bootstrapping

package
v6.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 14, 2024 License: Apache-2.0 Imports: 17 Imported by: 1

README

References

  1. Bootstrapping for Approximate Homomorphic Encryption (https://eprint.iacr.org/2018/153)
  2. Improved Bootstrapping for Approximate Homomorphic Encryption (https://eprint.iacr.org/2018/1043)
  3. Better Bootstrapping for Approximate Homomorphic Encryption (https://eprint.iacr.org/2019/688)
  4. Faster Homomorphic Discrete Fourier Transforms and Improved FHE Bootstrapping (https://eprint.iacr.org/2018/1073)
  5. Efficient Bootstrapping for Approximate Homomorphic Encryption with Non-Sparse Keys (https://eprint.iacr.org/2020/1203)
  6. High-Precision Bootstrapping for Approximate Homomorphic Encryption by Error Variance Minimization (https://eprint.iacr.org/2020/1549)
  7. High-Precision Bootstrapping of RNS-CKKS Homomorphic Encryption Using Optimal Minimax Polynomial Approximation and Inverse Sine Function (https://eprint.iacr.org/2020/552)
  8. Bootstrapping for Approximate Homomorphic Encryption with Negligible Failure-Probability by Using Sparse-Secret Encapsulation (https://eprint.iacr.org/2022/024)
  9. META-BTS: Bootstrapping Precision Beyond the Limit (https://eprint.iacr.org/2022/1167)

Documentation

Overview

Package bootstrapping implements bootstrapping for fixed-point encrypted approximate homomorphic encryption over the complex/real numbers (CKKS scheme).

Index

Constants

View Source 
const (
	ModUpThenEncode = CircuitOrder(0) // ScaleDown -> ModUp -> CoeffsToSlots -> EvalMod -> SlotsToCoeffs.
	DecodeThenModUp = CircuitOrder(1) // SlotsToCoeffs -> ScaleDown -> ModUp -> CoeffsToSlots -> EvalMod.
	Custom          = CircuitOrder(2) // Custom order (e.g. partial bootstrapping), disables checks.
)
View Source 
const (
	// DefaultLogN is the default ring degree for the bootstrapping.
	DefaultLogN = 16
	// DefaultCoeffsToSlotsFactorizationDepth is the default factorization depth CoeffsToSlots step.
	DefaultCoeffsToSlotsFactorizationDepth = 4
	// DefaultSlotsToCoeffsFactorizationDepth is the default factorization depth SlotsToCoeffs step.
	DefaultSlotsToCoeffsFactorizationDepth = 3
	// DefaultCoeffsToSlotsLogScale is the default scaling factors for the CoeffsToSlots step.
	DefaultCoeffsToSlotsLogScale = 56
	// DefaultSlotsToCoeffsLogScale is the default scaling factors for the SlotsToCoeffs step.
	DefaultSlotsToCoeffsLogScale = 39
	// DefaultEvalModLogScale is the default scaling factor for the EvalMod step.
	DefaultEvalModLogScale = 60
	// DefaultEphemeralSecretWeight is the default Hamming weight of the ephemeral secret.
	DefaultEphemeralSecretWeight = 32
	// DefaultIterations is the default number of bootstrapping iterations.
	DefaultIterations = 1
	// DefaultMod1Type is the default function and approximation technique for the homomorphic modular reduction polynomial.
	DefaultMod1Type = mod1.CosDiscrete
	// DefaultLogMessageRatio is the default ratio between Q[0] and |m|.
	DefaultLogMessageRatio = 8
	// DefaultK is the default interval [-K+1, K-1] for the polynomial approximation of the homomorphic modular reduction.
	DefaultK = 16
	// DefaultMod1Degree is the default degree for the polynomial approximation of the homomorphic modular reduction.
	DefaultMod1Degree = 30
	// DefaultDoubleAngle is the default number of double iterations for the homomorphic modular reduction.
	DefaultDoubleAngle = 3
	// DefaultMod1InvDegree is the default degree of the f^-1: (x mod 1)^-1 polynomial for the homomorphic modular reduction.
	DefaultMod1InvDegree = 0
)

Variables

View Source 
var (
	// N16QP1546H192H32 is a default bootstrapping parameters for a main secret with H=192 and an ephemeral secret with H=32.
	// Residual Q : []int{60, 40, 40, 40, 40, 40, 40, 40, 40, 40} (420 bits).
	// SlotsToCoeffs Q: []int{39, 39, 39}.
	// EvalMod Q: []int{60, 60, 60, 60, 60, 60, 60, 60}.
	// CoeffsToSlots Q: []int{56, 56, 56, 56}.
	// Precision : 26.6 bits for 2^{15} slots.
	// Failure : 2^{-138.7} for 2^{15} slots.
	N16QP1546H192H32 = defaultParametersLiteral{
		ckks.ParametersLiteral{
			LogN:            16,
			LogQ:            []int{60, 40, 40, 40, 40, 40, 40, 40, 40, 40},
			LogP:            []int{61, 61, 61, 61, 61},
			Xs:              ring.Ternary{H: 192},
			LogDefaultScale: 40,
		},
		ParametersLiteral{},
	}

	// N16QP1547H192H32 is a default bootstrapping parameters for a main secret with H=192 and an ephemeral secret with H=32.
	// Residual Q : []int{60, 45, 45, 45, 45} (285 bits).
	// SlotsToCoeffs Q: []int{42, 42, 42}.
	// EvalMod Q: []int{60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60}.
	// CoeffsToSlots Q: []int{58, 58, 58, 58}.
	// Precision : 32.1 bits for 2^{15} slots.
	// Failure : 2^{-138.7} for 2^{15} slots.
	N16QP1547H192H32 = defaultParametersLiteral{
		ckks.ParametersLiteral{
			LogN:            16,
			LogQ:            []int{60, 45, 45, 45, 45, 45},
			LogP:            []int{61, 61, 61, 61},
			Xs:              ring.Ternary{H: 192},
			LogDefaultScale: 45,
		},
		ParametersLiteral{
			SlotsToCoeffsFactorizationDepthAndLogScales: [][]int{{42}, {42}, {42}},
			CoeffsToSlotsFactorizationDepthAndLogScales: [][]int{{58}, {58}, {58}, {58}},
			LogMessageRatio: utils.Pointy(2),
			Mod1InvDegree:   utils.Pointy(7),
		},
	}

