# Notes on Lattices, Homomorphic Encryption, and CKKS

Vir Pathak

(February 2022)

##  1 Introduction

In cryptography, computing on encrypted data is a major goal which has so far
proven elusive. However recent progresses in this area (called homomorphic
encryption) have made it possible for such a technology to soon be deployed in
the real world.

In a homomorphic encryption scheme, you have the desirable property that

$\text{Decryption}(\text{Encyption}(a+b))=\text{Decryption}(\text{Encryption}(a))+\text{Decryption}(\text{Encryption}(b))$

and similarly

$\text{Decryption}(\text{Encryption}(ab))=\text{Decryption}((\text{Encryption}(a))(\text{Encryption}(b)))$

for real or complex messages $a$ and $b$.

Why is such technology so desirable? Consider the following scenario: imagine
you are a hospital which stores vast archives of sensitive medical data and
you want an analytics company to train their prediction algorithm on your
medical data. Then once trained, you can use such an algorithm to detect
diseases in new patients. However, you do not want such sensitive medical
information to be leaked to an untrusted third party. The solution is
homomorphic encryption, which will allow the company to compute on and train
on encrypted data.

How are people currently trying to create such homomorphic encryption schemes?
In 2009, Oded Regev wrote a famous paper reducing the hardness of a linear
algebra problem called the Learning With Errors Problem to the quantum
hardness of GapSVP. This work won him the 2018 Godel Prize. Moreover, this
allows cryptographers to base their schemes off the hardness of LWE, which is
extremely versatile and also allows for homomorphic encryption schemes.

LWE and its Ring variant allowed for cryptographers to devise many partially
homomorphic schemes. That is, such schemes do not allow for unbounded
addition/multiplication operations on encrypted data. Namely, each operation
adds “error” to the encrypted ciphertext. Ultimately, this error grows too
large to decrypt properly after enough encrypted computations (particularly
multiplication). This is remedied with a technique called bootstrapping which
was introduced in Craig Gentry’s PhD thesis in 2009. However, bootstrapping is
extremely slow and costly. To bypass bootstrapping, Braskerski, Gentry, and
Vaikuntanathan created the BGV scheme. While BGV is technically not fully
homomorphic, it is a leveled homomorphic encryption scheme. That is, if one
knows the polynomial they want to homomorphically compute beforehand, then
they can set the BGV parameters accordingly so that decryption does not fail.

The above methods make it easy to do homomorphic computations where the
encrypted inputs are integers. However, a challenge comes when trying to do
approximate arithmetic with real numbers. A naive approach is to scale a real
number by a multiplying the input by a large integer (called a scaling factor,
say $2^{64}$), do your homomorphic computations with the floor of the scaled
number, and finally divide by the integer after the homomorphic computations.
However, the problem is that the scaling factor itself increases exponentially
after encrypted multiplications. For example, if $c_{1}$ and $c_{2}$ are
encryptions of $100m_{1}$ and $100m_{2}$ respectively (here $100$ is the
scaling factor), then homomorphically multiplying $c_{1}$ and $c_{2}$ gives
$c_{3}$, which encrypts $10000m_{1}m_{2}$. The encryption scheme we talk about
in these notes (CKKS) give a method to homomorphically rescale (ie go back to
$100m_{1}m_{2}$). The security of CKKS comes from the Ring variant of LWE.
CKKS also is able to enjoy some useful features by using clever techniques
coming from Ring Theory, Linear Algebra, and cyclotomic extensions.

This is a survey describing what I have learned from the CCS Suf program two
years ago as well as what I learned from an REU at Clemson last summer. It
will cover lattices, security definitions, and the recent CKKS homomorphic
encryption scheme devised by Cheon, Kim, Kim, and Song. In the SUF program two
years ago, my main tasks were to read and understand the CKKS paper, implement
CKKS, and implement an algorithm optimizing CKKS parameter selection.

##  2 Lattices

######  Definition 1.

Let $v_{1},...,v_{n}\in\mathbb{R}^{m}$ be linearly independent vectors. The
lattice $\mathcal{L}$ generated by $v_{1},...,v_{n}$ is the set of integer
linear combinations

$\mathcal{L}=\\{a_{1}v_{1}+...+a_{n}v_{n}\mid
a_{1},...,a_{n}\in\mathbb{Z}\\}.$

The dimension of $\mathcal{L}$ is the number of vectors in a basis for
$\mathcal{L}$ (so in the above example $\\{v_{1},...,v_{n}$} is the basis and
the dimension is $n$). If $n=m$, we say the lattice $\mathcal{L}$ is full
rank.

###  2.1 Important Lattice Results

Let $\\{v_{1},...,v_{n}\\}$ be a basis for a lattice $\mathcal{L}$ and let
$w_{1},...,w_{m}$ be some vectors in $\mathcal{L}$. Then we have

$\displaystyle w_{1}$ $\displaystyle=a_{11}v_{1}+...+a_{1n}v_{n}$ . . .
$\displaystyle w_{n}$ $\displaystyle=a_{n1}v_{1}+...+a_{nn}v_{n}$

Now consider the matrix

$A=\begin{pmatrix}a_{11}&a_{12}&.&.&.a_{1n}\\\ .\\\ .\\\ .\\\
a_{n1}&a_{n2}&.&..&.a_{nn}\end{pmatrix}.$

For $v_{i}$ to be an integer linear combination of the $w_{j}$, we need
$A^{-1}$ to have integer entries. Since

$1=det(A)det(A^{-1}).$

and both $det(A)$ and $det(A^{-1})$ are integers, this tells us that the
determinant of both matrices are either $1$ or $-1$. Conversely, if
$det(A)=\pm 1$ and $A$ has integer entries, then $A^{-1}$ must have integer
entries. This gives us the following fact:

######  Theorem 1.

Any two bases for a lattice $\mathcal{L}$ are related by a matrix with integer
coefficients and a determinant of $\pm 1$. Such matrices are called unimodular
matrices.

A lot of hard lattice problems are centered around finding ”short” vectors in
the lattice. We can give a naive bound for the shortest vector, namely if we
have a lattice basis $B$, then every lattice vector is as least as long as the
vectors formed by applying the Gram Schmidt Algorithm to the lattice basis
$B$.

######  Theorem 2.

Let $B=\\{b_{1},...,b_{n}\\}$ be a rank $n$ lattice basis and let
$\mathcal{L}(B)\subset\mathbb{R}^{m}$ be the lattice generated by $B$.
Moreover let $\widetilde{B}=\\{\widetilde{b_{1}},...,\widetilde{b_{n}}\\}$ be
its Gram-Schmidt orthogonalization. Then

$\lambda_{1}(\mathcal{L}(B))\geq\min_{i=1,...,n}||\widetilde{b_{i}}||>0.$

Here $\lambda_{1}(\mathcal{L}(B))$ denotes the length of the shortest nonzero
vector in $\mathcal{L}(B)$.

###### Proof.

Let $B$ also denote the $m\times n$ matrix formed by writing each $b_{i}$ as
the $i$th column. Then note that we have

$\mathcal{L}(B)=\\{Bx\mid x\in\mathbb{Z}^{n}\\}.$

Now take any $x\in\mathbb{Z}^{n}$. We will show
$||Bx||\geq\min_{i=1,...,n}||\widetilde{b_{i}}||.$ For $x=(x_{1},...,x_{n})$,
let $j$ denote the largest number such that $x_{j}\neq 0$. We have

$\left|\langle{Bx,\widetilde{b_{j}}}\rangle\right|=\left|\langle{\sum_{i=1}^{n}x_{i}b_{i},\widetilde{b_{j}}}\rangle\right|$
$=\left|\sum_{i=1}^{n}x_{i}\langle{b_{i}\widetilde{b_{j}}}\rangle\right|=|x_{j}|||\widetilde{b_{j}}||^{2}$

However also note that By Cauchy Schwarz we have

$\left|\langle{Bx,\widetilde{b_{j}}}\rangle\right|\leq||Bx||\cdot||\widetilde{b_{j}}||.$

Combining this with the above equality, we have that

$||Bx||\geq\frac{\left|{\langle{Bx,\widetilde{b_{j}}}}\rangle\right|}{||\widetilde{b_{j}}||}$
$=|x_{j}|\cdot||\widetilde{b_{j}}||\geq||\widetilde{b_{j}}||\geq||\widetilde{b_{j}}||\geq\min_{i=1,...,n}||\widetilde{b_{i}}||>0$

∎

This gives a naive lower bound for the length of the shortest lattice vector.
However it is enough to show that lattices can be defined independent of a
latttice basis. Namely, lattices in $\mathbb{R}^{m}$ are nothing but discrete
(additive) subgroups of $\mathbb{R}^{m}$. Before that, we give another an easy
lemma.

######  Definition 2.

Given $n$ linearly independent vectors $v_{1},...,v_{n}\in\mathbb{R}^{m}$,
define their fundamental parallelepiped to be

$P(v_{1},...,v_{n}):=\\{\sum_{i=1}^{n}y_{i}v_{i}\mid 0\leq y_{i}<1\\}.$

######  Theorem 3.

Let $\mathcal{L}$ be a full rank lattice in $\mathbb{R}^{m}$ and let
$v_{1},...,v_{m}$ denote linearly independent vectors in $\mathcal{L}$. Then
$v_{1},...,v_{m}$ form a lattice basis for $\mathcal{L}$ if and only if
$P(v_{1},...,v_{m})\cap\mathcal{L}=\\{0\\}$.

###### Proof.

Let $\\{v_{1},...,v_{m}\\}$ be a lattice basis for $\mathcal{L}$ and let $v\in
P(v_{1},...,v_{m})\cap\mathcal{L}$. Then since $v_{1},...,v_{m}$ are linearly
independent and a lattice, $v$ can be written uniquely as an integer linear
combination of $v_{1},...,v_{m}$. But by definition of $P(v_{1},...,v_{m})$,
it must follow that all the scalars in the integer linear combination are
zero. So $v=0$ as claimed.

For the other direction, assume that $\\{v_{1},...,v_{m}\\}\subset\mathcal{L}$
are such that $P(v_{1},...,v_{m})\cap\mathcal{L}=0$. We show the $v_{i}$ form
a lattice basis. Let $v\in\mathcal{L}$ be any lattice vector. Then since the
$v_{i}$ are linearly independent, we know that

$v=\alpha_{1}v_{1}+...+\alpha_{m}v_{m}$

for real $\alpha_{i}$. But also note that

$\left\lfloor{\alpha_{1}}\right\rfloor
v_{1}+...+\left\lfloor{\alpha_{m}}\right\rfloor v_{m}\in\mathcal{L}.$

Therefore we know that

$v^{\prime}:=(\alpha_{1}-\left\lfloor{\alpha_{1}}\right\rfloor)v_{1}+...+(\alpha_{m}-\left\lfloor{\alpha_{m}}\right\rfloor)v_{m}\in\mathcal{L}.$

But $v^{\prime}$ is also clearly in $P(v_{1},...,v_{m})$. So by assumption we
have that $v^{\prime}=0$. Since the $v_{i}$ are linearly independent, it must
be that $\alpha_{i}-\left\lfloor{\alpha_{i}}\right\rfloor=0$ which means
$\alpha_{i}$ is an integer for all $i$. This implies that the $v_{i}$ form a
lattice basis for $\mathcal{L}$ as claimed. ∎

######  Definition 3.

A subset $\mathcal{L}$ of $\mathbb{R}^{m}$ is called a discrete additive
subgroup if it is an additive subgroup of $\mathbb{R}^{m}$ and there exists an
$\epsilon>0$ such that for any vector $v\in\mathcal{L}$, the intersection of
sets

$B_{\epsilon}(v)\cap\mathcal{L}=v.$

######  Theorem 4.

A subset $\mathcal{L}$ of $\mathbb{R}^{m}$ is a lattice if and only if it is a
discrete subgroup of $\mathbb{R}^{m}$.

###### Proof.

First let $\mathcal{L}$ be a lattice in $\mathbb{R}^{m}$. We will show it is a
discrete additive subgroup= of $\mathbb{R}^{m}.$ Clearly $\mathcal{L}$ is an
additive subgroup of $\mathbb{R}^{m}$. So for all $x,y\in\mathcal{L}$, we know
$x-y\in\mathcal{L}$ and therefore

$||x-y||\geq\lambda_{1}(\mathcal{L})$

where $\lambda_{1}(\mathcal{L})$ is as defined above. But we know from the
previous theorem that

$||x-y||\geq\lambda_{1}(\mathcal{L})\geq\min_{i=1,...,m}||\widetilde{b_{i}}||>0$

where $B=\\{b_{1},...,b_{m}\\}$ is a lattice basis and
$\widetilde{B}=\\{\widetilde{b_{1}},...,\widetilde{b_{m}}\\}$ is the Gram
Schmidt orthogonalization of $B$. Setting $\epsilon=\lambda_{1}(\mathcal{L})$,
we get the first direction.

Now for the other direction. We will construct a lattice basis
$(v_{1},...,v_{n})\subset\mathbb{R}^{m}$ (with $n\leq m$) for our discrete
subgroup $\mathcal{L}$. First pick $y\in\mathcal{L}$ such that there is no
vector in $\mathcal{L}$ shorter than $y$. Set $y$ equal to $v_{1}$. Next, we
recursively define $v_{i}$. Assume $v_{1},...,v_{i}$ have been chosen. Choose
a vector $y$ in $\mathcal{L}$ which is not in the span of the previous
$v_{i}$. Next, consider the parallelepiped

$P(v_{1},...,v_{i},y)$

and note that the parallelepiped contains at least one (but finitely many)
points in the $\mathcal{L}$. Choose a vector

$z\in P(v_{1},..,v_{i})\setminus span(v_{1},...,v_{i})$

where we require $z$ to be in $\mathcal{L}$ and

$dist(z,span(v_{1},...,v_{i}))$

is minimized. Here our notion of distance is given by the distance from $z$ to
its orthogonal projection in the subspace $span(v_{1},...,v_{i})$. Since there
are finitely many $z$, such a choice can be made. Set $z=v_{i+1}$. Continue
until we cannot construct anymore $v_{i}$. Note that we can choose at most $m$
$v_{i}$ since we cannot take more than $m$ linearly independent vectors in
$\mathbb{R}^{m}$.

