phantom-zone/src/bool/evaluator.rs
src/bool/evaluator.rsRaw
1use std::{
2 borrow::BorrowMut,
3 cell::{OnceCell, RefCell},
4 clone,
5 collections::HashMap,
6 fmt::{Debug, Display},
7 iter::Once,
8 marker::PhantomData,
9 ops::Shr,
10 sync::OnceLock,
11};
12
13use itertools::{izip, partition, Itertools};
14use num_traits::{FromPrimitive, Num, One, Pow, PrimInt, ToPrimitive, WrappingSub, Zero};
15use rand::Rng;
16use rand_distr::uniform::SampleUniform;
17
18use crate::{
19 backend::{
20 ArithmeticOps, GetModulus, ModInit, ModularOpsU64, Modulus, ShoupMatrixFMA, VectorOps,
21 },
22 decomposer::{Decomposer, DefaultDecomposer, NumInfo, RlweDecomposer},
23 lwe::{decrypt_lwe, encrypt_lwe, lwe_key_switch, lwe_ksk_keygen, measure_noise_lwe, LweSecret},
24 multi_party::{non_interactive_ksk_gen, public_key_share},
25 ntt::{self, Ntt, NttBackendU64, NttInit},
26 pbs::{pbs, sample_extract, PbsInfo, PbsKey, WithShoupRepr},
27 random::{
28 DefaultSecureRng, NewWithSeed, RandomFill, RandomFillGaussianInModulus,
29 RandomFillUniformInModulus, RandomGaussianElementInModulus,
30 },
31 rgsw::{
32 decrypt_rlwe, galois_auto, galois_key_gen, generate_auto_map, public_key_encrypt_rgsw,
33 rgsw_by_rgsw_inplace, rlwe_by_rgsw, secret_key_encrypt_rgsw, IsTrivial, RgswCiphertext,
34 RlweCiphertext, RlweSecret,
35 },
36 utils::{
37 fill_random_ternary_secret_with_hamming_weight, generate_prime, mod_exponent, Global,
38 TryConvertFrom1, WithLocal,
39 },
40 Decryptor, Encryptor, Matrix, MatrixEntity, MatrixMut, MultiPartyDecryptor, Row, RowEntity,
41 RowMut, Secret,
42};
43
44use super::{
45 keys::ClientKey,
46 parameters::{BoolParameters, CiphertextModulus},
47 CommonReferenceSeededCollectivePublicKeyShare, CommonReferenceSeededMultiPartyServerKeyShare,
48 NonInteractiveClientKey, SeededMultiPartyServerKey, SeededServerKey, ServerKeyEvaluationDomain,
49 ShoupServerKeyEvaluationDomain,
50};
51
52pub struct MultiPartyCrs<S> {
53 pub(super) seed: S,
54}
55
56impl<S: Default + Copy> MultiPartyCrs<S> {
57 /// Seed to generate public key share using MultiPartyCrs as the main seed.
58 ///
59 /// Public key seed equals the 1st seed extracted from PRNG Seeded with
60 /// MiltiPartyCrs's seed.
61 pub(super) fn public_key_share_seed<Rng: NewWithSeed<Seed = S> + RandomFill<S>>(&self) -> S {
62 let mut prng = Rng::new_with_seed(self.seed);
63
64 let mut seed = S::default();
65 RandomFill::<S>::random_fill(&mut prng, &mut seed);
66 seed
67 }
68
69 /// Seed to generate server key share using MultiPartyCrs as the main seed.
70 ///
71 /// Server key seed equals the 2nd seed extracted from PRNG Seeded with
72 /// MiltiPartyCrs's seed.
73 pub(super) fn server_key_share_seed<Rng: NewWithSeed<Seed = S> + RandomFill<S>>(&self) -> S {
74 let mut prng = Rng::new_with_seed(self.seed);
75
76 let mut seed = S::default();
77 RandomFill::<S>::random_fill(&mut prng, &mut seed);
78 RandomFill::<S>::random_fill(&mut prng, &mut seed);
79 seed
80 }
81}
82
83pub(crate) trait BooleanGates {
84 type Ciphertext: RowEntity;
85 type Key;
86
87 fn and_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
88 fn nand_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
89 fn or_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
90 fn nor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
91 fn xor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
92 fn xnor_inplace(&mut self, c0: &mut Self::Ciphertext, c1: &Self::Ciphertext, key: &Self::Key);
93 fn not_inplace(&mut self, c: &mut Self::Ciphertext);
94
95 fn and(
96 &mut self,
97 c0: &Self::Ciphertext,
98 c1: &Self::Ciphertext,
99 key: &Self::Key,
100 ) -> Self::Ciphertext;
101 fn nand(
102 &mut self,
103 c0: &Self::Ciphertext,
104 c1: &Self::Ciphertext,
105 key: &Self::Key,
106 ) -> Self::Ciphertext;
107 fn or(
108 &mut self,
109 c0: &Self::Ciphertext,
110 c1: &Self::Ciphertext,
111 key: &Self::Key,
112 ) -> Self::Ciphertext;
113 fn nor(
114 &mut self,
115 c0: &Self::Ciphertext,
116 c1: &Self::Ciphertext,
117 key: &Self::Key,
118 ) -> Self::Ciphertext;
119 fn xor(
120 &mut self,
121 c0: &Self::Ciphertext,
122 c1: &Self::Ciphertext,
123 key: &Self::Key,
124 ) -> Self::Ciphertext;
125 fn xnor(
126 &mut self,
127 c0: &Self::Ciphertext,
128 c1: &Self::Ciphertext,
129 key: &Self::Key,
130 ) -> Self::Ciphertext;
131 fn not(&mut self, c: &Self::Ciphertext) -> Self::Ciphertext;
132}
133
134struct ScratchMemory<M>
135where
136 M: Matrix,
137{
138 lwe_vector: M::R,
139 decomposition_matrix: M,
140}
141
142impl<M: MatrixEntity> ScratchMemory<M>
143where
144 M::R: RowEntity,
145{
146 fn new(parameters: &BoolParameters<M::MatElement>) -> Self {
147 // Vector to store LWE ciphertext with LWE dimesnion n
148 let lwe_vector = M::R::zeros(parameters.lwe_n().0 + 1);
149
150 // Matrix to store decomposed polynomials
151 // Max decompistion count + space for temporary RLWE
152 let d = std::cmp::max(
153 parameters.auto_decomposition_count().0,
154 std::cmp::max(
155 parameters.rlwe_rgsw_decomposition_count().0 .0,
156 parameters.rlwe_rgsw_decomposition_count().1 .0,
157 ),
158 ) + 2;
159 let decomposition_matrix = M::zeros(d, parameters.rlwe_n().0);
160
161 Self {
162 lwe_vector,
163 decomposition_matrix,
164 }
165 }
166}
167
168pub(super) trait BoolEncoding {
169 type Element;
170 fn true_el(&self) -> Self::Element;
171 fn false_el(&self) -> Self::Element;
172 fn qby4(&self) -> Self::Element;
173 fn decode(&self, m: Self::Element) -> bool;
174}
175
176impl<T> BoolEncoding for CiphertextModulus<T>
177where
178 CiphertextModulus<T>: Modulus<Element = T>,
179 T: PrimInt,
180{
181 type Element = T;
182
183 fn qby4(&self) -> Self::Element {
184 if self.is_native() {
185 T::one() << (CiphertextModulus::<T>::_bits() - 2)
186 } else {
187 self.q().unwrap() >> 2
188 }
189 }
190 /// Q/8
191 fn true_el(&self) -> Self::Element {
192 if self.is_native() {
193 T::one() << (CiphertextModulus::<T>::_bits() - 3)
194 } else {
195 self.q().unwrap() >> 3
196 }
197 }
198 /// -Q/8
199 fn false_el(&self) -> Self::Element {
200 self.largest_unsigned_value() - self.true_el() + T::one()
201 }
202 fn decode(&self, m: Self::Element) -> bool {
203 let qby8 = self.true_el();
204 let m = (((m + qby8).to_f64().unwrap() * 4.0f64) / self.q_as_f64().unwrap()).round()
205 as usize
206 % 4usize;
207
208 if m == 0 {
209 return false;
210 } else if m == 1 {
211 return true;
212 } else {
213 panic!("Incorrect bool decryption. Got m={m} but expected m to be 0 or 1")
214 }
215 }
216}
217
218pub(super) struct BoolPbsInfo<M: Matrix, Ntt, RlweModOp, LweModOp> {
219 auto_decomposer: DefaultDecomposer<M::MatElement>,
220 rlwe_rgsw_decomposer: (
221 DefaultDecomposer<M::MatElement>,
222 DefaultDecomposer<M::MatElement>,
223 ),
224 lwe_decomposer: DefaultDecomposer<M::MatElement>,
225 g_k_dlog_map: Vec<usize>,
226 rlwe_nttop: Ntt,
227 rlwe_modop: RlweModOp,
228 lwe_modop: LweModOp,
229 embedding_factor: usize,
230 rlwe_qby4: M::MatElement,
231 rlwe_auto_maps: Vec<(Vec<usize>, Vec<bool>)>,
232 parameters: BoolParameters<M::MatElement>,
233}
234
235impl<M: Matrix, NttOp, RlweModOp, LweModOp> PbsInfo for BoolPbsInfo<M, NttOp, RlweModOp, LweModOp>
236where
237 M::MatElement: PrimInt + WrappingSub + NumInfo + FromPrimitive + From<bool> + Display,
238 RlweModOp: ArithmeticOps<Element = M::MatElement> + ShoupMatrixFMA<M::R>,
239 LweModOp: ArithmeticOps<Element = M::MatElement> + VectorOps<Element = M::MatElement>,
240 NttOp: Ntt<Element = M::MatElement>,
241{
242 type M = M;
243 type Modulus = CiphertextModulus<M::MatElement>;
244 type D = DefaultDecomposer<M::MatElement>;
245 type RlweModOp = RlweModOp;
246 type LweModOp = LweModOp;
247 type NttOp = NttOp;
248 fn rlwe_auto_map(&self, k: usize) -> &(Vec<usize>, Vec<bool>) {
249 &self.rlwe_auto_maps[k]
250 }
251 fn br_q(&self) -> usize {
252 *self.parameters.br_q()
253 }
254 fn lwe_decomposer(&self) -> &Self::D {
255 &self.lwe_decomposer
256 }
257 fn rlwe_rgsw_decomposer(&self) -> &(Self::D, Self::D) {
258 &self.rlwe_rgsw_decomposer
259 }
260 fn auto_decomposer(&self) -> &Self::D {
261 &self.auto_decomposer
262 }
263 fn embedding_factor(&self) -> usize {
264 self.embedding_factor
265 }
266 fn g(&self) -> isize {
267 self.parameters.g() as isize
268 }
269 fn w(&self) -> usize {
270 self.parameters.w()
271 }
272 fn g_k_dlog_map(&self) -> &[usize] {
273 &self.g_k_dlog_map
274 }
275 fn lwe_n(&self) -> usize {
276 self.parameters.lwe_n().0
277 }
278 fn lwe_q(&self) -> &Self::Modulus {
279 self.parameters.lwe_q()
280 }
281 fn rlwe_n(&self) -> usize {
282 self.parameters.rlwe_n().0
283 }
284 fn rlwe_q(&self) -> &Self::Modulus {
285 self.parameters.rlwe_q()
286 }
287 fn modop_lweq(&self) -> &Self::LweModOp {
288 &self.lwe_modop
289 }
290 fn modop_rlweq(&self) -> &Self::RlweModOp {
291 &self.rlwe_modop
292 }
293 fn nttop_rlweq(&self) -> &Self::NttOp {
294 &self.rlwe_nttop
295 }
296}
297
298pub(crate) struct BoolEvaluator<M, Ntt, RlweModOp, LweModOp, SKey>
299where
300 M: Matrix,
301{
302 pbs_info: BoolPbsInfo<M, Ntt, RlweModOp, LweModOp>,
303 scratch_memory: ScratchMemory<M>,
304 nand_test_vec: M::R,
305 and_test_vec: M::R,
306 or_test_vec: M::R,
307 nor_test_vec: M::R,
308 xor_test_vec: M::R,
309 xnor_test_vec: M::R,
310 _phantom: PhantomData<SKey>,
311}
312
313impl<M: Matrix, NttOp, RlweModOp, LweModOp, Skey>
314 BoolEvaluator<M, NttOp, RlweModOp, LweModOp, Skey>
315{
316 pub(super) fn parameters(&self) -> &BoolParameters<M::MatElement> {
317 &self.pbs_info.parameters
318 }
319
320 pub(super) fn pbs_info(&self) -> &BoolPbsInfo<M, NttOp, RlweModOp, LweModOp> {
321 &self.pbs_info
322 }
323}
324
325impl<M: Matrix, NttOp, RlweModOp, LweModOp, SKey> BoolEvaluator<M, NttOp, RlweModOp, LweModOp, SKey>
326where
327 M: MatrixEntity + MatrixMut,
328 M::MatElement: PrimInt
329 + Debug
330 + Display
331 + NumInfo
332 + FromPrimitive
333 + WrappingSub
334 + SampleUniform
335 + From<bool>,
336 NttOp: Ntt<Element = M::MatElement>,
337 RlweModOp: ArithmeticOps<Element = M::MatElement>
338 + VectorOps<Element = M::MatElement>
339 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>
340 + ShoupMatrixFMA<M::R>,
341 LweModOp: ArithmeticOps<Element = M::MatElement>
342 + VectorOps<Element = M::MatElement>
343 + GetModulus<Element = M::MatElement, M = CiphertextModulus<M::MatElement>>,
344 M::R: TryConvertFrom1<[i32], CiphertextModulus<M::MatElement>> + RowEntity + Debug,
345 <M as Matrix>::R: RowMut,
346{
347 pub(super) fn new(parameters: BoolParameters<M::MatElement>) -> Self
348 where
349 RlweModOp: ModInit<M = CiphertextModulus<M::MatElement>>,
350 LweModOp: ModInit<M = CiphertextModulus<M::MatElement>>,
351 NttOp: NttInit<CiphertextModulus<M::MatElement>>,
352 {
353 //TODO(Jay): Run sanity checks for modulus values in parameters
354
355 // generates dlog map s.t. (+/-)g^{k} % q = a, for all a \in Z*_{q} and k \in
356 // [0, q/4). We store the dlog `k` at index `a`. This makes it easier to
357 // simply look up `k` at runtime as vec[a]. If a = g^{k} then dlog is
358 // stored as k. If a = -g^{k} then dlog is stored as k = q/4. This is done to
359 // differentiate sign.