	// N16QP1553H192H32 is a default bootstrapping parameters for a main secret with H=192 and an ephemeral secret with H=32.
	// Residual Q : []int{55, 60, 60, 60, 60, 60, 60, 60, 30} (505 bits).
	// SlotsToCoeffs Q: []int{30, {30, 30}}.
	// EvalMod Q: []int{55, 55, 55, 55, 55, 55, 55, 55}.
	// CoeffsToSlots Q: []int{53, 53, 53, 53}.
	// Precision : 19.1 bits for 2^{15} slots.
	// Failure : 2^{-138.7} for 2^{15} slots.
	N16QP1553H192H32 = defaultParametersLiteral{
		ckks.ParametersLiteral{
			LogN:            16,
			LogQ:            []int{55, 60, 60, 60, 60, 60, 60, 60},
			LogP:            []int{61, 61, 61, 61, 61},
			Xs:              ring.Ternary{H: 192},
			LogDefaultScale: 30,
		},
		ParametersLiteral{
			SlotsToCoeffsFactorizationDepthAndLogScales: [][]int{{30}, {30, 30}},
			CoeffsToSlotsFactorizationDepthAndLogScales: [][]int{{53}, {53}, {53}, {53}},
			EvalModLogScale: utils.Pointy(55),
		},
	}

	// N15QP768H192H32 is a default bootstrapping parameters for a main secret with H=192 and an ephemeral secret with H=32.
	// Residual Q : []int{32, 50, 25} (110 bits).
	// SlotsToCoeffs Q: []int{60}.
	// EvalMod Q: []int{50, 50, 50, 50, 50, 50, 50, 50}.
	// CoeffsToSlots Q: []int{49, 49}.
	// Precision : 15.4 bits for 2^{14} slots.
	// Failure : 2^{-139.7} for 2^{14} slots.
	N15QP768H192H32 = defaultParametersLiteral{
		ckks.ParametersLiteral{
			LogN:            15,
			LogQ:            []int{33, 50, 25},
			LogP:            []int{51, 51},
			Xs:              ring.Ternary{H: 192},
			LogDefaultScale: 25,
		},
		ParametersLiteral{
			SlotsToCoeffsFactorizationDepthAndLogScales: [][]int{{30, 30}},
			CoeffsToSlotsFactorizationDepthAndLogScales: [][]int{{49}, {49}},
			EvalModLogScale: utils.Pointy(50),
		},
	}

	// N16QP1767H32768H32 is a default bootstrapping parameters for a main secret with H=32768 and an ephemeral secret with H=32.
	// Residual Q : []int{60, 40, 40, 40, 40, 40, 40, 40, 40, 40, 40, 40, 40, 40} (580 bits).
	// SlotsToCoeffs Q: []int{39, 39, 39}.
	// EvalMod Q: []int{60, 60, 60, 60, 60, 60, 60, 60, 60}.
	// CoeffsToSlots Q: []int{56, 56, 56, 56}.
	// Precision : 23.8 bits for 2^{15} slots.
	// Failure : 2^{-138.7} for 2^{15} slots.
	N16QP1767H32768H32 = defaultParametersLiteral{
		ckks.ParametersLiteral{
			LogN:            16,
			LogQ:            []int{60, 40, 40, 40, 40, 40, 40, 40, 40, 40, 40, 40, 40, 40},
			LogP:            []int{61, 61, 61, 61, 61, 61},
			Xs:              ring.Ternary{H: 32768},
			LogDefaultScale: 40,
		},
		ParametersLiteral{},
	}

	// N16QP1788H32768H32 is a default bootstrapping parameters for a main secret with H=32768 and an ephemeral secret with H=32.
	// Residual Q : []int{60, 45, 45, 45, 45, 45, 45, 45, 45, 45} (465 bits).
	// SlotsToCoeffs Q: []int{42, 42, 42}.
	// EvalMod Q: []int{60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60}.
	// CoeffsToSlots Q: []int{58, 58, 58, 58}.
	// Precision : 29.8 bits for 2^{15} slots.
	// Failure : 2^{-138.7} for 2^{15} slots.
	N16QP1788H32768H32 = defaultParametersLiteral{
		ckks.ParametersLiteral{
			LogN:            16,
			LogQ:            []int{60, 45, 45, 45, 45, 45, 45, 45, 45, 45},
			LogP:            []int{61, 61, 61, 61, 61},
			Xs:              ring.Ternary{H: 32768},
			LogDefaultScale: 45,
		},
		ParametersLiteral{
			SlotsToCoeffsFactorizationDepthAndLogScales: [][]int{{42}, {42}, {42}},
			CoeffsToSlotsFactorizationDepthAndLogScales: [][]int{{58}, {58}, {58}, {58}},
			LogMessageRatio: utils.Pointy(2),
			Mod1InvDegree:   utils.Pointy(7),
		},
	}

	// N16QP1793H32768H32 is a default bootstrapping parameters for a main secret with H=32768 and an ephemeral secret with H=32.
	// Residual Q : []int{55, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 30} 745 bits.
	// SlotsToCoeffs Q: []int{30, 60}.
	// EvalMod Q: []int{55, 55, 55, 55, 55, 55, 55, 55}.
	// CoeffsToSlots Q: []int{53, 53, 53, 53}.
	// Precision : 17.8 bits for 2^{15} slots.
	// Failure : 2^{-138.7} for 2^{15} slots.
	N16QP1793H32768H32 = defaultParametersLiteral{
		ckks.ParametersLiteral{
			LogN:            16,
			LogQ:            []int{55, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 30},
			LogP:            []int{61, 61, 61, 61, 61},
			Xs:              ring.Ternary{H: 32768},
			LogDefaultScale: 30,
		},
		ParametersLiteral{
			SlotsToCoeffsFactorizationDepthAndLogScales: [][]int{{30}, {30, 30}},
			CoeffsToSlotsFactorizationDepthAndLogScales: [][]int{{53}, {53}, {53}, {53}},
			EvalModLogScale: utils.Pointy(55),
		},
	}

