ckks

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 1, 2019 License: Apache-2.0 Imports: 9 Imported by: 0

README

CKKS

The package CKKS is an RNS-accelerated version of the Homomorphic Encryption for Arithmetic of Approximate Numbers (HEAAN, a.k.a. CKKS) scheme originally proposed by Cheon, Kim, Kim and Song. It provides approximate arithmetic over complex numbers.

Brief description

This scheme can be used to do arithmetic over equation. The plaintext space and the ciphertext space share the same domain

,

with a power of 2.

The batch encoding of this scheme

.

maps an array of complex numbers to a polynomial with the property:

,

where represents a component-wise product, and represents a nega-cyclic convolution.

Security parameters

equation: the ring dimension, which defines the degree of the cyclotomic polynomial, and the number of coefficients of the plaintext/ciphertext polynomials; it should always be a power of two. This parameter has an impact on both security and performance (security increases with N and performance decreases with N). It should be chosen carefully to suit the intended use of the scheme.

equation: the ciphertext modulus. In Lattigo, it is chosen to be the product of a chain of small coprime moduli equation verifying equation in order to enable both the RNS and NTT representation. The used moduli equation are chosen to be of size 30 to 60 bits for the best performance. This parameter has an impact on both security and performance (for a fixed equation, a higher equation implies both lower security and lower performance). It is closely related to equation and should be chosen carefully to suit the intended use of the scheme.

equation: the variance used for the error polynomials. This parameter is closely tied to the security of the scheme (a higher equation implies higher security).

Other parameters

equation: the plaintext scale. Since complex numbers are encoded on polynomials with integer coefficients, the original values must be scaled during the encoding, before being rounded to the nearest integer. The equation parameter is the power of two by which the values are multiplied during the encoding. It has an impact on the precision of the output and on the amount of operations a fresh encyrption can undergo before overflowing.

Choosing the right parameters for a given application

There are 3 application-dependent parameters:

  • LogN: it determines (a) how many values can be encoded (batched) at once (maximum N/2) in one plaintext, and (b) the maximum total modulus bit size (the product of all the moduli) for a given security parameter.
  • Modulichain: it determines how many consecutive scalar and non-scalar multiplications (the depth of the arithmetic circuit) can be evaluated before requiring decryption. Since Lattigo features an RNS implementation, this parameter requires careful fine-tuning depending on the application; i.e., the rescaling procedure can only rescale by one of the RNS modulus at a time, whose size has to be chosen when creating the ckkscontext. Additionally, the individual size of each of the moduli also has an effect on the error introduced during the rescaling, since they cannot be powers of 2, so they should be chosen as NTT primes as close as possible to a power of 2 instead.
  • Logscale: it determines the scale of the plaintext, affecting both the precision and the maximum allowed depth for a given security parameter.

Configuring parameters for CKKS is very application dependent, requiring a prior analysis of the circuit to be executed under encryption. The following example illustrates how this parametrization can be done, showing that it is possible to come up with different parameter sets for a given circuit, each set having pros and cons.

Let us define the evaluation of an arbitrary smooth function f(x) on an array of ~4000 complex elements contained in a square of side 2 centered at the complex origin (with values ranging between -1-1i and 1+1i). We first need to find a good polynomial approximation for the given range. Lattigo provides an automatic Chebyshev approximation for any given polynomial degree, which can be used for this purpose (it is also possible to define a different polynomial approximation of lower degree with an acceptable error).

Let us assume that we find an approximation of degree 5, i.e., a + bx + cx^3 + dx^5. This function can be evaluated with 3 scalar multiplications, 3 additions and 3 non-scalar multiplications, consuming a total of 4 levels (one for the scalar multiplications and 3 for the non-scalar multiplications).

We then need to chose a scale for the plaintext, that will influence both the bit consumption for the rescaling, and the precision of the computation. If we choose a scale of 2^40, we need to consume at least 160 bits (4 levels) during the evaluation, and we still need some bits left to store the final result with an acceptable precision. Let us assume that the output of the approximation lies always in the square between -20-20i and 20+20i; then, the final modulus must be at least 5 bits larger than the final scale (to preserve the integer precision).