360 let g = parameters.g();
361 let q = *parameters.br_q();
362 let mut g_k_dlog_map = vec![0usize; q];
363 for i in 0..q / 4 {
364 let v = mod_exponent(g as u64, i as u64, q as u64) as usize;
365 // g^i
366 g_k_dlog_map[v] = i;
367 // -(g^i)
368 g_k_dlog_map[q - v] = i + (q / 4);
369 }
370
371 let embedding_factor = (2 * parameters.rlwe_n().0) / q;
372
373 let rlwe_nttop = NttOp::new(parameters.rlwe_q(), parameters.rlwe_n().0);
374 let rlwe_modop = RlweModOp::new(*parameters.rlwe_q());
375 let lwe_modop = LweModOp::new(*parameters.lwe_q());
376
377 let q = *parameters.br_q();
378 let qby2 = q >> 1;
379 let qby8 = q >> 3;
380 // Q/8 (Q: rlwe_q)
381 let true_m_el = parameters.rlwe_q().true_el();
382 // -Q/8
383 let false_m_el = parameters.rlwe_q().false_el();
384 let (auto_map_index, auto_map_sign) = generate_auto_map(qby2, -(g as isize));
385
386 let init_test_vec = |partition_el: usize,
387 before_partition_el: M::MatElement,
388 after_partition_el: M::MatElement| {
389 let mut test_vec = M::R::zeros(qby2);
390 for i in 0..qby2 {
391 if i < partition_el {
392 test_vec.as_mut()[i] = before_partition_el;
393 } else {
394 test_vec.as_mut()[i] = after_partition_el;
395 }
396 }
397
398 // v(X) -> v(X^{-g})
399 let mut test_vec_autog = M::R::zeros(qby2);
400 izip!(
401 test_vec.as_ref().iter(),
402 auto_map_index.iter(),
403 auto_map_sign.iter()
404 )
405 .for_each(|(v, to_index, to_sign)| {
406 if !to_sign {
407 // negate
408 test_vec_autog.as_mut()[*to_index] = rlwe_modop.neg(v);
409 } else {
410 test_vec_autog.as_mut()[*to_index] = *v;
411 }
412 });
413
414 return test_vec_autog;
415 };
416
417 let nand_test_vec = init_test_vec(3 * qby8, true_m_el, false_m_el);
418 let and_test_vec = init_test_vec(3 * qby8, false_m_el, true_m_el);
419 let or_test_vec = init_test_vec(qby8, false_m_el, true_m_el);
420 let nor_test_vec = init_test_vec(qby8, true_m_el, false_m_el);
421 let xor_test_vec = init_test_vec(qby8, false_m_el, true_m_el);
422 let xnor_test_vec = init_test_vec(qby8, true_m_el, false_m_el);
423
424 // auto map indices and sign
425 // Auto maps are stored as [-g, g^{1}, g^{2}, ..., g^{w}]
426 let mut rlwe_auto_maps = vec![];
427 let ring_size = parameters.rlwe_n().0;
428 let g = parameters.g();
429 let br_q = parameters.br_q();
430 let auto_element_dlogs = parameters.auto_element_dlogs();
431 assert!(auto_element_dlogs[0] == 0);
432 for i in auto_element_dlogs.into_iter() {
433 let el = if i == 0 {
434 -(g as isize)
435 } else {
436 (g.pow(i as u32) % br_q) as isize
437 };
438 rlwe_auto_maps.push(generate_auto_map(ring_size, el))
439 }
440
441 let rlwe_qby4 = parameters.rlwe_q().qby4();
442
443 let scratch_memory = ScratchMemory::new(¶meters);
444
445 let pbs_info = BoolPbsInfo {
446 auto_decomposer: parameters.auto_decomposer(),
447 lwe_decomposer: parameters.lwe_decomposer(),
448 rlwe_rgsw_decomposer: parameters.rlwe_rgsw_decomposer(),
449 g_k_dlog_map,
450 embedding_factor,
451 lwe_modop,
452 rlwe_modop,
453 rlwe_nttop,
454 rlwe_qby4,
455 rlwe_auto_maps,
456 parameters: parameters,
457 };
458
459 BoolEvaluator {
460 pbs_info,
461 scratch_memory,
462 nand_test_vec,
463 and_test_vec,
464 or_test_vec,
465 nor_test_vec,
466 xnor_test_vec,
467 xor_test_vec,
468 _phantom: PhantomData,
469 }
470 }
471
472 pub(super) fn client_key(&self) -> ClientKey {
473 let sk_lwe = LweSecret::random(
474 self.pbs_info.parameters.lwe_n().0 >> 1,
475 self.pbs_info.parameters.lwe_n().0,
476 );
477 let sk_rlwe = RlweSecret::random(
478 self.pbs_info.parameters.rlwe_n().0 >> 1,
479 self.pbs_info.parameters.rlwe_n().0,
480 );
481 ClientKey::new(sk_rlwe, sk_lwe)
482 }
483
484 pub(super) fn single_party_server_key(
485 &self,
486 client_key: &ClientKey,
487 ) -> SeededServerKey<M, BoolParameters<M::MatElement>, [u8; 32]> {
488 DefaultSecureRng::with_local_mut(|rng| {
489 let mut main_seed = [0u8; 32];
490 rng.fill_bytes(&mut main_seed);
491
492 let mut main_prng = DefaultSecureRng::new_seeded(main_seed);
493
494 let rlwe_n = self.pbs_info.parameters.rlwe_n().0;
495 let sk_rlwe = client_key.sk_rlwe();
496 let sk_lwe = client_key.sk_lwe();
497
498 // generate auto keys
499 let mut auto_keys = HashMap::new();
500 let auto_gadget = self.pbs_info.auto_decomposer.gadget_vector();
501 let g = self.pbs_info.parameters.g();
502 let br_q = self.pbs_info.parameters.br_q();
503 let auto_els = self.pbs_info.parameters.auto_element_dlogs();
504 for i in auto_els.into_iter() {
505 let g_pow = if i == 0 {
506 -(g as isize)
507 } else {
508 (g.pow(i as u32) % br_q) as isize
509 };
510 let mut gk = M::zeros(self.pbs_info.auto_decomposer.decomposition_count(), rlwe_n);
511 galois_key_gen(
512 &mut gk,
513 sk_rlwe.values(),
514 g_pow,
515 &auto_gadget,
516 &self.pbs_info.rlwe_modop,
517 &self.pbs_info.rlwe_nttop,
518 &mut main_prng,
519 rng,
520 );
521 auto_keys.insert(i, gk);
522 }
523
524 // generate rgsw ciphertexts RGSW(si) where si is i^th LWE secret element
525 let ring_size = self.pbs_info.parameters.rlwe_n().0;
526 let rlwe_q = self.pbs_info.parameters.rlwe_q();
527 let (rlrg_d_a, rlrg_d_b) = (
528 self.pbs_info.rlwe_rgsw_decomposer.0.decomposition_count(),
529 self.pbs_info.rlwe_rgsw_decomposer.1.decomposition_count(),
530 );
531 let rlrg_gadget_a = self.pbs_info.rlwe_rgsw_decomposer.0.gadget_vector();
532 let rlrg_gadget_b = self.pbs_info.rlwe_rgsw_decomposer.1.gadget_vector();
533 let rgsw_cts = sk_lwe
534 .values()
535 .iter()
536 .map(|si| {
537 // X^{si}; assume |emebedding_factor * si| < N
538 let mut m = M::R::zeros(ring_size);
539 let si = (self.pbs_info.embedding_factor as i32) * si;
540 // dbg!(si);
541 if si < 0 {
542 // X^{-i} = X^{2N - i} = -X^{N-i}
543 m.as_mut()[ring_size - (si.abs() as usize)] = rlwe_q.neg_one();
544 } else {
545 // X^{i}
546 m.as_mut()[si.abs() as usize] = M::MatElement::one();
547 }
548
549 let mut rgsw_si = M::zeros(rlrg_d_a * 2 + rlrg_d_b, ring_size);
550 secret_key_encrypt_rgsw(
551 &mut rgsw_si,
552 m.as_ref(),
553 &rlrg_gadget_a,
554 &rlrg_gadget_b,
555 sk_rlwe.values(),
556 &self.pbs_info.rlwe_modop,
557 &self.pbs_info.rlwe_nttop,
558 &mut main_prng,
559 rng,
560 );
561
562 rgsw_si
563 })
564 .collect_vec();
565
566 // LWE KSK from RLWE secret s -> LWE secret z
567 let d_lwe_gadget = self.pbs_info.lwe_decomposer.gadget_vector();
568 let mut lwe_ksk =
569 M::R::zeros(self.pbs_info.lwe_decomposer.decomposition_count() * ring_size);
570 lwe_ksk_keygen(
571 &sk_rlwe.values(),
572 &sk_lwe.values(),
573 &mut lwe_ksk,
574 &d_lwe_gadget,
575 &self.pbs_info.lwe_modop,
576 &mut main_prng,
577 rng,
578 );
579
580 SeededServerKey::from_raw(
581 auto_keys,
582 rgsw_cts,
583 lwe_ksk,
584 self.pbs_info.parameters.clone(),
585 main_seed,
586 )
587 })
588 }
589
590 pub(super) fn multi_party_server_key_share(
591 &self,
592 cr_seed: [u8; 32],
593 collective_pk: &M,
594 client_key: &ClientKey,
595 ) -> CommonReferenceSeededMultiPartyServerKeyShare<M, BoolParameters<M::MatElement>, [u8; 32]>
596 {
597 DefaultSecureRng::with_local_mut(|rng| {
598 let mut main_prng = DefaultSecureRng::new_seeded(cr_seed);
599
600 let sk_rlwe = client_key.sk_rlwe();
601 let sk_lwe = client_key.sk_lwe();
602
603 let g = self.pbs_info.parameters.g();
604 let ring_size = self.pbs_info.parameters.rlwe_n().0;
605 let rlwe_q = self.pbs_info.parameters.rlwe_q();
606 let lwe_q = self.pbs_info.parameters.lwe_q();
607
608 let rlweq_modop = &self.pbs_info.rlwe_modop;
609 let rlweq_nttop = &self.pbs_info.rlwe_nttop;
610
611 // sanity check
612 assert!(sk_rlwe.values().len() == ring_size);
613 assert!(sk_lwe.values().len() == self.pbs_info.parameters.lwe_n().0);
614
615 // auto keys
616 let mut auto_keys = HashMap::new();
617 let auto_gadget = self.pbs_info.auto_decomposer.gadget_vector();
618 let auto_element_dlogs = self.pbs_info.parameters.auto_element_dlogs();
619 let br_q = self.pbs_info.parameters.br_q();
620 for i in auto_element_dlogs.into_iter() {
621 let g_pow = if i == 0 {
622 -(g as isize)
623 } else {
624 (g.pow(i as u32) % br_q) as isize
625 };
626
627 let mut ksk_out = M::zeros(
628 self.pbs_info.auto_decomposer.decomposition_count(),
629 ring_size,
630 );
631 galois_key_gen(
632 &mut ksk_out,
633 sk_rlwe.values(),
634 g_pow,
635 &auto_gadget,
636 rlweq_modop,
637 rlweq_nttop,
638 &mut main_prng,
639 rng,
640 );
641 auto_keys.insert(i, ksk_out);
642 }
643
644 // rgsw ciphertexts of lwe secret elements
645 let rgsw_rgsw_decomposer = self
646 .pbs_info
647 .parameters
648 .rgsw_rgsw_decomposer::<DefaultDecomposer<M::MatElement>>();
649 let (rgrg_d_a, rgrg_d_b) = (
650 rgsw_rgsw_decomposer.0.decomposition_count(),
651 rgsw_rgsw_decomposer.1.decomposition_count(),
652 );
653 let (rgrg_gadget_a, rgrg_gadget_b) = (
654 rgsw_rgsw_decomposer.0.gadget_vector(),
655 rgsw_rgsw_decomposer.1.gadget_vector(),
656 );
657 let rgsw_cts = sk_lwe
658 .values()
659 .iter()
660 .map(|si| {
661 let mut m = M::R::zeros(ring_size);
662 //TODO(Jay): It will be nice to have a function that returns polynomial
663 // (monomial infact!) corresponding to secret element embedded in ring X^{2N+1}.
