phantom-zone/src/bool/evaluator.rs
src/bool/evaluator.rsRaw
1use std::{
2 borrow::BorrowMut,
3 cell::{OnceCell, RefCell},
4 clone,
5 collections::HashMap,
6 fmt::{Debug, Display},
7 iter::Once,
8 marker::PhantomData,
9 ops::Shr,
10 sync::OnceLock,
11};
12
13use itertools::{izip, partition, Itertools};
14use num_traits::{FromPrimitive, Num, One, Pow, PrimInt, ToPrimitive, WrappingSub, Zero};
15use rand_distr::uniform::SampleUniform;
16
17use crate::{
18 backend::{ArithmeticOps, GetModulus, ModInit, ModularOpsU64, Modulus, VectorOps},
19 decomposer::{Decomposer, DefaultDecomposer, NumInfo, RlweDecomposer},
20 lwe::{decrypt_lwe, encrypt_lwe, lwe_key_switch, lwe_ksk_keygen, measure_noise_lwe, LweSecret},
21 multi_party::public_key_share,
22 ntt::{self, Ntt, NttBackendU64, NttInit},
23 pbs::{pbs, sample_extract, PbsInfo, PbsKey},
24 random::{
25 DefaultSecureRng, NewWithSeed, RandomFill, RandomFillGaussianInModulus,
26 RandomFillUniformInModulus, RandomGaussianElementInModulus,
27 },
28 rgsw::{
29 decrypt_rlwe, galois_auto, galois_key_gen, generate_auto_map, public_key_encrypt_rgsw,
30 rgsw_by_rgsw_inplace, rlwe_by_rgsw, secret_key_encrypt_rgsw, IsTrivial, RgswCiphertext,
31 RlweCiphertext, RlweSecret,
32 },
33 utils::{
34 fill_random_ternary_secret_with_hamming_weight, generate_prime, mod_exponent, Global,
35 TryConvertFrom1, WithLocal,
36 },
37 Decryptor, Encryptor, Matrix, MatrixEntity, MatrixMut, MultiPartyDecryptor, Row, RowEntity,
38 RowMut, Secret,
39};
40
41use super::{
42 keys::ClientKey,
43 parameters::{BoolParameters, CiphertextModulus},
44 CommonReferenceSeededCollectivePublicKeyShare, CommonReferenceSeededMultiPartyServerKeyShare,
45 SeededMultiPartyServerKey, SeededServerKey, ServerKeyEvaluationDomain,
46};
47
48pub struct MultiPartyCrs<S> {
49 pub(super) seed: S,
50}
51
52impl<S: Default + Copy> MultiPartyCrs<S> {
53 /// Seed to generate public key share using MultiPartyCrs as the main seed.
54 ///
55 /// Public key seed equals the 1st seed extracted from PRNG Seeded with
56 /// MiltiPartyCrs's seed.
57 pub(super) fn public_key_share_seed<Rng: NewWithSeed<Seed = S> + RandomFill<S>>(&self) -> S {
58 let mut prng = Rng::new_with_seed(self.seed);
59
60 let mut seed = S::default();
61 RandomFill::<S>::random_fill(&mut prng, &mut seed);
62 seed
63 }
64
65 /// Seed to generate server key share using MultiPartyCrs as the main seed.
66 ///
67 /// Server key seed equals the 2nd seed extracted from PRNG Seeded with
68 /// MiltiPartyCrs's seed.
69 pub(super) fn server_key_share_seed<Rng: NewWithSeed<Seed = S> + RandomFill<S>>(&self) -> S {
70 let mut prng = Rng::new_with_seed(self.seed);
71
72 let mut seed = S::default();
73 RandomFill::<S>::random_fill(&mut prng, &mut seed);
74 RandomFill::<S>::random_fill(&mut prng, &mut seed);
75 seed
76 }
77}
78
79pub(crate) trait BooleanGates {
80 type Ciphertext: RowEntity;
81 type Key;
82
83 fn and_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
84 fn nand_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
85 fn or_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
86 fn nor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
87 fn xor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
88 fn xnor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
89 fn not_inplace(&mut self, c: &mut Self::Ciphertext);
90
91 fn and(
92 &mut self,
93 c0: &Self::Ciphertext,
94 c1: &Self::Ciphertext,
95 key: &Self::Key,
96 ) -> Self::Ciphertext;
97 fn nand(
98 &mut self,
99 c0: &Self::Ciphertext,
100 c1: &Self::Ciphertext,
101 key: &Self::Key,
102 ) -> Self::Ciphertext;
103 fn or(
104 &mut self,
105 c0: &Self::Ciphertext,
106 c1: &Self::Ciphertext,
107 key: &Self::Key,
108 ) -> Self::Ciphertext;
109 fn nor(
110 &mut self,
111 c0: &Self::Ciphertext,
112 c1: &Self::Ciphertext,
113 key: &Self::Key,
114 ) -> Self::Ciphertext;
115 fn xor(
116 &mut self,
117 c0: &Self::Ciphertext,
118 c1: &Self::Ciphertext,
119 key: &Self::Key,
120 ) -> Self::Ciphertext;
121 fn xnor(
122 &mut self,
123 c0: &Self::Ciphertext,
124 c1: &Self::Ciphertext,
125 key: &Self::Key,
126 ) -> Self::Ciphertext;
127 fn not(&mut self, c: &Self::Ciphertext) -> Self::Ciphertext;
128}
129
130struct ScratchMemory<M>
131where
132 M: Matrix,
133{
134 lwe_vector: M::R,
135 decomposition_matrix: M,
136}
137
138impl<M: MatrixEntity> ScratchMemory<M>
139where
140 M::R: RowEntity,
141{
142 fn new(parameters: &BoolParameters<M::MatElement>) -> Self {
143 // Vector to store LWE ciphertext with LWE dimesnion n
144 let lwe_vector = M::R::zeros(parameters.lwe_n().0 + 1);
145
146 // Matrix to store decomposed polynomials
147 // Max decompistion count + space for temporary RLWE
148 let d = std::cmp::max(
149 parameters.auto_decomposition_count().0,
150 std::cmp::max(
151 parameters.rlwe_rgsw_decomposition_count().0 .0,
152 parameters.rlwe_rgsw_decomposition_count().1 .0,
153 ),
154 ) + 2;
155 let decomposition_matrix = M::zeros(d, parameters.rlwe_n().0);
156
157 Self {
158 lwe_vector,
159 decomposition_matrix,
160 }
161 }
162}
163
164pub(super) trait BoolEncoding {
165 type Element;
166 fn true_el(&self) -> Self::Element;
167 fn false_el(&self) -> Self::Element;
168 fn qby4(&self) -> Self::Element;
169 fn decode(&self, m: Self::Element) -> bool;
170}
171
172impl<T> BoolEncoding for CiphertextModulus<T>
173where
174 CiphertextModulus<T>: Modulus<Element = T>,
175 T: PrimInt,
176{
177 type Element = T;
178
179 fn qby4(&self) -> Self::Element {
180 if self.is_native() {
181 T::one() << (CiphertextModulus::<T>::_bits() - 2)
182 } else {
183 self.q().unwrap() >> 2
184 }
185 }
186 /// Q/8
187 fn true_el(&self) -> Self::Element {
188 if self.is_native() {
189 T::one() << (CiphertextModulus::<T>::_bits() - 3)
190 } else {
191 self.q().unwrap() >> 3
192 }
193 }
194 /// -Q/8
195 fn false_el(&self) -> Self::Element {
196 self.largest_unsigned_value() - self.true_el() + T::one()
197 }
198 fn decode(&self, m: Self::Element) -> bool {
199 let qby8 = self.true_el();
200 let m = (((m + qby8).to_f64().unwrap() * 4.0f64) / self.q_as_f64().unwrap()).round()
201 as usize
202 % 4usize;
203
204 if m == 0 {
205 return false;
206 } else if m == 1 {
207 return true;
208 } else {
209 panic!("Incorrect bool decryption. Got m={m} but expected m to be 0 or 1")
210 }
211 }
212}
213
214pub(super) struct BoolPbsInfo<M: Matrix, Ntt, RlweModOp, LweModOp> {
215 auto_decomposer: DefaultDecomposer<M::MatElement>,
216 rlwe_rgsw_decomposer: (
217 DefaultDecomposer<M::MatElement>,
218 DefaultDecomposer<M::MatElement>,
219 ),
220 lwe_decomposer: DefaultDecomposer<M::MatElement>,
221 g_k_dlog_map: Vec<usize>,
222 rlwe_nttop: Ntt,
223 rlwe_modop: RlweModOp,
224 lwe_modop: LweModOp,
225 embedding_factor: usize,
226 rlwe_qby4: M::MatElement,
227 rlwe_auto_maps: Vec<(Vec<usize>, Vec<bool>)>,
228 parameters: BoolParameters<M::MatElement>,
229}
230
231impl<M: Matrix, NttOp, RlweModOp, LweModOp> PbsInfo for BoolPbsInfo<M, NttOp, RlweModOp, LweModOp>
232where
233 M::MatElement: PrimInt + WrappingSub + NumInfo + FromPrimitive,
234 RlweModOp: ArithmeticOps<Element = M::MatElement> + VectorOps<Element = M::MatElement>,
235 LweModOp: ArithmeticOps<Element = M::MatElement> + VectorOps<Element = M::MatElement>,
236 NttOp: Ntt<Element = M::MatElement>,
237{
238 type Modulus = CiphertextModulus<M::MatElement>;
239 type Element = M::MatElement;
240 type D = DefaultDecomposer<M::MatElement>;
241 type RlweModOp = RlweModOp;
242 type LweModOp = LweModOp;
243 type NttOp = NttOp;
244 fn rlwe_auto_map(&self, k: usize) -> &(Vec<usize>, Vec<bool>) {
245 &self.rlwe_auto_maps[k]
246 }
247 fn br_q(&self) -> usize {
248 *self.parameters.br_q()
249 }
250 fn lwe_decomposer(&self) -> &Self::D {
251 &self.lwe_decomposer
252 }
253 fn rlwe_rgsw_decomposer(&self) -> &(Self::D, Self::D) {
254 &self.rlwe_rgsw_decomposer
255 }
256 fn auto_decomposer(&self) -> &Self::D {
257 &self.auto_decomposer
258 }
259 fn embedding_factor(&self) -> usize {
260 self.embedding_factor
261 }
262 fn g(&self) -> isize {
263 self.parameters.g() as isize
264 }
265 fn w(&self) -> usize {
266 self.parameters.w()
267 }
268 fn g_k_dlog_map(&self) -> &[usize] {
269 &self.g_k_dlog_map
270 }
271 fn lwe_n(&self) -> usize {
272 self.parameters.lwe_n().0
273 }
274 fn lwe_q(&self) -> &Self::Modulus {
275 self.parameters.lwe_q()
276 }
277 fn rlwe_n(&self) -> usize {
278 self.parameters.rlwe_n().0
279 }
280 fn rlwe_q(&self) -> &Self::Modulus {
281 self.parameters.rlwe_q()
282 }
283 fn modop_lweq(&self) -> &Self::LweModOp {
284 &self.lwe_modop
285 }
286 fn modop_rlweq(&self) -> &Self::RlweModOp {
287 &self.rlwe_modop
288 }
289 fn nttop_rlweq(&self) -> &Self::NttOp {
290 &self.rlwe_nttop
291 }
292}
293
294pub(crate) struct BoolEvaluator<M, Ntt, RlweModOp, LweModOp>
295where
296 M: Matrix,
297{
298 pbs_info: BoolPbsInfo<M, Ntt, RlweModOp, LweModOp>,
299 scratch_memory: ScratchMemory<M>,
300 nand_test_vec: M::R,
301 and_test_vec: M::R,
302 or_test_vec: M::R,
303 nor_test_vec: M::R,
304 xor_test_vec: M::R,
305 xnor_test_vec: M::R,
306 _phantom: PhantomData<M>,
307}
308
309impl<M: Matrix, NttOp, RlweModOp, LweModOp> BoolEvaluator<M, NttOp, RlweModOp, LweModOp> {
310 pub(super) fn parameters(&self) -> &BoolParameters<M::MatElement> {
311 &self.pbs_info.parameters
312 }
313
314 pub(super) fn pbs_info(&self) -> &BoolPbsInfo<M, NttOp, RlweModOp, LweModOp> {
315 &self.pbs_info
316 }
317}
318
319impl<M: Matrix, NttOp, RlweModOp, LweModOp> BoolEvaluator<M, NttOp, RlweModOp, LweModOp>
320where
321 M: MatrixEntity + MatrixMut,
322 M::MatElement:
323 PrimInt + Debug + Display + NumInfo + FromPrimitive + WrappingSub + SampleUniform,
324 NttOp: Ntt<Element = M::MatElement>,
325 RlweModOp: ArithmeticOps<Element = M::MatElement>
326 + VectorOps<Element = M::MatElement>
327 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
328 LweModOp: ArithmeticOps<Element = M::MatElement>
329 + VectorOps<Element = M::MatElement>
330 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
331 M::R: TryConvertFrom1<[i32], CiphertextModulus<M::MatElement>> + RowEntity + Debug,
332 <M as Matrix>::R: RowMut,
333{
334 pub(super) fn new(parameters: BoolParameters<M::MatElement>) -> Self
335 where
336 RlweModOp: ModInit<M = CiphertextModulus<M::MatElement>>,
337 LweModOp: ModInit<M = CiphertextModulus<M::MatElement>>,
338 NttOp: NttInit<CiphertextModulus<M::MatElement>>,
339 {
340 //TODO(Jay): Run sanity checks for modulus values in parameters
341
342 // generates dlog map s.t. (+/-)g^{k} % q = a, for all a \in Z*_{q} and k \in
343 // [0, q/4). We store the dlog `k` at index `a`. This makes it easier to
344 // simply look up `k` at runtime as vec[a]. If a = g^{k} then dlog is
345 // stored as k. If a = -g^{k} then dlog is stored as k = q/4. This is done to
346 // differentiate sign.
