poulpy/core/src/blind_rotation/cggi.rs
core/src/blind_rotation/cggi.rsRaw
1use backend::hal::{
2 api::{
3 ScratchAvailable, SvpApply, SvpPPolAllocBytes, TakeVecZnx, TakeVecZnxBig, TakeVecZnxDft, TakeVecZnxDftSlice,
4 TakeVecZnxSlice, VecZnxAddInplace, VecZnxBigAddSmallInplace, VecZnxBigAllocBytes, VecZnxBigNormalizeTmpBytes, VecZnxCopy,
5 VecZnxDftAdd, VecZnxDftAddInplace, VecZnxDftAllocBytes, VecZnxDftFromVecZnx, VecZnxDftSubABInplace, VecZnxDftToVecZnxBig,
6 VecZnxDftToVecZnxBigTmpBytes, VecZnxDftZero, VecZnxMulXpMinusOneInplace, VecZnxNormalize, VecZnxNormalizeInplace,
7 VecZnxRotate, VecZnxSubABInplace, VmpApplyTmpBytes, ZnxView, ZnxZero,
8 },
9 layouts::{Backend, DataMut, DataRef, Module, Scratch, SvpPPol, VecZnx},
10};
11use itertools::izip;
12
13use crate::{
14 GLWECiphertext, GLWECiphertextToMut, GLWEExternalProductFamily, GLWEOps, Infos, LWECiphertext, LWECiphertextToRef,
15 TakeGLWECt,
16 blind_rotation::{key::BlindRotationKeyCGGIExec, lut::LookUpTable},
17 dist::Distribution,
18};
19
20pub trait CCGIBlindRotationFamily<B: Backend> = VecZnxBigAllocBytes
21 + VecZnxDftAllocBytes
22 + SvpPPolAllocBytes
23 + VmpApplyTmpBytes
24 + VecZnxBigNormalizeTmpBytes
25 + VecZnxDftToVecZnxBigTmpBytes
26 + VecZnxDftToVecZnxBig<B>
27 + VecZnxDftAdd<B>
28 + VecZnxDftAddInplace<B>
29 + VecZnxDftFromVecZnx<B>
30 + VecZnxDftZero<B>
31 + SvpApply<B>
32 + VecZnxDftSubABInplace<B>
33 + VecZnxBigAddSmallInplace<B>
34 + GLWEExternalProductFamily<B>
35 + VecZnxRotate
36 + VecZnxAddInplace
37 + VecZnxSubABInplace
38 + VecZnxNormalize<B>
39 + VecZnxNormalizeInplace<B>
40 + VecZnxCopy
41 + VecZnxMulXpMinusOneInplace;
42
43pub fn cggi_blind_rotate_scratch_space<B: Backend>(
44 module: &Module<B>,
45 n: usize,
46 block_size: usize,
47 extension_factor: usize,
48 basek: usize,
49 k_res: usize,
50 k_brk: usize,
51 rows: usize,
52 rank: usize,
53) -> usize
54where
55 Module<B>: CCGIBlindRotationFamily<B>,
56{
57 let brk_size: usize = k_brk.div_ceil(basek);
58
59 if block_size > 1 {
60 let cols: usize = rank + 1;
61 let acc_dft: usize = module.vec_znx_dft_alloc_bytes(n, cols, rows) * extension_factor;
62 let acc_big: usize = module.vec_znx_big_alloc_bytes(n, 1, brk_size);
63 let vmp_res: usize = module.vec_znx_dft_alloc_bytes(n, cols, brk_size) * extension_factor;
64 let vmp_xai: usize = module.vec_znx_dft_alloc_bytes(n, 1, brk_size);
65 let acc_dft_add: usize = vmp_res;
66 let vmp: usize = module.vmp_apply_tmp_bytes(n, brk_size, rows, rows, 2, 2, brk_size); // GGSW product: (1 x 2) x (2 x 2)
67
68 let acc: usize;
69 if extension_factor > 1 {
70 acc = VecZnx::alloc_bytes(n, cols, k_res.div_ceil(basek)) * extension_factor;
71 } else {
72 acc = 0;
73 }
74
75 return acc
76 + acc_dft
77 + acc_dft_add
78 + vmp_res
79 + vmp_xai