	// N15QP880H16384H32 is a default bootstrapping parameters for a main secret with H=16384 and an ephemeral secret with H=32.
	// Residual Q : []int{40, 31, 31, 31, 31} (166 bits).
	// SlotsToCoeffs Q: []int{60}.
	// EvalMod Q: []int{55, 55, 55, 55, 55, 55, 55, 55}.
	// CoeffsToSlots Q: []int{52, 52}.
	// Precision : 17.3 bits for 2^{14} slots.
	// Failure : 2^{-139.7} for 2^{14} slots.
	N15QP880H16384H32 = defaultParametersLiteral{
		ckks.ParametersLiteral{
			LogN:            15,
			LogQ:            []int{40, 31, 31, 31, 31},
			LogP:            []int{56, 56},
			Xs:              ring.Ternary{H: 16384},
			LogDefaultScale: 31,
		},
		ParametersLiteral{
			SlotsToCoeffsFactorizationDepthAndLogScales: [][]int{{30, 30}},
			CoeffsToSlotsFactorizationDepthAndLogScales: [][]int{{52}, {52}},
			EvalModLogScale: utils.Pointy(55),
		},
	}
)
View Source 
var (
	// DefaultXs is the default secret distribution of the bootstrapping parameters.
	DefaultXs = ring.Ternary{H: 192}
	// DefaultXe is the default error distribution of the bootstrapping parameters.
	DefaultXe = rlwe.DefaultXe
)
View Source 
var DefaultParametersDense = []defaultParametersLiteral{N16QP1767H32768H32, N16QP1788H32768H32, N16QP1793H32768H32, N15QP880H16384H32}

DefaultParametersDense is a set of default bootstrapping parameters with H=N/2 as main secret and H=32 as ephemeral secret.

View Source 
var DefaultParametersSparse = []defaultParametersLiteral{N16QP1546H192H32, N16QP1547H192H32, N16QP1553H192H32, N15QP768H192H32}

DefaultParametersSparse is a set of default bootstrapping parameters with H=192 as main secret and H=32 as ephemeral secret.

Functions

This section is empty.

Types

type Bootstrapper 

type Bootstrapper interface {

	// Bootstrap defines a method that takes a single Ciphertext as input and applies
	// an in place scheme-specific bootstrapping. The result is also returned.
	// An error should notably be returned if ct.Level() < Bootstrapper.MinimumInputLevel().
	Bootstrap(ct *rlwe.Ciphertext) (*rlwe.Ciphertext, error)

	// BootstrapMany defines a method that takes a slice of Ciphertexts as input and applies an
	// in place scheme-specific bootstrapping to each Ciphertext. The result is also returned.
	// An error should notably be returned if cts[i].Level() < Bootstrapper.MinimumInputLevel().
	BootstrapMany(cts []rlwe.Ciphertext) ([]rlwe.Ciphertext, error)

	// Depth is the number of levels consumed by the bootstrapping circuit.
	// This value is equivalent to params.MaxLevel() - OutputLevel().
	Depth() int

	// MinimumInputLevel defines the minimum level that the ciphertext
	// must be at when given to the bootstrapper.
	// For the centralized bootstrapping this value is usually zero.
	// For the collective bootstrapping it is given by the user-defined
	// security parameters
	MinimumInputLevel() int

	// OutputLevel defines the level that the ciphertext will be at
	// after the bootstrapping.
	// For the centralized bootstrapping this value is the maximum
	// level minus the depth of the bootstrapping circuit.
	// For the collective bootstrapping this value is usually the
	// maximum level.
	OutputLevel() int
}

type CircuitOrder 

type CircuitOrder int

type EvaluationKeys 

type EvaluationKeys struct {

	// EvkN1ToN2 is the evaluation key to switch from the residual parameters'
	// ring degree (N1) to the bootstrapping parameters' ring degree (N2)
	EvkN1ToN2 *rlwe.EvaluationKey

	// EvkN2ToN1 is the evaluation key to switch from the bootstrapping parameters'
	// ring degree (N2) to the residual parameters' ring degree (N1)
	EvkN2ToN1 *rlwe.EvaluationKey

	// EvkRealToCmplx is the evaluation key to switch from the standard ring to the
	// conjugate invariant ring.
	EvkRealToCmplx *rlwe.EvaluationKey

	// EvkCmplxToReal is the evaluation key to switch from the conjugate invariant
	// ring to the standard ring.
	EvkCmplxToReal *rlwe.EvaluationKey

	// EvkDenseToSparse is the evaluation key to switch
	// from the dense secret to the sparse secret.
	// https://eprint.iacr.org/2022/024
	EvkDenseToSparse *rlwe.EvaluationKey

	// EvkSparseToDense is the evaluation key to switch
	// from the sparse secret to the dense secret.
	// https://eprint.iacr.org/2022/024
	EvkSparseToDense *rlwe.EvaluationKey

	// MemEvaluationKeySet is the evaluation key set storing the relinearization
	// key and the Galois keys necessary for the bootstrapping circuit.
	*rlwe.MemEvaluationKeySet
}

EvaluationKeys is a struct storing the different evaluation keys required by the bootstrapper.

func (EvaluationKeys) BinarySize 

func (b EvaluationKeys) BinarySize() (dLen int)

BinarySize returns the total binary size of the bootstrapper's keys.

func (EvaluationKeys) MarshalBinary added in v6.1.0 

func (b EvaluationKeys) MarshalBinary() (p []byte, err error)

MarshalBinary encodes the object into a binary form on a newly allocated slices of bytes.

func (*EvaluationKeys) ReadFrom added in v6.1.0 

func (b *EvaluationKeys) ReadFrom(r io.Reader) (n int64, err error)

ReadFrom reads on the object from an io.Writer. It implements the io.ReaderFrom interface.