347 let g = parameters.g();
348 let q = *parameters.br_q();
349 let mut g_k_dlog_map = vec![0usize; q];
350 for i in 0..q / 4 {
351 let v = mod_exponent(g as u64, i as u64, q as u64) as usize;
352 // g^i
353 g_k_dlog_map[v] = i;
354 // -(g^i)
355 g_k_dlog_map[q - v] = i + (q / 4);
356 }
357
358 let embedding_factor = (2 * parameters.rlwe_n().0) / q;
359
360 let rlwe_nttop = NttOp::new(parameters.rlwe_q(), parameters.rlwe_n().0);
361 let rlwe_modop = RlweModOp::new(*parameters.rlwe_q());
362 let lwe_modop = LweModOp::new(*parameters.lwe_q());
363
364 let q = *parameters.br_q();
365 let qby2 = q >> 1;
366 let qby8 = q >> 3;
367 // Q/8 (Q: rlwe_q)
368 let true_m_el = parameters.rlwe_q().true_el();
369 // -Q/8
370 let false_m_el = parameters.rlwe_q().false_el();
371 let (auto_map_index, auto_map_sign) = generate_auto_map(qby2, -(g as isize));
372
373 let init_test_vec = |partition_el: usize,
374 before_partition_el: M::MatElement,
375 after_partition_el: M::MatElement| {
376 let mut test_vec = M::R::zeros(qby2);
377 for i in 0..qby2 {
378 if i < partition_el {
379 test_vec.as_mut()[i] = before_partition_el;
380 } else {
381 test_vec.as_mut()[i] = after_partition_el;
382 }
383 }
384
385 // v(X) -> v(X^{-g})
386 let mut test_vec_autog = M::R::zeros(qby2);
387 izip!(
388 test_vec.as_ref().iter(),
389 auto_map_index.iter(),
390 auto_map_sign.iter()
391 )
392 .for_each(|(v, to_index, to_sign)| {
393 if !to_sign {
394 // negate
395 test_vec_autog.as_mut()[*to_index] = rlwe_modop.neg(v);
396 } else {
397 test_vec_autog.as_mut()[*to_index] = *v;
398 }
399 });
400
401 return test_vec_autog;
402 };
403
404 let nand_test_vec = init_test_vec(3 * qby8, true_m_el, false_m_el);
405 let and_test_vec = init_test_vec(3 * qby8, false_m_el, true_m_el);
406 let or_test_vec = init_test_vec(qby8, false_m_el, true_m_el);
407 let nor_test_vec = init_test_vec(qby8, true_m_el, false_m_el);
408 let xor_test_vec = init_test_vec(qby8, false_m_el, true_m_el);
409 let xnor_test_vec = init_test_vec(qby8, true_m_el, false_m_el);
410
411 // auto map indices and sign
412 // Auto maps are stored as [-g, g^{1}, g^{2}, ..., g^{w}]
413 let mut rlwe_auto_maps = vec![];
414 let ring_size = parameters.rlwe_n().0;
415 let g = parameters.g();
416 let br_q = parameters.br_q();
417 let auto_element_dlogs = parameters.auto_element_dlogs();
418 assert!(auto_element_dlogs[0] == 0);
419 for i in auto_element_dlogs.into_iter() {
420 let el = if i == 0 {
421 -(g as isize)
422 } else {
423 (g.pow(i as u32) % br_q) as isize
424 };
425 rlwe_auto_maps.push(generate_auto_map(ring_size, el))
426 }
427
428 let rlwe_qby4 = parameters.rlwe_q().qby4();
429
430 let scratch_memory = ScratchMemory::new(¶meters);
431
432 let pbs_info = BoolPbsInfo {
433 auto_decomposer: parameters.auto_decomposer(),
434 lwe_decomposer: parameters.lwe_decomposer(),
435 rlwe_rgsw_decomposer: parameters.rlwe_rgsw_decomposer(),
436 g_k_dlog_map,
437 embedding_factor,
438 lwe_modop,
439 rlwe_modop,
440 rlwe_nttop,
441 rlwe_qby4,
442 rlwe_auto_maps,
443 parameters: parameters,
444 };
445
446 BoolEvaluator {
447 pbs_info,
448 scratch_memory,
449 nand_test_vec,
450 and_test_vec,
451 or_test_vec,
452 nor_test_vec,
453 xnor_test_vec,
454 xor_test_vec,
455 _phantom: PhantomData,
456 }
457 }
458
459 pub(super) fn client_key(&self) -> ClientKey {
460 let sk_lwe = LweSecret::random(
461 self.pbs_info.parameters.lwe_n().0 >> 1,
462 self.pbs_info.parameters.lwe_n().0,
463 );
464 let sk_rlwe = RlweSecret::random(
465 self.pbs_info.parameters.rlwe_n().0 >> 1,
466 self.pbs_info.parameters.rlwe_n().0,
467 );
468 ClientKey::new(sk_rlwe, sk_lwe)
469 }
470
471 pub(super) fn server_key(
472 &self,
473 client_key: &ClientKey,
474 ) -> SeededServerKey<M, BoolParameters<M::MatElement>, [u8; 32]> {
475 DefaultSecureRng::with_local_mut(|rng| {
476 let mut main_seed = [0u8; 32];
477 rng.fill_bytes(&mut main_seed);
478
479 let mut main_prng = DefaultSecureRng::new_seeded(main_seed);
480
481 let rlwe_n = self.pbs_info.parameters.rlwe_n().0;
482 let sk_rlwe = client_key.sk_rlwe();
483 let sk_lwe = client_key.sk_lwe();
484
485 // generate auto keys
486 let mut auto_keys = HashMap::new();
487 let auto_gadget = self.pbs_info.auto_decomposer.gadget_vector();
488 let g = self.pbs_info.parameters.g();
489 let br_q = self.pbs_info.parameters.br_q();
490 let auto_els = self.pbs_info.parameters.auto_element_dlogs();
491 for i in auto_els.into_iter() {
492 let g_pow = if i == 0 {
493 -(g as isize)
494 } else {
495 (g.pow(i as u32) % br_q) as isize
496 };
497 let mut gk = M::zeros(self.pbs_info.auto_decomposer.decomposition_count(), rlwe_n);
498 galois_key_gen(
499 &mut gk,
500 sk_rlwe.values(),
501 g_pow,
502 &auto_gadget,
503 &self.pbs_info.rlwe_modop,
504 &self.pbs_info.rlwe_nttop,
505 &mut main_prng,
506 rng,
507 );
508 auto_keys.insert(i, gk);
509 }
510
511 // generate rgsw ciphertexts RGSW(si) where si is i^th LWE secret element
512 let ring_size = self.pbs_info.parameters.rlwe_n().0;
513 let rlwe_q = self.pbs_info.parameters.rlwe_q();
514 let (rlrg_d_a, rlrg_d_b) = (
515 self.pbs_info.rlwe_rgsw_decomposer.0.decomposition_count(),
516 self.pbs_info.rlwe_rgsw_decomposer.1.decomposition_count(),
517 );
518 let rlrg_gadget_a = self.pbs_info.rlwe_rgsw_decomposer.0.gadget_vector();
519 let rlrg_gadget_b = self.pbs_info.rlwe_rgsw_decomposer.1.gadget_vector();
520 let rgsw_cts = sk_lwe
521 .values()
522 .iter()
523 .map(|si| {
524 // X^{si}; assume |emebedding_factor * si| < N
525 let mut m = M::R::zeros(ring_size);
526 let si = (self.pbs_info.embedding_factor as i32) * si;
527 // dbg!(si);
528 if si < 0 {
529 // X^{-i} = X^{2N - i} = -X^{N-i}
530 m.as_mut()[ring_size - (si.abs() as usize)] = rlwe_q.neg_one();
531 } else {
532 // X^{i}
533 m.as_mut()[si.abs() as usize] = M::MatElement::one();
534 }
535
536 let mut rgsw_si = M::zeros(rlrg_d_a * 2 + rlrg_d_b, ring_size);
537 secret_key_encrypt_rgsw(
538 &mut rgsw_si,
539 m.as_ref(),
540 &rlrg_gadget_a,
541 &rlrg_gadget_b,
542 sk_rlwe.values(),
543 &self.pbs_info.rlwe_modop,
544 &self.pbs_info.rlwe_nttop,
545 &mut main_prng,
546 rng,
547 );
548
549 rgsw_si
550 })
551 .collect_vec();
552
553 // LWE KSK from RLWE secret s -> LWE secret z
554 let d_lwe_gadget = self.pbs_info.lwe_decomposer.gadget_vector();
555 let mut lwe_ksk =
556 M::R::zeros(self.pbs_info.lwe_decomposer.decomposition_count() * ring_size);
557 lwe_ksk_keygen(
558 &sk_rlwe.values(),
559 &sk_lwe.values(),
560 &mut lwe_ksk,
561 &d_lwe_gadget,
562 &self.pbs_info.lwe_modop,
563 &mut main_prng,
564 rng,
565 );
566
567 SeededServerKey::from_raw(
568 auto_keys,
569 rgsw_cts,
570 lwe_ksk,
571 self.pbs_info.parameters.clone(),
572 main_seed,
573 )
574 })
575 }
576
577 pub(super) fn multi_party_server_key_share(
578 &self,
579 cr_seed: [u8; 32],
580 collective_pk: &M,
581 client_key: &ClientKey,
582 ) -> CommonReferenceSeededMultiPartyServerKeyShare<M, BoolParameters<M::MatElement>, [u8; 32]>
583 {
584 DefaultSecureRng::with_local_mut(|rng| {
585 let mut main_prng = DefaultSecureRng::new_seeded(cr_seed);
586
587 let sk_rlwe = client_key.sk_rlwe();
588 let sk_lwe = client_key.sk_lwe();
589
590 let g = self.pbs_info.parameters.g();
591 let ring_size = self.pbs_info.parameters.rlwe_n().0;
592 let rlwe_q = self.pbs_info.parameters.rlwe_q();
593 let lwe_q = self.pbs_info.parameters.lwe_q();
594
595 let rlweq_modop = &self.pbs_info.rlwe_modop;
596 let rlweq_nttop = &self.pbs_info.rlwe_nttop;
597
598 // sanity check
599 assert!(sk_rlwe.values().len() == ring_size);
600 assert!(sk_lwe.values().len() == self.pbs_info.parameters.lwe_n().0);
601
602 // auto keys
603 let mut auto_keys = HashMap::new();
604 let auto_gadget = self.pbs_info.auto_decomposer.gadget_vector();
605 let auto_element_dlogs = self.pbs_info.parameters.auto_element_dlogs();
606 let br_q = self.pbs_info.parameters.br_q();
607 for i in auto_element_dlogs.into_iter() {
608 let g_pow = if i == 0 {
609 -(g as isize)
610 } else {
611 (g.pow(i as u32) % br_q) as isize
612 };
613
614 let mut ksk_out = M::zeros(
615 self.pbs_info.auto_decomposer.decomposition_count(),
616 ring_size,
617 );
618 galois_key_gen(
619 &mut ksk_out,
620 sk_rlwe.values(),
621 g_pow,
622 &auto_gadget,
623 rlweq_modop,
624 rlweq_nttop,
625 &mut main_prng,
626 rng,
627 );
628 auto_keys.insert(i, ksk_out);
629 }
630
631 // rgsw ciphertexts of lwe secret elements
632 let rgsw_rgsw_decomposer = self
633 .pbs_info
634 .parameters
635 .rgsw_rgsw_decomposer::<DefaultDecomposer<M::MatElement>>();
636 let (rgrg_d_a, rgrg_d_b) = (
637 rgsw_rgsw_decomposer.0.decomposition_count(),
638 rgsw_rgsw_decomposer.1.decomposition_count(),
639 );
640 let (rgrg_gadget_a, rgrg_gadget_b) = (
641 rgsw_rgsw_decomposer.0.gadget_vector(),
642 rgsw_rgsw_decomposer.1.gadget_vector(),
643 );
644 let rgsw_cts = sk_lwe
645 .values()
646 .iter()
647 .map(|si| {
648 let mut m = M::R::zeros(ring_size);
649 //TODO(Jay): It will be nice to have a function that returns polynomial
650 // (monomial infact!) corresponding to secret element embedded in ring X^{2N+1}.
