phantom-zone/src/bool/evaluator.rs
src/bool/evaluator.rsRaw
1use std::{
2 borrow::BorrowMut,
3 cell::{OnceCell, RefCell},
4 clone,
5 collections::HashMap,
6 fmt::{Debug, Display},
7 iter::Once,
8 marker::PhantomData,
9 ops::Shr,
10 sync::OnceLock,
11};
12
13use itertools::{izip, partition, Itertools};
14use num_traits::{FromPrimitive, Num, One, Pow, PrimInt, ToPrimitive, WrappingSub, Zero};
15use rand_distr::uniform::SampleUniform;
16
17use crate::{
18 backend::{ArithmeticOps, GetModulus, ModInit, ModularOpsU64, Modulus, VectorOps},
19 decomposer::{Decomposer, DefaultDecomposer, NumInfo, RlweDecomposer},
20 lwe::{decrypt_lwe, encrypt_lwe, lwe_key_switch, lwe_ksk_keygen, measure_noise_lwe, LweSecret},
21 multi_party::public_key_share,
22 ntt::{self, Ntt, NttBackendU64, NttInit},
23 pbs::{pbs, sample_extract, PbsInfo, PbsKey},
24 random::{
25 DefaultSecureRng, NewWithSeed, RandomFill, RandomFillGaussianInModulus,
26 RandomFillUniformInModulus, RandomGaussianElementInModulus,
27 },
28 rgsw::{
29 decrypt_rlwe, galois_auto, galois_key_gen, generate_auto_map, public_key_encrypt_rgsw,
30 rgsw_by_rgsw_inplace, rlwe_by_rgsw, secret_key_encrypt_rgsw, IsTrivial, RgswCiphertext,
31 RlweCiphertext, RlweSecret,
32 },
33 utils::{
34 fill_random_ternary_secret_with_hamming_weight, generate_prime, mod_exponent, Global,
35 TryConvertFrom1, WithLocal,
36 },
37 Decryptor, Encryptor, Matrix, MatrixEntity, MatrixMut, MultiPartyDecryptor, Row, RowEntity,
38 RowMut, Secret,
39};
40
41use super::{
42 keys::ClientKey,
43 parameters::{BoolParameters, CiphertextModulus},
44 CommonReferenceSeededCollectivePublicKeyShare, CommonReferenceSeededMultiPartyServerKeyShare,
45 SeededMultiPartyServerKey, SeededServerKey, ServerKeyEvaluationDomain,
46};
47
48pub struct MultiPartyCrs<S> {
49 pub(super) seed: S,
50}
51
52impl<S: Default + Copy> MultiPartyCrs<S> {
53 /// Seed to generate public key share using MultiPartyCrs as the main seed.
54 ///
55 /// Public key seed equals the 1st seed extracted from PRNG Seeded with
56 /// MiltiPartyCrs's seed.
57 pub(super) fn public_key_share_seed<Rng: NewWithSeed<Seed = S> + RandomFill<S>>(&self) -> S {
58 let mut prng = Rng::new_with_seed(self.seed);
59
60 let mut seed = S::default();
61 RandomFill::<S>::random_fill(&mut prng, &mut seed);
62 seed
63 }
64
65 /// Seed to generate server key share using MultiPartyCrs as the main seed.
66 ///
67 /// Server key seed equals the 2nd seed extracted from PRNG Seeded with
68 /// MiltiPartyCrs's seed.
69 pub(super) fn server_key_share_seed<Rng: NewWithSeed<Seed = S> + RandomFill<S>>(&self) -> S {
70 let mut prng = Rng::new_with_seed(self.seed);
71
72 let mut seed = S::default();
73 RandomFill::<S>::random_fill(&mut prng, &mut seed);
74 RandomFill::<S>::random_fill(&mut prng, &mut seed);
75 seed
76 }
77}
78
79pub(crate) trait BooleanGates {
80 type Ciphertext: RowEntity;
81 type Key;
82
83 fn and_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
84 fn nand_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
85 fn or_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
86 fn nor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
87 fn xor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
88 fn xnor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
89 fn not_inplace(&mut self, c: &mut Self::Ciphertext);
90
91 fn and(
92 &mut self,
93 c0: &Self::Ciphertext,
94 c1: &Self::Ciphertext,
95 key: &Self::Key,
96 ) -> Self::Ciphertext;
97 fn nand(
98 &mut self,
99 c0: &Self::Ciphertext,
100 c1: &Self::Ciphertext,
101 key: &Self::Key,
102 ) -> Self::Ciphertext;
103 fn or(
104 &mut self,
105 c0: &Self::Ciphertext,
106 c1: &Self::Ciphertext,
107 key: &Self::Key,
108 ) -> Self::Ciphertext;
109 fn nor(
110 &mut self,
111 c0: &Self::Ciphertext,
112 c1: &Self::Ciphertext,
113 key: &Self::Key,
114 ) -> Self::Ciphertext;
115 fn xor(
116 &mut self,
117 c0: &Self::Ciphertext,
118 c1: &Self::Ciphertext,
119 key: &Self::Key,
120 ) -> Self::Ciphertext;
121 fn xnor(
122 &mut self,
123 c0: &Self::Ciphertext,
124 c1: &Self::Ciphertext,
125 key: &Self::Key,
126 ) -> Self::Ciphertext;
127 fn not(&mut self, c: &Self::Ciphertext) -> Self::Ciphertext;
128}
129
130struct ScratchMemory<M>
131where
132 M: Matrix,
133{
134 lwe_vector: M::R,
135 decomposition_matrix: M,
136}
137
138impl<M: MatrixEntity> ScratchMemory<M>
139where
140 M::R: RowEntity,
141{
142 fn new(parameters: &BoolParameters<M::MatElement>) -> Self {
143 // Vector to store LWE ciphertext with LWE dimesnion n
144 let lwe_vector = M::R::zeros(parameters.lwe_n().0 + 1);
145
146 // Matrix to store decomposed polynomials
147 // Max decompistion count + space for temporary RLWE
148 let d = std::cmp::max(
149 parameters.auto_decomposition_count().0,
150 std::cmp::max(
151 parameters.rlwe_rgsw_decomposition_count().0 .0,
152 parameters.rlwe_rgsw_decomposition_count().1 .0,
153 ),
154 ) + 2;
155 let decomposition_matrix = M::zeros(d, parameters.rlwe_n().0);
156
157 Self {
158 lwe_vector,
159 decomposition_matrix,
160 }
161 }
162}
163
164pub(super) trait BoolEncoding {
165 type Element;
166 fn true_el(&self) -> Self::Element;
167 fn false_el(&self) -> Self::Element;
168 fn qby4(&self) -> Self::Element;
169 fn decode(&self, m: Self::Element) -> bool;
170}
171
172impl<T> BoolEncoding for CiphertextModulus<T>
173where
174 CiphertextModulus<T>: Modulus<Element = T>,
175 T: PrimInt,
176{
177 type Element = T;
178
179 fn qby4(&self) -> Self::Element {
180 if self.is_native() {
181 T::one() << (CiphertextModulus::<T>::_bits() - 2)
182 } else {
183 self.q().unwrap() >> 2
184 }
185 }
186 /// Q/8
187 fn true_el(&self) -> Self::Element {
188 if self.is_native() {
189 T::one() << (CiphertextModulus::<T>::_bits() - 3)
190 } else {
191 self.q().unwrap() >> 3
192 }
193 }
194 /// -Q/8
195 fn false_el(&self) -> Self::Element {
196 self.largest_unsigned_value() - self.true_el() + T::one()
197 }
198 fn decode(&self, m: Self::Element) -> bool {
199 let qby8 = self.true_el();
200 let m = (((m + qby8).to_f64().unwrap() * 4.0f64) / self.q_as_f64().unwrap()).round()
201 as usize
202 % 4usize;
203
204 if m == 0 {
205 return false;
206 } else if m == 1 {
207 return true;
208 } else {
209 panic!("Incorrect bool decryption. Got m={m} but expected m to be 0 or 1")
210 }
211 }
212}
213
214pub(super) struct BoolPbsInfo<M: Matrix, Ntt, RlweModOp, LweModOp> {
215 auto_decomposer: DefaultDecomposer<M::MatElement>,
216 rlwe_rgsw_decomposer: (
217 DefaultDecomposer<M::MatElement>,
218 DefaultDecomposer<M::MatElement>,
219 ),
220 lwe_decomposer: DefaultDecomposer<M::MatElement>,
221 g_k_dlog_map: Vec<usize>,
222 rlwe_nttop: Ntt,
223 rlwe_modop: RlweModOp,
224 lwe_modop: LweModOp,
225 embedding_factor: usize,
226 rlwe_qby4: M::MatElement,
227 rlwe_auto_maps: Vec<(Vec<usize>, Vec<bool>)>,
228 parameters: BoolParameters<M::MatElement>,
229}
230
231impl<M: Matrix, NttOp, RlweModOp, LweModOp> PbsInfo for BoolPbsInfo<M, NttOp, RlweModOp, LweModOp>
232where
233 M::MatElement: PrimInt + WrappingSub + NumInfo + FromPrimitive + From<bool> + Display,
234 RlweModOp: ArithmeticOps<Element = M::MatElement> + VectorOps<Element = M::MatElement>,
235 LweModOp: ArithmeticOps<Element = M::MatElement> + VectorOps<Element = M::MatElement>,
236 NttOp: Ntt<Element = M::MatElement>,
237{
238 type Modulus = CiphertextModulus<M::MatElement>;
239 type Element = M::MatElement;
240 type D = DefaultDecomposer<M::MatElement>;
241 type RlweModOp = RlweModOp;
242 type LweModOp = LweModOp;
243 type NttOp = NttOp;
244 fn rlwe_auto_map(&self, k: usize) -> &(Vec<usize>, Vec<bool>) {
245 &self.rlwe_auto_maps[k]
246 }
247 fn br_q(&self) -> usize {
248 *self.parameters.br_q()
249 }
250 fn lwe_decomposer(&self) -> &Self::D {
251 &self.lwe_decomposer
252 }
253 fn rlwe_rgsw_decomposer(&self) -> &(Self::D, Self::D) {
254 &self.rlwe_rgsw_decomposer
255 }
256 fn auto_decomposer(&self) -> &Self::D {
257 &self.auto_decomposer
258 }
259 fn embedding_factor(&self) -> usize {
260 self.embedding_factor
261 }
262 fn g(&self) -> isize {
263 self.parameters.g() as isize
264 }
265 fn w(&self) -> usize {
266 self.parameters.w()
267 }
268 fn g_k_dlog_map(&self) -> &[usize] {
269 &self.g_k_dlog_map
270 }
271 fn lwe_n(&self) -> usize {
272 self.parameters.lwe_n().0
273 }
274 fn lwe_q(&self) -> &Self::Modulus {
275 self.parameters.lwe_q()
276 }
277 fn rlwe_n(&self) -> usize {
278 self.parameters.rlwe_n().0
279 }
280 fn rlwe_q(&self) -> &Self::Modulus {
281 self.parameters.rlwe_q()
282 }
283 fn modop_lweq(&self) -> &Self::LweModOp {
284 &self.lwe_modop
285 }
286 fn modop_rlweq(&self) -> &Self::RlweModOp {
287 &self.rlwe_modop
288 }
289 fn nttop_rlweq(&self) -> &Self::NttOp {
290 &self.rlwe_nttop
291 }
292}
293
294pub(crate) struct BoolEvaluator<M, Ntt, RlweModOp, LweModOp>
295where
296 M: Matrix,
297{
298 pbs_info: BoolPbsInfo<M, Ntt, RlweModOp, LweModOp>,
299 scratch_memory: ScratchMemory<M>,
300 nand_test_vec: M::R,
301 and_test_vec: M::R,
302 or_test_vec: M::R,
303 nor_test_vec: M::R,
304 xor_test_vec: M::R,
305 xnor_test_vec: M::R,
306 _phantom: PhantomData<M>,
307}
308
309impl<M: Matrix, NttOp, RlweModOp, LweModOp> BoolEvaluator<M, NttOp, RlweModOp, LweModOp> {
310 pub(super) fn parameters(&self) -> &BoolParameters<M::MatElement> {
311 &self.pbs_info.parameters
312 }
313
314 pub(super) fn pbs_info(&self) -> &BoolPbsInfo<M, NttOp, RlweModOp, LweModOp> {
315 &self.pbs_info
316 }
317}
318
319impl<M: Matrix, NttOp, RlweModOp, LweModOp> BoolEvaluator<M, NttOp, RlweModOp, LweModOp>
320where
321 M: MatrixEntity + MatrixMut,
322 M::MatElement: PrimInt
323 + Debug
324 + Display
325 + NumInfo
326 + FromPrimitive
327 + WrappingSub
328 + SampleUniform
329 + From<bool>,
330 NttOp: Ntt<Element = M::MatElement>,
331 RlweModOp: ArithmeticOps<Element = M::MatElement>
332 + VectorOps<Element = M::MatElement>
333 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
334 LweModOp: ArithmeticOps<Element = M::MatElement>
335 + VectorOps<Element = M::MatElement>
336 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
337 M::R: TryConvertFrom1<[i32], CiphertextModulus<M::MatElement>> + RowEntity + Debug,
338 <M as Matrix>::R: RowMut,
339{
340 pub(super) fn new(parameters: BoolParameters<M::MatElement>) -> Self
341 where
342 RlweModOp: ModInit<M = CiphertextModulus<M::MatElement>>,
343 LweModOp: ModInit<M = CiphertextModulus<M::MatElement>>,
344 NttOp: NttInit<CiphertextModulus<M::MatElement>>,
345 {
346 //TODO(Jay): Run sanity checks for modulus values in parameters
347
348 // generates dlog map s.t. (+/-)g^{k} % q = a, for all a \in Z*_{q} and k \in
349 // [0, q/4). We store the dlog `k` at index `a`. This makes it easier to
350 // simply look up `k` at runtime as vec[a]. If a = g^{k} then dlog is
351 // stored as k. If a = -g^{k} then dlog is stored as k = q/4. This is done to
352 // differentiate sign.
