phantom-zone/src/bool/evaluator.rs
src/bool/evaluator.rsRaw
1use std::{
2 borrow::BorrowMut,
3 cell::{OnceCell, RefCell},
4 clone,
5 collections::HashMap,
6 fmt::{Debug, Display},
7 iter::Once,
8 marker::PhantomData,
9 ops::Shr,
10 sync::OnceLock,
11};
12
13use itertools::{izip, partition, Itertools};
14use num_traits::{FromPrimitive, Num, One, Pow, PrimInt, ToPrimitive, WrappingSub, Zero};
15use rand_distr::uniform::SampleUniform;
16
17use crate::{
18 backend::{
19 ArithmeticOps, GetModulus, ModInit, ModularOpsU64, Modulus, ShoupMatrixFMA, VectorOps,
20 },
21 decomposer::{Decomposer, DefaultDecomposer, NumInfo, RlweDecomposer},
22 lwe::{decrypt_lwe, encrypt_lwe, lwe_key_switch, lwe_ksk_keygen, measure_noise_lwe, LweSecret},
23 multi_party::public_key_share,
24 ntt::{self, Ntt, NttBackendU64, NttInit},
25 pbs::{pbs, sample_extract, PbsInfo, PbsKey, WithShoupRepr},
26 random::{
27 DefaultSecureRng, NewWithSeed, RandomFill, RandomFillGaussianInModulus,
28 RandomFillUniformInModulus, RandomGaussianElementInModulus,
29 },
30 rgsw::{
31 decrypt_rlwe, galois_auto, galois_key_gen, generate_auto_map, public_key_encrypt_rgsw,
32 rgsw_by_rgsw_inplace, rlwe_by_rgsw, secret_key_encrypt_rgsw, IsTrivial, RgswCiphertext,
33 RlweCiphertext, RlweSecret,
34 },
35 utils::{
36 fill_random_ternary_secret_with_hamming_weight, generate_prime, mod_exponent, Global,
37 TryConvertFrom1, WithLocal,
38 },
39 Decryptor, Encryptor, Matrix, MatrixEntity, MatrixMut, MultiPartyDecryptor, Row, RowEntity,
40 RowMut, Secret,
41};
42
43use super::{
44 keys::ClientKey,
45 parameters::{BoolParameters, CiphertextModulus},
46 CommonReferenceSeededCollectivePublicKeyShare, CommonReferenceSeededMultiPartyServerKeyShare,
47 SeededMultiPartyServerKey, SeededServerKey, ServerKeyEvaluationDomain,
48 ShoupServerKeyEvaluationDomain,
49};
50
51pub struct MultiPartyCrs<S> {
52 pub(super) seed: S,
53}
54
55impl<S: Default + Copy> MultiPartyCrs<S> {
56 /// Seed to generate public key share using MultiPartyCrs as the main seed.
57 ///
58 /// Public key seed equals the 1st seed extracted from PRNG Seeded with
59 /// MiltiPartyCrs's seed.
60 pub(super) fn public_key_share_seed<Rng: NewWithSeed<Seed = S> + RandomFill<S>>(&self) -> S {
61 let mut prng = Rng::new_with_seed(self.seed);
62
63 let mut seed = S::default();
64 RandomFill::<S>::random_fill(&mut prng, &mut seed);
65 seed
66 }
67
68 /// Seed to generate server key share using MultiPartyCrs as the main seed.
69 ///
70 /// Server key seed equals the 2nd seed extracted from PRNG Seeded with
71 /// MiltiPartyCrs's seed.
72 pub(super) fn server_key_share_seed<Rng: NewWithSeed<Seed = S> + RandomFill<S>>(&self) -> S {
73 let mut prng = Rng::new_with_seed(self.seed);
74
75 let mut seed = S::default();
76 RandomFill::<S>::random_fill(&mut prng, &mut seed);
77 RandomFill::<S>::random_fill(&mut prng, &mut seed);
78 seed
79 }
80}
81
82pub(crate) trait BooleanGates {
83 type Ciphertext: RowEntity;
84 type Key;
85
86 fn and_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
87 fn nand_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
88 fn or_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
89 fn nor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
90 fn xor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
91 fn xnor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
92 fn not_inplace(&mut self, c: &mut Self::Ciphertext);
93
94 fn and(
95 &mut self,
96 c0: &Self::Ciphertext,
97 c1: &Self::Ciphertext,
98 key: &Self::Key,
99 ) -> Self::Ciphertext;
100 fn nand(
101 &mut self,
102 c0: &Self::Ciphertext,
103 c1: &Self::Ciphertext,
104 key: &Self::Key,
105 ) -> Self::Ciphertext;
106 fn or(
107 &mut self,
108 c0: &Self::Ciphertext,
109 c1: &Self::Ciphertext,
110 key: &Self::Key,
111 ) -> Self::Ciphertext;
112 fn nor(
113 &mut self,
114 c0: &Self::Ciphertext,
115 c1: &Self::Ciphertext,
116 key: &Self::Key,
117 ) -> Self::Ciphertext;
118 fn xor(
119 &mut self,
120 c0: &Self::Ciphertext,
121 c1: &Self::Ciphertext,
122 key: &Self::Key,
123 ) -> Self::Ciphertext;
124 fn xnor(
125 &mut self,
126 c0: &Self::Ciphertext,
127 c1: &Self::Ciphertext,
128 key: &Self::Key,
129 ) -> Self::Ciphertext;
130 fn not(&mut self, c: &Self::Ciphertext) -> Self::Ciphertext;
131}
132
133struct ScratchMemory<M>
134where
135 M: Matrix,
136{
137 lwe_vector: M::R,
138 decomposition_matrix: M,
139}
140
141impl<M: MatrixEntity> ScratchMemory<M>
142where
143 M::R: RowEntity,
144{
145 fn new(parameters: &BoolParameters<M::MatElement>) -> Self {
146 // Vector to store LWE ciphertext with LWE dimesnion n
147 let lwe_vector = M::R::zeros(parameters.lwe_n().0 + 1);
148
149 // Matrix to store decomposed polynomials
150 // Max decompistion count + space for temporary RLWE
151 let d = std::cmp::max(
152 parameters.auto_decomposition_count().0,
153 std::cmp::max(
154 parameters.rlwe_rgsw_decomposition_count().0 .0,
155 parameters.rlwe_rgsw_decomposition_count().1 .0,
156 ),
157 ) + 2;
158 let decomposition_matrix = M::zeros(d, parameters.rlwe_n().0);
159
160 Self {
161 lwe_vector,
162 decomposition_matrix,
163 }
164 }
165}
166
167pub(super) trait BoolEncoding {
168 type Element;
169 fn true_el(&self) -> Self::Element;
170 fn false_el(&self) -> Self::Element;
171 fn qby4(&self) -> Self::Element;
172 fn decode(&self, m: Self::Element) -> bool;
173}
174
175impl<T> BoolEncoding for CiphertextModulus<T>
176where
177 CiphertextModulus<T>: Modulus<Element = T>,
178 T: PrimInt,
179{
180 type Element = T;
181
182 fn qby4(&self) -> Self::Element {
183 if self.is_native() {
184 T::one() << (CiphertextModulus::<T>::_bits() - 2)
185 } else {
186 self.q().unwrap() >> 2
187 }
188 }
189 /// Q/8
190 fn true_el(&self) -> Self::Element {
191 if self.is_native() {
192 T::one() << (CiphertextModulus::<T>::_bits() - 3)
193 } else {
194 self.q().unwrap() >> 3
195 }
196 }
197 /// -Q/8
198 fn false_el(&self) -> Self::Element {
199 self.largest_unsigned_value() - self.true_el() + T::one()
200 }
201 fn decode(&self, m: Self::Element) -> bool {
202 let qby8 = self.true_el();
203 let m = (((m + qby8).to_f64().unwrap() * 4.0f64) / self.q_as_f64().unwrap()).round()
204 as usize
205 % 4usize;
206
207 if m == 0 {
208 return false;
209 } else if m == 1 {
210 return true;
211 } else {
212 panic!("Incorrect bool decryption. Got m={m} but expected m to be 0 or 1")
213 }
214 }
215}
216
217pub(super) struct BoolPbsInfo<M: Matrix, Ntt, RlweModOp, LweModOp> {
218 auto_decomposer: DefaultDecomposer<M::MatElement>,
219 rlwe_rgsw_decomposer: (
220 DefaultDecomposer<M::MatElement>,
221 DefaultDecomposer<M::MatElement>,
222 ),
223 lwe_decomposer: DefaultDecomposer<M::MatElement>,
224 g_k_dlog_map: Vec<usize>,
225 rlwe_nttop: Ntt,
226 rlwe_modop: RlweModOp,
227 lwe_modop: LweModOp,
228 embedding_factor: usize,
229 rlwe_qby4: M::MatElement,
230 rlwe_auto_maps: Vec<(Vec<usize>, Vec<bool>)>,
231 parameters: BoolParameters<M::MatElement>,
232}
233
234impl<M: Matrix, NttOp, RlweModOp, LweModOp> PbsInfo for BoolPbsInfo<M, NttOp, RlweModOp, LweModOp>
235where
236 M::MatElement: PrimInt + WrappingSub + NumInfo + FromPrimitive + From<bool> + Display,
237 RlweModOp: ArithmeticOps<Element = M::MatElement> + ShoupMatrixFMA<M::R>,
238 LweModOp: ArithmeticOps<Element = M::MatElement> + VectorOps<Element = M::MatElement>,
239 NttOp: Ntt<Element = M::MatElement>,
240{
241 type M = M;
242 type Modulus = CiphertextModulus<M::MatElement>;
243 type D = DefaultDecomposer<M::MatElement>;
244 type RlweModOp = RlweModOp;
245 type LweModOp = LweModOp;
246 type NttOp = NttOp;
247 fn rlwe_auto_map(&self, k: usize) -> &(Vec<usize>, Vec<bool>) {
248 &self.rlwe_auto_maps[k]
249 }
250 fn br_q(&self) -> usize {
251 *self.parameters.br_q()
252 }
253 fn lwe_decomposer(&self) -> &Self::D {
254 &self.lwe_decomposer
255 }
256 fn rlwe_rgsw_decomposer(&self) -> &(Self::D, Self::D) {
257 &self.rlwe_rgsw_decomposer
258 }
259 fn auto_decomposer(&self) -> &Self::D {
260 &self.auto_decomposer
261 }
262 fn embedding_factor(&self) -> usize {
263 self.embedding_factor
264 }
265 fn g(&self) -> isize {
266 self.parameters.g() as isize
267 }
268 fn w(&self) -> usize {
269 self.parameters.w()
270 }
271 fn g_k_dlog_map(&self) -> &[usize] {
272 &self.g_k_dlog_map
273 }
274 fn lwe_n(&self) -> usize {
275 self.parameters.lwe_n().0
276 }
277 fn lwe_q(&self) -> &Self::Modulus {
278 self.parameters.lwe_q()
279 }
280 fn rlwe_n(&self) -> usize {
281 self.parameters.rlwe_n().0
282 }
283 fn rlwe_q(&self) -> &Self::Modulus {
284 self.parameters.rlwe_q()
285 }
286 fn modop_lweq(&self) -> &Self::LweModOp {
287 &self.lwe_modop
288 }
289 fn modop_rlweq(&self) -> &Self::RlweModOp {
290 &self.rlwe_modop
291 }
292 fn nttop_rlweq(&self) -> &Self::NttOp {
293 &self.rlwe_nttop
294 }
295}
296
297pub(crate) struct BoolEvaluator<M, Ntt, RlweModOp, LweModOp, SKey>
298where
299 M: Matrix,
300{
301 pbs_info: BoolPbsInfo<M, Ntt, RlweModOp, LweModOp>,
302 scratch_memory: ScratchMemory<M>,
303 nand_test_vec: M::R,
304 and_test_vec: M::R,
305 or_test_vec: M::R,
306 nor_test_vec: M::R,
307 xor_test_vec: M::R,
308 xnor_test_vec: M::R,
309 _phantom: PhantomData<SKey>,
310}
311
312impl<M: Matrix, NttOp, RlweModOp, LweModOp, Skey>
313 BoolEvaluator<M, NttOp, RlweModOp, LweModOp, Skey>
314{
315 pub(super) fn parameters(&self) -> &BoolParameters<M::MatElement> {
316 &self.pbs_info.parameters
317 }
318
319 pub(super) fn pbs_info(&self) -> &BoolPbsInfo<M, NttOp, RlweModOp, LweModOp> {
320 &self.pbs_info
321 }
322}
323
324impl<M: Matrix, NttOp, RlweModOp, LweModOp, SKey> BoolEvaluator<M, NttOp, RlweModOp, LweModOp, SKey>
325where
326 M: MatrixEntity + MatrixMut,
327 M::MatElement: PrimInt
328 + Debug
329 + Display
330 + NumInfo
331 + FromPrimitive
332 + WrappingSub
333 + SampleUniform
334 + From<bool>,
335 NttOp: Ntt<Element = M::MatElement>,
336 RlweModOp: ArithmeticOps<Element = M::MatElement>
337 + VectorOps<Element = M::MatElement>
338 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>
339 + ShoupMatrixFMA<M::R>,
340 LweModOp: ArithmeticOps<Element = M::MatElement>
341 + VectorOps<Element = M::MatElement>
342 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
343 M::R: TryConvertFrom1<[i32], CiphertextModulus<M::MatElement>> + RowEntity + Debug,
344 <M as Matrix>::R: RowMut,
345{
346 pub(super) fn new(parameters: BoolParameters<M::MatElement>) -> Self
347 where
348 RlweModOp: ModInit<M = CiphertextModulus<M::MatElement>>,
349 LweModOp: ModInit<M = CiphertextModulus<M::MatElement>>,
350 NttOp: NttInit<CiphertextModulus<M::MatElement>>,
351 {
352 //TODO(Jay): Run sanity checks for modulus values in parameters
353
354 // generates dlog map s.t. (+/-)g^{k} % q = a, for all a \in Z*_{q} and k \in
355 // [0, q/4). We store the dlog `k` at index `a`. This makes it easier to
356 // simply look up `k` at runtime as vec[a]. If a = g^{k} then dlog is
357 // stored as k. If a = -g^{k} then dlog is stored as k = q/4. This is done to
358 // differentiate sign.
