf) to make GGSW easier to understand), and
* a generalization of “Powers of 2 encryptions” used in other FHE schemes like [BGV](https://eprint.iacr.org/2011/277.pdf).
> Sometimes you want to multiply by a large value (or apply a structured transform), but doing it directly makes noise blow up. GLev gives you multiple “scaled views” of the same message so you can combine them in controlled ways later.
You don’t need the full multiplication story yet; just remember **GLev = redundancy for controlled arithmetic**.
***
## 3) What does a GLev ciphertext look like?
A **GLWE** ciphertext encrypting `M` has the shape:
* `(A0, …, A(k-1), B)` in `R_q^(k+1)` (mask + body)
A **GLev** ciphertext stacks several of these GLWEs into a list:
$$GLev^{\beta,\ell}\_{\vec{S},\sigma}(M) ;\subseteq; \mathcal{R}\_q^{\ell\cdot (k+1)}$$
So if one GLWE is “one row”, GLev is “many rows”.
***
## 4) The key idea: same message, different scaling factors
GLev using two parameters:
* **base** `β` (generally a power of 2)
* **number of levels** `ℓ`
And then defines the ciphertext as the product/list:
$$\left( GLWE\_{\vec{S},\sigma}\left(\frac{q}{\beta^1}M\right) \times \ldots \times GLWE\_{\vec{S},\sigma}\left(\frac{q}{\beta^\ell}M\right) \right) = GLev^{\beta,\ell}\_{\vec{S},\sigma}(M)$$
### How to read this
* You are encrypting the same `M` multiple times.
* But each time, you “place.” `M` at a different scale inside the modulus `q`.
* Those scales are: $$\Delta\_i = \frac{q}{\beta^i} \quad \text{for } i=1.. \ell$$
* This is why GLev has “very precise scaling factors Δ”.
> If `β` and `q` are not powers of 2, you need rounding when encoding.
***
***
## 5) Secret key and decryption
### Secret key
GLev uses the **same secret key as GLWE**.
### Decryption
To decrypt a GLev ciphertext :
> You can decrypt **any one** of the GLWE ciphertexts inside the list, using its corresponding scaling factor.
So:
* GLev doesn’t introduce a new decryption trick
* it introduces a **new structure** (a list of GLWEs) that helps later operations
***
## 6) Toy example
Let’s pick toy parameters (NOT secure):
* `q = 256`
* `β = 4`
* `ℓ = 3`
Then the scaling factors are:
* `Δ1 = q/β^1 = 256/4 = 64`
* `Δ2 = q/β^2 = 256/16 = 16`
* `Δ3 = q/β^3 = 256/64 = 4`
So `GLev^{β,ℓ}(M)` contains **three GLWE encryptions** of the same `M`:
* one where `M` is embedded at scale `64`
* one at scale `16`
* one at scale `4`
This “multi-scale redundancy” is exactly what GLev is about.
***
## 7) Lev and RLev
The post notes:
* Just like **GLWE** generalizes **LWE** and **RLWE**,
* **GLev** can be specialized into **Lev** and **RLev** by applying the same rules.
Meaning (high level):
* If you “collapse” the polynomial structure the way GLWE→LWE, you get **Lev**
* If you specialize to ring form the way GLWE→RLWE, you get **RLev**
(We’ll keep those as optional deeper sections later his page is just to introduce the idea.)
***
## 8) ELI5 (Explain Like I’m 5)
* **GLWE** is one locked box containing your message.
* **GLev** is a *stack of locked boxes* containing the same message, but each box stores it at a different “zoom level” (scale).
* Later, TFHE will use those different zoom levels to do certain operations cleanly.
***
## 9) Quick summary
* **GLev** is an intermediate ciphertext type between GLWE and GGSW.
* It is a **list of GLWE ciphertexts** encrypting the **same** `M`
* Each GLWE uses a different scaling factor: $$\Delta\_i = \frac{q}{\beta^i}$$ controlled by the base `β` and levels `ℓ`.
* Same secret key as GLWE; decrypt by decrypting one GLWE with the right scale.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://sabanaku77.gitbook.io/fhe-handbook-for-beginners/glev.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.