664 // Save lots of mistakes where one forgest to emebed si in bigger ring.
665 let si = *si * (self.pbs_info.embedding_factor as i32);
666 if si < 0 {
667 // X^{-si} = X^{2N-si} = -X^{N-si}, assuming abs(si) < N
668 // (which it is given si is secret element)
669 m.as_mut()[ring_size - (si.abs() as usize)] = rlwe_q.neg_one();
670 } else {
671 m.as_mut()[si as usize] = M::MatElement::one();
672 }
673
674 // public key RGSW encryption has no part that can be seeded, unlike secret key
675 // RGSW encryption where RLWE'_A(m) is seeded
676 let mut out_rgsw = M::zeros(rgrg_d_a * 2 + rgrg_d_b * 2, ring_size);
677 public_key_encrypt_rgsw(
678 &mut out_rgsw,
679 &m.as_ref(),
680 collective_pk,
681 &rgrg_gadget_a,
682 &rgrg_gadget_b,
683 rlweq_modop,
684 rlweq_nttop,
685 rng,
686 );
687
688 out_rgsw
689 })
690 .collect_vec();
691
692 // LWE ksk
693 let mut lwe_ksk =
694 M::R::zeros(self.pbs_info.lwe_decomposer.decomposition_count() * ring_size);
695 let lwe_modop = &self.pbs_info.lwe_modop;
696 let d_lwe_gadget_vec = self.pbs_info.lwe_decomposer.gadget_vector();
697 lwe_ksk_keygen(
698 sk_rlwe.values(),
699 sk_lwe.values(),
700 &mut lwe_ksk,
701 &d_lwe_gadget_vec,
702 lwe_modop,
703 &mut main_prng,
704 rng,
705 );
706
707 CommonReferenceSeededMultiPartyServerKeyShare::new(
708 rgsw_cts,
709 auto_keys,
710 lwe_ksk,
711 cr_seed,
712 self.pbs_info.parameters.clone(),
713 )
714 })
715 }
716
717 pub(super) fn non_interactive_multi_party_key_share(
718 self_ui_to_ksk_seed: [u8; 32],
719 others_ui_to_ksk_seed: &[[u8; 32]],
720 client_key: &NonInteractiveClientKey,
721 ) {
722 // // ui_to_s_ksk
723 // non_interactive_ksk_gen(
724 // client_key.sk_rlwe().values(),
725 // client_key.sk_u_rlwe().values(),
726 // gadget_vec,
727 // p_rng,
728 // rng,
729 // nttop,
730 // modop,
731 // )
732 }
733
734 pub(super) fn multi_party_public_key_share(
735 &self,
736 cr_seed: [u8; 32],
737 client_key: &ClientKey,
738 ) -> CommonReferenceSeededCollectivePublicKeyShare<
739 <M as Matrix>::R,
740 [u8; 32],
741 BoolParameters<<M as Matrix>::MatElement>,
742 > {
743 DefaultSecureRng::with_local_mut(|rng| {
744 let mut share_out = M::R::zeros(self.pbs_info.parameters.rlwe_n().0);
745 let modop = &self.pbs_info.rlwe_modop;
746 let nttop = &self.pbs_info.rlwe_nttop;
747 let mut main_prng = DefaultSecureRng::new_seeded(cr_seed);
748 public_key_share(
749 &mut share_out,
750 client_key.sk_rlwe().values(),
751 modop,
752 nttop,
753 &mut main_prng,
754 rng,
755 );
756 CommonReferenceSeededCollectivePublicKeyShare::new(
757 share_out,
758 cr_seed,
759 self.pbs_info.parameters.clone(),
760 )
761 })
762 }
763
764 pub(super) fn multi_party_decryption_share(
765 &self,
766 lwe_ct: &M::R,
767 client_key: &ClientKey,
768 ) -> <M as Matrix>::MatElement {
769 assert!(lwe_ct.as_ref().len() == self.pbs_info.parameters.rlwe_n().0 + 1);
770 let modop = &self.pbs_info.rlwe_modop;
771 let mut neg_s = M::R::try_convert_from(
772 client_key.sk_rlwe().values(),
773 &self.pbs_info.parameters.rlwe_q(),
774 );
775 modop.elwise_neg_mut(neg_s.as_mut());
776
777 let mut neg_sa = M::MatElement::zero();
778 izip!(lwe_ct.as_ref().iter().skip(1), neg_s.as_ref().iter()).for_each(|(ai, nsi)| {
779 neg_sa = modop.add(&neg_sa, &modop.mul(ai, nsi));
780 });
781
782 let e = DefaultSecureRng::with_local_mut(|rng| {
783 let mut e =
784 RandomGaussianElementInModulus::random(rng, self.pbs_info.parameters.rlwe_q());
785 e
786 });
787 let share = modop.add(&neg_sa, &e);
788
789 share
790 }
791
792 pub(crate) fn multi_party_decrypt(&self, shares: &[M::MatElement], lwe_ct: &M::R) -> bool {
793 let modop = &self.pbs_info.rlwe_modop;
794 let mut sum_a = M::MatElement::zero();
795 shares
796 .iter()
797 .for_each(|share_i| sum_a = modop.add(&sum_a, &share_i));
798
799 let encoded_m = modop.add(&lwe_ct.as_ref()[0], &sum_a);
800 self.pbs_info.parameters.rlwe_q().decode(encoded_m)
801 }
802
803 pub(crate) fn pk_encrypt(&self, pk: &M, m: bool) -> M::R {
804 self.pk_encrypt_batched(pk, &vec![m]).remove(0)
805 }
806
807 /// Encrypts a batch booleans as multiple LWE ciphertexts.
808 ///
809 /// For public key encryption we first encrypt `m` as a RLWE ciphertext and
810 /// then sample extract LWE samples at required indices.
811 ///
812 /// - TODO(Jay:) Communication can be improved by not sample exctracting and
813 /// instead just truncate degree 0 values (part Bs)
814 pub(crate) fn pk_encrypt_batched(&self, pk: &M, m: &[bool]) -> Vec<M::R> {
815 DefaultSecureRng::with_local_mut(|rng| {
816 let ring_size = self.pbs_info.parameters.rlwe_n().0;
817 assert!(
818 m.len() <= ring_size,
819 "Cannot batch encrypt > ring_size{ring_size} elements at once"
820 );
821
822 let modop = &self.pbs_info.rlwe_modop;
823 let nttop = &self.pbs_info.rlwe_nttop;
824
825 // RLWE(0)
826 // sample ephemeral key u
827 let mut u = vec![0i32; ring_size];
828 fill_random_ternary_secret_with_hamming_weight(u.as_mut(), ring_size >> 1, rng);
829 let mut u = M::R::try_convert_from(&u, &self.pbs_info.parameters.rlwe_q());
830 nttop.forward(u.as_mut());
831
832 let mut ua = M::R::zeros(ring_size);
833 ua.as_mut().copy_from_slice(pk.get_row_slice(0));
834 let mut ub = M::R::zeros(ring_size);
835 ub.as_mut().copy_from_slice(pk.get_row_slice(1));
836
837 // a*u
838 nttop.forward(ua.as_mut());
839 modop.elwise_mul_mut(ua.as_mut(), u.as_ref());
840 nttop.backward(ua.as_mut());
841
842 // b*u
843 nttop.forward(ub.as_mut());
844 modop.elwise_mul_mut(ub.as_mut(), u.as_ref());
845 nttop.backward(ub.as_mut());
846
847 let mut rlwe = M::zeros(2, ring_size);
848 // sample error
849 rlwe.iter_rows_mut().for_each(|ri| {
850 RandomFillGaussianInModulus::<[M::MatElement], CiphertextModulus<M::MatElement>>::random_fill(
851 rng,
852 &self.pbs_info.parameters.rlwe_q(),
853 ri.as_mut(),
854 );
855 });
856
857 // a*u + e0
858 modop.elwise_add_mut(rlwe.get_row_mut(0), ua.as_ref());
859 // b*u + e1
860 modop.elwise_add_mut(rlwe.get_row_mut(1), ub.as_ref());
861
862 //FIXME(Jay): Figure out a way to get Q/8 form modulus
863 let mut m_vec = M::R::zeros(ring_size);
864 izip!(m_vec.as_mut().iter_mut(), m.iter()).for_each(|(m_el, m_bool)| {
865 if *m_bool {
866 // Q/8
867 *m_el = self.pbs_info.rlwe_q().true_el()
868 } else {
869 // -Q/8
870 *m_el = self.pbs_info.rlwe_q().false_el()
871 }
872 });
873
874 // b*u + e1 + m
875 modop.elwise_add_mut(rlwe.get_row_mut(1), m_vec.as_ref());
876 // rlwe.set(1, 0, modop.add(rlwe.get(1, 0), &m));
877
878 // sample extract index required indices
879 let samples = m.len();
880 (0..samples)
881 .into_iter()
882 .map(|i| {
883 let mut lwe_out = M::R::zeros(ring_size + 1);
884 sample_extract(&mut lwe_out, &rlwe, modop, i);
885 lwe_out
886 })
887 .collect_vec()
888 })
889 }
890
891 /// TODO(Jay): Fetch client key from thread local
892 pub fn sk_encrypt(&self, m: bool, client_key: &ClientKey) -> M::R {
893 //FIXME(Jay): Figure out a way to get Q/8 form modulus
894 let m = if m {
895 // Q/8
896 self.pbs_info.rlwe_q().true_el()
897 } else {
898 // -Q/8
899 self.pbs_info.rlwe_q().false_el()
900 };
901
902 DefaultSecureRng::with_local_mut(|rng| {
903 let mut lwe_out = M::R::zeros(self.pbs_info.parameters.rlwe_n().0 + 1);
904 encrypt_lwe(
905 &mut lwe_out,
906 &m,
907 client_key.sk_rlwe().values(),
908 &self.pbs_info.rlwe_modop,
909 rng,
910 );
911 lwe_out
912 })
913 }
914
915 pub fn sk_decrypt(&self, lwe_ct: &M::R, client_key: &ClientKey) -> bool {
916 let m = decrypt_lwe(
917 lwe_ct,
918 client_key.sk_rlwe().values(),
919 &self.pbs_info.rlwe_modop,
920 );
921 self.pbs_info.rlwe_q().decode(m)
922 }
923
924 pub(super) fn aggregate_multi_party_server_key_shares<S>(
925 &self,
926 shares: &[CommonReferenceSeededMultiPartyServerKeyShare<
927 M,
928 BoolParameters<M::MatElement>,
929 S,
930 >],
931 ) -> SeededMultiPartyServerKey<M, S, BoolParameters<M::MatElement>>
932 where
933 S: PartialEq + Clone,
934 M: Clone,
935 {
936 assert!(shares.len() > 0);
937 let parameters = shares[0].parameters().clone();
938 let cr_seed = shares[0].cr_seed();
939
940 let rlwe_n = parameters.rlwe_n().0;
941 let g = parameters.g() as isize;
942 let rlwe_q = parameters.rlwe_q();
943 let lwe_q = parameters.lwe_q();
944
945 // sanity checks
946 shares.iter().skip(1).for_each(|s| {
947 assert!(s.parameters() == ¶meters);
948 assert!(s.cr_seed() == cr_seed);
949 });
950
951 let rlweq_modop = &self.pbs_info.rlwe_modop;
952 let rlweq_nttop = &self.pbs_info.rlwe_nttop;
953
954 // auto keys
955 let mut auto_keys = HashMap::new();
956 let auto_elements_dlog = parameters.auto_element_dlogs();
957 for i in auto_elements_dlog.into_iter() {
958 let mut key = M::zeros(parameters.auto_decomposition_count().0, rlwe_n);
959
960 shares.iter().for_each(|s| {
961 let auto_key_share_i = s.auto_keys().get(&i).expect("Auto key {i} missing");
962 assert!(
963 auto_key_share_i.dimension()
964 == (parameters.auto_decomposition_count().0, rlwe_n)
965 );
966 izip!(key.iter_rows_mut(), auto_key_share_i.iter_rows()).for_each(
967 |(partb_out, partb_share)| {
968 rlweq_modop.elwise_add_mut(partb_out.as_mut(), partb_share.as_ref());
969 },
970 );
971 });
972
973 auto_keys.insert(i, key);
974 }
975
976 // rgsw ciphertext (most expensive part!)