359 let g = parameters.g();
360 let q = *parameters.br_q();
361 let mut g_k_dlog_map = vec![0usize; q];
362 for i in 0..q / 4 {
363 let v = mod_exponent(g as u64, i as u64, q as u64) as usize;
364 // g^i
365 g_k_dlog_map[v] = i;
366 // -(g^i)
367 g_k_dlog_map[q - v] = i + (q / 4);
368 }
369
370 let embedding_factor = (2 * parameters.rlwe_n().0) / q;
371
372 let rlwe_nttop = NttOp::new(parameters.rlwe_q(), parameters.rlwe_n().0);
373 let rlwe_modop = RlweModOp::new(*parameters.rlwe_q());
374 let lwe_modop = LweModOp::new(*parameters.lwe_q());
375
376 let q = *parameters.br_q();
377 let qby2 = q >> 1;
378 let qby8 = q >> 3;
379 // Q/8 (Q: rlwe_q)
380 let true_m_el = parameters.rlwe_q().true_el();
381 // -Q/8
382 let false_m_el = parameters.rlwe_q().false_el();
383 let (auto_map_index, auto_map_sign) = generate_auto_map(qby2, -(g as isize));
384
385 let init_test_vec = |partition_el: usize,
386 before_partition_el: M::MatElement,
387 after_partition_el: M::MatElement| {
388 let mut test_vec = M::R::zeros(qby2);
389 for i in 0..qby2 {
390 if i < partition_el {
391 test_vec.as_mut()[i] = before_partition_el;
392 } else {
393 test_vec.as_mut()[i] = after_partition_el;
394 }
395 }
396
397 // v(X) -> v(X^{-g})
398 let mut test_vec_autog = M::R::zeros(qby2);
399 izip!(
400 test_vec.as_ref().iter(),
401 auto_map_index.iter(),
402 auto_map_sign.iter()
403 )
404 .for_each(|(v, to_index, to_sign)| {
405 if !to_sign {
406 // negate
407 test_vec_autog.as_mut()[*to_index] = rlwe_modop.neg(v);
408 } else {
409 test_vec_autog.as_mut()[*to_index] = *v;
410 }
411 });
412
413 return test_vec_autog;
414 };
415
416 let nand_test_vec = init_test_vec(3 * qby8, true_m_el, false_m_el);
417 let and_test_vec = init_test_vec(3 * qby8, false_m_el, true_m_el);
418 let or_test_vec = init_test_vec(qby8, false_m_el, true_m_el);
419 let nor_test_vec = init_test_vec(qby8, true_m_el, false_m_el);
420 let xor_test_vec = init_test_vec(qby8, false_m_el, true_m_el);
421 let xnor_test_vec = init_test_vec(qby8, true_m_el, false_m_el);
422
423 // auto map indices and sign
424 // Auto maps are stored as [-g, g^{1}, g^{2}, ..., g^{w}]
425 let mut rlwe_auto_maps = vec![];
426 let ring_size = parameters.rlwe_n().0;
427 let g = parameters.g();
428 let br_q = parameters.br_q();
429 let auto_element_dlogs = parameters.auto_element_dlogs();
430 assert!(auto_element_dlogs[0] == 0);
431 for i in auto_element_dlogs.into_iter() {
432 let el = if i == 0 {
433 -(g as isize)
434 } else {
435 (g.pow(i as u32) % br_q) as isize
436 };
437 rlwe_auto_maps.push(generate_auto_map(ring_size, el))
438 }
439
440 let rlwe_qby4 = parameters.rlwe_q().qby4();
441
442 let scratch_memory = ScratchMemory::new(¶meters);
443
444 let pbs_info = BoolPbsInfo {
445 auto_decomposer: parameters.auto_decomposer(),
446 lwe_decomposer: parameters.lwe_decomposer(),
447 rlwe_rgsw_decomposer: parameters.rlwe_rgsw_decomposer(),
448 g_k_dlog_map,
449 embedding_factor,
450 lwe_modop,
451 rlwe_modop,
452 rlwe_nttop,
453 rlwe_qby4,
454 rlwe_auto_maps,
455 parameters: parameters,
456 };
457
458 BoolEvaluator {
459 pbs_info,
460 scratch_memory,
461 nand_test_vec,
462 and_test_vec,
463 or_test_vec,
464 nor_test_vec,
465 xnor_test_vec,
466 xor_test_vec,
467 _phantom: PhantomData,
468 }
469 }
470
471 pub(super) fn client_key(&self) -> ClientKey {
472 let sk_lwe = LweSecret::random(
473 self.pbs_info.parameters.lwe_n().0 >> 1,
474 self.pbs_info.parameters.lwe_n().0,
475 );
476 let sk_rlwe = RlweSecret::random(
477 self.pbs_info.parameters.rlwe_n().0 >> 1,
478 self.pbs_info.parameters.rlwe_n().0,
479 );
480 ClientKey::new(sk_rlwe, sk_lwe)
481 }
482
483 pub(super) fn single_party_server_key(
484 &self,
485 client_key: &ClientKey,
486 ) -> SeededServerKey<M, BoolParameters<M::MatElement>, [u8; 32]> {
487 DefaultSecureRng::with_local_mut(|rng| {
488 let mut main_seed = [0u8; 32];
489 rng.fill_bytes(&mut main_seed);
490
491 let mut main_prng = DefaultSecureRng::new_seeded(main_seed);
492
493 let rlwe_n = self.pbs_info.parameters.rlwe_n().0;
494 let sk_rlwe = client_key.sk_rlwe();
495 let sk_lwe = client_key.sk_lwe();
496
497 // generate auto keys
498 let mut auto_keys = HashMap::new();
499 let auto_gadget = self.pbs_info.auto_decomposer.gadget_vector();
500 let g = self.pbs_info.parameters.g();
501 let br_q = self.pbs_info.parameters.br_q();
502 let auto_els = self.pbs_info.parameters.auto_element_dlogs();
503 for i in auto_els.into_iter() {
504 let g_pow = if i == 0 {
505 -(g as isize)
506 } else {
507 (g.pow(i as u32) % br_q) as isize
508 };
509 let mut gk = M::zeros(self.pbs_info.auto_decomposer.decomposition_count(), rlwe_n);
510 galois_key_gen(
511 &mut gk,
512 sk_rlwe.values(),
513 g_pow,
514 &auto_gadget,
515 &self.pbs_info.rlwe_modop,
516 &self.pbs_info.rlwe_nttop,
517 &mut main_prng,
518 rng,
519 );
520 auto_keys.insert(i, gk);
521 }
522
523 // generate rgsw ciphertexts RGSW(si) where si is i^th LWE secret element
524 let ring_size = self.pbs_info.parameters.rlwe_n().0;
525 let rlwe_q = self.pbs_info.parameters.rlwe_q();
526 let (rlrg_d_a, rlrg_d_b) = (
527 self.pbs_info.rlwe_rgsw_decomposer.0.decomposition_count(),
528 self.pbs_info.rlwe_rgsw_decomposer.1.decomposition_count(),
529 );
530 let rlrg_gadget_a = self.pbs_info.rlwe_rgsw_decomposer.0.gadget_vector();
531 let rlrg_gadget_b = self.pbs_info.rlwe_rgsw_decomposer.1.gadget_vector();
532 let rgsw_cts = sk_lwe
533 .values()
534 .iter()
535 .map(|si| {
536 // X^{si}; assume |emebedding_factor * si| < N
537 let mut m = M::R::zeros(ring_size);
538 let si = (self.pbs_info.embedding_factor as i32) * si;
539 // dbg!(si);
540 if si < 0 {
541 // X^{-i} = X^{2N - i} = -X^{N-i}
542 m.as_mut()[ring_size - (si.abs() as usize)] = rlwe_q.neg_one();
543 } else {
544 // X^{i}
545 m.as_mut()[si.abs() as usize] = M::MatElement::one();
546 }
547
548 let mut rgsw_si = M::zeros(rlrg_d_a * 2 + rlrg_d_b, ring_size);
549 secret_key_encrypt_rgsw(
550 &mut rgsw_si,
551 m.as_ref(),
552 &rlrg_gadget_a,
553 &rlrg_gadget_b,
554 sk_rlwe.values(),
555 &self.pbs_info.rlwe_modop,
556 &self.pbs_info.rlwe_nttop,
557 &mut main_prng,
558 rng,
559 );
560
561 rgsw_si
562 })
563 .collect_vec();
564
565 // LWE KSK from RLWE secret s -> LWE secret z
566 let d_lwe_gadget = self.pbs_info.lwe_decomposer.gadget_vector();
567 let mut lwe_ksk =
568 M::R::zeros(self.pbs_info.lwe_decomposer.decomposition_count() * ring_size);
569 lwe_ksk_keygen(
570 &sk_rlwe.values(),
571 &sk_lwe.values(),
572 &mut lwe_ksk,
573 &d_lwe_gadget,
574 &self.pbs_info.lwe_modop,
575 &mut main_prng,
576 rng,
577 );
578
579 SeededServerKey::from_raw(
580 auto_keys,
581 rgsw_cts,
582 lwe_ksk,
583 self.pbs_info.parameters.clone(),
584 main_seed,
585 )
586 })
587 }
588
589 pub(super) fn multi_party_server_key_share(
590 &self,
591 cr_seed: [u8; 32],
592 collective_pk: &M,
593 client_key: &ClientKey,
594 ) -> CommonReferenceSeededMultiPartyServerKeyShare<M, BoolParameters<M::MatElement>, [u8; 32]>
595 {
596 DefaultSecureRng::with_local_mut(|rng| {
597 let mut main_prng = DefaultSecureRng::new_seeded(cr_seed);
598
599 let sk_rlwe = client_key.sk_rlwe();
600 let sk_lwe = client_key.sk_lwe();
601
602 let g = self.pbs_info.parameters.g();
603 let ring_size = self.pbs_info.parameters.rlwe_n().0;
604 let rlwe_q = self.pbs_info.parameters.rlwe_q();
605 let lwe_q = self.pbs_info.parameters.lwe_q();
606
607 let rlweq_modop = &self.pbs_info.rlwe_modop;
608 let rlweq_nttop = &self.pbs_info.rlwe_nttop;
609
610 // sanity check
611 assert!(sk_rlwe.values().len() == ring_size);
612 assert!(sk_lwe.values().len() == self.pbs_info.parameters.lwe_n().0);
613
614 // auto keys
615 let mut auto_keys = HashMap::new();
616 let auto_gadget = self.pbs_info.auto_decomposer.gadget_vector();
617 let auto_element_dlogs = self.pbs_info.parameters.auto_element_dlogs();
618 let br_q = self.pbs_info.parameters.br_q();
619 for i in auto_element_dlogs.into_iter() {
620 let g_pow = if i == 0 {
621 -(g as isize)
622 } else {
623 (g.pow(i as u32) % br_q) as isize
624 };
625
626 let mut ksk_out = M::zeros(
627 self.pbs_info.auto_decomposer.decomposition_count(),
628 ring_size,
629 );
630 galois_key_gen(
631 &mut ksk_out,
632 sk_rlwe.values(),
633 g_pow,
634 &auto_gadget,
635 rlweq_modop,
636 rlweq_nttop,
637 &mut main_prng,
638 rng,
639 );
640 auto_keys.insert(i, ksk_out);
641 }
642
643 // rgsw ciphertexts of lwe secret elements
644 let rgsw_rgsw_decomposer = self
645 .pbs_info
646 .parameters
647 .rgsw_rgsw_decomposer::<DefaultDecomposer<M::MatElement>>();
648 let (rgrg_d_a, rgrg_d_b) = (
649 rgsw_rgsw_decomposer.0.decomposition_count(),
650 rgsw_rgsw_decomposer.1.decomposition_count(),
651 );
652 let (rgrg_gadget_a, rgrg_gadget_b) = (
653 rgsw_rgsw_decomposer.0.gadget_vector(),
654 rgsw_rgsw_decomposer.1.gadget_vector(),
655 );
656 let rgsw_cts = sk_lwe
657 .values()
658 .iter()
659 .map(|si| {
660 let mut m = M::R::zeros(ring_size);
661 //TODO(Jay): It will be nice to have a function that returns polynomial
662 // (monomial infact!) corresponding to secret element embedded in ring X^{2N+1}.