Now that we have picked our set $B=(v_{1},...,v_{n})$, we will show that
$\mathcal{L}$ is precisely the $\mathbb{Z}$ span of $B$. Clearly anything in
the $\mathbb{Z}$ span of $B$ is contained in $\mathcal{L}$. Next, let $v$ be
any vector in $\mathcal{L}$ Then by construction of $B$, we know that we can
write

$v=\sum_{i=1}^{n}y_{i}v_{i}$

for $y_{i}\in\mathbb{R}$. Take

$v^{\prime}:=\left\lfloor{y_{1}}\right\rfloor
v_{1}+...+\left\lfloor{y_{n}}\right\rfloor v_{n}.$

Then $v^{\prime}$ is clearly an element in $\mathcal{L}$ and so we know
$v-v^{\prime}\in\mathcal{L}$. Consider the Gram-Schmidt orthogonalization of
the set $\\{v_{1},...,v_{n}\\}$ and denote it by
$\\{\widetilde{v_{1}},...,\widetilde{v_{n}}\\}$. Then since we can write

$v-v^{\prime}=(y_{n}-\left\lfloor{y_{n}}\right\rfloor)\widetilde{v_{n}}+s$

where $s\in span(v_{1},...,v_{n-1})$, we have that

$dist(v-v^{\prime},span(v_{1},...,v_{n-1}))=(y_{n}-\left\lfloor{y_{n}}\right\rfloor)\cdot||\widetilde{v_{n}}||.$

By the same logic,

$dist(v_{n},span(v_{1},...,v_{n-1}))=||\widetilde{v_{n}}||.$

But since $(y_{n}-\left\lfloor{y_{n}}\right\rfloor)<1$, we know

$dist(v-v^{\prime},span(v_{1},...,v_{n-1}))<dist(v_{m},span(v_{1},...,v_{n-1})).$

But $v_{n}$ was chosen such that it was closest to $span(v_{1},...,v_{n-1})$
so $v-v^{\prime}\in span(v_{1},...,v_{n-1})$. This implies that
$y_{n}-\left\lfloor{y_{n}}\right\rfloor=0$. So $y_{n}$ is an integer.

Repeating the same argument for each $y_{i}$ using $\\{v_{1},...,v_{i}\\}$
tells us that each $y_{i}$ is an integer. So $\mathcal{L}$ is precisely the
$\mathbb{Z}$-span of $B$ as claimed. ∎

###  2.2 Hard Lattice Problems

Take a lattice $\mathcal{L}\subset\mathbb{R}^{m}$. There are a number of
problems which we are believed to be hard for computers to solve efficiently.
These problems will be the basis of the homomorphic encryption schemes we will
study and are also the basis of many post-quantum encryption schemes.

Shortest Vector Problem (SVP): In our lattice $\mathcal{L}$ and given a norm
$||\cdot||$ (usually we take the Euclidean norm in $\mathbb{R}^{m}$), find a
vector $v\in L$ such that $||v||$ is shorter than all other vectors in $L$
(note that such a $v$ may not be unique).

Closest Vector Problem (CVP): Given a vector $w\in\mathbb{R}^{m}$ that is not
in $\mathcal{L}$ find a vector $v\in\mathcal{L}$ such that $||w-v||$ is
minimized.

CVP is NP hard and SVP is NP hard under a ”randomized reduction hypothesis”.
Here is another problem believed to be reasonably hard for computers to
efficiently solve.

GapSVP: Let $\mathcal{L}$ be an $n$ dimensional lattice and let $\psi$ be a
real valued function which takes integers as input. Given a lattice basis for
$\mathcal{L}$, decide whether $\lambda_{1}(\mathcal{L})\leq 1$ or if
$\lambda_{1}(\mathcal{L})\geq\psi(n)$.

The security of all the homomorphic encryption schemes we will consider is
based on the GapSVP problem. In order to explain why, we need to explain a new
problem.

##  3 LWE and RLWE

Now we will give the Learning With Errors Problem and its variants.
Intuitively, the LWE problems ask you to solve a ”noisy” system of linear
equations.

Notation: For a probability distribution $\chi$, we write $e\leftarrow\chi$ to
mean that $e$ is sampled from the distribution $\chi$. If $S$ is a set, we
write $s\leftarrow S$ to mean $s$ is sampled from $S$ according to the uniform
distribution over $S$.

###  3.1 LWE

Let $q$ be a prime, $\chi$ a probability distribution which outputs ”small
values” (e.g. the uniform distribution over $[-B,B]$ for $B<<\frac{q}{2}$). We
say that a sample from $LWE(n,\chi,q)$ is a set of pairs of the form

$\left\\{(a_{i},\langle{a_{i},s\rangle}+e_{i})\mid
s\leftarrow\mathbb{Z}_{q}^{n},e_{i}\leftarrow\chi,a_{i}\leftarrow\mathbb{Z}_{q}^{n}\right\\}.$

The decision version of $LWE(n,m,\chi,q)$ is to distinguish $m$ samples from
$LWE(n,\chi,q)$ from $m$ uniformly random samples in
$\mathbb{Z}_{q}^{n}\times\mathbb{Z}_{q}$. The search version of
$LWE(n,\chi,q)$ is to recover $s$ given a polynomially bounded amount (in
$n\log q)$ of $LWE(n,\chi,q)$ samples. It is known that these two variants are
actually equivalent.

In his 2009 paper On Lattices, Learning With Errors, Random Linear Codes, and
Cryptography, Oded Regev gives the following theorem:

######  Theorem 5.

Let $n,p$ be integers and $\alpha\in\\{0,1\\}$ be such that $\alpha
p>2\sqrt{n}$. If there exists an efficient algorithm that solves
$LWE_{p\Psi,\alpha}$, then there exists an efficient quantum algorithm that
approximates GapSVP and SIVP (another lattice problem).

That is, if solving GapSVP is hard (for quantum computers - which we believe
they are) then solving $LWE$ (both the decision and search versions) is also
hard (for classical computers).

###  3.2 RLWE

Fix a prime $q$ and take the ring

$R_{n,q}=\mathbb{Z}_{q}[x]/(x^{n}+1).$

An RLWE sample is of the form $(a(x),b(x))$ where $a(x)\in R_{n,q}$ is uniform
random and $b(x)=s(x)a(x)+e(x)\in R_{n,q}$. Here $s$ is a fixed secret
polynomial and each coefficient $e$ comes from the error distribution $\chi$
we mentioned above. The (search)RLWE problem is to find the polynomial $s(x)$
given a bunch of $RLWE$ samples. The decision RLWE problem is defined
analogously as above. We have the following theorem:

######  Theorem 6.

Suppose that it is hard for polynomial-time quantum algorithms to approximate
the search version of the shortest vector problem (SVP) in the worst case on
ideal lattices in $R=\mathbb{Z}[x]/(x^{n}+1)$ to within a fixed poly(n)
factor. Then any $poly(n)$ number of samples drawn from the R-LWE distribution
are pseudorandom to any polynomial-time (possibly quantum) attacker.

So the same conclusion we made for LWE also applies for RLWE!

##  4 Example: A Public Key Encryption Scheme Based on LWE

We will now give an example of a (toy) encryption scheme whose security is
based on the decision LWE hardness assumption. For this, we first need to give
some notions of security and public key encryption.

######  Definition 4.

A public key encryption scheme is a tuple of algorithms $(Gen,Enc,Dec)$. $Gen$
takes as input a security parameter denoted by $1^{n}$ for $n$ bit security.
$Gen(1^{n})$ outputs a pair $(pk,sk)$. For a message $m$ in message space
$\mathcal{M}$ (this can be some ambient field $\mathbb{Z}_{p}$ for example),
$Enc(pk,m)$ outputs a ciphertext $c$, where $c$ is an element of the
ciphertext space $\mathcal{C}$ specified by the algorithm. Finally $Dec$ takes
in $sk$ and $c$ as inputs and is such that $Dec(sk,c)=m$.

Now we need to give notions which will help us define the security of a public
key encryption scheme.

######  Definition 5.

Let $\\{X_{n}\\}$ be a sequence of random variables whose support is
bitstrings of length polynomial in $n$. We call the sequence $\\{X_{n}\\}$ a
probability ensemble. Now consider two probaility ensembles $\\{X_{n}\\}$ and
$\\{Y_{n}\\}$. For any probabilistic polynomial time algorithm $A$, if we have

$\bigg{|}Pr[s\leftarrow X_{n}:A(s)=1]-Pr[s\leftarrow
Y_{n}:A(s)=1]\bigg{|}\leq\epsilon(n)$

where $\epsilon(n)$ is a negligible function in $n$, then we say the two
distribution ensembles are computationally indistinguishable. We write
$\\{X_{n}\\}\approx_{c}\\{Y_{n}\\}$. (Note that formally, the decision LWE
problem is naturally stated in terms of computational indistinguishability).

The notion of computational indistinguishability is critical to defining
several notions for security in cryptosystems. It intuititively tells us that
no computationally bounded attacker can tell the difference between two
distributions given several samples. In the setting of an encryption scheme,
this is a nice property for the distributions of your ciphertexts to have.
Namely, we want an encryption scheme to have the property that, a
computationally bounded attacker should not be able to tell two different
ciphertexts $c_{1}$ encrypting $m_{1}$ and $c_{2}$ encrypting $m_{2}$ come
from different distributions (ie the distribution of ciphertexts encrypting
$m_{1}$ and the distribution of ciphertexts encrypting $m_{2}$). That is,
given ciphertexts, a computationally bounded attacker should learn nothing
from them.

######  Definition 6.

Consider an encryption scheme specified by the algorithms (Gen, Enc, Dec). The
scheme (Gen, Enc, Dec) is said to be multi message secure if for all
probabilistic polynomial time algorithms $A$ and all polynomials $q(n)$, there
exists a negligible function $\epsilon(\cdot)$ such that for all
$n\in\mathbb{N}$ and
$m_{0},m_{1},...,m_{q(n)},m_{0}^{\prime},m_{1}^{\prime},...,m_{q(n)}^{\prime}\in\\{0,1\\}^{n}$,
$A$ distinguishes between the following distributions with probability at most
$\epsilon(n):$

$\biggr{(}k\leftarrow Gen(1^{n}):Enc(k,m_{i})\biggr{)}_{i=1}^{q(n)}$

and

$\biggr{(}k\leftarrow Gen(1^{n}):Enc(k,m_{i}^{\prime})\biggr{)}_{i=1}^{q(n)}$

Next, we will need the following fact in the security proof of our scheme.
This theorem is a special case of the hybrid lemma. It says that computational
indistinguishability is a transitive relation between distribution ensembles.

######  Theorem 7.

Let $\\{X_{n}\\}$, $\\{Y_{n}\\}$, and $\\{Z_{n}\\}$ be distribution ensembles.
If $\\{X_{n}\\}\approx_{c}\\{Y_{n}\\}$ and
$\\{Y_{n}\\}\approx_{c}\\{Z_{n}\\}$, then $\\{X_{n}\\}\approx_{c}\\{Z_{n}\\}$.

###  4.1 Scheme Description and Security Proof

This scheme only encrypts single bits. Namely, our message space is simply
$\\{0,1\\}$. Let $q$ be a prime, $n,m\in\mathbb{Z}$, and $\chi$ be a noise
distribution where for any $e\leftarrow\chi$ we have that $||e||\leq q/4m$
with high probability.

Gen($1^{n}$): This algorithm takes in a security parameter $n$ and samples
$A\leftarrow\mathbb{Z}_{q}^{n\times m},e\leftarrow\chi^{m}$ and outputs
$(pk,sk)$ where

$sk=s\leftarrow\mathbb{Z}_{q}^{n},pk=(A,s^{T}A+e^{T}).$

Enc$(pk,\mu)$: Denote our $pk$ by $(A,b^{T})$ and message $\mu\in\\{0,1\\}$.
We begin by sampling a random bitstring $r\leftarrow\\{0,1\\}^{m}$. Output
$(Ar,b^{T}+\mu\cdot\left\lceil{q/2}\right\rceil))$

Dec$(sk,(u,v))$: For secret key $sk$ and ciphertext $(u,v)$ (recall $u$ is a
vector of length $n$ and $v$ is a constant), compute

$||v-s^{T}u||.$

If the above quantity is less that $q/4$, output $0$. Otherwise output $1$.

####  4.1.1 Correctness

Consider our ciphertext $(u,v)$. Note that
$v-s^{T}u=b^{T}r+\mu\cdot\left\lceil{q/2}\right\rceil-s^{T}Ar=e^{T}r+\mu\left\lceil{q/2}\right\rceil$.
If $\mu=1$ then clearly the decryption correctly outputs $1$. If $\mu=0$ then
by our requirement for $\chi$, we have that $||e^{T}r||\leq
m\cdot\frac{q}{4m}=q/4$ with high probability. So decryption correctly outputs
$0$ with high probability.

####  4.1.2 Security

To obtain multi message security, it is sufficient to show that for any
$k=poly(n)$, we have

$\left((pk,Enc(pk,\mu_{1}),...,(pk,Enc(pk,\mu_{k}))\right)\approx_{c}\left((pk,Enc(pk,0),...,(pk,Enc(pk,0)\right).$

By the hybrid lemma, we can obtain the above requirement by just showing

$(pk,Enc(pk,0))\approx_{c}(pk,Enc(pk,1)).$

We show this with another hybrid argument. To do that, we construct the
following distributions:

First Distribution: $(pk,ct)$ where

$pk=(A,b^{T})=(A,S^{T}A+e^{T})$

for $A\leftarrow\mathbb{Z}_{q}^{m\times
n},s\leftarrow\mathbb{Z}_{q}^{n},e\leftarrow\chi^{m}$ and $ct=Enc(pk,0)$

$=(Ar,b^{T}r)$

for $r\leftarrow\\{0,1\\}^{m}$.