651 // Save lots of mistakes where one forgest to emebed si in bigger ring.
652 let si = *si * (self.pbs_info.embedding_factor as i32);
653 if si < 0 {
654 // X^{-si} = X^{2N-si} = -X^{N-si}, assuming abs(si) < N
655 // (which it is given si is secret element)
656 m.as_mut()[ring_size - (si.abs() as usize)] = rlwe_q.neg_one();
657 } else {
658 m.as_mut()[si as usize] = M::MatElement::one();
659 }
660
661 // public key RGSW encryption has no part that can be seeded, unlike secret key
662 // RGSW encryption where RLWE'_A(m) is seeded
663 let mut out_rgsw = M::zeros(rgrg_d_a * 2 + rgrg_d_b * 2, ring_size);
664 public_key_encrypt_rgsw(
665 &mut out_rgsw,
666 &m.as_ref(),
667 collective_pk,
668 &rgrg_gadget_a,
669 &rgrg_gadget_b,
670 rlweq_modop,
671 rlweq_nttop,
672 rng,
673 );
674
675 out_rgsw
676 })
677 .collect_vec();
678
679 // LWE ksk
680 let mut lwe_ksk =
681 M::R::zeros(self.pbs_info.lwe_decomposer.decomposition_count() * ring_size);
682 let lwe_modop = &self.pbs_info.lwe_modop;
683 let d_lwe_gadget_vec = self.pbs_info.lwe_decomposer.gadget_vector();
684 lwe_ksk_keygen(
685 sk_rlwe.values(),
686 sk_lwe.values(),
687 &mut lwe_ksk,
688 &d_lwe_gadget_vec,
689 lwe_modop,
690 &mut main_prng,
691 rng,
692 );
693
694 CommonReferenceSeededMultiPartyServerKeyShare::new(
695 rgsw_cts,
696 auto_keys,
697 lwe_ksk,
698 cr_seed,
699 self.pbs_info.parameters.clone(),
700 )
701 })
702 }
703
704 pub(super) fn multi_party_public_key_share(
705 &self,
706 cr_seed: [u8; 32],
707 client_key: &ClientKey,
708 ) -> CommonReferenceSeededCollectivePublicKeyShare<
709 <M as Matrix>::R,
710 [u8; 32],
711 BoolParameters<<M as Matrix>::MatElement>,
712 > {
713 DefaultSecureRng::with_local_mut(|rng| {
714 let mut share_out = M::R::zeros(self.pbs_info.parameters.rlwe_n().0);
715 let modop = &self.pbs_info.rlwe_modop;
716 let nttop = &self.pbs_info.rlwe_nttop;
717 let mut main_prng = DefaultSecureRng::new_seeded(cr_seed);
718 public_key_share(
719 &mut share_out,
720 client_key.sk_rlwe().values(),
721 modop,
722 nttop,
723 &mut main_prng,
724 rng,
725 );
726 CommonReferenceSeededCollectivePublicKeyShare::new(
727 share_out,
728 cr_seed,
729 self.pbs_info.parameters.clone(),
730 )
731 })
732 }
733
734 pub(super) fn multi_party_decryption_share(
735 &self,
736 lwe_ct: &M::R,
737 client_key: &ClientKey,
738 ) -> <M as Matrix>::MatElement {
739 assert!(lwe_ct.as_ref().len() == self.pbs_info.parameters.rlwe_n().0 + 1);
740 let modop = &self.pbs_info.rlwe_modop;
741 let mut neg_s = M::R::try_convert_from(
742 client_key.sk_rlwe().values(),
743 &self.pbs_info.parameters.rlwe_q(),
744 );
745 modop.elwise_neg_mut(neg_s.as_mut());
746
747 let mut neg_sa = M::MatElement::zero();
748 izip!(lwe_ct.as_ref().iter().skip(1), neg_s.as_ref().iter()).for_each(|(ai, nsi)| {
749 neg_sa = modop.add(&neg_sa, &modop.mul(ai, nsi));
750 });
751
752 let e = DefaultSecureRng::with_local_mut(|rng| {
753 let mut e =
754 RandomGaussianElementInModulus::random(rng, self.pbs_info.parameters.rlwe_q());
755 e
756 });
757 let share = modop.add(&neg_sa, &e);
758
759 share
760 }
761
762 pub(crate) fn multi_party_decrypt(&self, shares: &[M::MatElement], lwe_ct: &M::R) -> bool {
763 let modop = &self.pbs_info.rlwe_modop;
764 let mut sum_a = M::MatElement::zero();
765 shares
766 .iter()
767 .for_each(|share_i| sum_a = modop.add(&sum_a, &share_i));
768
769 let encoded_m = modop.add(&lwe_ct.as_ref()[0], &sum_a);
770 self.pbs_info.parameters.rlwe_q().decode(encoded_m)
771 }
772
773 pub(crate) fn pk_encrypt(&self, pk: &M, m: bool) -> M::R {
774 self.pk_encrypt_batched(pk, &vec![m]).remove(0)
775 }
776
777 /// Encrypts a batch booleans as multiple LWE ciphertexts.
778 ///
779 /// For public key encryption we first encrypt `m` as a RLWE ciphertext and
780 /// then sample extract LWE samples at required indices.
781 ///
782 /// - TODO(Jay:) Communication can be improved by not sample exctracting and
783 /// instead just truncate degree 0 values (part Bs)
784 pub(crate) fn pk_encrypt_batched(&self, pk: &M, m: &[bool]) -> Vec<M::R> {
785 DefaultSecureRng::with_local_mut(|rng| {
786 let ring_size = self.pbs_info.parameters.rlwe_n().0;
787 assert!(
788 m.len() <= ring_size,
789 "Cannot batch encrypt > ring_size{ring_size} elements at once"
790 );
791
792 let modop = &self.pbs_info.rlwe_modop;
793 let nttop = &self.pbs_info.rlwe_nttop;
794
795 // RLWE(0)
796 // sample ephemeral key u
797 let mut u = vec![0i32; ring_size];
798 fill_random_ternary_secret_with_hamming_weight(u.as_mut(), ring_size >> 1, rng);
799 let mut u = M::R::try_convert_from(&u, &self.pbs_info.parameters.rlwe_q());
800 nttop.forward(u.as_mut());
801
802 let mut ua = M::R::zeros(ring_size);
803 ua.as_mut().copy_from_slice(pk.get_row_slice(0));
804 let mut ub = M::R::zeros(ring_size);
805 ub.as_mut().copy_from_slice(pk.get_row_slice(1));
806
807 // a*u
808 nttop.forward(ua.as_mut());
809 modop.elwise_mul_mut(ua.as_mut(), u.as_ref());
810 nttop.backward(ua.as_mut());
811
812 // b*u
813 nttop.forward(ub.as_mut());
814 modop.elwise_mul_mut(ub.as_mut(), u.as_ref());
815 nttop.backward(ub.as_mut());
816
817 let mut rlwe = M::zeros(2, ring_size);
818 // sample error
819 rlwe.iter_rows_mut().for_each(|ri| {
820 RandomFillGaussianInModulus::<[M::MatElement], CiphertextModulus<M::MatElement>>::random_fill(
821 rng,
822 &self.pbs_info.parameters.rlwe_q(),
823 ri.as_mut(),
824 );
825 });
826
827 // a*u + e0
828 modop.elwise_add_mut(rlwe.get_row_mut(0), ua.as_ref());
829 // b*u + e1
830 modop.elwise_add_mut(rlwe.get_row_mut(1), ub.as_ref());
831
832 //FIXME(Jay): Figure out a way to get Q/8 form modulus
833 let mut m_vec = M::R::zeros(ring_size);
834 izip!(m_vec.as_mut().iter_mut(), m.iter()).for_each(|(m_el, m_bool)| {
835 if *m_bool {
836 // Q/8
837 *m_el = self.pbs_info.rlwe_q().true_el()
838 } else {
839 // -Q/8
840 *m_el = self.pbs_info.rlwe_q().false_el()
841 }
842 });
843
844 // b*u + e1 + m
845 modop.elwise_add_mut(rlwe.get_row_mut(1), m_vec.as_ref());
846 // rlwe.set(1, 0, modop.add(rlwe.get(1, 0), &m));
847
848 // sample extract index required indices
849 let samples = m.len();
850 (0..samples)
851 .into_iter()
852 .map(|i| {
853 let mut lwe_out = M::R::zeros(ring_size + 1);
854 sample_extract(&mut lwe_out, &rlwe, modop, i);
855 lwe_out
856 })
857 .collect_vec()
858 })
859 }
860
861 /// TODO(Jay): Fetch client key from thread local
862 pub fn sk_encrypt(&self, m: bool, client_key: &ClientKey) -> M::R {
863 //FIXME(Jay): Figure out a way to get Q/8 form modulus
864 let m = if m {
865 // Q/8
866 self.pbs_info.rlwe_q().true_el()
867 } else {
868 // -Q/8
869 self.pbs_info.rlwe_q().false_el()
870 };
871
872 DefaultSecureRng::with_local_mut(|rng| {
873 let mut lwe_out = M::R::zeros(self.pbs_info.parameters.rlwe_n().0 + 1);
874 encrypt_lwe(
875 &mut lwe_out,
876 &m,
877 client_key.sk_rlwe().values(),
878 &self.pbs_info.rlwe_modop,
879 rng,
880 );
881 lwe_out
882 })
883 }
884
885 pub fn sk_decrypt(&self, lwe_ct: &M::R, client_key: &ClientKey) -> bool {
886 let m = decrypt_lwe(
887 lwe_ct,
888 client_key.sk_rlwe().values(),
889 &self.pbs_info.rlwe_modop,
890 );
891 self.pbs_info.rlwe_q().decode(m)
892 }
893
894 pub(super) fn aggregate_multi_party_server_key_shares<S>(
895 &self,
896 shares: &[CommonReferenceSeededMultiPartyServerKeyShare<
897 M,
898 BoolParameters<M::MatElement>,
899 S,
900 >],
901 ) -> SeededMultiPartyServerKey<M, S, BoolParameters<M::MatElement>>
902 where
903 S: PartialEq + Clone,
904 M: Clone,
905 {
906 assert!(shares.len() > 0);
907 let parameters = shares[0].parameters().clone();
908 let cr_seed = shares[0].cr_seed();
909
910 let rlwe_n = parameters.rlwe_n().0;
911 let g = parameters.g() as isize;
912 let rlwe_q = parameters.rlwe_q();
913 let lwe_q = parameters.lwe_q();
914
915 // sanity checks
916 shares.iter().skip(1).for_each(|s| {
917 assert!(s.parameters() == ¶meters);
918 assert!(s.cr_seed() == cr_seed);
919 });
920
921 let rlweq_modop = &self.pbs_info.rlwe_modop;
922 let rlweq_nttop = &self.pbs_info.rlwe_nttop;
923
924 // auto keys
925 let mut auto_keys = HashMap::new();
926 let auto_elements_dlog = parameters.auto_element_dlogs();
927 for i in auto_elements_dlog.into_iter() {
928 let mut key = M::zeros(parameters.auto_decomposition_count().0, rlwe_n);
929
930 shares.iter().for_each(|s| {
931 let auto_key_share_i = s.auto_keys().get(&i).expect("Auto key {i} missing");
932 assert!(
933 auto_key_share_i.dimension()
934 == (parameters.auto_decomposition_count().0, rlwe_n)
935 );
936 izip!(key.iter_rows_mut(), auto_key_share_i.iter_rows()).for_each(
937 |(partb_out, partb_share)| {
938 rlweq_modop.elwise_add_mut(partb_out.as_mut(), partb_share.as_ref());
939 },
940 );
941 });
942
943 auto_keys.insert(i, key);
944 }
945
946 // rgsw ciphertext (most expensive part!)