Unless r implements the buffer.Reader interface (see see lattigo/utils/buffer/reader.go), it will be wrapped into a bufio.Reader. Since this requires allocation, it is preferable to pass a buffer.Reader directly:

  • When reading multiple values from a io.Reader, it is preferable to first first wrap io.Reader in a pre-allocated bufio.Reader.
  • When reading from a var b []byte, it is preferable to pass a buffer.NewBuffer(b) as w (see lattigo/utils/buffer/buffer.go).

func (*EvaluationKeys) UnmarshalBinary added in v6.1.0 

func (b *EvaluationKeys) UnmarshalBinary(p []byte) (err error)

UnmarshalBinary encodes a slices of bytes generated by MarshalBinary or WriteTo on the object.

func (EvaluationKeys) WriteTo added in v6.1.0 

func (b EvaluationKeys) WriteTo(w io.Writer) (n int64, err error)

WriteTo writes the object on an io.Writer. It implements the io.WriterTo interface, and will write exactly object.BinarySize() bytes on w.

Unless w implements the buffer.Writer interface (see lattigo/utils/buffer/writer.go), it will be wrapped into a bufio.Writer. Since this requires allocations, it is preferable to pass a buffer.Writer directly:

  • When writing multiple times to a io.Writer, it is preferable to first wrap the io.Writer in a pre-allocated bufio.Writer.
  • When writing to a pre-allocated var b []byte, it is preferable to pass buffer.NewBuffer(b) as w (see lattigo/utils/buffer/buffer.go).

type Evaluator 

type Evaluator struct {
	Parameters
	*ckks.Evaluator
	DFTEvaluator  *dft.Evaluator
	Mod1Evaluator *mod1.Evaluator
	*EvaluationKeys

	ckks.DomainSwitcher

	Mod1Parameters mod1.Parameters
	S2CDFTMatrix   dft.Matrix
	C2SDFTMatrix   dft.Matrix

	SkDebug *rlwe.SecretKey
	// contains filtered or unexported fields
}

Evaluator is a struct to store a memory buffer with the plaintext matrices, the polynomial approximation, and the keys for the bootstrapping. It is used to evaluate the bootstrapping circuit on single ciphertexts.

func NewEvaluator 

func NewEvaluator(btpParams Parameters, evk *EvaluationKeys) (eval *Evaluator, err error)

NewEvaluator creates a new Evaluator.

func (Evaluator) Bootstrap 

func (eval Evaluator) Bootstrap(ct *rlwe.Ciphertext) (*rlwe.Ciphertext, error)

Bootstrap bootstraps a single ciphertext and returns the bootstrapped ciphertext.

func (Evaluator) BootstrapMany 

func (eval Evaluator) BootstrapMany(cts []rlwe.Ciphertext) ([]rlwe.Ciphertext, error)

BootstrapMany bootstraps a list of ciphertext and returns the list of bootstrapped ciphertexts.

func (Evaluator) CoeffsToSlots 

func (eval Evaluator) CoeffsToSlots(ctIn *rlwe.Ciphertext) (ctReal, ctImag *rlwe.Ciphertext, err error)

CoeffsToSlots applies the homomorphic decoding

func (Evaluator) ComplexToRealNew 

func (eval Evaluator) ComplexToRealNew(ctCmplx *rlwe.Ciphertext) (ctReal *rlwe.Ciphertext)

func (Evaluator) Depth 

func (eval Evaluator) Depth() int

Depth returns the multiplicative depth (number of levels consumed) of the bootstrapping circuit.

func (Evaluator) EvalMod 

func (eval Evaluator) EvalMod(ctIn *rlwe.Ciphertext) (ctOut *rlwe.Ciphertext, err error)

EvalMod applies the homomorphic modular reduction by q.

func (Evaluator) EvalModAndScale added in v6.1.0 

func (eval Evaluator) EvalModAndScale(ctIn *rlwe.Ciphertext, scaling complex128) (ctOut *rlwe.Ciphertext, err error)

EvalModAndScale applies the homomorphic modular reduction by q and scales the output value (without consuming an additional level).

func (Evaluator) Evaluate 

func (eval Evaluator) Evaluate(ctIn *rlwe.Ciphertext) (ctOut *rlwe.Ciphertext, err error)

Evaluate re-encrypts a ciphertext to a ciphertext at MaxLevel - k where k is the depth of the bootstrapping circuit. If the input ciphertext level is zero, the input scale must be an exact power of two smaller than Q[0]/MessageRatio (it can't be equal since Q[0] is not a power of two). The message ratio is an optional field in the bootstrapping parameters, by default it set to 2^{LogMessageRatio = 8}. See the bootstrapping parameters for more information about the message ratio or other parameters related to the bootstrapping. If the input ciphertext is at level one or more, the input scale does not need to be an exact power of two as one level can be used to do a scale matching.

The circuit consists in 5 steps.

  1. ScaleDown: scales the ciphertext to q/|m| and bringing it down to q
  2. ModUp: brings the modulus from q to Q
  3. CoeffsToSlots: homomorphic encoding
  4. EvalMod: homomorphic modular reduction
  5. SlotsToCoeffs: homomorphic decoding

func (Evaluator) EvaluateConjugateInvariant 

func (eval Evaluator) EvaluateConjugateInvariant(ctLeftN1Q0, ctRightN1Q0 *rlwe.Ciphertext) (ctLeftN1QL, ctRightN1QL *rlwe.Ciphertext, err error)

EvaluateConjugateInvariant takes two ciphertext in the Conjugate Invariant ring, repacks them in a single ciphertext in the standard ring using the real and imaginary part, bootstrap both ciphertext, and then extract back the real and imaginary part before repacking them individually in two new ciphertexts in the Conjugate Invariant ring.

func (Evaluator) MinimumInputLevel 

func (eval Evaluator) MinimumInputLevel() int

MinimumInputLevel returns the minimum level at which a ciphertext must be to be bootstrapped.

func (Evaluator) ModUp 

func (eval Evaluator) ModUp(ctIn *rlwe.Ciphertext) (ctOut *rlwe.Ciphertext, err error)

ModUp raise the modulus from q to Q, scales the message and applies the Trace if the ciphertext is sparsely packed.

func (Evaluator) OutputLevel 

func (eval Evaluator) OutputLevel() int

OutputLevel returns the output level after the evaluation of the bootstrapping circuit.