Second Distribution: $(pk,ct)$ where $pk=(A,b^{T})$ for
$A\leftarrow\mathbb{Z}_{q}^{m\times n}$ and random
$b\leftarrow\mathbb{Z}_{q}^{n}$ and $ct=Enc(pk,0)$

$=(Ar,b^{T}r)$

for $r\leftarrow\\{0,1\\}^{m}$.

Third Distribution: $(pk,ct)$ where $pk=(A,b^{T})$ for
$A\leftarrow\mathbb{Z}_{q}^{m\times n}$ and random
$b\leftarrow\mathbb{Z}_{q}^{n}$ and
$ct=(u,v)\leftarrow\mathbb{Z}_{q}^{n}\times\mathbb{Z}_{q}$.

Fourth Distribution: $(pk,ct)$ where where $pk=(A,b^{T})$ for
$A\leftarrow\mathbb{Z}_{q}^{m\times n}$ and $ct=Enc(pk,1)$

$=(Ar,b^{T}r+\left\lceil{q/2}\right\rceil)$

for random $r\leftarrow\\{0,1\\}^{m}$.

Fifth Distribution: $(pk,ct)$ where $pk=(A,b^{T})=(A,s^{T}A+e^{T})$ for
$A\leftarrow\mathbb{Z}_{q}^{m\times
n},s\leftarrow\mathbb{Z}_{q}^{n},e\leftarrow\chi^{m}$ and $ct=Enc(pk,1)$

$=(Ar,b^{T}r+\left\lceil{q/2}\right\rceil)$

for random $r\leftarrow\\{0,1\\}^{m}$. We want to show the first distribution
is computationally indistinguishable from the fifth distribution. By the LWE
assumption, first distribution is computationally indistinguishable from the
second. By a special case of the universal hash lemma, the second is
indistinguishable from the third and the third is indistinguishable from the
fourth. Finally the LWE assumption implies that that the fourth distribution
is computationally indistinguishable from the fifth. By the hybrid argument,
we get that the first and fifth distributions are computationally
indistinguishable, as required.

##  5 Motivation, Notations, and Definitions for CKKS

Now we use RLWE to construct a homomorphic encryption scheme called CKKS. The
great thing about CKKS is that you can perform homomorphic computations on
real/complex numbers. It was previously only possible to do homomorphic
computations on integers. This brings us one step closer to real world
applications like privacy-preserving machine learning.

Popular homomorphic encryption schemes have a decryption structure of
$\langle{c,sk}\rangle=m+et\pmod{q}$ where $c$ is an encryption of $m$. If we
homomorphically multiply encryptions of messages $m_{1}$ and $m_{2}$, then the
ciphertext corresponding to the encryption of the product $c_{1}=m_{1}m_{2}$
is contained in some of the least significant bits of the homomorphic
multiplication.

This means that if we have encryptions of approximations of $m_{1}$ and
$m_{2}$, the result $c_{1}^{\prime}$ of homomorphically multiplying these
encrypted approximations will have completely different Most Significant Bits
compared to that of $c_{1}$. Therefore, it is difficult to homomorphically do
arithmetic with encrypted approximations of messages.

To do approximate arithmetic homomorphically, we want our decryption to have
the our message contained in the most significant bits of of the decryption
$\langle{c,sk}\rangle$. Therefore, we want our decryption structure to be of
the form $\langle{c,sk}\rangle=m+e$ where $e$ is small compared to $m$.

###  5.1 Notation and Definitions

Let $M$ be a power of $2$ larger where $M>2$, and let $\phi_{M}(x)$ be the
$M$th cyclotomic polynomial with degree $N=\phi(M)$ (note that $N$ is simply
$M/2$ and is always even). More explicitly,

$\phi_{M}(x)=(x-\zeta)...(x-\zeta^{j})...(x-\zeta^{M-1})$

where where $\zeta=e^{\frac{2\pi i}{M}}$ and $j$ runs through all the numbers
in $Z_{M}^{\ast}$.

Take $R$ to be the ring $\mathbb{Z}[x]/(\phi_{M}(x))$. For an integer $q$, we
denote $R_{q}$ to be the quotient ring $R/(qR)$.

Define the canonical embedding $\sigma:R\to\mathbb{C}^{N}$ by
$\sigma(a)=(a(\zeta),...,a(\zeta^{j}),...,a(\zeta^{M-1}))$ where
$\zeta=e^{\frac{2\pi i}{M}}$ and $j$ runs through all the numbers in
$Z_{M}^{\ast}$. Note that $\sigma(a)\in\mathbb{C}^{N}$ since
$|Z_{M}^{\ast}|=\phi(M)=N$. For a polynomial $a\in S$, define the canonical
embedding norm

$||a||_{\infty}^{\text{can}}=||\sigma(a)||_{\infty}$

We use the canonical embedding norm later to discuss the sizes of noise
polynomials in decryption and homomorphic operations.

Finally take any real number $a\in\mathbb{R}$. We write $\lfloor{a}\rceil$ to
describe $a$ rounded to the nearest integer.

##  6 Encoding/Decoding Procedure

Our message vectors will be complex vectors in $\mathbb{C}^{\frac{N}{2}}$ and
our plaintext space will be $R$. We do this because we can encrypt multiple
messages into one ciphertext. Encoding will map our complex messages to a
plaintext polynomial in $R$, while decoding map a plaintext polynomial back to
the original complex vector.

###  6.1 Encoding

Consider the canonical embedding from
$R\to\mathbb{\sigma}(R)\subset\mathbb{C}^{N}$. Since $M$ is a power of $2$, we
have $N=M/2$. First note that the kernel of this homomorphism is the zero
polynomial(denoted by $0$). Since $R/(0)$ is just $R$, we have that

$R\cong\sigma(R)$

by the first isomorphism theorem. Therefore $\sigma$ maps every polynomial in
$R$ to a unique vector in $\sigma(R)$.

For a vector $z=(z_{1},...,z_{n})\in\mathbb{\sigma}(R)$, our goal is to
compute $\sigma^{-1}(z)$. This problem reduces to finding the coefficient
vector $(\alpha_{0},...,\alpha_{N-1})$ such that

$\sum_{i=0}^{N-1}\alpha_{i}(\zeta^{2j-1})^{i}=z_{j}$

for $j=1,...,n$. We can characterize this problem as solving the system of
equations

$\begin{bmatrix}1&&\zeta&&\zeta^{2}&&...&&\zeta^{N-1}\\\
1&&\zeta^{3}&&(\zeta^{3})^{2}&&...&&(\zeta^{3})^{N-1}\\\ &&&&&&.\\\ &&&&&&.\\\
&&&&&&.\\\ 1&&\zeta^{2N-1}&&(\zeta^{2N-1})^{2}&&...&&(\zeta^{2N-1})^{N-1}\\\
\end{bmatrix}\begin{bmatrix}\alpha_{0}\\\ \alpha_{1}\\\ .\\\ .\\\ .\\\
\alpha^{N-1}\end{bmatrix}=\begin{bmatrix}z_{1}\\\ z_{2}\\\ .\\\ .\\\ .\\\
z_{n}\end{bmatrix}$

Call the large matrix on the left hand side $A$ and the vector on the right
hand side $z$. We get our polynomial coefficients by computing $A^{-1}z$. This
essentially computes $\sigma^{-1}(z)$.

In the context of CKKS, our plaintext ring is $R=\mathbb{Z}[x]/(x^{N}+1)$.
Note that therefore the coefficients of polynomials encoding messages must
have integer coefficients.

Now consider the canonical embedding $\sigma:R\to\mathbb{C}^{N}$. Since every
$N$th root of unity is the complex conjugate of some other $N$th root of
unity, we know that the image

$\sigma(R)\subseteq H=\\{z\in\mathbb{C}^{N}\mid z_{j}=\overline{z_{-j}}\\}.$

So we can naturally identify every element of $\sigma(R)$ to be in
$\mathbb{C}^{\frac{N}{2}}$. Therefore, our message space will just be vectors
in $\mathbb{C}^{\frac{N}{2}}$.

Now we give the encoding procedure which sends a message in
$\mathbb{C}^{\frac{N}{2}}$ to a plaintext polynomial in $R$. We start with a
message $z\in\mathbb{C}^{\frac{N}{2}}$. Then we naturally extend this into an
element in $\mathbb{C}^{N}$ by computing $\pi^{-1}(z)$ which is computed by
keeping the $\frac{N}{2}$ entries and then adding the $\frac{N}{2}$ complex
conjugates of the first $\frac{N}{2}$ entries to make a vector in
$\mathbb{H}\subset\mathbb{C}^{N}$.

Since $\pi^{-1}(z)\in\mathbb{H}\subset\mathbb{C}^{N}$, we would like to
immediately apply $\sigma^{-1}$ to $\pi^{-1}$ to get our corresponding
plaintext polynomial in $R$. However, note that $\sigma(R)\neq H$, so
$\pi^{-1}(z)$ may not be an element of $\sigma(R)$. To fix this problem, we
use a technique called coordinate-wise random rounding. We now describe this
process.

####  6.1.1 Coordinate-Wise-Random-Rounding and Decoding

We know that $R$ is isomorphic to $\sigma(R)$. Since $R$ has the orthogonal
$\mathbb{Z}$ basis $(1,x,...,x^{N-1})$, we know that

$(\beta_{1},...,\beta_{N})=(\sigma(1),\sigma(x),...,\sigma(x^{N-1}))$

is an orthogonal $\mathbb{Z}$ basis for $\sigma(R)$. Then for
$z\in\mathbb{H}$, we simply have to project $z$ onto the basis
$(\sigma(1),\sigma(x),...,\sigma(x^{N-1}))$ to find the closest vector to $z$
in $\sigma(R)$. We have

$z=\sum_{i=1}^{N}z_{i}\beta_{i}$

with $z_{i}=\frac{\langle{z,\beta_{i}}\rangle}{||\beta_{i}||^{2}}$. Note
$\langle{\cdot}\rangle$ denotes the Hermitian inner product and it turns out
that this inner product will always yield real values here.

Then once we compute all the $z_{i}$, we randomly round(i.e use the coordinate
wise random rounding scheme) to round $z_{i}$ to randomly up or down to the
nearest integer. Let $l$ be the vector of randomly rounded $z_{i}$’s. This is
an element of $\sigma(R)$. To manage possible rounding errors, we compute
$\Delta\cdot\pi^{-1}(l)$ for some scaling factor $\Delta$. Finally, we
calculate our $R$ polynomial $m(x)=\sigma^{-1}(\Delta\cdot\pi^{-1}(l))$ using
our previously mentioned reasoning. This concludes the encoding scheme.

Finally, decoding is simple. For a polynomial $m\in R$, compute
$\pi\circ\sigma(\left\lfloor{\Delta^{-1}\cdot m}\right\rceil)$.

###  6.2 Example

We now give a toy example of encoding. We will encode
$m=(3+4i,2-i)\in\mathbb{C}^{2}$ with $N=4$, $M=8$, and $\Delta=64$. We see
that

$\pi^{-1}(3+4i,2-i)=(3+4i,2-i,3-4i,2+i).$

Multiplying this vector by $\Delta$, we obtain the vector
$z=(192+256i,128-64i,192-256i,128+64i)$. We now project $z$ onto $\sigma(R)$
to get a close approximation of $z$ in $\sigma(R)$. By our previous
discussion, we have that $z\approx\sum_{i=1}^{4}z_{i}\beta_{i}$ where

$z_{i}=\frac{\langle{z,\beta_{i}}\rangle}{||\beta_{i}||^{2}}$

and $\beta_{i}=\sigma(x^{i})$.

We first compute each $\beta_{i}$. We see $\beta_{1}=\sigma(1)=(1,1,1,1)$.
Next,
$\beta_{2}=(\frac{\sqrt{2}}{2}+\frac{i\sqrt{2}}{2},-\frac{\sqrt{2}}{2}+\frac{i\sqrt{2}}{2},\frac{\sqrt{2}}{2}-\frac{i\sqrt{2}}{2},-\frac{\sqrt{2}}{2}-\frac{i\sqrt{2}}{2})$.
Then squaring each entry in $\beta_{2}$, we have that $\beta_{3}=(i,-i,-i,i)$.
Finally,
$\beta_{4}=(-\frac{\sqrt{2}}{2}+\frac{i\sqrt{2}}{2},\frac{\sqrt{2}}{2}+\frac{i\sqrt{2}}{2},-\frac{\sqrt{2}}{2}-\frac{i\sqrt{2}}{2},\frac{\sqrt{2}}{2}-\frac{i\sqrt{2}}{2})$

With this formula, we get $z_{1}=160$, $z_{2}=90.5$, $z_{3}=160$,
$z_{4}=45.2$. Now we randomly round each $z_{i}$ to the nearest integer to get
the vector $z^{\prime}=(160,90,160,45)$.

Now we compute our projection. This will be

$v=z_{1}\beta_{1}+z_{2}\beta_{2}+z_{3}\beta_{3}+z_{4}\beta_{4}=\begin{bmatrix}191.82+255.46i\\\
128.18-64.54i\\\ 191.82-255.46i\\\ 128.18-64.54i\end{bmatrix}$

Notice how close an approximation this is to $z$. Now we solve the system

$\begin{bmatrix}1&\zeta&\zeta^{2}&\zeta^{3}\\\
1&\zeta^{3}&(\zeta^{3})^{2}&(\zeta^{3})^{3}\\\
1&\zeta^{5}&(\zeta^{5})^{2}&(\zeta^{5})^{3}\\\
1&\zeta^{7}&(\zeta^{7})^{2}&(\zeta^{7})^{3}\end{bmatrix}\begin{bmatrix}\alpha_{0}\\\
\alpha_{1}\\\ \alpha_{2}\\\ \alpha_{3}\\\
\end{bmatrix}=\begin{bmatrix}191.82+255.46i\\\ 128.18-64.54i\\\
191.82-255.46i\\\ 128.18-64.54i\end{bmatrix}$

We obtain our coefficients
$\alpha_{0}=160,\alpha_{1}=90,\alpha_{2}=160,\alpha_{3}=45$ to get our
polynomial $m(x)=160+90x+160x^{2}+45x^{3}$.

