Abstract. Let E/Q be a semistable elliptic curve such that ords=1L(E, s) = 1. We prove the p-part of the Birch and Swinnerton-Dyer formula for E/Q for each prime p ≥ 5 of good reduction such that E[p] is irreducible:This formula also holds for p = 3 provided ap(E) = 0 if E has supersingular reduction at p.

This paper proposes a practical hybrid solution for combining and switching between three popular Ring-LWE-based FHE schemes: TFHE, B/FV and HEAAN. This is achieved by first mapping the different plaintext spaces to a common algebraic structure and then by applying efficient switching algorithms. This approach has many practical applications. First and foremost, it becomes an integral tool for the recent standardization initiatives of homomorphic schemes and common APIs. Then, it can be used in many real-life scenarios where operations of different nature and not achievable within a single FHE scheme have to be performed and where it is important to efficiently switch from one scheme to another. Finally, as a byproduct of our analysis we introduce the notion of a FHE module structure, that generalizes the notion of the external product, but can certainly be of independent interest in future research in FHE.

Abstract. Consider a joint distribution (X, A) on a set X × {0, 1} ℓ . We show that for any family F of distinguishers f : X × {0, 1} ℓ → {0, 1}, there exists a simulator h : X → {0, 1} ℓ such that 1. no function in F can distinguish (X, A) from (X, h(X)) with advantage ǫ, 2. h is only O(2 3ℓ ǫ −2 ) times less efficient than the functions in F. For the most interesting settings of the parameters (in particular, the cryptographic case where X has superlogarithmic min-entropy, ǫ > 0 is negligible and F consists of circuits of polynomial size), we can make the simulator h deterministic.As an illustrative application of this theorem, we give a new security proof for the leakage-resilient stream-cipher from Eurocrypt'09. Our proof is simpler and quantitatively much better than the original proof using the dense model theorem, giving meaningful security guarantees if instantiated with a standard blockcipher like AES. Subsequent to this work, Chung, Lui and Pass gave an interactive variant of our main theorem, and used it to investigate weak notions of Zero-Knowledge. Vadhan and Zheng give a more constructive version of our theorem using their new uniform min-max theorem.