663 // Save lots of mistakes where one forgest to emebed si in bigger ring.
664 let si = *si * (self.pbs_info.embedding_factor as i32);
665 if si < 0 {
666 // X^{-si} = X^{2N-si} = -X^{N-si}, assuming abs(si) < N
667 // (which it is given si is secret element)
668 m.as_mut()[ring_size - (si.abs() as usize)] = rlwe_q.neg_one();
669 } else {
670 m.as_mut()[si as usize] = M::MatElement::one();
671 }
672
673 // public key RGSW encryption has no part that can be seeded, unlike secret key
674 // RGSW encryption where RLWE'_A(m) is seeded
675 let mut out_rgsw = M::zeros(rgrg_d_a * 2 + rgrg_d_b * 2, ring_size);
676 public_key_encrypt_rgsw(
677 &mut out_rgsw,
678 &m.as_ref(),
679 collective_pk,
680 &rgrg_gadget_a,
681 &rgrg_gadget_b,
682 rlweq_modop,
683 rlweq_nttop,
684 rng,
685 );
686
687 out_rgsw
688 })
689 .collect_vec();
690
691 // LWE ksk
692 let mut lwe_ksk =
693 M::R::zeros(self.pbs_info.lwe_decomposer.decomposition_count() * ring_size);
694 let lwe_modop = &self.pbs_info.lwe_modop;
695 let d_lwe_gadget_vec = self.pbs_info.lwe_decomposer.gadget_vector();
696 lwe_ksk_keygen(
697 sk_rlwe.values(),
698 sk_lwe.values(),
699 &mut lwe_ksk,
700 &d_lwe_gadget_vec,
701 lwe_modop,
702 &mut main_prng,
703 rng,
704 );
705
706 CommonReferenceSeededMultiPartyServerKeyShare::new(
707 rgsw_cts,
708 auto_keys,
709 lwe_ksk,
710 cr_seed,
711 self.pbs_info.parameters.clone(),
712 )
713 })
714 }
715
716 pub(super) fn multi_party_public_key_share(
717 &self,
718 cr_seed: [u8; 32],
719 client_key: &ClientKey,
720 ) -> CommonReferenceSeededCollectivePublicKeyShare<
721 <M as Matrix>::R,
722 [u8; 32],
723 BoolParameters<<M as Matrix>::MatElement>,
724 > {
725 DefaultSecureRng::with_local_mut(|rng| {
726 let mut share_out = M::R::zeros(self.pbs_info.parameters.rlwe_n().0);
727 let modop = &self.pbs_info.rlwe_modop;
728 let nttop = &self.pbs_info.rlwe_nttop;
729 let mut main_prng = DefaultSecureRng::new_seeded(cr_seed);
730 public_key_share(
731 &mut share_out,
732 client_key.sk_rlwe().values(),
733 modop,
734 nttop,
735 &mut main_prng,
736 rng,
737 );
738 CommonReferenceSeededCollectivePublicKeyShare::new(
739 share_out,
740 cr_seed,
741 self.pbs_info.parameters.clone(),
742 )
743 })
744 }
745
746 pub(super) fn multi_party_decryption_share(
747 &self,
748 lwe_ct: &M::R,
749 client_key: &ClientKey,
750 ) -> <M as Matrix>::MatElement {
751 assert!(lwe_ct.as_ref().len() == self.pbs_info.parameters.rlwe_n().0 + 1);
752 let modop = &self.pbs_info.rlwe_modop;
753 let mut neg_s = M::R::try_convert_from(
754 client_key.sk_rlwe().values(),
755 &self.pbs_info.parameters.rlwe_q(),
756 );
757 modop.elwise_neg_mut(neg_s.as_mut());
758
759 let mut neg_sa = M::MatElement::zero();
760 izip!(lwe_ct.as_ref().iter().skip(1), neg_s.as_ref().iter()).for_each(|(ai, nsi)| {
761 neg_sa = modop.add(&neg_sa, &modop.mul(ai, nsi));
762 });
763
764 let e = DefaultSecureRng::with_local_mut(|rng| {
765 let mut e =
766 RandomGaussianElementInModulus::random(rng, self.pbs_info.parameters.rlwe_q());
767 e
768 });
769 let share = modop.add(&neg_sa, &e);
770
771 share
772 }
773
774 pub(crate) fn multi_party_decrypt(&self, shares: &[M::MatElement], lwe_ct: &M::R) -> bool {
775 let modop = &self.pbs_info.rlwe_modop;
776 let mut sum_a = M::MatElement::zero();
777 shares
778 .iter()
779 .for_each(|share_i| sum_a = modop.add(&sum_a, &share_i));
780
781 let encoded_m = modop.add(&lwe_ct.as_ref()[0], &sum_a);
782 self.pbs_info.parameters.rlwe_q().decode(encoded_m)
783 }
784
785 pub(crate) fn pk_encrypt(&self, pk: &M, m: bool) -> M::R {
786 self.pk_encrypt_batched(pk, &vec![m]).remove(0)
787 }
788
789 /// Encrypts a batch booleans as multiple LWE ciphertexts.
790 ///
791 /// For public key encryption we first encrypt `m` as a RLWE ciphertext and
792 /// then sample extract LWE samples at required indices.
793 ///
794 /// - TODO(Jay:) Communication can be improved by not sample exctracting and
795 /// instead just truncate degree 0 values (part Bs)
796 pub(crate) fn pk_encrypt_batched(&self, pk: &M, m: &[bool]) -> Vec<M::R> {
797 DefaultSecureRng::with_local_mut(|rng| {
798 let ring_size = self.pbs_info.parameters.rlwe_n().0;
799 assert!(
800 m.len() <= ring_size,
801 "Cannot batch encrypt > ring_size{ring_size} elements at once"
802 );
803
804 let modop = &self.pbs_info.rlwe_modop;
805 let nttop = &self.pbs_info.rlwe_nttop;
806
807 // RLWE(0)
808 // sample ephemeral key u
809 let mut u = vec![0i32; ring_size];
810 fill_random_ternary_secret_with_hamming_weight(u.as_mut(), ring_size >> 1, rng);
811 let mut u = M::R::try_convert_from(&u, &self.pbs_info.parameters.rlwe_q());
812 nttop.forward(u.as_mut());
813
814 let mut ua = M::R::zeros(ring_size);
815 ua.as_mut().copy_from_slice(pk.get_row_slice(0));
816 let mut ub = M::R::zeros(ring_size);
817 ub.as_mut().copy_from_slice(pk.get_row_slice(1));
818
819 // a*u
820 nttop.forward(ua.as_mut());
821 modop.elwise_mul_mut(ua.as_mut(), u.as_ref());
822 nttop.backward(ua.as_mut());
823
824 // b*u
825 nttop.forward(ub.as_mut());
826 modop.elwise_mul_mut(ub.as_mut(), u.as_ref());
827 nttop.backward(ub.as_mut());
828
829 let mut rlwe = M::zeros(2, ring_size);
830 // sample error
831 rlwe.iter_rows_mut().for_each(|ri| {
832 RandomFillGaussianInModulus::<[M::MatElement], CiphertextModulus<M::MatElement>>::random_fill(
833 rng,
834 &self.pbs_info.parameters.rlwe_q(),
835 ri.as_mut(),
836 );
837 });
838
839 // a*u + e0
840 modop.elwise_add_mut(rlwe.get_row_mut(0), ua.as_ref());
841 // b*u + e1
842 modop.elwise_add_mut(rlwe.get_row_mut(1), ub.as_ref());
843
844 //FIXME(Jay): Figure out a way to get Q/8 form modulus
845 let mut m_vec = M::R::zeros(ring_size);
846 izip!(m_vec.as_mut().iter_mut(), m.iter()).for_each(|(m_el, m_bool)| {
847 if *m_bool {
848 // Q/8
849 *m_el = self.pbs_info.rlwe_q().true_el()
850 } else {
851 // -Q/8
852 *m_el = self.pbs_info.rlwe_q().false_el()
853 }
854 });
855
856 // b*u + e1 + m
857 modop.elwise_add_mut(rlwe.get_row_mut(1), m_vec.as_ref());
858 // rlwe.set(1, 0, modop.add(rlwe.get(1, 0), &m));
859
860 // sample extract index required indices
861 let samples = m.len();
862 (0..samples)
863 .into_iter()
864 .map(|i| {
865 let mut lwe_out = M::R::zeros(ring_size + 1);
866 sample_extract(&mut lwe_out, &rlwe, modop, i);
867 lwe_out
868 })
869 .collect_vec()
870 })
871 }
872
873 /// TODO(Jay): Fetch client key from thread local
874 pub fn sk_encrypt(&self, m: bool, client_key: &ClientKey) -> M::R {
875 //FIXME(Jay): Figure out a way to get Q/8 form modulus
876 let m = if m {
877 // Q/8
878 self.pbs_info.rlwe_q().true_el()
879 } else {
880 // -Q/8
881 self.pbs_info.rlwe_q().false_el()
882 };
883
884 DefaultSecureRng::with_local_mut(|rng| {
885 let mut lwe_out = M::R::zeros(self.pbs_info.parameters.rlwe_n().0 + 1);
886 encrypt_lwe(
887 &mut lwe_out,
888 &m,
889 client_key.sk_rlwe().values(),
890 &self.pbs_info.rlwe_modop,
891 rng,
892 );
893 lwe_out
894 })
895 }
896
897 pub fn sk_decrypt(&self, lwe_ct: &M::R, client_key: &ClientKey) -> bool {
898 let m = decrypt_lwe(
899 lwe_ct,
900 client_key.sk_rlwe().values(),
901 &self.pbs_info.rlwe_modop,
902 );
903 self.pbs_info.rlwe_q().decode(m)
904 }
905
906 pub(super) fn aggregate_multi_party_server_key_shares<S>(
907 &self,
908 shares: &[CommonReferenceSeededMultiPartyServerKeyShare<
909 M,
910 BoolParameters<M::MatElement>,
911 S,
912 >],
913 ) -> SeededMultiPartyServerKey<M, S, BoolParameters<M::MatElement>>
914 where
915 S: PartialEq + Clone,
916 M: Clone,
917 {
918 assert!(shares.len() > 0);
919 let parameters = shares[0].parameters().clone();
920 let cr_seed = shares[0].cr_seed();
921
922 let rlwe_n = parameters.rlwe_n().0;
923 let g = parameters.g() as isize;
924 let rlwe_q = parameters.rlwe_q();
925 let lwe_q = parameters.lwe_q();
926
927 // sanity checks
928 shares.iter().skip(1).for_each(|s| {
929 assert!(s.parameters() == ¶meters);
930 assert!(s.cr_seed() == cr_seed);
931 });
932
933 let rlweq_modop = &self.pbs_info.rlwe_modop;
934 let rlweq_nttop = &self.pbs_info.rlwe_nttop;
935
936 // auto keys
937 let mut auto_keys = HashMap::new();
938 let auto_elements_dlog = parameters.auto_element_dlogs();
939 for i in auto_elements_dlog.into_iter() {
940 let mut key = M::zeros(parameters.auto_decomposition_count().0, rlwe_n);
941
942 shares.iter().for_each(|s| {
943 let auto_key_share_i = s.auto_keys().get(&i).expect("Auto key {i} missing");
944 assert!(
945 auto_key_share_i.dimension()
946 == (parameters.auto_decomposition_count().0, rlwe_n)
947 );
948 izip!(key.iter_rows_mut(), auto_key_share_i.iter_rows()).for_each(
949 |(partb_out, partb_share)| {
950 rlweq_modop.elwise_add_mut(partb_out.as_mut(), partb_share.as_ref());
951 },
952 );
953 });
954
955 auto_keys.insert(i, key);
956 }
957
958 // rgsw ciphertext (most expensive part!)