##  7 CKKS Scheme Outline

We first give a brief description of each function in CKKS and what they are
supposed to do. We will shortly describe how each of these functions work. The
goal is to construct a leveled fully homomorphic scheme which supports
approximations as described before. We begin by fixing integers $p>0$ and
modulus $q_{0}$. For $0<l\leq L$ write $q_{l}=p^{l}\cdot q_{0}$.

We choose an integer $M$ as a function of security parameter $\lambda$. For
levels $0\leq l\leq L$, a ciphertext on level $l$ will be an element of
$R_{l}^{2}$.

Encoding and Decoding are as previously described. Now for plaintexts, we want
to describe the algorithms
$(KeyGen,Enc,Dec,Add,Mult)$. After decrypting, we decode our plaintext and
recover the orignal vector in $\mathbb{Z}[i]^{\frac{N}{2}}$. As before, we
work over the plaintext ring $R=\mathbb{Z}[x]/(\phi_{M}(x))$ with $M$ a power
of $2$.

We now describe the algorithms mentioned before. We have

$KeyGen(1^{\lambda}):$ Generates secret key $sk$, public key $pk$, and a
public evaluation key $evk$ (this is to do homomorphic multiplications).

$Enc_{pk}(m):$ For a polynomial $m\in R$, output a ciphertext $c$ in
$R_{q_{L}}^{2}$ such that $\langle{c,sk}\rangle=m+e\pmod{q_{L}}$ with the
noise $e$ small compared to $m$.

$Dec_{sk}(c):$ For ciphertext $c$ at level $l$, compute
$m^{\prime}=m+e=\langle{c,sk}\rangle\pmod{q_{l}}$ where $m$, $e$, and $c$ are
as described in $Enc$.

$Add(c_{1},c_{2}):$ For ciphertexts $c_{1},c_{2}$ encrypting $m_{1}$ and
$m_{2}$, output a ciphertext encrypting $m_{1}+m_{2}$ whose noise is bounded
by the sum of the noises associated with $c_{1}$ and $c_{2}$.

$Mult(c_{1},c_{2}):$ For ciphertexts $c_{1},c_{2}$ encrypting $m_{1}$ and
$m_{2}$, output a ciphertext encrypting $m_{1}m_{2}$ whose noise is bounded by
a constant $B_{\text{mult}}$.

$Rescale_{l\to l^{\prime}}(c):$ For a ciphertext $c\in R_{q_{l}}^{2}$ at level
$l>l^{\prime}$, output
$c^{\prime}=\left\lfloor{\frac{q_{l^{\prime}}}{q_{l}}c}\right\rceil$

After many homomorphic multiplications, the size of the message in the
resulting ciphertext will have grown exponentially. Through $Rescale$, we are
able to reduce the size of this message by a factor of $p$. Rescale also
reduces the noise of the homomorphic operations. The idea is as follows. Let
$z\in\mathbb{C}^{\frac{N}{2}}$. We consider the number $pz$ and let $m$ be the
polynomial encoding of $pz$. Then $\langle{c,sk}\rangle\approx pz$. If we have
two ciphertexts $c_{1},c_{2}$ encrypting $m_{1},m_{2}$, homomorphically
multiplying them results in a ciphertext $c^{\prime}$ such that
$\langle{c^{\prime},sk}\rangle\approx p^{2}z_{1}z_{2}$. We use the rescale
function to get a ciphertext encrypting $pz_{1}z_{2}$.

##  8 CKKS Actual Scheme

We now give the actual CKKS Scheme in full detail. Let $\sigma>0$. A sample
from $DG(\sigma^{2})$ is a vector in $\mathbb{Z}^{N}$ whose entries are drawn
from a discrete Gaussian with variance $\sigma^{2}$. For a positive integer
$h$, a sample from $HWT(h)$ is a vector in $\\{0,\pm 1\\}^{N}$ whose hamming
weight is $h$. For $0<\rho<1$ a sample from $ZO(\rho)$ is a vector in
$\\{0,\pm 1\\}^{N}$ where the probability of having 1 or $-1$ in entry spot
$i$ is $\rho/2$ and $0$ being in entry spot $i$ is $1-\rho$.

###  8.1 Description of the Main Algorithms

Encoding and Decoding are as previously described.

$KeyGen:$ Given security parameter $\lambda$ and $q_{L}$, generate integers
$M,P$ and a real number $\sigma$. Sample $s\leftarrow HWT(h),a\leftarrow
R_{q_{L}},e\leftarrow DG(\sigma^{2})$. We take $sk=(1,s),pk=(b,a)$ with
$b=-as+e\pmod{q_{L}}$. Sample $a^{\prime}\leftarrow R_{P\cdot
q_{L}}^{2},e^{\prime}\leftarrow DG(\sigma^{2})$. Set
$evk=(b^{\prime},a^{\prime})$ with
$b^{\prime}=-a^{\prime}s+e^{\prime}+Ps^{2}$.

$Enc_{pk}(m):$ Sample polynomials $v\leftarrow ZO(0.5),e_{0},e_{1}\leftarrow
DG(\sigma^{2})$ whose coefficients form a vector sampled from $ZO(0.5)$ and
$DG(\sigma^{2})$ respectively. Compute $c=v\cdot pk+(m+e_{0},e_{1})$ and
reduce to a polynomial in $R_{q_{L}}$.

$Dec_{sk}(c):$For $c\in R_{q_{l}}^{2}$ Compute
$\langle{c,sk}\rangle\pmod{q_{l}}$.

$Add(c_{1},c_{2}):$ For $c_{1},c_{2}\in R_{q_{l}}^{2}$, compute
$c_{\text{add}}=c_{1}+c_{2}\pmod{q_{l}}$.

$Mult(c_{1},c_{2}):$ For $c_{1}=(b_{1},a_{1}),c_{2}=(b_{2},a_{2})\
inR_{q_{l}}^{2}$, let
$(d_{0},d_{1},d_{2})=(b_{1}b_{2},a_{1}b_{2}+a_{2}b_{1},a_{1}a_{2})\pmod{q_{l}}$.
Output $c_{\text{mult}}=(d_{0},d_{1})+\left\lfloor{P^{-1}\cdot d_{2}\cdot
evk}\right\rceil\pmod{q_{l}}$

$RS_{l\to l^{\prime}}(c):$ For $c\in R_{q_{l}}^{2}$, output
$c^{\prime}=\left\lfloor{\frac{q_{l^{\prime}}}{q_{l}}c}\right\rceil\pmod{q_{l^{\prime}}}$.

Our encrypted messages have a distribution which is (computationally)
indistinguishable from that of an RLWE distribution. This is proven formally
using a hybrid argument.

###  8.2 Bonus! Homomorphic Message Vector Permutation

Homomorphically permuting the slots of the original plaintext message can be
of critical importance in privacy preserving applications. Galois Theory makes
this quite easy to do in practice.

First note that any element in $\sigma(R)$ is also an element of
$\mathbb{Q}(\zeta_{M})$. Now recall that any message vector gets mapped to a
vector in $\sigma(R)$ by coordinate-wise random rounding. Moreover, recall
that

$\text{Gal}(\mathbb{Q}(\zeta_{M})/\mathbb{Q})\cong\mathbb{Z}_{M}^{\ast}.$

Now consider $(z_{1},...,z_{\frac{N}{2}})$ to be an element of $\sigma(R)$.
Then for any $z_{i}$ and $z_{j}$, there exists a map
$\varphi_{ij}\in\text{Gal}(\mathbb{Q}(\zeta_{m})/\mathbb{Q})$ such that
$\varphi_{ij}(z_{i})=z_{j}$. To be explicit, we have that

$\varphi_{ij}(\zeta)=\zeta^{(j^{-1}i)}$

where $j^{-1}\cdot j\equiv 1\pmod{M}$.

Now consider the corresponding plaintext polynomial $m(x)$ (i.e the encoding
of $(z_{1},...,z_{\frac{N}{2}})$. We can analogously act on $m(x)$ to obtain a
polynomial $m^{\prime}(x)$ by setting

$m^{\prime}(x)=m(x^{j^{-1}i}).$

Then one can easily verify that the the decodings of $m(x)$ and
$m^{\prime}(x)$ are just permutations of each other. Moreover, the $j$th
element of decoding $m^{\prime}(x)$ is just the $i$th element of decoding
$m(x)$.

Now consider a ciphertext $c=(c_{0},c_{1})$ encrypting $m$ (on any level).
Consider the vector

$(\varphi_{ij}(c_{0}),\varphi_{ij}(c_{1})).$

One can show that this decrypts to a polynomial which decodes to the same
complex vector as what $m^{\prime}(x)$ decodes to! This is how we plaintext
slots on the corresponding ciphertexts.

###  8.3 Example

####  8.3.1 keygen

We give an example of key generation, encryption, and decryption. We start
with key generation. For this example, we take $p=5,q_{0}=5$, so
$q_{0}=5,q_{1}=4\cdot 5=20,q_{2}=80,q_{3}=320,q_{4}=1280$. We continue to take
$M=8,N=4$, and $R=\mathbb{Z}[x]/(x^{4}+1)$, and $h=2$.

We first obtain our secret key $sk$. We have $sk=(1,s)$. To get $s$, we sample
a vector in $\\{0,\pm 1\\}^{4}$ whose hamming weight is $2$. Here, we select
$(0,-1,1,0)$. Then we have that $s=-x^{2}+x$ and $sk=(1,-x^{2}+x)$.

We now sample $a$ from $R_{q_{L}}$. We choose $a=103x^{3}-15x^{2}+67x-221$. To
get $e$, we sample a vector from $DG(3.2)$. We choose $(0,0,1,1)$ to obtain
$e=x+1$. To create our public key $pk=(b,a)$, we simply compute
$b=-as+e\pmod{q_{L}}$. This turns out to be

$pk=(82x^{3}-288x^{2}+119x+119,103x^{3}-15x^{2}+67x-221)$

####  8.3.2 Encryption

We will encrypt our original message polynomial $m=160+90x+160x^{2}+45x^{3}$.
We choose $v=x^{3}+1$, $e_{0}=x^{3}-1$, $e_{1}=x^{2}-1$. We have

$(m+e_{0},e_{1})=(46x^{3}+160x^{2}+90x+159,x^{2}-1).$

We now compute $v\cdot pk\pmod{q_{L}}$. We have

$(v\cdot b,v\cdot a)=(201x^{3}-370x^{2}+407x,-118x^{3}-118x^{2}+82x-288).$

Finally we calculate

$c=v\cdot
pk+(m+e_{0},e_{1})=(247x^{3}-210x^{2}+497x+159,-118x^{3}-117x^{2}+82x-289)$

####  8.3.3 Decryption

We now decrypt. This is simply $c[0]+c[1]\cdot s\pmod{q_{L}}$. We decrypt to
get

$48x^{3}+161x^{2}+90x+160.$

Notice how close this is to our original plaintext polynomial.

####  8.3.4 Decoding

For fun, let us decode and see how close we get to the original vector we
encoded. Recall that we encoded the vector $z=(3+4i,2-i)$. Above, we encrypted
and decrypted the polynomial which encoded this vector. We now decode
$p(x)=48x^{3}+161x^{2}+90x+160.$ We simply evaluate $p(\zeta)$ and
$p(\zeta^{3})$. We get

$(189.70+258.58i,130.302-63.419i).$

We now multiply our resultant vector by the inverse of our scaling factor. We
compute
$\frac{1}{64}(189.70+258.58i,130.302-63.419i)=(2.96+4.04i,2.03-.9909i)$.
Finally we round to the nearest Gaussian integer to recover our original
complex vector $(3+4i,2-i)$.

###  8.4 Correctness Lemma

We give a lemma proving the (approximate) correctness of encryption and
decryption. The proofs for the correctness of the rescaling algorithm, and the
homomorphic operations are similar.

######  Theorem 8.

Let $c$ be an encryption of $m$. Then $\langle{c,sk}\rangle=m+e$ with
$||e||_{\infty}^{\text{can}}<B_{\text{clean}}=8\sqrt{2}+\sigma
N+6\sigma\sqrt{N}+16\sigma\sqrt{hN}$. Take $c=Enc(m)$ and $m=Ecd(z)$ for
$z\in\mathbb{Z}[i]^{\frac{N}{2}}$. Then if $\Delta>N+2B_{\text{clean}}$ then
$Dcd(Dec(c))=z$.

###### Proof.

We see that $||\langle{c,sk}\rangle-m||_{\infty}^{\text{can}}=||v\cdot
e+e_{0}+e_{1}\cdot s||_{\infty}^{\text{can}}$. By triangle inequality, we see
this is less than or equal to

$||v\cdot
e||_{\infty}^{\text{can}}+||e_{0}||_{\infty}^{\text{can}}+||e_{1}\cdot
s||_{\infty}^{\text{can}}$

By some heuristic arguments, we conclude this is less than or equal to(with
high probability)

$8\sqrt{2}\sigma N+6\sigma\sqrt{N}+16\sigma\sqrt{hN}$

We prove the second part of the proposition. If
$z\in\mathbb{C}^{\frac{N}{2}}$, an encryption of $m=Ecd(z)$ is also an
encryption of $\Delta\sigma^{-1}\circ\pi^{-1}(z)$ with an error bound
$B^{\prime}=B_{\text{clean}}+\frac{N}{2}$. Therefore, we can bound our error
polynomial $e$ by $B^{\prime}$. We consider
$Dcd(m+B^{\prime})=\sigma(\pi(\left\lfloor{\Delta^{-1}(m+B^{\prime})}\right\rceil$.
For this to equal $\sigma(\pi(\left\lfloor{\Delta^{-1}(m)}\right\rceil$ as
desired, it must be the case that $\Delta^{-1}B^{\prime}<\frac{1}{2}$.
Substituting $B^{\prime}=B_{\text{clean}}+\frac{N}{2}$ into the inequality, we
get the desired result. ∎

CKKS was proposed a few years ago. It is the first scheme which allows for
approximate homomorphic computation on real/complex messages. In my REU
program at Clemson last year, our group proposed another homomorphic
encryption scheme. We do not have a rescaling procedure, so we can only
compute on integer messages. In order to reduce error, we instead use a
technique called modulus reduction. Our scheme was inspired by the closely
related Braskersky, Gentry, Vaikuntanathan (BGV) scheme.