The following parameters will work for the posed example:

  • LogN = 13
  • Modulichain = [45, 40, 40, 40, 40], for a logQ <= 205
  • LogScale = 40

But it is also possible to use less levels to have ciphertexts of smaller size and, therefore, a faster evaluation, at the expense of less precision. This can be achieved by using a scale of 30 bits and squeezing two multiplications in a single level, while pre-computing the last scalar multiplication already in the plaintext. Instead of evaluating a + bx + cx^3 + dx^5, we pre-multply the plaintext by d^(1/5) and evaluate a + b/(d^(1/5))x + c/(d^(3/5)) + x^5.

The following parameters are enough to evaluate this modified function:

  • LogN = 13
  • Modulichain = [35, 60, 60], for a logQ <= 155
  • LogScale = 30

To summarize, several parameter sets can be used to evaluate a given function, achieving different trade-offs for space and time versus precision.

Choosing secure parameters

The CKKS scheme supports the standard recommended parameters chosen to offer a security of 128 bits for a secret key with uniform ternary distribution equation, according to the Homomorphic Encryption Standards group (https://homomorphicencryption.org/standard/).

Each set of security parameters is defined by the tuple equation :

  • {11, 54, 3.2}
  • {12, 109, 3.2}
  • {13, 218, 3.2}
  • {14, 438, 3.2}
  • {15, 881, 3.2}

As mentioned, setting parameters for CKKS involves not only choosing this tuple, but also defining the actual moduli chain depending on the application at hand, which is why the provided default parameter sets have to be fine-tuned, preserving the values of the aforementioned tuples, in order to maintain the required security level of 128 bits. That is, Lattigo provides a set of default parameters for CKKS, including example moduli chains, ensuring 128 bit security. The user might want to choose different values in the moduli chain optimized for a specific application. As long as the total modulus is equal or below the above values for a given logN, the scheme will still provide a security of at least 128 bits against the current best known attacks.

Finally, it is worth noting that these security parameters are computed for fully entropic ternary keys (with probability distribution {1/3,1/3,1/3} for values {-1,0,1}). Lattigo uses this fully-entropic key configuration by default. It is possible, though, to generate keys with lower entropy, by modifying their distribution to {(1-p)/2, p, (1-p)/2}, for any p between 0 and 1, which for p>>1/3 can result in low Hamming weight keys (sparse keys). We recall that it has been shown that the security of sparse keys can be considerably lower than that of fully entropic keys, and the CKKS security parameters should be re-evaluated if sparse keys are used.

Documentation

Overview

Package ckks implements a RNS-accelerated version of the Homomorphic Encryption for Arithmetic for Approximate Numbers (HEAAN, a.k.a. CKKS) scheme. It provides approximate arithmetic over the complex numbers.

Index

Constants

View Source 
const MaxLogN = 16

MaxN is the largest supported polynomial modulus degree

View Source 
const MaxModuliCount = 34

MaxModuliCount is the largest supported number of moduli in the RNS representation

Variables

View Source 
var DefaultParams = map[uint64]*Parameters{
	11: {11, []uint8{54}, 45, 3.2},
	12: {12, []uint8{44, 32, 32}, 32, 3.2},
	13: {13, []uint8{49, 42, 42, 42, 42}, 42, 3.2},
	14: {14, []uint8{50, 43, 43, 43, 43, 43, 43, 43, 43, 43}, 43, 3.2},
	15: {15, []uint8{53, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46, 46}, 46, 3.2},
}

DefaultParams is a set of default CKKS parameters ensuring 128 bit security.

Functions

func Approximate 

func Approximate(function func(complex128) complex128, a, b complex128, degree int) (cheby *chebyshevinterpolation)

Approximate computes a Chebyshev approximation of the input function, for the tange [-a, b] of degree degree. To be used in conjonction with the function EvaluateCheby.

func GenerateCKKSPrimes 

func GenerateCKKSPrimes(logQ, logN, levels uint64) ([]uint64, error)

Generates CKKS Primes given logQ = size of the primes, logN = size of N and level, the number of levels we require. Will return all the appropriate primes, up to the number of level, with the best avaliable precision for the given level.