353 let g = parameters.g();
354 let q = *parameters.br_q();
355 let mut g_k_dlog_map = vec![0usize; q];
356 for i in 0..q / 4 {
357 let v = mod_exponent(g as u64, i as u64, q as u64) as usize;
358 // g^i
359 g_k_dlog_map[v] = i;
360 // -(g^i)
361 g_k_dlog_map[q - v] = i + (q / 4);
362 }
363
364 let embedding_factor = (2 * parameters.rlwe_n().0) / q;
365
366 let rlwe_nttop = NttOp::new(parameters.rlwe_q(), parameters.rlwe_n().0);
367 let rlwe_modop = RlweModOp::new(*parameters.rlwe_q());
368 let lwe_modop = LweModOp::new(*parameters.lwe_q());
369
370 let q = *parameters.br_q();
371 let qby2 = q >> 1;
372 let qby8 = q >> 3;
373 // Q/8 (Q: rlwe_q)
374 let true_m_el = parameters.rlwe_q().true_el();
375 // -Q/8
376 let false_m_el = parameters.rlwe_q().false_el();
377 let (auto_map_index, auto_map_sign) = generate_auto_map(qby2, -(g as isize));
378
379 let init_test_vec = |partition_el: usize,
380 before_partition_el: M::MatElement,
381 after_partition_el: M::MatElement| {
382 let mut test_vec = M::R::zeros(qby2);
383 for i in 0..qby2 {
384 if i < partition_el {
385 test_vec.as_mut()[i] = before_partition_el;
386 } else {
387 test_vec.as_mut()[i] = after_partition_el;
388 }
389 }
390
391 // v(X) -> v(X^{-g})
392 let mut test_vec_autog = M::R::zeros(qby2);
393 izip!(
394 test_vec.as_ref().iter(),
395 auto_map_index.iter(),
396 auto_map_sign.iter()
397 )
398 .for_each(|(v, to_index, to_sign)| {
399 if !to_sign {
400 // negate
401 test_vec_autog.as_mut()[*to_index] = rlwe_modop.neg(v);
402 } else {
403 test_vec_autog.as_mut()[*to_index] = *v;
404 }
405 });
406
407 return test_vec_autog;
408 };
409
410 let nand_test_vec = init_test_vec(3 * qby8, true_m_el, false_m_el);
411 let and_test_vec = init_test_vec(3 * qby8, false_m_el, true_m_el);
412 let or_test_vec = init_test_vec(qby8, false_m_el, true_m_el);
413 let nor_test_vec = init_test_vec(qby8, true_m_el, false_m_el);
414 let xor_test_vec = init_test_vec(qby8, false_m_el, true_m_el);
415 let xnor_test_vec = init_test_vec(qby8, true_m_el, false_m_el);
416
417 // auto map indices and sign
418 // Auto maps are stored as [-g, g^{1}, g^{2}, ..., g^{w}]
419 let mut rlwe_auto_maps = vec![];
420 let ring_size = parameters.rlwe_n().0;
421 let g = parameters.g();
422 let br_q = parameters.br_q();
423 let auto_element_dlogs = parameters.auto_element_dlogs();
424 assert!(auto_element_dlogs[0] == 0);
425 for i in auto_element_dlogs.into_iter() {
426 let el = if i == 0 {
427 -(g as isize)
428 } else {
429 (g.pow(i as u32) % br_q) as isize
430 };
431 rlwe_auto_maps.push(generate_auto_map(ring_size, el))
432 }
433
434 let rlwe_qby4 = parameters.rlwe_q().qby4();
435
436 let scratch_memory = ScratchMemory::new(¶meters);
437
438 let pbs_info = BoolPbsInfo {
439 auto_decomposer: parameters.auto_decomposer(),
440 lwe_decomposer: parameters.lwe_decomposer(),
441 rlwe_rgsw_decomposer: parameters.rlwe_rgsw_decomposer(),
442 g_k_dlog_map,
443 embedding_factor,
444 lwe_modop,
445 rlwe_modop,
446 rlwe_nttop,
447 rlwe_qby4,
448 rlwe_auto_maps,
449 parameters: parameters,
450 };
451
452 BoolEvaluator {
453 pbs_info,
454 scratch_memory,
455 nand_test_vec,
456 and_test_vec,
457 or_test_vec,
458 nor_test_vec,
459 xnor_test_vec,
460 xor_test_vec,
461 _phantom: PhantomData,
462 }
463 }
464
465 pub(super) fn client_key(&self) -> ClientKey {
466 let sk_lwe = LweSecret::random(
467 self.pbs_info.parameters.lwe_n().0 >> 1,
468 self.pbs_info.parameters.lwe_n().0,
469 );
470 let sk_rlwe = RlweSecret::random(
471 self.pbs_info.parameters.rlwe_n().0 >> 1,
472 self.pbs_info.parameters.rlwe_n().0,
473 );
474 ClientKey::new(sk_rlwe, sk_lwe)
475 }
476
477 pub(super) fn server_key(
478 &self,
479 client_key: &ClientKey,
480 ) -> SeededServerKey<M, BoolParameters<M::MatElement>, [u8; 32]> {
481 DefaultSecureRng::with_local_mut(|rng| {
482 let mut main_seed = [0u8; 32];
483 rng.fill_bytes(&mut main_seed);
484
485 let mut main_prng = DefaultSecureRng::new_seeded(main_seed);
486
487 let rlwe_n = self.pbs_info.parameters.rlwe_n().0;
488 let sk_rlwe = client_key.sk_rlwe();
489 let sk_lwe = client_key.sk_lwe();
490
491 // generate auto keys
492 let mut auto_keys = HashMap::new();
493 let auto_gadget = self.pbs_info.auto_decomposer.gadget_vector();
494 let g = self.pbs_info.parameters.g();
495 let br_q = self.pbs_info.parameters.br_q();
496 let auto_els = self.pbs_info.parameters.auto_element_dlogs();
497 for i in auto_els.into_iter() {
498 let g_pow = if i == 0 {
499 -(g as isize)
500 } else {
501 (g.pow(i as u32) % br_q) as isize
502 };
503 let mut gk = M::zeros(self.pbs_info.auto_decomposer.decomposition_count(), rlwe_n);
504 galois_key_gen(
505 &mut gk,
506 sk_rlwe.values(),
507 g_pow,
508 &auto_gadget,
509 &self.pbs_info.rlwe_modop,
510 &self.pbs_info.rlwe_nttop,
511 &mut main_prng,
512 rng,
513 );
514 auto_keys.insert(i, gk);
515 }
516
517 // generate rgsw ciphertexts RGSW(si) where si is i^th LWE secret element
518 let ring_size = self.pbs_info.parameters.rlwe_n().0;
519 let rlwe_q = self.pbs_info.parameters.rlwe_q();
520 let (rlrg_d_a, rlrg_d_b) = (
521 self.pbs_info.rlwe_rgsw_decomposer.0.decomposition_count(),
522 self.pbs_info.rlwe_rgsw_decomposer.1.decomposition_count(),
523 );
524 let rlrg_gadget_a = self.pbs_info.rlwe_rgsw_decomposer.0.gadget_vector();
525 let rlrg_gadget_b = self.pbs_info.rlwe_rgsw_decomposer.1.gadget_vector();
526 let rgsw_cts = sk_lwe
527 .values()
528 .iter()
529 .map(|si| {
530 // X^{si}; assume |emebedding_factor * si| < N
531 let mut m = M::R::zeros(ring_size);
532 let si = (self.pbs_info.embedding_factor as i32) * si;
533 // dbg!(si);
534 if si < 0 {
535 // X^{-i} = X^{2N - i} = -X^{N-i}
536 m.as_mut()[ring_size - (si.abs() as usize)] = rlwe_q.neg_one();
537 } else {
538 // X^{i}
539 m.as_mut()[si.abs() as usize] = M::MatElement::one();
540 }
541
542 let mut rgsw_si = M::zeros(rlrg_d_a * 2 + rlrg_d_b, ring_size);
543 secret_key_encrypt_rgsw(
544 &mut rgsw_si,
545 m.as_ref(),
546 &rlrg_gadget_a,
547 &rlrg_gadget_b,
548 sk_rlwe.values(),
549 &self.pbs_info.rlwe_modop,
550 &self.pbs_info.rlwe_nttop,
551 &mut main_prng,
552 rng,
553 );
554
555 rgsw_si
556 })
557 .collect_vec();
558
559 // LWE KSK from RLWE secret s -> LWE secret z
560 let d_lwe_gadget = self.pbs_info.lwe_decomposer.gadget_vector();
561 let mut lwe_ksk =
562 M::R::zeros(self.pbs_info.lwe_decomposer.decomposition_count() * ring_size);
563 lwe_ksk_keygen(
564 &sk_rlwe.values(),
565 &sk_lwe.values(),
566 &mut lwe_ksk,
567 &d_lwe_gadget,
568 &self.pbs_info.lwe_modop,
569 &mut main_prng,
570 rng,
571 );
572
573 SeededServerKey::from_raw(
574 auto_keys,
575 rgsw_cts,
576 lwe_ksk,
577 self.pbs_info.parameters.clone(),
578 main_seed,
579 )
580 })
581 }
582
583 pub(super) fn multi_party_server_key_share(
584 &self,
585 cr_seed: [u8; 32],
586 collective_pk: &M,
587 client_key: &ClientKey,
588 ) -> CommonReferenceSeededMultiPartyServerKeyShare<M, BoolParameters<M::MatElement>, [u8; 32]>
589 {
590 DefaultSecureRng::with_local_mut(|rng| {
591 let mut main_prng = DefaultSecureRng::new_seeded(cr_seed);
592
593 let sk_rlwe = client_key.sk_rlwe();
594 let sk_lwe = client_key.sk_lwe();
595
596 let g = self.pbs_info.parameters.g();
597 let ring_size = self.pbs_info.parameters.rlwe_n().0;
598 let rlwe_q = self.pbs_info.parameters.rlwe_q();
599 let lwe_q = self.pbs_info.parameters.lwe_q();
600
601 let rlweq_modop = &self.pbs_info.rlwe_modop;
602 let rlweq_nttop = &self.pbs_info.rlwe_nttop;
603
604 // sanity check
605 assert!(sk_rlwe.values().len() == ring_size);
606 assert!(sk_lwe.values().len() == self.pbs_info.parameters.lwe_n().0);
607
608 // auto keys
609 let mut auto_keys = HashMap::new();
610 let auto_gadget = self.pbs_info.auto_decomposer.gadget_vector();
611 let auto_element_dlogs = self.pbs_info.parameters.auto_element_dlogs();
612 let br_q = self.pbs_info.parameters.br_q();
613 for i in auto_element_dlogs.into_iter() {
614 let g_pow = if i == 0 {
615 -(g as isize)
616 } else {
617 (g.pow(i as u32) % br_q) as isize
618 };
619
620 let mut ksk_out = M::zeros(
621 self.pbs_info.auto_decomposer.decomposition_count(),
622 ring_size,
623 );
624 galois_key_gen(
625 &mut ksk_out,
626 sk_rlwe.values(),
627 g_pow,
628 &auto_gadget,
629 rlweq_modop,
630 rlweq_nttop,
631 &mut main_prng,
632 rng,
633 );
634 auto_keys.insert(i, ksk_out);
635 }
636
637 // rgsw ciphertexts of lwe secret elements
638 let rgsw_rgsw_decomposer = self
639 .pbs_info
640 .parameters
641 .rgsw_rgsw_decomposer::<DefaultDecomposer<M::MatElement>>();
642 let (rgrg_d_a, rgrg_d_b) = (
643 rgsw_rgsw_decomposer.0.decomposition_count(),
644 rgsw_rgsw_decomposer.1.decomposition_count(),
645 );
646 let (rgrg_gadget_a, rgrg_gadget_b) = (
647 rgsw_rgsw_decomposer.0.gadget_vector(),
648 rgsw_rgsw_decomposer.1.gadget_vector(),
649 );
650 let rgsw_cts = sk_lwe
651 .values()
652 .iter()
653 .map(|si| {
654 let mut m = M::R::zeros(ring_size);
655 //TODO(Jay): It will be nice to have a function that returns polynomial
656 // (monomial infact!) corresponding to secret element embedded in ring X^{2N+1}.