func (Evaluator) Pack 

func (eval Evaluator) Pack(cts []rlwe.Ciphertext, params ckks.Parameters, xPow2 []ring.Poly) ([]rlwe.Ciphertext, error)

func (Evaluator) PackAndSwitchN1ToN2 

func (eval Evaluator) PackAndSwitchN1ToN2(cts []rlwe.Ciphertext) ([]rlwe.Ciphertext, error)

func (Evaluator) RealToComplexNew 

func (eval Evaluator) RealToComplexNew(ctReal *rlwe.Ciphertext) (ctCmplx *rlwe.Ciphertext)

func (Evaluator) ScaleDown 

func (eval Evaluator) ScaleDown(ctIn *rlwe.Ciphertext) (*rlwe.Ciphertext, *rlwe.Scale, error)

ScaleDown brings the ciphertext level to zero and scaling factor to Q[0]/MessageRatio It multiplies the ciphertexts by round(currentMessageRatio / targetMessageRatio) where:

  • currentMessageRatio = Q/ctIn.Scale
  • targetMessageRatio = q/|m|

and updates the scale of ctIn accordingly It then rescales the ciphertext down to q if necessary and also returns the rescaling error from this process

func (Evaluator) ShallowCopy 

func (eval Evaluator) ShallowCopy() *Evaluator

ShallowCopy creates a shallow copy of this Evaluator in which all the read-only data-structures are shared with the receiver and the temporary buffers are reallocated. The receiver and the returned Evaluator can be used concurrently.

func (Evaluator) SlotsToCoeffs 

func (eval Evaluator) SlotsToCoeffs(ctReal, ctImag *rlwe.Ciphertext) (ctOut *rlwe.Ciphertext, err error)

func (Evaluator) SwitchRingDegreeN1ToN2New 

func (eval Evaluator) SwitchRingDegreeN1ToN2New(ctN1 *rlwe.Ciphertext) (ctN2 *rlwe.Ciphertext)

func (Evaluator) SwitchRingDegreeN2ToN1New 

func (eval Evaluator) SwitchRingDegreeN2ToN1New(ctN2 *rlwe.Ciphertext) (ctN1 *rlwe.Ciphertext)

func (Evaluator) UnPack 

func (eval Evaluator) UnPack(cts []rlwe.Ciphertext, params ckks.Parameters, LogSlots, Nb int, xPow2Inv []ring.Poly) ([]rlwe.Ciphertext, error)

func (Evaluator) UnpackAndSwitchN2Tn1 

func (eval Evaluator) UnpackAndSwitchN2Tn1(cts []rlwe.Ciphertext, LogSlots, Nb int) ([]rlwe.Ciphertext, error)

type IterationsParameters 

type IterationsParameters struct {
	BootstrappingPrecision []float64
	ReservedPrimeBitSize   int
}

type Parameters 

type Parameters struct {
	// ResidualParameters: Parameters outside of the bootstrapping circuit
	ResidualParameters ckks.Parameters
	// BootstrappingParameters: Parameters during the bootstrapping circuit
	BootstrappingParameters ckks.Parameters
	// SlotsToCoeffsParameters Parameters of the homomorphic decoding linear transformation
	SlotsToCoeffsParameters dft.MatrixLiteral
	// Mod1ParametersLiteral: Parameters of the homomorphic modular reduction
	Mod1ParametersLiteral mod1.ParametersLiteral
	// CoeffsToSlotsParameters: Parameters of the homomorphic encoding linear transformation
	CoeffsToSlotsParameters dft.MatrixLiteral
	// IterationsParameters: Parameters of the bootstrapping iterations (META-BTS)
	IterationsParameters *IterationsParameters
	// EphemeralSecretWeight: Hamming weight of the ephemeral secret. If 0, no ephemeral secret is used during the bootstrapping.
	EphemeralSecretWeight int
	// CircuitOrder: Value indicating the order of the circuit (default: ModUpThenEncode)
	CircuitOrder CircuitOrder
}

Parameters is a struct storing the parameters of the bootstrapping circuit.

func NewParametersFromLiteral 

func NewParametersFromLiteral(residualParameters ckks.Parameters, btpLit ParametersLiteral) (Parameters, error)

NewParametersFromLiteral instantiates a Parameters from the residual ckks.Parameters and a ParametersLiteral struct.

The residualParameters corresponds to the ckks.Parameters that are left after the bootstrapping circuit is evaluated. These are entirely independent of the bootstrapping parameters with one exception: the ciphertext primes Qi must be congruent to 1 mod 2N of the bootstrapping parameters (note that the auxiliary primes Pi do not need to be). This is required because the primes Qi of the residual parameters and the bootstrapping parameters are the same between the two sets of parameters.

The user can ensure that this condition is met by setting the appropriate LogNThRoot in the ckks.ParametersLiteral before instantiating them.

The method NewParametersFromLiteral will automatically allocate the ckks.Parameters of the bootstrapping circuit based on the provided residualParameters and the information given in the ParametersLiteral.

func (Parameters) Depth 

func (p Parameters) Depth() (depth int)

Depth returns the depth of the full bootstrapping circuit.

func (Parameters) DepthCoeffsToSlots 

func (p Parameters) DepthCoeffsToSlots() (depth int)

DepthCoeffsToSlots returns the depth of the Coeffs to Slots of the bootstrapping.

func (Parameters) DepthEvalMod 

func (p Parameters) DepthEvalMod() (depth int)

DepthEvalMod returns the depth of the EvalMod step of the bootstrapping.

func (Parameters) DepthSlotsToCoeffs 

func (p Parameters) DepthSlotsToCoeffs() (depth int)

DepthSlotsToCoeffs returns the depth of the Slots to Coeffs step of the bootstrapping.

func (Parameters) Equal 

func (p Parameters) Equal(other *Parameters) (res bool)

func (Parameters) GaloisElements 

func (p Parameters) GaloisElements(params ckks.Parameters) (galEls []uint64)

GaloisElements returns the list of Galois elements required to evaluate the bootstrapping.

func (Parameters) GenEvaluationKeys 

func (p Parameters) GenEvaluationKeys(skN1 *rlwe.SecretKey) (btpkeys *EvaluationKeys, skN2 *rlwe.SecretKey, err error)

GenEvaluationKeys generates the bootstrapping evaluation keys, which include:

If the bootstrapping parameters' ring degree > residual parameters' ring degree:

  • An evaluation key to switch from the residual parameters' ring to the bootstrapping parameters' ring
  • An evaluation key to switch from the bootstrapping parameters' ring to the residual parameters' ring