80 + (vmp | (acc_big + (module.vec_znx_big_normalize_tmp_bytes(n) | module.vec_znx_dft_to_vec_znx_big_tmp_bytes(n))));
81 } else {
82 GLWECiphertext::bytes_of(n, basek, k_res, rank)
83 + GLWECiphertext::external_product_scratch_space(module, n, basek, k_res, k_res, k_brk, 1, rank)
84 }
85}
86
87pub fn cggi_blind_rotate<DataRes, DataIn, DataBrk, B: Backend>(
88 module: &Module<B>,
89 res: &mut GLWECiphertext<DataRes>,
90 lwe: &LWECiphertext<DataIn>,
91 lut: &LookUpTable,
92 brk: &BlindRotationKeyCGGIExec<DataBrk, B>,
93 scratch: &mut Scratch<B>,
94) where
95 DataRes: DataMut,
96 DataIn: DataRef,
97 DataBrk: DataRef,
98 Module<B>: CCGIBlindRotationFamily<B>,
99 Scratch<B>: TakeVecZnxDftSlice<B> + TakeVecZnxDft<B> + TakeVecZnxBig<B> + TakeVecZnx + ScratchAvailable + TakeVecZnxSlice,
100{
101 match brk.dist {
102 Distribution::BinaryBlock(_) | Distribution::BinaryFixed(_) | Distribution::BinaryProb(_) | Distribution::ZERO => {
103 if lut.extension_factor() > 1 {
104 cggi_blind_rotate_block_binary_extended(module, res, lwe, lut, brk, scratch);
105 } else if brk.block_size() > 1 {
106 cggi_blind_rotate_block_binary(module, res, lwe, lut, brk, scratch);
107 } else {
108 cggi_blind_rotate_binary_standard(module, res, lwe, lut, brk, scratch);
109 }
110 }
111 // TODO: ternary distribution ?
112 _ => panic!(
113 "invalid BlindRotationKeyCGGI distribution: must be BinaryBlock, BinaryFixed or BinaryProb (or ZERO for debugging)"
114 ),
115 }
116}
117
118pub(crate) fn cggi_blind_rotate_block_binary_extended<DataRes, DataIn, DataBrk, B: Backend>(
119 module: &Module<B>,
120 res: &mut GLWECiphertext<DataRes>,
121 lwe: &LWECiphertext<DataIn>,
122 lut: &LookUpTable,
123 brk: &BlindRotationKeyCGGIExec<DataBrk, B>,
124 scratch: &mut Scratch<B>,
125) where
126 DataRes: DataMut,
127 DataIn: DataRef,
128 DataBrk: DataRef,
129 Module<B>: CCGIBlindRotationFamily<B>,
130 Scratch<B>: TakeVecZnxDftSlice<B> + TakeVecZnxDft<B> + TakeVecZnxBig<B> + TakeVecZnxSlice,
131{
132 let n_glwe: usize = brk.n();
133 let extension_factor: usize = lut.extension_factor();
134 let basek: usize = res.basek();
135 let rows: usize = brk.rows();
136 let cols: usize = res.rank() + 1;
137
138 let (mut acc, scratch1) = scratch.take_vec_znx_slice(extension_factor, n_glwe, cols, res.size());
139 let (mut acc_dft, scratch2) = scratch1.take_vec_znx_dft_slice(extension_factor, n_glwe, cols, rows);
140 let (mut vmp_res, scratch3) = scratch2.take_vec_znx_dft_slice(extension_factor, n_glwe, cols, brk.size());
141 let (mut acc_add_dft, scratch4) = scratch3.take_vec_znx_dft_slice(extension_factor, n_glwe, cols, brk.size());
142 let (mut vmp_xai, scratch5) = scratch4.take_vec_znx_dft(n_glwe, 1, brk.size());
143
144 (0..extension_factor).for_each(|i| {
145 acc[i].zero();