657 // Save lots of mistakes where one forgest to emebed si in bigger ring.
658 let si = *si * (self.pbs_info.embedding_factor as i32);
659 if si < 0 {
660 // X^{-si} = X^{2N-si} = -X^{N-si}, assuming abs(si) < N
661 // (which it is given si is secret element)
662 m.as_mut()[ring_size - (si.abs() as usize)] = rlwe_q.neg_one();
663 } else {
664 m.as_mut()[si as usize] = M::MatElement::one();
665 }
666
667 // public key RGSW encryption has no part that can be seeded, unlike secret key
668 // RGSW encryption where RLWE'_A(m) is seeded
669 let mut out_rgsw = M::zeros(rgrg_d_a * 2 + rgrg_d_b * 2, ring_size);
670 public_key_encrypt_rgsw(
671 &mut out_rgsw,
672 &m.as_ref(),
673 collective_pk,
674 &rgrg_gadget_a,
675 &rgrg_gadget_b,
676 rlweq_modop,
677 rlweq_nttop,
678 rng,
679 );
680
681 out_rgsw
682 })
683 .collect_vec();
684
685 // LWE ksk
686 let mut lwe_ksk =
687 M::R::zeros(self.pbs_info.lwe_decomposer.decomposition_count() * ring_size);
688 let lwe_modop = &self.pbs_info.lwe_modop;
689 let d_lwe_gadget_vec = self.pbs_info.lwe_decomposer.gadget_vector();
690 lwe_ksk_keygen(
691 sk_rlwe.values(),
692 sk_lwe.values(),
693 &mut lwe_ksk,
694 &d_lwe_gadget_vec,
695 lwe_modop,
696 &mut main_prng,
697 rng,
698 );
699
700 CommonReferenceSeededMultiPartyServerKeyShare::new(
701 rgsw_cts,
702 auto_keys,
703 lwe_ksk,
704 cr_seed,
705 self.pbs_info.parameters.clone(),
706 )
707 })
708 }
709
710 pub(super) fn multi_party_public_key_share(
711 &self,
712 cr_seed: [u8; 32],
713 client_key: &ClientKey,
714 ) -> CommonReferenceSeededCollectivePublicKeyShare<
715 <M as Matrix>::R,
716 [u8; 32],
717 BoolParameters<<M as Matrix>::MatElement>,
718 > {
719 DefaultSecureRng::with_local_mut(|rng| {
720 let mut share_out = M::R::zeros(self.pbs_info.parameters.rlwe_n().0);
721 let modop = &self.pbs_info.rlwe_modop;
722 let nttop = &self.pbs_info.rlwe_nttop;
723 let mut main_prng = DefaultSecureRng::new_seeded(cr_seed);
724 public_key_share(
725 &mut share_out,
726 client_key.sk_rlwe().values(),
727 modop,
728 nttop,
729 &mut main_prng,
730 rng,
731 );
732 CommonReferenceSeededCollectivePublicKeyShare::new(
733 share_out,
734 cr_seed,
735 self.pbs_info.parameters.clone(),
736 )
737 })
738 }
739
740 pub(super) fn multi_party_decryption_share(
741 &self,
742 lwe_ct: &M::R,
743 client_key: &ClientKey,
744 ) -> <M as Matrix>::MatElement {
745 assert!(lwe_ct.as_ref().len() == self.pbs_info.parameters.rlwe_n().0 + 1);
746 let modop = &self.pbs_info.rlwe_modop;
747 let mut neg_s = M::R::try_convert_from(
748 client_key.sk_rlwe().values(),
749 &self.pbs_info.parameters.rlwe_q(),
750 );
751 modop.elwise_neg_mut(neg_s.as_mut());
752
753 let mut neg_sa = M::MatElement::zero();
754 izip!(lwe_ct.as_ref().iter().skip(1), neg_s.as_ref().iter()).for_each(|(ai, nsi)| {
755 neg_sa = modop.add(&neg_sa, &modop.mul(ai, nsi));
756 });
757
758 let e = DefaultSecureRng::with_local_mut(|rng| {
759 let mut e =
760 RandomGaussianElementInModulus::random(rng, self.pbs_info.parameters.rlwe_q());
761 e
762 });
763 let share = modop.add(&neg_sa, &e);
764
765 share
766 }
767
768 pub(crate) fn multi_party_decrypt(&self, shares: &[M::MatElement], lwe_ct: &M::R) -> bool {
769 let modop = &self.pbs_info.rlwe_modop;
770 let mut sum_a = M::MatElement::zero();
771 shares
772 .iter()
773 .for_each(|share_i| sum_a = modop.add(&sum_a, &share_i));
774
775 let encoded_m = modop.add(&lwe_ct.as_ref()[0], &sum_a);
776 self.pbs_info.parameters.rlwe_q().decode(encoded_m)
777 }
778
779 pub(crate) fn pk_encrypt(&self, pk: &M, m: bool) -> M::R {
780 self.pk_encrypt_batched(pk, &vec![m]).remove(0)
781 }
782
783 /// Encrypts a batch booleans as multiple LWE ciphertexts.
784 ///
785 /// For public key encryption we first encrypt `m` as a RLWE ciphertext and
786 /// then sample extract LWE samples at required indices.
787 ///
788 /// - TODO(Jay:) Communication can be improved by not sample exctracting and
789 /// instead just truncate degree 0 values (part Bs)
790 pub(crate) fn pk_encrypt_batched(&self, pk: &M, m: &[bool]) -> Vec<M::R> {
791 DefaultSecureRng::with_local_mut(|rng| {
792 let ring_size = self.pbs_info.parameters.rlwe_n().0;
793 assert!(
794 m.len() <= ring_size,
795 "Cannot batch encrypt > ring_size{ring_size} elements at once"
796 );
797
798 let modop = &self.pbs_info.rlwe_modop;
799 let nttop = &self.pbs_info.rlwe_nttop;
800
801 // RLWE(0)
802 // sample ephemeral key u
803 let mut u = vec![0i32; ring_size];
804 fill_random_ternary_secret_with_hamming_weight(u.as_mut(), ring_size >> 1, rng);
805 let mut u = M::R::try_convert_from(&u, &self.pbs_info.parameters.rlwe_q());
806 nttop.forward(u.as_mut());
807
808 let mut ua = M::R::zeros(ring_size);
809 ua.as_mut().copy_from_slice(pk.get_row_slice(0));
810 let mut ub = M::R::zeros(ring_size);
811 ub.as_mut().copy_from_slice(pk.get_row_slice(1));
812
813 // a*u
814 nttop.forward(ua.as_mut());
815 modop.elwise_mul_mut(ua.as_mut(), u.as_ref());
816 nttop.backward(ua.as_mut());
817
818 // b*u
819 nttop.forward(ub.as_mut());
820 modop.elwise_mul_mut(ub.as_mut(), u.as_ref());
821 nttop.backward(ub.as_mut());
822
823 let mut rlwe = M::zeros(2, ring_size);
824 // sample error
825 rlwe.iter_rows_mut().for_each(|ri| {
826 RandomFillGaussianInModulus::<[M::MatElement], CiphertextModulus<M::MatElement>>::random_fill(
827 rng,
828 &self.pbs_info.parameters.rlwe_q(),
829 ri.as_mut(),
830 );
831 });
832
833 // a*u + e0
834 modop.elwise_add_mut(rlwe.get_row_mut(0), ua.as_ref());
835 // b*u + e1
836 modop.elwise_add_mut(rlwe.get_row_mut(1), ub.as_ref());
837
838 //FIXME(Jay): Figure out a way to get Q/8 form modulus
839 let mut m_vec = M::R::zeros(ring_size);
840 izip!(m_vec.as_mut().iter_mut(), m.iter()).for_each(|(m_el, m_bool)| {
841 if *m_bool {
842 // Q/8
843 *m_el = self.pbs_info.rlwe_q().true_el()
844 } else {
845 // -Q/8
846 *m_el = self.pbs_info.rlwe_q().false_el()
847 }
848 });
849
850 // b*u + e1 + m
851 modop.elwise_add_mut(rlwe.get_row_mut(1), m_vec.as_ref());
852 // rlwe.set(1, 0, modop.add(rlwe.get(1, 0), &m));
853
854 // sample extract index required indices
855 let samples = m.len();
856 (0..samples)
857 .into_iter()
858 .map(|i| {
859 let mut lwe_out = M::R::zeros(ring_size + 1);
860 sample_extract(&mut lwe_out, &rlwe, modop, i);
861 lwe_out
862 })
863 .collect_vec()
864 })
865 }
866
867 /// TODO(Jay): Fetch client key from thread local
868 pub fn sk_encrypt(&self, m: bool, client_key: &ClientKey) -> M::R {
869 //FIXME(Jay): Figure out a way to get Q/8 form modulus
870 let m = if m {
871 // Q/8
872 self.pbs_info.rlwe_q().true_el()
873 } else {
874 // -Q/8
875 self.pbs_info.rlwe_q().false_el()
876 };
877
878 DefaultSecureRng::with_local_mut(|rng| {
879 let mut lwe_out = M::R::zeros(self.pbs_info.parameters.rlwe_n().0 + 1);
880 encrypt_lwe(
881 &mut lwe_out,
882 &m,
883 client_key.sk_rlwe().values(),
884 &self.pbs_info.rlwe_modop,
885 rng,
886 );
887 lwe_out
888 })
889 }
890
891 pub fn sk_decrypt(&self, lwe_ct: &M::R, client_key: &ClientKey) -> bool {
892 let m = decrypt_lwe(
893 lwe_ct,
894 client_key.sk_rlwe().values(),
895 &self.pbs_info.rlwe_modop,
896 );
897 self.pbs_info.rlwe_q().decode(m)
898 }
899
900 pub(super) fn aggregate_multi_party_server_key_shares<S>(
901 &self,
902 shares: &[CommonReferenceSeededMultiPartyServerKeyShare<
903 M,
904 BoolParameters<M::MatElement>,
905 S,
906 >],
907 ) -> SeededMultiPartyServerKey<M, S, BoolParameters<M::MatElement>>
908 where
909 S: PartialEq + Clone,
910 M: Clone,
911 {
912 assert!(shares.len() > 0);
913 let parameters = shares[0].parameters().clone();
914 let cr_seed = shares[0].cr_seed();
915
916 let rlwe_n = parameters.rlwe_n().0;
917 let g = parameters.g() as isize;
918 let rlwe_q = parameters.rlwe_q();
919 let lwe_q = parameters.lwe_q();
920
921 // sanity checks
922 shares.iter().skip(1).for_each(|s| {
923 assert!(s.parameters() == ¶meters);
924 assert!(s.cr_seed() == cr_seed);
925 });
926
927 let rlweq_modop = &self.pbs_info.rlwe_modop;
928 let rlweq_nttop = &self.pbs_info.rlwe_nttop;
929
930 // auto keys
931 let mut auto_keys = HashMap::new();
932 let auto_elements_dlog = parameters.auto_element_dlogs();
933 for i in auto_elements_dlog.into_iter() {
934 let mut key = M::zeros(parameters.auto_decomposition_count().0, rlwe_n);
935
936 shares.iter().for_each(|s| {
937 let auto_key_share_i = s.auto_keys().get(&i).expect("Auto key {i} missing");
938 assert!(
939 auto_key_share_i.dimension()
940 == (parameters.auto_decomposition_count().0, rlwe_n)
941 );
942 izip!(key.iter_rows_mut(), auto_key_share_i.iter_rows()).for_each(
943 |(partb_out, partb_share)| {
944 rlweq_modop.elwise_add_mut(partb_out.as_mut(), partb_share.as_ref());
945 },
946 );
947 });
948
949 auto_keys.insert(i, key);
950 }
951
952 // rgsw ciphertext (most expensive part!)