977 let lwe_n = parameters.lwe_n().0;
978 let rgsw_by_rgsw_decomposer =
979 parameters.rgsw_rgsw_decomposer::<DefaultDecomposer<M::MatElement>>();
980 let mut scratch_matrix = M::zeros(
981 std::cmp::max(
982 rgsw_by_rgsw_decomposer.a().decomposition_count(),
983 rgsw_by_rgsw_decomposer.b().decomposition_count(),
984 ) + (rgsw_by_rgsw_decomposer.a().decomposition_count() * 2
985 + rgsw_by_rgsw_decomposer.b().decomposition_count() * 2),
986 rlwe_n,
987 );
988
989 let mut tmp_rgsw =
990 RgswCiphertext::<M, _>::empty(rlwe_n, &rgsw_by_rgsw_decomposer, rlwe_q.clone()).data;
991 let rgsw_cts = (0..lwe_n).into_iter().map(|index| {
992 // copy over rgsw ciphertext for index^th secret element from first share and
993 // treat it as accumulating rgsw ciphertext
994 let mut rgsw_i = shares[0].rgsw_cts()[index].clone();
995
996 shares.iter().skip(1).for_each(|si| {
997 // copy over si's RGSW[index] ciphertext and send to evaluation domain
998 izip!(tmp_rgsw.iter_rows_mut(), si.rgsw_cts()[index].iter_rows()).for_each(
999 |(to_ri, from_ri)| {
1000 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1001 rlweq_nttop.forward(to_ri.as_mut())
1002 },
1003 );
1004
1005 rgsw_by_rgsw_inplace(
1006 &mut rgsw_i,
1007 &tmp_rgsw,
1008 &rgsw_by_rgsw_decomposer,
1009 &mut scratch_matrix,
1010 rlweq_nttop,
1011 rlweq_modop,
1012 );
1013 });
1014
1015 rgsw_i
1016 });
1017 // d_a and d_b may differ for RGSWxRGSW multiplication and RLWExRGSW
1018 // multiplication. After this point RGSW ciphertexts will only be used for
1019 // RLWExRGSW multiplication (in blind rotation). Thus we drop any additional
1020 // RLWE ciphertexts in RGSW ciphertexts after RGSw x RGSW multiplication
1021 let (rgswrgsw_d_a, rgswrgsw_d_b) = self.pbs_info.parameters.rgsw_rgsw_decomposition_count();
1022 let (rlrg_d_a, rlrg_d_b) = self.pbs_info.parameters.rlwe_rgsw_decomposition_count();
1023 let rgsw_ct_rows_in = rgswrgsw_d_a.0 * 2 + rgswrgsw_d_b.0 * 2;
1024 let rgsw_ct_rows_out = rlrg_d_a.0 * 2 + rlrg_d_b.0 * 2;
1025 assert!(rgswrgsw_d_a.0 >= rlrg_d_a.0, "RGSWxRGSW part A decomposition count {} must be >= RLWExRGSW part A decomposition count {}", rgswrgsw_d_a.0 , rlrg_d_a.0);
1026 assert!(rgswrgsw_d_b.0 >= rlrg_d_b.0, "RGSWxRGSW part B decomposition count {} must be >= RLWExRGSW part B decomposition count {}", rgswrgsw_d_b.0 , rlrg_d_b.0);
1027 let rgsw_cts = rgsw_cts
1028 .map(|ct_i_in| {
1029 assert!(ct_i_in.dimension() == (rgsw_ct_rows_in, rlwe_n));
1030 let mut reduced_ct_i_out = M::zeros(rgsw_ct_rows_out, rlwe_n);
1031
1032 // RLWE'(-sm) part A
1033 izip!(
1034 reduced_ct_i_out.iter_rows_mut().take(rlrg_d_a.0),
1035 ct_i_in
1036 .iter_rows()
1037 .skip(rgswrgsw_d_a.0 - rlrg_d_a.0)
1038 .take(rlrg_d_a.0)
1039 )
1040 .for_each(|(to_ri, from_ri)| {
1041 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1042 });
1043
1044 // RLWE'(-sm) part B
1045 izip!(
1046 reduced_ct_i_out
1047 .iter_rows_mut()
1048 .skip(rlrg_d_a.0)
1049 .take(rlrg_d_a.0),
1050 ct_i_in
1051 .iter_rows()
1052 .skip(rgswrgsw_d_a.0 + (rgswrgsw_d_a.0 - rlrg_d_a.0))
1053 .take(rlrg_d_a.0)
1054 )
1055 .for_each(|(to_ri, from_ri)| {
1056 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1057 });
1058
1059 // RLWE'(m) Part A
1060 izip!(
1061 reduced_ct_i_out
1062 .iter_rows_mut()
1063 .skip(rlrg_d_a.0 * 2)
1064 .take(rlrg_d_b.0),
1065 ct_i_in
1066 .iter_rows()
1067 .skip(rgswrgsw_d_a.0 * 2 + (rgswrgsw_d_b.0 - rlrg_d_b.0))
1068 .take(rlrg_d_b.0)
1069 )
1070 .for_each(|(to_ri, from_ri)| {
1071 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1072 });
1073
1074 // RLWE'(m) Part B
1075 izip!(
1076 reduced_ct_i_out
1077 .iter_rows_mut()
1078 .skip(rlrg_d_a.0 * 2 + rlrg_d_b.0)
1079 .take(rlrg_d_b.0),
1080 ct_i_in
1081 .iter_rows()
1082 .skip(rgswrgsw_d_a.0 * 2 + rgswrgsw_d_b.0 + (rgswrgsw_d_b.0 - rlrg_d_b.0))
1083 .take(rlrg_d_b.0)
1084 )
1085 .for_each(|(to_ri, from_ri)| {
1086 to_ri.as_mut().copy_from_slice(from_ri.as_ref());
1087 });
1088
1089 reduced_ct_i_out
1090 })
1091 .collect_vec();
1092
1093 // LWE ksks
1094 let mut lwe_ksk = M::R::zeros(rlwe_n * parameters.lwe_decomposition_count().0);
1095 let lweq_modop = &self.pbs_info.lwe_modop;
1096 shares.iter().for_each(|si| {
1097 assert!(si.lwe_ksk().as_ref().len() == rlwe_n * parameters.lwe_decomposition_count().0);
1098 lweq_modop.elwise_add_mut(lwe_ksk.as_mut(), si.lwe_ksk().as_ref())
1099 });
1100
1101 SeededMultiPartyServerKey::new(rgsw_cts, auto_keys, lwe_ksk, cr_seed.clone(), parameters)
1102 }
1103}
1104
1105impl<M, NttOp, RlweModOp, LweModOp, Skey> BoolEvaluator<M, NttOp, RlweModOp, LweModOp, Skey>
1106where
1107 M: MatrixMut + MatrixEntity,
1108 M::R: RowMut + RowEntity,
1109 M::MatElement: PrimInt + FromPrimitive + One + Copy + Zero + Display + WrappingSub + NumInfo,
1110 RlweModOp: VectorOps<Element = M::MatElement> + ArithmeticOps<Element = M::MatElement>,
1111 LweModOp: VectorOps<Element = M::MatElement> + ArithmeticOps<Element = M::MatElement>,
1112 NttOp: Ntt<Element = M::MatElement>,
1113{
1114 /// Returns c0 + c1 + Q/4
1115 fn _add_and_shift_lwe_cts(&self, c0: &mut M::R, c1: &M::R) {
1116 let modop = &self.pbs_info.rlwe_modop;
1117 modop.elwise_add_mut(c0.as_mut(), c1.as_ref());
1118 // +Q/4
1119 c0.as_mut()[0] = modop.add(&c0.as_ref()[0], &self.pbs_info.rlwe_qby4);
1120 }
1121
1122 /// Returns 2(c0 - c1) + Q/4
1123 fn _subtract_double_lwe_cts(&self, c0: &mut M::R, c1: &M::R) {
1124 let modop = &self.pbs_info.rlwe_modop;
1125 // c0 - c1
1126 modop.elwise_sub_mut(c0.as_mut(), c1.as_ref());
1127
1128 // double
1129 c0.as_mut().iter_mut().for_each(|v| *v = modop.add(v, v));
1130 }
1131}
1132
1133impl<M, NttOp, RlweModOp, LweModOp, Skey> BooleanGates
1134 for BoolEvaluator<M, NttOp, RlweModOp, LweModOp, Skey>
1135where
1136 M: MatrixMut + MatrixEntity,
1137 M::R: RowMut + RowEntity + Clone,
1138 M::MatElement:
1139 PrimInt + FromPrimitive + One + Copy + Zero + Display + WrappingSub + NumInfo + From<bool>,
1140 RlweModOp: VectorOps<Element = M::MatElement>
1141 + ArithmeticOps<Element = M::MatElement>
1142 + ShoupMatrixFMA<M::R>,
1143 LweModOp: VectorOps<Element = M::MatElement> + ArithmeticOps<Element = M::MatElement>,
1144 NttOp: Ntt<Element = M::MatElement>,
1145 Skey: PbsKey<AutoKey = <Skey as PbsKey>::RgswCt, LweKskKey = M>,
1146 <Skey as PbsKey>::RgswCt: WithShoupRepr<M = M>,
1147{
1148 type Ciphertext = M::R;
1149 type Key = Skey;
1150
1151 fn nand_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1152 self._add_and_shift_lwe_cts(c0, c1);
1153
1154 // PBS
1155 pbs(
1156 &self.pbs_info,
1157 &self.nand_test_vec,
1158 c0,
1159 server_key,
1160 &mut self.scratch_memory.lwe_vector,
1161 &mut self.scratch_memory.decomposition_matrix,
1162 );
1163 }
1164
1165 fn and_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1166 self._add_and_shift_lwe_cts(c0, c1);
1167
1168 // PBS
1169 pbs(
1170 &self.pbs_info,
1171 &self.and_test_vec,
1172 c0,
1173 server_key,
1174 &mut self.scratch_memory.lwe_vector,
1175 &mut self.scratch_memory.decomposition_matrix,
1176 );
1177 }
1178
1179 fn or_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1180 self._add_and_shift_lwe_cts(c0, c1);
1181
1182 // PBS
1183 pbs(
1184 &self.pbs_info,
1185 &self.or_test_vec,
1186 c0,
1187 server_key,
1188 &mut self.scratch_memory.lwe_vector,
1189 &mut self.scratch_memory.decomposition_matrix,
1190 );
1191 }
1192
1193 fn nor_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1194 self._add_and_shift_lwe_cts(c0, c1);
1195
1196 // PBS
1197 pbs(
1198 &self.pbs_info,
1199 &self.nor_test_vec,
1200 c0,
1201 server_key,
1202 &mut self.scratch_memory.lwe_vector,
1203 &mut self.scratch_memory.decomposition_matrix,
1204 )
1205 }
1206
1207 fn xor_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1208 self._subtract_double_lwe_cts(c0, c1);
1209
1210 // PBS
1211 pbs(
1212 &self.pbs_info,
1213 &self.xor_test_vec,
1214 c0,
1215 server_key,
1216 &mut self.scratch_memory.lwe_vector,
1217 &mut self.scratch_memory.decomposition_matrix,
1218 );
1219 }
1220
1221 fn xnor_inplace(&mut self, c0: &mut M::R, c1: &M::R, server_key: &Self::Key) {
1222 self._subtract_double_lwe_cts(c0, c1);
1223
1224 // PBS
1225 pbs(
1226 &self.pbs_info,
1227 &self.xnor_test_vec,
1228 c0,
1229 server_key,
1230 &mut self.scratch_memory.lwe_vector,
1231 &mut self.scratch_memory.decomposition_matrix,
1232 );
1233 }
1234
1235 fn not_inplace(&mut self, c0: &mut M::R) {
1236 let modop = &self.pbs_info.rlwe_modop;
1237 c0.as_mut().iter_mut().for_each(|v| *v = modop.neg(v));
1238 }
1239
1240 fn and(
1241 &mut self,
1242 c0: &Self::Ciphertext,
1243 c1: &Self::Ciphertext,
1244 key: &Self::Key,
1245 ) -> Self::Ciphertext {
1246 let mut out = c0.clone();