146 });
147
148 let x_pow_a: &Vec<SvpPPol<Vec<u8>, B>>;
149 if let Some(b) = &brk.x_pow_a {
150 x_pow_a = b
151 } else {
152 panic!("invalid key: x_pow_a has not been initialized")
153 }
154
155 let mut lwe_2n: Vec<i64> = vec![0i64; lwe.n() + 1]; // TODO: from scratch space
156 let lwe_ref: LWECiphertext<&[u8]> = lwe.to_ref();
157
158 let two_n: usize = 2 * n_glwe;
159 let two_n_ext: usize = 2 * lut.domain_size();
160
161 negate_and_mod_switch_2n(two_n_ext, &mut lwe_2n, &lwe_ref);
162
163 let a: &[i64] = &lwe_2n[1..];
164 let b_pos: usize = ((lwe_2n[0] + two_n_ext as i64) & (two_n_ext - 1) as i64) as usize;
165
166 let b_hi: usize = b_pos / extension_factor;
167 let b_lo: usize = b_pos & (extension_factor - 1);
168
169 for (i, j) in (0..b_lo).zip(extension_factor - b_lo..extension_factor) {
170 module.vec_znx_rotate(b_hi as i64 + 1, &mut acc[i], 0, &lut.data[j], 0);
171 }
172 for (i, j) in (b_lo..extension_factor).zip(0..extension_factor - b_lo) {
173 module.vec_znx_rotate(b_hi as i64, &mut acc[i], 0, &lut.data[j], 0);
174 }
175
176 let block_size: usize = brk.block_size();
177
178 izip!(
179 a.chunks_exact(block_size),
180 brk.data.chunks_exact(block_size)
181 )
182 .for_each(|(ai, ski)| {
183 (0..extension_factor).for_each(|i| {
184 (0..cols).for_each(|j| {
185 module.vec_znx_dft_from_vec_znx(1, 0, &mut acc_dft[i], j, &acc[i], j);
186 });
187 module.vec_znx_dft_zero(&mut acc_add_dft[i])
188 });
189
190 // TODO: first & last iterations can be optimized
191 izip!(ai.iter(), ski.iter()).for_each(|(aii, skii)| {
192 let ai_pos: usize = ((aii + two_n_ext as i64) & (two_n_ext - 1) as i64) as usize;
193 let ai_hi: usize = ai_pos / extension_factor;
194 let ai_lo: usize = ai_pos & (extension_factor - 1);
195
196 // vmp_res = DFT(acc) * BRK[i]
197 (0..extension_factor).for_each(|i| {
198 module.vmp_apply(&mut vmp_res[i], &acc_dft[i], &skii.data, scratch5);
199 });
200
201 // Trivial case: no rotation between polynomials, we can directly multiply with (X^{-ai} - 1)
202 if ai_lo == 0 {
203 // Sets acc_add_dft[i] = (acc[i] * sk) * X^{-ai} - (acc[i] * sk)
204 if ai_hi != 0 {
205 // DFT X^{-ai}
206 (0..extension_factor).for_each(|j| {
207 (0..cols).for_each(|i| {
208 module.svp_apply(&mut vmp_xai, 0, &x_pow_a[ai_hi], 0, &vmp_res[j], i);
209 module.vec_znx_dft_add_inplace(&mut acc_add_dft[j], i, &vmp_xai, 0);
210 module.vec_znx_dft_sub_ab_inplace(&mut acc_add_dft[j], i, &vmp_res[j], i);
211 });
212 });
213 }
214
215 // Non trivial case: rotation between polynomials
216 // In this case we can't directly multiply with (X^{-ai} - 1) because of the
217 // ring homomorphism R^{N} -> prod R^{N/extension_factor}, so we split the
218 // computation in two steps: acc_add_dft = (acc * sk) * (-1) + (acc * sk) * X^{-ai}