If the residual parameters use the Conjugate Invariant ring:

  • An evaluation key to switch from the conjugate invariant ring to the standard ring
  • An evaluation key to switch from the standard ring to the conjugate invariant ring

The core bootstrapping circuit evaluation keys:

Note:

  • These evaluation keys are generated under an ephemeral secret key skN2 using the distribution specified in the bootstrapping parameters.
  • The ephemeral key used to generate the bootstrapping keys is returned by this method for debugging purposes.
  • !WARNING! The bootstrapping parameters use their own and independent cryptographic parameters (i.e. float.Parameters) and it is the user's responsibility to ensure that these parameters meet the target security and tweak them if necessary.

func (Parameters) LogMaxDimensions 

func (p Parameters) LogMaxDimensions() ring.Dimensions

LogMaxDimensions returns the log plaintext dimensions of the target Parameters.

func (Parameters) LogMaxSlots 

func (p Parameters) LogMaxSlots() int

LogMaxSlots returns the log of the maximum number of slots.

func (Parameters) MarshalBinary 

func (p Parameters) MarshalBinary() (data []byte, err error)

MarshalBinary returns a JSON representation of the Parameters struct. See Marshal from the encoding/json package.

func (Parameters) MarshalJSON 

func (p Parameters) MarshalJSON() (data []byte, err error)

func (*Parameters) UnmarshalBinary 

func (p *Parameters) UnmarshalBinary(data []byte) (err error)

UnmarshalBinary reads a JSON representation on the target Parameters struct. See Unmarshal from the encoding/json package.

func (*Parameters) UnmarshalJSON 

func (p *Parameters) UnmarshalJSON(data []byte) (err error)

type ParametersLiteral 

type ParametersLiteral struct {
	LogN                                        *int                        // Default: 16
	LogP                                        []int                       // Default: 61 * max(1, floor(sqrt(#Qi)))
	Xs                                          ring.DistributionParameters // Default: ring.Ternary{H: 192}
	Xe                                          ring.DistributionParameters // Default: rlwe.DefaultXe
	LogSlots                                    *int                        // Default: LogN-1
	CoeffsToSlotsFactorizationDepthAndLogScales [][]int                     // Default: [][]int{min(4, max(LogSlots, 1)) * 56}
	SlotsToCoeffsFactorizationDepthAndLogScales [][]int                     // Default: [][]int{min(3, max(LogSlots, 1)) * 39}
	EvalModLogScale                             *int                        // Default: 60
	EphemeralSecretWeight                       *int                        // Default: 32
	IterationsParameters                        *IterationsParameters       // Default: nil (default starting level of 0 and 1 iteration)
	Mod1Type                                    mod1.Type                   // Default: mod1.CosDiscrete
	LogMessageRatio                             *int                        // Default: 8
	K                                           *int                        // Default: 16
	Mod1Degree                                  *int                        // Default: 30
	DoubleAngle                                 *int                        // Default: 3
	Mod1InvDegree                               *int                        // Default: 0
}

ParametersLiteral is a struct to parameterize the bootstrapping parameters. The ParametersLiteral struct an unchecked struct that is given to the method NewParametersFromLiteral to validate them and create the bootstrapping Parameters struct, which is used to instantiate a Bootstrapper. This struct contains only optional fields. The default bootstrapping (with no optional field) has - Depth 4 for CoeffsToSlots - Depth 8 for EvalMod - Depth 3 for SlotsToCoeffs for a total depth of 15 and a bit consumption of 821 A precision, for complex values with both real and imaginary parts uniformly distributed in -1, 1 of - 27.9 bits (27.4 L2) for H=192 - 24.4 bits (23.9 L2) for H=32768, And a failure probability of 2^{-138.7} for 2^{15} slots.

===================================== Optional fields (with default values) =====================================

LogN: the log2 of the ring degree of the bootstrapping parameters. The default value is 16.

LogP: the log2 of the auxiliary primes during the key-switching operation of the bootstrapping parameters. The default value is [61]*max(1, floor(sqrt(#Qi))).

Xs: the distribution of the secret-key used to generate the bootstrapping evaluation keys. The default value is ring.Ternary{H: 192}.

Xe: the distribution of the error sampled to generate the bootstrapping evaluation keys. The default value is rlwe.DefaultXe.

LogSlots: the maximum number of slots of the ciphertext. Default value: LogN-1.

CoeffsToSlotsFactorizationDepthAndLogPlaintextScales: the scaling factor and distribution of the moduli for the SlotsToCoeffs (homomorphic encoding) step. 

Default value is [][]int{min(4, max(LogSlots, 1)) * 56}.
This is a double slice where the first dimension is the index of the prime to be used, and the second dimension the scaling factors to be used: [level][scaling].
For example: [][]int{{45}, {46}, {47}} means that the CoeffsToSlots step will use three levels, each with one prime. Primes are consumed in reverse order,
so in this example the first matrix will use the prime of 47 bits, the second the prime of 46 bits, and so on.
Non standard parameterization can include multiple scaling factors for a same prime, for example [][]int{{30}, {30, 30}} will use two levels for three matrices.
The first two matrices will consume a prime of 30 + 30 bits, and have a scaling factor which prime^(1/2), and the third matrix will consume the second prime of 30 bits.

SlotsToCoeffsFactorizationDepthAndLogPlaintextScales: the scaling factor and distribution of the moduli for the CoeffsToSlots (homomorphic decoding) step. 

Parameterization is identical to C2SLogPlaintextScale. and the default value is [][]int{min(3, max(LogSlots, 1)) * 39}.

EvalModLogPlaintextScale: the scaling factor used during the EvalMod step (all primes will have this bit-size). 

Default value is 60.

EphemeralSecretWeight: the Hamming weight of the ephemeral secret, by default set to 32, which ensure over 128-bit security for an evaluation key of modulus 121 bits. 

The user can set this value to 0 to use the regular bootstrapping circuit without the ephemeral secret encapsulation.
Be aware that doing so will impact the security, precision, and failure probability of the bootstrapping circuit.
See https://eprint.iacr.org/2022/024 for more information.

