Security notes — allele_frequency_with_variance

Scoped to this bundle. The platform-wide threat model lives in
docs/manifesto.md, docs/requirements.md, and docs/simulation_mode.md §5.
Kerckhoffs applied to a product: no guarantee rests on the secrecy — or the
honesty — of the server. Don’t trust, verify.

This is the multiplication-supporting sibling of the flagship: same inputs, but
the server SQUARES an encrypted value. The trust boundary is unchanged — the
server still holds no secret key and still returns only ciphertext.

Trust classes (what may cross the wire)

Only ENCRYPTED and PUBLIC are ever uploaded. 00_keygen.py writes the secret key
to secret_context.tenseal, which is used only by 40_decrypt.py on the
researcher’s machine. There is no /api/v1 endpoint that accepts a secret key.

The public context carries relin keys — and that is safe

Unlike the additive flagship, the published public context includes
relinearization keys. Relin keys are a public evaluation key: they let the
server relinearize a degree-3 product ciphertext (the result of ct × ct) back to
degree 2. They reveal nothing about any plaintext and cannot decrypt — only
the secret key can. The server needs them purely to perform the square. No
Galois (rotation) keys are generated: the square is element-wise per slot, so
there is never a cross-slot rotation. Withholding Galois keys keeps the server’s
capability minimal — it can add and element-wise square, nothing else.

Server holds no secret key

30_compute_encrypted.py — the only server-side stage, a kit shim that runs
server.py’s compute — loads the public
context plus ciphertexts, homomorphically adds, and homomorphically squares
(relin). It defensively refuses a context that carries a secret key
(context.is_private() → error). The server therefore never sees a single
plaintext genotype; it operates on ciphertext and returns ciphertext (two blobs:
sum_g and the server-derived sum_g2). Decryption happens only where the
secret key lives: locally.

Server-derived second moment — integrity, not blind trust

sum_g2 is computed by the server, under encryption, from the same g
ciphertexts. The researcher never has to trust the server got the square right:
the released sum_g2 is bit-exact-verifiable against the cleartext oracle in
simulation (docs/simulation_mode.md), and the compute is deterministic, so
re-execution reproduces a bit-identical result digest. Squaring server-side (vs
the client sending g²) means the contributor payload stays minimal and the
second moment can never be a client-fabricated value inconsistent with g.

The append-1 sentinel is NOT a MAC

Both result vectors’ trailing sentinel slot decrypts to the exact contributor
count N (sum path Σ 1 = N; square path Σ 1² = N), and 50_decode.py
cross-checks that the two agree. Dropping one upload yields N−1 in both (test:
test_sentinel_tracks_dropped_upload). It catches mechanical corruption /
miscounting — it gives no guarantee that contributions are distinct,
genuine, or non-Sybil. Call it what it is: an integrity check, not authenticity.

What FHE here does and does not hide

• Hides: individual genotype vectors from the server (inputs are ciphertext),
  and the individual second moments (the server never decrypts g² per person).
• Does not hide: the released aggregates themselves (sum_g, sum_g2, and
  the derived mean/variance), and metadata (researcher identity, participant
  count/timing, ciphertext sizes, protocol choice).
• Differencing (K vs K+1): the statistics leak an individual if you can
  compute A_{K+1} − A_K — and because BOTH moments are released, an attacker who
  can difference recovers both g and g² for the marginal contributor.
  aggregate_only + min_contributors ≥ 30 (higher than the flagship’s 20) +
  allowed_runs_per_project: 1 (cohort freeze + min-N + run cap) mitigate
  this; they are not a complete defense. Overlapping/Sybil differencing across
  separately frozen cohorts needs DP + cross-job query budgets (v2). Documented,
  not hand-waved — see docs/simulation_mode.md §5.
• Verify-by-re-execution is determinism, not zero-knowledge. Re-running
  30_compute_encrypted.py on the same ciphertexts reproduces bit-identical
  result digests; it proves the computation, it is not a ZK proof.

Exactness / parameter safety

BFV is exact in Z_t. The plaintext modulus must satisfy t > max coordinate value. Here the second moment dominates: max sum_g2 = 4·N (each g² ≤ 4). The
default t = 786433 (a 20-bit batching prime, ≡ 1 (mod 32768) as required at
n=16384) stays exact for N up to ~196k; a real run at larger N must raise t (or
the simulation feasibility sweep will report infeasible-at-these-params on
overflow). Per-contributor g² ≤ 4 and the sentinel sum N are both ≪ t.

Noise budget: the coeff-modulus chain [60, 40, 40, 60] gives two
multiplicative levels; the single depth-1 square consumes one, leaving headroom.
A depth-2 circuit would need a longer chain (and a larger ring for the same
security), which is precisely the cost the benchmark matrix quantifies.