\documentclass{article}
\usepackage[utf8]{inputenc}
\usepackage{amsfonts}
\usepackage{amsthm}
\usepackage{amsmath}
\usepackage{enumerate}

\usepackage{hyperref}
\hypersetup{
    colorlinks,
    citecolor=black,
    filecolor=black,
    linkcolor=black,
    urlcolor=blue
}


\newcommand{\Zq}{\mathbb{Z}_q}
\newcommand{\Rq}{\mathbb{Z}_q[X]/(X^n+1)}


\title{NTT for Negacyclic Polynomial Multiplication}
\author{arnaucube}
\date{January 2025}

\begin{document}

\maketitle

\begin{abstract}
    Notes taken while studying the NTT, mostly from \cite{10177902}.

	Usually while reading books and papers I take handwritten notes in a notebook, this document contains some of them re-written to $LaTeX$.

	The notes are not complete, don't include all the steps neither all the proofs.

	An implementation of the NTT can be found at\\
	\href{https://github.com/arnaucube/fhe-study/blob/main/arithmetic/src/ntt.rs}{https://github.com/arnaucube/fhe-study/blob/main/arithmetic/src/ntt.rs}.
\end{abstract}

\tableofcontents

\section{Main idea}
For doing multiplications in the \emph{negacyclic polynomial ring} ($\Rq$), rather than doing it in a naive way, it is more
efficient to do it through the NTT.

This is, let $a(X), b(X) \in \Rq$, and suppose we want to
obtain $a(X) \cdot b(X)$. First apply the NTT to the two ring
elements that we want to multiply,
$$\hat{a}(X) = NTT(a(X)),~~ \hat{b}(X)=NTT(b(X))$$
then multiply the result element-wise,
% $$\hat{c}(X) = \sum \hat{a}_i \cdot \hat{b}_i$$
$$c= \hat{a} \circ \hat{b}$$
where $\circ$ means the element-wise vector multiplication in $\Zq$.

Then apply the NTT$^{-1}$ to the result, obtaining the actual value of
multiplying $a(X) \cdot b(X)$.

\section{Cyclotomic vs Negacyclic}

\subsection{Cyclotomic: \texorpdfstring{$\mathbb{Z}_q[X]/(X^n-1)$}{Zq[X]/(X**n-1)}}
In the cyclotomic case, the primitive n-th root of unity in $Z_q$ is $w^n \equiv 1 \pmod q$ (and
$w^k \not\equiv 1 \pmod q ~~ for k<n$)

\subsubsection{NTT based on \texorpdfstring{$w$}{w}}
NTT of a polynomial $a(X) = \sum a_i X^i$ is defined as $\hat{a} = NTT(a)$,
where
$$\hat{a}_j = \sum_{i=0}^{n-1} a_i w^{ij} \pmod q$$
for each of the $j=0,1,\ldots, n-1$.

We can visualize the NTT operation as
$$
NTT(a) =
\begin{bmatrix}
w^{0 \cdot 0} & w^{0 \cdot 1} & w^{0 \cdot 2} & \ldots & w^{0 \cdot (n-1)} \\
w^{1 \cdot 0} & w^{1 \cdot 1} & w^{1 \cdot 2} & \ldots & w^{1 \cdot (n-1)} \\
w^{2 \cdot 0} & w^{2 \cdot 1} & w^{2 \cdot 2} & \ldots & w^{2 \cdot (n-1)} \\
\vdots & \vdots & \vdots & & \vdots\\
w^{(n-1) \cdot 0} & w^{(n-1) \cdot 1} & w^{(n-1) \cdot 2} & \ldots & w^{(n-1) \cdot (n-1)} \\
\end{bmatrix}
\begin{bmatrix}
a_0 \\ a_1 \\ a_2 \\ \vdots \\ a_{n-1}
\end{bmatrix}
=
\begin{bmatrix}
\hat{a}_0 \\ \hat{a}_1 \\ \hat{a}_2 \\ \vdots \\ \hat{a}_{n-1}
\end{bmatrix}
$$

\subsubsection{Inverse NTT based on \texorpdfstring{$w$}{w}}
Inverse-NTT of a vector $\hat{a}$ is defined as $a = iNTT(\hat{a})$, where
$$a_i = n^{-1} \sum_{j=0}^{n-1} \hat{a}_j w^{-ij}k \pmod q$$
with $j=0,1,\ldots,n-1$.