953 let lwe_n = parameters.lwe_n().0;
954 let rgsw_by_rgsw_decomposer =
955 parameters.rgsw_rgsw_decomposer::<DefaultDecomposer<M::MatElement>>();
956 let mut scratch_matrix = M::zeros(
957 std::cmp::max(
958 rgsw_by_rgsw_decomposer.a().decomposition_count(),
959 rgsw_by_rgsw_decomposer.b().decomposition_count(),
960 ) + (rgsw_by_rgsw_decomposer.a().decomposition_count() * 2
961 + rgsw_by_rgsw_decomposer.b().decomposition_count() * 2),
962 rlwe_n,
963 );
964
965 let mut tmp_rgsw =
966 RgswCiphertext::<M, _>::empty(rlwe_n, &rgsw_by_rgsw_decomposer, rlwe_q.clone()).data;
967 let rgsw_cts = (0..lwe_n).into_iter().map(|index| {
968 // copy over rgsw ciphertext for index^th secret element from first share and
969 // treat it as accumulating rgsw ciphertext
970 let mut rgsw_i = shares[0].rgsw_cts()[index].clone();
971
972 shares.iter().skip(1).for_each(|si| {
973 // copy over si's RGSW[index] ciphertext and send to evaluation domain
974 izip!(tmp_rgsw.iter_rows_mut(), si.rgsw_cts()[index].iter_rows()).for_each(
975 |(to_ri, from_ri)| {
976 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
977 rlweq_nttop.forward(to_ri.as_mut())
978 },
979 );
980
981 rgsw_by_rgsw_inplace(
982 &mut rgsw_i,
983 &tmp_rgsw,
984 &rgsw_by_rgsw_decomposer,
985 &mut scratch_matrix,
986 rlweq_nttop,
987 rlweq_modop,
988 );
989 });
990
991 rgsw_i
992 });
993 // d_a and d_b may differ for RGSWxRGSW multiplication and RLWExRGSW
994 // multiplication. After this point RGSW ciphertexts will only be used for
995 // RLWExRGSW multiplication (in blind rotation). Thus we drop any additional
996 // RLWE ciphertexts in RGSW ciphertexts after RGSw x RGSW multiplication
997 let (rgswrgsw_d_a, rgswrgsw_d_b) = self.pbs_info.parameters.rgsw_rgsw_decomposition_count();
998 let (rlrg_d_a, rlrg_d_b) = self.pbs_info.parameters.rlwe_rgsw_decomposition_count();
999 let rgsw_ct_rows_in = rgswrgsw_d_a.0 * 2 + rgswrgsw_d_b.0 * 2;
1000 let rgsw_ct_rows_out = rlrg_d_a.0 * 2 + rlrg_d_b.0 * 2;
1001 assert!(rgswrgsw_d_a.0 >= rlrg_d_a.0, "RGSWxRGSW part A decomposition count {} must be >= RLWExRGSW part A decomposition count {}", rgswrgsw_d_a.0 , rlrg_d_a.0);
1002 assert!(rgswrgsw_d_b.0 >= rlrg_d_b.0, "RGSWxRGSW part B decomposition count {} must be >= RLWExRGSW part B decomposition count {}", rgswrgsw_d_b.0 , rlrg_d_b.0);
1003 let rgsw_cts = rgsw_cts
1004 .map(|ct_i_in| {
1005 assert!(ct_i_in.dimension() == (rgsw_ct_rows_in, rlwe_n));
1006 let mut reduced_ct_i_out = M::zeros(rgsw_ct_rows_out, rlwe_n);
1007
1008 // RLWE'(-sm) part A
1009 izip!(
1010 reduced_ct_i_out.iter_rows_mut().take(rlrg_d_a.0),
1011 ct_i_in
1012 .iter_rows()
1013 .skip(rgswrgsw_d_a.0 - rlrg_d_a.0)
1014 .take(rlrg_d_a.0)
1015 )
1016 .for_each(|(to_ri, from_ri)| {
1017 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1018 });
1019
1020 // RLWE'(-sm) part B
1021 izip!(
1022 reduced_ct_i_out
1023 .iter_rows_mut()
1024 .skip(rlrg_d_a.0)
1025 .take(rlrg_d_a.0),
1026 ct_i_in
1027 .iter_rows()
1028 .skip(rgswrgsw_d_a.0 + (rgswrgsw_d_a.0 - rlrg_d_a.0))
1029 .take(rlrg_d_a.0)
1030 )
1031 .for_each(|(to_ri, from_ri)| {
1032 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1033 });
1034
1035 // RLWE'(m) Part A
1036 izip!(
1037 reduced_ct_i_out
1038 .iter_rows_mut()
1039 .skip(rlrg_d_a.0 * 2)
1040 .take(rlrg_d_b.0),
1041 ct_i_in
1042 .iter_rows()
1043 .skip(rgswrgsw_d_a.0 * 2 + (rgswrgsw_d_b.0 - rlrg_d_b.0))
1044 .take(rlrg_d_b.0)
1045 )
1046 .for_each(|(to_ri, from_ri)| {
1047 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1048 });
1049
1050 // RLWE'(m) Part B
1051 izip!(
1052 reduced_ct_i_out
1053 .iter_rows_mut()
1054 .skip(rlrg_d_a.0 * 2 + rlrg_d_b.0)
1055 .take(rlrg_d_b.0),
1056 ct_i_in
1057 .iter_rows()
1058 .skip(rgswrgsw_d_a.0 * 2 + rgswrgsw_d_b.0 + (rgswrgsw_d_b.0 - rlrg_d_b.0))
1059 .take(rlrg_d_b.0)
1060 )
1061 .for_each(|(to_ri, from_ri)| {
1062 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1063 });
1064
1065 reduced_ct_i_out
1066 })
1067 .collect_vec();
1068
1069 // LWE ksks
1070 let mut lwe_ksk = M::R::zeros(rlwe_n * parameters.lwe_decomposition_count().0);
1071 let lweq_modop = &self.pbs_info.lwe_modop;
1072 shares.iter().for_each(|si| {
1073 assert!(si.lwe_ksk().as_ref().len() == rlwe_n * parameters.lwe_decomposition_count().0);
1074 lweq_modop.elwise_add_mut(lwe_ksk.as_mut(), si.lwe_ksk().as_ref())
1075 });
1076
1077 SeededMultiPartyServerKey::new(rgsw_cts, auto_keys, lwe_ksk, cr_seed.clone(), parameters)
1078 }
1079}
1080
1081impl<M, NttOp, RlweModOp, LweModOp> BoolEvaluator<M, NttOp, RlweModOp, LweModOp>
1082where
1083 M: MatrixMut + MatrixEntity,
1084 M::R: RowMut + RowEntity,
1085 M::MatElement: PrimInt + FromPrimitive + One + Copy + Zero + Display + WrappingSub + NumInfo,
1086 RlweModOp: VectorOps<Element = M::MatElement>
1087 + ArithmeticOps<Element = M::MatElement>
1088 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
1089 LweModOp: VectorOps<Element = M::MatElement>
1090 + ArithmeticOps<Element = M::MatElement>
1091 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
1092 NttOp: Ntt<Element = M::MatElement>,
1093{
1094 /// Returns c0 + c1 + Q/4
1095 fn _add_and_shift_lwe_cts(&self, c0: &mut M::R, c1: &M::R) {
1096 let modop = &self.pbs_info.rlwe_modop;
1097 modop.elwise_add_mut(c0.as_mut(), c1.as_ref());
1098 // +Q/4
1099 c0.as_mut()[0] = modop.add(&c0.as_ref()[0], &self.pbs_info.rlwe_qby4);
1100 }
1101
1102 /// Returns 2(c0 - c1) + Q/4
1103 fn _subtract_double_lwe_cts(&self, c0: &mut M::R, c1: &M::R) {
1104 let modop = &self.pbs_info.rlwe_modop;
1105 // c0 - c1
1106 modop.elwise_sub_mut(c0.as_mut(), c1.as_ref());
1107
1108 // double
1109 c0.as_mut().iter_mut().for_each(|v| *v = modop.add(v, v));
1110 }
1111}
1112
1113impl<M, NttOp, RlweModOp, LweModOp> BooleanGates for BoolEvaluator<M, NttOp, RlweModOp, LweModOp>
1114where
1115 M: MatrixMut + MatrixEntity,
1116 M::R: RowMut + RowEntity + Clone,
1117 M::MatElement:
1118 PrimInt + FromPrimitive + One + Copy + Zero + Display + WrappingSub + NumInfo + From<bool>,
1119 RlweModOp: VectorOps<Element = M::MatElement>
1120 + ArithmeticOps<Element = M::MatElement>
1121 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
1122 LweModOp: VectorOps<Element = M::MatElement>
1123 + ArithmeticOps<Element = M::MatElement>
1124 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
1125 NttOp: Ntt<Element = M::MatElement>,
1126{
1127 type Ciphertext = M::R;
1128 type Key = ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>;
1129
1130 fn nand_inplace(
1131 &mut self,
1132 c0: &mut M::R,
1133 c1: &M::R,
1134 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1135 ) {
1136 self._add_and_shift_lwe_cts(c0, c1);
1137
1138 // PBS
1139 pbs(
1140 &self.pbs_info,
1141 &self.nand_test_vec,
1142 c0,
1143 server_key,
1144 &mut self.scratch_memory.lwe_vector,
1145 &mut self.scratch_memory.decomposition_matrix,
1146 );
1147 }
1148
1149 fn and_inplace(
1150 &mut self,
1151 c0: &mut M::R,
1152 c1: &M::R,
1153 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1154 ) {
1155 self._add_and_shift_lwe_cts(c0, c1);
1156
1157 // PBS
1158 pbs(
1159 &self.pbs_info,
1160 &self.and_test_vec,
1161 c0,
1162 server_key,
1163 &mut self.scratch_memory.lwe_vector,
1164 &mut self.scratch_memory.decomposition_matrix,
1165 );
1166 }
1167
1168 fn or_inplace(
1169 &mut self,
1170 c0: &mut M::R,
1171 c1: &M::R,
1172 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1173 ) {
1174 self._add_and_shift_lwe_cts(c0, c1);
1175
1176 // PBS
1177 pbs(
1178 &self.pbs_info,
1179 &self.or_test_vec,
1180 c0,
1181 server_key,
1182 &mut self.scratch_memory.lwe_vector,
1183 &mut self.scratch_memory.decomposition_matrix,
1184 );
1185 }
1186
1187 fn nor_inplace(
1188 &mut self,
1189 c0: &mut M::R,
1190 c1: &M::R,
1191 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1192 ) {
1193 self._add_and_shift_lwe_cts(c0, c1);
1194
1195 // PBS
1196 pbs(
1197 &self.pbs_info,
1198 &self.nor_test_vec,
1199 c0,
1200 server_key,
1201 &mut self.scratch_memory.lwe_vector,
1202 &mut self.scratch_memory.decomposition_matrix,
1203 )
1204 }
1205
1206 fn xor_inplace(
1207 &mut self,
1208 c0: &mut M::R,
1209 c1: &M::R,
1210 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1211 ) {
1212 self._subtract_double_lwe_cts(c0, c1);
1213
1214 // PBS
1215 pbs(
1216 &self.pbs_info,
1217 &self.xor_test_vec,
1218 c0,
1219 server_key,
1220 &mut self.scratch_memory.lwe_vector,
1221 &mut self.scratch_memory.decomposition_matrix,
1222 );
1223 }
1224
1225 fn xnor_inplace(
1226 &mut self,
1227 c0: &mut M::R,
1228 c1: &M::R,
1229 server_key: &ServerKeyEvaluationDomain<M, DefaultSecureRng, NttOp>,
1230 ) {
1231 self._subtract_double_lwe_cts(c0, c1);
1232
1233 // PBS
