---
title: 'BFV: Brakerski-Fan-Vercauteren Homomorphic Encryption'
url: https://www.emergentmind.com/topics/brakerski-fan-vercauteren-bfv
type: topic
---

# BFV: Brakerski-Fan-Vercauteren Homomorphic Encryption

Brakerski–Fan–Vercauteren (BFV) is a ring-LWE based leveled fully homomorphic encryption scheme that supports exact integer arithmetic modulo a plaintext modulus \(t\). In BFV, plaintexts live in a polynomial ring \(R_t\), ciphertexts live in a larger ring \(R_q\), and encryption embeds plaintexts through a scaling factor \(\Delta = \lfloor q/t \rfloor\), so that additions and multiplications can be evaluated on ciphertexts while decryption recovers the corresponding result modulo \(t\) if the accumulated noise remains below a correctness threshold [2503.05136]. Within the FV-like family, BFV is closely related to BGV and contrasts with CKKS in that BFV targets exact modular arithmetic rather than approximate real/complex arithmetic; this exactness is the property repeatedly exploited in applications such as decentralized learning, vehicular aggregation, privacy-preserving neural inference, and federated model summation [2503.05136].

## 1. Scheme family, scope, and computational model

BFV belongs to the “FV-like” family of schemes and operates over cyclotomic polynomial rings, typically in the power-of-two setting \(f(X)=X^n+1\). The base ring is \(R=\mathbb{Z}[X]/(X^n+1)\); the ciphertext ring is \(R_q=\mathbb{Z}_q[X]/(X^n+1)\); and the plaintext ring is \(R_t=\mathbb{Z}_t[X]/(X^n+1)\). Security reduces to the hardness of Ring Learning With Errors (RLWE), with small secrets and small error polynomials masking the scaled plaintext in the ciphertext domain [2503.05136].

The defining semantic feature of BFV is exact modular arithmetic on plaintexts. Rather than representing approximate real values as in CKKS, BFV computes exactly modulo \(t\). The cited studies repeatedly exploit this property for integer-valued or fixed-point workloads. In decentralized deep learning, BFV is used to preserve “lossless precision” for integer or fixed-point gradients [2207.04604]. In vehicular communication, BFV is used for encrypted vehicle counting and other addition-only integer aggregates [2508.02461]. In privacy-preserving spiking neural networks, BFV is selected because it “provides exact modular-integer arithmetic,” matching spike-based computation with binary or low-precision integer activations [2308.05636].

The relationship to nearby schemes is also explicit. BFV and BGV both provide exact arithmetic modulo \(t\), but differ in noise management and modulus-switching style; CKKS provides approximate arithmetic and is suited to workloads where real-valued operations and rescaling dominate; TFHE targets gate-level computation with very fast bootstrapping for Boolean circuits [2503.05136]. A recurrent practical conclusion is therefore workload-dependent rather than absolute: BFV is a natural fit for exact counting, integer aggregation, thresholding-compatible pipelines, and quantized model updates, whereas approximate linear algebra or large dynamic range can favor CKKS [2207.04604].

## 2. Algebraic setting and canonical algorithms

In the power-of-two formulation used throughout the cited literature, BFV takes \(N=2^b\) or \(n=2^k\) and works modulo \(X^N+1\) or \(X^n+1\). The plaintext is lifted from \(R_t\) to \(R_q\) by the scale
\[
\Delta = \left\lfloor \frac{q}{t} \right\rfloor.
\]
An encoded plaintext \(m \in R_t\) is represented in ciphertext arithmetic as \(\Delta \cdot m \in R_q\), and decryption rescales by \(t/q\) and rounds [2207.04604].

The standard public-key form samples a small secret \(s\), a uniform \(a \leftarrow R_q\), and a small error \(e\), then sets a public key as either \(pk=(a,b=-a s + e)\) or, in another equivalent sign convention used in the cited systems literature, \(pk=(a,b=a s + e)\) with a correspondingly negated second ciphertext component [2207.04604] [2509.23091]. With the conventional two-component encryption formula, fresh small randomness \(u,e_1,e_2\) yields
\[
c_0 = b u + e_1 + \Delta m,\qquad c_1 = a u + e_2.
\]
Decryption computes
\[
m = \operatorname{round}\!\left(\frac{t}{q}(c_0 + c_1 s)\right)\bmod t,
\]
or an equivalent sign-adjusted variant, and succeeds when the total decryption noise satisfies the standard BFV bound
\[
\|E\|_\infty < \frac{q}{2t}.
\]
This exact recovery condition is central: the ciphertext carries \(\Delta m\) plus RLWE noise, and the scaling-and-rounding step cancels the noise if the bound is respected [2207.04604].