Types

type Ciphertext 

type Ciphertext struct {
	// contains filtered or unexported fields
}

Ciphertext is a BigPoly of degree > 0.

func (Ciphertext) Ciphertext added in v1.1.0 

func (el Ciphertext) Ciphertext() *Ciphertext

func (Ciphertext) Copy 

func (el Ciphertext) Copy(ctxCopy *ckksElement) (err error)

Copy copies the input element and its parameters on the target element.

func (Ciphertext) CopyNew 

func (el Ciphertext) CopyNew() *ckksElement

CopyNew creates a new element which is a copy of the target element.

func (Ciphertext) CopyParams 

func (el Ciphertext) CopyParams(ckkselement *ckksElement)

CopyParams copies the input element parameters on the target element

func (Ciphertext) CurrentModulus 

func (el Ciphertext) CurrentModulus() *ring.Int

func (Ciphertext) Degree 

func (el Ciphertext) Degree() uint64

func (Ciphertext) Element added in v1.1.0 

func (el Ciphertext) Element() *ckksElement

func (Ciphertext) InvNTT 

func (el Ciphertext) InvNTT(ckkscontext *CkksContext, c *ckksElement) error

InvNTT puts the target element outside of the NTT domain, and sets its isNTT flag to false. If it is not in the NTT domain, does nothing.

func (Ciphertext) IsNTT 

func (el Ciphertext) IsNTT() bool

func (Ciphertext) Level 

func (el Ciphertext) Level() uint64

func (*Ciphertext) MarshalBinary 

func (ciphertext *Ciphertext) MarshalBinary() ([]byte, error)

MarshalBinary encodes a ciphertext on a byte slice. The total size in byte is 4 + 2 * 8 * N * (level + 1).

func (Ciphertext) NTT 

func (el Ciphertext) NTT(ckkscontext *CkksContext, c *ckksElement) error

NTT puts the target element in the NTT domain and sets its isNTT flag to true. If it is already in the NTT domain, does nothing.

func (Ciphertext) Plaintext added in v1.1.0 

func (el Ciphertext) Plaintext() *Plaintext

func (Ciphertext) Resize 

func (el Ciphertext) Resize(ckkscontext *CkksContext, degree uint64)

func (Ciphertext) Scale 

func (el Ciphertext) Scale() uint64

func (Ciphertext) SetCurrentModulus 

func (el Ciphertext) SetCurrentModulus(modulus *ring.Int)

func (Ciphertext) SetIsNTT 

func (el Ciphertext) SetIsNTT(value bool)

func (Ciphertext) SetScale 

func (el Ciphertext) SetScale(scale uint64)

func (Ciphertext) SetValue 

func (el Ciphertext) SetValue(value []*ring.Poly)

func (*Ciphertext) UnMarshalBinary added in v1.1.0 

func (ciphertext *Ciphertext) UnMarshalBinary(data []byte) error

UnMarshalBinary decodes a previously marshaled ciphertext on the target ciphertext. The target ciphertext must be of the appropriate format and size, it can be created with the methode NewCiphertext(uint64, uin64t, uint64).

func (Ciphertext) Value 

func (el Ciphertext) Value() []*ring.Poly

type CkksContext 

type CkksContext struct {
	// contains filtered or unexported fields
}

CkksContext is a struct which contains all the elements required to instantiate the CKKS Scheme. This includes the parameters (N, ciphertext modulus, sampling, polynomial contexts and other parameters required for the homomorphic operations).

func NewCkksContext 

func NewCkksContext(params *Parameters) (ckkscontext *CkksContext, err error)

NewCkksContext creates a new CkksContext with the given parameters. Returns an error if one of the parameters would not ensure the correctness of the scheme (however it doesn't check for security).

func (*CkksContext) ContextKeys 

func (ckkscontext *CkksContext) ContextKeys() *ring.Context

ContextKeys returns the ring context under which the keys are created.

func (*CkksContext) Levels added in v1.1.0 

func (ckkscontext *CkksContext) Levels() uint64

Levels returns the number of levels of the ckkscontext.

func (*CkksContext) LogN added in v1.1.0 

func (ckkscontext *CkksContext) LogN() uint64

LogN returns logN of the ckkscontext.