Similar to the NTT formula, only diffs:
\begin{itemize}
    \item $w$ is replaced by its inverse in $\Zq$
    \item $n^{-1}$ scaling factor
\end{itemize}

We can visualize the NTT$^{-1}$ operation as
$$
iNTT(\hat{a}) =
n^{-1} \cdot
\begin{bmatrix}
w^{-0 \cdot 0} & w^{-0 \cdot 1} & w^{-0 \cdot 2} & \ldots & w^{-0 \cdot (n-1)} \\
w^{-1 \cdot 0} & w^{-1 \cdot 1} & w^{-1 \cdot 2} & \ldots & w^{-1 \cdot (n-1)} \\
w^{-2 \cdot 0} & w^{-2 \cdot 1} & w^{-2 \cdot 2} & \ldots & w^{-2 \cdot (n-1)} \\
\vdots & \vdots & \vdots & & \vdots\\
w^{-(n-1) \cdot 0} & w^{-(n-1) \cdot 1} & w^{-(n-1) \cdot 2} & \ldots & w^{-(n-1) \cdot (n-1)} \\
\end{bmatrix}
\begin{bmatrix}
\hat{a}_0 \\ \hat{a}_1 \\ \hat{a}_2 \\ \vdots \\ \hat{a}_{n-1}
\end{bmatrix}
=
\begin{bmatrix}
a_0 \\ a_1 \\ a_2 \\ \vdots \\ a_{n-1}
\end{bmatrix}
$$

\subsection{Apply it to polynomial multiplication}
Want to compute $c(X) = a(X) \cdot b(X) \in \mathbb{Z}_q[X] / (X^n-1)$, which we
can do as
$$c= iNTT(NTT(a) \circ NTT(b))$$
where $\circ$ means the element-wise vector multiplication in $\Zq$.



\subsection{Negacyclic: \texorpdfstring{$\mathbb{Z}_q[X] / (X^n+1)$}{Zq[X]/(X**n+1)}}
Instead of working in $\mathbb{Z}_q[X] / (X^n-1)$, we work in $\Rq$.

Instead of using the primitive n-th root of unity ($w$), we use the
\emph{primitive 2n-th root of unity} $\psi$.

Where $\psi^2 \equiv w \pmod q$, and $\psi^2 \equiv -1 \pmod q$.


\subsubsection{NTT based on \texorpdfstring{$\psi$}{psi}, NTT\texorpdfstring{$^\psi$}{$**psi$}}
$\hat{a} = NTT^{\psi}(a)$, where

$$\hat{a}_j = \sum_{i=0}^{n-1} \psi^i w^{ij} a_i \pmod q$$
with $j=0,1,\ldots,n-1$.

Since $\psi^2 \equiv w \pmod q$, we can substitute $w=\psi^2$:

$$\hat{a}_j = \sum_{i=0}^{n-1} \psi^{2ij+i} a_i \pmod q$$

getting rid of $w$.

We can visualize the NTT$^{\psi}$ operation as
$$
NTT^\psi(a) =
\begin{bmatrix}
\psi^{2(0 \cdot 0)+0} & \psi^{2(0 \cdot 1)+1} & \psi^{2(0 \cdot 2)+2} & \ldots & \psi^{2(0 \cdot (n-1))+(n-1)} \\
\psi^{2(1 \cdot 0)+0} & \psi^{2(1 \cdot 1)+1} & \psi^{2(1 \cdot 2)+2} & \ldots & \psi^{2(1 \cdot (n-1))+(n-1)} \\
\psi^{2(2 \cdot 0)+0} & \psi^{2(2 \cdot 1)+1} & \psi^{2(2 \cdot 2)+2} & \ldots & \psi^{2(2 \cdot (n-1))+(n-1)} \\
\vdots & \vdots & \vdots & & \vdots\\
\psi^{2((n-1) \cdot 0)+0} & \psi^{2((n-1) \cdot 1)+1} & \psi^{2((n-1) \cdot 2)+2} & \ldots & \psi^{2((n-1) \cdot (n-1))+(n-1)} \\
\end{bmatrix}
\begin{bmatrix}
a_0 \\ a_1 \\ a_2 \\ \vdots \\ a_{n-1}
\end{bmatrix}
=
\begin{bmatrix}
\hat{a}_0 \\ \hat{a}_1 \\ \hat{a}_2 \\ \vdots \\ \hat{a}_{n-1}
\end{bmatrix}
$$

