-
Notifications
You must be signed in to change notification settings - Fork 172
/
gadgetciphertext.go
293 lines (230 loc) · 9.01 KB
/
gadgetciphertext.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
package rlwe
import (
"bufio"
"fmt"
"io"
"github.com/google/go-cmp/cmp"
"github.com/tuneinsight/lattigo/v5/ring"
"github.com/tuneinsight/lattigo/v5/ring/ringqp"
"github.com/tuneinsight/lattigo/v5/utils"
"github.com/tuneinsight/lattigo/v5/utils/buffer"
"github.com/tuneinsight/lattigo/v5/utils/structs"
)
// GadgetCiphertext is a struct for storing an encrypted
// plaintext times the gadget power matrix.
type GadgetCiphertext struct {
BaseTwoDecomposition int
Value structs.Matrix[VectorQP]
}
// NewGadgetCiphertext returns a new Ciphertext key with pre-allocated zero-value.
// Ciphertext is always in the NTT domain.
// A GadgetCiphertext is created by default at degree 1 with the the maximum levelQ and levelP and with no base 2 decomposition.
// Give the optional GadgetCiphertextParameters struct to create a GadgetCiphertext with at a specific degree, levelQ, levelP and/or base 2 decomposition.
func NewGadgetCiphertext(params ParameterProvider, Degree, LevelQ, LevelP, BaseTwoDecomposition int) *GadgetCiphertext {
p := params.GetRLWEParameters()
BaseRNSDecompositionVectorSize := p.BaseRNSDecompositionVectorSize(LevelQ, LevelP)
BaseTwoDecompositionVectorSize := p.BaseTwoDecompositionVectorSize(LevelQ, LevelP, BaseTwoDecomposition)
m := make(structs.Matrix[VectorQP], BaseRNSDecompositionVectorSize)
for i := 0; i < BaseRNSDecompositionVectorSize; i++ {
m[i] = make([]VectorQP, BaseTwoDecompositionVectorSize[i])
for j := range m[i] {
m[i][j] = NewVectorQP(params, Degree+1, LevelQ, LevelP)
}
}
return &GadgetCiphertext{BaseTwoDecomposition: BaseTwoDecomposition, Value: m}
}
// LevelQ returns the level of the modulus Q of the target Ciphertext.
func (ct GadgetCiphertext) LevelQ() int {
return ct.Value[0][0][0].LevelQ()
}
// LevelP returns the level of the modulus P of the target Ciphertext.
func (ct GadgetCiphertext) LevelP() int {
return ct.Value[0][0][0].LevelP()
}
// BaseRNSDecompositionVectorSize returns the number of element in the RNS decomposition basis.
func (ct GadgetCiphertext) BaseRNSDecompositionVectorSize() int {
return len(ct.Value)
}
// BaseTwoDecompositionVectorSize returns the number of element in the Power of two decomposition basis for each prime of Q.
func (ct GadgetCiphertext) BaseTwoDecompositionVectorSize() (base []int) {
base = make([]int, len(ct.Value))
for i := range ct.Value {
base[i] = len(ct.Value[i])
}
return
}
// Equal checks two Ciphertexts for equality.
func (ct GadgetCiphertext) Equal(other *GadgetCiphertext) bool {
return (ct.BaseTwoDecomposition == other.BaseTwoDecomposition) && cmp.Equal(ct.Value, other.Value)
}
// CopyNew creates a deep copy of the receiver Ciphertext and returns it.
func (ct GadgetCiphertext) CopyNew() (ctCopy *GadgetCiphertext) {
return &GadgetCiphertext{BaseTwoDecomposition: ct.BaseTwoDecomposition, Value: ct.Value.CopyNew()}
}
// BinarySize returns the serialized size of the object in bytes.
func (ct GadgetCiphertext) BinarySize() (dataLen int) {
return 8 + ct.Value.BinarySize()
}
// WriteTo writes the object on an io.Writer. It implements the io.WriterTo
// interface, and will write exactly object.BinarySize() bytes on w.
//
// Unless w implements the buffer.Writer interface (see lattigo/utils/buffer/writer.go),
// it will be wrapped into a bufio.Writer. Since this requires allocations, it
// is preferable to pass a buffer.Writer directly:
//
// - When writing multiple times to a io.Writer, it is preferable to first wrap the
// io.Writer in a pre-allocated bufio.Writer.
// - When writing to a pre-allocated var b []byte, it is preferable to pass
// buffer.NewBuffer(b) as w (see lattigo/utils/buffer/buffer.go).
func (ct GadgetCiphertext) WriteTo(w io.Writer) (n int64, err error) {
switch w := w.(type) {
case buffer.Writer:
var inc int64
if inc, err = buffer.WriteAsUint64[int](w, ct.BaseTwoDecomposition); err != nil {
return n + inc, err
}
n += inc
inc, err = ct.Value.WriteTo(w)
return n + inc, err
default:
return ct.WriteTo(bufio.NewWriter(w))
}
}
// ReadFrom reads on the object from an io.Writer. It implements the
// io.ReaderFrom interface.
//
// Unless r implements the buffer.Reader interface (see see lattigo/utils/buffer/reader.go),
// it will be wrapped into a bufio.Reader. Since this requires allocation, it
// is preferable to pass a buffer.Reader directly:
//
// - When reading multiple values from a io.Reader, it is preferable to first
// first wrap io.Reader in a pre-allocated bufio.Reader.