947 let lwe_n = parameters.lwe_n().0;
948 let rgsw_by_rgsw_decomposer =
949 parameters.rgsw_rgsw_decomposer::<DefaultDecomposer<M::MatElement>>();
950 let mut scratch_matrix = M::zeros(
951 std::cmp::max(
952 rgsw_by_rgsw_decomposer.a().decomposition_count(),
953 rgsw_by_rgsw_decomposer.b().decomposition_count(),
954 ) + (rgsw_by_rgsw_decomposer.a().decomposition_count() * 2
955 + rgsw_by_rgsw_decomposer.b().decomposition_count() * 2),
956 rlwe_n,
957 );
958
959 let mut tmp_rgsw =
960 RgswCiphertext::<M, _>::empty(rlwe_n, &rgsw_by_rgsw_decomposer, rlwe_q.clone()).data;
961 let rgsw_cts = (0..lwe_n).into_iter().map(|index| {
962 // copy over rgsw ciphertext for index^th secret element from first share and
963 // treat it as accumulating rgsw ciphertext
964 let mut rgsw_i = shares[0].rgsw_cts()[index].clone();
965
966 shares.iter().skip(1).for_each(|si| {
967 // copy over si's RGSW[index] ciphertext and send to evaluation domain
968 izip!(tmp_rgsw.iter_rows_mut(), si.rgsw_cts()[index].iter_rows()).for_each(
969 |(to_ri, from_ri)| {
970 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
971 rlweq_nttop.forward(to_ri.as_mut())
972 },
973 );
974
975 rgsw_by_rgsw_inplace(
976 &mut rgsw_i,
977 &tmp_rgsw,
978 &rgsw_by_rgsw_decomposer,
979 &mut scratch_matrix,
980 rlweq_nttop,
981 rlweq_modop,
982 );
983 });
984
985 rgsw_i
986 });
987 // d_a and d_b may differ for RGSWxRGSW multiplication and RLWExRGSW
988 // multiplication. After this point RGSW ciphertexts will only be used for
989 // RLWExRGSW multiplication (in blind rotation). Thus we drop any additional
990 // RLWE ciphertexts in RGSW ciphertexts after RGSw x RGSW multiplication
991 let (rgswrgsw_d_a, rgswrgsw_d_b) = self.pbs_info.parameters.rgsw_rgsw_decomposition_count();
992 let (rlrg_d_a, rlrg_d_b) = self.pbs_info.parameters.rlwe_rgsw_decomposition_count();
993 let rgsw_ct_rows_in = rgswrgsw_d_a.0 * 2 + rgswrgsw_d_b.0 * 2;
994 let rgsw_ct_rows_out = rlrg_d_a.0 * 2 + rlrg_d_b.0 * 2;
995 assert!(rgswrgsw_d_a.0 >= rlrg_d_a.0, "RGSWxRGSW part A decomposition count {} must be >= RLWExRGSW part A decomposition count {}", rgswrgsw_d_a.0 , rlrg_d_a.0);
996 assert!(rgswrgsw_d_b.0 >= rlrg_d_b.0, "RGSWxRGSW part B decomposition count {} must be >= RLWExRGSW part B decomposition count {}", rgswrgsw_d_b.0 , rlrg_d_b.0);
997 let rgsw_cts = rgsw_cts
998 .map(|ct_i_in| {
999 assert!(ct_i_in.dimension() == (rgsw_ct_rows_in, rlwe_n));
1000 let mut reduced_ct_i_out = M::zeros(rgsw_ct_rows_out, rlwe_n);
1001
1002 // RLWE'(-sm) part A
1003 izip!(
1004 reduced_ct_i_out.iter_rows_mut().take(rlrg_d_a.0),
1005 ct_i_in
1006 .iter_rows()
1007 .skip(rgswrgsw_d_a.0 - rlrg_d_a.0)
1008 .take(rlrg_d_a.0)
1009 )
1010 .for_each(|(to_ri, from_ri)| {
1011 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1012 });
1013
1014 // RLWE'(-sm) part B
1015 izip!(
1016 reduced_ct_i_out
1017 .iter_rows_mut()
1018 .skip(rlrg_d_a.0)
1019 .take(rlrg_d_a.0),
1020 ct_i_in
1021 .iter_rows()
1022 .skip(rgswrgsw_d_a.0 + (rgswrgsw_d_a.0 - rlrg_d_a.0))
1023 .take(rlrg_d_a.0)
1024 )
1025 .for_each(|(to_ri, from_ri)| {
1026 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1027 });
1028
1029 // RLWE'(m) Part A
1030 izip!(
1031 reduced_ct_i_out
1032 .iter_rows_mut()
1033 .skip(rlrg_d_a.0 * 2)
1034 .take(rlrg_d_b.0),
1035 ct_i_in
1036 .iter_rows()
1037 .skip(rgswrgsw_d_a.0 * 2 + (rgswrgsw_d_b.0 - rlrg_d_b.0))
1038 .take(rlrg_d_b.0)
1039 )
1040 .for_each(|(to_ri, from_ri)| {
1041 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1042 });
1043
1044 // RLWE'(m) Part B
1045 izip!(
1046 reduced_ct_i_out
1047 .iter_rows_mut()
1048 .skip(rlrg_d_a.0 * 2 + rlrg_d_b.0)
1049 .take(rlrg_d_b.0),
1050 ct_i_in
1051 .iter_rows()
1052 .skip(rgswrgsw_d_a.0 * 2 + rgswrgsw_d_b.0 + (rgswrgsw_d_b.0 - rlrg_d_b.0))
1053 .take(rlrg_d_b.0)
1054 )
1055 .for_each(|(to_ri, from_ri)| {
1056 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1057 });
1058
1059 reduced_ct_i_out
1060 })
1061 .collect_vec();
1062
1063 // LWE ksks
1064 let mut lwe_ksk = M::R::zeros(rlwe_n * parameters.lwe_decomposition_count().0);
1065 let lweq_modop = &self.pbs_info.lwe_modop;
1066 shares.iter().for_each(|si| {
1067 assert!(si.lwe_ksk().as_ref().len() == rlwe_n * parameters.lwe_decomposition_count().0);
1068 lweq_modop.elwise_add_mut(lwe_ksk.as_mut(), si.lwe_ksk().as_ref())
1069 });
1070
1071 SeededMultiPartyServerKey::new(rgsw_cts, auto_keys, lwe_ksk, cr_seed.clone(), parameters)
1072 }
1073}
1074
1075impl<M, NttOp, RlweModOp, LweModOp> BoolEvaluator<M, NttOp, RlweModOp, LweModOp>
1076where
1077 M: MatrixMut + MatrixEntity,
1078 M::R: RowMut + RowEntity,
1079 M::MatElement: PrimInt + FromPrimitive + One + Copy + Zero + Display + WrappingSub + NumInfo,
1080 RlweModOp: VectorOps<Element = M::MatElement>
1081 + ArithmeticOps<Element = M::MatElement>
1082 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
1083 LweModOp: VectorOps<Element = M::MatElement>
1084 + ArithmeticOps<Element = M::MatElement>
1085 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
1086 NttOp: Ntt<Element = M::MatElement>,
1087{
1088 /// Returns c0 + c1 + Q/4
1089 fn _add_and_shift_lwe_cts(&self, c0: &mut M::R, c1: &M::R) {
1090 let modop = &self.pbs_info.rlwe_modop;
1091 modop.elwise_add_mut(c0.as_mut(), c1.as_ref());
1092 // +Q/4
1093 c0.as_mut()[0] = modop.add(&c0.as_ref()[0], &self.pbs_info.rlwe_qby4);
1094 }
1095
1096 /// Returns 2(c0 - c1) + Q/4
1097 fn _subtract_double_lwe_cts(&self, c0: &mut M::R, c1: &M::R) {
1098 let modop = &self.pbs_info.rlwe_modop;
1099 // c0 - c1
1100 modop.elwise_sub_mut(c0.as_mut(), c1.as_ref());
1101
1102 // double
1103 c0.as_mut().iter_mut().for_each(|v| *v = modop.add(v, v));
1104 }
1105}
1106
1107impl<M, NttOp, RlweModOp, LweModOp> BooleanGates for BoolEvaluator<M, NttOp, RlweModOp, LweModOp>
1108where
1109 M: MatrixMut + MatrixEntity,
1110 M::R: RowMut + RowEntity + Clone,
1111 M::MatElement: PrimInt + FromPrimitive + One + Copy + Zero + Display + WrappingSub + NumInfo,
1112 RlweModOp: VectorOps<Element = M::MatElement>
1113 + ArithmeticOps<Element = M::MatElement>
1114 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
1115 LweModOp: VectorOps<Element = M::MatElement>
1116 + ArithmeticOps<Element = M::MatElement>
1117 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
1118 NttOp: Ntt<Element = M::MatElement>,
1119{
1120 type Ciphertext = M::R;
1121 type Key = ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>;
1122
1123 fn nand_inplace(
1124 &mut self,
1125 c0: &mut M::R,
1126 c1: &M::R,
1127 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1128 ) {
1129 self._add_and_shift_lwe_cts(c0, c1);
1130
1131 // PBS
1132 pbs(
1133 &self.pbs_info,
1134 &self.nand_test_vec,
1135 c0,
1136 server_key,
1137 &mut self.scratch_memory.lwe_vector,
1138 &mut self.scratch_memory.decomposition_matrix,
1139 );
1140 }
1141
1142 fn and_inplace(
1143 &mut self,
1144 c0: &mut M::R,
1145 c1: &M::R,
1146 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1147 ) {
1148 self._add_and_shift_lwe_cts(c0, c1);
1149
1150 // PBS
1151 pbs(
1152 &self.pbs_info,
1153 &self.and_test_vec,
1154 c0,
1155 server_key,
1156 &mut self.scratch_memory.lwe_vector,
1157 &mut self.scratch_memory.decomposition_matrix,
1158 );
1159 }
1160
1161 fn or_inplace(
1162 &mut self,
1163 c0: &mut M::R,
1164 c1: &M::R,
1165 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1166 ) {
1167 self._add_and_shift_lwe_cts(c0, c1);
1168
1169 // PBS
1170 pbs(
1171 &self.pbs_info,
1172 &self.or_test_vec,
1173 c0,
1174 server_key,
1175 &mut self.scratch_memory.lwe_vector,
1176 &mut self.scratch_memory.decomposition_matrix,
1177 );
1178 }
1179
1180 fn nor_inplace(
1181 &mut self,
1182 c0: &mut M::R,
1183 c1: &M::R,
1184 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1185 ) {
1186 self._add_and_shift_lwe_cts(c0, c1);
1187
1188 // PBS
1189 pbs(
1190 &self.pbs_info,
1191 &self.nor_test_vec,
1192 c0,
1193 server_key,
1194 &mut self.scratch_memory.lwe_vector,
1195 &mut self.scratch_memory.decomposition_matrix,
1196 )
1197 }
1198
1199 fn xor_inplace(
1200 &mut self,
1201 c0: &mut M::R,
1202 c1: &M::R,
1203 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1204 ) {
1205 self._subtract_double_lwe_cts(c0, c1);
1206
1207 // PBS
1208 pbs(
1209 &self.pbs_info,
1210 &self.xor_test_vec,
1211 c0,
1212 server_key,
1213 &mut self.scratch_memory.lwe_vector,
1214 &mut self.scratch_memory.decomposition_matrix,
1215 );
1216 }
1217
1218 fn xnor_inplace(
1219 &mut self,
1220 c0: &mut M::R,
1221 c1: &M::R,
1222 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1223 ) {
1224 self._subtract_double_lwe_cts(c0, c1);
1225
1226 // PBS
1227 pbs(
1228 &self.pbs_info,
1229 &self.xnor_test_vec,
1230 c0,
1231 server_key,
1232 &mut self.scratch_memory.lwe_vector,
1233 &mut self.scratch_memory.decomposition_matrix,
1234 );
1235 }
1236
1237 fn not_inplace(&mut self, c0: &mut M::R) {
1238 let modop = &self.pbs_info.rlwe_modop;
1239 c0.as_mut().iter_mut().for_each(|v| *v = modop.neg(v));
1240 }
1241
1242 fn and(
1243 &mut self,
1244 c0: &Self::Ciphertext,
1245 c1: &Self::Ciphertext,
1246 key: &Self::Key,
1247 ) -> Self::Ciphertext {
1248 let mut out = c0.clone();
1249 self.and_inplace(&mut out, c1, key);
1250 out
1251 }
1252
1253 fn nand(
1254 &mut self,
1255 c0: &Self::Ciphertext,
1256 c1: &Self::Ciphertext,
1257 key: &Self::Key,
1258 ) -> Self::Ciphertext {
1259 let mut out = c0.clone();
1260 self.nand_inplace(&mut out, c1, key);
1261 out
1262 }
1263
1264 fn or(
1265 &mut self,
1266 c0: &Self::Ciphertext,
1267 c1: &Self::Ciphertext,
1268 key: &Self::Key,