1247 self.and_inplace(&mut out, c1, key);
1248 out
1249 }
1250
1251 fn nand(
1252 &mut self,
1253 c0: &Self::Ciphertext,
1254 c1: &Self::Ciphertext,
1255 key: &Self::Key,
1256 ) -> Self::Ciphertext {
1257 let mut out = c0.clone();
1258 self.nand_inplace(&mut out, c1, key);
1259 out
1260 }
1261
1262 fn or(
1263 &mut self,
1264 c0: &Self::Ciphertext,
1265 c1: &Self::Ciphertext,
1266 key: &Self::Key,
1267 ) -> Self::Ciphertext {
1268 let mut out = c0.clone();
1269 self.or_inplace(&mut out, c1, key);
1270 out
1271 }
1272
1273 fn nor(
1274 &mut self,
1275 c0: &Self::Ciphertext,
1276 c1: &Self::Ciphertext,
1277 key: &Self::Key,
1278 ) -> Self::Ciphertext {
1279 let mut out = c0.clone();
1280 self.nor_inplace(&mut out, c1, key);
1281 out
1282 }
1283
1284 fn xnor(
1285 &mut self,
1286 c0: &Self::Ciphertext,
1287 c1: &Self::Ciphertext,
1288 key: &Self::Key,
1289 ) -> Self::Ciphertext {
1290 let mut out = c0.clone();
1291 self.xnor_inplace(&mut out, c1, key);
1292 out
1293 }
1294
1295 fn xor(
1296 &mut self,
1297 c0: &Self::Ciphertext,
1298 c1: &Self::Ciphertext,
1299 key: &Self::Key,
1300 ) -> Self::Ciphertext {
1301 let mut out = c0.clone();
1302 self.xor_inplace(&mut out, c1, key);
1303 out
1304 }
1305
1306 fn not(&mut self, c: &Self::Ciphertext) -> Self::Ciphertext {
1307 let mut out = c.clone();
1308 self.not_inplace(&mut out);
1309 out
1310 }
1311}
1312
1313#[cfg(test)]
1314mod tests {
1315 use bool::parameters::{MP_BOOL_PARAMS, SP_BOOL_PARAMS};
1316 use rand::{thread_rng, Rng};
1317 use rand_distr::Uniform;
1318
1319 use crate::{
1320 bool::{
1321 self, CommonReferenceSeededMultiPartyServerKeyShare, PublicKey,
1322 SeededMultiPartyServerKey, SMALL_MP_BOOL_PARAMS,
1323 },
1324 ntt::NttBackendU64,
1325 random::{RandomElementInModulus, DEFAULT_RNG},
1326 rgsw::{
1327 self, measure_noise, public_key_encrypt_rlwe, secret_key_encrypt_rlwe,
1328 tests::{_measure_noise_rgsw, _sk_encrypt_rlwe},
1329 RgswCiphertext, RgswCiphertextEvaluationDomain, SeededRgswCiphertext,
1330 SeededRlweCiphertext,
1331 },
1332 utils::{negacyclic_mul, Stats},
1333 };
1334
1335 use super::*;
1336
1337 #[test]
1338 fn bool_encrypt_decrypt_works() {
1339 let bool_evaluator = BoolEvaluator::<
1340 Vec<Vec<u64>>,
1341 NttBackendU64,
1342 ModularOpsU64<CiphertextModulus<u64>>,
1343 ModularOpsU64<CiphertextModulus<u64>>,
1344 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1345 >::new(SP_BOOL_PARAMS);
1346 let client_key = bool_evaluator.client_key();
1347
1348 let mut m = true;
1349 for _ in 0..1000 {
1350 let lwe_ct = bool_evaluator.sk_encrypt(m, &client_key);
1351 let m_back = bool_evaluator.sk_decrypt(&lwe_ct, &client_key);
1352 assert_eq!(m, m_back);
1353 m = !m;
1354 }
1355 }
1356
1357 #[test]
1358 fn bool_nand() {
1359 let mut bool_evaluator = BoolEvaluator::<
1360 Vec<Vec<u64>>,
1361 NttBackendU64,
1362 ModularOpsU64<CiphertextModulus<u64>>,
1363 ModularOpsU64<CiphertextModulus<u64>>,
1364 ShoupServerKeyEvaluationDomain<_>,
1365 >::new(SP_BOOL_PARAMS);
1366
1367 // println!("{:?}", bool_evaluator.nand_test_vec);
1368 let client_key = bool_evaluator.client_key();
1369 let seeded_server_key = bool_evaluator.single_party_server_key(&client_key);
1370 let runtime_server_key =
1371 ShoupServerKeyEvaluationDomain::from(ServerKeyEvaluationDomain::<
1372 _,
1373 _,
1374 DefaultSecureRng,
1375 NttBackendU64,
1376 >::from(&seeded_server_key));
1377
1378 let mut m0 = false;
1379 let mut m1 = true;
1380
1381 let mut ct0 = bool_evaluator.sk_encrypt(m0, &client_key);
1382 let mut ct1 = bool_evaluator.sk_encrypt(m1, &client_key);
1383
1384 for _ in 0..500 {
1385 let ct_back = bool_evaluator.nand(&ct0, &ct1, &runtime_server_key);
1386
1387 let m_out = !(m0 && m1);
1388
1389 let m_back = bool_evaluator.sk_decrypt(&ct_back, &client_key);
1390 assert!(m_out == m_back, "Expected {m_out}, got {m_back}");
1391
1392 m1 = m0;
1393 m0 = m_out;
1394
1395 ct1 = ct0;
1396 ct0 = ct_back;
1397 }
1398 }
1399
1400 #[test]
1401 fn bool_xor() {
1402 let mut bool_evaluator = BoolEvaluator::<
1403 Vec<Vec<u64>>,
1404 NttBackendU64,
1405 ModularOpsU64<CiphertextModulus<u64>>,
1406 ModularOpsU64<CiphertextModulus<u64>>,
1407 ShoupServerKeyEvaluationDomain<_>,
1408 >::new(SP_BOOL_PARAMS);
1409
1410 // println!("{:?}", bool_evaluator.nand_test_vec);
1411 let client_key = bool_evaluator.client_key();
1412 let seeded_server_key = bool_evaluator.single_party_server_key(&client_key);
1413 let runtime_server_key =
1414 ShoupServerKeyEvaluationDomain::from(ServerKeyEvaluationDomain::<
1415 _,
1416 _,
1417 DefaultSecureRng,
1418 NttBackendU64,
1419 >::from(&seeded_server_key));
1420
1421 let mut m0 = false;
1422 let mut m1 = true;
1423
1424 let mut ct0 = bool_evaluator.sk_encrypt(m0, &client_key);
1425 let mut ct1 = bool_evaluator.sk_encrypt(m1, &client_key);
1426
1427 for _ in 0..1000 {
1428 let ct_back = bool_evaluator.xor(&ct0, &ct1, &runtime_server_key);
1429 let m_out = (m0 ^ m1);
1430
1431 let m_back = bool_evaluator.sk_decrypt(&ct_back, &client_key);
1432 assert!(m_out == m_back, "Expected {m_out}, got {m_back}");
1433
1434 m1 = m0;
1435 m0 = m_out;
1436
1437 ct1 = ct0;
1438 ct0 = ct_back;
1439 }
1440 }
1441
1442 #[test]
1443 fn multi_party_encryption_decryption() {
1444 let bool_evaluator = BoolEvaluator::<
1445 Vec<Vec<u64>>,
1446 NttBackendU64,
1447 ModularOpsU64<CiphertextModulus<u64>>,
1448 ModularOpsU64<CiphertextModulus<u64>>,
1449 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1450 >::new(MP_BOOL_PARAMS);
1451
1452 let no_of_parties = 500;
1453 let parties = (0..no_of_parties)
1454 .map(|_| bool_evaluator.client_key())
1455 .collect_vec();
1456
1457 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1458 parties.iter().for_each(|k| {
1459 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1460 *ideal_i = *ideal_i + s_i;
1461 });
1462 });
1463
1464 let mut m = true;
1465 for i in 0..100 {
1466 let pk_cr_seed = [0u8; 32];
1467
1468 let public_key_share = parties
1469 .iter()
1470 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1471 .collect_vec();
1472
1473 let collective_pk = PublicKey::<
1474 Vec<Vec<u64>>,
1475 DefaultSecureRng,
1476 ModularOpsU64<CiphertextModulus<u64>>,
1477 >::from(public_key_share.as_slice());
1478 let lwe_ct = bool_evaluator.pk_encrypt(collective_pk.key(), m);
1479
1480 let decryption_shares = parties
1481 .iter()
1482 .map(|k| bool_evaluator.multi_party_decryption_share(&lwe_ct, k))
1483 .collect_vec();
1484
1485 let m_back = bool_evaluator.multi_party_decrypt(&decryption_shares, &lwe_ct);
1486
1487 {
1488 let ideal_m = if m {
1489 bool_evaluator.pbs_info.parameters.rlwe_q().true_el()
1490 } else {
1491 bool_evaluator.pbs_info.parameters.rlwe_q().false_el()
1492 };
1493 let noise = measure_noise_lwe(
1494 &lwe_ct,
1495 &ideal_rlwe_sk,
1496 &bool_evaluator.pbs_info.rlwe_modop,
1497 &ideal_m,
1498 );
1499 println!("Noise: {noise}");
1500 }
1501
1502 assert_eq!(m_back, m);
1503 m = !m;
1504 }
1505 }
1506
1507 fn _collecitve_public_key_gen(rlwe_q: u64, parties_rlwe_sk: &[RlweSecret]) -> Vec<Vec<u64>> {
1508 let ring_size = parties_rlwe_sk[0].values.len();
1509 assert!(ring_size.is_power_of_two());
1510 let mut rng = DefaultSecureRng::new();
1511 let nttop = NttBackendU64::new(&rlwe_q, ring_size);
1512 let modop = ModularOpsU64::new(rlwe_q);
1513
1514 // Generate Pk shares
1515 let pk_seed = [0u8; 32];
1516 let pk_shares = parties_rlwe_sk.iter().map(|sk| {
1517 let mut p_rng = DefaultSecureRng::new_seeded(pk_seed);
1518 let mut share_out = vec![0u64; ring_size];
1519 public_key_share(
1520 &mut share_out,
1521 sk.values(),
1522 &modop,
1523 &nttop,
1524 &mut p_rng,
1525 &mut rng,
1526 );
1527 share_out
1528 });
1529
1530 let mut pk_part_b = vec![0u64; ring_size];
1531 pk_shares.for_each(|share| modop.elwise_add_mut(&mut pk_part_b, &share));
1532 let mut pk_part_a = vec![0u64; ring_size];
1533 let mut p_rng = DefaultSecureRng::new_seeded(pk_seed);
1534 RandomFillUniformInModulus::random_fill(&mut p_rng, &rlwe_q, pk_part_a.as_mut_slice());
1535
1536 vec![pk_part_a, pk_part_b]
1537 }
1538
1539 fn _multi_party_all_keygen(
1540 bool_evaluator: &BoolEvaluator<
1541 Vec<Vec<u64>>,
1542 NttBackendU64,
1543 ModularOpsU64<CiphertextModulus<u64>>,
1544 ModularOpsU64<CiphertextModulus<u64>>,
1545 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1546 >,
1547 no_of_parties: usize,
1548 ) -> (
1549 Vec<ClientKey>,
1550 PublicKey<Vec<Vec<u64>>, DefaultSecureRng, ModularOpsU64<CiphertextModulus<u64>>>,
1551 Vec<
1552 CommonReferenceSeededMultiPartyServerKeyShare<
1553 Vec<Vec<u64>>,
1554 BoolParameters<u64>,
1555 [u8; 32],
1556 >,
1557 >,
1558 SeededMultiPartyServerKey<Vec<Vec<u64>>, [u8; 32], BoolParameters<u64>>,