219 } else {
220 // Sets acc_add_dft[0..ai_lo] += (acc[extension_factor - ai_lo..extension_factor] * sk) * X^{-ai+1}
221 if (ai_hi + 1) & (two_n - 1) != 0 {
222 for (i, j) in (0..ai_lo).zip(extension_factor - ai_lo..extension_factor) {
223 (0..cols).for_each(|k| {
224 module.svp_apply(&mut vmp_xai, 0, &x_pow_a[ai_hi + 1], 0, &vmp_res[j], k);
225 module.vec_znx_dft_add_inplace(&mut acc_add_dft[i], k, &vmp_xai, 0);
226 module.vec_znx_dft_sub_ab_inplace(&mut acc_add_dft[i], k, &vmp_res[i], k);
227 });
228 }
229 }
230
231 // Sets acc_add_dft[ai_lo..extension_factor] += (acc[0..extension_factor - ai_lo] * sk) * X^{-ai}
232 if ai_hi != 0 {
233 // Sets acc_add_dft[ai_lo..extension_factor] += (acc[0..extension_factor - ai_lo] * sk) * X^{-ai}
234 for (i, j) in (ai_lo..extension_factor).zip(0..extension_factor - ai_lo) {
235 (0..cols).for_each(|k| {
236 module.svp_apply(&mut vmp_xai, 0, &x_pow_a[ai_hi], 0, &vmp_res[j], k);
237 module.vec_znx_dft_add_inplace(&mut acc_add_dft[i], k, &vmp_xai, 0);
238 module.vec_znx_dft_sub_ab_inplace(&mut acc_add_dft[i], k, &vmp_res[i], k);
239 });
240 }
241 }
242 }
243 });
244
245 {
246 let (mut acc_add_big, scratch7) = scratch5.take_vec_znx_big(n_glwe, 1, brk.size());
247
248 (0..extension_factor).for_each(|j| {
249 (0..cols).for_each(|i| {
250 module.vec_znx_dft_to_vec_znx_big(&mut acc_add_big, 0, &acc_add_dft[j], i, scratch7);
251 module.vec_znx_big_add_small_inplace(&mut acc_add_big, 0, &acc[j], i);
252 module.vec_znx_big_normalize(basek, &mut acc[j], i, &acc_add_big, 0, scratch7);
253 });
254 });
255 }
256 });
257
258 (0..cols).for_each(|i| {
259 module.vec_znx_copy(&mut res.data, i, &acc[0], i);
260 });
261}
262
263pub(crate) fn cggi_blind_rotate_block_binary<DataRes, DataIn, DataBrk, B: Backend>(
264 module: &Module<B>,
265 res: &mut GLWECiphertext<DataRes>,
266 lwe: &LWECiphertext<DataIn>,
267 lut: &LookUpTable,
268 brk: &BlindRotationKeyCGGIExec<DataBrk, B>,
269 scratch: &mut Scratch<B>,
270) where
271 DataRes: DataMut,
272 DataIn: DataRef,
273 DataBrk: DataRef,
274 Module<B>: CCGIBlindRotationFamily<B>,
275 Scratch<B>: TakeVecZnxDft<B> + TakeVecZnxBig<B>,
276{
277 let n_glwe: usize = brk.n();
278 let mut lwe_2n: Vec<i64> = vec![0i64; lwe.n() + 1]; // TODO: from scratch space
279 let mut out_mut: GLWECiphertext<&mut [u8]> = res.to_mut();
280 let lwe_ref: LWECiphertext<&[u8]> = lwe.to_ref();
281 let two_n: usize = n_glwe << 1;
282 let basek: usize = brk.basek();
283 let rows: usize = brk.rows();
284
285 let cols: usize = out_mut.rank() + 1;
286
287 negate_and_mod_switch_2n(2 * lut.domain_size(), &mut lwe_2n, &lwe_ref);
288
289 let a: &[i64] = &lwe_2n[1..];
290 let b: i64 = lwe_2n[0];
291
292 out_mut.data.zero();
293
294 // Initialize out to X^{b} * LUT(X)
