# GLWE (General-LWE)
In the previous section, we learned **LWE** as the “small scalar ciphertext.” Now we move one step up: **GLWE (General-LWE)**, which is the ciphertext type TFHE uses as a *general container* that can represent both LWE and RLWE as special cases.
A simple way to remember it:
* **LWE** encrypts *one value* (scalar)
* **GLWE** encrypts a *polynomial* (think: a bundle/vector of values packed together)
Later ciphertexts in the TFHE family (like **GLev** and **GGSW**) are built out of GLWE pieces, which is why GLWE is introduced early in the series.
***
## 1) What is a “polynomial message” and why do we want it?
Instead of encrypting one number `m`, GLWE encrypts a polynomial:
$$M(X) = m\_0 + m\_1 X + m\_2 X^2 + \cdots + m\_{N-1}X^{N-1}$$
* treat the coefficients $$(m\_0,\dots,m\_{N-1})$$ like a **small vector of values**
* GLWE lets you do operations on this vector **in one ciphertext** (SIMD-like efficiency)
This is a big reason ring/polynomial cryptography is used in FHE: you can often do more work “per ciphertext.”
***
## 2) The ring used in GLWE
GLWE lives in a polynomial ring modulo $$X^N + 1$$ (in typical TFHE settings). You’ll see:
* $$\mathcal{R} = \mathbb{Z}\[X]/(X^N + 1)$$
* $$\mathcal{R}\_q = \mathbb{Z}\_q\[X]/(X^N + 1)$$
So coefficients are taken **mod q**, and polynomials are reduced **mod** $$X^N + 1$$
You don’t need to be a ring expert right now, just remember:
> “GLWE arithmetic is polynomial arithmetic with wrap-around rules.”
***
## 3) Shape of a GLWE ciphertext
A GLWE ciphertext has:
* a **mask** made of `k` polynomials: $$(A\_0, \dots, A\_{k-1})$$
* a **body** polynomial: $$B$$
So the ciphertext is:
$$(A\_0, \dots, A\_{k-1}, B) \in \mathcal{R}\_q^{k+1}$$
The secret key is also polynomial-shaped:
$$S = (S\_0, \dots, S\_{k-1}) \in \mathcal{R}^k$$
***
## 4) The core GLWE equation (the “meaning” of the ciphertext)
GLWE is designed so that the body $$B$$ hides the message polynomial $$M$$ like:
$$B = \sum\_{i=0}^{k-1} A\_i \cdot S\_i ;+; \Delta \cdot M ;+; E \pmod q$$
Where:
* $$A\_i$$ are random mask polynomials
* $$S\_i$$ are secret-key polynomials
* $$\Delta \cdot M$$ is the scaled plaintext polynomial
* $$E$$ is a small noise polynomial
This is the polynomial/ring version of the LWE “dot-product + message + noise” idea.
***
## 5) Encryption
To encrypt a message polynomial $$M$$:
1. Sample random mask polynomials $$A\_0,\dots,A\_{k-1}$$ in $$\mathcal{R}\_q$$
2. Sample small noise polynomial $$E$$
3. Compute: $$B = \sum\_{i} A\_i S\_i + \Delta M + E \pmod q$$
4. Output: $$\text{ct} = (A\_0,\dots,A\_{k-1},B)$$
***
***
## 6) Decryption
Given ciphertext $$(A\_0,\dots,A\_{k-1},B)$$ and secret key $$S=(S\_0,\dots,S\_{k-1})$$:
1. Remove the secret-key mix: $$T = B - \sum\_i A\_i S\_i \pmod q$$
2. Now: $$T \approx \Delta M + E \pmod q$$
3. Recover $$M$$ by coefficient-wise rounding/decoding.
Just like LWE:
* Noise must stay “small enough” for rounding to work reliably
***
***
## 7) GLWE ↔ LWE and RLWE
One of the key points of the deep dive is that **GLWE generalizes both LWE and RLWE**.
### GLWE becomes LWE
If you set:
* $$N = 1$$ (polynomials collapse into scalars)
* $$k = n$$
…then GLWE becomes **LWE**. This is exactly how you can think of LWE as a “degenerate” GLWE case.
### GLWE becomes RLWE
If you set:
* $$k = 1$$
* $$N$$ is a power of 2
…then GLWE becomes **RLWE**. So RLWE is essentially GLWE with just one secret polynomial.
***
## 8) Trivial GLWE ciphertexts
The series introduces **trivial GLWE ciphertexts**:
* They have the *shape* of a GLWE ciphertext
* But they are **not hiding anything**
* They are used like “public constant ciphertexts” inside computations
A trivial ciphertext of message $M$ is:
$$(0,\ldots,0,\Delta M) \in \mathcal{R}\_q^{k+1}$$
This is useful to inject public data into homomorphic computations without changing the data structure.
***
## 9) What operations are “easy” on GLWE?
Just like LWE, GLWE is naturally good at **linear operations**:
* **Addition** of ciphertexts (component-wise in $$\mathcal{R}\_q$$)
* **Multiply by a public constant** (scalar or polynomial, depending on the setting)
Noise grows with operations, so depth is limited unless you refresh (bootstrapping concepts come later).
***
## 10) ELI5 (Explain Like I’m 5)
* **LWE** is like encrypting a *single number* in a locked box.
* **GLWE** is like encrypting a *whole tray of numbers* (a vector) in one locked box.
* The tray is arranged as a polynomial, because polynomial math makes “mixing and unmixing” efficient.
* Later, TFHE builds bigger tools (like GLev/GGSW) by stacking these GLWE boxes together.
***
## 11) Quick summary
* A GLWE ciphertext is $$(A\_0,\dots,A\_{k-1},B)\in \mathcal{R}\_q^{k+1}$$
* It hides a message polynomial $$M$$ via: $$B = \sum\_i A\_iS\_i + \Delta M + E \pmod q$$
* Decrypt by subtracting $$\sum\_i A\_iS\_i$$ then rounding
* **LWE and RLWE are special cases** of GLWE (by choosing $$N$$ and $$k$$).
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://sabanaku77.gitbook.io/fhe-handbook-for-beginners/glwe.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.