##  9 References

1) Vinod Vaikuntanathan’s notes (lecture 1 and 2) on Lattices in Computer
Science

(link: https://people.csail.mit.edu/vinodv/COURSES/CSC2414-F11/index.html)

2) Vinod Vaikuntanathan’s notes (lecture 1) on Lattices, Learning With Errors,
and Post Quantum Cryptography

(link: https://people.csail.mit.edu/vinodv/CS294/)

3)Rafael Pass, Abhi Shelat: A Course in Cryptography

4) Jung Hee Cheon, Andrey Kim, Miran Kim, Yongsoo Song: Homomorphic Encryption
for Arithmetic of Approximate Numbers

5) Oded Regev: On Lattices, Learning With Errors, Random Linear Codes, and
Cryptography

6) Vadim Lyubashevsky, Chris Peikert, Oded Regev: On Ideal Lattices and
Learning With Errors Over Rings

7) Jeffrey Hoffstein, Jill Pipher, Joseph Silverman: An Introduction to
Mathematical Cryptography

8) Braskerski, Gentry, Vaikuntanathan: Fully Homomorphic Encryption Without
Bootstrapping


&=-\dashint_a^b \ud q\, \frac{f(q)-f(k)}{(k-q)^2}+ f(k) \ddashint_a^b \ud q\, \frac{1}{(k-q)^2} %\nonumber\\&
=-\dashint_a^b \ud q\, \frac{f(q)-f(k)}{(k-q)^2}+ f(k)\left[\frac{1}{k-a}+\frac{1}{b-k}\right]\nonumber\\
\ddashint_a^b \ud q\, \frac{f(q)}{(k-q)^2}\,.
\end{align}
These expressions differ only by divergent terms which we can miraculously ignore (see \cite{MONEGATO2009425}).
In a similar manner we can find the finite part of
\be
\ddashint_a^b \ud q\, \frac{1}{(k-q)^{p+1}} = \frac{(-1)^p}{p!}\frac{\partial^p}{\partial k^p}\dashint_a^b \ud q\, \frac{1}{k-q}\,.
\ee

Numerically we find it straightforward to calculate these integrals using integration by parts, which naturally returns the finite part. For example,
\begin{align}
\dashint_a^b \ud q\, \frac{f(q)}{k-q} & =  \frac{\partial}{\partial k}\int_a^b \ud q\, f(q)\ln|k-q|
= \int_a^b \ud q\, f(q) \frac{\partial}{\partial k}\ln|k-q|\nonumber\\
& = -\int_a^b \ud q\, f'(q) \ln|k-q|+~\text{boundary terms.}
\end{align}

In general, our integrals consist of regular parts plus singular parts and are of the form
\be
\int_0^\infty \ud q\, \left[ f_1(q,k)[\ln|k-q|-\ln(k+q)]+\frac{f_2(q,k)}{(k-q)^{p+1}}\right]\,.
\ee
The singularities at $k=q$ can be evaluated by parts, assuming that $P_m(q)$ and its derivatives vanish sufficiently rapidly at $q=0$ and $q=∞$. Integrating the last term by parts implies that the non-regular parts of this integral can be written as
\begin{align}
& \int_0^\infty\! \ud q\! \left[ f_1(q,k)\ln|k-q|+\frac{f_2(q,k)}{(k-q)^{p+1}}\right] = \int_0^\infty\!\! \ud q \ln|k-q|\!\left[ f_1(q,k)+\frac{(-1)^{p+1}}{p!}\frac{\partial^{p+1} f_2(q,k)}{\partial q^{p+1}}\right]
\nonumber\\
&= \int_0^\infty \ud q\, (k-q)(1-\ln|k-q|)\left[-\frac{\partial f_1(q,k)}{\partial q}+\frac{(-1)^{p+1}}{p!}\frac{\partial^{p+2} f_2(q,k)}{\partial q^{p+2}}\right],
\end{align}
where we integrated by parts to remove the logarithmic singularity.
Note that the part of the integrand containing  $(k-q)(1-ln|k-q|)$ is now regular~\cite{Zozulya:2015:RDI}. Therefore we have
\begin{align}
&\int_0^\infty \!\ud q \left\{ f_1(q,k)\Big[\ln|k-q|-\ln(k+q)\Big]+\frac{f_2(q,k)}{(k-q)^{p+1}}\right\}\\ \nonumber
&=\int_0^\infty \!\ud q \left\{- f_1(q,k)\ln(k+q)-(k-q)(1-\ln|k-q|)\left[\frac{\partial f_1(q,k)}{\partial q}-\frac{(-1)^{p+1}}{p!}\frac{\partial^{p+2} f_2(q,k)}{\partial q^{p+2}}\right]\right\}.
\end{align}
In reality we are dealing with an integral over the power spectrum with finite limits so the boundary terms need to be taken into account. In general, %[something still wrong here],
\begin{align}
&\int_a^b\! \ud q \left[ f_1(q,k)[\ln|k-q|-\ln(k+q)]+\frac{f_2(q,k)}{(k-q)^{p+1}}\right]\nonumber\\
&=\int_a^b\! \ud q \left\{- f_1(q,k)\ln(k+q)+(k-q)(1-\ln|k-q|)\left[-\frac{\partial f_1(q,k)}{\partial q}+\frac{(-1)^{p+1}}{p!}\frac{\partial^{p+2} f_2(q,k)}{\partial q^{p+2}}\right]\right\}\nonumber\\
&+\sum_{i=0}^{p-1}\frac{(p-(i+1))!}{p!(q-k)^{p-i}}\frac{\partial^i f_2(q,k)}{\partial q^i}\bigg|_{q=a}^b +\frac{(-1)^{p+1}}{p!}\ln|k-q|\frac{\partial^{p} f_2(q,k)}{\partial q^{p}}\bigg|_{q=a}^b \nonumber\\
&+ (k-q)(1-\ln|k-q|)\left[- f_1(q,k)+\frac{(-1)^{p}}{p!}\frac{\partial^{p} f_2(q,k)}{\partial q^{p}}\right]\bigg|_{q=a}^b.
\end{align}

\subsection{A general formula for $\displaystyle\int_0^\infty \ud r\, f(r) j_{\ell}(kr)\,j_{\ell'}(qr)$}

Given an analytic function $f(r)$ on $[0,∞)$ we can derive the general formula:
\begin{align}
\int_0^\infty \ud r\, f(r) j_{\ell}(kr)\,j_{\ell'}(qr)%\nonumber\\
&= \sum_{n=0}^\infty \left[-\frac{\partial^2}{\partial k^2}-\frac{2}{k}\frac{\partial}{\partial k}+\frac{\ell(\ell+1)}{k^2}\right]^{n+1}
\nonumber\\ &~~~~~~\times
\left[\frac{f^{(2n)}(0)}{(2n)!}\mathcal{I}^{-2}_{\ell\ell'}(k,q)
\right].\label{djskndksnskdjc}
\end{align}

\section{Integral formulas for $p>0$}
\label{app4}

Here we tabulate the lowest order integrals in terms of elementary functions required for calculating multipoles up to $ℓ=4$, to order $O(x^2)$.

\begin{align}
\mathcal{I}^0_{1,0}(k, q)&=\dfrac{1}{2 q k^{2}}\ln \dfrac{k+q}{|k-q|}+\dfrac{1}{k(k-q)(k+q)}\,, \\
\mathcal{I}^0_{2,0}(k, q)&=\dfrac{3 \pi }{2 k^{3}}\,\Theta(k-q)-\dfrac{\pi }{2 q^{2}}\,\delta(k-q)\,, \\
\mathcal{I}^0_{2,1}(k, q)&=\dfrac{k^{2}+3 q^{2} }{4 k^{3} q^{2}}\ln \dfrac{k+q}{|k-q|}-\dfrac{k^{2}-3 q^{2}}{2 k^{2} q(k-q)(k+q)}\,, \\
\mathcal{I}^0_{3,0}(k, q)&=\dfrac{3\left(k^{2}-5 q^{2}\right)}{4 k^{4} q} \ln \dfrac{k+q}{|k-q|}+\dfrac{13 k^{2}-15 q^{2}}{2 k^{3}(k-q)(k+q)}\,, \\
\mathcal{I}^0_{3,1}(k, q)&=\dfrac{5 \pi q }{2 k^{4}}\,\Theta(k-q)-\dfrac{\pi }{2 q^{2}}\, \delta(k-q)\,, \\
\mathcal{I}^0_{4,3}(k, q)&=\dfrac{5 k^{6}+9 k^{4} q^{2}+15 k^{2} q^{4}+35 q^{6} }{32 k^{5} q^{4}}\ln \dfrac{k+q}{|k-q|}-\dfrac{15 k^{6}+17 k^{4} q^{2}+25 k^{2} q^{4}-105 q^{6}}{48 k^{4} q^{3}(k-q)(k+q)}\,,\\
\mathcal{I}^1_{0,0}(k, q)&=-\dfrac{2}{(k-q)^{2}(k+q)^{2}}\,, \\
\mathcal{I}^1_{1,0}(k, q)&=-\dfrac{\pi }{2 q^{2}}\,\delta'(k-q)\,, \\
\mathcal{I}^1_{1,1}(k, q)&=\dfrac{1}{2 k^{2} q^{2}}\ln \dfrac{k+q}{|k-q|}-\dfrac{k^{2}+q^{2}}{k q(k+q)^{2}(k-q)^{2}}\,, \\
\mathcal{I}^1_{2,0}(k, q)&=\dfrac{3}{2 q k^{3}}\ln \dfrac{k+q}{|k-q|}+\dfrac{5 k^{2}-3 q^{2}}{k^{2}(k-q)^{2}(k+q)^{2}}\,, \\
\mathcal{I}^1_{2,1}(k, q)&=\dfrac{\pi }{2 q^{3}}\,\delta(k-q)-\dfrac{\pi }{2 q^{2}}\,\delta'(k-q)\,, \\
\mathcal{I}^1_{3,0}(k, q)&=\frac{15 \pi }{2 k^{4}}\,\Theta(k-q)
-\frac{5  \pi}{2 q^{3}}\,\delta(k-q)+\frac{\pi }{2 q^{2}}\, \delta'(k-q)
\,,\\
\mathcal{I}^1_{3,1}(k, q)&=\dfrac{3\left(k^{2}+5 q^{2}\right) }{4 k^{4} q^{2}}\ln \dfrac{k+q}{|k-q|}-\dfrac{3 k^{4}-22 k^{2} q^{2}+15 q^{4}}{2 k^{3} q(k-q)^{2}(k+q)^{2}}, \\
\mathcal{I}^1_{3,2}(k, q)&=\dfrac{\pi }{q^{3}}\,\delta(k-q)-\dfrac{\pi }{2 q^{2}}\,\delta'(k-q)\,,\\
\mathcal{I}^1_{3,3}(k, q)&=\dfrac{3\left(5 k^{4}+6 k^{2} q^{2}+5 q^{4}\right)}{16 k^{4} q^{4}}\ln \dfrac{k+q}{|k-q|}
-\dfrac{\left(k^{2}+q^{2}\right)\left(15 k^{4}-22 k^{2} q^{2}+15 q^{4}\right)}{8(k+q)^{2} q^{3} k^{3}(k-q)^{2}}\,, \\
\mathcal{I}^1_{4,0}(k, q)&=\dfrac{15\left(k^{2}-7 q^{2}\right) }{4 k^{5} q}\ln \dfrac{k+q}{|k-q|}+\dfrac{81 k^{4}-190 k^{2} q^{2}+105 q^{4}}{2 k^{4}(k-q)^{2}(k+q)^{2}}, \\
\mathcal{I}^1_{4,1}(k, q)&=\dfrac{35 \pi q }{2 k^{5}}\, \Theta(k-q)-\dfrac{4 \pi }{q^{3}}\,\delta(k-q) +\dfrac{\pi }{2 q^{2}}\,\delta'(k-q)\,, \\
\mathcal{I}^1_{4,2}(k, q)&=\dfrac{3\left(3 k^{4}+10 k^{2} q^{2}+35 q^{4}\right)}{16 q^{3} k^{5}}\ln \dfrac{k+q}{|k-q|}
-\dfrac{9 k^{6}+15 k^{4} q^{2}-145 k^{2} q^{4}+105 q^{6}}{8 k^{4} q^{2}(k-q)^{2}(k+q)^{2}}\,, \\
\mathcal{I}^1_{4,3}(k, q)&=\dfrac{3 \pi }{2 q^{3}}\,\delta(k-q) -\dfrac{\pi }{2 q^{2}}\,\delta'(k-q)\,, \\
\mathcal{I}^1_{4,4}(k, q)&=\dfrac{5\left(k^{2}+q^{2}\right)\left(7 k^{4}+2 k^{2} q^{2}+7 q^{4}\right) }{32 k^{5} q^{5}}\ln \dfrac{k+q}{|k-q|}
\notag\\&
-\dfrac{105 k^{8}-40 k^{6} q^{2}-34 k^{4} q^{4}-40 k^{2} q^{6}+105 q^{8}}{48 q^{4} k^{4}(k-q)^{2}(k+q)^{2}},\\
\mathcal{I}^2_{0,0}(k, q)&=-\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)-\dfrac{ \pi}{q^{3}}\,\delta'(k-q)-\dfrac{\pi }{q^{4}}\,\delta(k-q), \\
\mathcal{I}^2_{1,0}(k, q)&=-\dfrac{8 k}{(k-q)^{3}(k+q)^{3}}, \\
\mathcal{I}^2_{1,1}(k, q)&=-\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)-\dfrac{ \pi}{q^{3}}\,\delta'(k-q), \\
\mathcal{I}^2_{2,0}(k, q)&=\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)-\dfrac{ \pi}{2 q^{3}}\,\delta'(k-q)-\dfrac{\pi }{2 q^{4}}\,\delta(k-q), \\
\mathcal{I}^2_{2,1}(k, q)&=\dfrac{3 }{2 k^{3} q^{2}}\ln \dfrac{k+q}{|k-q|}-\dfrac{\left(3 k^{2}-q^{2}\right)\left(k^{2}+3 q^{2}\right)}{q k^{2}(k-q)^{3}(k+q)^{3}}, \\
\mathcal{I}^2_{2,2}(k, q)&=-\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)-\dfrac{ \pi}{q^{3}}\,\delta'(k-q)+\dfrac{2 \pi }{q^{4}}\,\delta(k-q), \\
\mathcal{I}^2_{3,0}(k, q)&=\dfrac{15 }{2 k^{4} q}\ln \dfrac{k+q}{|k-q|}+\dfrac{33 k^{4}-40 q^{2} k^{2}+15 q^{4}}{k^{3}(k-q)^{3}(k+q)^{3}}, \\
\mathcal{I}^2_{3,1}(k, q)&=\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)-\dfrac{3  \pi}{2 q^{3}}\,\delta'(k-q), \\
\mathcal{I}^2_{3,2}(k, q)&=\dfrac{3\left(3 k^{2}+5 q^{2}\right) }{4 k^{4} q^{3}}\ln \dfrac{k+q}{|k-q|}-\dfrac{9 k^{6}-9 k^{4} q^{2}+31 k^{2} q^{4}-15 q^{6}}{2 k^{3} q^{2}(k-q)^{3}(k+q)^{3}},\\
\mathcal{I}^2_{3,3}(k, q)&=-\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)-\dfrac{ \pi}{q^{3}}\,\delta'(k-q)+\dfrac{5 \pi }{q^{4}}\,\delta(k-q), \\
\mathcal{I}^2_{4,0}(k, q)&=-\dfrac{27 \pi }{2 q^{4}}\,\delta(k-q)+\dfrac{4  \pi}{q^{3}}\,\delta'(k-q)-\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)+\dfrac{105 \pi }{2 k^{5}}\,\Theta(k-q), \\
\mathcal{I}^2_{4,1}(k, q)&=\dfrac{15\left(k^{2}+7 q^{2}\right) }{4 k^{5} q^{2}}\ln \dfrac{k+q}{|k-q|}-\dfrac{15 k^{6}-191 k^{4} q^{2}+265 k^{2} q^{4}-105 q^{6}}{2 q k^{4}(k-q)^{3}(k+q)^{3}}, \\
\mathcal{I}^2_{4,2}(k, q)&=\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)-\dfrac{5  \pi}{2 q^{3}}\,\delta'(k-q)+\dfrac{3 \pi }{2 q^{4}}\,\delta(k-q), \\
\mathcal{I}^2_{4,3}(k, q)&=\dfrac{15\left(3 k^{4}+6 q^{2} k^{2}+7 q^{4}\right)}{16 k^{5} q^{4}}\ln \dfrac{k+q}{|k-q|}
\notag\\&
-\dfrac{45 k^{8}-30 k^{6} q^{2}-36 k^{4} q^{4}+190 k^{2} q^{6}-105 q^{8}}{8 q^{3} k^{4}(k-q)^{3}(k+q)^{3}}, \\
\mathcal{I}^2_{4,4}(k, q)&=-\dfrac{\pi }{2 q^{2}}\,\delta''(k-q)-\dfrac{ \pi}{q^{3}}\,\delta'(k-q)+\dfrac{9 \pi }{q^{4}}\,\delta(k-q).
\end{align}