1559 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1560 ClientKey,
1561 ) {
1562 let parties = (0..no_of_parties)
1563 .map(|_| bool_evaluator.client_key())
1564 .collect_vec();
1565
1566 let mut rng = DefaultSecureRng::new();
1567
1568 // Collective public key
1569 let mut pk_cr_seed = [0u8; 32];
1570 rng.fill_bytes(&mut pk_cr_seed);
1571 let public_key_share = parties
1572 .iter()
1573 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1574 .collect_vec();
1575 let collective_pk =
1576 PublicKey::<Vec<Vec<u64>>, DefaultSecureRng, _>::from(public_key_share.as_slice());
1577
1578 // Server key
1579 let mut pbs_cr_seed = [0u8; 32];
1580 rng.fill_bytes(&mut pbs_cr_seed);
1581 let server_key_shares = parties
1582 .iter()
1583 .map(|k| {
1584 bool_evaluator.multi_party_server_key_share(pbs_cr_seed, &collective_pk.key(), k)
1585 })
1586 .collect_vec();
1587 let seeded_server_key =
1588 bool_evaluator.aggregate_multi_party_server_key_shares(&server_key_shares);
1589 let runtime_server_key =
1590 ShoupServerKeyEvaluationDomain::from(ServerKeyEvaluationDomain::<
1591 _,
1592 _,
1593 DefaultSecureRng,
1594 NttBackendU64,
1595 >::from(&seeded_server_key));
1596
1597 // construct ideal rlwe sk for meauring noise
1598 let ideal_client_key = {
1599 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1600 parties.iter().for_each(|k| {
1601 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1602 *ideal_i = *ideal_i + s_i;
1603 });
1604 });
1605 let mut ideal_lwe_sk = vec![0i32; bool_evaluator.pbs_info.lwe_n()];
1606 parties.iter().for_each(|k| {
1607 izip!(ideal_lwe_sk.iter_mut(), k.sk_lwe().values()).for_each(|(ideal_i, s_i)| {
1608 *ideal_i = *ideal_i + s_i;
1609 });
1610 });
1611
1612 ClientKey::new(
1613 RlweSecret {
1614 values: ideal_rlwe_sk,
1615 },
1616 LweSecret {
1617 values: ideal_lwe_sk,
1618 },
1619 )
1620 };
1621
1622 (
1623 parties,
1624 collective_pk,
1625 server_key_shares,
1626 seeded_server_key,
1627 runtime_server_key,
1628 ideal_client_key,
1629 )
1630 }
1631
1632 #[test]
1633 fn multi_party_nand() {
1634 let mut bool_evaluator = BoolEvaluator::<
1635 Vec<Vec<u64>>,
1636 NttBackendU64,
1637 ModularOpsU64<CiphertextModulus<u64>>,
1638 ModularOpsU64<CiphertextModulus<u64>>,
1639 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1640 >::new(MP_BOOL_PARAMS);
1641
1642 let (parties, collective_pk, _, _, server_key_eval, ideal_client_key) =
1643 _multi_party_all_keygen(&bool_evaluator, 2);
1644
1645 let mut m0 = true;
1646 let mut m1 = false;
1647
1648 let mut lwe0 = bool_evaluator.pk_encrypt(collective_pk.key(), m0);
1649 let mut lwe1 = bool_evaluator.pk_encrypt(collective_pk.key(), m1);
1650
1651 for _ in 0..2000 {
1652 let lwe_out = bool_evaluator.nand(&lwe0, &lwe1, &server_key_eval);
1653
1654 let m_expected = !(m0 & m1);
1655
1656 // multi-party decrypt
1657 let decryption_shares = parties
1658 .iter()
1659 .map(|k| bool_evaluator.multi_party_decryption_share(&lwe_out, k))
1660 .collect_vec();
1661 let m_back = bool_evaluator.multi_party_decrypt(&decryption_shares, &lwe_out);
1662
1663 let m_back = bool_evaluator.sk_decrypt(&lwe_out, &ideal_client_key);
1664
1665 assert!(
1666 m_expected == m_back,
1667 "Expected {m_expected}, got
1668{m_back}"
1669 );
1670 m1 = m0;
1671 m0 = m_expected;
1672
1673 lwe1 = lwe0;
1674 lwe0 = lwe_out;
1675 }
1676 }
1677
1678 #[test]
1679 fn noise_tester() {
1680 let bool_evaluator = BoolEvaluator::<
1681 Vec<Vec<u64>>,
1682 NttBackendU64,
1683 ModularOpsU64<CiphertextModulus<u64>>,
1684 ModularOpsU64<CiphertextModulus<u64>>,
1685 ShoupServerKeyEvaluationDomain<Vec<Vec<u64>>>,
1686 >::new(SMALL_MP_BOOL_PARAMS);
1687
1688 // let (_, collective_pk, _, _, server_key_eval, ideal_client_key) =
1689 // _multi_party_all_keygen(&bool_evaluator, 20);
1690 let no_of_parties = 16;
1691 let lwe_q = bool_evaluator.pbs_info.parameters.lwe_q();
1692 let rlwe_q = bool_evaluator.pbs_info.parameters.rlwe_q();
1693 let lwe_n = bool_evaluator.pbs_info.parameters.lwe_n().0;
1694 let rlwe_n = bool_evaluator.pbs_info.parameters.rlwe_n().0;
1695 let lwe_modop = &bool_evaluator.pbs_info.lwe_modop;
1696 let rlwe_nttop = &bool_evaluator.pbs_info.rlwe_nttop;
1697 let rlwe_modop = &bool_evaluator.pbs_info.rlwe_modop;
1698
1699 // let rgsw_rgsw_decomposer = &bool_evaluator
1700 // .pbs_info
1701 // .parameters
1702 // .rgsw_rgsw_decomposer::<DefaultDecomposer<u64>>();
1703 // let rgsw_rgsw_gadget_a = rgsw_rgsw_decomposer.0.gadget_vector();
1704 // let rgsw_rgsw_gadget_b = rgsw_rgsw_decomposer.1.gadget_vector();
1705
1706 let rlwe_rgsw_decomposer = &bool_evaluator.pbs_info.rlwe_rgsw_decomposer;
1707 let rlwe_rgsw_gadget_a = rlwe_rgsw_decomposer.0.gadget_vector();
1708 let rlwe_rgsw_gadget_b = rlwe_rgsw_decomposer.1.gadget_vector();
1709
1710 let auto_decomposer = &bool_evaluator.pbs_info.auto_decomposer;
1711 let auto_gadget = auto_decomposer.gadget_vector();
1712
1713 let parties = (0..no_of_parties)
1714 .map(|_| bool_evaluator.client_key())
1715 .collect_vec();
1716
1717 let ideal_client_key = {
1718 let mut ideal_rlwe_sk = vec![0i32; bool_evaluator.pbs_info.rlwe_n()];
1719 parties.iter().for_each(|k| {
1720 izip!(ideal_rlwe_sk.iter_mut(), k.sk_rlwe().values()).for_each(|(ideal_i, s_i)| {
1721 *ideal_i = *ideal_i + s_i;
1722 });
1723 });
1724 let mut ideal_lwe_sk = vec![0i32; bool_evaluator.pbs_info.lwe_n()];
1725 parties.iter().for_each(|k| {
1726 izip!(ideal_lwe_sk.iter_mut(), k.sk_lwe().values()).for_each(|(ideal_i, s_i)| {
1727 *ideal_i = *ideal_i + s_i;
1728 });
1729 });
1730
1731 ClientKey::new(
1732 RlweSecret {
1733 values: ideal_rlwe_sk,
1734 },
1735 LweSecret {
1736 values: ideal_lwe_sk,
1737 },
1738 )
1739 };
1740
1741 // check noise in freshly encrypted RLWE ciphertext (ie var_fresh)
1742 if true {
1743 let mut rng = DefaultSecureRng::new();
1744 let mut check = Stats { samples: vec![] };
1745 for _ in 0..10 {
1746 // generate a new collective public key
1747 let mut pk_cr_seed = [0u8; 32];
1748 rng.fill_bytes(&mut pk_cr_seed);
1749 let public_key_share = parties
1750 .iter()
1751 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1752 .collect_vec();
1753 let collective_pk = PublicKey::<
1754 Vec<Vec<u64>>,
1755 DefaultSecureRng,
1756 ModularOpsU64<CiphertextModulus<u64>>,
1757 >::from(public_key_share.as_slice());
1758
1759 let mut m = vec![0u64; rlwe_n];
1760 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
1761 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1762 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
1763 &mut rlwe_ct,
1764 collective_pk.key(),
1765 &m,
1766 rlwe_modop,
1767 rlwe_nttop,
1768 &mut rng,
1769 );
1770
1771 let mut m_back = vec![0u64; rlwe_n];
1772 decrypt_rlwe(
1773 &rlwe_ct,
1774 ideal_client_key.sk_rlwe().values(),
1775 &mut m_back,
1776 rlwe_nttop,
1777 rlwe_modop,
1778 );
1779
1780 rlwe_modop.elwise_sub_mut(m_back.as_mut_slice(), m.as_slice());
1781
1782 check.add_more(Vec::<i64>::try_convert_from(&m_back, rlwe_q).as_slice());
1783 }
1784
1785 println!("Public key Std: {}", check.std_dev().abs().log2());
1786 }
1787
1788 if true {
1789 // Generate server key shares
1790 let mut rng = DefaultSecureRng::new();
1791 let mut pk_cr_seed = [0u8; 32];
1792 rng.fill_bytes(&mut pk_cr_seed);
1793 let public_key_share = parties
1794 .iter()
1795 .map(|k| bool_evaluator.multi_party_public_key_share(pk_cr_seed, k))
1796 .collect_vec();
1797 let collective_pk = PublicKey::<
1798 Vec<Vec<u64>>,
1799 DefaultSecureRng,
1800 ModularOpsU64<CiphertextModulus<u64>>,
1801 >::from(public_key_share.as_slice());
1802
1803 let pbs_cr_seed = [0u8; 32];
1804 rng.fill_bytes(&mut pk_cr_seed);
1805 let server_key_shares = parties
1806 .iter()
1807 .map(|k| {
1808 bool_evaluator.multi_party_server_key_share(pbs_cr_seed, collective_pk.key(), k)
1809 })
1810 .collect_vec();
1811
1812 let seeded_server_key =
1813 bool_evaluator.aggregate_multi_party_server_key_shares(&server_key_shares);
1814
1815 // Check noise in RGSW ciphertexts of ideal LWE secret elements
1816 if false {
1817 let mut check = Stats { samples: vec![] };
1818 izip!(
1819 ideal_client_key.sk_lwe().values.iter(),
1820 seeded_server_key.rgsw_cts().iter()
1821 )
1822 .for_each(|(s_i, rgsw_ct_i)| {
1823 // X^{s[i]}
1824 let mut m_si = vec![0u64; rlwe_n];
1825 let s_i = *s_i * (bool_evaluator.pbs_info.embedding_factor as i32);
1826 if s_i < 0 {
1827 m_si[rlwe_n - (s_i.abs() as usize)] = rlwe_q.neg_one();
1828 } else {
1829 m_si[s_i as usize] = 1;
1830 }
1831
1832 // RLWE'(-sm)
1833 let mut neg_s_eval =
1834 Vec::<u64>::try_convert_from(ideal_client_key.sk_rlwe().values(), rlwe_q);
1835 rlwe_modop.elwise_neg_mut(&mut neg_s_eval);