1269 ) -> Self::Ciphertext {
1270 let mut out = c0.clone();
1271 self.or_inplace(&mut out, c1, key);
1272 out
1273 }
1274
1275 fn nor(
1276 &mut self,
1277 c0: &Self::Ciphertext,
1278 c1: &Self::Ciphertext,
1279 key: &Self::Key,
1280 ) -> Self::Ciphertext {
1281 let mut out = c0.clone();
1282 self.nor_inplace(&mut out, c1, key);
1283 out
1284 }
1285
1286 fn xnor(
1287 &mut self,
1288 c0: &Self::Ciphertext,
1289 c1: &Self::Ciphertext,
1290 key: &Self::Key,
1291 ) -> Self::Ciphertext {
1292 let mut out = c0.clone();
1293 self.xnor_inplace(&mut out, c1, key);
1294 out
1295 }
1296
1297 fn xor(
1298 &mut self,
1299 c0: &Self::Ciphertext,
1300 c1: &Self::Ciphertext,
1301 key: &Self::Key,
1302 ) -> Self::Ciphertext {
1303 let mut out = c0.clone();
1304 self.xor_inplace(&mut out, c1, key);
1305 out
1306 }
1307
1308 fn not(&mut self, c: &Self::Ciphertext) -> Self::Ciphertext {
1309 let mut out = c.clone();
1310 self.not_inplace(&mut out);
1311 out
1312 }
1313}
1314
1315#[cfg(test)]
1316mod tests {
1317 use bool::parameters::{MP_BOOL_PARAMS, SP_BOOL_PARAMS};
1318 use rand::{thread_rng, Rng};
1319 use rand_distr::Uniform;
1320
1321 use crate::{
1322 backend::{GetModulus, ModInit, ModularOpsU64, WordSizeModulus},
1323 bool::{
1324 self, CommonReferenceSeededMultiPartyServerKeyShare, PublicKey,
1325 SeededMultiPartyServerKey,
1326 },
1327 ntt::NttBackendU64,
1328 random::{RandomElementInModulus, DEFAULT_RNG},
1329 rgsw::{
1330 self, measure_noise, public_key_encrypt_rlwe, secret_key_encrypt_rlwe,
1331 tests::{_measure_noise_rgsw, _sk_encrypt_rlwe},
1332 RgswCiphertext, RgswCiphertextEvaluationDomain, SeededRgswCiphertext,
1333 SeededRlweCiphertext,
1334 },
1335 utils::{negacyclic_mul, Stats},
1336 };
1337
1338 use super::*;
1339
1340 #[test]
1341 fn bool_encrypt_decrypt_works() {
1342 let bool_evaluator = BoolEvaluator::<
1343 Vec<Vec<u64>>,
1344 NttBackendU64,
1345 ModularOpsU64<CiphertextModulus<u64>>,
1346 ModularOpsU64<CiphertextModulus<u64>>,
1347 >::new(SP_BOOL_PARAMS);
1348 let client_key = bool_evaluator.client_key();
1349
1350 let mut m = true;
1351 for _ in 0..1000 {
1352 let lwe_ct = bool_evaluator.sk_encrypt(m, &client_key);
1353 let m_back = bool_evaluator.sk_decrypt(&lwe_ct, &client_key);
1354 assert_eq!(m, m_back);
1355 m = !m;
1356 }
1357 }
1358
1359 #[test]
1360 fn bool_nand() {
1361 let mut bool_evaluator = BoolEvaluator::<
1362 Vec<Vec<u64>>,
1363 NttBackendU64,
1364 ModularOpsU64<CiphertextModulus<u64>>,
1365 ModularOpsU64<CiphertextModulus<u64>>,
1366 >::new(SP_BOOL_PARAMS);
1367
1368 // println!("{:?}", bool_evaluator.nand_test_vec);
1369 let client_key = bool_evaluator.client_key();
1370 let seeded_server_key = bool_evaluator.server_key(&client_key);
1371 let server_key_eval_domain =
1372 ServerKeyEvaluationDomain::<_, DefaultSecureRng, NttBackendU64>::from(
1373 &seeded_server_key,
1374 );
1375
1376 let mut m0 = false;
1377 let mut m1 = true;
1378
1379 let mut ct0 = bool_evaluator.sk_encrypt(m0, &client_key);
1380 let mut ct1 = bool_evaluator.sk_encrypt(m1, &client_key);
1381
1382 for _ in 0..500 {
1383 let ct_back = bool_evaluator.nand(&ct0, &ct1, &server_key_eval_domain);
1384
1385 let m_out = !(m0 && m1);
1386
1387 // Trace and measure PBS noise
1388 {
1389 let noise0 = {
1390 let ideal = if m0 {
1391 bool_evaluator.pbs_info.parameters.rlwe_q().true_el()
1392 } else {
1393 bool_evaluator.pbs_info.parameters.rlwe_q().false_el()
1394 };
1395 let n = measure_noise_lwe(
1396 &ct0,
1397 client_key.sk_rlwe().values(),
1398 &bool_evaluator.pbs_info.rlwe_modop,
1399 &ideal,
1400 );
1401 let v = decrypt_lwe(
1402 &ct0,
1403 client_key.sk_rlwe().values(),
1404 &bool_evaluator.pbs_info.rlwe_modop,
1405 );
1406 (n, v)
1407 };
1408 let noise1 = {
1409 let ideal = if m1 {
1410 bool_evaluator.pbs_info.parameters.rlwe_q().true_el()
1411 } else {
1412 bool_evaluator.pbs_info.parameters.rlwe_q().false_el()
1413 };
1414 let n = measure_noise_lwe(
1415 &ct1,
1416 client_key.sk_rlwe().values(),
1417 &bool_evaluator.pbs_info.rlwe_modop,
1418 &ideal,
1419 );
1420 let v = decrypt_lwe(
1421 &ct1,
1422 client_key.sk_rlwe().values(),
1423 &bool_evaluator.pbs_info.rlwe_modop,
1424 );
1425 (n, v)
1426 };
1427
1428 // Calculate noise in ciphertext post PBS
1429 let noise_out = {
1430 let ideal = if m_out {
1431 bool_evaluator.pbs_info.parameters.rlwe_q().true_el()
1432 } else {
1433 bool_evaluator.pbs_info.parameters.rlwe_q().false_el()
1434 };
1435 let n = measure_noise_lwe(
1436 &ct_back,
1437 client_key.sk_rlwe().values(),
1438 &bool_evaluator.pbs_info.rlwe_modop,
1439 &ideal,
1440 );
1441 let v = decrypt_lwe(
1442 &ct_back,
1443 client_key.sk_rlwe().values(),
1444 &bool_evaluator.pbs_info.rlwe_modop,
1445 );
1446 (n, v)
1447 };
1448 dbg!(m0, m1, m_out);
1449 println!(
1450 "ct0 (noise, message): {:?} \n ct1 (noise, message): {:?} \n PBS (noise, message): {:?}", noise0, noise1, noise_out
1451 );
1452 }
1453 let m_back = bool_evaluator.sk_decrypt(&ct_back, &client_key);
1454 assert!(m_out == m_back, "Expected {m_out}, got {m_back}");
1455 println!("----------");
1456
1457 m1 = m0;
1458 m0 = m_out;
1459
1460 ct1 = ct0;
1461 ct0 = ct_back;
1462 }
1463 }
1464
1465 #[test]
1466 fn bool_xor() {
1467 let mut bool_evaluator = BoolEvaluator::<
1468 Vec<Vec<u64>>,
1469 NttBackendU64,
1470 ModularOpsU64<CiphertextModulus<u64>>,
1471 ModularOpsU64<CiphertextModulus<u64>>,
1472 >::new(SP_BOOL_PARAMS);
1473
1474 // println!("{:?}", bool_evaluator.nand_test_vec);
1475 let client_key = bool_evaluator.client_key();
1476 let seeded_server_key = bool_evaluator.server_key(&client_key);
1477 let server_key_eval_domain =
1478 ServerKeyEvaluationDomain::<_, DefaultSecureRng, NttBackendU64>::from(
1479 &seeded_server_key,
1480 );
1481
1482 let mut m0 = false;
1483 let mut m1 = true;
1484
1485 let mut ct0 = bool_evaluator.sk_encrypt(m0, &client_key);
1486 let mut ct1 = bool_evaluator.sk_encrypt(m1, &client_key);
1487
1488 for _ in 0..1000 {
1489 let ct_back = bool_evaluator.xor(&ct0, &ct1, &server_key_eval_domain);
1490 let m_out = (m0 ^ m1);
1491
1492 let m_back = bool_evaluator.sk_decrypt(&ct_back, &client_key);
1493 assert!(m_out == m_back, "Expected {m_out}, got {m_back}");
1494
1495 m1 = m0;
1496 m0 = m_out;
1497
1498 ct1 = ct0;
1499 ct0 = ct_back;
1500 }
1501 }
1502
1503 #[test]
1504 fn multi_party_encryption_decryption() {
1505 let bool_evaluator = BoolEvaluator::<
1506 Vec<Vec<u64>>,
1507 NttBackendU64,
1508 ModularOpsU64<CiphertextModulus<u64>>,
1509 ModularOpsU64<CiphertextModulus<u64>>,
1510 >::new(MP_BOOL_PARAMS);
1511
1512 let no_of_parties = 500;
1513 let parties = (0..no_of_parties)
1514 .map(|_| bool_evaluator.client_key())
1515 .collect_vec();
1516
1517 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1518 parties.iter().for_each(|k| {
1519 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1520 *ideal_i = *ideal_i + s_i;
1521 });
1522 });
1523
1524 println!("{:?}", &ideal_rlwe_sk);
1525
1526 let mut m = true;
1527 for i in 0..100 {
1528 let pk_cr_seed = [0u8; 32];
1529
1530 let public_key_share = parties
1531 .iter()
1532 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1533 .collect_vec();
1534
1535 let collective_pk = PublicKey::<
1536 Vec<Vec<u64>>,
1537 DefaultSecureRng,
1538 ModularOpsU64<CiphertextModulus<u64>>,
1539 >::from(public_key_share.as_slice());
1540 let lwe_ct = bool_evaluator.pk_encrypt(collective_pk.key(), m);
1541
1542 let decryption_shares = parties
1543 .iter()
1544 .map(|k| bool_evaluator.multi_party_decryption_share(&lwe_ct, k))
1545 .collect_vec();
1546
1547 let m_back = bool_evaluator.multi_party_decrypt(&decryption_shares, &lwe_ct);
1548
1549 {
1550 let ideal_m = if m {
1551 bool_evaluator.pbs_info.parameters.rlwe_q().true_el()
1552 } else {
1553 bool_evaluator.pbs_info.parameters.rlwe_q().false_el()
1554 };
1555 let noise = measure_noise_lwe(
1556 &lwe_ct,
1557 &ideal_rlwe_sk,
1558 &bool_evaluator.pbs_info.rlwe_modop,
1559 &ideal_m,
1560 );
1561 println!("Noise: {noise}");
1562 }
1563
1564 assert_eq!(m_back, m);
1565 m = !m;
1566 }
1567 }
1568
1569 fn _collecitve_public_key_gen(rlwe_q: u64, parties_rlwe_sk: &[RlweSecret]) -> Vec<Vec<u64>> {
1570 let ring_size = parties_rlwe_sk[0].values.len();
1571 assert!(ring_size.is_power_of_two());
1572 let mut rng = DefaultSecureRng::new();
1573 let nttop = NttBackendU64::new(&rlwe_q, ring_size);
1574 let modop = ModularOpsU64::new(rlwe_q);
1575
1576 // Generate Pk shares
1577 let pk_seed = [0u8; 32];
1578 let pk_shares = parties_rlwe_sk.iter().map(|sk| {
1579 let mut p_rng = DefaultSecureRng::new_seeded(pk_seed);
1580 let mut share_out = vec![0u64; ring_size];
1581 public_key_share(
1582 &mut share_out,
1583 sk.values(),
1584 &modop,
1585 &nttop,
1586 &mut p_rng,
1587 &mut rng,
1588 );
1589 share_out
1590 });
1591
1592 let mut pk_part_b = vec![0u64; ring_size];
1593 pk_shares.for_each(|share| modop.elwise_add_mut(&mut pk_part_b, &share));
1594 let mut pk_part_a = vec![0u64; ring_size];
1595 let mut p_rng = DefaultSecureRng::new_seeded(pk_seed);
1596 RandomFillUniformInModulus::random_fill(&mut p_rng, &rlwe_q, pk_part_a.as_mut_slice());
1597
1598 vec![pk_part_a, pk_part_b]
1599 }
1600
1601 fn _multi_party_all_keygen(
1602 bool_evaluator: &BoolEvaluator<
1603 Vec<Vec<u64>>,
1604 NttBackendU64,
1605 ModularOpsU64<CiphertextModulus<u64>>,
1606 ModularOpsU64<CiphertextModulus<u64>>,
1607 >,
1608 no_of_parties: usize,
1609 ) -> (
1610 Vec<ClientKey>,
1611 PublicKey<Vec<Vec<u64>>, DefaultSecureRng, ModularOpsU64<CiphertextModulus<u64>>>,
1612 Vec<
1613 CommonReferenceSeededMultiPartyServerKeyShare<