\newpage

\bibliographystyle{JHEP}
\input{output.bbl}
\end{document}

For the simplest case of equal-redshift auto-correlations, we find the following for the multipoles:
\begin{align}
{\xi_0\over b^2}=&{1\over15}\big(15+10\beta+3 \beta^2\big)\xi^{(0)}_0-{8\over15} \beta^2\big(1-\sin^2\!\theta\big)\sin^2\!\theta\, \xi^{(0)}_0
- {2\over21}\big(7\beta- \beta^2+4\beta^2\sin^2\!\theta\big) \sin^2\!\theta\, \xi^{(0)}_2
\notag\\ &
-{1\over105} \beta^2\big(4-9\sin^2\!\theta\big)\sin^2\!\theta\, \xi^{(0)}_4 +{\pi\over10}\alpha
\big(5\beta- \beta^2+4\beta^2\sin^2\!\theta\big)\sin\theta\,\xi^{(1)}_1
\notag\\ &
\beta^2\big[20-3\pi\big(1+\sin^2\!\theta \big)\big]\sin\theta\,\xi^{(1)}_3\,,
\label{24} \\
{\xi_1\over b^2}=& 0\,,
\label{25}\\
{\xi_2\over b^2}=& -{4\over27}\big(7\beta+3 \beta^2\big)\xi^{(0)}_2 + {8\over27} \big(7\beta+3 \beta^2\big)\sin^2\!\theta\, \xi^{(0)}_2
- {4\over21} \beta^2\sin^2\!\theta\, \xi^{(0)}_4
\notag\\ &
-{\pi\over16}\alpha \big(5\beta-\beta^2+4\beta^2\sin^2\!\theta\big)\sin\theta\, \xi^{(1)}_1
% \notag\\ &
+{1\over48}\alpha\, \beta^2\big[64+3\pi \big(1+\sin^2\!\theta\big)\big]\sin\theta\, \xi^{(1)}_3\,,
\label{26}\\
{\xi_3\over b^2}=& 0\,,
\label{27}\\
{\xi_4\over b^2}=& {8\over35} \beta^2\,\xi^{(0)}_4 -{9\pi\over2560}(\alpha_1+\alpha_2)
\big(5\beta- \beta^2+\beta^2\sin^2\!\theta \big)\sin\theta\,\xi^{(1)}_1
\notag\\ &
\beta^2\big(1+\sin^2\!\theta \big)\sin\theta\,\xi^{(1)}_3\,.
\label{28}
\end{align}


# Something about Inter-universal Teichmuller Theory

Mikael Sarkisyan

###### Abstract

There was a lot of controversy about corollary 3.12, which was described in
the paper Inter-universal Teichmuller Theory III. In this article, another
proof of Corollary 3.12 will be derived, where the basis of the proof will be
the Erdos-Kac theorem. Also in Inter-universal Teichmuller Theory IV it was
said that the theory has a strong connection with the theory of Weil
cohomology, based on this connection, very important physical applications
will be derived in this article: generalization of non-Abelian Hodge
correspondence, non-Abelian gauge theory, proof of the mass gap based on
corollary 3.12, T duality is $\Theta^{\pm ell}$NF Hodge Theater, the limit at
which a black hole appears, the inflationary growth of the universe for the
observer.

##  1 Introduction

There was a lot of controversy about corollary 3.12, which was described in
the paper Inter-universal Teichmuller Theory III. In this article, another
proof of Corollary 3.12 will be derived, where the basis of the proof will be
the Erdos-Kac theorem. Also in Inter-universal Teichmuller Theory IV it was
said that the theory has a strong connection with the theory of Weil
cohomology, based on this connection, very important physical applications
will be derived in this article: generalization of non-Abelian Hodge
correspondence, non-Abelian gauge theory, proof of the mass gap based on
corollary 3.12, T duality is $\Theta^{\pm ell}$NF Hodge Theater, the limit at
which a black hole appears, the inflationary growth of the universe for the
observer. The main tool of this article is additive log shells, which include
the D brane. Further in the article, the role of additive logarithmic shells
for physics will be discussed in more detail.

Warning: Before reading this article, it is recommended that you familiarize
with the Inter-universal Teichmuller Theory.

$\S$ Introduction.

1\. Deninger Program.

2\. Non-Abelian Hodge Correspondence.

$\S$ Corollary 3.12 Proof.

1\. Theorem A.

2\. Theorem B.

3\. Corollary 3.12 Proof.

$\S$ Main Results: Non-Abelian gauge theory and T Duality is $\Theta^{\pm
ell}$NF Hodge Theater.

###  1.1 Deninger Program:

Deninger suggested a program concerning the existence of an ”arithmetic node”
$\mathit{Y}$ associated with the compactification of $\mathbb{Z}$. Among other
properties, this site would be equipped with an action that would be equal to
$\mathbb{R}$, and each prime number p would correspond to a closed orbit
$\mathbb{R}$-an action of length log(p). The Riemann hypothesis would be a
consequence of properties parallel to the positivity of the intersection
pairing in Hodge theory. An analogue of such intersections are Hodge theaters,
which were created in the first article of IUTech[I] and are the main
instrument of the theory. The Riemann hypothesis having a real part equal to
1/2, which is the skeleton of an arithmetic holomorphic structure (Honda-Tate
theory, Remark 3.6.5 IUTech[II]), has a significant role in proving the ABC
Conjecture. Lefschetz’s version of the forumly trace was proved by Deninger.
As a result of the above mentioned, we come to the conclusion that in order to
complete the Deninger program, it is necessary to carry out the evolution of
the Deninger program through Inter-universal formalism. A clear example of
such an evolution is the work of Deninger and Joachim Kunz on Witt vectors,
which sought to represent the ring of Witt vectors in terms of the completion
of the monoidal algebra $\mathbb{Z}$ DenFrd[I]. This work has a similar result
with the theory of Frobenoids Frd[I]. And as a result, we avoid the universal
polynomial approach (Fig. $\S$ 3\. Main Results: Non-Abelian gauge theory and
T Duality is $\Theta^{\pm ell}$NF Hodge Theater). And so with the help of
Corollary 3.12 IUTech[III], we can build a layered space corresponding to the
specification $\mathbb{Z}$.

###  1.2 Non-Abelian Hodge Correspondence:

The basic principle of the non-Abelian Hodge correspondence is that the
correspondence between Higgs bundles and representations of the fundamental
group can be formulated as a kind of non-Abelian Hodge theorem, that is, an
analogy occurs with the Hodge decomposition of a non-Abelian Keller manifold,
but with coefficients in a non-Abelian group $\mathop{GL}(n,\mathbb{C})$,
instead of the abelian group $\mathbb{C}$(cf. Main Results: Non-Abelian gauge
theory and T Duality is $\Theta^{\pm ell}$NF Hodge Theater).

1\. Non-Abelian Hodge theorem:

A representation ${\displaystyle\rho:\pi_{1}(X)\to GL(r,\mathbb{C})}$ of the
fundamental group is semisimple if and only if the flat vector bundle
${\displaystyle E={\hat{X}}\times_{\rho}\mathbb{C}^{r}}$ admits a harmonic
metric. Furthermore the representation is irreducible if and only if the flat
vector bundle is irreducible.

2\. Non-Abelian Hodge theorem:

A Higgs bundle ${\displaystyle(E,\Phi)}$ has a Hermitian Yang–Mills metric if
and only if it is polystable. This metric is a harmonic metric, and therefore
arises from a semisimple representation of the fundamental group, if and only
if the Chern classes ${\displaystyle c_{1}(E)}$ and ${\displaystyle c_{2}(E)}$
vanish. Furthermore, a Higgs bundle is stable if and only if it admits an
irreducible Hermitian Yang–Mills connection, and therefore comes from an
irreducible representation of the fundamental group.

3\. Non-Abelian Hodge theorem:

A Higgs bundle arises from a semisimple representation of the fundamental
group if and only if it is polystable. Furthermore it arises from an
irreducible representation if and only if it is stable.

4\. Non-Abelian Hodge theorem version for module spaces:

There are homeomorphisms ${\displaystyle M_{Dol}^{ss}\cong M_{dR}\cong
M_{B}^{+}}$ of moduli spaces which restrict to homeomorphisms ${\displaystyle
M_{Dol}^{s}\cong M_{dR}^{*}\cong M_{B}^{*}}.$

Based on the theorems above, it can be determined that the non-Abelian Hodge
correspondence will tend to evolve into Inter-universal formalism and as a
result, using Corollary 3.12 IUTech[III], it is possible to arrive at a gap in
the mass. Or we can again come to this conclusion based on the previously
mentioned Deninger program, where Deninger, together with Annette Werner, in a
series of papers on vector bundles on p-adic curves, use the motivation from
the Narasimhan-Seshadri theorem and deduce that a vector bundle on a compact
Riemann surface $\mathit{X}$ is stable if it occurs from the unitary
representation of the fundamental group $\pi_{1}$(X).

In addition, as a result of the above, one can make an analytical consequence
that the mirror symmetry construction will correspond to the construction of
Hodge theatres. The implication of this is that mirror symmetry follows the
way T-duality works, and the previously described change in D-brane dimensions
by +1 or -1 can also be generalized using the $\Theta^{\pm ell}$NF-Hodge
theatre(cf. Main Results: Non-Abelian gauge theory and T Duality is
$\Theta^{\pm ell}$NF-Hodge theatre).

##  2 Corollary 3.12 Proof:

###  2.1 Definition - Theorem A:

(Multiradial Algorithms for Logarithmic Gaussian Procession Monoids).