1234 pbs(
1235 &self.pbs_info,
1236 &self.xnor_test_vec,
1237 c0,
1238 server_key,
1239 &mut self.scratch_memory.lwe_vector,
1240 &mut self.scratch_memory.decomposition_matrix,
1241 );
1242 }
1243
1244 fn not_inplace(&mut self, c0: &mut M::R) {
1245 let modop = &self.pbs_info.rlwe_modop;
1246 c0.as_mut().iter_mut().for_each(|v| *v = modop.neg(v));
1247 }
1248
1249 fn and(
1250 &mut self,
1251 c0: &Self::Ciphertext,
1252 c1: &Self::Ciphertext,
1253 key: &Self::Key,
1254 ) -> Self::Ciphertext {
1255 let mut out = c0.clone();
1256 self.and_inplace(&mut out, c1, key);
1257 out
1258 }
1259
1260 fn nand(
1261 &mut self,
1262 c0: &Self::Ciphertext,
1263 c1: &Self::Ciphertext,
1264 key: &Self::Key,
1265 ) -> Self::Ciphertext {
1266 let mut out = c0.clone();
1267 self.nand_inplace(&mut out, c1, key);
1268 out
1269 }
1270
1271 fn or(
1272 &mut self,
1273 c0: &Self::Ciphertext,
1274 c1: &Self::Ciphertext,
1275 key: &Self::Key,
1276 ) -> Self::Ciphertext {
1277 let mut out = c0.clone();
1278 self.or_inplace(&mut out, c1, key);
1279 out
1280 }
1281
1282 fn nor(
1283 &mut self,
1284 c0: &Self::Ciphertext,
1285 c1: &Self::Ciphertext,
1286 key: &Self::Key,
1287 ) -> Self::Ciphertext {
1288 let mut out = c0.clone();
1289 self.nor_inplace(&mut out, c1, key);
1290 out
1291 }
1292
1293 fn xnor(
1294 &mut self,
1295 c0: &Self::Ciphertext,
1296 c1: &Self::Ciphertext,
1297 key: &Self::Key,
1298 ) -> Self::Ciphertext {
1299 let mut out = c0.clone();
1300 self.xnor_inplace(&mut out, c1, key);
1301 out
1302 }
1303
1304 fn xor(
1305 &mut self,
1306 c0: &Self::Ciphertext,
1307 c1: &Self::Ciphertext,
1308 key: &Self::Key,
1309 ) -> Self::Ciphertext {
1310 let mut out = c0.clone();
1311 self.xor_inplace(&mut out, c1, key);
1312 out
1313 }
1314
1315 fn not(&mut self, c: &Self::Ciphertext) -> Self::Ciphertext {
1316 let mut out = c.clone();
1317 self.not_inplace(&mut out);
1318 out
1319 }
1320}
1321
1322#[cfg(test)]
1323mod tests {
1324 use bool::parameters::{MP_BOOL_PARAMS, SP_BOOL_PARAMS};
1325 use rand::{thread_rng, Rng};
1326 use rand_distr::Uniform;
1327
1328 use crate::{
1329 backend::{GetModulus, ModInit, ModularOpsU64, WordSizeModulus},
1330 bool::{
1331 self, CommonReferenceSeededMultiPartyServerKeyShare, PublicKey,
1332 SeededMultiPartyServerKey,
1333 },
1334 ntt::NttBackendU64,
1335 random::{RandomElementInModulus, DEFAULT_RNG},
1336 rgsw::{
1337 self, measure_noise, public_key_encrypt_rlwe, secret_key_encrypt_rlwe,
1338 tests::{_measure_noise_rgsw, _sk_encrypt_rlwe},
1339 RgswCiphertext, RgswCiphertextEvaluationDomain, SeededRgswCiphertext,
1340 SeededRlweCiphertext,
1341 },
1342 utils::{negacyclic_mul, Stats},
1343 };
1344
1345 use super::*;
1346
1347 #[test]
1348 fn bool_encrypt_decrypt_works() {
1349 let bool_evaluator = BoolEvaluator::<
1350 Vec<Vec<u64>>,
1351 NttBackendU64,
1352 ModularOpsU64<CiphertextModulus<u64>>,
1353 ModularOpsU64<CiphertextModulus<u64>>,
1354 >::new(SP_BOOL_PARAMS);
1355 let client_key = bool_evaluator.client_key();
1356
1357 let mut m = true;
1358 for _ in 0..1000 {
1359 let lwe_ct = bool_evaluator.sk_encrypt(m, &client_key);
1360 let m_back = bool_evaluator.sk_decrypt(&lwe_ct, &client_key);
1361 assert_eq!(m, m_back);
1362 m = !m;
1363 }
1364 }
1365
1366 #[test]
1367 fn bool_nand() {
1368 let mut bool_evaluator = BoolEvaluator::<
1369 Vec<Vec<u64>>,
1370 NttBackendU64,
1371 ModularOpsU64<CiphertextModulus<u64>>,
1372 ModularOpsU64<CiphertextModulus<u64>>,
1373 >::new(SP_BOOL_PARAMS);
1374
1375 // println!("{:?}", bool_evaluator.nand_test_vec);
1376 let client_key = bool_evaluator.client_key();
1377 let seeded_server_key = bool_evaluator.server_key(&client_key);
1378 let server_key_eval_domain =
1379 ServerKeyEvaluationDomain::<_, DefaultSecureRng, NttBackendU64>::from(
1380 &seeded_server_key,
1381 );
1382
1383 let mut m0 = false;
1384 let mut m1 = true;
1385
1386 let mut ct0 = bool_evaluator.sk_encrypt(m0, &client_key);
1387 let mut ct1 = bool_evaluator.sk_encrypt(m1, &client_key);
1388
1389 for _ in 0..500 {
1390 let ct_back = bool_evaluator.nand(&ct0, &ct1, &server_key_eval_domain);
1391
1392 let m_out = !(m0 && m1);
1393
1394 let m_back = bool_evaluator.sk_decrypt(&ct_back, &client_key);
1395 assert!(m_out == m_back, "Expected {m_out}, got {m_back}");
1396
1397 m1 = m0;
1398 m0 = m_out;
1399
1400 ct1 = ct0;
1401 ct0 = ct_back;
1402 }
1403 }
1404
1405 #[test]
1406 fn bool_xor() {
1407 let mut bool_evaluator = BoolEvaluator::<
1408 Vec<Vec<u64>>,
1409 NttBackendU64,
1410 ModularOpsU64<CiphertextModulus<u64>>,
1411 ModularOpsU64<CiphertextModulus<u64>>,
1412 >::new(SP_BOOL_PARAMS);
1413
1414 // println!("{:?}", bool_evaluator.nand_test_vec);
1415 let client_key = bool_evaluator.client_key();
1416 let seeded_server_key = bool_evaluator.server_key(&client_key);
1417 let server_key_eval_domain =
1418 ServerKeyEvaluationDomain::<_, DefaultSecureRng, NttBackendU64>::from(
1419 &seeded_server_key,
1420 );
1421
1422 let mut m0 = false;
1423 let mut m1 = true;
1424
1425 let mut ct0 = bool_evaluator.sk_encrypt(m0, &client_key);
1426 let mut ct1 = bool_evaluator.sk_encrypt(m1, &client_key);
1427
1428 for _ in 0..1000 {
1429 let ct_back = bool_evaluator.xor(&ct0, &ct1, &server_key_eval_domain);
1430 let m_out = (m0 ^ m1);
1431
1432 let m_back = bool_evaluator.sk_decrypt(&ct_back, &client_key);
1433 assert!(m_out == m_back, "Expected {m_out}, got {m_back}");
1434
1435 m1 = m0;
1436 m0 = m_out;
1437
1438 ct1 = ct0;
1439 ct0 = ct_back;
1440 }
1441 }
1442
1443 #[test]
1444 fn multi_party_encryption_decryption() {
1445 let bool_evaluator = BoolEvaluator::<
1446 Vec<Vec<u64>>,
1447 NttBackendU64,
1448 ModularOpsU64<CiphertextModulus<u64>>,
1449 ModularOpsU64<CiphertextModulus<u64>>,
1450 >::new(MP_BOOL_PARAMS);
1451
1452 let no_of_parties = 500;
1453 let parties = (0..no_of_parties)
1454 .map(|_| bool_evaluator.client_key())
1455 .collect_vec();
1456
1457 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1458 parties.iter().for_each(|k| {
1459 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1460 *ideal_i = *ideal_i + s_i;
1461 });
1462 });
1463
1464 let mut m = true;
1465 for i in 0..100 {
1466 let pk_cr_seed = [0u8; 32];
1467
1468 let public_key_share = parties
1469 .iter()
1470 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1471 .collect_vec();
1472
1473 let collective_pk = PublicKey::<
1474 Vec<Vec<u64>>,
1475 DefaultSecureRng,
1476 ModularOpsU64<CiphertextModulus<u64>>,
1477 >::from(public_key_share.as_slice());
1478 let lwe_ct = bool_evaluator.pk_encrypt(collective_pk.key(), m);
1479
1480 let decryption_shares = parties
1481 .iter()
1482 .map(|k| bool_evaluator.multi_party_decryption_share(&lwe_ct, k))
1483 .collect_vec();
1484
1485 let m_back = bool_evaluator.multi_party_decrypt(&decryption_shares, &lwe_ct);
1486
1487 {
1488 let ideal_m = if m {
1489 bool_evaluator.pbs_info.parameters.rlwe_q().true_el()
1490 } else {
1491 bool_evaluator.pbs_info.parameters.rlwe_q().false_el()
1492 };
1493 let noise = measure_noise_lwe(
1494 &lwe_ct,
1495 &ideal_rlwe_sk,
1496 &bool_evaluator.pbs_info.rlwe_modop,
1497 &ideal_m,
1498 );
1499 println!("Noise: {noise}");
1500 }
1501
1502 assert_eq!(m_back, m);
1503 m = !m;
1504 }
1505 }
1506
1507 fn _collecitve_public_key_gen(rlwe_q: u64, parties_rlwe_sk: &[RlweSecret]) -> Vec<Vec<u64>> {
1508 let ring_size = parties_rlwe_sk[0].values.len();
1509 assert!(ring_size.is_power_of_two());
1510 let mut rng = DefaultSecureRng::new();
1511 let nttop = NttBackendU64::new(&rlwe_q, ring_size);
1512 let modop = ModularOpsU64::new(rlwe_q);
1513
1514 // Generate Pk shares
1515 let pk_seed = [0u8; 32];
1516 let pk_shares = parties_rlwe_sk.iter().map(|sk| {
1517 let mut p_rng = DefaultSecureRng::new_seeded(pk_seed);
1518 let mut share_out = vec![0u64; ring_size];
1519 public_key_share(
1520 &mut share_out,
1521 sk.values(),
1522 &modop,
1523 &nttop,
1524 &mut p_rng,
1525 &mut rng,
1526 );
1527 share_out
1528 });
1529
1530 let mut pk_part_b = vec![0u64; ring_size];
1531 pk_shares.for_each(|share| modop.elwise_add_mut(&mut pk_part_b, &share));
1532 let mut pk_part_a = vec![0u64; ring_size];
1533 let mut p_rng = DefaultSecureRng::new_seeded(pk_seed);
1534 RandomFillUniformInModulus::random_fill(&mut p_rng, &rlwe_q, pk_part_a.as_mut_slice());
1535
1536 vec![pk_part_a, pk_part_b]
1537 }
1538
1539 fn _multi_party_all_keygen(
1540 bool_evaluator: &BoolEvaluator<
1541 Vec<Vec<u64>>,
1542 NttBackendU64,
1543 ModularOpsU64<CiphertextModulus<u64>>,
1544 ModularOpsU64<CiphertextModulus<u64>>,
1545 >,
1546 no_of_parties: usize,
1547 ) -> (
1548 Vec<ClientKey>,
1549 PublicKey<Vec<Vec<u64>>, DefaultSecureRng, ModularOpsU64<CiphertextModulus<u64>>>,
1550 Vec<