IterationsParameters : by treating the bootstrapping as a black box with precision logprec, we can construct a bootstrapping of precision ~k*logprec by iteration (see https://eprint.iacr.org/2022/1167).

  • BootstrappingPrecision: []float64, the list of iterations (after the initial bootstrapping) given by the expected precision of each previous iteration.
  • ReservedPrimeBitSize: the size of the reserved prime for the scaling after the initial bootstrapping.

For example: &bootstrapping.IterationsParameters{BootstrappingPrecision: []float64{16}, ReservedPrimeBitSize: 16} will define a two iteration bootstrapping (the first iteration being the initial bootstrapping) with a additional prime close to 2^{16} reserved for the scaling of the error during the second iteration.

Here is an example for a two iterations bootstrapping of an input message mod [logq0=55, logq1=45] with scaling factor 2^{90}:

INPUT:

  1. The input is a ciphertext encrypting [2^{90} * M]_{q0, q1}

ITERATION N°0

  1. Rescale [M^{90}]_{q0, q1} to [M^{90}/q1]_{q0} (ensure that M^{90}/q1 ~ q0/message-ratio by additional scaling if necessary)
  2. Bootstrap [M^{90}/q1]_{q0} to [M^{90}/q1 + e^{90 - logprec}/q1]_{q0, q1, q2, ...}
  3. Scale up [M^{90}/q1 + e^{90 - logprec}/q1]_{q0, q1, q2, ...} to [M^{d} + e^{d - logprec}]_{q0, q1, q2, ...}

ITERATION N°1

  1. Subtract [M^{d}]_{q0, q1} to [M^{d} + e^{d - logprec}]_{q0, q1, q2, ...} to get [e^{d - logprec}]_{q0, q1}
  2. Scale up [e^{90 - logprec}]_{q0, q1} by 2^{logprec} to get [e^{d}]_{q0, q1}
  3. Rescale [e^{90}]_{q0, q1} to [{90}/q1]_{q0}
  4. Bootstrap [e^{90}/q1]_{q0} to [e^{90}/q1 + e'^{90 - logprec}/q1]_{q0, q1, q2, ...}
  5. Scale up [e^{90}/q1 + e'^{90 - logprec}/q0]_{q0, q1, q2, ...} by round(q1/2^{logprec}) to get [e^{90-logprec} + e'^{90 - 2logprec}]_{q0, q1, q2, ...}
  6. Subtract [e^{d - logprec} + e'^{d - 2logprec}]_{q0, q1, q2, ...} to [M^{d} + e^{d - logprec}]_{q0, q1, q2, ...} to get [M^{d} + e'^{d - 2logprec}]_{q0, q1, q2, ...}
  7. Go back to step 5 for more iterations until 2^{k * logprec} >= 2^{90}

This example can be generalized to input messages of any scaling factor and desired output precision by increasing the input scaling factor and substituting q1 by a larger product of primes.

Notes:

  • The bootstrapping precision cannot exceed the original input ciphertext precision.
  • Although the rescalings of 2) and 7) are approximate, we can ignore them and treat them as being part of the bootstrapping error
  • As long as round(q1/2^{k*logprec}) >= 2^{logprec}, for k the iteration number, we are guaranteed that the error due to the approximate scale up of step 8) is smaller than 2^{logprec}
  • The gain in precision for each iteration is proportional to min(round(q1/2^{k*logprec}), 2^{logprec})
  • If round(q1/2^{k * logprec}) < 2^{logprec}, where k is the iteration number, then the gain in precision will be less than the expected logprec. This can happen during the last iteration when q1/2^{k * logprec} < 1, and gets rounded to 1 or 0. To solve this issue, we can reduce logprec for the last iterations, but this increases the number of iterations, or reserve a prime of size at least 2^{logprec} to get a proper scaling by q1/2^{k * logprec} (i.e. not a integer rounded scaling).
  • If the input ciphertext is at level 0, we must reserve a prime because everything happens within Q[0] and we have no other prime to use for rescaling.

LogMessageRatio: the log of expected ratio Q[0]/|m|, by default set to 8 (ratio of 256.0). 

	This ratio directly impacts the precision of the bootstrapping.
	The homomorphic modular reduction x mod 1 is approximated with by sin(2*pi*x)/(2*pi), which is a good approximation
	when x is close to the origin. Thus a large message ratio (i.e. 2^8) implies that x is small with respect to Q, and thus close to the origin.
	When using a small ratio (i.e. 2^4), for example if ct.PlaintextScale is close to Q[0] is small or if |m| is large, the Mod1InvDegree can be set to
 a non zero value (i.e. 5 or 7). This will greatly improve the precision of the bootstrapping, at the expense of slightly increasing its depth.

Mod1Type: the type of approximation for the modular reduction polynomial. By default set to mod1.CosDiscrete.

K: the range of the approximation interval, by default set to 16.

Mod1Degree: the degree of f: x mod 1. By default set to 30.

DoubleAngle: the number of double angle evaluation. By default set to 3.

Mod1InvDegree: the degree of the f^-1: (x mod 1)^-1, by default set to 0.

func (ParametersLiteral) BitConsumption 

func (p ParametersLiteral) BitConsumption(LogSlots int) (logQ int, err error)

BitConsumption returns the expected consumption in bits of bootstrapping circuit of the target ParametersLiteral. The value is rounded up and thus will overestimate the value by up to 1 bit.

func (ParametersLiteral) GetCoeffsToSlotsFactorizationDepthAndLogScales 

func (p ParametersLiteral) GetCoeffsToSlotsFactorizationDepthAndLogScales(LogSlots int) (CoeffsToSlotsFactorizationDepthAndLogScales [][]int, err error)

GetCoeffsToSlotsFactorizationDepthAndLogScales returns a copy of the CoeffsToSlotsFactorizationDepthAndLogScales field of the target ParametersLiteral. The default value constructed from DefaultSlotsToCoeffsFactorizationDepth and DefaultSlotsToCoeffsLogScale is returned if the field is nil.

func (ParametersLiteral) GetDefaultXe 

func (p ParametersLiteral) GetDefaultXe() (Xe ring.DistributionParameters)

GetDefaultXe returns the Xe field of the target ParametersLiteral. The default value DefaultXe is returned if the field is nil.