Fix a collection of initial $\Theta$-data ($\overline{F}$/F, $X_{F}$ , $\ell$,
$\underline{C}_{K}$, $\mathbb{V}$, $\mathbb{V}^{bad}_{mod}$,
$\underline{\epsilon}$) as in [IUTechI], Definition 3.1. Let
{$\mathit{{}^{n,m}HT^{\Theta^{\pm ell}NF}}\\}_{n,m\in\mathbb{Z}}$ be a
collection of distinct $\Theta$-Hodge theaters [relative to the given initial
$\Theta$-data] — which we think of as arising from a LGP Gaussian log-theta-
lattice [cf. IUTech[III] Definition 3.8, (iii)]. For each n $\in$
$\mathbb{Z}$, write {$\mathit{{}^{n,\circ}HT^{D-\Theta^{\pm ell}NF}}$} for the
D-${\Theta^{\pm ell}}$NF-Hodge theater determined, up to isomorphism, by the
various $\mathit{{}^{n,m}HT^{\Theta^{\pm ell}NF}}$, where m $\in$
$\mathbb{Z}$, via the vertical coricity of IUTech[III] Theorem 1.5, (i) [cf.
Remark 3.8.2].

(i) (Multiradial Representation) Write ${}^{n,\circ}\mathfrak{R}_{LGP}$ for
the collection of data consisting of

(a) tensor packets of log-shells;

(b) splitting monoids of LGP-monoids acting on the tensor packets of (a);

(c) copies, labeled by j $\in$ $\mathbb{F}^{*}_{\ell}$, of [the multiplicative
monoid of nonzero elements of ] the number field $F_{mod}$ acting on the
tensor packets of (a) [cf. IUTech[III] Theorem 3.11, (i), (a), (b), (c), for
more details] regarded up to indeterminacies of the following two types:

(Ind1) the indeterminacies induced by the automorphisms of the procession of
$\mathit{D}$-prime-strips $\mathop{Prc}(^{n,\circ}D_{T})$ that gives rise to
the tensor packets of (a);

(Ind2) the [“non-(Ind1) portion” of the] indeterminacies that arise from the
automorphisms of the $\mathit{F}^{\vdash\times\mu}$-prime-strips that appear
in the $\Theta^{\times\mu}$ LGP-link, i.e., in particular, at [for simplicity]
$\mathit{v}$ $\in$ $\mathbb{V}^{non}$, the multiplicative $\mathbb{Z}$
divisors-indeterminacies acting on local copies of “$\mathcal{O}^{\times\mu}$”
— cf. IUTech[III] Theorem 3.11, (i), for more details. Then
${}^{n,\circ}\mathfrak{R}_{LGP}$ may be constructed via an algorithm in the
procession of $\mathit{D}$-prime-strips $\mathop{Prc}(^{n,\circ}D_{T})$, which
is functorial with respect to isomorphisms of processions of
$\mathit{D}$-prime-strips. For n, $n^{{}^{\prime}}$ $\in$ $\mathbb{Z}$, the
permutation symmetries of the etale-picture discussed in IUTech[I], Corollary
6.10, (iii); IUTech[II], Corollary 4.11, (ii), (iii) [cf. also Corollary 2.3,
(ii); Remarks 2.3.2 and 3.8.2, of the IUTech[III]], induce compatible
polyisomorphisms:

$\mathop{Prc}(^{n,\circ}\mathit{D}_{T})$ $\tilde{\rightarrow}$
$\mathop{Prc}(^{n,\circ}D_{T})$; ${}^{n,\circ}\mathfrak{R}_{LGP}$
$\tilde{\rightarrow}$ ${}^{n^{{}^{\prime}},\circ}\mathfrak{R}_{LGP}$

which are, moreover, compatible with the bi-coricity poly-isomorphisms

of Theorem 1.5, (iii) [cf. also [IUTechII], Corollaries 4.10, (iv); 4.11,
(i)].

(ii) ($\mathfrak{log}$-$\mathbf{KummerCorrespondence)}$ For n, m $\in$
$\mathbb{Z}$, the inverses of the Kummer isomorphisms associated to the
various F-prime-strips and NF bridges that appear in the $\Theta^{\pm
ell}NF$-Hodge theater $\mathit{{}^{n,m}HT^{\Theta^{\pm ell}NF}}$ induce
“inverse Kummer” isomorphisms between the vertically coric data (a), (b), (c)
of (i) and the corresponding Frobenioid-theoretic data arising from each
$\Theta^{\pm ell}$NF Hodge theater ${{}^{n,m}HT^{\Theta^{\pm ell}NF}}$ [cf.
IUTech[III] Theorem 3.11, (ii), (a), (b), (c), for more details]. Moreover, as
one varies m $\in$ $\mathbb{Z}$, the corresponding Kummer isomorphisms [i.e.,
inverses of “inverse Kummer” isomorphisms] of splitting monoids of LGP-monoids
[cf. (i), (b)] and labeled copies of the number field $F_{mod}$ [cf. (i), (c)]
are mutually compatible, relative to the $\mathfrak{log}$-links of the n-th
column of the LGP-Gaussian log-theta-lattice under consideration, in the sense
that the only portions of the [Frobenioid-theoretic] domains of these Kummer
isomorphisms that are possibly related to one another via the
$\mathfrak{log}$-links consist of roots of unity in the domains of the
$\mathfrak{log}$-links [multiplication by which corresponds, via the
$\mathfrak{log}$-link, to an “addition by zero” indeterminacy, i.e., to no
indeterminacy!] — cf. IUTech[III] Proposition 3.5, (ii), (c); Proposition
3.10, (ii); Theorem 3.11, (ii), for more details. On the other hand, the
Kummer isomorphisms of tensor packets of log-shells [cf. (i), (a)] are subject
to a certain “indeterminacy” as follows:

(Ind3) as one varies m $\in$ $\mathbb{Z}$, these Kummer isomorphisms of tensor
packets of log-shells are “upper semi-compatible”, relative to the
$\mathfrak{log}$-links of the n-th column of the LGP-Gaussian log-theta-
lattice under consideration, in a sense that involves certain natural
inclusions “$\subseteq$” at $\mathit{v}_{\mathbb{Q}}$ $\in$
$\mathbb{V}^{non}_{\mathbb{Q}}$ and certain natural surjections
“$\twoheadrightarrow$” at $\mathit{v}_{\mathbb{Q}}$ $\in$
$\mathbb{V}^{arc}_{\mathbb{Q}}$ — cf. Proposition 3.5, (ii), (a), (b); Theorem
3.11, (ii), for more details. Finally, as one varies m $\in$ $\mathbb{Z}$,
these Kummer isomorphisms of tensor packets of log-shells are [precisely!]
compatible, relative to the $\mathfrak{log}$-links of the n-th column of the
LGP-Gaussian log-theta lattice under consideration, with the respective log-
volumes [cf. Proposition 3.9, (iv)].

(iii) ($\Theta^{\times\mu}$ LGP-Link Compatibility) The various Kummer
isomorphisms of (ii) satisfy compatibility properties with the various
horizontal arrows - i.e., $\Theta^{\times\mu}$ LGP links - of the LGP-Gaussian
log-theta-lattice under consideration as follows: The tensor packets of log-
shells [cf. (i), (a)] are compatible, relative to the relevant Kummer
isomorphisms, with [the unit group portion “$(-)^{\times\mu}$” of ] the
$\Theta^{\times\mu}$ LGP-link [cf. the indeterminacy “(Ind2)” of (i)]; we
refer to Theorem 3.11 IUTech[III], (iii), (a), (b), for more details. The
identity automorphism on the objects that appear in the construction of the
splitting monoids of LGP-monoids via mono-theta environments [cf. (i), (b)] is
compatible, relative to the relevant Kummer isomorphisms and isomorphisms of
mono-theta environments, with the $\Theta^{\times\mu}$ LGP-link [cf. the
indeterminacy “(Ind2)” of (i)]; we refer to Theorem 3.11 IUTech[III], (iii),
(c), for more details. The identity automorphism on the objects that appear in
the construction of the labeled copies of the number field $F_{mod}$ [cf. (i),
(c)] is compatible, relative to the relevant Kummer isomorphisms and
cyclotomic rigidity isomorphisms [cf. the discussion of Remark 2.3.2; the
constructions of IUTech[I], Example 5.1, (v)], with the $\Theta^{\times\mu}$
LGP-link [cf. the indeterminacy “(Ind2)” of (i)]; we refer to Theorem 3.11
IUTech[III], (iii), (d), for more details.

###  2.2 Definition - Theorem B:

(Log-volume Estimates for Multiradially Represented Splitting Monoids of
Logarithmic

Gaussian Procession Monoids).

Suppose that we are in the situation of Theorem A. Write -
$|$log($\underline{\underline{\Theta}}$)$|$ $\in$ $\mathbb{R}$ $\cup$
{+$\infty$} for the procession-normalized mono-analytic log-volume [where the
average is taken over j $\in$ $\mathbb{F}_{l}$ — cf.IUTech[III] Remark 3.1.1,
(ii), (iii), (iv); Proposition 3.9,(i), (ii); Theorem 3.11, (i), (a), for more
details] of the holomorphic hull [cf. IUTech[III] Remark 3.9.5, (i)] of the
union of the possible images of a $\Theta$-pilot object [cf. Definition 3.8,
(i)], relative to the relevant Kummer isomorphisms [cf. IUTech[III] Theorems
A, (ii); 3.11, (ii)], in the multiradial representation of Theorems A, (i);
3.11, (i), which we regard as subject to the indeterminacies (Ind1), (Ind2),
(Ind3) described in Theorems A, (i), (ii); 3.11, (i), (ii). Write
-$|$log($\underline{\underline{q}}$)$|$ $\in$ $\mathbb{R}$ for the procession-
normalized mono-analytic log-volume of the image of a q-pilot object [cf.
IUTech[III] Definition 3.8, (i)], relative to the relevant Kummer isomorphisms
[cf. IUTech[III] Theorems A, (ii); 3.11, (ii)], in the multiradial
representation of Theorems A, (i); 3.11, (i), which we do not regard as
subject to the indeterminacies (Ind1), (Ind2), (Ind3) described in Theorems A,
(i), (ii); 3.11, (i), (ii). Here, we recall the definition of the symbol
“$\Delta$” as the result of identifying the labels ”0” and
”$\langle\mathbb{F}^{*}_{\ell}\rangle$” [cf. [IUTechII], Corollary 4.10, (i)].
In particular, $|$log($\underline{\underline{q}}$)$|$ $\mathit{>}$ 0 is easily
computed in terms of the various q-parameters of the elliptic curve $E_{F}$
[cf. [IUTechI], Definition 3.1, (b)] at $\underline{\mathit{v}}$ $\in$
$\underline{\mathbb{V}}^{bad}$ ($\neq$ $\varnothing$). Then it holds that
-$|$log($\underline{\underline{\Theta}}$)$|$ $\in$ $\mathbb{R}$, and -
$|$log($\underline{\underline{\Theta}}$)$|$ $\geq$
-$|$log($\underline{\underline{q}}$)$|$ \- i.e., $C_{\Theta}$ $\geq$ -1 for
any real number $C_{\Theta}$ $\in$ $\mathbb{R}$ such that - $|$
log($\underline{\underline{\Theta}}$)$|$ $\leq$
$C_{\underline{\underline{\Theta}}}$ $\cdot$
$|$log($\underline{\underline{q}}$)$|$.

###  2.3 Corollary 3.12 Proof:

[HarRam]The Hardy-Ramanujan Theorem:

The Hardy-Ramanujan theorem states that the growth rate of distinct prime
divisors of n, the definition of the logarithm formula
${\displaystyle\log(\log(n))}$, and the spread in the number of direct
divisors is the square root of that function
${\displaystyle\sqrt{\log(\log(n))}}$.

Theorem: Let a real function f(n) be such that
${\displaystyle\lim_{n\to\infty}f(n)=\infty}$, let g(x) is the number of
natural numbers ${\displaystyle n<x}$ for which
${\displaystyle|\omega(n)-\log(\log(n))|<f(n){\sqrt{\log(\log(n))}}}$.

When ${\displaystyle\lim_{x\to\infty}{\frac{g(x)}{x}}=1}$

Now we need to generalize the Hardy-Ramanujan theorem to the normal
distribution based on the Erdos-Kac theorem.

[ErdKac]The Erdos-Kac theorem:

In the original proof of the Erdos-Kac theorem, the statement about the
normality of the distribution in the first lemma of the theorem is based on
the fact that the function $\omega(n)$ is additive and can be represented as a
sum of prime divisibility exponents. Further, without introducing the concept
of a random variable, the authors argue that the terms of the indicator are
independent. And without going into details, the authors refer to a source
where the normality of the distribution of sums of weakly dependent random
variables is proved.

Kac’s Heuristic:

If n is a randomly chosen large integer, then the number of distinct prime
factors of n is approximately normally distributed with mean and variance
log(log(n)). This comes from the fact that given a random natural number n,
the events ”the number n is divisible by some prime p” for each p are mutually
independent.

Now, denoting the event ”the number n is divisible by p” by $n_{{p}}$,
consider the following sum of indicator random variables:
$I_{{n_{{2}}}}+I_{{n_{{3}}}}+I_{{n_{{5}}}}+I_{{n_{{7}}}}+$$\ldots$

This sum counts how many distinct prime factors our random natural number n
has. It can be shown that this sum satisfies the Lindeberg condition, and
therefore the Lindeberg central limit theorem guarantees that after
appropriate rescaling, the above expression will be Gaussian(cf. Theorem B).