1551 CommonReferenceSeededMultiPartyServerKeyShare<
1552 Vec<Vec<u64>>,
1553 BoolParameters<u64>,
1554 [u8; 32],
1555 >,
1556 >,
1557 SeededMultiPartyServerKey<Vec<Vec<u64>>, [u8; 32], BoolParameters<u64>>,
1558 ServerKeyEvaluationDomain<Vec<Vec<u64>>, DefaultSecureRng, NttBackendU64>,
1559 ClientKey,
1560 ) {
1561 let parties = (0..no_of_parties)
1562 .map(|_| bool_evaluator.client_key())
1563 .collect_vec();
1564
1565 let mut rng = DefaultSecureRng::new();
1566
1567 // Collective public key
1568 let mut pk_cr_seed = [0u8; 32];
1569 rng.fill_bytes(&mut pk_cr_seed);
1570 let public_key_share = parties
1571 .iter()
1572 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1573 .collect_vec();
1574 let collective_pk =
1575 PublicKey::<Vec<Vec<u64>>, DefaultSecureRng, _>::from(public_key_share.as_slice());
1576
1577 // Server key
1578 let mut pbs_cr_seed = [0u8; 32];
1579 rng.fill_bytes(&mut pbs_cr_seed);
1580 let server_key_shares = parties
1581 .iter()
1582 .map(|k| {
1583 bool_evaluator.multi_party_server_key_share(pbs_cr_seed, &collective_pk.key(), k)
1584 })
1585 .collect_vec();
1586 let seeded_server_key =
1587 bool_evaluator.aggregate_multi_party_server_key_shares(&server_key_shares);
1588 let server_key_eval = ServerKeyEvaluationDomain::<_, DefaultSecureRng, NttBackendU64>::from(
1589 &seeded_server_key,
1590 );
1591
1592 // construct ideal rlwe sk for meauring noise
1593 let ideal_client_key = {
1594 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1595 parties.iter().for_each(|k| {
1596 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1597 *ideal_i = *ideal_i + s_i;
1598 });
1599 });
1600 let mut ideal_lwe_sk = vec![0i32; bool_evaluator.pbs_info.lwe_n()];
1601 parties.iter().for_each(|k| {
1602 izip!(ideal_lwe_sk.iter_mut(), k.sk_lwe().values()).for_each(|(ideal_i, s_i)| {
1603 *ideal_i = *ideal_i + s_i;
1604 });
1605 });
1606
1607 ClientKey::new(
1608 RlweSecret {
1609 values: ideal_rlwe_sk,
1610 },
1611 LweSecret {
1612 values: ideal_lwe_sk,
1613 },
1614 )
1615 };
1616
1617 (
1618 parties,
1619 collective_pk,
1620 server_key_shares,
1621 seeded_server_key,
1622 server_key_eval,
1623 ideal_client_key,
1624 )
1625 }
1626
1627 #[test]
1628 fn multi_party_nand() {
1629 let mut bool_evaluator = BoolEvaluator::<
1630 Vec<Vec<u64>>,
1631 NttBackendU64,
1632 ModularOpsU64<CiphertextModulus<u64>>,
1633 ModularOpsU64<CiphertextModulus<u64>>,
1634 >::new(MP_BOOL_PARAMS);
1635
1636 let (parties, collective_pk, _, _, server_key_eval, ideal_client_key) =
1637 _multi_party_all_keygen(&bool_evaluator, 2);
1638
1639 let mut m0 = true;
1640 let mut m1 = false;
1641
1642 let mut lwe0 = bool_evaluator.pk_encrypt(collective_pk.key(), m0);
1643 let mut lwe1 = bool_evaluator.pk_encrypt(collective_pk.key(), m1);
1644
1645 for _ in 0..2000 {
1646 let lwe_out = bool_evaluator.nand(&lwe0, &lwe1, &server_key_eval);
1647
1648 let m_expected = !(m0 & m1);
1649
1650 // multi-party decrypt
1651 let decryption_shares = parties
1652 .iter()
1653 .map(|k| bool_evaluator.multi_party_decryption_share(&lwe_out, k))
1654 .collect_vec();
1655 let m_back = bool_evaluator.multi_party_decrypt(&decryption_shares, &lwe_out);
1656
1657 // let m_back = bool_evaluator.sk_decrypt(&lwe_out, &ideal_client_key);
1658
1659 assert!(m_expected == m_back, "Expected {m_expected}, got {m_back}");
1660 m1 = m0;
1661 m0 = m_expected;
1662
1663 lwe1 = lwe0;
1664 lwe0 = lwe_out;
1665 }
1666 }
1667
1668 #[test]
1669 fn noise_tester() {
1670 let bool_evaluator = BoolEvaluator::<
1671 Vec<Vec<u64>>,
1672 NttBackendU64,
1673 ModularOpsU64<CiphertextModulus<u64>>,
1674 ModularOpsU64<CiphertextModulus<u64>>,
1675 >::new(SP_BOOL_PARAMS);
1676
1677 // let (_, collective_pk, _, _, server_key_eval, ideal_client_key) =
1678 // _multi_party_all_keygen(&bool_evaluator, 20);
1679 let no_of_parties = 2;
1680 let lwe_q = bool_evaluator.pbs_info.parameters.lwe_q();
1681 let rlwe_q = bool_evaluator.pbs_info.parameters.rlwe_q();
1682 let lwe_n = bool_evaluator.pbs_info.parameters.lwe_n().0;
1683 let rlwe_n = bool_evaluator.pbs_info.parameters.rlwe_n().0;
1684 let lwe_modop = &bool_evaluator.pbs_info.lwe_modop;
1685 let rlwe_nttop = &bool_evaluator.pbs_info.rlwe_nttop;
1686 let rlwe_modop = &bool_evaluator.pbs_info.rlwe_modop;
1687
1688 // let rgsw_rgsw_decomposer = &bool_evaluator
1689 // .pbs_info
1690 // .parameters
1691 // .rgsw_rgsw_decomposer::<DefaultDecomposer<u64>>();
1692 // let rgsw_rgsw_gadget_a = rgsw_rgsw_decomposer.0.gadget_vector();
1693 // let rgsw_rgsw_gadget_b = rgsw_rgsw_decomposer.1.gadget_vector();
1694
1695 let rlwe_rgsw_decomposer = &bool_evaluator.pbs_info.rlwe_rgsw_decomposer;
1696 let rlwe_rgsw_gadget_a = rlwe_rgsw_decomposer.0.gadget_vector();
1697 let rlwe_rgsw_gadget_b = rlwe_rgsw_decomposer.1.gadget_vector();
1698
1699 let auto_decomposer = &bool_evaluator.pbs_info.auto_decomposer;
1700 let auto_gadget = auto_decomposer.gadget_vector();
1701
1702 let parties = (0..no_of_parties)
1703 .map(|_| bool_evaluator.client_key())
1704 .collect_vec();
1705
1706 let ideal_client_key = {
1707 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1708 parties.iter().for_each(|k| {
1709 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1710 *ideal_i = *ideal_i + s_i;
1711 });
1712 });
1713 let mut ideal_lwe_sk = vec![0i32; bool_evaluator.pbs_info.lwe_n()];
1714 parties.iter().for_each(|k| {
1715 izip!(ideal_lwe_sk.iter_mut(), k.sk_lwe().values()).for_each(|(ideal_i, s_i)| {
1716 *ideal_i = *ideal_i + s_i;
1717 });
1718 });
1719
1720 ClientKey::new(
1721 RlweSecret {
1722 values: ideal_rlwe_sk,
1723 },
1724 LweSecret {
1725 values: ideal_lwe_sk,
1726 },
1727 )
1728 };
1729
1730 // check noise in freshly encrypted RLWE ciphertext (ie var_fresh)
1731 if true {
1732 let mut rng = DefaultSecureRng::new();
1733 let mut check = Stats { samples: vec![] };
1734 for _ in 0..10 {
1735 // generate a new collective public key
1736 let mut pk_cr_seed = [0u8; 32];
1737 rng.fill_bytes(&mut pk_cr_seed);
1738 let public_key_share = parties
1739 .iter()
1740 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1741 .collect_vec();
1742 let collective_pk = PublicKey::<
1743 Vec<Vec<u64>>,
1744 DefaultSecureRng,
1745 ModularOpsU64<CiphertextModulus<u64>>,
1746 >::from(public_key_share.as_slice());
1747
1748 let mut m = vec![0u64; rlwe_n];
1749 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
1750 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1751 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
1752 &mut rlwe_ct,
1753 collective_pk.key(),
1754 &m,
1755 rlwe_modop,
1756 rlwe_nttop,
1757 &mut rng,
1758 );
1759
1760 let mut m_back = vec![0u64; rlwe_n];
1761 decrypt_rlwe(
1762 &rlwe_ct,
1763 ideal_client_key.sk_rlwe().values(),
1764 &mut m_back,
1765 rlwe_nttop,
1766 rlwe_modop,
1767 );
1768
1769 rlwe_modop.elwise_sub_mut(m_back.as_mut_slice(), m.as_slice());
1770
1771 check.add_more(Vec::<i64>::try_convert_from(&m_back, rlwe_q).as_slice());
1772 }
1773
1774 println!("Public key Std: {}", check.std_dev().abs().log2());
1775 }
1776
1777 if true {
1778 // Generate server key shares
1779 let mut rng = DefaultSecureRng::new();
1780 let mut pk_cr_seed = [0u8; 32];
1781 rng.fill_bytes(&mut pk_cr_seed);
1782 let public_key_share = parties
1783 .iter()
1784 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1785 .collect_vec();
1786 let collective_pk = PublicKey::<
1787 Vec<Vec<u64>>,
1788 DefaultSecureRng,
1789 ModularOpsU64<CiphertextModulus<u64>>,
1790 >::from(public_key_share.as_slice());
1791
1792 let pbs_cr_seed = [0u8; 32];
1793 rng.fill_bytes(&mut pk_cr_seed);
1794 let server_key_shares = parties
1795 .iter()
1796 .map(|k| {
1797 bool_evaluator.multi_party_server_key_share(pbs_cr_seed, collective_pk.key(), k)
1798 })
1799 .collect_vec();
1800
1801 let seeded_server_key =
1802 bool_evaluator.aggregate_multi_party_server_key_shares(&server_key_shares);
1803
1804 // Check noise in RGSW ciphertexts of ideal LWE secret elements
1805 if false {
1806 let mut check = Stats { samples: vec![] };
1807 izip!(
1808 ideal_client_key.sk_lwe().values.iter(),
1809 seeded_server_key.rgsw_cts().iter()
1810 )
1811 .for_each(|(s_i, rgsw_ct_i)| {
1812 // X^{s[i]}
1813 let mut m_si = vec![0u64; rlwe_n];
1814 let s_i = *s_i * (bool_evaluator.pbs_info.embedding_factor as i32);
1815 if s_i < 0 {
1816 m_si[rlwe_n - (s_i.abs() as usize)] = rlwe_q.neg_one();
1817 } else {
1818 m_si[s_i as usize] = 1;
1819 }
1820
1821 // RLWE'(-sm)
1822 let mut neg_s_eval =
1823 Vec::<u64>::try_convert_from(ideal_client_key.sk_rlwe().values(), rlwe_q);
1824 rlwe_modop.elwise_neg_mut(&mut neg_s_eval);
1825 rlwe_nttop.forward(&mut neg_s_eval);