Homomorphic addition is component-wise:
\[
(c_0,c_1)+(d_0,d_1)=(c_0+d_0,\;c_1+d_1).
\]
Homomorphic multiplication first produces a three-component ciphertext,
\[
e_0=c_0 d_0,\qquad e_1=c_0 d_1 + c_1 d_0,\qquad e_2=c_1 d_1,
\]
after which relinearization uses an evaluation key encrypting powers of the secret, typically \(s^2\), to map the product back to a two-component form [2207.04604]. The cited textbook treatment presents the same operation through mod-raise, rescale by \(1/\Delta\), and gadget-based relinearization, emphasizing that multiplication expands both ciphertext dimension and noise, whereas addition grows noise only linearly [2503.05136].

The secret and error distributions are small by design. One cited formulation uses ternary secrets with coefficients in \(\{-1,0,1\}\) and errors from a centered discrete Gaussian truncated to a bounded interval [2207.04604]. Other cited implementations describe small secrets drawn from binary, ternary, or discrete-Gaussian-like distributions, but do not always enumerate the exact sampler parameters [2508.02461] [2308.05636].

## 3. Encoding, batching, relinearization, and bootstrapping

A major practical feature of BFV is batching. When \(t\) is chosen so that \(X^n+1\) splits over \(\mathbb{Z}_t\), the Chinese Remainder Theorem decomposes \(R_t\) into a direct product of fields, enabling SIMD-style packing. The cited sources state this condition in closely related forms: \(t\) prime with \(t \equiv 1 \bmod 2n\), or more generally \(n \mid (t-1)\), so that primitive roots of unity exist modulo \(t\) and slotwise encoding/decoding can be realized through CRT or Vandermonde-like transforms [2508.02461] [2503.05136]. Under such conditions, one plaintext polynomial can hold up to \(n\) independent integers.

Efficient polynomial arithmetic is obtained by choosing NTT-friendly ciphertext moduli. If \(q \equiv 1 \bmod 2n\), then \(R_q\) admits primitive \(2n\)-th roots of unity, and the Number Theoretic Transform yields quasi-linear convolution for polynomial multiplication [2508.02461]. Modern software stacks such as Microsoft SEAL and OpenFHE use RNS/NTT BFV variants, and several of the empirical papers inherit these optimizations directly from the library backend [2207.04604] [2508.02461].

Relinearization is the standard mechanism that collapses a multiplication result from three ciphertext components back to two. The textbook treatment expresses this through gadget decomposition and evaluation keys \(RLev\) encrypting scaled versions of \(S^2\), so that the \(D_2 S^2\) term can be transformed into a linear term in the secret [2503.05136]. In practice, however, several application papers are explicitly addition-dominated. The decentralized learning workload in D²-MHE is dominated by aggregation, so multiplications and relinearization are “minimal and not the performance bottleneck” [2207.04604]. The V2X study uses BFV only for additions, so neither multiplication nor modulus switching is exercised experimentally, and no relinearization or rotation keys are required [2508.02461].

Bootstrapping occupies a more delicate position. The textbook source presents a BFV bootstrapping method based on homomorphic digit extraction, involving modulus switching, homomorphic decryption, CoeffToSlot, digit extraction polynomials, SlotToCoeff, and scaling reinterpretation [2503.05136]. D²-MHE also defines a distributed bootstrapping primitive, MBFV.Bootstrap, which refreshes a ciphertext to “fresh-like” noise in the multiparty setting [2207.04604]. Yet the reported deployments also show why BFV is often used in leveled, non-bootstrapped form: when the circuit is shallow or addition-only, noise remains sufficiently small that bootstrapping is unnecessary in most runs [2207.04604] [2508.02461]. This directly counters the common misconception that BFV necessarily implies frequent bootstrapping in practical systems.

## 4. Multiparty BFV and application-specific adaptations

A prominent systems extension is the multiparty BFV design used in D²-MHE for decentralized deep learning. Here, the collective secret is additively shared,
\[
s=\sum_{k \in U} s_k,
\]
over a local neighborhood \(U=i \cup N_i\), and a collective public key is formed by summing local public-key shares. The scheme introduces four primitives—MBFV.SecKeyGen, MBFV.PubKeyGen, MBFV.Convert, and MBFV.Bootstrap—to support secure aggregation over a graph without reconstructing the joint secret [2207.04604]. The core conversion primitive performs an interactive one-shot key switch from the shared public key to a recipient’s individual key by having each participant contribute masked partials
\[
h_{0,k}=s_k c_1 + \mu_k p_{0,i} + e_{0,k},\qquad h_{1,k}=\mu_k p_{1,i}+e_{1,k},
\]
after which the recipient sums them into a new ciphertext decryptable under its own secret key [2207.04604].