295 module.vec_znx_rotate(b, &mut out_mut.data, 0, &lut.data[0], 0);
296
297 let block_size: usize = brk.block_size();
298
299 // ACC + [sum DFT(X^ai -1) * (DFT(ACC) x BRKi)]
300
301 let (mut acc_dft, scratch1) = scratch.take_vec_znx_dft(n_glwe, cols, rows);
302 let (mut vmp_res, scratch2) = scratch1.take_vec_znx_dft(n_glwe, cols, brk.size());
303 let (mut acc_add_dft, scratch3) = scratch2.take_vec_znx_dft(n_glwe, cols, brk.size());
304 let (mut vmp_xai, scratch4) = scratch3.take_vec_znx_dft(n_glwe, 1, brk.size());
305
306 let x_pow_a: &Vec<SvpPPol<Vec<u8>, B>>;
307 if let Some(b) = &brk.x_pow_a {
308 x_pow_a = b
309 } else {
310 panic!("invalid key: x_pow_a has not been initialized")
311 }
312
313 izip!(
314 a.chunks_exact(block_size),
315 brk.data.chunks_exact(block_size)
316 )
317 .for_each(|(ai, ski)| {
318 (0..cols).for_each(|j| {
319 module.vec_znx_dft_from_vec_znx(1, 0, &mut acc_dft, j, &out_mut.data, j);
320 });
321
322 module.vec_znx_dft_zero(&mut acc_add_dft);
323
324 izip!(ai.iter(), ski.iter()).for_each(|(aii, skii)| {
325 let ai_pos: usize = ((aii + two_n as i64) & (two_n - 1) as i64) as usize;
326
327 // vmp_res = DFT(acc) * BRK[i]
328 module.vmp_apply(&mut vmp_res, &acc_dft, &skii.data, scratch4);
329
330 // DFT(X^ai -1) * (DFT(acc) * BRK[i])
331 (0..cols).for_each(|i| {
332 module.svp_apply(&mut vmp_xai, 0, &x_pow_a[ai_pos], 0, &vmp_res, i);
333 module.vec_znx_dft_add_inplace(&mut acc_add_dft, i, &vmp_xai, 0);
334 module.vec_znx_dft_sub_ab_inplace(&mut acc_add_dft, i, &vmp_res, i);
335 });
336 });
337
338 {
339 let (mut acc_add_big, scratch5) = scratch4.take_vec_znx_big(n_glwe, 1, brk.size());
340
341 (0..cols).for_each(|i| {
342 module.vec_znx_dft_to_vec_znx_big(&mut acc_add_big, 0, &acc_add_dft, i, scratch5);
343 module.vec_znx_big_add_small_inplace(&mut acc_add_big, 0, &out_mut.data, i);
344 module.vec_znx_big_normalize(basek, &mut out_mut.data, i, &acc_add_big, 0, scratch5);
345 });
346 }
347 });
348}
349
350pub(crate) fn cggi_blind_rotate_binary_standard<DataRes, DataIn, DataBrk, B: Backend>(
351 module: &Module<B>,
352 res: &mut GLWECiphertext<DataRes>,
353 lwe: &LWECiphertext<DataIn>,
354 lut: &LookUpTable,
355 brk: &BlindRotationKeyCGGIExec<DataBrk, B>,
356 scratch: &mut Scratch<B>,
357) where
358 DataRes: DataMut,
359 DataIn: DataRef,
360 DataBrk: DataRef,
361 Module<B>: CCGIBlindRotationFamily<B>,
362 Scratch<B>: TakeVecZnxDft<B> + TakeVecZnxBig<B> + TakeVecZnx + ScratchAvailable,
363{
364 #[cfg(debug_assertions)]
365 {
366 assert_eq!(
367 res.n(),
368 brk.n(),
369 "res.n(): {} != brk.n(): {}",
370 res.n(),
371 brk.n()
372 );
373 assert_eq!(
374 lut.domain_size(),
375 brk.n(),
376 "lut.n(): {} != brk.n(): {}",
377 lut.domain_size(),
378 brk.n()
379 );
380 assert_eq!(
381 res.rank(),
