Shrinks reconstruction factors and modulus growth in threshold FHE over cyclotomic rings, with implementations that scale.
1 comment
Threshold FHE is one of those places where the old secret-sharing picture stops being enough, because you are not just splitting a key among parties, you are trying to make decryption and bootstrapping cooperate without the noise and modulus spiraling out of control. A lot of earlier threshold work ended up with fairly chunky reconstruction factors or extra CRT-ish machinery just to keep the algebra manageable.
Shamir is a very natural starting point, but over cyclotomic rings the details get touchy fast. If they really reduced the growth in the reconstruction modulus and still have code that scales, that is the sort of thing that makes threshold deployments feel less like a demo and more like a primitive someone might actually build on.