The security model is honest-but-curious with collusion allowance: in any neighborhood \(U=i \cup N_i\), up to \(|U|-1\) users can collude. The paper’s simulators for MBFV.PubKeyGen, MBFV.Convert, and MBFV.Bootstrap rely on decisional RLWE together with additive secret sharing and fresh Gaussian masks, and conclude that semantic security is preserved so long as at least one honest party remains in the neighborhood [2207.04604]. The systems consequence is a communication reduction from the quadratic pattern of generic MPC-style secret sharing to linear scaling in the number of users, enabled by one system-wide public key, ciphertext packing, homomorphic local aggregation, and recipient-specific conversion [2207.04604].

A second adaptation appears in FedBit, which tailors BFV to federated learning through coefficient-level bit-interleaved packing rather than CRT slot packing. In FedBit, multiple quantized weights are embedded into one plaintext coefficient by disjoint bit-fields:
\[
c=\sum_{k=0}^{m_\ell-1} w^{(\ell)}_{p_k}\,2^{k(\beta_\ell+\delta_\ell)}.
\]
Correctness requires both intra-slot carry prevention,
\[
U\cdot (2^{\beta_\ell}-1) < 2^{\beta_\ell+\delta_\ell},
\]
and avoidance of coefficient wraparound,
\[
U\cdot M^{(\ell)} < t,
\]
where \(M^{(\ell)}\) is the worst-case packed coefficient bound defined in the paper [2509.23091]. Because FedBit is aggregation-only, it avoids multiplications, rotations, relinearization, and key-switching; this permits a compact two-component BFV deployment with hardware acceleration on a Xilinx Alveo U250 FPGA [2509.23091].

These two systems illustrate distinct but complementary ways BFV is adapted. D²-MHE modifies key management and decryption flow to support decentralized secure averaging with neighborhood-majority collusion resistance [2207.04604]. FedBit modifies data representation and hardware dataflow to minimize ciphertext count, communication, and transform overhead in federated aggregation [2509.23091]. A plausible implication is that BFV’s practical flexibility derives less from changing its algebraic core than from controlling how exact integer semantics, packing, and key structure are embedded into the surrounding protocol.

## 5. Implementations and reported empirical behavior

The recent systems literature evaluates BFV in markedly different environments, but a consistent pattern emerges: exact addition-heavy workloads are the most favorable regime, while multiplication-heavy workloads are constrained by ciphertext growth, wide modular multiplication cost, or both [2508.02461] [2309.06545] [2308.05636] [2207.04604] [2509.23091].

| Environment | BFV configuration | Reported findings |
|---|---|---|
| Decentralized deep learning [2207.04604] | Microsoft SEAL; polynomial degree 2048 and 4096; 1024 slots per ciphertext | MNIST, 50 users: D²-MHE 91.17%; CIFAR-10, 100 users: 68.25%; MNIST communication 56.7 MB per user total vs COPML 707.7 MB |
| V2X encrypted counting [2508.02461] | OpenFHE; \(n=4096\); addition-only; ciphertext size \(\approx 132\) KB | Vehicle count 100 over Wi‑Fi: 5.44 ± 2.14 ms encryption, 347.61 ± 6.80 ms evaluation, 4.73 ± 1.08 ms decryption; communication latency 3072.89 ms; about 95 fragments |
| PIM acceleration [2309.06545] | UPMEM PIM; \(n=1024,2048,4096\); 32-, 64-, 128-bit coefficients | Vector addition: 50–100× over CPU and 2–15× over GPU; vector multiplication: 40–50× over CPU but 10–15× behind GPU |
| Encrypted SNN/DNN inference [2308.05636] | Pyfhel; \(n=1024\); \(t \in \{10,\ldots,5000\}\) | SNNs achieve up to 40% higher accuracy than DNNs for low \(t\); encrypted LeNet-5 totals 31 s per image; Spiking-LeNet-5 totals 930 s |
| Federated learning co-design [2509.23091] | BFV with \(N=4096\), \(t=2{,}281{,}701{,}377\); FPGA accelerator | Fashion-MNIST: 3.2 ms encryption, 3.1 ms decryption; per-client traffic 2.7 MB vs CKKS 8.68 MB; average communication reduction 60.7% |