1614 Vec<Vec<u64>>,
1615 BoolParameters<u64>,
1616 [u8; 32],
1617 >,
1618 >,
1619 SeededMultiPartyServerKey<Vec<Vec<u64>>, [u8; 32], BoolParameters<u64>>,
1620 ServerKeyEvaluationDomain<Vec<Vec<u64>>, DefaultSecureRng, NttBackendU64>,
1621 ClientKey,
1622 ) {
1623 let parties = (0..no_of_parties)
1624 .map(|_| bool_evaluator.client_key())
1625 .collect_vec();
1626
1627 let mut rng = DefaultSecureRng::new();
1628
1629 // Collective public key
1630 let mut pk_cr_seed = [0u8; 32];
1631 rng.fill_bytes(&mut pk_cr_seed);
1632 let public_key_share = parties
1633 .iter()
1634 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1635 .collect_vec();
1636 let collective_pk =
1637 PublicKey::<Vec<Vec<u64>>, DefaultSecureRng, _>::from(public_key_share.as_slice());
1638
1639 // Server key
1640 let mut pbs_cr_seed = [0u8; 32];
1641 rng.fill_bytes(&mut pbs_cr_seed);
1642 let server_key_shares = parties
1643 .iter()
1644 .map(|k| {
1645 bool_evaluator.multi_party_server_key_share(pbs_cr_seed, &collective_pk.key(), k)
1646 })
1647 .collect_vec();
1648 let seeded_server_key =
1649 bool_evaluator.aggregate_multi_party_server_key_shares(&server_key_shares);
1650 let server_key_eval = ServerKeyEvaluationDomain::<_, DefaultSecureRng, NttBackendU64>::from(
1651 &seeded_server_key,
1652 );
1653
1654 // construct ideal rlwe sk for meauring noise
1655 let ideal_client_key = {
1656 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1657 parties.iter().for_each(|k| {
1658 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1659 *ideal_i = *ideal_i + s_i;
1660 });
1661 });
1662 let mut ideal_lwe_sk = vec![0i32; bool_evaluator.pbs_info.lwe_n()];
1663 parties.iter().for_each(|k| {
1664 izip!(ideal_lwe_sk.iter_mut(), k.sk_lwe().values()).for_each(|(ideal_i, s_i)| {
1665 *ideal_i = *ideal_i + s_i;
1666 });
1667 });
1668
1669 ClientKey::new(
1670 RlweSecret {
1671 values: ideal_rlwe_sk,
1672 },
1673 LweSecret {
1674 values: ideal_lwe_sk,
1675 },
1676 )
1677 };
1678
1679 (
1680 parties,
1681 collective_pk,
1682 server_key_shares,
1683 seeded_server_key,
1684 server_key_eval,
1685 ideal_client_key,
1686 )
1687 }
1688
1689 #[test]
1690 fn multi_party_nand() {
1691 let mut bool_evaluator = BoolEvaluator::<
1692 Vec<Vec<u64>>,
1693 NttBackendU64,
1694 ModularOpsU64<CiphertextModulus<u64>>,
1695 ModularOpsU64<CiphertextModulus<u64>>,
1696 >::new(MP_BOOL_PARAMS);
1697
1698 let (parties, collective_pk, _, _, server_key_eval, ideal_client_key) =
1699 _multi_party_all_keygen(&bool_evaluator, 2);
1700
1701 let mut m0 = true;
1702 let mut m1 = false;
1703
1704 let mut lwe0 = bool_evaluator.pk_encrypt(collective_pk.key(), m0);
1705 let mut lwe1 = bool_evaluator.pk_encrypt(collective_pk.key(), m1);
1706
1707 for _ in 0..2000 {
1708 let lwe_out = bool_evaluator.nand(&lwe0, &lwe1, &server_key_eval);
1709
1710 let m_expected = !(m0 & m1);
1711
1712 // measure noise
1713 {
1714 let noise0 = {
1715 let ideal = if m0 {
1716 bool_evaluator.pbs_info.rlwe_q().true_el()
1717 } else {
1718 bool_evaluator.pbs_info.rlwe_q().false_el()
1719 };
1720 let n = measure_noise_lwe(
1721 &lwe0,
1722 ideal_client_key.sk_rlwe().values(),
1723 &bool_evaluator.pbs_info.rlwe_modop,
1724 &ideal,
1725 );
1726 let v = decrypt_lwe(
1727 &lwe0,
1728 ideal_client_key.sk_rlwe().values(),
1729 &bool_evaluator.pbs_info.rlwe_modop,
1730 );
1731 (n, v)
1732 };
1733 let noise1 = {
1734 let ideal = if m1 {
1735 bool_evaluator.pbs_info.rlwe_q().true_el()
1736 } else {
1737 bool_evaluator.pbs_info.rlwe_q().false_el()
1738 };
1739 let n = measure_noise_lwe(
1740 &lwe1,
1741 ideal_client_key.sk_rlwe().values(),
1742 &bool_evaluator.pbs_info.rlwe_modop,
1743 &ideal,
1744 );
1745 let v = decrypt_lwe(
1746 &lwe1,
1747 ideal_client_key.sk_rlwe().values(),
1748 &bool_evaluator.pbs_info.rlwe_modop,
1749 );
1750 (n, v)
1751 };
1752
1753 // // Trace PBS
1754 // PBSTracer::with_local(|t| {
1755 // t.trace(
1756 // &MP_BOOL_PARAMS,
1757 // &ideal_client_key.sk_lwe.values(),
1758 // &ideal_client_key.sk_rlwe.values(),
1759 // )
1760 // });
1761
1762 let noise_out = {
1763 let ideal_m = if m_expected {
1764 bool_evaluator.pbs_info.rlwe_q().true_el()
1765 } else {
1766 bool_evaluator.pbs_info.rlwe_q().false_el()
1767 };
1768 let n = measure_noise_lwe(
1769 &lwe_out,
1770 ideal_client_key.sk_rlwe().values(),
1771 &bool_evaluator.pbs_info.rlwe_modop,
1772 &ideal_m,
1773 );
1774 let v = decrypt_lwe(
1775 &lwe_out,
1776 ideal_client_key.sk_rlwe().values(),
1777 &bool_evaluator.pbs_info.rlwe_modop,
1778 );
1779 (n, v)
1780 };
1781 dbg!(m0, m1, m_expected);
1782 println!(
1783 "ct0 (noise, message): {:?} \n ct1 (noise, message): {:?} \n PBS (noise, message): {:?}", noise0, noise1, noise_out
1784 );
1785 }
1786
1787 // multi-party decrypt
1788 let decryption_shares = parties
1789 .iter()
1790 .map(|k| bool_evaluator.multi_party_decryption_share(&lwe_out, k))
1791 .collect_vec();
1792 let m_back = bool_evaluator.multi_party_decrypt(&decryption_shares, &lwe_out);
1793
1794 // let m_back = bool_evaluator.sk_decrypt(&lwe_out, &ideal_client_key);
1795
1796 assert!(m_expected == m_back, "Expected {m_expected}, got {m_back}");
1797 m1 = m0;
1798 m0 = m_expected;
1799
1800 lwe1 = lwe0;
1801 lwe0 = lwe_out;
1802 }
1803 }
1804
1805 #[test]
1806 fn noise_tester() {
1807 let bool_evaluator = BoolEvaluator::<
1808 Vec<Vec<u64>>,
1809 NttBackendU64,
1810 ModularOpsU64<CiphertextModulus<u64>>,
1811 ModularOpsU64<CiphertextModulus<u64>>,
1812 >::new(SP_BOOL_PARAMS);
1813
1814 // let (_, collective_pk, _, _, server_key_eval, ideal_client_key) =
1815 // _multi_party_all_keygen(&bool_evaluator, 20);
1816 let no_of_parties = 2;
1817 let lwe_q = bool_evaluator.pbs_info.parameters.lwe_q();
1818 let rlwe_q = bool_evaluator.pbs_info.parameters.rlwe_q();
1819 let lwe_n = bool_evaluator.pbs_info.parameters.lwe_n().0;
1820 let rlwe_n = bool_evaluator.pbs_info.parameters.rlwe_n().0;
1821 let lwe_modop = &bool_evaluator.pbs_info.lwe_modop;
1822 let rlwe_nttop = &bool_evaluator.pbs_info.rlwe_nttop;
1823 let rlwe_modop = &bool_evaluator.pbs_info.rlwe_modop;
1824
1825 // let rgsw_rgsw_decomposer = &bool_evaluator
1826 // .pbs_info
1827 // .parameters
1828 // .rgsw_rgsw_decomposer::<DefaultDecomposer<u64>>();
1829 // let rgsw_rgsw_gadget_a = rgsw_rgsw_decomposer.0.gadget_vector();
1830 // let rgsw_rgsw_gadget_b = rgsw_rgsw_decomposer.1.gadget_vector();
1831
1832 let rlwe_rgsw_decomposer = &bool_evaluator.pbs_info.rlwe_rgsw_decomposer;
1833 let rlwe_rgsw_gadget_a = rlwe_rgsw_decomposer.0.gadget_vector();
1834 let rlwe_rgsw_gadget_b = rlwe_rgsw_decomposer.1.gadget_vector();
1835
1836 let auto_decomposer = &bool_evaluator.pbs_info.auto_decomposer;
1837 let auto_gadget = auto_decomposer.gadget_vector();
1838
1839 let parties = (0..no_of_parties)
1840 .map(|_| bool_evaluator.client_key())
1841 .collect_vec();
1842
1843 let ideal_client_key = {
1844 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1845 parties.iter().for_each(|k| {
1846 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1847 *ideal_i = *ideal_i + s_i;
1848 });
1849 });
1850 let mut ideal_lwe_sk = vec![0i32; bool_evaluator.pbs_info.lwe_n()];
1851 parties.iter().for_each(|k| {
1852 izip!(ideal_lwe_sk.iter_mut(), k.sk_lwe().values()).for_each(|(ideal_i, s_i)| {
1853 *ideal_i = *ideal_i + s_i;
1854 });
1855 });
1856
1857 ClientKey::new(
1858 RlweSecret {
1859 values: ideal_rlwe_sk,
1860 },
1861 LweSecret {
1862 values: ideal_lwe_sk,
1863 },
1864 )
1865 };
1866
1867 // check noise in freshly encrypted RLWE ciphertext (ie var_fresh)
1868 if true {
1869 let mut rng = DefaultSecureRng::new();
1870 let mut check = Stats { samples: vec![] };
1871 for _ in 0..10 {
1872 // generate a new collective public key
1873 let mut pk_cr_seed = [0u8; 32];
1874 rng.fill_bytes(&mut pk_cr_seed);
1875 let public_key_share = parties
1876 .iter()
1877 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1878 .collect_vec();
1879 let collective_pk = PublicKey::<
1880 Vec<Vec<u64>>,
1881 DefaultSecureRng,
1882 ModularOpsU64<CiphertextModulus<u64>>,
1883 >::from(public_key_share.as_slice());
1884
1885 let mut m = vec![0u64; rlwe_n];
1886 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
1887 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1888 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
1889 &mut rlwe_ct,
1890 collective_pk.key(),
1891 &m,
1892 rlwe_modop,
1893 rlwe_nttop,
1894 &mut rng,
1895 );
1896
1897 let mut m_back = vec![0u64; rlwe_n];
1898 decrypt_rlwe(
1899 &rlwe_ct,
1900 ideal_client_key.sk_rlwe().values(),
1901 &mut m_back,
1902 rlwe_nttop,
1903 rlwe_modop,
1904 );
1905
1906 rlwe_modop.elwise_sub_mut(m_back.as_mut_slice(), m.as_slice());
1907
1908 check.add_more(Vec::<i64>::try_convert_from(&m_back, rlwe_q).as_slice());
1909 }
1910
1911 println!("Public key Std: {}", check.std_dev().abs().log2());
1912 }
1913
1914 if true {
1915 // Generate server key shares
1916 let mut rng = DefaultSecureRng::new();
1917 let mut pk_cr_seed = [0u8; 32];
1918 rng.fill_bytes(&mut pk_cr_seed);
1919 let public_key_share = parties
1920 .iter()
1921 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1922 .collect_vec();
1923 let collective_pk = PublicKey::<
1924 Vec<Vec<u64>>,
1925 DefaultSecureRng,
1926 ModularOpsU64<CiphertextModulus<u64>>,
1927 >::from(public_key_share.as_slice());
1928
1929 let pbs_cr_seed = [0u8; 32];
1930 rng.fill_bytes(&mut pk_cr_seed);
1931 let server_key_shares = parties
1932 .iter()
1933 .map(|k| {
1934 bool_evaluator.multi_party_server_key_share(pbs_cr_seed, collective_pk.key(), k)
1935 })
1936 .collect_vec();
1937