1836 rlwe_nttop.forward(&mut neg_s_eval);
1837 for j in 0..rlwe_rgsw_decomposer.a().decomposition_count() {
1838 // RLWE(B^{j} * -s[X]*X^{s_lwe[i]})
1839
1840 // -s[X]*X^{s_lwe[i]}*B_j
1841 let mut m_ideal = m_si.clone();
1842 rlwe_nttop.forward(m_ideal.as_mut_slice());
1843 rlwe_modop.elwise_mul_mut(m_ideal.as_mut_slice(), neg_s_eval.as_slice());
1844 rlwe_nttop.backward(m_ideal.as_mut_slice());
1845 rlwe_modop
1846 .elwise_scalar_mul_mut(m_ideal.as_mut_slice(), &rlwe_rgsw_gadget_a[j]);
1847
1848 // RLWE(-s*X^{s_lwe[i]}*B_j)
1849 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1850 rlwe_ct[0].copy_from_slice(&rgsw_ct_i[j]);
1851 rlwe_ct[1].copy_from_slice(
1852 &rgsw_ct_i[j + rlwe_rgsw_decomposer.a().decomposition_count()],
1853 );
1854
1855 let mut m_back = vec![0u64; rlwe_n];
1856 decrypt_rlwe(
1857 &rlwe_ct,
1858 ideal_client_key.sk_rlwe().values(),
1859 &mut m_back,
1860 rlwe_nttop,
1861 rlwe_modop,
1862 );
1863
1864 // diff
1865 rlwe_modop.elwise_sub_mut(&mut m_back, &m_ideal);
1866 check.add_more(&Vec::<i64>::try_convert_from(&m_back, rlwe_q));
1867 }
1868
1869 // RLWE'(m)
1870 for j in 0..rlwe_rgsw_decomposer.b().decomposition_count() {
1871 // RLWE(B^{j} * X^{s_lwe[i]})
1872
1873 // X^{s_lwe[i]}*B_j
1874 let mut m_ideal = m_si.clone();
1875 rlwe_modop
1876 .elwise_scalar_mul_mut(m_ideal.as_mut_slice(), &rlwe_rgsw_gadget_b[j]);
1877
1878 // RLWE(X^{s_lwe[i]}*B_j)
1879 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1880 rlwe_ct[0].copy_from_slice(
1881 &rgsw_ct_i[j + (2 * rlwe_rgsw_decomposer.a().decomposition_count())],
1882 );
1883 rlwe_ct[1].copy_from_slice(
1884 &rgsw_ct_i[j
1885 + (2 * rlwe_rgsw_decomposer.a().decomposition_count()
1886 + rlwe_rgsw_decomposer.b().decomposition_count())],
1887 );
1888
1889 let mut m_back = vec![0u64; rlwe_n];
1890 decrypt_rlwe(
1891 &rlwe_ct,
1892 ideal_client_key.sk_rlwe().values(),
1893 &mut m_back,
1894 rlwe_nttop,
1895 rlwe_modop,
1896 );
1897
1898 // diff
1899 rlwe_modop.elwise_sub_mut(&mut m_back, &m_ideal);
1900 check.add_more(&Vec::<i64>::try_convert_from(&m_back, rlwe_q));
1901 }
1902 });
1903 println!(
1904 "RGSW Std: {} {} ;; max={}",
1905 check.mean(),
1906 check.std_dev().abs().log2(),
1907 check.samples.iter().max().unwrap()
1908 );
1909 }
1910
1911 // server key in Evaluation domain
1912 let runtime_server_key =
1913 ShoupServerKeyEvaluationDomain::from(ServerKeyEvaluationDomain::<
1914 _,
1915 _,
1916 DefaultSecureRng,
1917 NttBackendU64,
1918 >::from(&seeded_server_key));
1919
1920 // check noise in RLWE x RGSW(X^{s_i}) where RGSW is accunulated RGSW ciphertext
1921 if false {
1922 let mut check = Stats { samples: vec![] };
1923
1924 ideal_client_key
1925 .sk_lwe()
1926 .values()
1927 .iter()
1928 .enumerate()
1929 .for_each(|(index, s_i)| {
1930 let rgsw_ct_i = runtime_server_key.rgsw_ct_lwe_si(index).as_ref();
1931
1932 let mut m = vec![0u64; rlwe_n];
1933 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
1934 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
1935 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
1936 &mut rlwe_ct,
1937 collective_pk.key(),
1938 &m,
1939 rlwe_modop,
1940 rlwe_nttop,
1941 &mut rng,
1942 );
1943
1944 let mut rlwe_after = RlweCiphertext::<_, DefaultSecureRng> {
1945 data: rlwe_ct.clone(),
1946 is_trivial: false,
1947 _phatom: PhantomData,
1948 };
1949 let mut scratch = vec![
1950 vec![0u64; rlwe_n];
1951 std::cmp::max(
1952 rlwe_rgsw_decomposer.0.decomposition_count(),
1953 rlwe_rgsw_decomposer.1.decomposition_count()
1954 ) + 2
1955 ];
1956 rlwe_by_rgsw(
1957 &mut rlwe_after,
1958 rgsw_ct_i,
1959 &mut scratch,
1960 rlwe_rgsw_decomposer,
1961 rlwe_nttop,
1962 rlwe_modop,
1963 );
1964
1965 // m1 = X^{s[i]}
1966 let mut m1 = vec![0u64; rlwe_n];
1967 let s_i = *s_i * (bool_evaluator.pbs_info.embedding_factor as i32);
1968 if s_i < 0 {
1969 m1[rlwe_n - (s_i.abs() as usize)] = rlwe_q.neg_one()
1970 } else {
1971 m1[s_i as usize] = 1;
1972 }
1973
1974 // (m+e) * m1
1975 let mut m_plus_e_times_m1 = vec![0u64; rlwe_n];
1976 decrypt_rlwe(
1977 &rlwe_ct,
1978 ideal_client_key.sk_rlwe().values(),
1979 &mut m_plus_e_times_m1,
1980 rlwe_nttop,
1981 rlwe_modop,
1982 );
1983 rlwe_nttop.forward(m_plus_e_times_m1.as_mut_slice());
1984 rlwe_nttop.forward(m1.as_mut_slice());
1985
1986 rlwe_modop.elwise_mul_mut(m_plus_e_times_m1.as_mut_slice(), m1.as_slice());
1987 rlwe_nttop.backward(m_plus_e_times_m1.as_mut_slice());
1988
1989 // Resulting RLWE ciphertext will equal: (m0m1 + em1) + e_{rlsw x rgsw}.
1990 // Hence, resulting rlwe ciphertext will have error em1 + e_{rlwe x rgsw}.
1991 // Here we're only concerned with e_{rlwe x rgsw}, that is noise added by
1992 // RLWExRGSW. Also note in practice m1 is a monomial, for ex, X^{s_{i}}, for
1993 // some i and var(em1) = var(e).
1994 let mut m_plus_e_times_m1_more_e = vec![0u64; rlwe_n];
1995 decrypt_rlwe(
1996 &rlwe_after,
1997 ideal_client_key.sk_rlwe().values(),
1998 &mut m_plus_e_times_m1_more_e,
1999 rlwe_nttop,
2000 rlwe_modop,
2001 );
2002
2003 // diff
2004 rlwe_modop.elwise_sub_mut(
2005 m_plus_e_times_m1_more_e.as_mut_slice(),
2006 m_plus_e_times_m1.as_slice(),
2007 );
2008
2009 // let noise = measure_noise(
2010 // &rlwe_after,
2011 // &m_plus_e_times_m1,
2012 // rlwe_nttop,
2013 // rlwe_modop,
2014 // ideal_client_key.sk_rlwe.values(),
2015 // );
2016 // print!("NOISE: {}", noise);
2017
2018 check.add_more(&Vec::<i64>::try_convert_from(
2019 &m_plus_e_times_m1_more_e,
2020 rlwe_q,
2021 ));
2022 });
2023 println!(
2024 "RLWE x RGSW, where RGSW has noise var_brk, std: {} {}",
2025 check.std_dev(),
2026 check.std_dev().abs().log2()
2027 )
2028 }
2029
2030 // check noise in Auto key
2031 if false {
2032 let mut check = Stats { samples: vec![] };
2033
2034 let mut neg_s_poly =
2035 Vec::<u64>::try_convert_from(ideal_client_key.sk_rlwe().values(), rlwe_q);
2036 rlwe_modop.elwise_neg_mut(neg_s_poly.as_mut_slice());
2037
2038 let g = bool_evaluator.pbs_info.g();
2039 let br_q = bool_evaluator.pbs_info.br_q();
2040 let auto_element_dlogs = bool_evaluator.pbs_info.parameters.auto_element_dlogs();
2041 for i in auto_element_dlogs.into_iter() {
2042 let g_pow = if i == 0 {
2043 -g
2044 } else {
2045 (((g as usize).pow(i as u32)) % br_q) as isize
2046 };
2047
2048 // -s[X^k]
2049 let (auto_indices, auto_sign) = generate_auto_map(rlwe_n, g_pow);
2050 let mut neg_s_poly_auto_i = vec![0u64; rlwe_n];
2051 izip!(neg_s_poly.iter(), auto_indices.iter(), auto_sign.iter()).for_each(
2052 |(v, to_i, to_sign)| {
2053 if !to_sign {
2054 neg_s_poly_auto_i[*to_i] = rlwe_modop.neg(v);
2055 } else {
2056 neg_s_poly_auto_i[*to_i] = *v;
2057 }
2058 },
2059 );
2060
2061 let mut auto_key_i = runtime_server_key.galois_key_for_auto(i).as_ref().clone(); //send i^th auto key to coefficient domain
2062 auto_key_i
2063 .iter_mut()
2064 .for_each(|r| rlwe_nttop.backward(r.as_mut_slice()));
2065 auto_gadget.iter().enumerate().for_each(|(i, b_i)| {
2066 // B^i * -s[X^k]
2067 let mut m_ideal = neg_s_poly_auto_i.clone();
2068
2069 rlwe_modop.elwise_scalar_mul_mut(m_ideal.as_mut_slice(), b_i);
2070
2071 let mut m_out = vec![0u64; rlwe_n];
2072 let mut rlwe_ct = vec![vec![0u64; rlwe_n]; 2];
2073 rlwe_ct[0].copy_from_slice(&auto_key_i[i]);
2074 rlwe_ct[1].copy_from_slice(
2075 &auto_key_i[auto_decomposer.decomposition_count() + i],
2076 );
2077 decrypt_rlwe(
2078 &rlwe_ct,
2079 ideal_client_key.sk_rlwe().values(),
2080 &mut m_out,
2081 rlwe_nttop,
2082 rlwe_modop,
2083 );
2084
2085 // diff
2086 rlwe_modop.elwise_sub_mut(m_out.as_mut_slice(), m_ideal.as_slice());
2087
2088 check.add_more(&Vec::<i64>::try_convert_from(&m_out, rlwe_q));
2089 });
2090 }
2091
2092 println!("Auto key noise std dev: {}", check.std_dev().abs().log2());
2093 }
2094
2095 // check noise in RLWE(X^k) after sending RLWE(X) -> RLWE(X^k)using collective
2096 // auto key
2097 if true {
2098 let mut check = Stats { samples: vec![] };
2099 let br_q = bool_evaluator.pbs_info.br_q();
2100 let g = bool_evaluator.pbs_info.g();
2101 let auto_element_dlogs = bool_evaluator.pbs_info.parameters.auto_element_dlogs();
2102 for i in auto_element_dlogs.into_iter() {
2103 for _ in 0..10 {
2104 let mut m = vec![0u64; rlwe_n];
2105 RandomFillUniformInModulus::random_fill(&mut rng, rlwe_q, m.as_mut_slice());
2106 let mut rlwe_ct = RlweCiphertext::<_, DefaultSecureRng> {
2107 data: vec![vec![0u64; rlwe_n]; 2],
2108 is_trivial: false,
2109 _phatom: PhantomData,
2110 };
2111 public_key_encrypt_rlwe::<_, _, _, _, i32, _>(
2112 &mut rlwe_ct,
2113 collective_pk.key(),
2114 &m,
2115 rlwe_modop,
2116 rlwe_nttop,
2117 &mut rng,
2118 );
2119
2120 // We're only interested in noise increased as a result of automorphism.
