BGV ("exact" scheme) — Homomorphic encryption family that operates over integers. It has no approximation noise. The result is always bit-identical to the plaintext computation. Ideal for counts, SQL queries and boolean logic.

8 192 slots — An FHE ciphertext is not a single value: it is a vector of 8 192 packed values. You operate on all 8 192 at once with a single operation. This native "batching" is what makes FHE viable at scale.

Multiplicative depth 2 — How many chained multiplications a ciphertext supports before becoming unstable. Each multiplication consumes 1 level. More depth = more computation possible, but also slower and more expensive.

~128 bits of security — Industry standard. It means brute-forcing the key would require ~2¹²⁸ operations — an astronomical number, infeasible even for foreseeable quantum hardware.

RLWE base — Ring Learning With Errors. The mathematical problem underpinning all security. It is the same problem over which NIST standardized the next generation of post-quantum cryptography (ML-KEM, ML-DSA).

Binary characteristic vector — Instead of encrypting the list of IDs as strings, we convert it into a binary vector where each position represents an ID in the universe. 1 = in the list, 0 = not. This format lets the intersection (step 4) become simply an element-wise multiplication.

Encryption before sharing — The difference vs traditional linkage: the vector is encrypted inside the agency's data center. At no point does a cleartext copy exist outside.

3 ms per agency — Real measured time. Negligible compared to the time of any traditional inter-agency agreement (months for approval).

INSS does the same — In parallel, INSS prepares its own list, encrypts with the same consortium public key, and sends it. The two ciphertexts travel to the neutral server independently.

Encrypted multiplication (logical AND) — The key FHE property is that multiplying two ciphertexts decrypts to the product of the plaintexts. Since our vectors are binary (0 or 1), the slot-wise product is exactly AND: it equals 1 only when BOTH are 1 — that is, only for IDs that appear in both lists.

InnerSum (counting) — Sums every slot of the encrypted vector to obtain the total count of IDs in the intersection. Internally it uses Galois rotations.

Foreign cloud can host it — The server may physically sit in the US, Europe, anywhere. Without the key (distributed among the 4 Brazilian parties), it only sees pseudo-random bytes. Even under the US CLOUD Act, it has nothing to hand over.

44 ms for 100 IDs — In real production with millions of IDs per agency, the same pattern scales via slot batching — each ciphertext supports 8 192 IDs in parallel.

Fiscal linkage demands exactness — Unlike risk scoring or recommendation (where CKKS approximation is acceptable), a fiscal/social security operation cannot have error. A single wrong ID can become an administrative case. BGV guarantees zero error.

Public audit — Because the result is mathematically verifiable (BGV is deterministic on the final result), any auditor can rerun the same operation on the same ciphertexts and get exactly the same count. Reproducibility is part of the legal guarantee.

Defense against contestation — If a flagged ID challenges the linkage in court, the court can audit the entire process (without seeing the other agencies' data) and mathematically confirm the linkage was performed correctly.