1use base2k::{
  2    Encoding, FFT64, Module, Sampling, ScalarAlloc, ScalarZnxDftAlloc, ScalarZnxDftOps, ScratchOwned, VecZnxAlloc, VecZnxBigOps,
  3    VecZnxBigScratch, VecZnxDftAlloc, VecZnxDftOps, ZnxInfos,
  4};
  5use itertools::izip;
  6use sampling::source::Source;
  7
  8fn main() {
  9    let n: usize = 16;
 10    let log_base2k: usize = 18;
 11    let ct_size: usize = 3;
 12    let msg_size: usize = 2;
 13    let log_scale: usize = msg_size * log_base2k - 5;
 14    let module: Module<FFT64> = Module::<FFT64>::new(n);
 15
 16    let mut scratch =
 17        ScratchOwned::new((2 * module.bytes_of_vec_znx_dft(1, ct_size)) + 2 * module.vec_znx_big_normalize_tmp_bytes());
 18
 19    let seed: [u8; 32] = [0; 32];
 20    let mut source: Source = Source::new(seed);
 21
 22    // s <- Z_{-1, 0, 1}[X]/(X^{N}+1)
 23    let mut s = module.new_scalar(1);
 24    s.fill_ternary_prob(0, 0.5, &mut source);
 25
 26    // Buffer to store s in the DFT domain
 27    let mut s_dft = module.new_scalar_znx_dft(s.cols());
 28
 29    // s_dft <- DFT(s)
 30    module.svp_prepare(&mut s_dft, 0, &s, 0);
 31
 32    // Allocates a VecZnx with two columns: ct=(0, 0)
 33    let mut ct = module.new_vec_znx(
 34        2,       // Number of columns
 35        ct_size, // Number of small poly per column
 36    );
 37
 38    // Fill the second column with random values: ct = (0, a)
 39    module.fill_uniform(log_base2k, &mut ct, 1, ct_size, &mut source);
 40
 41    // Scratch space for DFT values
 42    let scratch = scratch.borrow();
 43    let (mut buf_dft, scratch) = scratch.tmp_vec_znx_dft(&module, 1, ct_size);
 44
 45    // Applies DFT(ct[1]) * DFT(s)
 46    module.svp_apply_dft(
 47        &mut buf_dft, // DFT(ct[1] * s)
 48        0,            // Selects the first column of res
 49        &s_dft,       // DFT(s)
 50        0,            // Selects the first column of s_dft
 51        &ct,
 52        1, // Selects the second column of ct
 53    );
 54
 55    // Alias scratch space (VecZnxDft<B> is always at least as big as VecZnxBig<B>)
 56    let (mut buf_big, scratch) = scratch.tmp_vec_znx_big(&module, 1, ct_size);
 57
 58    // BIG(ct[1] * s) <- IDFT(DFT(ct[1] * s)) (not normalized)
 59    // Note: Since `vec_znx_idft_tmp_a` takes no argument for generic `Data` a full qualified path seems necessary
 60    <Module<_> as VecZnxDftOps<_, &[u8], _>>::vec_znx_idft_tmp_a(&module, &mut buf_big, 0, &mut buf_dft, 0);
 61
 62    // Creates a plaintext: VecZnx with 1 column
 63    let mut m = module.new_vec_znx(
 64        1,        // Number of columns
 65        msg_size, // Number of small polynomials
 66    );
 67    let mut want: Vec<i64> = vec![0; n];
 68    want.iter_mut()
 69        .for_each(|x| *x = source.next_u64n(16, 15) as i64);
 70    m.encode_vec_i64(0, log_base2k, log_scale, &want, 4);
 71    let (tmp_bytes_norm, scratch) = scratch.tmp_scalar_slice(n * std::mem::size_of::<i64>());
 72    m.normalize(log_base2k, 0, tmp_bytes_norm);
 73
 74    // m - BIG(ct[1] * s)
 75    module.vec_znx_big_sub_small_b_inplace(
 76        &mut buf_big,
 77        0, // Selects the first column of the receiver
 78        &m,
 79        0, // Selects the first column of the message
 80    );
 81
 82    // Normalizes back to VecZnx
 83    // ct[0] <- m - BIG(c1 * s)
 84    module.vec_znx_big_normalize(
 85        log_base2k, &mut ct, 0, // Selects the first column of ct (ct[0])
 86        &buf_big, 0, // Selects the first column of buf_big
 87        scratch,
 88    );
 89
 90    // Add noise to ct[0]
 91    // ct[0] <- ct[0] + e
 92    module.add_normal(
 93        log_base2k,
 94        &mut ct,
 95        0,                    // Selects the first column of ct (ct[0])
 96        log_base2k * ct_size, // Scaling of the noise: 2^{-log_base2k * limbs}
 97        &mut source,
 98        3.2,  // Standard deviation
 99        19.0, // Truncatation bound
100    );
101
102    // Final ciphertext: ct = (-a * s + m + e, a)
103
104    // Decryption
105
106    // DFT(ct[1] * s)
107    module.svp_apply_dft(
108        &mut buf_dft,
109        0, // Selects the first column of res.
110        &s_dft,
111        0,
112        &ct,
113        1, // Selects the second column of ct (ct[1])
114    );
115
116    // BIG(c1 * s) = IDFT(DFT(c1 * s))
117    <Module<_> as VecZnxDftOps<_, &[u8], _>>::vec_znx_idft_tmp_a(&module, &mut buf_big, 0, &mut buf_dft, 0);
118
119    // BIG(c1 * s) + ct[0]
120    module.vec_znx_big_add_small_inplace(&mut buf_big, 0, &ct, 0);
121
122    // m + e <- BIG(ct[1] * s + ct[0])
123    let mut res = module.new_vec_znx(1, ct_size);
124    module.vec_znx_big_normalize(log_base2k, &mut res, 0, &buf_big, 0, scratch);
125
126    // have = m * 2^{log_scale} + e
127    let mut have: Vec<i64> = vec![i64::default(); n];
128    res.decode_vec_i64(0, log_base2k, res.size() * log_base2k, &mut have);
129
130    let scale: f64 = (1 << (res.size() * log_base2k - log_scale)) as f64;
131    izip!(want.iter(), have.iter())
132        .enumerate()
133        .for_each(|(i, (a, b))| {
134            println!("{}: {} {}", i, a, (*b as f64) / scale);
135        });
136
137    module.free();
138}