use std::collections::HashMap; use poulpy_hal::{ api::{ ScratchAvailable, TakeMatZnx, TakeVecZnx, TakeVecZnxBig, TakeVecZnxDft, TakeVecZnxDftSlice, TakeVecZnxSlice, VecZnxAddInplace, VecZnxAutomorphismInplace, VecZnxBigAddSmallInplace, VecZnxBigAllocBytes, VecZnxBigAutomorphismInplace, VecZnxBigNormalize, VecZnxBigNormalizeTmpBytes, VecZnxBigSubSmallNegateInplace, VecZnxCopy, VecZnxDftAddInplace, VecZnxDftAllocBytes, VecZnxDftApply, VecZnxDftCopy, VecZnxIdftApplyConsume, VecZnxIdftApplyTmpA, VecZnxNegateInplace, VecZnxNormalize, VecZnxNormalizeInplace, VecZnxNormalizeTmpBytes, VecZnxRotate, VecZnxRotateInplace, VecZnxRotateInplaceTmpBytes, VecZnxRshInplace, VecZnxSub, VecZnxSubInplace, VecZnxSwitchRing, VmpApplyDftToDft, VmpApplyDftToDftAdd, VmpApplyDftToDftTmpBytes, }, layouts::{Backend, DataMut, DataRef, Module, Scratch, ToOwnedDeep}, oep::{ScratchOwnedAllocImpl, ScratchOwnedBorrowImpl}, }; use poulpy_core::{ GLWEOperations, TakeGGLWE, TakeGLWECt, layouts::{Digits, GGLWECiphertextLayout, GGSWInfos, GLWEInfos, LWEInfos}, }; use poulpy_core::layouts::{GGSWCiphertext, GLWECiphertext, LWECiphertext, prepared::GGLWEAutomorphismKeyPrepared}; use crate::tfhe::{ blind_rotation::{ BlincRotationExecute, BlindRotationAlgo, BlindRotationKeyPrepared, LookUpTable, LookUpTableRotationDirection, }, circuit_bootstrapping::{CircuitBootstrappingKeyPrepared, CirtuitBootstrappingExecute}, }; impl CirtuitBootstrappingExecute for CircuitBootstrappingKeyPrepared where Module: VecZnxRotateInplace + VecZnxNormalizeInplace + VecZnxNormalizeTmpBytes + VecZnxSwitchRing + VecZnxBigAutomorphismInplace + VecZnxRshInplace + VecZnxDftCopy + VecZnxIdftApplyTmpA + VecZnxSub + VecZnxAddInplace + VecZnxNegateInplace + VecZnxCopy + VecZnxSubInplace + VecZnxDftAllocBytes + VmpApplyDftToDftTmpBytes + VecZnxBigNormalizeTmpBytes + VmpApplyDftToDft + VmpApplyDftToDftAdd + VecZnxDftApply + VecZnxIdftApplyConsume + VecZnxBigAddSmallInplace + VecZnxBigNormalize + VecZnxAutomorphismInplace + VecZnxBigSubSmallNegateInplace + VecZnxRotateInplaceTmpBytes + VecZnxBigAllocBytes + VecZnxDftAddInplace + VecZnxRotate + VecZnxNormalize, B: Backend + ScratchOwnedAllocImpl + ScratchOwnedBorrowImpl, Scratch: TakeVecZnx + TakeVecZnxDftSlice + TakeVecZnxBig + TakeVecZnxDft + TakeMatZnx + ScratchAvailable + TakeVecZnxSlice, BlindRotationKeyPrepared: BlincRotationExecute, { fn execute_to_constant( &self, module: &Module, res: &mut GGSWCiphertext, lwe: &LWECiphertext, log_domain: usize, extension_factor: usize, scratch: &mut Scratch, ) { circuit_bootstrap_core( false, module, 0, res, lwe, log_domain, extension_factor, self, scratch, ); } fn execute_to_exponent( &self, module: &Module, log_gap_out: usize, res: &mut GGSWCiphertext, lwe: &LWECiphertext, log_domain: usize, extension_factor: usize, scratch: &mut Scratch, ) { circuit_bootstrap_core( true, module, log_gap_out, res, lwe, log_domain, extension_factor, self, scratch, ); } } #[allow(clippy::too_many_arguments)] pub fn circuit_bootstrap_core( to_exponent: bool, module: &Module, log_gap_out: usize, res: &mut GGSWCiphertext, lwe: &LWECiphertext, log_domain: usize, extension_factor: usize, key: &CircuitBootstrappingKeyPrepared, scratch: &mut Scratch, ) where DRes: DataMut, DLwe: DataRef, DBrk: DataRef, Module: VecZnxRotateInplace + VecZnxNormalizeInplace + VecZnxNormalizeTmpBytes + VecZnxSwitchRing + VecZnxBigAutomorphismInplace + VecZnxRshInplace + VecZnxDftCopy + VecZnxIdftApplyTmpA + VecZnxSub + VecZnxAddInplace + VecZnxNegateInplace + VecZnxCopy + VecZnxSubInplace + VecZnxDftAllocBytes + VmpApplyDftToDftTmpBytes + VecZnxBigNormalizeTmpBytes + VmpApplyDftToDft + VmpApplyDftToDftAdd + VecZnxDftApply + VecZnxIdftApplyConsume + VecZnxBigAddSmallInplace + VecZnxBigNormalize + VecZnxAutomorphismInplace + VecZnxBigSubSmallNegateInplace + VecZnxBigAllocBytes + VecZnxDftAddInplace + VecZnxRotateInplaceTmpBytes + VecZnxRotate + VecZnxNormalize, B: Backend + ScratchOwnedAllocImpl + ScratchOwnedBorrowImpl, Scratch: TakeVecZnxDftSlice + TakeVecZnxBig + TakeVecZnxDft + TakeVecZnx + ScratchAvailable + TakeVecZnxSlice + TakeMatZnx, BlindRotationKeyPrepared: BlincRotationExecute, { #[cfg(debug_assertions)] { use poulpy_core::layouts::LWEInfos; assert_eq!(res.n(), key.brk.n()); assert_eq!(lwe.base2k(), key.brk.base2k()); assert_eq!(res.base2k(), key.brk.base2k()); } let n: usize = res.n().into(); let base2k: usize = res.base2k().into(); let rows: usize = res.rows().into(); let rank: usize = res.rank().into(); let k: usize = res.k().into(); let alpha: usize = rows.next_power_of_two(); let mut f: Vec = vec![0i64; (1 << log_domain) * alpha]; if to_exponent { (0..rows).for_each(|i| { f[i] = 1 << (base2k * (rows - 1 - i)); }); } else { (0..1 << log_domain).for_each(|j| { (0..rows).for_each(|i| { f[j * alpha + i] = j as i64 * (1 << (base2k * (rows - 1 - i))); }); }); } // Lut precision, basically must be able to hold the decomposition power basis of the GGSW let mut lut: LookUpTable = LookUpTable::alloc(module, base2k, base2k * rows, extension_factor); lut.set(module, &f, base2k * rows); if to_exponent { lut.set_rotation_direction(LookUpTableRotationDirection::Right); } // TODO: separate GGSW k from output of blind rotation k let (mut res_glwe, scratch_1) = scratch.take_glwe_ct(res); let gglwe_infos: GGLWECiphertextLayout = GGLWECiphertextLayout { n: n.into(), base2k: base2k.into(), k: k.into(), rows: rows.into(), digits: Digits(1), rank_in: rank.max(1).into(), rank_out: rank.into(), }; let (mut tmp_gglwe, scratch_2) = scratch_1.take_gglwe(&gglwe_infos); key.brk.execute(module, &mut res_glwe, lwe, &lut, scratch_2); let gap: usize = 2 * lut.drift / lut.extension_factor(); let log_gap_in: usize = (usize::BITS - (gap * alpha - 1).leading_zeros()) as _; (0..rows).for_each(|i| { let mut tmp_glwe: GLWECiphertext<&mut [u8]> = tmp_gglwe.at_mut(i, 0); if to_exponent { // Isolates i-th LUT and moves coefficients according to requested gap. post_process( module, &mut tmp_glwe, &res_glwe, log_gap_in, log_gap_out, log_domain, &key.atk, scratch_2, ); } else { tmp_glwe.trace(module, 0, module.log_n(), &res_glwe, &key.atk, scratch_2); } if i < rows { res_glwe.rotate_inplace(module, -(gap as i64), scratch_2); } }); // Expands GGLWE to GGSW using GGLWE(s^2) res.from_gglwe(module, &tmp_gglwe, &key.tsk, scratch_2); } #[allow(clippy::too_many_arguments)] fn post_process( module: &Module, res: &mut GLWECiphertext, a: &GLWECiphertext, log_gap_in: usize, log_gap_out: usize, log_domain: usize, auto_keys: &HashMap, B>>, scratch: &mut Scratch, ) where DataRes: DataMut, DataA: DataRef, Module: VecZnxRotateInplace + VecZnxNormalizeInplace + VecZnxNormalizeTmpBytes + VecZnxSwitchRing + VecZnxBigAutomorphismInplace + VecZnxRshInplace + VecZnxDftCopy + VecZnxIdftApplyTmpA + VecZnxSub + VecZnxAddInplace + VecZnxNegateInplace + VecZnxCopy + VecZnxSubInplace + VecZnxDftAllocBytes + VmpApplyDftToDftTmpBytes + VecZnxBigNormalizeTmpBytes + VmpApplyDftToDft + VmpApplyDftToDftAdd + VecZnxDftApply + VecZnxIdftApplyConsume + VecZnxBigAddSmallInplace + VecZnxBigNormalize + VecZnxAutomorphismInplace + VecZnxBigSubSmallNegateInplace + VecZnxRotate + VecZnxNormalize, Scratch: TakeVecZnxDft + ScratchAvailable + TakeVecZnx, { let log_n: usize = module.log_n(); let mut cts: HashMap>> = HashMap::new(); // First partial trace, vanishes all coefficients which are not multiples of gap_in // [1, 1, 1, 1, 0, 0, 0, ..., 0, 0, -1, -1, -1, -1] -> [1, 0, 0, 0, 0, 0, 0, ..., 0, 0, 0, 0, 0, 0] res.trace( module, module.log_n() - log_gap_in + 1, log_n, a, auto_keys, scratch, ); // TODO: optimize with packing and final partial trace // If gap_out < gap_in, then we need to repack, i.e. reduce the cap between coefficients. if log_gap_in != log_gap_out { let steps: i32 = 1 << log_domain; (0..steps).for_each(|i| { if i != 0 { res.rotate_inplace(module, -(1 << log_gap_in), scratch); } cts.insert(i as usize * (1 << log_gap_out), res.to_owned_deep()); }); pack(module, &mut cts, log_gap_out, auto_keys, scratch); let packed: GLWECiphertext> = cts.remove(&0).unwrap(); res.trace( module, log_n - log_gap_out, log_n, &packed, auto_keys, scratch, ); } } pub fn pack( module: &Module, cts: &mut HashMap>, log_gap_out: usize, auto_keys: &HashMap, B>>, scratch: &mut Scratch, ) where Module: VecZnxRotateInplace + VecZnxNormalizeInplace + VecZnxNormalizeTmpBytes + VecZnxSwitchRing + VecZnxBigAutomorphismInplace + VecZnxRshInplace + VecZnxDftCopy + VecZnxIdftApplyTmpA + VecZnxSub + VecZnxAddInplace + VecZnxNegateInplace + VecZnxCopy + VecZnxSubInplace + VecZnxDftAllocBytes + VmpApplyDftToDftTmpBytes + VecZnxBigNormalizeTmpBytes + VmpApplyDftToDft + VmpApplyDftToDftAdd + VecZnxDftApply + VecZnxIdftApplyConsume + VecZnxBigAddSmallInplace + VecZnxBigNormalize + VecZnxAutomorphismInplace + VecZnxBigSubSmallNegateInplace + VecZnxRotate + VecZnxNormalize, Scratch: TakeVecZnx + TakeVecZnxDft + ScratchAvailable, { let log_n: usize = module.log_n(); (0..log_n - log_gap_out).for_each(|i| { let t: usize = 16.min(1 << (log_n - 1 - i)); let