And we come from here to the exact statement of the theorem:

If f(n) is a strongly additive function $\scriptstyle f(p_{1}^{{a_{1}}}\cdots
p_{k}^{{a_{k}}})=f(p_{1})+\cdots+f(p_{k}))$ with $\scriptstyle|f(p)|\leq 1$
for all prime p, then
${\displaystyle\lim_{x\rightarrow\infty}\left({\frac{1}{x}}\cdot\\#\left\\{n\leq
x:a\leq{\frac{f(n)-A(n)}{B(n)}}\leq b\right\\}\right)=\Phi(a,b)}$

$A(n)=\sum_{{p\leq n}}{\frac{f(p)}{p}},\qquad B(n)={\sqrt{\sum_{{p\leq
n}}{\frac{f(p)^{2}}{p}}}},\qquad{\displaystyle\Phi(a,b)={\frac{1}{\sqrt{2\pi}}}\int_{a}^{b}e^{-t^{2}/2}\,dt.}$

It follows from these theorems that the local logarithmic hull has gluing
schemes of weight ”-1” and this is more clearly shown in the Erdos-Kac
theorem, since it is described in terms of additive logarithmic hulls, and the
description of the consequence by Lindenberg’s central limit theorem can be
more intuitive instead of Theorem B
$|$log($\underline{\underline{\Theta}}$)$|$ $\in$ $\mathbb{R}$ $\cup$
{+$\infty$}. And the isomorphism of Hodge theaters is proved using the Tate
isogeny theorem[Tate[I]], since we are talking about Tate modules expressed as
Galois representations. And with the help of the Honda-Tate theorem(cf.
[Tate[II]]), which says that the isogeny classes of simple Abelian varieties
over a finite field of order q correspond to algebraic integers, all
conjugations given by the eigenvalues of the Frobenius endomorphism have an
absolute value of $\sqrt{q}$ generalizes IUTech[IV] Remark 2.2.2. and also
outputs to us that $\sqrt{q}$ is the skeleton of our arithmetic holomorphic
structure(cf. Remark 3.6.5. IUTech[IV]).
$\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\blacksquare$

##  3 Main Results: Non-Abelian gauge theory and T Duality is $\Theta^{\pm
ell}$NF Hodge Theater

Mirror Symmetry Conjecture: For a Calabi-Yau manifold X there should exist a
mirror Calabi-Yau manifold ${\displaystyle X^{\vee}}$ such that there exists a
mirror isomorphism ${\displaystyle H^{1}(X,\Omega_{X})\cong
H^{1}(X^{\vee},T_{X^{\vee}})}$ giving the compatibility of the associated
A-model and B-model. This means given ${\displaystyle H\in
H^{1}(X,\Omega_{X})}$ and ${\displaystyle\theta\in
H^{1}(X^{\vee},T_{X^{\vee}})}$ such that ${\displaystyle H\mapsto\theta}$
under the mirror map, there is the equality of correlation functions
${\displaystyle\langle H,H,H\rangle=\langle\theta,\theta,\theta\rangle}$ This
is significant because it relates the number of degree ${\displaystyle 0}$
curves on a quintic threefold ${\displaystyle\mathbb{P}^{4}}$ (so
${\displaystyle H^{1,1}\cong\mathbb{Z}}$) to integrals in a variation of Hodge
structures.

A model of representation of mirror symmetry through Frobenoids(cf. Fig. I.1
IUTech[IV]).

Non-Abelian gauge theory considers non-commutative symmetry groups. A striking
example of such a theory is the Yang-Mills theory, which we consider in this
article. Since the symmetry groups are non-commutative, we define them as
$\mathbb{F}^{\rtimes\mu}_{\ell}$ (based on the non-Abelian Hodge
correspondence, where we have a semisimple representation, and we also know
that this symmetry group is additive (see IUTech[II] note 4.11.3)), and the
entire symmetry group, as a multiplicative representation, will be defined as
$\mathbb{F}^{*}_{\ell}$, which begins at the point {0} (cf. Fig. $\S$2.3,
Corollary 3.12, proof), and now from this we can conclude that from Theorem
3.11 IUTech [III], where we have different Hodge theaters, but with the same
specific data $\Theta$ will give us another Calabi-Yau manifold, but with the
same physics, and as a result will create T duality, which is the basic
construction of the theory of mirror symmetry. It follows that $\Theta^{\pm
ell}$NF The Hodge Theater is a T-duality. This also implies the proof of the
corollaries described in the introduction.
$\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\quad\qquad\qquad\qquad\qquad\qquad\qquad\blacksquare$

Based on the theory of Weil cohomology, we can say that the universe appeared
when the gravitational energy of the vacuum acquired a weight that was equal
to ”+1”.Hence therefore the inflationary growth of the universe for the
observer. Then based on this, the gravitational energy inside the universe
must have negative gravitational energy weight.

From here we can also deduce the limit at which a black hole appears. If
($\mathit{v}$ $\in$ $\mathbb{V}(F)^{non}$) $\mapsto$ $log(q_{\mathit{v}})$ the
”global” mirror symmetry of the additive logarithmic shell, and when
($\mathit{v}$ $\in$ $\mathbb{V}(F)^{non}$) $\mapsto$ $1$ then it is violated
based on the fact that we have space inside the Universe , then the weight of
the gravitational energy will be ”-1” and will apply to the entire additive
logarithmic shell (cf. Definition 1.9 IUTech[IV], Introduction Corollary non-
Abelian Hodge Correspondence). Hence the conclusion that the limit of the
appearance of a black hole depends on the state of the vacuum. In the case of
the appearance of black holes, the reduction of the additive logarithmic shell
will create virtual particles, this process is the process of Hawking
radiation(cf. Theorem A IUTT[IV]).

The expansion of the universe directly depends on dark energy, which explains
the observed expansion. Based on Proposition 2.1(i), (ii) IUTech[IV], additive
logarithmic shells are defined as:

Let there be a real number $\xi_{prm}$ $\geq$ 5 such that: $\frac{2}{3}*x$
$\leq$ $\theta(x)$$:=$ $\sum_{p\leq x}$ log(p) $\leq$ $\frac{4}{3}*x.$

Where the sum ranges over the prime numbers p such that p $\leq$ x — for all
($\mathbb{R}$ $\in$) $\geq$ $\xi_{prm}$. In particular, if A is a finite set
of prime numbers, and we write $\theta_{\mathit{A}}$ $:=$ $\sum_{p\leq
x}$log(p) [where we take the sum to be 0 if $\mathit{A}$ = $\varnothing$],
then there exists a prime number p $\in$ $\mathit{A}$ such that p $\leq$
2($\theta_{\mathit{A}}$ \+ $\xi_{prm}$)(cf. IUTech[IV] Proposition
2.1,(i),(ii)).

The result is consistent with the experimental conclusions that were
established in the paper: ”Pantheon+ Analysis: Cosmological
Constraints”[UnivExt]. Where it was found that the ratio of dark energy to
dark matter is: 66.2% dark energy and 33.8% dark matter. From here we also
obtain experimental confirmation of our theory.

Acknowledgments: I would like to thank M.V. Heneralov and D. G. Shepelskii for
discussions and for help in publishing this article.

References

[GenEll] Mochizuki, S., Arithmetic elliptic curves in general position, Math.
J. Okayama Univ., 52 (2010), 1–28.

[HarRam] Hardy, G. H.; Ramanujan, S. (1917), ”The normal number of prime
factors of a number n”, Quarterly Journal of Mathematics, 48: 76–92, JFM
46.0262.03

[ErdKac] Erdos, Paul; Kac, Mark (1940). ”The Gaussian Law of Errors in the
Theory of Additive Number Theoretic Functions”. American Journal of
Mathematics. 62 (1/4): 738–742. doi:10.2307/2371483. ISSN 0002-9327. JSTOR
2371483. Zbl 0024.10203.

[Frd[I]] Mochizuki, S., The Geometry of Frobenioids I: The General Theory.

[Frd[II]] Mochizuki, S., The Geometry of Frobenioids II: Poly-Frobenioids.

[Abs[III]] Mochizuki, S., Topics in Absolute Anabelian Geometry III: Global
Reconstruction Algorithms.

[IUTech[I]] Mochizuki, S., Inter-universal Teichmuller Theory I: Construction
of Hodge Theaters

[IUTech[II]] Mochizuki, S., Inter-universal Teichmuller Theory II: Hodge-
Arakelov-theoretic Evaluation.

[IUTech[III]] Mochizuki, S., Inter-universal Teichmuller Theory III: Canonical
Splittings of the Log-theta-lattice.

[IUTech[IV]] Mochizuki, S., Inter-universal Teichmuller Theory IV: Log-volume
Computations and Set-theoretic Foundations.

[Honda]Honda, Taira (1968), ”Isogeny classes of abelian varieties over finite
fields”, Journal of the Mathematical Society of Japan, 20 (1–2): 83–95,
doi:10.2969/jmsj/02010083, ISSN 0025-5645, MR 0229642

[Tate[I]]Tate, John (1966), ”Endomorphisms of abelian varieties over finite
fields”, Inventiones Mathematicae, 2 (2): 134–144, Bibcode:1966InMat…2..134T,
doi:10.1007/BF01404549, ISSN 0020-9910, MR 0206004, S2CID 245902

[Tate[II]]Tate, John (1971), ”Classes d’isogénie des variétés abéliennes sur
un corps fini (d’après T. Honda)”, Séminaire Bourbaki vol. 1968/69 Exposés
347-363, Lecture Notes in Mathematics, vol. 179, Springer Berlin / Heidelberg,
pp. 95–110, doi:10.1007/BFb0058807, ISBN 978-3-540-05356-9

[DenAnn] Deninger, Christopher; Werner, Annette (2005), ”Vector bundles on
p-adic curves and parallel transport”, Annales Scientifiques de l’École
Normale Supérieure, Quatrième Série, 38 (4): 553–597,
doi:10.1016/j.ansens.2005.05.002, MR 2172951, S2CID 8884837

[WittFrd[I]] Cuntz, Joachim; Deninger, Christopher (2015), ”Witt vector rings
and the relative de Rham Witt complex”, Journal of Algebra, 440: 545–593,
arXiv:1410.5249, doi:10.1016/j.jalgebra.2015.05.029, MR 3373405, S2CID
119171724

[WittFrd[II]] Cuntz, Joachim; Deninger, Christopher (2014), ”An alternative to
Witt vectors”, Münster Journal of Mathematics, 7 (1): 105–114,
arXiv:1311.2774, Bibcode:2013arXiv1311.2774C,
doi:10.1080/18756891.2013.858905, MR 3271241

[NarSesh] Narasimhan, M. S.; Seshadri, C. S. (1965). ”Stable and unitary
vector bundles on a compact Riemann surface”. Annals of Mathematics. 82 (3):
540–567. doi:10.2307/1970710. JSTOR 1970710. MR 0184252.

[DonSim[NS]] Donaldson, Simon K. (1983), ”A new proof of a theorem of
Narasimhan and Seshadri”, Journal of Differential Geometry, 18 (2): 269–277,
doi:10.4310/jdg/1214437664, MR 0710055

[DonSim[YM]] Donaldson, Simon K. (1985). ”Anti self-dual Yang-Mills
connections over complex algebraic surfaces and stable vector bundle”.
Proceedings of the London Mathematical Society. 3. 50 (1): 1–26.
doi:10.1112/plms/s3-50.1.1. MR 0765366.

[UlYau[HYM]] Uhlenbeck, Karen; Yau, Shing-Tung (1986), ”On the existence of
Hermitian–Yang–Mills connections in stable vector bundles”, Communications on
Pure and Applied Mathematics, 39: S257–S293, doi:10.1002/cpa.3160390714, ISSN
0010-3640, MR 0861491

[Hitchin] Hitchin, Nigel J. (1987). ”The self-duality equations on a Riemann
surface”. Proceedings of the London Mathematical Society. 55 (1): 59–126.
doi:10.1112/plms/s3-55.1.59. MR 0887284.

[DonSim] Donaldson, Simon K. (1987). ”Twisted harmonic maps and the self-
duality equations”. Proceedings of the London Mathematical Society. 55 (1):
127–131. doi:10.1112/plms/s3-55.1.127. MR 0887285.

[SimpsonNonHodge] Simpson, Carlos T. (1991), ”Nonabelian Hodge theory”,
Proceedings of the International Congress of Mathematicians (Kyoto, 1990)
(PDF), vol. 1, Tokyo: Math. Soc. Japan, pp. 747–756, MR 1159261

[SimpsonHiggs] Simpson, Carlos T. (1992). ”Higgs bundles and local systems”.
Publications Mathématiques de l’IHÉS. 75: 5–95. doi:10.1007/BF02699491. MR
1179076. S2CID 56417181.

[Corlette] Corlette, Kevin (1988). ”Flat G-bundles with canonical metrics”.
Journal of Differential Geometry. 28 (3): 361–382. doi:10.4310/jdg/1214442469.
MR 0965220.

[GolXia] Goldman, William M.; Xia, Eugene Z. (2008). ”Rank one Higgs bundles
and representations of fundamental groups of Riemann surfaces”. Memoirs of the
American Mathematical Society. 193 (904): viii+69 pp. arXiv:math/0402429.
doi:10.1090/memo/0904. ISSN 0065-9266. MR 2400111. S2CID 2865489.

[MirGaug] Intriligator, Kenneth; Seiberg, Nathan (1996). ”Mirror symmetry in
three-dimensional gauge theories”. Physics Letters B. 387 (3): 513–519.
arXiv:hep-th/9607207. Bibcode:1996PhLB..387..513I.
doi:10.1016/0370-2693(96)01088-X. S2CID 13985843.

[UnivExt] Dillon Brout, Dan Scolnic, Brodie Popovic, Adam G. Riess, Joe Zuntz,
Rick Kessler, Anthony Carr, Tamara M. Davis, Samuel Hinton, David Jones, W.
D’Arcy Kenworthy, Erik R. Peterson, Khaled Said, Georgie Taylor, Noor Ali,
Patrick Armstrong, Pranav Charvu, Arianna Dwomoh, Antonella Palmese, Helen Qu,
Benjamin M. Rose, Christopher W. Stubbs, Maria Vincenzi, Charlotte M. Wood,
Peter J. Brown, Rebecca Chen, Ken Chambers, David A. Coulter, Mi Dai, Georgios
Dimitriadis, Alexei V. Filippenko, Ryan J. Foley, Saurabh W. Jha, Lisa Kelsey,
Robert P. Kirshner, Anais Möller, Jessie Muir, Seshadri Nadathur, Yen-Chen
Pan, Armin Rest, Cesar Rojas-Bravo, Masao Sako, Matthew R. Siebert, Mat Smith,
Benjamin E. Stahl, Phil Wiseman ”The Pantheon+ Analysis: Cosmological
Constraints” https://doi.org/10.48550/arXiv.2202.04077.

Mikael Sarkisyan

Email address<EMAIL_ADDRESS>