1938 let seeded_server_key =
1939 bool_evaluator.aggregate_multi_party_server_key_shares(&server_key_shares);
1940
1941 // Check noise in RGSW ciphertexts of ideal LWE secret elements
1942 if false {
1943 let mut check = Stats { samples: vec![] };
1944 izip!(
1945 ideal_client_key.sk_lwe().values.iter(),
1946 seeded_server_key.rgsw_cts().iter()
1947 )
1948 .for_each(|(s_i, rgsw_ct_i)| {
1949 // X^{s[i]}
1950 let mut m_si = vec![0u64; rlwe_n];
1951 let s_i = *s_i * (bool_evaluator.pbs_info.embedding_factor as i32);
1952 if s_i < 0 {
1953 m_si[rlwe_n - (s_i.abs() as usize)] = rlwe_q.neg_one();
1954 } else {
1955 m_si[s_i as usize] = 1;
1956 }
1957
1958 // RLWE'(-sm)
1959 let mut neg_s_eval =
1960 Vec::<u64>::try_convert_from(ideal_client_key.sk_rlwe().values(), rlwe_q);
1961 rlwe_modop.elwise_neg_mut(&mut neg_s_eval);
1962 rlwe_nttop.forward(&mut neg_s_eval);
1963 for j in 0..rlwe_rgsw_decomposer.a().decomposition_count() {
1964 // RLWE(B^{j} * -s[X]*X^{s_lwe[i]})
1965
1966 // -s[X]*X^{s_lwe[i]}*B_j
1967 let mut m_ideal = m_si.clone();
1968 rlwe_nttop.forward(m_ideal.as_mut_slice());
1969 rlwe_modop.elwise_mul_mut(m_ideal.as_mut_slice(), neg_s_eval.as_slice());
1970 rlwe_nttop.backward(m_ideal.as_mut_slice());
1971 rlwe_modop
1972 .elwise_scalar_mul_mut(m_ideal.as_mut_slice(), &rlwe_rgsw_gadget_a[j]);
1973
1974 // RLWE(-s*X^{s_lwe[i]}*B_j)
1975 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1976 rlwe_ct[0].copy_from_slice(&rgsw_ct_i[j]);
1977 rlwe_ct[1].copy_from_slice(
1978 &rgsw_ct_i[j + rlwe_rgsw_decomposer.a().decomposition_count()],
1979 );
1980
1981 let mut m_back = vec![0u64; rlwe_n];
1982 decrypt_rlwe(
1983 &rlwe_ct,
1984 ideal_client_key.sk_rlwe().values(),
1985 &mut m_back,
1986 rlwe_nttop,
1987 rlwe_modop,
1988 );
1989
1990 // diff
1991 rlwe_modop.elwise_sub_mut(&mut m_back, &m_ideal);
1992 check.add_more(&Vec::<i64>::try_convert_from(&m_back, rlwe_q));
1993 }
1994
1995 // RLWE'(m)
1996 for j in 0..rlwe_rgsw_decomposer.b().decomposition_count() {
1997 // RLWE(B^{j} * X^{s_lwe[i]})
1998
1999 // X^{s_lwe[i]}*B_j
2000 let mut m_ideal = m_si.clone();
2001 rlwe_modop
2002 .elwise_scalar_mul_mut(m_ideal.as_mut_slice(), &rlwe_rgsw_gadget_b[j]);
2003
2004 // RLWE(X^{s_lwe[i]}*B_j)
2005 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
2006 rlwe_ct[0].copy_from_slice(
2007 &rgsw_ct_i[j + (2 * rlwe_rgsw_decomposer.a().decomposition_count())],
2008 );
2009 rlwe_ct[1].copy_from_slice(
2010 &rgsw_ct_i[j
2011 + (2 * rlwe_rgsw_decomposer.a().decomposition_count()
2012 + rlwe_rgsw_decomposer.b().decomposition_count())],
2013 );
2014
2015 let mut m_back = vec![0u64; rlwe_n];
2016 decrypt_rlwe(
2017 &rlwe_ct,
2018 ideal_client_key.sk_rlwe().values(),
2019 &mut m_back,
2020 rlwe_nttop,
2021 rlwe_modop,
2022 );
2023
2024 // diff
2025 rlwe_modop.elwise_sub_mut(&mut m_back, &m_ideal);
2026 check.add_more(&Vec::<i64>::try_convert_from(&m_back, rlwe_q));
2027 }
2028 });
2029 println!(
2030 "RGSW Std: {} {} ;; max={}",
2031 check.mean(),
2032 check.std_dev().abs().log2(),
2033 check.samples.iter().max().unwrap()
2034 );
2035 }
2036
2037 // server key in Evaluation domain
2038 let server_key_eval_domain =
2039 ServerKeyEvaluationDomain::<_, DefaultSecureRng, NttBackendU64>::from(
2040 &seeded_server_key,
2041 );
2042
2043 // check noise in RLWE x RGSW(X^{s_i}) where RGSW is accunulated RGSW ciphertext
2044 if false {
2045 let mut check = Stats { samples: vec![] };
2046
2047 izip!(
2048 ideal_client_key.sk_lwe().values(),
2049 server_key_eval_domain.rgsw_cts().iter()
2050 )
2051 .for_each(|(s_i, rgsw_ct_i)| {
2052 let mut m = vec![0u64; rlwe_n];
2053 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
2054 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
2055 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
2056 &mut rlwe_ct,
2057 collective_pk.key(),
2058 &m,
2059 rlwe_modop,
2060 rlwe_nttop,
2061 &mut rng,
2062 );
2063
2064 // RLWE(m*X^{s[i]}) = RLWE(m) x RGSW(X^{s[i]})
2065 // let mut rlwe_after = RlweCiphertext::<_, DefaultSecureRng>::new_trivial(vec![
2066 // vec![0u64; rlwe_n],
2067 // m.clone(),
2068 // ]);
2069 let mut rlwe_after = RlweCiphertext::<_, DefaultSecureRng> {
2070 data: rlwe_ct.clone(),
2071 is_trivial: false,
2072 _phatom: PhantomData,
2073 };
2074 let mut scratch = vec![
2075 vec![0u64; rlwe_n];
2076 std::cmp::max(
2077 rlwe_rgsw_decomposer.0.decomposition_count(),
2078 rlwe_rgsw_decomposer.1.decomposition_count()
2079 ) + 2
2080 ];
2081 rlwe_by_rgsw(
2082 &mut rlwe_after,
2083 rgsw_ct_i,
2084 &mut scratch,
2085 rlwe_rgsw_decomposer,
2086 rlwe_nttop,
2087 rlwe_modop,
2088 );
2089
2090 // m1 = X^{s[i]}
2091 let mut m1 = vec![0u64; rlwe_n];
2092 let s_i = *s_i * (bool_evaluator.pbs_info.embedding_factor as i32);
2093 if s_i < 0 {
2094 m1[rlwe_n - (s_i.abs() as usize)] = rlwe_q.neg_one()
2095 } else {
2096 m1[s_i as usize] = 1;
2097 }
2098
2099 // (m+e) * m1
2100 let mut m_plus_e_times_m1 = vec![0u64; rlwe_n];
2101 decrypt_rlwe(
2102 &rlwe_ct,
2103 ideal_client_key.sk_rlwe().values(),
2104 &mut m_plus_e_times_m1,
2105 rlwe_nttop,
2106 rlwe_modop,
2107 );
2108 rlwe_nttop.forward(m_plus_e_times_m1.as_mut_slice());
2109 rlwe_nttop.forward(m1.as_mut_slice());
2110 rlwe_modop.elwise_mul_mut(m_plus_e_times_m1.as_mut_slice(), m1.as_slice());
2111 rlwe_nttop.backward(m_plus_e_times_m1.as_mut_slice());
2112
2113 // Resulting RLWE ciphertext will equal: (m0m1 + em1) + e_{rlsw x rgsw}.
2114 // Hence, resulting rlwe ciphertext will have error em1 + e_{rlwe x rgsw}.
2115 // Here we're only concerned with e_{rlwe x rgsw}, that is noise added by
2116 // RLWExRGSW. Also note in practice m1 is a monomial, for ex, X^{s_{i}}, for
2117 // some i and var(em1) = var(e).
2118 let mut m_plus_e_times_m1_more_e = vec![0u64; rlwe_n];
2119 decrypt_rlwe(
2120 &rlwe_after,
2121 ideal_client_key.sk_rlwe().values(),
2122 &mut m_plus_e_times_m1_more_e,
2123 rlwe_nttop,
2124 rlwe_modop,
2125 );
2126
2127 // diff
2128 rlwe_modop.elwise_sub_mut(
2129 m_plus_e_times_m1_more_e.as_mut_slice(),
2130 m_plus_e_times_m1.as_slice(),
2131 );
2132
2133 // let noise = measure_noise(
2134 // &rlwe_after,
2135 // &m_plus_e_times_m1,
2136 // rlwe_nttop,
2137 // rlwe_modop,
2138 // ideal_client_key.sk_rlwe.values(),
2139 // );
2140 // print!("NOISE: {}", noise);
2141
2142 check.add_more(&Vec::<i64>::try_convert_from(
2143 &m_plus_e_times_m1_more_e,
2144 rlwe_q,
2145 ));
2146 });
2147 println!(
2148 "RLWE x RGSW, where RGSW has noise var_brk, std: {} {}",
2149 check.std_dev(),
2150 check.std_dev().abs().log2()
2151 )
2152 }
2153
2154 // check noise in Auto key
2155 if false {
2156 let mut check = Stats { samples: vec![] };
2157
2158 let mut neg_s_poly =
2159 Vec::<u64>::try_convert_from(ideal_client_key.sk_rlwe().values(), rlwe_q);
2160 rlwe_modop.elwise_neg_mut(neg_s_poly.as_mut_slice());
2161
2162 let g = bool_evaluator.pbs_info.g();
2163 let br_q = bool_evaluator.pbs_info.br_q();
2164 let auto_element_dlogs = bool_evaluator.pbs_info.parameters.auto_element_dlogs();
2165 for i in auto_element_dlogs.into_iter() {
2166 let g_pow = if i == 0 {
2167 -g
2168 } else {
2169 (((g as usize).pow(i as u32)) % br_q) as isize
2170 };
2171
2172 // -s[X^k]
2173 let (auto_indices, auto_sign) = generate_auto_map(rlwe_n, g_pow);
2174 let mut neg_s_poly_auto_i = vec![0u64; rlwe_n];
2175 izip!(neg_s_poly.iter(), auto_indices.iter(), auto_sign.iter()).for_each(
2176 |(v, to_i, to_sign)| {
2177 if !to_sign {
2178 neg_s_poly_auto_i[*to_i] = rlwe_modop.neg(v);
2179 } else {
2180 neg_s_poly_auto_i[*to_i] = *v;
2181 }
2182 },
2183 );
2184
2185 let mut auto_key_i = server_key_eval_domain.galois_key_for_auto(i).clone();
2186 // send i^th auto key to coefficient domain
2187 auto_key_i
2188 .iter_mut()
2189 .for_each(|r| rlwe_nttop.backward(r.as_mut_slice()));
2190 auto_gadget.iter().enumerate().for_each(|(i, b_i)| {
2191 // B^i * -s[X^k]
2192 let mut m_ideal = neg_s_poly_auto_i.clone();
2193 rlwe_modop.elwise_scalar_mul_mut(m_ideal.as_mut_slice(), b_i);
2194
2195 let mut m_out = vec![0u64; rlwe_n];
2196 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
2197 rlwe_ct[0].copy_from_slice(&auto_key_i[i]);
2198 rlwe_ct[1].copy_from_slice(
2199 &auto_key_i[auto_decomposer.decomposition_count() + i],
2200 );
2201 decrypt_rlwe(
2202 &rlwe_ct,
2203 ideal_client_key.sk_rlwe().values(),
2204 &mut m_out,
2205 rlwe_nttop,
2206 rlwe_modop,
2207 );
2208
2209 // diff
2210 rlwe_modop.elwise_sub_mut(m_out.as_mut_slice(), m_ideal.as_slice());
2211
2212 check.add_more(&Vec::<i64>::try_convert_from(&m_out, rlwe_q));
2213 });
2214 }
2215
2216 println!("Auto key noise std dev: {}", check.std_dev().abs().log2());
2217 }
2218
2219 // check noise in RLWE(X^k) after sending RLWE(X) -> RLWE(X^k) using collective
2220 // auto key
2221 if true {
2222 let mut check = Stats { samples: vec![] };
2223 let br_q = bool_evaluator.pbs_info.br_q();
2224 let g = bool_evaluator.pbs_info.g();
2225 let auto_element_dlogs = bool_evaluator.pbs_info.parameters.auto_element_dlogs();
2226 for i in auto_element_dlogs.into_iter() {
2227 for _ in 0..10 {
2228 let mut m = vec![0u64; rlwe_n];
2229 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
2230 let mut rlwe_ct = RlweCiphertext::<_, DefaultSecureRng> {
2231 data: vec![vec![0u64; rlwe_n]; 2],
2232 is_trivial: false,
2233 _phatom: PhantomData,
2234 };
2235 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
2236 &mut rlwe_ct,
2237 collective_pk.key(),
2238 &m,
2239 rlwe_modop,
2240 rlwe_nttop,
2241 &mut rng,
2242 );
2243
2244 // We're only interested in noise increased as a result of automorphism.