func (ParametersLiteral) GetDefaultXs 

func (p ParametersLiteral) GetDefaultXs() (Xs ring.DistributionParameters)

GetDefaultXs returns the Xs field of the target ParametersLiteral. The default value DefaultXs is returned if the field is nil.

func (ParametersLiteral) GetDoubleAngle 

func (p ParametersLiteral) GetDoubleAngle() (DoubleAngle int, err error)

GetDoubleAngle returns the DoubleAngle field of the target ParametersLiteral. The default value DefaultDoubleAngle is returned if the field is nil.

func (ParametersLiteral) GetEphemeralSecretWeight 

func (p ParametersLiteral) GetEphemeralSecretWeight() (EphemeralSecretWeight int, err error)

GetEphemeralSecretWeight returns the EphemeralSecretWeight field of the target ParametersLiteral. The default value DefaultEphemeralSecretWeight is returned if the field is nil.

func (ParametersLiteral) GetEvalMod1LogScale 

func (p ParametersLiteral) GetEvalMod1LogScale() (EvalModLogScale int, err error)

GetEvalMod1LogScale returns the EvalModLogScale field of the target ParametersLiteral. The default value DefaultEvalModLogScale is returned if the field is nil.

func (ParametersLiteral) GetIterationsParameters 

func (p ParametersLiteral) GetIterationsParameters() (Iterations *IterationsParameters, err error)

GetIterationsParameters returns the IterationsParameters field of the target ParametersLiteral. The default value is nil.

func (ParametersLiteral) GetK 

func (p ParametersLiteral) GetK() (K int, err error)

GetK returns the K field of the target ParametersLiteral. The default value DefaultK is returned if the field is nil.

func (ParametersLiteral) GetLogMessageRatio 

func (p ParametersLiteral) GetLogMessageRatio() (LogMessageRatio int, err error)

GetLogMessageRatio returns the []LogMessageRatio field of the target ParametersLiteral. The default value DefaultLogMessageRatio is returned if the field is nil.

func (ParametersLiteral) GetLogN 

func (p ParametersLiteral) GetLogN() (LogN int)

GetLogN returns the LogN field of the target ParametersLiteral. The default value DefaultLogN is returned if the field is nil.

func (ParametersLiteral) GetLogP 

func (p ParametersLiteral) GetLogP(NumberOfQi int) (LogP []int)

GetLogP returns the list of bit-size of the primes Pi (extended primes for the key-switching) according to the number of #Qi (ciphertext primes). The default value is 61 * max(1, floor(sqrt(#Qi))).

func (ParametersLiteral) GetLogSlots 

func (p ParametersLiteral) GetLogSlots() (LogSlots int, err error)

GetLogSlots returns the LogSlots field of the target ParametersLiteral. The default value LogN-1 is returned if the field is nil.

func (ParametersLiteral) GetMod1Degree 

func (p ParametersLiteral) GetMod1Degree() (Mod1Degree int, err error)

GetMod1Degree returns the Mod1Degree field of the target ParametersLiteral. The default value DefaultMod1Degree is returned if the field is nil.

func (ParametersLiteral) GetMod1InvDegree 

func (p ParametersLiteral) GetMod1InvDegree() (Mod1InvDegree int, err error)

GetMod1InvDegree returns the Mod1InvDegree field of the target ParametersLiteral. The default value DefaultMod1InvDegree is returned if the field is nil.

func (ParametersLiteral) GetMod1Type 

func (p ParametersLiteral) GetMod1Type() (Mod1Type mod1.Type)

GetMod1Type returns the Mod1Type field of the target ParametersLiteral. The default value DefaultMod1Type is returned if the field is nil.

func (ParametersLiteral) GetSlotsToCoeffsFactorizationDepthAndLogScales 

func (p ParametersLiteral) GetSlotsToCoeffsFactorizationDepthAndLogScales(LogSlots int) (SlotsToCoeffsFactorizationDepthAndLogScales [][]int, err error)

GetSlotsToCoeffsFactorizationDepthAndLogScales returns a copy of the SlotsToCoeffsFactorizationDepthAndLogScales field of the target ParametersLiteral. The default value constructed from DefaultSlotsToCoeffsFactorizationDepth and DefaultSlotsToCoeffsLogScale is returned if the field is nil.

func (ParametersLiteral) MarshalBinary 

func (p ParametersLiteral) MarshalBinary() (data []byte, err error)

MarshalBinary returns a JSON representation of the the target ParametersLiteral struct on a slice of bytes. See Marshal from the encoding/json package.

func (*ParametersLiteral) UnmarshalBinary 

func (p *ParametersLiteral) UnmarshalBinary(data []byte) (err error)

UnmarshalBinary reads a JSON representation on the target ParametersLiteral struct. See Unmarshal from the encoding/json package.

type SecretKeyBootstrapper 

type SecretKeyBootstrapper struct {
	ckks.Parameters
	*ckks.Encoder
	*rlwe.Decryptor
	*rlwe.Encryptor

	Values   []*bignum.Complex
	Counter  int // records the number of bootstrapping
	MinLevel int
	// contains filtered or unexported fields
}

SecretKeyBootstrapper is an implementation of the rlwe.Bootstrapping interface that uses the secret-key to decrypt and re-encrypt the bootstrapped ciphertext.

func NewSecretKeyBootstrapper 

func NewSecretKeyBootstrapper(params ckks.Parameters, sk *rlwe.SecretKey) *SecretKeyBootstrapper

func (*SecretKeyBootstrapper) Bootstrap 

func (d *SecretKeyBootstrapper) Bootstrap(ct *rlwe.Ciphertext) (*rlwe.Ciphertext, error)

func (SecretKeyBootstrapper) BootstrapMany 

func (d SecretKeyBootstrapper) BootstrapMany(cts []rlwe.Ciphertext) ([]rlwe.Ciphertext, error)

func (SecretKeyBootstrapper) Depth 

func (d SecretKeyBootstrapper) Depth() int

func (SecretKeyBootstrapper) MinimumInputLevel 

func (d SecretKeyBootstrapper) MinimumInputLevel() int

func (SecretKeyBootstrapper) OutputLevel 

func (d SecretKeyBootstrapper) OutputLevel() int

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.