959 let lwe_n = parameters.lwe_n().0;
960 let rgsw_by_rgsw_decomposer =
961 parameters.rgsw_rgsw_decomposer::<DefaultDecomposer<M::MatElement>>();
962 let mut scratch_matrix = M::zeros(
963 std::cmp::max(
964 rgsw_by_rgsw_decomposer.a().decomposition_count(),
965 rgsw_by_rgsw_decomposer.b().decomposition_count(),
966 ) + (rgsw_by_rgsw_decomposer.a().decomposition_count() * 2
967 + rgsw_by_rgsw_decomposer.b().decomposition_count() * 2),
968 rlwe_n,
969 );
970
971 let mut tmp_rgsw =
972 RgswCiphertext::<M, _>::empty(rlwe_n, &rgsw_by_rgsw_decomposer, rlwe_q.clone()).data;
973 let rgsw_cts = (0..lwe_n).into_iter().map(|index| {
974 // copy over rgsw ciphertext for index^th secret element from first share and
975 // treat it as accumulating rgsw ciphertext
976 let mut rgsw_i = shares[0].rgsw_cts()[index].clone();
977
978 shares.iter().skip(1).for_each(|si| {
979 // copy over si's RGSW[index] ciphertext and send to evaluation domain
980 izip!(tmp_rgsw.iter_rows_mut(), si.rgsw_cts()[index].iter_rows()).for_each(
981 |(to_ri, from_ri)| {
982 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
983 rlweq_nttop.forward(to_ri.as_mut())
984 },
985 );
986
987 rgsw_by_rgsw_inplace(
988 &mut rgsw_i,
989 &tmp_rgsw,
990 &rgsw_by_rgsw_decomposer,
991 &mut scratch_matrix,
992 rlweq_nttop,
993 rlweq_modop,
994 );
995 });
996
997 rgsw_i
998 });
999 // d_a and d_b may differ for RGSWxRGSW multiplication and RLWExRGSW
1000 // multiplication. After this point RGSW ciphertexts will only be used for
1001 // RLWExRGSW multiplication (in blind rotation). Thus we drop any additional
1002 // RLWE ciphertexts in RGSW ciphertexts after RGSw x RGSW multiplication
1003 let (rgswrgsw_d_a, rgswrgsw_d_b) = self.pbs_info.parameters.rgsw_rgsw_decomposition_count();
1004 let (rlrg_d_a, rlrg_d_b) = self.pbs_info.parameters.rlwe_rgsw_decomposition_count();
1005 let rgsw_ct_rows_in = rgswrgsw_d_a.0 * 2 + rgswrgsw_d_b.0 * 2;
1006 let rgsw_ct_rows_out = rlrg_d_a.0 * 2 + rlrg_d_b.0 * 2;
1007 assert!(rgswrgsw_d_a.0 >= rlrg_d_a.0, "RGSWxRGSW part A decomposition count {} must be >= RLWExRGSW part A decomposition count {}", rgswrgsw_d_a.0 , rlrg_d_a.0);
1008 assert!(rgswrgsw_d_b.0 >= rlrg_d_b.0, "RGSWxRGSW part B decomposition count {} must be >= RLWExRGSW part B decomposition count {}", rgswrgsw_d_b.0 , rlrg_d_b.0);
1009 let rgsw_cts = rgsw_cts
1010 .map(|ct_i_in| {
1011 assert!(ct_i_in.dimension() == (rgsw_ct_rows_in, rlwe_n));
1012 let mut reduced_ct_i_out = M::zeros(rgsw_ct_rows_out, rlwe_n);
1013
1014 // RLWE'(-sm) part A
1015 izip!(
1016 reduced_ct_i_out.iter_rows_mut().take(rlrg_d_a.0),
1017 ct_i_in
1018 .iter_rows()
1019 .skip(rgswrgsw_d_a.0 - rlrg_d_a.0)
1020 .take(rlrg_d_a.0)
1021 )
1022 .for_each(|(to_ri, from_ri)| {
1023 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1024 });
1025
1026 // RLWE'(-sm) part B
1027 izip!(
1028 reduced_ct_i_out
1029 .iter_rows_mut()
1030 .skip(rlrg_d_a.0)
1031 .take(rlrg_d_a.0),
1032 ct_i_in
1033 .iter_rows()
1034 .skip(rgswrgsw_d_a.0 + (rgswrgsw_d_a.0 - rlrg_d_a.0))
1035 .take(rlrg_d_a.0)
1036 )
1037 .for_each(|(to_ri, from_ri)| {
1038 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1039 });
1040
1041 // RLWE'(m) Part A
1042 izip!(
1043 reduced_ct_i_out
1044 .iter_rows_mut()
1045 .skip(rlrg_d_a.0 * 2)
1046 .take(rlrg_d_b.0),
1047 ct_i_in
1048 .iter_rows()
1049 .skip(rgswrgsw_d_a.0 * 2 + (rgswrgsw_d_b.0 - rlrg_d_b.0))
1050 .take(rlrg_d_b.0)
1051 )
1052 .for_each(|(to_ri, from_ri)| {
1053 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1054 });
1055
1056 // RLWE'(m) Part B
1057 izip!(
1058 reduced_ct_i_out
1059 .iter_rows_mut()
1060 .skip(rlrg_d_a.0 * 2 + rlrg_d_b.0)
1061 .take(rlrg_d_b.0),
1062 ct_i_in
1063 .iter_rows()
1064 .skip(rgswrgsw_d_a.0 * 2 + rgswrgsw_d_b.0 + (rgswrgsw_d_b.0 - rlrg_d_b.0))
1065 .take(rlrg_d_b.0)
1066 )
1067 .for_each(|(to_ri, from_ri)| {
1068 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1069 });
1070
1071 reduced_ct_i_out
1072 })
1073 .collect_vec();
1074
1075 // LWE ksks
1076 let mut lwe_ksk = M::R::zeros(rlwe_n * parameters.lwe_decomposition_count().0);
1077 let lweq_modop = &self.pbs_info.lwe_modop;
1078 shares.iter().for_each(|si| {
1079 assert!(si.lwe_ksk().as_ref().len() == rlwe_n * parameters.lwe_decomposition_count().0);
1080 lweq_modop.elwise_add_mut(lwe_ksk.as_mut(), si.lwe_ksk().as_ref())
1081 });
1082
1083 SeededMultiPartyServerKey::new(rgsw_cts, auto_keys, lwe_ksk, cr_seed.clone(), parameters)
1084 }
1085}
1086
1087impl<M, NttOp, RlweModOp, LweModOp, Skey> BoolEvaluator<M, NttOp, RlweModOp, LweModOp, Skey>
1088where
1089 M: MatrixMut + MatrixEntity,
1090 M::R: RowMut + RowEntity,
1091 M::MatElement: PrimInt + FromPrimitive + One + Copy + Zero + Display + WrappingSub + NumInfo,
1092 RlweModOp: VectorOps<Element = M::MatElement> + ArithmeticOps<Element = M::MatElement>,
1093 LweModOp: VectorOps<Element = M::MatElement> + ArithmeticOps<Element = M::MatElement>,
1094 NttOp: Ntt<Element = M::MatElement>,
1095{
1096 /// Returns c0 + c1 + Q/4
1097 fn _add_and_shift_lwe_cts(&self, c0: &mut M::R, c1: &M::R) {
1098 let modop = &self.pbs_info.rlwe_modop;
1099 modop.elwise_add_mut(c0.as_mut(), c1.as_ref());
1100 // +Q/4
1101 c0.as_mut()[0] = modop.add(&c0.as_ref()[0], &self.pbs_info.rlwe_qby4);
1102 }
1103
1104 /// Returns 2(c0 - c1) + Q/4
1105 fn _subtract_double_lwe_cts(&self, c0: &mut M::R, c1: &M::R) {
1106 let modop = &self.pbs_info.rlwe_modop;
1107 // c0 - c1
1108 modop.elwise_sub_mut(c0.as_mut(), c1.as_ref());
1109
1110 // double
1111 c0.as_mut().iter_mut().for_each(|v| *v = modop.add(v, v));
1112 }
1113}
1114
1115impl<M, NttOp, RlweModOp, LweModOp, Skey> BooleanGates
1116 for BoolEvaluator<M, NttOp, RlweModOp, LweModOp, Skey>
1117where
1118 M: MatrixMut + MatrixEntity,
1119 M::R: RowMut + RowEntity + Clone,
1120 M::MatElement:
1121 PrimInt + FromPrimitive + One + Copy + Zero + Display + WrappingSub + NumInfo + From<bool>,
1122 RlweModOp: VectorOps<Element = M::MatElement>
1123 + ArithmeticOps<Element = M::MatElement>
1124 + ShoupMatrixFMA<M::R>,
1125 LweModOp: VectorOps<Element = M::MatElement> + ArithmeticOps<Element = M::MatElement>,
1126 NttOp: Ntt<Element = M::MatElement>,
1127 Skey: PbsKey<AutoKey = <Skey as PbsKey>::RgswCt, LweKskKey = M>,
1128 <Skey as PbsKey>::RgswCt: WithShoupRepr<M = M>,
1129{
1130 type Ciphertext = M::R;
1131 type Key = Skey;
1132
1133 fn nand_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1134 self._add_and_shift_lwe_cts(c0, c1);
1135
1136 // PBS
1137 pbs(
1138 &self.pbs_info,
1139 &self.nand_test_vec,
1140 c0,
1141 server_key,
1142 &mut self.scratch_memory.lwe_vector,
1143 &mut self.scratch_memory.decomposition_matrix,
1144 );
1145 }
1146
1147 fn and_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1148 self._add_and_shift_lwe_cts(c0, c1);
1149
1150 // PBS
1151 pbs(
1152 &self.pbs_info,
1153 &self.and_test_vec,
1154 c0,
1155 server_key,
1156 &mut self.scratch_memory.lwe_vector,
1157 &mut self.scratch_memory.decomposition_matrix,
1158 );
1159 }
1160
1161 fn or_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1162 self._add_and_shift_lwe_cts(c0, c1);
1163
1164 // PBS
1165 pbs(
1166 &self.pbs_info,
1167 &self.or_test_vec,
1168 c0,
1169 server_key,
1170 &mut self.scratch_memory.lwe_vector,
1171 &mut self.scratch_memory.decomposition_matrix,
1172 );
1173 }
1174
1175 fn nor_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1176 self._add_and_shift_lwe_cts(c0, c1);
1177
1178 // PBS
1179 pbs(
1180 &self.pbs_info,
1181 &self.nor_test_vec,
1182 c0,
1183 server_key,
1184 &mut self.scratch_memory.lwe_vector,
1185 &mut self.scratch_memory.decomposition_matrix,
1186 )
1187 }
1188
1189 fn xor_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1190 self._subtract_double_lwe_cts(c0, c1);
1191
1192 // PBS
1193 pbs(
1194 &self.pbs_info,
1195 &self.xor_test_vec,
1196 c0,
1197 server_key,
1198 &mut self.scratch_memory.lwe_vector,
1199 &mut self.scratch_memory.decomposition_matrix,
1200 );
1201 }
1202
1203 fn xnor_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1204 self._subtract_double_lwe_cts(c0, c1);
1205
1206 // PBS
1207 pbs(
1208 &self.pbs_info,
1209 &self.xnor_test_vec,
1210 c0,
1211 server_key,
1212 &mut self.scratch_memory.lwe_vector,
1213 &mut self.scratch_memory.decomposition_matrix,
1214 );
1215 }
1216
1217 fn not_inplace(&mut self, c0: &mut M::R) {
1218 let modop = &self.pbs_info.rlwe_modop;
1219 c0.as_mut().iter_mut().for_each(|v| *v = modop.neg(v));
1220 }
1221
1222 fn and(
1223 &mut self,
1224 c0: &Self::Ciphertext,
1225 c1: &Self::Ciphertext,
1226 key: &Self::Key,
1227 ) -> Self::Ciphertext {
1228 let mut out = c0.clone();
1229 self.and_inplace(&mut out, c1, key);