auto_key: &GGLWEAutomorphismKeyPrepared, B> = if i == 0 { auto_keys.get(&-1).unwrap() } else { auto_keys.get(&module.galois_element(1 << (i - 1))).unwrap() }; (0..t).for_each(|j| { let mut a: Option> = cts.remove(&j); let mut b: Option> = cts.remove(&(j + t)); combine(module, a.as_mut(), b.as_mut(), i, auto_key, scratch); if let Some(a) = a { cts.insert(j, a); } else if let Some(b) = b { cts.insert(j, b); } }); }); } #[allow(clippy::too_many_arguments)] fn combine( module: &Module, a: Option<&mut GLWECiphertext>, b: Option<&mut GLWECiphertext>, i: usize, auto_key: &GGLWEAutomorphismKeyPrepared, scratch: &mut Scratch, ) where Module: VecZnxRotateInplace + VecZnxNormalizeInplace + VecZnxNormalizeTmpBytes + VecZnxSwitchRing + VecZnxBigAutomorphismInplace + VecZnxRshInplace + VecZnxDftCopy + VecZnxIdftApplyTmpA + VecZnxSub + VecZnxAddInplace + VecZnxNegateInplace + VecZnxCopy + VecZnxSubInplace + VecZnxDftAllocBytes + VmpApplyDftToDftTmpBytes + VecZnxBigNormalizeTmpBytes + VmpApplyDftToDft + VmpApplyDftToDftAdd + VecZnxDftApply + VecZnxIdftApplyConsume + VecZnxBigAddSmallInplace + VecZnxBigNormalize + VecZnxAutomorphismInplace + VecZnxBigSubSmallNegateInplace + VecZnxRotate + VecZnxNormalize, Scratch: TakeVecZnx + TakeVecZnxDft + ScratchAvailable, { // Goal is to evaluate: a = a + b*X^t + phi(a - b*X^t)) // We also use the identity: AUTO(a * X^t, g) = -X^t * AUTO(a, g) // where t = 2^(log_n - i - 1) and g = 5^{2^(i - 1)} // Different cases for wether a and/or b are zero. // // Implicite RSH without modulus switch, introduces extra I(X) * Q/2 on decryption. // Necessary so that the scaling of the plaintext remains constant. // It however is ok to do so here because coefficients are eventually // either mapped to garbage or twice their value which vanishes I(X) // since 2*(I(X) * Q/2) = I(X) * Q = 0 mod Q. if let Some(a) = a { let t: i64 = 1 << (a.n().log2() - i - 1); if let Some(b) = b { let (mut tmp_b, scratch_1) = scratch.take_glwe_ct(a); // a = a * X^-t a.rotate_inplace(module, -t, scratch_1); // tmp_b = a * X^-t - b tmp_b.sub(module, a, b); tmp_b.rsh(module, 1, scratch_1); // a = a * X^-t + b a.add_inplace(module, b); a.rsh(module, 1, scratch_1); tmp_b.normalize_inplace(module, scratch_1); // tmp_b = phi(a * X^-t - b) tmp_b.automorphism_inplace(module, auto_key, scratch_1); // a = a * X^-t + b - phi(a * X^-t - b) a.sub_inplace_ab(module, &tmp_b); a.normalize_inplace(module, scratch_1); // a = a + b * X^t - phi(a * X^-t - b) * X^t // = a + b * X^t - phi(a * X^-t - b) * - phi(X^t) // = a + b * X^t + phi(a - b * X^t) a.rotate_inplace(module, t, scratch_1); } else { a.rsh(module, 1, scratch); // a = a + phi(a) a.automorphism_add_inplace(module, auto_key, scratch); } } else if let Some(b) = b { let t: i64 = 1 << (b.n().log2() - i - 1); let (mut tmp_b, scratch_1) = scratch.take_glwe_ct(b); tmp_b.rotate(module, t, b); tmp_b.rsh(module, 1, scratch_1); // a = (b* X^t - phi(b* X^t)) b.automorphism_sub_negate(module, &tmp_b, auto_key, scratch_1); } }