# TFHE Ciphertexts

TFHE is an FHE scheme that lets you compute on encrypted data. What makes TFHE *practically useful* is that it uses multiple ciphertext each optimized for a specific job in the pipeline (fast ops, packing, bootstrapping, etc.).

This page introduces the ciphertext families you’ll keep seeing throughout the TFHE deep dive:

* **(G)LWE / (G)LWE-based ciphertexts** for “normal encrypted values”
* **GLev** for “leveled / gadget-friendly” representations
* **(G)GSW / (G)GSW-based ciphertexts** for “encrypted selectors / encrypted multipliers” used in bootstrapping and programmable operations

***

## 1) Why does TFHE use multiple ciphertext types?

**The Simple Explanation:** Think of TFHE like a construction site. You don't carry everything in the same type of container.

* **LWE:** A small envelope for a single letter.
* **RLWE:** A crate for a batch of items.
* **GGSW:** A heavy-duty machine (like a forklift) that not only holds data but helps manipulate other data.

TFHE mainly uses three types of ciphertexts (LWE, RLWE, RGSW), because **they have different properties that become useful in different homomorphic operations**.

**Mental Model:**

* **LWE**: Best for **simple numbers** (like a single boolean `true/false` or integer `42`).
* **RLWE/GLWE**: Best for **packing data** (efficiently processing 1024 numbers at once).
* **(R)GSW / GGSW**: Best for **controlling operations** (like "if this encrypted bit is 1, do X"). It is expensive to create but powerful.

***

## 2) The “base layer”: GLWE (General-LWE)

### What it is

TFHE uses **GLWE** as the *general form* that covers both LWE and RLWE.

A GLWE ciphertext encrypting a message `M` looks like:

* a **mask**: `(A0, …, A(k-1))` (Random noise to hide the message)
* a **body**: `B` (The masked message)

> **Key Equation:** `B = Mask · Key + Message + Error` Think of this as: `Body = (Randomness mixed with Key) + Data + Noise`

### Why GLWE matters

GLWE is the “Lego brick” of the system:

* It acts as the **building block** for the larger types (GLev and GGSW are just stacks of GLWEs).
* It allows you to switch between "single number mode" and "polynomial packing mode" without changing the math.

***

## 3) Special cases of GLWE: LWE and RLWE

Since GLWE is the "Shape Shifter," you can lock it into two specific modes:

### LWE (The "Scalar" / Single Box)

* **Settings:** You force polynomials to be just regular numbers ($$N=1$$) and set the vector size $$k=n$$.
* **Intuition:** LWE is a **single encrypted value**. It’s compact and good for final answers or simple logic gates.

### RLWE (The "Polynomial" / Egg Carton)

* **Settings:** You use polynomials (where $$N$$ is a power of 2) and set $$k=1$$.
* **Intuition:** RLWE is a **container with slots**. One RLWE ciphertext can hold $$N$$ different values (e.g., 1024 values) at once. This allows you to add/multiply all 1024 values in a single step (SIMD).

***

## 4) Trivial GLWE ciphertexts (The "See-Through" Box)

TFHE uses a notion called **trivial ciphertexts**:

* They are shaped like a ciphertext (so the machines can process them).
* **But** the "mask" is zero, so the message is visible.

**Analogy:** Imagine you are adding an encrypted number (in a locked box) to the number 5. The machine only accepts boxes. So, you put the number 5 in a **transparent box**. The machine can now process "Locked Box + Transparent Box" without needing a key for the second one.

**Why it’s useful:** It lets you mix **public data** (constants) with **private data** (encrypted) easily.

***

## 5) GLev: “The Coin Stack”

### What it is

A **GLev ciphertext** is a list of GLWE ciphertexts that all encrypt the *same* message `M`, but with **different precision scales**.

Conceptually: `GLev(M) = [ Encrypt(M with huge noise), ..., Encrypt(M with tiny noise) ]`

Imagine you have a currency system.

* Instead of giving someone a $100 bill (which is hard to break change for), you give them a stack: **one $100 bill, one $10 bill, and one $1 bill**.
* This is called **Gadget Decomposition**.
* It allows the homomorphic operations to pick the "denomination" that minimizes noise growth during complex calculations.

***

## 6) GGSW: “The Operator” (The Heavy Hitter)

### Structure

TFHE gives a clean hierarchy:

* **GLWE** = 1D vector (Line)
* **GLev** = 2D structure (Square/Matrix)
* **GGSW** = 3D structure (Cube/Tensor)

### What it does (The "Magic")

Normal ciphertexts (GLWE) are **passive**: they just hold data. **GGSW** ciphertexts are **active**: they are used to *multiply* or *select* other ciphertexts.

In a **GGSW(M)**:

* It contains encryptions of the message `M` mixed with the secret key `S` (specifically `-Si · M`).
* This special structure allows it to perform the **external product**: `GGSW(A) * GLWE(B) = GLWE(A * B)`

**Why it matters:** This is the engine behind **Bootstrapping**. It allows TFHE to refresh the noise and keep computations going forever.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://sabanaku77.gitbook.io/fhe-handbook-for-beginners/tfhe-ciphertexts.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.