1230 out
1231 }
1232
1233 fn nand(
1234 &mut self,
1235 c0: &Self::Ciphertext,
1236 c1: &Self::Ciphertext,
1237 key: &Self::Key,
1238 ) -> Self::Ciphertext {
1239 let mut out = c0.clone();
1240 self.nand_inplace(&mut out, c1, key);
1241 out
1242 }
1243
1244 fn or(
1245 &mut self,
1246 c0: &Self::Ciphertext,
1247 c1: &Self::Ciphertext,
1248 key: &Self::Key,
1249 ) -> Self::Ciphertext {
1250 let mut out = c0.clone();
1251 self.or_inplace(&mut out, c1, key);
1252 out
1253 }
1254
1255 fn nor(
1256 &mut self,
1257 c0: &Self::Ciphertext,
1258 c1: &Self::Ciphertext,
1259 key: &Self::Key,
1260 ) -> Self::Ciphertext {
1261 let mut out = c0.clone();
1262 self.nor_inplace(&mut out, c1, key);
1263 out
1264 }
1265
1266 fn xnor(
1267 &mut self,
1268 c0: &Self::Ciphertext,
1269 c1: &Self::Ciphertext,
1270 key: &Self::Key,
1271 ) -> Self::Ciphertext {
1272 let mut out = c0.clone();
1273 self.xnor_inplace(&mut out, c1, key);
1274 out
1275 }
1276
1277 fn xor(
1278 &mut self,
1279 c0: &Self::Ciphertext,
1280 c1: &Self::Ciphertext,
1281 key: &Self::Key,
1282 ) -> Self::Ciphertext {
1283 let mut out = c0.clone();
1284 self.xor_inplace(&mut out, c1, key);
1285 out
1286 }
1287
1288 fn not(&mut self, c: &Self::Ciphertext) -> Self::Ciphertext {
1289 let mut out = c.clone();
1290 self.not_inplace(&mut out);
1291 out
1292 }
1293}
1294
1295#[cfg(test)]
1296mod tests {
1297 use bool::parameters::{MP_BOOL_PARAMS, SP_BOOL_PARAMS};
1298 use rand::{thread_rng, Rng};
1299 use rand_distr::Uniform;
1300
1301 use crate::{
1302 backend::{GetModulus, ModInit, ModularOpsU64, WordSizeModulus},
1303 bool::{
1304 self, CommonReferenceSeededMultiPartyServerKeyShare, PublicKey,
1305 SeededMultiPartyServerKey,
1306 },
1307 ntt::NttBackendU64,
1308 random::{RandomElementInModulus, DEFAULT_RNG},
1309 rgsw::{
1310 self, measure_noise, public_key_encrypt_rlwe, secret_key_encrypt_rlwe,
1311 tests::{_measure_noise_rgsw, _sk_encrypt_rlwe},
1312 RgswCiphertext, RgswCiphertextEvaluationDomain, SeededRgswCiphertext,
1313 SeededRlweCiphertext,
1314 },
1315 utils::{negacyclic_mul, Stats},
1316 };
1317
1318 use super::*;
1319
1320 #[test]
1321 fn bool_encrypt_decrypt_works() {
1322 let bool_evaluator = BoolEvaluator::<
1323 Vec<Vec<u64>>,
1324 NttBackendU64,
1325 ModularOpsU64<CiphertextModulus<u64>>,
1326 ModularOpsU64<CiphertextModulus<u64>>,
1327 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1328 >::new(SP_BOOL_PARAMS);
1329 let client_key = bool_evaluator.client_key();
1330
1331 let mut m = true;
1332 for _ in 0..1000 {
1333 let lwe_ct = bool_evaluator.sk_encrypt(m, &client_key);
1334 let m_back = bool_evaluator.sk_decrypt(&lwe_ct, &client_key);
1335 assert_eq!(m, m_back);
1336 m = !m;
1337 }
1338 }
1339
1340 #[test]
1341 fn bool_nand() {
1342 let mut bool_evaluator = BoolEvaluator::<
1343 Vec<Vec<u64>>,
1344 NttBackendU64,
1345 ModularOpsU64<CiphertextModulus<u64>>,
1346 ModularOpsU64<CiphertextModulus<u64>>,
1347 ShoupServerKeyEvaluationDomain<_>,
1348 >::new(SP_BOOL_PARAMS);
1349
1350 // println!("{:?}", bool_evaluator.nand_test_vec);
1351 let client_key = bool_evaluator.client_key();
1352 let seeded_server_key = bool_evaluator.single_party_server_key(&client_key);
1353 let runtime_server_key =
1354 ShoupServerKeyEvaluationDomain::from(ServerKeyEvaluationDomain::<
1355 _,
1356 _,
1357 DefaultSecureRng,
1358 NttBackendU64,
1359 >::from(&seeded_server_key));
1360
1361 let mut m0 = false;
1362 let mut m1 = true;
1363
1364 let mut ct0 = bool_evaluator.sk_encrypt(m0, &client_key);
1365 let mut ct1 = bool_evaluator.sk_encrypt(m1, &client_key);
1366
1367 for _ in 0..500 {
1368 let ct_back = bool_evaluator.nand(&ct0, &ct1, &runtime_server_key);
1369
1370 let m_out = !(m0 && m1);
1371
1372 let m_back = bool_evaluator.sk_decrypt(&ct_back, &client_key);
1373 assert!(m_out == m_back, "Expected {m_out}, got {m_back}");
1374
1375 m1 = m0;
1376 m0 = m_out;
1377
1378 ct1 = ct0;
1379 ct0 = ct_back;
1380 }
1381 }
1382
1383 #[test]
1384 fn bool_xor() {
1385 let mut bool_evaluator = BoolEvaluator::<
1386 Vec<Vec<u64>>,
1387 NttBackendU64,
1388 ModularOpsU64<CiphertextModulus<u64>>,
1389 ModularOpsU64<CiphertextModulus<u64>>,
1390 ShoupServerKeyEvaluationDomain<_>,
1391 >::new(SP_BOOL_PARAMS);
1392
1393 // println!("{:?}", bool_evaluator.nand_test_vec);
1394 let client_key = bool_evaluator.client_key();
1395 let seeded_server_key = bool_evaluator.single_party_server_key(&client_key);
1396 let runtime_server_key =
1397 ShoupServerKeyEvaluationDomain::from(ServerKeyEvaluationDomain::<
1398 _,
1399 _,
1400 DefaultSecureRng,
1401 NttBackendU64,
1402 >::from(&seeded_server_key));
1403
1404 let mut m0 = false;
1405 let mut m1 = true;
1406
1407 let mut ct0 = bool_evaluator.sk_encrypt(m0, &client_key);
1408 let mut ct1 = bool_evaluator.sk_encrypt(m1, &client_key);
1409
1410 for _ in 0..1000 {
1411 let ct_back = bool_evaluator.xor(&ct0, &ct1, &runtime_server_key);
1412 let m_out = (m0 ^ m1);
1413
1414 let m_back = bool_evaluator.sk_decrypt(&ct_back, &client_key);
1415 assert!(m_out == m_back, "Expected {m_out}, got {m_back}");
1416
1417 m1 = m0;
1418 m0 = m_out;
1419
1420 ct1 = ct0;
1421 ct0 = ct_back;
1422 }
1423 }
1424
1425 #[test]
1426 fn multi_party_encryption_decryption() {
1427 let bool_evaluator = BoolEvaluator::<
1428 Vec<Vec<u64>>,
1429 NttBackendU64,
1430 ModularOpsU64<CiphertextModulus<u64>>,
1431 ModularOpsU64<CiphertextModulus<u64>>,
1432 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1433 >::new(MP_BOOL_PARAMS);
1434
1435 let no_of_parties = 500;
1436 let parties = (0..no_of_parties)
1437 .map(|_| bool_evaluator.client_key())
1438 .collect_vec();
1439
1440 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1441 parties.iter().for_each(|k| {
1442 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1443 *ideal_i = *ideal_i + s_i;
1444 });
1445 });
1446
1447 let mut m = true;
1448 for i in 0..100 {
1449 let pk_cr_seed = [0u8; 32];
1450
1451 let public_key_share = parties
1452 .iter()
1453 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1454 .collect_vec();
1455
1456 let collective_pk = PublicKey::<
1457 Vec<Vec<u64>>,
1458 DefaultSecureRng,
1459 ModularOpsU64<CiphertextModulus<u64>>,
1460 >::from(public_key_share.as_slice());
1461 let lwe_ct = bool_evaluator.pk_encrypt(collective_pk.key(), m);
1462
1463 let decryption_shares = parties
1464 .iter()
1465 .map(|k| bool_evaluator.multi_party_decryption_share(&lwe_ct, k))
1466 .collect_vec();
1467
1468 let m_back = bool_evaluator.multi_party_decrypt(&decryption_shares, &lwe_ct);
1469
1470 {
1471 let ideal_m = if m {
1472 bool_evaluator.pbs_info.parameters.rlwe_q().true_el()
1473 } else {
1474 bool_evaluator.pbs_info.parameters.rlwe_q().false_el()
1475 };
1476 let noise = measure_noise_lwe(
1477 &lwe_ct,
1478 &ideal_rlwe_sk,
1479 &bool_evaluator.pbs_info.rlwe_modop,
1480 &ideal_m,
1481 );
1482 println!("Noise: {noise}");
1483 }
1484
1485 assert_eq!(m_back, m);
1486 m = !m;
1487 }
1488 }
1489
1490 fn _collecitve_public_key_gen(rlwe_q: u64, parties_rlwe_sk: &[RlweSecret]) -> Vec<Vec<u64>> {
1491 let ring_size = parties_rlwe_sk[0].values.len();
1492 assert!(ring_size.is_power_of_two());
1493 let mut rng = DefaultSecureRng::new();
1494 let nttop = NttBackendU64::new(&rlwe_q, ring_size);
1495 let modop = ModularOpsU64::new(rlwe_q);
1496
1497 // Generate Pk shares
1498 let pk_seed = [0u8; 32];
1499 let pk_shares = parties_rlwe_sk.iter().map(|sk| {
1500 let mut p_rng = DefaultSecureRng::new_seeded(pk_seed);
1501 let mut share_out = vec![0u64; ring_size];
1502 public_key_share(
1503 &mut share_out,
1504 sk.values(),
1505 &modop,
1506 &nttop,
1507 &mut p_rng,
1508 &mut rng,
1509 );
1510 share_out
1511 });
1512
1513 let mut pk_part_b = vec![0u64; ring_size];
1514 pk_shares.for_each(|share| modop.elwise_add_mut(&mut pk_part_b, &share));
1515 let mut pk_part_a = vec![0u64; ring_size];
1516 let mut p_rng = DefaultSecureRng::new_seeded(pk_seed);
1517 RandomFillUniformInModulus::random_fill(&mut p_rng, &rlwe_q, pk_part_a.as_mut_slice());
1518
1519 vec![pk_part_a, pk_part_b]
1520 }
1521
1522 fn _multi_party_all_keygen(
1523 bool_evaluator: &BoolEvaluator<
1524 Vec<Vec<u64>>,
1525 NttBackendU64,
1526 ModularOpsU64<CiphertextModulus<u64>>,
1527 ModularOpsU64<CiphertextModulus<u64>>,
1528 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1529 >,
1530 no_of_parties: usize,
1531 ) -> (
1532 Vec<ClientKey>,
1533 PublicKey<Vec<Vec<u64>>, DefaultSecureRng, ModularOpsU64<CiphertextModulus<u64>>>,
1534 Vec<
1535 CommonReferenceSeededMultiPartyServerKeyShare<
1536 Vec<Vec<u64>>,
1537 BoolParameters<u64>,
1538 [u8; 32],
1539 >,
1540 >,