1826 for j in 0..rlwe_rgsw_decomposer.a().decomposition_count() {
1827 // RLWE(B^{j} * -s[X]*X^{s_lwe[i]})
1828
1829 // -s[X]*X^{s_lwe[i]}*B_j
1830 let mut m_ideal = m_si.clone();
1831 rlwe_nttop.forward(m_ideal.as_mut_slice());
1832 rlwe_modop.elwise_mul_mut(m_ideal.as_mut_slice(), neg_s_eval.as_slice());
1833 rlwe_nttop.backward(m_ideal.as_mut_slice());
1834 rlwe_modop
1835 .elwise_scalar_mul_mut(m_ideal.as_mut_slice(), &rlwe_rgsw_gadget_a[j]);
1836
1837 // RLWE(-s*X^{s_lwe[i]}*B_j)
1838 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1839 rlwe_ct[0].copy_from_slice(&rgsw_ct_i[j]);
1840 rlwe_ct[1].copy_from_slice(
1841 &rgsw_ct_i[j + rlwe_rgsw_decomposer.a().decomposition_count()],
1842 );
1843
1844 let mut m_back = vec![0u64; rlwe_n];
1845 decrypt_rlwe(
1846 &rlwe_ct,
1847 ideal_client_key.sk_rlwe().values(),
1848 &mut m_back,
1849 rlwe_nttop,
1850 rlwe_modop,
1851 );
1852
1853 // diff
1854 rlwe_modop.elwise_sub_mut(&mut m_back, &m_ideal);
1855 check.add_more(&Vec::<i64>::try_convert_from(&m_back, rlwe_q));
1856 }
1857
1858 // RLWE'(m)
1859 for j in 0..rlwe_rgsw_decomposer.b().decomposition_count() {
1860 // RLWE(B^{j} * X^{s_lwe[i]})
1861
1862 // X^{s_lwe[i]}*B_j
1863 let mut m_ideal = m_si.clone();
1864 rlwe_modop
1865 .elwise_scalar_mul_mut(m_ideal.as_mut_slice(), &rlwe_rgsw_gadget_b[j]);
1866
1867 // RLWE(X^{s_lwe[i]}*B_j)
1868 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1869 rlwe_ct[0].copy_from_slice(
1870 &rgsw_ct_i[j + (2 * rlwe_rgsw_decomposer.a().decomposition_count())],
1871 );
1872 rlwe_ct[1].copy_from_slice(
1873 &rgsw_ct_i[j
1874 + (2 * rlwe_rgsw_decomposer.a().decomposition_count()
1875 + rlwe_rgsw_decomposer.b().decomposition_count())],
1876 );
1877
1878 let mut m_back = vec![0u64; rlwe_n];
1879 decrypt_rlwe(
1880 &rlwe_ct,
1881 ideal_client_key.sk_rlwe().values(),
1882 &mut m_back,
1883 rlwe_nttop,
1884 rlwe_modop,
1885 );
1886
1887 // diff
1888 rlwe_modop.elwise_sub_mut(&mut m_back, &m_ideal);
1889 check.add_more(&Vec::<i64>::try_convert_from(&m_back, rlwe_q));
1890 }
1891 });
1892 println!(
1893 "RGSW Std: {} {} ;; max={}",
1894 check.mean(),
1895 check.std_dev().abs().log2(),
1896 check.samples.iter().max().unwrap()
1897 );
1898 }
1899
1900 // server key in Evaluation domain
1901 let server_key_eval_domain =
1902 ServerKeyEvaluationDomain::<_, DefaultSecureRng, NttBackendU64>::from(
1903 &seeded_server_key,
1904 );
1905
1906 // check noise in RLWE x RGSW(X^{s_i}) where RGSW is accunulated RGSW ciphertext
1907 if false {
1908 let mut check = Stats { samples: vec![] };
1909
1910 izip!(
1911 ideal_client_key.sk_lwe().values(),
1912 server_key_eval_domain.rgsw_cts().iter()
1913 )
1914 .for_each(|(s_i, rgsw_ct_i)| {
1915 let mut m = vec![0u64; rlwe_n];
1916 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
1917 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1918 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
1919 &mut rlwe_ct,
1920 collective_pk.key(),
1921 &m,
1922 rlwe_modop,
1923 rlwe_nttop,
1924 &mut rng,
1925 );
1926
1927 // RLWE(m*X^{s[i]}) = RLWE(m) x RGSW(X^{s[i]})
1928 // let mut rlwe_after = RlweCiphertext::<_, DefaultSecureRng>::new_trivial(vec![
1929 // vec![0u64; rlwe_n],
1930 // m.clone(),
1931 // ]);
1932 let mut rlwe_after = RlweCiphertext::<_, DefaultSecureRng> {
1933 data: rlwe_ct.clone(),
1934 is_trivial: false,
1935 _phatom: PhantomData,
1936 };
1937 let mut scratch = vec![
1938 vec![0u64; rlwe_n];
1939 std::cmp::max(
1940 rlwe_rgsw_decomposer.0.decomposition_count(),
1941 rlwe_rgsw_decomposer.1.decomposition_count()
1942 ) + 2
1943 ];
1944 rlwe_by_rgsw(
1945 &mut rlwe_after,
1946 rgsw_ct_i,
1947 &mut scratch,
1948 rlwe_rgsw_decomposer,
1949 rlwe_nttop,
1950 rlwe_modop,
1951 );
1952
1953 // m1 = X^{s[i]}
1954 let mut m1 = vec![0u64; rlwe_n];
1955 let s_i = *s_i * (bool_evaluator.pbs_info.embedding_factor as i32);
1956 if s_i < 0 {
1957 m1[rlwe_n - (s_i.abs() as usize)] = rlwe_q.neg_one()
1958 } else {
1959 m1[s_i as usize] = 1;
1960 }
1961
1962 // (m+e) * m1
1963 let mut m_plus_e_times_m1 = vec![0u64; rlwe_n];
1964 decrypt_rlwe(
1965 &rlwe_ct,
1966 ideal_client_key.sk_rlwe().values(),
1967 &mut m_plus_e_times_m1,
1968 rlwe_nttop,
1969 rlwe_modop,
1970 );
1971 rlwe_nttop.forward(m_plus_e_times_m1.as_mut_slice());
1972 rlwe_nttop.forward(m1.as_mut_slice());
1973 rlwe_modop.elwise_mul_mut(m_plus_e_times_m1.as_mut_slice(), m1.as_slice());
1974 rlwe_nttop.backward(m_plus_e_times_m1.as_mut_slice());
1975
1976 // Resulting RLWE ciphertext will equal: (m0m1 + em1) + e_{rlsw x rgsw}.
1977 // Hence, resulting rlwe ciphertext will have error em1 + e_{rlwe x rgsw}.
1978 // Here we're only concerned with e_{rlwe x rgsw}, that is noise added by
1979 // RLWExRGSW. Also note in practice m1 is a monomial, for ex, X^{s_{i}}, for
1980 // some i and var(em1) = var(e).
1981 let mut m_plus_e_times_m1_more_e = vec![0u64; rlwe_n];
1982 decrypt_rlwe(
1983 &rlwe_after,
1984 ideal_client_key.sk_rlwe().values(),
1985 &mut m_plus_e_times_m1_more_e,
1986 rlwe_nttop,
1987 rlwe_modop,
1988 );
1989
1990 // diff
1991 rlwe_modop.elwise_sub_mut(
1992 m_plus_e_times_m1_more_e.as_mut_slice(),
1993 m_plus_e_times_m1.as_slice(),
1994 );
1995
1996 // let noise = measure_noise(
1997 // &rlwe_after,
1998 // &m_plus_e_times_m1,
1999 // rlwe_nttop,
2000 // rlwe_modop,
2001 // ideal_client_key.sk_rlwe.values(),
2002 // );
2003 // print!("NOISE: {}", noise);
2004
2005 check.add_more(&Vec::<i64>::try_convert_from(
2006 &m_plus_e_times_m1_more_e,
2007 rlwe_q,
2008 ));
2009 });
2010 println!(
2011 "RLWE x RGSW, where RGSW has noise var_brk, std: {} {}",
2012 check.std_dev(),
2013 check.std_dev().abs().log2()
2014 )
2015 }
2016
2017 // check noise in Auto key
2018 if false {
2019 let mut check = Stats { samples: vec![] };
2020
2021 let mut neg_s_poly =
2022 Vec::<u64>::try_convert_from(ideal_client_key.sk_rlwe().values(), rlwe_q);
2023 rlwe_modop.elwise_neg_mut(neg_s_poly.as_mut_slice());
2024
2025 let g = bool_evaluator.pbs_info.g();
2026 let br_q = bool_evaluator.pbs_info.br_q();
2027 let auto_element_dlogs = bool_evaluator.pbs_info.parameters.auto_element_dlogs();
2028 for i in auto_element_dlogs.into_iter() {
2029 let g_pow = if i == 0 {
2030 -g
2031 } else {
2032 (((g as usize).pow(i as u32)) % br_q) as isize
2033 };
2034
2035 // -s[X^k]
2036 let (auto_indices, auto_sign) = generate_auto_map(rlwe_n, g_pow);
2037 let mut neg_s_poly_auto_i = vec![0u64; rlwe_n];
2038 izip!(neg_s_poly.iter(), auto_indices.iter(), auto_sign.iter()).for_each(
2039 |(v, to_i, to_sign)| {
2040 if !to_sign {
2041 neg_s_poly_auto_i[*to_i] = rlwe_modop.neg(v);
2042 } else {
2043 neg_s_poly_auto_i[*to_i] = *v;
2044 }
2045 },
2046 );
2047
2048 let mut auto_key_i = server_key_eval_domain.galois_key_for_auto(i).clone();
2049 // send i^th auto key to coefficient domain
2050 auto_key_i
2051 .iter_mut()
2052 .for_each(|r| rlwe_nttop.backward(r.as_mut_slice()));
2053 auto_gadget.iter().enumerate().for_each(|(i, b_i)| {
2054 // B^i * -s[X^k]
2055 let mut m_ideal = neg_s_poly_auto_i.clone();
2056 rlwe_modop.elwise_scalar_mul_mut(m_ideal.as_mut_slice(), b_i);
2057
2058 let mut m_out = vec![0u64; rlwe_n];
2059 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
2060 rlwe_ct[0].copy_from_slice(&auto_key_i[i]);
2061 rlwe_ct[1].copy_from_slice(
2062 &auto_key_i[auto_decomposer.decomposition_count() + i],
2063 );
2064 decrypt_rlwe(
2065 &rlwe_ct,
2066 ideal_client_key.sk_rlwe().values(),
2067 &mut m_out,
2068 rlwe_nttop,
2069 rlwe_modop,
2070 );
2071
2072 // diff
2073 rlwe_modop.elwise_sub_mut(m_out.as_mut_slice(), m_ideal.as_slice());
2074
2075 check.add_more(&Vec::<i64>::try_convert_from(&m_out, rlwe_q));
2076 });
2077 }
2078
2079 println!("Auto key noise std dev: {}", check.std_dev().abs().log2());
2080 }
2081
2082 // check noise in RLWE(X^k) after sending RLWE(X) -> RLWE(X^k) using collective
2083 // auto key
2084 if true {
2085 let mut check = Stats { samples: vec![] };
2086 let br_q = bool_evaluator.pbs_info.br_q();
2087 let g = bool_evaluator.pbs_info.g();
2088 let auto_element_dlogs = bool_evaluator.pbs_info.parameters.auto_element_dlogs();
2089 for i in auto_element_dlogs.into_iter() {
2090 for _ in 0..10 {
2091 let mut m = vec![0u64; rlwe_n];
2092 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
2093 let mut rlwe_ct = RlweCiphertext::<_, DefaultSecureRng> {
2094 data: vec![vec![0u64; rlwe_n]; 2],
2095 is_trivial: false,
2096 _phatom: PhantomData,
2097 };
2098 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
2099 &mut rlwe_ct,
2100 collective_pk.key(),
2101 &m,
2102 rlwe_modop,
2103 rlwe_nttop,
2104 &mut rng,
2105 );
2106
2107 // We're only interested in noise increased as a result of automorphism.