The V2X study is particularly explicit about network cost. Under 128-bit post-quantum security with \(n=4096\), a two-component BFV ciphertext is approximately 132 KB, which at 1400-byte UDP fragmentation yields about 95 fragments per ciphertext. Communication dominates end-to-end latency: round-trip BFV communication is approximately \(3.0\)–\(3.1\) s in both Wi‑Fi and Ethernet, largely independent of the number of additions, while the server’s evaluation time grows roughly linearly with the number of additions [2508.02461]. The same study concludes that BFV and BGV are suitable for latency-tolerant ITS tasks, but none of the tested HE schemes meet stringent sub-second safety-critical deadlines under the tested parameters [2508.02461].

The PIM study evaluates only BFV’s core arithmetic kernels on a real UPMEM system rather than a full end-to-end encrypted protocol. Addition maps well to native 32-bit add and add-with-carry, leading to large speedups; multiplication is limited by the lack of native sufficiently wide multiplication support, so GPU remains superior for multiplication-heavy kernels [2309.06545]. This distinction aligns with the application papers: arithmetic mean and secure summation are favorable for BFV acceleration, whereas variance, linear regression, or deeper neural pipelines move the bottleneck toward multiplications [2309.06545].

The encrypted SNN study highlights another empirical axis: plaintext modulus \(t\). With \(n=1024\) and Pyfhel-managed \(q\), the authors sweep \(t\) from \(10\) to \(5000\), reporting that SNNs degrade more gracefully than DNNs at low \(t\), with about 40% higher accuracy at \(t=50\), while encrypted inference remains costly—31 s per image for LeNet-5 and about 15.5 minutes for Spiking-LeNet-5 with \(seq\_length=30\) [2308.05636]. This is not an argument that BFV makes spiking models fast; rather, it shows that integer-exact encrypted computation can interact favorably with low-precision spike-based representations.

## 6. Limitations, misconceptions, and scheme-selection criteria

Several limitations recur across the cited literature. First, ciphertext expansion is substantial. BFV ciphertexts are much larger than plaintext vectors or gradients, and communication latency can dominate end-to-end time even when homomorphic evaluation is addition-only, as the V2X measurements make explicit [2508.02461]. Second, parameter growth is expensive: larger polynomial modulus degree and larger \(q\) improve noise margins but increase latency, memory footprint, and in some settings fragmentation overhead [2207.04604]. Third, multiplication remains the difficult operation. Relinearization keys, modulus management, and wide modular multiplication cost are either major performance factors or deliberately avoided by restricting workloads to additions [2309.06545] [2508.02461].

Two misconceptions are directly contradicted by the cited work. One is that BFV is inherently an approximate-arithmetic scheme. It is not: its defining feature is exact modular arithmetic in \(R_t\), and this is precisely why it is selected for counting, integer aggregation, quantized updates, and spike-oriented computations [2503.05136] [2508.02461]. Another is that BFV is useful only with CRT slot batching. Standard BFV does support CRT-SIMD packing when the plaintext modulus satisfies the requisite splitting conditions, but FedBit shows that practical systems may instead use coefficient-level bit interleaving, avoiding the root-of-unity constraint on \(t\) and eliminating the need for rotation keys [2509.23091].

Scheme selection in the cited papers is consistently application-driven. When exact integer semantics matter—vehicle counting, occupancy sums, model-update aggregation, or fixed-point gradients—BFV is repeatedly presented as the better fit [2508.02461] [2207.04604]. When approximate arithmetic, large dynamic range, or multiplication-heavy linear algebra dominate, the same literature notes that CKKS can be advantageous [2207.04604]. This does not make BFV “better” in the abstract; it means that BFV’s central design decision—exactness modulo \(t\)—is a strength only when the application semantics and protocol structure can exploit it.

A final practical observation is that many empirical BFV papers do not enumerate every cryptographic parameter. Several studies omit exact plaintext modulus values, RNS prime decompositions, or key sizes, especially when the library selects them automatically or when the workload exercises only addition [2508.02461] [2308.05636]. This suggests a separation between two layers of BFV research: one layer develops the algebra, correctness bounds, batching, relinearization, and bootstrapping machinery; the other fixes a narrow workload class and leverages only the portion of BFV needed for that class. The contemporary literature cited here is strongest precisely where those two layers align: shallow, addition-dominated, exact-integer computation under RLWE security.

Source: https://www.emergentmind.com/topics/brakerski-fan-vercauteren-bfv