1541 SeededMultiPartyServerKey<Vec<Vec<u64>>, [u8; 32], BoolParameters<u64>>,
1542 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1543 ClientKey,
1544 ) {
1545 let parties = (0..no_of_parties)
1546 .map(|_| bool_evaluator.client_key())
1547 .collect_vec();
1548
1549 let mut rng = DefaultSecureRng::new();
1550
1551 // Collective public key
1552 let mut pk_cr_seed = [0u8; 32];
1553 rng.fill_bytes(&mut pk_cr_seed);
1554 let public_key_share = parties
1555 .iter()
1556 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1557 .collect_vec();
1558 let collective_pk =
1559 PublicKey::<Vec<Vec<u64>>, DefaultSecureRng, _>::from(public_key_share.as_slice());
1560
1561 // Server key
1562 let mut pbs_cr_seed = [0u8; 32];
1563 rng.fill_bytes(&mut pbs_cr_seed);
1564 let server_key_shares = parties
1565 .iter()
1566 .map(|k| {
1567 bool_evaluator.multi_party_server_key_share(pbs_cr_seed, &collective_pk.key(), k)
1568 })
1569 .collect_vec();
1570 let seeded_server_key =
1571 bool_evaluator.aggregate_multi_party_server_key_shares(&server_key_shares);
1572 let runtime_server_key =
1573 ShoupServerKeyEvaluationDomain::from(ServerKeyEvaluationDomain::<
1574 _,
1575 _,
1576 DefaultSecureRng,
1577 NttBackendU64,
1578 >::from(&seeded_server_key));
1579
1580 // construct ideal rlwe sk for meauring noise
1581 let ideal_client_key = {
1582 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1583 parties.iter().for_each(|k| {
1584 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1585 *ideal_i = *ideal_i + s_i;
1586 });
1587 });
1588 let mut ideal_lwe_sk = vec![0i32; bool_evaluator.pbs_info.lwe_n()];
1589 parties.iter().for_each(|k| {
1590 izip!(ideal_lwe_sk.iter_mut(), k.sk_lwe().values()).for_each(|(ideal_i, s_i)| {
1591 *ideal_i = *ideal_i + s_i;
1592 });
1593 });
1594
1595 ClientKey::new(
1596 RlweSecret {
1597 values: ideal_rlwe_sk,
1598 },
1599 LweSecret {
1600 values: ideal_lwe_sk,
1601 },
1602 )
1603 };
1604
1605 (
1606 parties,
1607 collective_pk,
1608 server_key_shares,
1609 seeded_server_key,
1610 runtime_server_key,
1611 ideal_client_key,
1612 )
1613 }
1614
1615 #[test]
1616 fn multi_party_nand() {
1617 let mut bool_evaluator = BoolEvaluator::<
1618 Vec<Vec<u64>>,
1619 NttBackendU64,
1620 ModularOpsU64<CiphertextModulus<u64>>,
1621 ModularOpsU64<CiphertextModulus<u64>>,
1622 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1623 >::new(MP_BOOL_PARAMS);
1624
1625 let (parties, collective_pk, _, _, server_key_eval, ideal_client_key) =
1626 _multi_party_all_keygen(&bool_evaluator, 2);
1627
1628 let mut m0 = true;
1629 let mut m1 = false;
1630
1631 let mut lwe0 = bool_evaluator.pk_encrypt(collective_pk.key(), m0);
1632 let mut lwe1 = bool_evaluator.pk_encrypt(collective_pk.key(), m1);
1633
1634 for _ in 0..2000 {
1635 let lwe_out = bool_evaluator.nand(&lwe0, &lwe1, &server_key_eval);
1636
1637 let m_expected = !(m0 & m1);
1638
1639 // multi-party decrypt
1640 let decryption_shares = parties
1641 .iter()
1642 .map(|k| bool_evaluator.multi_party_decryption_share(&lwe_out, k))
1643 .collect_vec();
1644 let m_back = bool_evaluator.multi_party_decrypt(&decryption_shares, &lwe_out);
1645
1646 let m_back = bool_evaluator.sk_decrypt(&lwe_out, &ideal_client_key);
1647
1648 assert!(
1649 m_expected == m_back,
1650 "Expected {m_expected}, got
1651{m_back}"
1652 );
1653 m1 = m0;
1654 m0 = m_expected;
1655
1656 lwe1 = lwe0;
1657 lwe0 = lwe_out;
1658 }
1659 }
1660
1661 #[test]
1662 fn noise_tester() {
1663 let bool_evaluator = BoolEvaluator::<
1664 Vec<Vec<u64>>,
1665 NttBackendU64,
1666 ModularOpsU64<CiphertextModulus<u64>>,
1667 ModularOpsU64<CiphertextModulus<u64>>,
1668 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1669 >::new(SP_BOOL_PARAMS);
1670
1671 // let (_, collective_pk, _, _, server_key_eval, ideal_client_key) =
1672 // _multi_party_all_keygen(&bool_evaluator, 20);
1673 let no_of_parties = 2;
1674 let lwe_q = bool_evaluator.pbs_info.parameters.lwe_q();
1675 let rlwe_q = bool_evaluator.pbs_info.parameters.rlwe_q();
1676 let lwe_n = bool_evaluator.pbs_info.parameters.lwe_n().0;
1677 let rlwe_n = bool_evaluator.pbs_info.parameters.rlwe_n().0;
1678 let lwe_modop = &bool_evaluator.pbs_info.lwe_modop;
1679 let rlwe_nttop = &bool_evaluator.pbs_info.rlwe_nttop;
1680 let rlwe_modop = &bool_evaluator.pbs_info.rlwe_modop;
1681
1682 // let rgsw_rgsw_decomposer = &bool_evaluator
1683 // .pbs_info
1684 // .parameters
1685 // .rgsw_rgsw_decomposer::<DefaultDecomposer<u64>>();
1686 // let rgsw_rgsw_gadget_a = rgsw_rgsw_decomposer.0.gadget_vector();
1687 // let rgsw_rgsw_gadget_b = rgsw_rgsw_decomposer.1.gadget_vector();
1688
1689 let rlwe_rgsw_decomposer = &bool_evaluator.pbs_info.rlwe_rgsw_decomposer;
1690 let rlwe_rgsw_gadget_a = rlwe_rgsw_decomposer.0.gadget_vector();
1691 let rlwe_rgsw_gadget_b = rlwe_rgsw_decomposer.1.gadget_vector();
1692
1693 let auto_decomposer = &bool_evaluator.pbs_info.auto_decomposer;
1694 let auto_gadget = auto_decomposer.gadget_vector();
1695
1696 let parties = (0..no_of_parties)
1697 .map(|_| bool_evaluator.client_key())
1698 .collect_vec();
1699
1700 let ideal_client_key = {
1701 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1702 parties.iter().for_each(|k| {
1703 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1704 *ideal_i = *ideal_i + s_i;
1705 });
1706 });
1707 let mut ideal_lwe_sk = vec![0i32; bool_evaluator.pbs_info.lwe_n()];
1708 parties.iter().for_each(|k| {
1709 izip!(ideal_lwe_sk.iter_mut(), k.sk_lwe().values()).for_each(|(ideal_i, s_i)| {
1710 *ideal_i = *ideal_i + s_i;
1711 });
1712 });
1713
1714 ClientKey::new(
1715 RlweSecret {
1716 values: ideal_rlwe_sk,
1717 },
1718 LweSecret {
1719 values: ideal_lwe_sk,
1720 },
1721 )
1722 };
1723
1724 // check noise in freshly encrypted RLWE ciphertext (ie var_fresh)
1725 if true {
1726 let mut rng = DefaultSecureRng::new();
1727 let mut check = Stats { samples: vec![] };
1728 for _ in 0..10 {
1729 // generate a new collective public key
1730 let mut pk_cr_seed = [0u8; 32];
1731 rng.fill_bytes(&mut pk_cr_seed);
1732 let public_key_share = parties
1733 .iter()
1734 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1735 .collect_vec();
1736 let collective_pk = PublicKey::<
1737 Vec<Vec<u64>>,
1738 DefaultSecureRng,
1739 ModularOpsU64<CiphertextModulus<u64>>,
1740 >::from(public_key_share.as_slice());
1741
1742 let mut m = vec![0u64; rlwe_n];
1743 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
1744 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1745 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
1746 &mut rlwe_ct,
1747 collective_pk.key(),
1748 &m,
1749 rlwe_modop,
1750 rlwe_nttop,
1751 &mut rng,
1752 );
1753
1754 let mut m_back = vec![0u64; rlwe_n];
1755 decrypt_rlwe(
1756 &rlwe_ct,
1757 ideal_client_key.sk_rlwe().values(),
1758 &mut m_back,
1759 rlwe_nttop,
1760 rlwe_modop,
1761 );
1762
1763 rlwe_modop.elwise_sub_mut(m_back.as_mut_slice(), m.as_slice());
1764
1765 check.add_more(Vec::<i64>::try_convert_from(&m_back, rlwe_q).as_slice());
1766 }
1767
1768 println!("Public key Std: {}", check.std_dev().abs().log2());
1769 }
1770
1771 if true {
1772 // Generate server key shares
1773 let mut rng = DefaultSecureRng::new();
1774 let mut pk_cr_seed = [0u8; 32];
1775 rng.fill_bytes(&mut pk_cr_seed);
1776 let public_key_share = parties
1777 .iter()
1778 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1779 .collect_vec();
1780 let collective_pk = PublicKey::<
1781 Vec<Vec<u64>>,
1782 DefaultSecureRng,
1783 ModularOpsU64<CiphertextModulus<u64>>,
1784 >::from(public_key_share.as_slice());
1785
1786 let pbs_cr_seed = [0u8; 32];
1787 rng.fill_bytes(&mut pk_cr_seed);
1788 let server_key_shares = parties
1789 .iter()
1790 .map(|k| {
1791 bool_evaluator.multi_party_server_key_share(pbs_cr_seed, collective_pk.key(), k)
1792 })
1793 .collect_vec();
1794
1795 let seeded_server_key =
1796 bool_evaluator.aggregate_multi_party_server_key_shares(&server_key_shares);
1797
1798 // Check noise in RGSW ciphertexts of ideal LWE secret elements
1799 if false {
1800 let mut check = Stats { samples: vec![] };
1801 izip!(
1802 ideal_client_key.sk_lwe().values.iter(),
1803 seeded_server_key.rgsw_cts().iter()
1804 )
1805 .for_each(|(s_i, rgsw_ct_i)| {
1806 // X^{s[i]}
1807 let mut m_si = vec![0u64; rlwe_n];
1808 let s_i = *s_i * (bool_evaluator.pbs_info.embedding_factor as i32);
1809 if s_i < 0 {
1810 m_si[rlwe_n - (s_i.abs() as usize)] = rlwe_q.neg_one();
1811 } else {
1812 m_si[s_i as usize] = 1;
1813 }
1814
1815 // RLWE'(-sm)
1816 let mut neg_s_eval =
1817 Vec::<u64>::try_convert_from(ideal_client_key.sk_rlwe().values(), rlwe_q);
1818 rlwe_modop.elwise_neg_mut(&mut neg_s_eval);