382 brk.rank(),
383 "res.rank(): {} != brk.rank(): {}",
384 res.rank(),
385 brk.rank()
386 );
387 assert_eq!(
388 lwe.n(),
389 brk.data.len(),
390 "lwe.n(): {} != brk.data.len(): {}",
391 lwe.n(),
392 brk.data.len()
393 );
394 }
395
396 let mut lwe_2n: Vec<i64> = vec![0i64; lwe.n() + 1]; // TODO: from scratch space
397 let mut out_mut: GLWECiphertext<&mut [u8]> = res.to_mut();
398 let lwe_ref: LWECiphertext<&[u8]> = lwe.to_ref();
399 let basek: usize = brk.basek();
400
401 negate_and_mod_switch_2n(2 * lut.domain_size(), &mut lwe_2n, &lwe_ref);
402
403 let a: &[i64] = &lwe_2n[1..];
404 let b: i64 = lwe_2n[0];
405
406 out_mut.data.zero();
407
408 // Initialize out to X^{b} * LUT(X)
409 module.vec_znx_rotate(b, &mut out_mut.data, 0, &lut.data[0], 0);
410
411 // ACC + [sum DFT(X^ai -1) * (DFT(ACC) x BRKi)]
412 let (mut acc_tmp, scratch1) = scratch.take_glwe_ct(out_mut.n(), basek, out_mut.k(), out_mut.rank());
413
414 // TODO: see if faster by skipping normalization in external product and keeping acc in big coeffs
415 // TODO: first iteration can be optimized to be a gglwe product
416 izip!(a.iter(), brk.data.iter()).for_each(|(ai, ski)| {
417 // acc_tmp = sk[i] * acc
418 acc_tmp.external_product(module, &out_mut, ski, scratch1);
419
420 // acc_tmp = (sk[i] * acc) * (X^{ai} - 1)
421 acc_tmp.mul_xp_minus_one_inplace(module, *ai);
422
423 // acc = acc + (sk[i] * acc) * (X^{ai} - 1)
424 out_mut.add_inplace(module, &acc_tmp);
425 });
426
427 // We can normalize only at the end because we add normalized values in [-2^{basek-1}, 2^{basek-1}]
428 // on top of each others, thus ~ 2^{63-basek} additions are supported before overflow.
429 out_mut.normalize_inplace(module, scratch1);
430}
431
432pub(crate) fn negate_and_mod_switch_2n(n: usize, res: &mut [i64], lwe: &LWECiphertext<&[u8]>) {
433 let basek: usize = lwe.basek();
434
435 let log2n: usize = usize::BITS as usize - (n - 1).leading_zeros() as usize + 1;
436
437 res.copy_from_slice(&lwe.data.at(0, 0));
438 res.iter_mut().for_each(|x| *x = -*x);
439
440 if basek > log2n {
441 let diff: usize = basek - log2n;
442 res.iter_mut().for_each(|x| {
443 *x = div_round_by_pow2(x, diff);
444 })
445 } else {
446 let rem: usize = basek - (log2n % basek);
447 let size: usize = log2n.div_ceil(basek);
448 (1..size).for_each(|i| {
449 if i == size - 1 && rem != basek {
450 let k_rem: usize = basek - rem;
451 izip!(lwe.data.at(0, i).iter(), res.iter_mut()).for_each(|(x, y)| {
452 *y = (*y << k_rem) + (x >> rem);
453 });
454 } else {
455 izip!(lwe.data.at(0, i).iter(), res.iter_mut()).for_each(|(x, y)| {
456 *y = (*y << basek) + x;
457 });
458 }
459 })
460 }
461}
462
463#[inline(always)]
464fn div_round_by_pow2(x: &i64, k: usize) -> i64 {
465 (x + (1 << (k - 1))) >> k
466}