func (*CkksContext) LogQ added in v1.1.0 

func (ckkscontext *CkksContext) LogQ() uint64

LogQ returns the log_2(prod(modulie)) of the ckkscontext.

func (*CkksContext) Moduli added in v1.1.0 

func (ckkscontext *CkksContext) Moduli() []uint64

Moduli returns the moduli of the ckkscontext.

func (*CkksContext) NewCiphertext 

func (ckkscontext *CkksContext) NewCiphertext(degree uint64, level uint64, scale uint64) *Ciphertext

NewCiphertext creates a new ciphertext parameterized by degree, level and scale.

func (*CkksContext) NewCkksElement added in v1.1.0 

func (ckkscontext *CkksContext) NewCkksElement(degree, level, scale uint64) *ckksElement

func (*CkksContext) NewDecryptor 

func (ckkscontext *CkksContext) NewDecryptor(sk *SecretKey) (*Decryptor, error)

NewDecryptor instanciates a new decryptor that will be able to decrypt ciphertext encrypted under the provided secret-key.

func (*CkksContext) NewEncoder added in v1.1.0 

func (ckkscontext *CkksContext) NewEncoder() (encoder *Encoder)

NewEncoder creates a new Encoder that is used to encode a slice of complex values of size at most N/2 (the number of slots) on a plaintext.

func (*CkksContext) NewEncryptorFromPk added in v1.1.0 

func (ckkscontext *CkksContext) NewEncryptorFromPk(pk *PublicKey) (*Encryptor, error)

NewEncryptorFromPk creates a new Encryptor with the provided public-key. This encryptor can be used to encrypt plaintexts, using the stored key.

func (*CkksContext) NewEncryptorFromSk added in v1.1.0 

func (ckkscontext *CkksContext) NewEncryptorFromSk(sk *SecretKey) (*Encryptor, error)

NewEncryptorFromSk creates a new Encryptor with the provided secret-key. This encryptor can be used to encrypt plaintexts, using the stored key.

func (*CkksContext) NewEvaluator 

func (ckkscontext *CkksContext) NewEvaluator() (evaluator *Evaluator)

NewEvaluator creates a new Evaluator, that can be used to do homomorphic operations on the ciphertexts and/or plaintexts. It stores a small pool of polynomials and ciphertexts that will be used for intermediate values.

func (*CkksContext) NewKeyGenerator 

func (ckkscontext *CkksContext) NewKeyGenerator() (keygen *KeyGenerator)

NewKeyGenerator creates a new keygenerator, from which the secret and public keys, as well as the evaluation, rotation and switching keys can be generated.

func (*CkksContext) NewPlaintext 

func (ckkscontext *CkksContext) NewPlaintext(level uint64, scale uint64) *Plaintext

NewPlaintext creates a new plaintext of level level and scale scale.

func (*CkksContext) NewRandomCiphertext 

func (ckkscontext *CkksContext) NewRandomCiphertext(degree, level, scale uint64) (ciphertext *Ciphertext)

NewRandoMCiphertext generates a new uniformely distributed ciphertext of degree, level and scale.

func (*CkksContext) Scale added in v1.1.0 

func (ckkscontext *CkksContext) Scale() uint64

Scale returns the default scalt of the ckkscontext.

func (*CkksContext) Sigma added in v1.1.0 

func (ckkscontext *CkksContext) Sigma() float64

Sigma returns the variance used by the target context to sample gaussian polynomials.

func (*CkksContext) Slots 

func (ckkscontext *CkksContext) Slots() uint64

Slots returns the number of slots that the scheme can encrypt at the same time.

type Decryptor 

type Decryptor struct {
	// contains filtered or unexported fields
}

Decryptor is a structure used to decrypt ciphertext. It stores the secret-key.

func (*Decryptor) Decrypt 

func (decryptor *Decryptor) Decrypt(ciphertext *Ciphertext, plaintext *Plaintext)

Decrypt decrypts the ciphertext and returns the result on the provided receiver plaintext. A Horner methode is used for evaluating the decryption.

func (*Decryptor) DecryptNew 

func (decryptor *Decryptor) DecryptNew(ciphertext *Ciphertext) (plaintext *Plaintext)