\subsubsection{Inverse NTT based on \texorpdfstring{$\psi$}{psi}, iNTT\texorpdfstring{$^\psi$}{**psi}}
$a = iNTT{\psi}(\hat{a})$, where
$$a_i = n^{-1} \sum_{j=0}^{n-1} \psi^{-j} w^{-ij} \hat{a}_j \pmod q$$
with $i=0,1,\ldots,n-1$.

Which substituting $w=\psi^2$ we get
$$a_i = n^{-1} \sum_{j=0}^{n-1} \psi^{-(2ij + j)} \hat{a}_j \pmod q$$


So the differences with the NTT$^\psi$ are:
\begin{itemize}
    \item $\psi$ is replaced by its inverse $\psi^{-1}$ in $\Zq$
    \item $n^{-1}$ scaling factor
    \item transpose of the exponents of $\psi$
\end{itemize}

We can visualize the NTT$^{-\psi}$ operation as

\begin{align*}
    &iNTT^{\psi}(a) =\\
&\begin{bmatrix}
\psi^{-(2(0 \cdot 0)+0)} & \psi^{-(2(0 \cdot 1)+1)} & \psi^{-(2(0 \cdot 2)+2)} & \ldots & \psi^{-(2(0 \cdot (n-1))+(n-1))} \\
\psi^{-(2(1 \cdot 0)+0)} & \psi^{-(2(1 \cdot 1)+1)} & \psi^{-(2(1 \cdot 2)+2)} & \ldots & \psi^{-(2(1 \cdot (n-1))+(n-1))} \\
\psi^{-(2(2 \cdot 0)+0)} & \psi^{-(2(2 \cdot 1)+1)} & \psi^{-(2(2 \cdot 2)+2)} & \ldots & \psi^{-(2(2 \cdot (n-1))+(n-1))} \\
\vdots & \vdots & \vdots & & \vdots\\
\psi^{-(2((n-1) \cdot 0)+0)} & \psi^{-(2((n-1) \cdot 1)+1)} & \psi^{-(2((n-1) \cdot 2)+2)} & \ldots & \psi^{-(2((n-1) \cdot (n-1))+(n-1))} \\
\end{bmatrix}
\begin{bmatrix}
\hat{a}_0 \\ \hat{a}_1 \\ \hat{a}_2 \\ \vdots \\ \hat{a}_{n-1}
\end{bmatrix}
=
\begin{bmatrix}
a_0 \\ a_1 \\ a_2 \\ \vdots \\ a_{n-1}
\end{bmatrix}
\end{align*}

\subsection{Use it to polynomial multiplication}
Want to compute $c(X) = a(X) \cdot b(X) \in \mathbb{Z}_q[X] / (X^n-1)$, which we
can do as
$$c= iNTT^{\psi 1}(NTT^{\psi}(a) \circ NTT^{\psi}(b))$$
where $\circ$ means the element-wise vector multiplication in $\Zq$.

\section{Fast NTT}
NTT and INTT have $O(n^2)$ complexity, but since NTT is the DFT in a ring, we
can apply the DFT optimization techniques (FFT), to reduce the complexity to
$O(n log n)$.

