How the FHE encrypts a k-bit message just with one-bit encryption scheme?

Question

I'm reading "Fully Homomorphic Encryption over the Integers"——the first generation of FHE. However, this paper seems to detail a scheme to encrypt each bit in a message. I'm very confused about how to implement homomorphic encryption of the whole k-bits message. More specifically,

if I want to achieve homomorphic addition of ciphertexts, such as encryption(3)+encrpytion(3)=encrpytion(6), just using the one-bit FHE scheme seems insufficient.

My question is there any approach to implement that likes the function of carry bits. Or homomorphic encryption of boolean functions, which is capable of extending one-bit homomorphic arithmetic operations to k-bit homomorphic arithmetic operations.

Any references or answers will be much appreciated!

Answer 1

One-bit FHE schemes, as you call them, are actually sufficient to implement a full adder.

You just have to encrypt each bit of the messages, then use the homomorphic logic gates to execute the circuit that you want.

For instance, if you have 2-bit messages $a = (a_0, a_1)$ and $b = (b_0, b_1)$, just encrypt the four bits, obtaining $c_{a, i}$ and $c_{b, i}$ (for $i = 1, 2$), use the homomorphic logic xor gate to add two bits and logical and gate to obtain the carry, that is, representing XOR by + and AND by $\cdot$, we have

First bit of the result: $r_0 := c_{a,0} + c_{b,0}$ (thus, $r_0 $ encrypts $a_0$ XOR $b_0$)

First carry: $c_0 := c_{a,0} \cdot c_{b,0}$

Then, second bit of the result: $r_1 := c_{a,1} + c_{b,1} + c_0$.

Second carry: $c_1 := (c_{a,1} \cdot c_{b,1}) + (c_{a,1} \cdot c_0) + (c_{b,1} \cdot c_0)$

Third bit of the result: $r_2 := c_1$ (just use the last carry as the most-significant bit)

Therefore, the resulting message is $(r_0, r_1, r_2)$.

You may want to check the TFHE project. They implement several circuits homomorphically (in particular, in the tutorial that link, you can run a circuit that computes the maximum of two values).