2121 // Hence, we take m+e as the bench.
2122 let mut m_plus_e = vec![0u64; rlwe_n];
2123 decrypt_rlwe(
2124 &rlwe_ct,
2125 ideal_client_key.sk_rlwe().values(),
2126 &mut m_plus_e,
2127 rlwe_nttop,
2128 rlwe_modop,
2129 );
2130
2131 let auto_key = runtime_server_key.galois_key_for_auto(i).as_ref();
2132 let (auto_map_index, auto_map_sign) =
2133 bool_evaluator.pbs_info.rlwe_auto_map(i);
2134 let mut scratch =
2135 vec![vec![0u64; rlwe_n]; auto_decomposer.decomposition_count() + 2];
2136 galois_auto(
2137 &mut rlwe_ct,
2138 auto_key,
2139 &mut scratch,
2140 &auto_map_index,
2141 &auto_map_sign,
2142 rlwe_modop,
2143 rlwe_nttop,
2144 auto_decomposer,
2145 );
2146
2147 // send m+e from X to X^k
2148 let mut m_plus_e_auto = vec![0u64; rlwe_n];
2149 izip!(m_plus_e.iter(), auto_map_index.iter(), auto_map_sign.iter())
2150 .for_each(|(v, to_index, to_sign)| {
2151 if !to_sign {
2152 m_plus_e_auto[*to_index] = rlwe_modop.neg(v);
2153 } else {
2154 m_plus_e_auto[*to_index] = *v
2155 }
2156 });
2157
2158 let mut m_out = vec![0u64; rlwe_n];
2159 decrypt_rlwe(
2160 &rlwe_ct,
2161 ideal_client_key.sk_rlwe().values(),
2162 &mut m_out,
2163 rlwe_nttop,
2164 rlwe_modop,
2165 );
2166
2167 // diff
2168 rlwe_modop.elwise_sub_mut(m_out.as_mut_slice(), m_plus_e_auto.as_slice());
2169
2170 check.add_more(&Vec::<i64>::try_convert_from(m_out.as_slice(), rlwe_q));
2171 }
2172 }
2173
2174 println!("Rlwe Auto Noise Std: {}", check.std_dev().abs().log2());
2175 }
2176
2177 // Check noise growth in ksk
2178 // TODO check in LWE key switching keys
2179 if true {
2180 // 1. encrypt LWE ciphertext
2181 // 2. Key switching
2182 // 3.
2183 let mut check = Stats { samples: vec![] };
2184
2185 for _ in 0..1024 {
2186 // Encrypt m \in Q_{ks} using RLWE sk
2187 let mut lwe_in_ct = vec![0u64; rlwe_n + 1];
2188 let m = RandomElementInModulus::random(&mut rng, &lwe_q.q().unwrap());
2189 encrypt_lwe(
2190 &mut lwe_in_ct,
2191 &m,
2192 ideal_client_key.sk_rlwe().values(),
2193 lwe_modop,
2194 &mut rng,
2195 );
2196
2197 // Key switch
2198 let mut lwe_out = vec![0u64; lwe_n + 1];
2199 lwe_key_switch(
2200 &mut lwe_out,
2201 &lwe_in_ct,
2202 runtime_server_key.lwe_ksk(),
2203 lwe_modop,
2204 bool_evaluator.pbs_info.lwe_decomposer(),
2205 );
2206
2207 // We only care about noise added by LWE key switch
2208 // m+e
2209 let m_plus_e =
2210 decrypt_lwe(&lwe_in_ct, ideal_client_key.sk_rlwe().values(), lwe_modop);
2211
2212 let m_plus_e_plus_lwe_ksk_noise =
2213 decrypt_lwe(&lwe_out, ideal_client_key.sk_lwe().values(), lwe_modop);
2214
2215 let diff = lwe_modop.sub(&m_plus_e_plus_lwe_ksk_noise, &m_plus_e);
2216
2217 check.add_more(&vec![lwe_q.map_element_to_i64(&diff)]);
2218 }
2219
2220 println!("Lwe ksk std dev: {}", check.std_dev().abs().log2());
2221 }
2222 }
2223
2224 // Check noise in fresh RGSW ciphertexts, ie X^{s_j[i]}, must equalnoise in
2225 // // fresh RLWE ciphertext
2226 if true {}
2227 // test LWE ksk from RLWE -> LWE
2228 // if false {
2229 // let logp = 2;
2230 // let mut rng = DefaultSecureRng::new();
2231
2232 // let m = 1;
2233 // let encoded_m = m << (lwe_logq - logp);
2234
2235 // // Encrypt
2236 // let mut lwe_ct = vec![0u64; rlwe_n + 1];
2237 // encrypt_lwe(
2238 // &mut lwe_ct,
2239 // &encoded_m,
2240 // ideal_client_key.sk_rlwe.values(),
2241 // lwe_modop,
2242 // &mut rng,
2243 // );
2244
2245 // // key switch
2246 // let lwe_decomposer = &bool_evaluator.decomposer_lwe;
2247 // let mut lwe_out = vec![0u64; lwe_n + 1];
2248 // lwe_key_switch(
2249 // &mut lwe_out,
2250 // &lwe_ct,
2251 // &server_key_eval.lwe_ksk,
2252 // lwe_modop,
2253 // lwe_decomposer,
2254 // );
2255
2256 // let encoded_m_back = decrypt_lwe(&lwe_out,
2257 // ideal_client_key.sk_lwe.values(), lwe_modop); let m_back
2258 // = ((encoded_m_back as f64 * (1 << logp) as f64) /
2259 // (lwe_q as f64)).round() as u64; dbg!(m_back, m);
2260
2261 // let noise = measure_noise_lwe(
2262 // &lwe_out,
2263 // ideal_client_key.sk_lwe.values(),
2264 // lwe_modop,
2265 // &encoded_m,
2266 // );
2267
2268 // println!("Noise: {noise}");
2269 // }
2270
2271 // Measure noise in RGSW ciphertexts of ideal LWE secrets
2272 // if true {
2273 // let gadget_vec = gadget_vector(
2274 // bool_evaluator.parameters.rlwe_logq,
2275 // bool_evaluator.parameters.logb_rgsw,
2276 // bool_evaluator.parameters.d_rgsw,
2277 // );
2278
2279 // for i in 0..20 {
2280 // // measure noise in RGSW(s[i])
2281 // let si =
2282 // ideal_client_key.sk_lwe.values[i] *
2283 // (bool_evaluator.embedding_factor as i32); let mut
2284 // si_poly = vec![0u64; rlwe_n]; if si < 0 {
2285 // si_poly[rlwe_n - (si.abs() as usize)] = rlwe_q - 1;
2286 // } else {
2287 // si_poly[(si.abs() as usize)] = 1;
2288 // }
2289
2290 // let mut rgsw_si = server_key_eval.rgsw_cts[i].clone();
2291 // rgsw_si
2292 // .iter_mut()
2293 // .for_each(|ri| rlwe_nttop.backward(ri.as_mut()));
2294
2295 // println!("####### Noise in RGSW(X^s_{i}) #######");
2296 // _measure_noise_rgsw(
2297 // &rgsw_si,
2298 // &si_poly,
2299 // ideal_client_key.sk_rlwe.values(),
2300 // &gadget_vec,
2301 // rlwe_q,
2302 // );
2303 // println!("####### ##################### #######");
2304 // }
2305 // }
2306
2307 // // measure noise grwoth in RLWExRGSW
2308 // if true {
2309 // let mut rng = DefaultSecureRng::new();
2310 // let mut carry_m = vec![0u64; rlwe_n];
2311 // RandomUniformDist1::random_fill(&mut rng, &rlwe_q,
2312 // carry_m.as_mut_slice());
2313
2314 // // RGSW(carrym)
2315 // let trivial_rlwect = vec![vec![0u64; rlwe_n],carry_m.clone()];
2316 // let mut rlwe_ct = RlweCiphertext::<_,
2317 // DefaultSecureRng>::from_raw(trivial_rlwect, true);
2318
2319 // let mut scratch_matrix_dplus2_ring = vec![vec![0u64; rlwe_n];
2320 // d_rgsw + 2]; let mul_mod =
2321 // |v0: &u64, v1: &u64| (((*v0 as u128 * *v1 as u128) % (rlwe_q as u128)) as u64);
2322
2323 // for i in 0..bool_evaluator.parameters.lwe_n {
2324 // rlwe_by_rgsw(
2325 // &mut rlwe_ct,
2326 // server_key_eval.rgsw_ct_lwe_si(i),
2327 // &mut scratch_matrix_dplus2_ring,
2328 // rlwe_decomposer,
2329 // rlwe_nttop,
2330 // rlwe_modop,
2331 // );
2332
2333 // // carry_m[X] * s_i[X]
2334 // let si =
2335 // ideal_client_key.sk_lwe.values[i] *
2336 // (bool_evaluator.embedding_factor as i32); let mut
2337 // si_poly = vec![0u64; rlwe_n]; if si < 0 {
2338 // si_poly[rlwe_n - (si.abs() as usize)] = rlwe_q - 1;
2339 // } else {
2340 // si_poly[(si.abs() as usize)] = 1;
2341 // }
2342 // carry_m = negacyclic_mul(&carry_m, &si_poly, mul_mod,
2343 // rlwe_q);
2344
2345 // let noise = measure_noise(
2346 // &rlwe_ct,
2347 // &carry_m,
2348 // rlwe_nttop,
2349 // rlwe_modop,
2350 // ideal_client_key.sk_rlwe.values(),
2351 // );
2352 // println!("Noise RLWE(carry_m) accumulating {i}^th secret
2353 // monomial: {noise}"); }
2354 // }
2355
2356 // // Check galois keys
2357 // if false {
2358 // let g = bool_evaluator.g() as isize;
2359 // let mut rng = DefaultSecureRng::new();
2360 // let mut scratch_matrix_dplus2_ring = vec![vec![0u64; rlwe_n];
2361 // d_rgsw + 2]; for i in [g, -g] {
2362 // let mut m = vec![0u64; rlwe_n];
2363 // RandomUniformDist1::random_fill(&mut rng, &rlwe_q,
2364 // m.as_mut_slice()); let mut rlwe_ct = {
2365 // let mut data = vec![vec![0u64; rlwe_n]; 2];
2366 // public_key_encrypt_rlwe(
2367 // &mut data,
2368 // &collective_pk.key,
2369 // &m,
2370 // rlwe_modop,
2371 // rlwe_nttop,
2372 // &mut rng,
2373 // );
2374 // RlweCiphertext::<_, DefaultSecureRng>::from_raw(data,
2375 // false) };
2376
2377 // let auto_key = server_key_eval.galois_key_for_auto(i);
2378 // let (auto_map_index, auto_map_sign) =
2379 // generate_auto_map(rlwe_n, i); galois_auto(
2380 // &mut rlwe_ct,
2381 // auto_key,
2382 // &mut scratch_matrix_dplus2_ring,
2383 // &auto_map_index,
2384 // &auto_map_sign,
2385 // rlwe_modop,
2386 // rlwe_nttop,
2387 // rlwe_decomposer,
2388 // );
2389
2390 // // send m(X) -> m(X^i)
2391 // let mut m_k = vec![0u64; rlwe_n];
2392 // izip!(m.iter(), auto_map_index.iter(),
2393 // auto_map_sign.iter()).for_each( |(mi, to_index,to_sign)|
2394 // // { if !to_sign {
2395 // m_k[*to_index] = rlwe_q - *mi; } else {
2396 // m_k[*to_index] = *mi;
2397 // }
2398 // },
2399 // );
2400
2401 // // measure noise
2402 // let noise = measure_noise(
2403 // &rlwe_ct,
2404 // &m_k,
2405 // rlwe_nttop,
2406 // rlwe_modop,
2407 // ideal_client_key.sk_rlwe.values(),
2408 // );
2409
2410 // println!("Noise after auto k={i}: {noise}");
2411 // }
2412 // }
2413 }
2414}