We use two properties of $\psi$:
\begin{itemize}
    \item periodicity: $\psi^{k+2n} = \psi^k$
    \item symmetry: $\psi^{k+n} = - \psi^k$
\end{itemize}

\subsection{Cooley-Tukey algorithm (Fast NTT)}\label{sec:CT}
Recall,
$$\hat{a}_j = \sum_{i=0}^{n-1} \psi^{2ij+i} a_i \pmod q$$
we can split it into two parts,
\begin{align*}
    \hat{a}_j &=\sum_{i=0}^{n/2 -1} \psi^{4ij+2i} a_{2i} + \sum_{i=0}^{n/2 -1} \psi^{4ij+2j+2i+1} a_{2i+1} \pmod q \\
	      &=\sum_{i=0}^{n/2 -1} \psi^{4ij+2i} a_{2i} + \psi^{2j+1} \cdot \sum_{i=0}^{n/2-1} \psi^{4ij+2i} a_{2i+1} \pmod q
\end{align*}

Let
\begin{align*}
    A_j &= \sum_{i=0}^{n/2 -1} \psi^{4ij+2i} a_{2i} \pmod q \\
    B_j &= \sum_{i=0}^{n/2-1} \psi^{4ij+2i} a_{2i+1} \pmod q
\end{align*}

then,
\begin{align*}
    \hat{a}_j &= A_j + \psi^{2j+1} \cdot B_j \pmod q \\
    \hat{a}_{j+n/2} &= A_j - \psi^{2j+1} \cdot B_j \pmod q
\end{align*}

Notice that $A_j,~B_j$ can be obtained as $n/2$ points. So if $n$ is a power of
two, we can repeat the process for all the coefficients.

[todo: diagram and explain intuition]

\subsection{Gentleman-Sande algorithm (Fast iNTT)}
Instead of dividing the summation by its index parity, it is separated by the
lower and upper half of the summation.

Similar to what we did in section \ref{sec:CT}, let's split the equation to compute $a_i$.

Recall that we had
$$a_i = n^{-1} \sum_{j=0}^{n-1} \psi^{-(2ij + j)} \hat{a}_j \pmod q$$
we can split it into two parts,

\begin{align*}
    a_i &= n^{-1} \cdot \left[ \sum_{j=0}^{n/2-1} \psi^{-(2i + 1)j} \hat{a}_j 
    + \sum_{j=0}^{n/2-1} \psi^{-(2i + 1)(j+n/2)} \hat{a}_{j+n/2} \right] \pmod q \\
	&=  n^{-1} \cdot \psi^{-i} \cdot \left[ \sum_{j=0}^{n/2-1} \psi^{-2ij} \hat{a}_j 
    + \sum_{j=0}^{n/2-1} \psi^{-2i(j+n/2)} \hat{a}_{j+n/2} \right] \pmod q
\end{align*}


Based on the periodicity and symmetry of $\psi^{-1}$, leaving the $n^{-1}$ factor out, for the even terms:
\begin{align*}
    a_{2i} &= \psi^{-2i} \cdot \left[ \sum_{j=0}^{n/2-1} \psi^{-4ij} \hat{a}_j
	+ \sum_{j=0}^{n/2-1} \psi^{-4i(j+n/2)} \hat{a}_(j+n/2) \right] \pmod q \\
	   &= \psi^{-2i} \sum_{j=0}^{n/2-1} (\hat{a}_j + \hat{a}_{j+n/2}) \psi^{-4ij} ) \pmod q
\end{align*}

Doing the same derivation for the odd terms:
$$a_{2i+1} = \psi^{-2i} \sum_{j=0}^{n/2-1} ( \hat{a}_j - \hat{a}_{j+n/2} ) \psi^{-4ij} \pmod q$$


Now, let
$$A_j = \sum_{j=0}^{n/2-1} \hat{a}_j \psi^{-4ij},~~ B_j = \sum_{j=0}^{n/2-1} \hat{a}_{j +n/2} \psi^{-4ij}$$
then
\begin{align*}
    a_{2i} &= (A_i +B_i) \psi^{-2i} \pmod q\\
    a_{2i+1} &= (A_i -B_i) \psi^{-2i} \pmod q\\
\end{align*}

[todo: add diagram and explain intuition]

\bibliography{paper-notes.bib}
\bibliographystyle{unsrt}

\end{document}