The bootstrapping technique, using the arithmetic circuit of the decryption algorithm presented in BV11, is questionable. The authors say, “Checking if the result is in Z_p can be done with depth O(log(k) + log log (p)) arithmetic circuit." However, they didn't provide any construction of that arithmetic circuit. I have searched many works of literature but have found no clue. How can we do a homomorphic module operation given a ciphertext of an integer and a modulus p? Where p is given in plaintext.
Another thing I didn't get is that they claim (without any construction) that outputting the least significant bit is still manageable. But I still can't see how. Note that the inner product is in Z_p (if the previous question holds) in the ciphertext. So, how is this process done homomorphically?
If any of the above two questions is not true, then the bootstrapping results given in Lemma 4.6 also do not hold! And thus, their arithmetic bootstrapping fails!
Reference: [BV11] Zvika Brakerski and Vinod Vaikuntanathan Efficient Fully Homomorphic Encryption from (Standard) LWE,page 27. [BV11]: https://eprint.iacr.org/2011/344.pdf