2245 // Hence, we take m+e as the bench.
2246 let mut m_plus_e = vec![0u64; rlwe_n];
2247 decrypt_rlwe(
2248 &rlwe_ct,
2249 ideal_client_key.sk_rlwe().values(),
2250 &mut m_plus_e,
2251 rlwe_nttop,
2252 rlwe_modop,
2253 );
2254
2255 let auto_key = server_key_eval_domain.galois_key_for_auto(i);
2256 let (auto_map_index, auto_map_sign) =
2257 bool_evaluator.pbs_info.rlwe_auto_map(i);
2258 let mut scratch =
2259 vec![vec![0u64; rlwe_n]; auto_decomposer.decomposition_count() + 2];
2260 galois_auto(
2261 &mut rlwe_ct,
2262 auto_key,
2263 &mut scratch,
2264 &auto_map_index,
2265 &auto_map_sign,
2266 rlwe_modop,
2267 rlwe_nttop,
2268 auto_decomposer,
2269 );
2270
2271 // send m+e from X to X^k
2272 let mut m_plus_e_auto = vec![0u64; rlwe_n];
2273 izip!(m_plus_e.iter(), auto_map_index.iter(), auto_map_sign.iter())
2274 .for_each(|(v, to_index, to_sign)| {
2275 if !to_sign {
2276 m_plus_e_auto[*to_index] = rlwe_modop.neg(v);
2277 } else {
2278 m_plus_e_auto[*to_index] = *v
2279 }
2280 });
2281
2282 let mut m_out = vec![0u64; rlwe_n];
2283 decrypt_rlwe(
2284 &rlwe_ct,
2285 ideal_client_key.sk_rlwe().values(),
2286 &mut m_out,
2287 rlwe_nttop,
2288 rlwe_modop,
2289 );
2290
2291 // diff
2292 rlwe_modop.elwise_sub_mut(m_out.as_mut_slice(), m_plus_e_auto.as_slice());
2293
2294 check.add_more(&Vec::<i64>::try_convert_from(m_out.as_slice(), rlwe_q));
2295 }
2296 }
2297
2298 println!("Rlwe Auto Noise Std: {}", check.std_dev().abs().log2());
2299 }
2300
2301 // Check noise growth in ksk
2302 // TODO check in LWE key switching keys
2303 if true {
2304 // 1. encrypt LWE ciphertext
2305 // 2. Key switching
2306 // 3.
2307 let mut check = Stats { samples: vec![] };
2308
2309 for _ in 0..1024 {
2310 // Encrypt m \in Q_{ks} using RLWE sk
2311 let mut lwe_in_ct = vec![0u64; rlwe_n + 1];
2312 let m = RandomElementInModulus::random(&mut rng, &lwe_q.q().unwrap());
2313 encrypt_lwe(
2314 &mut lwe_in_ct,
2315 &m,
2316 ideal_client_key.sk_rlwe().values(),
2317 lwe_modop,
2318 &mut rng,
2319 );
2320
2321 // Key switch
2322 let mut lwe_out = vec![0u64; lwe_n + 1];
2323 lwe_key_switch(
2324 &mut lwe_out,
2325 &lwe_in_ct,
2326 server_key_eval_domain.lwe_ksk(),
2327 lwe_modop,
2328 bool_evaluator.pbs_info.lwe_decomposer(),
2329 );
2330
2331 // We only care about noise added by LWE key switch
2332 // m+e
2333 let m_plus_e =
2334 decrypt_lwe(&lwe_in_ct, ideal_client_key.sk_rlwe().values(), lwe_modop);
2335
2336 let m_plus_e_plus_lwe_ksk_noise =
2337 decrypt_lwe(&lwe_out, ideal_client_key.sk_lwe().values(), lwe_modop);
2338
2339 let diff = lwe_modop.sub(&m_plus_e_plus_lwe_ksk_noise, &m_plus_e);
2340
2341 check.add_more(&vec![lwe_q.map_element_to_i64(&diff)]);
2342 }
2343
2344 println!("Lwe ksk std dev: {}", check.std_dev().abs().log2());
2345 }
2346 }
2347
2348 // Check noise in fresh RGSW ciphertexts, ie X^{s_j[i]}, must equal noise in
2349 // fresh RLWE ciphertext
2350 if true {}
2351 // test LWE ksk from RLWE -> LWE
2352 // if false {
2353 // let logp = 2;
2354 // let mut rng = DefaultSecureRng::new();
2355
2356 // let m = 1;
2357 // let encoded_m = m << (lwe_logq - logp);
2358
2359 // // Encrypt
2360 // let mut lwe_ct = vec![0u64; rlwe_n + 1];
2361 // encrypt_lwe(
2362 // &mut lwe_ct,
2363 // &encoded_m,
2364 // ideal_client_key.sk_rlwe.values(),
2365 // lwe_modop,
2366 // &mut rng,
2367 // );
2368
2369 // // key switch
2370 // let lwe_decomposer = &bool_evaluator.decomposer_lwe;
2371 // let mut lwe_out = vec![0u64; lwe_n + 1];
2372 // lwe_key_switch(
2373 // &mut lwe_out,
2374 // &lwe_ct,
2375 // &server_key_eval.lwe_ksk,
2376 // lwe_modop,
2377 // lwe_decomposer,
2378 // );
2379
2380 // let encoded_m_back = decrypt_lwe(&lwe_out,
2381 // ideal_client_key.sk_lwe.values(), lwe_modop); let m_back
2382 // = ((encoded_m_back as f64 * (1 << logp) as f64) /
2383 // (lwe_q as f64)).round() as u64; dbg!(m_back, m);
2384
2385 // let noise = measure_noise_lwe(
2386 // &lwe_out,
2387 // ideal_client_key.sk_lwe.values(),
2388 // lwe_modop,
2389 // &encoded_m,
2390 // );
2391
2392 // println!("Noise: {noise}");
2393 // }
2394
2395 // Measure noise in RGSW ciphertexts of ideal LWE secrets
2396 // if true {
2397 // let gadget_vec = gadget_vector(
2398 // bool_evaluator.parameters.rlwe_logq,
2399 // bool_evaluator.parameters.logb_rgsw,
2400 // bool_evaluator.parameters.d_rgsw,
2401 // );
2402
2403 // for i in 0..20 {
2404 // // measure noise in RGSW(s[i])
2405 // let si =
2406 // ideal_client_key.sk_lwe.values[i] *
2407 // (bool_evaluator.embedding_factor as i32); let mut
2408 // si_poly = vec![0u64; rlwe_n]; if si < 0 {
2409 // si_poly[rlwe_n - (si.abs() as usize)] = rlwe_q - 1;
2410 // } else {
2411 // si_poly[(si.abs() as usize)] = 1;
2412 // }
2413
2414 // let mut rgsw_si = server_key_eval.rgsw_cts[i].clone();
2415 // rgsw_si
2416 // .iter_mut()
2417 // .for_each(|ri| rlwe_nttop.backward(ri.as_mut()));
2418
2419 // println!("####### Noise in RGSW(X^s_{i}) #######");
2420 // _measure_noise_rgsw(
2421 // &rgsw_si,
2422 // &si_poly,
2423 // ideal_client_key.sk_rlwe.values(),
2424 // &gadget_vec,
2425 // rlwe_q,
2426 // );
2427 // println!("####### ##################### #######");
2428 // }
2429 // }
2430
2431 // // measure noise grwoth in RLWExRGSW
2432 // if true {
2433 // let mut rng = DefaultSecureRng::new();
2434 // let mut carry_m = vec![0u64; rlwe_n];
2435 // RandomUniformDist1::random_fill(&mut rng, &rlwe_q,
2436 // carry_m.as_mut_slice());
2437
2438 // // RGSW(carrym)
2439 // let trivial_rlwect = vec![vec![0u64; rlwe_n], carry_m.clone()];
2440 // let mut rlwe_ct = RlweCiphertext::<_,
2441 // DefaultSecureRng>::from_raw(trivial_rlwect, true);
2442
2443 // let mut scratch_matrix_dplus2_ring = vec![vec![0u64; rlwe_n];
2444 // d_rgsw + 2]; let mul_mod =
2445 // |v0: &u64, v1: &u64| (((*v0 as u128 * *v1 as u128) % (rlwe_q as u128)) as u64);
2446
2447 // for i in 0..bool_evaluator.parameters.lwe_n {
2448 // rlwe_by_rgsw(
2449 // &mut rlwe_ct,
2450 // server_key_eval.rgsw_ct_lwe_si(i),
2451 // &mut scratch_matrix_dplus2_ring,
2452 // rlwe_decomposer,
2453 // rlwe_nttop,
2454 // rlwe_modop,
2455 // );
2456
2457 // // carry_m[X] * s_i[X]
2458 // let si =
2459 // ideal_client_key.sk_lwe.values[i] *
2460 // (bool_evaluator.embedding_factor as i32); let mut
2461 // si_poly = vec![0u64; rlwe_n]; if si < 0 {
2462 // si_poly[rlwe_n - (si.abs() as usize)] = rlwe_q - 1;
2463 // } else {
2464 // si_poly[(si.abs() as usize)] = 1;
2465 // }
2466 // carry_m = negacyclic_mul(&carry_m, &si_poly, mul_mod,
2467 // rlwe_q);
2468
2469 // let noise = measure_noise(
2470 // &rlwe_ct,
2471 // &carry_m,
2472 // rlwe_nttop,
2473 // rlwe_modop,
2474 // ideal_client_key.sk_rlwe.values(),
2475 // );
2476 // println!("Noise RLWE(carry_m) accumulating {i}^th secret
2477 // monomial: {noise}"); }
2478 // }
2479
2480 // // Check galois keys
2481 // if false {
2482 // let g = bool_evaluator.g() as isize;
2483 // let mut rng = DefaultSecureRng::new();
2484 // let mut scratch_matrix_dplus2_ring = vec![vec![0u64; rlwe_n];
2485 // d_rgsw + 2]; for i in [g, -g] {
2486 // let mut m = vec![0u64; rlwe_n];
2487 // RandomUniformDist1::random_fill(&mut rng, &rlwe_q,
2488 // m.as_mut_slice()); let mut rlwe_ct = {
2489 // let mut data = vec![vec![0u64; rlwe_n]; 2];
2490 // public_key_encrypt_rlwe(
2491 // &mut data,
2492 // &collective_pk.key,
2493 // &m,
2494 // rlwe_modop,
2495 // rlwe_nttop,
2496 // &mut rng,
2497 // );
2498 // RlweCiphertext::<_, DefaultSecureRng>::from_raw(data,
2499 // false) };
2500
2501 // let auto_key = server_key_eval.galois_key_for_auto(i);
2502 // let (auto_map_index, auto_map_sign) =
2503 // generate_auto_map(rlwe_n, i); galois_auto(
2504 // &mut rlwe_ct,
2505 // auto_key,
2506 // &mut scratch_matrix_dplus2_ring,
2507 // &auto_map_index,
2508 // &auto_map_sign,
2509 // rlwe_modop,
2510 // rlwe_nttop,
2511 // rlwe_decomposer,
2512 // );
2513
2514 // // send m(X) -> m(X^i)
2515 // let mut m_k = vec![0u64; rlwe_n];
2516 // izip!(m.iter(), auto_map_index.iter(),
2517 // auto_map_sign.iter()).for_each( |(mi, to_index, to_sign)|
2518 // { if !to_sign {
2519 // m_k[*to_index] = rlwe_q - *mi;
2520 // } else {
2521 // m_k[*to_index] = *mi;
2522 // }
2523 // },
2524 // );
2525
2526 // // measure noise
2527 // let noise = measure_noise(
2528 // &rlwe_ct,
2529 // &m_k,
2530 // rlwe_nttop,
2531 // rlwe_modop,
2532 // ideal_client_key.sk_rlwe.values(),
2533 // );
2534
2535 // println!("Noise after auto k={i}: {noise}");
2536 // }
2537 // }
2538 }
2539}