2108 // Hence, we take m+e as the bench.
2109 let mut m_plus_e = vec![0u64; rlwe_n];
2110 decrypt_rlwe(
2111 &rlwe_ct,
2112 ideal_client_key.sk_rlwe().values(),
2113 &mut m_plus_e,
2114 rlwe_nttop,
2115 rlwe_modop,
2116 );
2117
2118 let auto_key = server_key_eval_domain.galois_key_for_auto(i);
2119 let (auto_map_index, auto_map_sign) =
2120 bool_evaluator.pbs_info.rlwe_auto_map(i);
2121 let mut scratch =
2122 vec![vec![0u64; rlwe_n]; auto_decomposer.decomposition_count() + 2];
2123 galois_auto(
2124 &mut rlwe_ct,
2125 auto_key,
2126 &mut scratch,
2127 &auto_map_index,
2128 &auto_map_sign,
2129 rlwe_modop,
2130 rlwe_nttop,
2131 auto_decomposer,
2132 );
2133
2134 // send m+e from X to X^k
2135 let mut m_plus_e_auto = vec![0u64; rlwe_n];
2136 izip!(m_plus_e.iter(), auto_map_index.iter(), auto_map_sign.iter())
2137 .for_each(|(v, to_index, to_sign)| {
2138 if !to_sign {
2139 m_plus_e_auto[*to_index] = rlwe_modop.neg(v);
2140 } else {
2141 m_plus_e_auto[*to_index] = *v
2142 }
2143 });
2144
2145 let mut m_out = vec![0u64; rlwe_n];
2146 decrypt_rlwe(
2147 &rlwe_ct,
2148 ideal_client_key.sk_rlwe().values(),
2149 &mut m_out,
2150 rlwe_nttop,
2151 rlwe_modop,
2152 );
2153
2154 // diff
2155 rlwe_modop.elwise_sub_mut(m_out.as_mut_slice(), m_plus_e_auto.as_slice());
2156
2157 check.add_more(&Vec::<i64>::try_convert_from(m_out.as_slice(), rlwe_q));
2158 }
2159 }
2160
2161 println!("Rlwe Auto Noise Std: {}", check.std_dev().abs().log2());
2162 }
2163
2164 // Check noise growth in ksk
2165 // TODO check in LWE key switching keys
2166 if true {
2167 // 1. encrypt LWE ciphertext
2168 // 2. Key switching
2169 // 3.
2170 let mut check = Stats { samples: vec![] };
2171
2172 for _ in 0..1024 {
2173 // Encrypt m \in Q_{ks} using RLWE sk
2174 let mut lwe_in_ct = vec![0u64; rlwe_n + 1];
2175 let m = RandomElementInModulus::random(&mut rng, &lwe_q.q().unwrap());
2176 encrypt_lwe(
2177 &mut lwe_in_ct,
2178 &m,
2179 ideal_client_key.sk_rlwe().values(),
2180 lwe_modop,
2181 &mut rng,
2182 );
2183
2184 // Key switch
2185 let mut lwe_out = vec![0u64; lwe_n + 1];
2186 lwe_key_switch(
2187 &mut lwe_out,
2188 &lwe_in_ct,
2189 server_key_eval_domain.lwe_ksk(),
2190 lwe_modop,
2191 bool_evaluator.pbs_info.lwe_decomposer(),
2192 );
2193
2194 // We only care about noise added by LWE key switch
2195 // m+e
2196 let m_plus_e =
2197 decrypt_lwe(&lwe_in_ct, ideal_client_key.sk_rlwe().values(), lwe_modop);
2198
2199 let m_plus_e_plus_lwe_ksk_noise =
2200 decrypt_lwe(&lwe_out, ideal_client_key.sk_lwe().values(), lwe_modop);
2201
2202 let diff = lwe_modop.sub(&m_plus_e_plus_lwe_ksk_noise, &m_plus_e);
2203
2204 check.add_more(&vec![lwe_q.map_element_to_i64(&diff)]);
2205 }
2206
2207 println!("Lwe ksk std dev: {}", check.std_dev().abs().log2());
2208 }
2209 }
2210
2211 // Check noise in fresh RGSW ciphertexts, ie X^{s_j[i]}, must equal noise in
2212 // fresh RLWE ciphertext
2213 if true {}
2214 // test LWE ksk from RLWE -> LWE
2215 // if false {
2216 // let logp = 2;
2217 // let mut rng = DefaultSecureRng::new();
2218
2219 // let m = 1;
2220 // let encoded_m = m << (lwe_logq - logp);
2221
2222 // // Encrypt
2223 // let mut lwe_ct = vec![0u64; rlwe_n + 1];
2224 // encrypt_lwe(
2225 // &mut lwe_ct,
2226 // &encoded_m,
2227 // ideal_client_key.sk_rlwe.values(),
2228 // lwe_modop,
2229 // &mut rng,
2230 // );
2231
2232 // // key switch
2233 // let lwe_decomposer = &bool_evaluator.decomposer_lwe;
2234 // let mut lwe_out = vec![0u64; lwe_n + 1];
2235 // lwe_key_switch(
2236 // &mut lwe_out,
2237 // &lwe_ct,
2238 // &server_key_eval.lwe_ksk,
2239 // lwe_modop,
2240 // lwe_decomposer,
2241 // );
2242
2243 // let encoded_m_back = decrypt_lwe(&lwe_out,
2244 // ideal_client_key.sk_lwe.values(), lwe_modop); let m_back
2245 // = ((encoded_m_back as f64 * (1 << logp) as f64) /
2246 // (lwe_q as f64)).round() as u64; dbg!(m_back, m);
2247
2248 // let noise = measure_noise_lwe(
2249 // &lwe_out,
2250 // ideal_client_key.sk_lwe.values(),
2251 // lwe_modop,
2252 // &encoded_m,
2253 // );
2254
2255 // println!("Noise: {noise}");
2256 // }
2257
2258 // Measure noise in RGSW ciphertexts of ideal LWE secrets
2259 // if true {
2260 // let gadget_vec = gadget_vector(
2261 // bool_evaluator.parameters.rlwe_logq,
2262 // bool_evaluator.parameters.logb_rgsw,
2263 // bool_evaluator.parameters.d_rgsw,
2264 // );
2265
2266 // for i in 0..20 {
2267 // // measure noise in RGSW(s[i])
2268 // let si =
2269 // ideal_client_key.sk_lwe.values[i] *
2270 // (bool_evaluator.embedding_factor as i32); let mut
2271 // si_poly = vec![0u64; rlwe_n]; if si < 0 {
2272 // si_poly[rlwe_n - (si.abs() as usize)] = rlwe_q - 1;
2273 // } else {
2274 // si_poly[(si.abs() as usize)] = 1;
2275 // }
2276
2277 // let mut rgsw_si = server_key_eval.rgsw_cts[i].clone();
2278 // rgsw_si
2279 // .iter_mut()
2280 // .for_each(|ri| rlwe_nttop.backward(ri.as_mut()));
2281
2282 // println!("####### Noise in RGSW(X^s_{i}) #######");
2283 // _measure_noise_rgsw(
2284 // &rgsw_si,
2285 // &si_poly,
2286 // ideal_client_key.sk_rlwe.values(),
2287 // &gadget_vec,
2288 // rlwe_q,
2289 // );
2290 // println!("####### ##################### #######");
2291 // }
2292 // }
2293
2294 // // measure noise grwoth in RLWExRGSW
2295 // if true {
2296 // let mut rng = DefaultSecureRng::new();
2297 // let mut carry_m = vec![0u64; rlwe_n];
2298 // RandomUniformDist1::random_fill(&mut rng, &rlwe_q,
2299 // carry_m.as_mut_slice());
2300
2301 // // RGSW(carrym)
2302 // let trivial_rlwect = vec![vec![0u64; rlwe_n], carry_m.clone()];
2303 // let mut rlwe_ct = RlweCiphertext::<_,
2304 // DefaultSecureRng>::from_raw(trivial_rlwect, true);
2305
2306 // let mut scratch_matrix_dplus2_ring = vec![vec![0u64; rlwe_n];
2307 // d_rgsw + 2]; let mul_mod =
2308 // |v0: &u64, v1: &u64| (((*v0 as u128 * *v1 as u128) % (rlwe_q as u128)) as u64);
2309
2310 // for i in 0..bool_evaluator.parameters.lwe_n {
2311 // rlwe_by_rgsw(
2312 // &mut rlwe_ct,
2313 // server_key_eval.rgsw_ct_lwe_si(i),
2314 // &mut scratch_matrix_dplus2_ring,
2315 // rlwe_decomposer,
2316 // rlwe_nttop,
2317 // rlwe_modop,
2318 // );
2319
2320 // // carry_m[X] * s_i[X]
2321 // let si =
2322 // ideal_client_key.sk_lwe.values[i] *
2323 // (bool_evaluator.embedding_factor as i32); let mut
2324 // si_poly = vec![0u64; rlwe_n]; if si < 0 {
2325 // si_poly[rlwe_n - (si.abs() as usize)] = rlwe_q - 1;
2326 // } else {
2327 // si_poly[(si.abs() as usize)] = 1;
2328 // }
2329 // carry_m = negacyclic_mul(&carry_m, &si_poly, mul_mod,
2330 // rlwe_q);
2331
2332 // let noise = measure_noise(
2333 // &rlwe_ct,
2334 // &carry_m,
2335 // rlwe_nttop,
2336 // rlwe_modop,
2337 // ideal_client_key.sk_rlwe.values(),
2338 // );
2339 // println!("Noise RLWE(carry_m) accumulating {i}^th secret
2340 // monomial: {noise}"); }
2341 // }
2342
2343 // // Check galois keys
2344 // if false {
2345 // let g = bool_evaluator.g() as isize;
2346 // let mut rng = DefaultSecureRng::new();
2347 // let mut scratch_matrix_dplus2_ring = vec![vec![0u64; rlwe_n];
2348 // d_rgsw + 2]; for i in [g, -g] {
2349 // let mut m = vec![0u64; rlwe_n];
2350 // RandomUniformDist1::random_fill(&mut rng, &rlwe_q,
2351 // m.as_mut_slice()); let mut rlwe_ct = {
2352 // let mut data = vec![vec![0u64; rlwe_n]; 2];
2353 // public_key_encrypt_rlwe(
2354 // &mut data,
2355 // &collective_pk.key,
2356 // &m,
2357 // rlwe_modop,
2358 // rlwe_nttop,
2359 // &mut rng,
2360 // );
2361 // RlweCiphertext::<_, DefaultSecureRng>::from_raw(data,
2362 // false) };
2363
2364 // let auto_key = server_key_eval.galois_key_for_auto(i);
2365 // let (auto_map_index, auto_map_sign) =
2366 // generate_auto_map(rlwe_n, i); galois_auto(
2367 // &mut rlwe_ct,
2368 // auto_key,
2369 // &mut scratch_matrix_dplus2_ring,
2370 // &auto_map_index,
2371 // &auto_map_sign,
2372 // rlwe_modop,
2373 // rlwe_nttop,
2374 // rlwe_decomposer,
2375 // );
2376
2377 // // send m(X) -> m(X^i)
2378 // let mut m_k = vec![0u64; rlwe_n];
2379 // izip!(m.iter(), auto_map_index.iter(),
2380 // auto_map_sign.iter()).for_each( |(mi, to_index, to_sign)|
2381 // { if !to_sign {
2382 // m_k[*to_index] = rlwe_q - *mi;
2383 // } else {
2384 // m_k[*to_index] = *mi;
2385 // }
2386 // },
2387 // );
2388
2389 // // measure noise
2390 // let noise = measure_noise(
2391 // &rlwe_ct,
2392 // &m_k,
2393 // rlwe_nttop,
2394 // rlwe_modop,
2395 // ideal_client_key.sk_rlwe.values(),
2396 // );
2397
2398 // println!("Noise after auto k={i}: {noise}");
2399 // }
2400 // }
2401 }
2402}