// - When reading from a var b []byte, it is preferable to pass a buffer.NewBuffer(b)
// as w (see lattigo/utils/buffer/buffer.go).
func (ct *GadgetCiphertext) ReadFrom(r io.Reader) (n int64, err error) {
switch r := r.(type) {
case buffer.Reader:
var inc int64
if inc, err = buffer.ReadAsUint64[int](r, &ct.BaseTwoDecomposition); err != nil {
return n + inc, err
}
n += inc
inc, err = ct.Value.ReadFrom(r)
return n + inc, err
default:
return ct.ReadFrom(bufio.NewReader(r))
}
}
// MarshalBinary encodes the object into a binary form on a newly allocated slice of bytes.
func (ct GadgetCiphertext) MarshalBinary() (data []byte, err error) {
buf := buffer.NewBufferSize(ct.BinarySize())
_, err = ct.WriteTo(buf)
return buf.Bytes(), err
}
// UnmarshalBinary decodes a slice of bytes generated by
// MarshalBinary or WriteTo on the object.
func (ct *GadgetCiphertext) UnmarshalBinary(p []byte) (err error) {
_, err = ct.ReadFrom(buffer.NewBuffer(p))
return
}
// AddPolyTimesGadgetVectorToGadgetCiphertext takes a plaintext polynomial and a list of Ciphertexts and adds the
// plaintext times the RNS and BIT decomposition to the i-th element of the i-th Ciphertexts. This method return
// an error if len(cts) > 2.
func AddPolyTimesGadgetVectorToGadgetCiphertext(pt ring.Poly, cts []GadgetCiphertext, ringQP ringqp.Ring, buff ring.Poly) (err error) {
levelQ := cts[0].LevelQ()
levelP := cts[0].LevelP()
ringQ := ringQP.RingQ.AtLevel(levelQ)
if len(cts) > 2 {
return fmt.Errorf("cannot AddPolyTimesGadgetVectorToGadgetCiphertext: len(cts) should be <= 2")
}
if levelP != -1 {
ringQ.MulScalarBigint(pt, ringQP.RingP.AtLevel(levelP).Modulus(), buff) // P * pt
} else {
levelP = 0
buff.CopyLvl(levelQ, pt) // 1 * pt
}
BaseRNSDecompositionVectorSize := len(cts[0].Value)
BaseTwoDecompositionVectorSize := make([]int, len(cts[0].Value))
for i := range BaseTwoDecompositionVectorSize {
BaseTwoDecompositionVectorSize[i] = len(cts[0].Value[i])
}
N := ringQ.N()
var index int
for j := 0; j < utils.MaxSlice(BaseTwoDecompositionVectorSize); j++ {
for i := 0; i < BaseRNSDecompositionVectorSize; i++ {
if j < BaseTwoDecompositionVectorSize[i] {
// e + (m * P * w^2j) * (q_star * q_tild) mod QP
//
// q_prod = prod(q[i*#Pi+j])
// q_star = Q/qprod
// q_tild = q_star^-1 mod q_prod
//
// Therefore : (pt * P * w^2j) * (q_star * q_tild) = pt*P*w^2j mod q[i*#Pi+j], else 0
for k := 0; k < levelP+1; k++ {
index = i*(levelP+1) + k
// Handle cases where #pj does not divide #qi
if index >= levelQ+1 {
break
}
qi := ringQ.SubRings[index].Modulus
p0tmp := buff.Coeffs[index]
for u, ct := range cts {
p1tmp := ct.Value[i][j][u].Q.Coeffs[index]
for w := 0; w < N; w++ {
p1tmp[w] = ring.CRed(p1tmp[w]+p0tmp[w], qi)
}
}
}
}
}
// w^2j
ringQ.MulScalar(buff, 1<<cts[0].BaseTwoDecomposition, buff)
}
return
}
// GadgetPlaintext stores a plaintext value times the gadget vector.
type GadgetPlaintext struct {
Value structs.Vector[ring.Poly]
}
// NewGadgetPlaintext creates a new gadget plaintext from value, which can be either uint64, int64 or *ring.Poly.
// Plaintext is returned in the NTT and Montgomery domain.
func NewGadgetPlaintext(params Parameters, value interface{}, levelQ, levelP, baseTwoDecomposition int) (pt *GadgetPlaintext, err error) {
ringQ := params.RingQP().RingQ.AtLevel(levelQ)
BaseTwoDecompositionVectorSize := utils.MaxSlice(params.BaseTwoDecompositionVectorSize(levelQ, levelP, baseTwoDecomposition))
pt = new(GadgetPlaintext)
pt.Value = make([]ring.Poly, BaseTwoDecompositionVectorSize)
switch el := value.(type) {
case uint64:
pt.Value[0] = ringQ.NewPoly()
for i := 0; i < levelQ+1; i++ {
pt.Value[0].Coeffs[i][0] = el
}
case int64:
pt.Value[0] = ringQ.NewPoly()
if el < 0 {
for i := 0; i < levelQ+1; i++ {
pt.Value[0].Coeffs[i][0] = ringQ.SubRings[i].Modulus - uint64(-el)
}
} else {
for i := 0; i < levelQ+1; i++ {
pt.Value[0].Coeffs[i][0] = uint64(el)
}
}
case ring.Poly:
pt.Value[0] = *el.CopyNew()
default:
return nil, fmt.Errorf("cannot NewGadgetPlaintext: unsupported type, must be either int64, uint64 or ring.Poly but is %T", el)
}
if levelP > -1 {
ringQ.MulScalarBigint(pt.Value[0], params.RingP().AtLevel(levelP).Modulus(), pt.Value[0])
}
ringQ.NTT(pt.Value[0], pt.Value[0])
ringQ.MForm(pt.Value[0], pt.Value[0])
for i := 1; i < len(pt.Value); i++ {
pt.Value[i] = *pt.Value[0].CopyNew()
for j := 0; j < i; j++ {
ringQ.MulScalar(pt.Value[i], 1<<baseTwoDecomposition, pt.Value[i])
}
}
return
}