1819 rlwe_nttop.forward(&mut neg_s_eval);
1820 for j in 0..rlwe_rgsw_decomposer.a().decomposition_count() {
1821 // RLWE(B^{j} * -s[X]*X^{s_lwe[i]})
1822
1823 // -s[X]*X^{s_lwe[i]}*B_j
1824 let mut m_ideal = m_si.clone();
1825 rlwe_nttop.forward(m_ideal.as_mut_slice());
1826 rlwe_modop.elwise_mul_mut(m_ideal.as_mut_slice(), neg_s_eval.as_slice());
1827 rlwe_nttop.backward(m_ideal.as_mut_slice());
1828 rlwe_modop
1829 .elwise_scalar_mul_mut(m_ideal.as_mut_slice(), &rlwe_rgsw_gadget_a[j]);
1830
1831 // RLWE(-s*X^{s_lwe[i]}*B_j)
1832 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1833 rlwe_ct[0].copy_from_slice(&rgsw_ct_i[j]);
1834 rlwe_ct[1].copy_from_slice(
1835 &rgsw_ct_i[j + rlwe_rgsw_decomposer.a().decomposition_count()],
1836 );
1837
1838 let mut m_back = vec![0u64; rlwe_n];
1839 decrypt_rlwe(
1840 &rlwe_ct,
1841 ideal_client_key.sk_rlwe().values(),
1842 &mut m_back,
1843 rlwe_nttop,
1844 rlwe_modop,
1845 );
1846
1847 // diff
1848 rlwe_modop.elwise_sub_mut(&mut m_back, &m_ideal);
1849 check.add_more(&Vec::<i64>::try_convert_from(&m_back, rlwe_q));
1850 }
1851
1852 // RLWE'(m)
1853 for j in 0..rlwe_rgsw_decomposer.b().decomposition_count() {
1854 // RLWE(B^{j} * X^{s_lwe[i]})
1855
1856 // X^{s_lwe[i]}*B_j
1857 let mut m_ideal = m_si.clone();
1858 rlwe_modop
1859 .elwise_scalar_mul_mut(m_ideal.as_mut_slice(), &rlwe_rgsw_gadget_b[j]);
1860
1861 // RLWE(X^{s_lwe[i]}*B_j)
1862 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1863 rlwe_ct[0].copy_from_slice(
1864 &rgsw_ct_i[j + (2 * rlwe_rgsw_decomposer.a().decomposition_count())],
1865 );
1866 rlwe_ct[1].copy_from_slice(
1867 &rgsw_ct_i[j
1868 + (2 * rlwe_rgsw_decomposer.a().decomposition_count()
1869 + rlwe_rgsw_decomposer.b().decomposition_count())],
1870 );
1871
1872 let mut m_back = vec![0u64; rlwe_n];
1873 decrypt_rlwe(
1874 &rlwe_ct,
1875 ideal_client_key.sk_rlwe().values(),
1876 &mut m_back,
1877 rlwe_nttop,
1878 rlwe_modop,
1879 );
1880
1881 // diff
1882 rlwe_modop.elwise_sub_mut(&mut m_back, &m_ideal);
1883 check.add_more(&Vec::<i64>::try_convert_from(&m_back, rlwe_q));
1884 }
1885 });
1886 println!(
1887 "RGSW Std: {} {} ;; max={}",
1888 check.mean(),
1889 check.std_dev().abs().log2(),
1890 check.samples.iter().max().unwrap()
1891 );
1892 }
1893
1894 // server key in Evaluation domain
1895 let runtime_server_key =
1896 ShoupServerKeyEvaluationDomain::from(ServerKeyEvaluationDomain::<
1897 _,
1898 _,
1899 DefaultSecureRng,
1900 NttBackendU64,
1901 >::from(&seeded_server_key));
1902
1903 // check noise in RLWE x RGSW(X^{s_i}) where RGSW is accunulated RGSW ciphertext
1904 if false {
1905 let mut check = Stats { samples: vec![] };
1906
1907 ideal_client_key
1908 .sk_lwe()
1909 .values()
1910 .iter()
1911 .enumerate()
1912 .for_each(|(index, s_i)| {
1913 let rgsw_ct_i = runtime_server_key.rgsw_ct_lwe_si(index).as_ref();
1914
1915 let mut m = vec![0u64; rlwe_n];
1916 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
1917 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1918 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
1919 &mut rlwe_ct,
1920 collective_pk.key(),
1921 &m,
1922 rlwe_modop,
1923 rlwe_nttop,
1924 &mut rng,
1925 );
1926
1927 let mut rlwe_after = RlweCiphertext::<_, DefaultSecureRng> {
1928 data: rlwe_ct.clone(),
1929 is_trivial: false,
1930 _phatom: PhantomData,
1931 };
1932 let mut scratch = vec![
1933 vec![0u64; rlwe_n];
1934 std::cmp::max(
1935 rlwe_rgsw_decomposer.0.decomposition_count(),
1936 rlwe_rgsw_decomposer.1.decomposition_count()
1937 ) + 2
1938 ];
1939 rlwe_by_rgsw(
1940 &mut rlwe_after,
1941 rgsw_ct_i,
1942 &mut scratch,
1943 rlwe_rgsw_decomposer,
1944 rlwe_nttop,
1945 rlwe_modop,
1946 );
1947
1948 // m1 = X^{s[i]}
1949 let mut m1 = vec![0u64; rlwe_n];
1950 let s_i = *s_i * (bool_evaluator.pbs_info.embedding_factor as i32);
1951 if s_i < 0 {
1952 m1[rlwe_n - (s_i.abs() as usize)] = rlwe_q.neg_one()
1953 } else {
1954 m1[s_i as usize] = 1;
1955 }
1956
1957 // (m+e) * m1
1958 let mut m_plus_e_times_m1 = vec![0u64; rlwe_n];
1959 decrypt_rlwe(
1960 &rlwe_ct,
1961 ideal_client_key.sk_rlwe().values(),
1962 &mut m_plus_e_times_m1,
1963 rlwe_nttop,
1964 rlwe_modop,
1965 );
1966 rlwe_nttop.forward(m_plus_e_times_m1.as_mut_slice());
1967 rlwe_nttop.forward(m1.as_mut_slice());
1968
1969 rlwe_modop.elwise_mul_mut(m_plus_e_times_m1.as_mut_slice(), m1.as_slice());
1970 rlwe_nttop.backward(m_plus_e_times_m1.as_mut_slice());
1971
1972 // Resulting RLWE ciphertext will equal: (m0m1 + em1) + e_{rlsw x rgsw}.
1973 // Hence, resulting rlwe ciphertext will have error em1 + e_{rlwe x rgsw}.
1974 // Here we're only concerned with e_{rlwe x rgsw}, that is noise added by
1975 // RLWExRGSW. Also note in practice m1 is a monomial, for ex, X^{s_{i}}, for
1976 // some i and var(em1) = var(e).
1977 let mut m_plus_e_times_m1_more_e = vec![0u64; rlwe_n];
1978 decrypt_rlwe(
1979 &rlwe_after,
1980 ideal_client_key.sk_rlwe().values(),
1981 &mut m_plus_e_times_m1_more_e,
1982 rlwe_nttop,
1983 rlwe_modop,
1984 );
1985
1986 // diff
1987 rlwe_modop.elwise_sub_mut(
1988 m_plus_e_times_m1_more_e.as_mut_slice(),
1989 m_plus_e_times_m1.as_slice(),
1990 );
1991
1992 // let noise = measure_noise(
1993 // &rlwe_after,
1994 // &m_plus_e_times_m1,
1995 // rlwe_nttop,
1996 // rlwe_modop,
1997 // ideal_client_key.sk_rlwe.values(),
1998 // );
1999 // print!("NOISE: {}", noise);
2000
2001 check.add_more(&Vec::<i64>::try_convert_from(
2002 &m_plus_e_times_m1_more_e,
2003 rlwe_q,
2004 ));
2005 });
2006 println!(
2007 "RLWE x RGSW, where RGSW has noise var_brk, std: {} {}",
2008 check.std_dev(),
2009 check.std_dev().abs().log2()
2010 )
2011 }
2012
2013 // check noise in Auto key
2014 if false {
2015 let mut check = Stats { samples: vec![] };
2016
2017 let mut neg_s_poly =
2018 Vec::<u64>::try_convert_from(ideal_client_key.sk_rlwe().values(), rlwe_q);
2019 rlwe_modop.elwise_neg_mut(neg_s_poly.as_mut_slice());
2020
2021 let g = bool_evaluator.pbs_info.g();
2022 let br_q = bool_evaluator.pbs_info.br_q();
2023 let auto_element_dlogs = bool_evaluator.pbs_info.parameters.auto_element_dlogs();
2024 for i in auto_element_dlogs.into_iter() {
2025 let g_pow = if i == 0 {
2026 -g
2027 } else {
2028 (((g as usize).pow(i as u32)) % br_q) as isize
2029 };
2030
2031 // -s[X^k]
2032 let (auto_indices, auto_sign) = generate_auto_map(rlwe_n, g_pow);
2033 let mut neg_s_poly_auto_i = vec![0u64; rlwe_n];
2034 izip!(neg_s_poly.iter(), auto_indices.iter(), auto_sign.iter()).for_each(
2035 |(v, to_i, to_sign)| {
2036 if !to_sign {
2037 neg_s_poly_auto_i[*to_i] = rlwe_modop.neg(v);
2038 } else {
2039 neg_s_poly_auto_i[*to_i] = *v;
2040 }
2041 },
2042 );
2043
2044 let mut auto_key_i = runtime_server_key.galois_key_for_auto(i).as_ref().clone(); //send i^th auto key to coefficient domain
2045 auto_key_i
2046 .iter_mut()
2047 .for_each(|r| rlwe_nttop.backward(r.as_mut_slice()));
2048 auto_gadget.iter().enumerate().for_each(|(i, b_i)| {
2049 // B^i * -s[X^k]
2050 let mut m_ideal = neg_s_poly_auto_i.clone();
2051
2052 rlwe_modop.elwise_scalar_mul_mut(m_ideal.as_mut_slice(), b_i);
2053
2054 let mut m_out = vec![0u64; rlwe_n];
2055 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
2056 rlwe_ct[0].copy_from_slice(&auto_key_i[i]);
2057 rlwe_ct[1].copy_from_slice(
2058 &auto_key_i[auto_decomposer.decomposition_count() + i],
2059 );
2060 decrypt_rlwe(
2061 &rlwe_ct,
2062 ideal_client_key.sk_rlwe().values(),
2063 &mut m_out,
2064 rlwe_nttop,
2065 rlwe_modop,
2066 );
2067
2068 // diff
2069 rlwe_modop.elwise_sub_mut(m_out.as_mut_slice(), m_ideal.as_slice());
2070
2071 check.add_more(&Vec::<i64>::try_convert_from(&m_out, rlwe_q));
2072 });
2073 }
2074
2075 println!("Auto key noise std dev: {}", check.std_dev().abs().log2());
2076 }
2077
2078 // check noise in RLWE(X^k) after sending RLWE(X) -> RLWE(X^k)using collective
2079 // auto key
2080 if true {
2081 let mut check = Stats { samples: vec![] };
2082 let br_q = bool_evaluator.pbs_info.br_q();
2083 let g = bool_evaluator.pbs_info.g();
2084 let auto_element_dlogs = bool_evaluator.pbs_info.parameters.auto_element_dlogs();
2085 for i in auto_element_dlogs.into_iter() {
2086 for _ in 0..10 {
2087 let mut m = vec![0u64; rlwe_n];
2088 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
2089 let mut rlwe_ct = RlweCiphertext::<_, DefaultSecureRng> {
2090 data: vec![vec![0u64; rlwe_n]; 2],
2091 is_trivial: false,
2092 _phatom: PhantomData,
2093 };
2094 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
2095 &mut rlwe_ct,
2096 collective_pk.key(),
2097 &m,
2098 rlwe_modop,
2099 rlwe_nttop,
2100 &mut rng,
2101 );
2102
2103 // We're only interested in noise increased as a result of automorphism.
2104 // Hence, we take m+e as the bench.
2105 let mut m_plus_e = vec![0u64; rlwe_n];
2106 decrypt_rlwe(
2107 &rlwe_ct,
2108 ideal_client_key.sk_rlwe().values(),
2109 &mut m_plus_e,
2110 rlwe_nttop,
2111 rlwe_modop,
2112 );
2113
2114 let auto_key = runtime_server_key.galois_key_for_auto(i).as_ref();
2115 let (auto_map_index, auto_map_sign) =
2116 bool_evaluator.pbs_info.rlwe_auto_map(i);
2117 let mut scratch =
2118 vec![vec![0u64; rlwe_n]; auto_decomposer.decomposition_count() + 2];
2119 galois_auto(
2120 &mut rlwe_ct,
2121 auto_key,
2122 &mut scratch,
2123 &auto_map_index,
2124 &auto_map_sign,
2125 rlwe_modop,
2126 rlwe_nttop,
2127 auto_decomposer,
2128 );
2129
2130 // send m+e from X to X^k
2131 let mut m_plus_e_auto = vec![0u64; rlwe_n];
2132 izip!(m_plus_e.iter(), auto_map_index.iter(), auto_map_sign.iter())
2133 .for_each(|(v, to_index, to_sign)| {
2134 if !to_sign {
2135 m_plus_e_auto[*to_index] = rlwe_modop.neg(v);
2136 } else {
2137 m_plus_e_auto[*to_index] = *v
2138 }
2139 });
2140
2141 let mut m_out = vec![0u64; rlwe_n];
2142 decrypt_rlwe(
2143 &rlwe_ct,
2144 ideal_client_key.sk_rlwe().values(),
2145 &mut m_out,
2146 rlwe_nttop,
2147 rlwe_modop,
2148 );
2149
2150 // diff
2151 rlwe_modop.elwise_sub_mut(m_out.as_mut_slice(), m_plus_e_auto.as_slice());
2152
2153 check.add_more(&Vec::<i64>::try_convert_from(m_out.as_slice(), rlwe_q));
2154 }
2155 }
2156
2157 println!("Rlwe Auto Noise Std: {}", check.std_dev().abs().log2());
2158 }
2159
2160 // Check noise growth in ksk
2161 // TODO check in LWE key switching keys
2162 if true {
2163 // 1. encrypt LWE ciphertext
2164 // 2. Key switching
2165 // 3.
2166 let mut check = Stats { samples: vec![] };
2167
2168 for _ in 0..1024 {
2169 // Encrypt m \in Q_{ks} using RLWE sk
2170 let mut lwe_in_ct = vec![0u64; rlwe_n + 1];
2171 let m = RandomElementInModulus::random(&mut rng, &lwe_q.q().unwrap());
2172 encrypt_lwe(
2173 &mut lwe_in_ct,
2174 &m,
2175 ideal_client_key.sk_rlwe().values(),
2176 lwe_modop,
2177 &mut rng,
2178 );
2179
2180 // Key switch
2181 let mut lwe_out = vec![0u64; lwe_n + 1];
2182 lwe_key_switch(
2183 &mut lwe_out,
2184 &lwe_in_ct,
2185 runtime_server_key.lwe_ksk(),
2186 lwe_modop,
2187 bool_evaluator.pbs_info.lwe_decomposer(),
2188 );
2189
2190 // We only care about noise added by LWE key switch
2191 // m+e
2192 let m_plus_e =
2193 decrypt_lwe(&lwe_in_ct, ideal_client_key.sk_rlwe().values(), lwe_modop);
2194
2195 let m_plus_e_plus_lwe_ksk_noise =
2196 decrypt_lwe(&lwe_out, ideal_client_key.sk_lwe().values(), lwe_modop);
2197
2198 let diff = lwe_modop.sub(&m_plus_e_plus_lwe_ksk_noise, &m_plus_e);
2199
2200 check.add_more(&vec![lwe_q.map_element_to_i64(&diff)]);
2201 }
2202
2203 println!("Lwe ksk std dev: {}", check.std_dev().abs().log2());
2204 }
2205 }
2206
2207 // Check noise in fresh RGSW ciphertexts, ie X^{s_j[i]}, must equalnoise in
2208 // // fresh RLWE ciphertext
2209 if true {}
2210 // test LWE ksk from RLWE -> LWE
2211 // if false {
2212 // let logp = 2;
2213 // let mut rng = DefaultSecureRng::new();
2214
2215 // let m = 1;
2216 // let encoded_m = m << (lwe_logq - logp);
2217
2218 // // Encrypt
2219 // let mut lwe_ct = vec![0u64; rlwe_n + 1];
2220 // encrypt_lwe(
2221 // &mut lwe_ct,
2222 // &encoded_m,
2223 // ideal_client_key.sk_rlwe.values(),
2224 // lwe_modop,
2225 // &mut rng,
2226 // );
2227
2228 // // key switch
2229 // let lwe_decomposer = &bool_evaluator.decomposer_lwe;
2230 // let mut lwe_out = vec![0u64; lwe_n + 1];
2231 // lwe_key_switch(
2232 // &mut lwe_out,
2233 // &lwe_ct,
2234 // &server_key_eval.lwe_ksk,
2235 // lwe_modop,
2236 // lwe_decomposer,
2237 // );
2238
2239 // let encoded_m_back = decrypt_lwe(&lwe_out,
2240 // ideal_client_key.sk_lwe.values(), lwe_modop); let m_back
2241 // = ((encoded_m_back as f64 * (1 << logp) as f64) /
2242 // (lwe_q as f64)).round() as u64; dbg!(m_back, m);
2243
2244 // let noise = measure_noise_lwe(
2245 // &lwe_out,
2246 // ideal_client_key.sk_lwe.values(),
2247 // lwe_modop,
2248 // &encoded_m,
2249 // );
2250
2251 // println!("Noise: {noise}");
2252 // }
2253
2254 // Measure noise in RGSW ciphertexts of ideal LWE secrets
2255 // if true {
2256 // let gadget_vec = gadget_vector(
2257 // bool_evaluator.parameters.rlwe_logq,
2258 // bool_evaluator.parameters.logb_rgsw,
2259 // bool_evaluator.parameters.d_rgsw,
2260 // );
2261
2262 // for i in 0..20 {
2263 // // measure noise in RGSW(s[i])
2264 // let si =
2265 // ideal_client_key.sk_lwe.values[i] *
2266 // (bool_evaluator.embedding_factor as i32); let mut
2267 // si_poly = vec![0u64; rlwe_n]; if si < 0 {
2268 // si_poly[rlwe_n - (si.abs() as usize)] = rlwe_q - 1;
2269 // } else {
2270 // si_poly[(si.abs() as usize)] = 1;
2271 // }
2272
2273 // let mut rgsw_si = server_key_eval.rgsw_cts[i].clone();
2274 // rgsw_si
2275 // .iter_mut()
2276 // .for_each(|ri| rlwe_nttop.backward(ri.as_mut()));
2277
2278 // println!("####### Noise in RGSW(X^s_{i}) #######");
2279 // _measure_noise_rgsw(
2280 // &rgsw_si,
2281 // &si_poly,
2282 // ideal_client_key.sk_rlwe.values(),
2283 // &gadget_vec,
2284 // rlwe_q,
2285 // );
2286 // println!("####### ##################### #######");
2287 // }
2288 // }
2289
2290 // // measure noise grwoth in RLWExRGSW
2291 // if true {
2292 // let mut rng = DefaultSecureRng::new();
2293 // let mut carry_m = vec![0u64; rlwe_n];
2294 // RandomUniformDist1::random_fill(&mut rng, &rlwe_q,
2295 // carry_m.as_mut_slice());
2296
2297 // // RGSW(carrym)
2298 // let trivial_rlwect = vec![vec![0u64; rlwe_n],carry_m.clone()];
2299 // let mut rlwe_ct = RlweCiphertext::<_,
2300 // DefaultSecureRng>::from_raw(trivial_rlwect, true);
2301
2302 // let mut scratch_matrix_dplus2_ring = vec![vec![0u64; rlwe_n];
2303 // d_rgsw + 2]; let mul_mod =
2304 // |v0: &u64, v1: &u64| (((*v0 as u128 * *v1 as u128) % (rlwe_q as u128)) as u64);
2305
2306 // for i in 0..bool_evaluator.parameters.lwe_n {
2307 // rlwe_by_rgsw(
2308 // &mut rlwe_ct,
2309 // server_key_eval.rgsw_ct_lwe_si(i),
2310 // &mut scratch_matrix_dplus2_ring,
2311 // rlwe_decomposer,
2312 // rlwe_nttop,
2313 // rlwe_modop,
2314 // );
2315
2316 // // carry_m[X] * s_i[X]
2317 // let si =
2318 // ideal_client_key.sk_lwe.values[i] *
2319 // (bool_evaluator.embedding_factor as i32); let mut
2320 // si_poly = vec![0u64; rlwe_n]; if si < 0 {
2321 // si_poly[rlwe_n - (si.abs() as usize)] = rlwe_q - 1;
2322 // } else {
2323 // si_poly[(si.abs() as usize)] = 1;
2324 // }
2325 // carry_m = negacyclic_mul(&carry_m, &si_poly, mul_mod,
2326 // rlwe_q);
2327
2328 // let noise = measure_noise(
2329 // &rlwe_ct,
2330 // &carry_m,
2331 // rlwe_nttop,
2332 // rlwe_modop,
2333 // ideal_client_key.sk_rlwe.values(),
2334 // );
2335 // println!("Noise RLWE(carry_m) accumulating {i}^th secret
2336 // monomial: {noise}"); }
2337 // }
2338
2339 // // Check galois keys
2340 // if false {
2341 // let g = bool_evaluator.g() as isize;
2342 // let mut rng = DefaultSecureRng::new();
2343 // let mut scratch_matrix_dplus2_ring = vec![vec![0u64; rlwe_n];
2344 // d_rgsw + 2]; for i in [g, -g] {
2345 // let mut m = vec![0u64; rlwe_n];
2346 // RandomUniformDist1::random_fill(&mut rng, &rlwe_q,
2347 // m.as_mut_slice()); let mut rlwe_ct = {
2348 // let mut data = vec![vec![0u64; rlwe_n]; 2];
2349 // public_key_encrypt_rlwe(
2350 // &mut data,
2351 // &collective_pk.key,
2352 // &m,
2353 // rlwe_modop,
2354 // rlwe_nttop,
2355 // &mut rng,
2356 // );
2357 // RlweCiphertext::<_, DefaultSecureRng>::from_raw(data,
2358 // false) };
2359
2360 // let auto_key = server_key_eval.galois_key_for_auto(i);
2361 // let (auto_map_index, auto_map_sign) =
2362 // generate_auto_map(rlwe_n, i); galois_auto(
2363 // &mut rlwe_ct,
2364 // auto_key,
2365 // &mut scratch_matrix_dplus2_ring,
2366 // &auto_map_index,
2367 // &auto_map_sign,
2368 // rlwe_modop,
2369 // rlwe_nttop,
2370 // rlwe_decomposer,
2371 // );
2372
2373 // // send m(X) -> m(X^i)
2374 // let mut m_k = vec![0u64; rlwe_n];
2375 // izip!(m.iter(), auto_map_index.iter(),
2376 // auto_map_sign.iter()).for_each( |(mi, to_index,to_sign)|
2377 // // { if !to_sign {
2378 // m_k[*to_index] = rlwe_q - *mi; } else {
2379 // m_k[*to_index] = *mi;
2380 // }
2381 // },
2382 // );
2383
2384 // // measure noise
2385 // let noise = measure_noise(
2386 // &rlwe_ct,
2387 // &m_k,
2388 // rlwe_nttop,
2389 // rlwe_modop,
2390 // ideal_client_key.sk_rlwe.values(),
2391 // );
2392
2393 // println!("Noise after auto k={i}: {noise}");
2394 // }
2395 // }
2396 }
2397}