DecryptNew decrypts the ciphertext and returns a newly created plaintext. A Horner methode is used for evaluating the decryption.

type Encoder added in v1.1.0 

type Encoder struct {
	// contains filtered or unexported fields
}

Encoder is a struct storing the necessary parameters to encode a slice of complex number on a plaintext.

func (*Encoder) DecodeComplex added in v1.1.0 

func (encoder *Encoder) DecodeComplex(plaintext *Plaintext) (res []complex128)

DecodeFloat decodes the plaintext values to a slice of complex128 values of size at most N/2.

func (*Encoder) DecodeFloat added in v1.1.0 

func (encoder *Encoder) DecodeFloat(plaintext *Plaintext) (res []float64)

DecodeFloat decodes the plaintext values to a slice of float64 values of size at most N/2.

func (*Encoder) EncodeComplex added in v1.1.0 

func (encoder *Encoder) EncodeComplex(plaintext *Plaintext, coeffs []complex128) (err error)

EncodeFloat takes a slice of complex128 values of size at most N/2 (the number of slots) and encodes it on the receiver plaintext.

func (*Encoder) EncodeFloat added in v1.1.0 

func (encoder *Encoder) EncodeFloat(plaintext *Plaintext, coeffs []float64) (err error)

EncodeFloat takes a slice of float64 values of size at most N/2 (the number of slots) and encodes it on the receiver plaintext.

type Encryptor 

type Encryptor struct {
	// contains filtered or unexported fields
}

Encreyptor is a struct used to encrypt plaintext and storing the public-key and/or secret-key.

func (*Encryptor) Encrypt 

func (encryptor *Encryptor) Encrypt(plaintext *Plaintext, ciphertext *Ciphertext) (err error)

EncryptFromPk encrypts the input plaintext using the stored public-key, and returns the result on the reciver ciphertext. It will encrypt the plaintext with the stored key, which can be private or public, a private-key encryption puts initial noise.

encrypt with pk : ciphertext = [pk[0]*u + m + e_0, pk[1]*u + e_1] encrypt with sk : ciphertext = [-a*sk + m + e, a]

func (*Encryptor) EncryptNew 

func (encryptor *Encryptor) EncryptNew(plaintext *Plaintext) (ciphertext *Ciphertext, err error)

EncryptFromPkNew encrypts the input plaintext using the stored public-key and returns the result on a newly created ciphertext. It will encrypt the plaintext with the stored key, which can be private or public, a private-key encryption puts initial noise.

encrypt with pk : ciphertext = [pk[0]*u + m + e_0, pk[1]*u + e_1] encrypt with sk : ciphertext = [-a*sk + m + e, a]

type EvaluationKey 

type EvaluationKey struct {
	// contains filtered or unexported fields
}

Evaluationkey is a structure that stores the switching-keys required during the relinearization.

func (*EvaluationKey) MarshalBinary added in v1.1.0 

func (evaluationkey *EvaluationKey) MarshalBinary() (data []byte, err error)

MarshalBinary encodes an evaluation key on a byte slice. The total size depends on each modulus size and the bit decomp. It will approximately be 5 + (level + 1) * ( 1 + 2 * 8 * N * (level + 1) * logQi/bitDecomp).

func (*EvaluationKey) UnMarshalBinary added in v1.1.0 

func (evaluationkey *EvaluationKey) UnMarshalBinary(data []byte) (err error)

UnMarshalBinary decodes a previously marshaled evaluation-key on the target evaluation-key. The target evaluation-key must have the appropriate format and size, it can be created with the methode NewRelinKeyEmpty(uint64, uint64).

type Evaluator 

type Evaluator struct {
	// contains filtered or unexported fields
}

Evaluator is a struct holding the necessary elements to operates the homomorphic operations between ciphertext and/or plaintexts. It also holds a small memory pool used to store intermediate computations.

func (*Evaluator) Add 

func (evaluator *Evaluator) Add(op0, op1 Operand, ctOut *Ciphertext) (err error)

Add adds op0 to op1 and returns the result on ctOut.

func (*Evaluator) AddConst 

func (evaluator *Evaluator) AddConst(ct0 *Ciphertext, constant interface{}, ctOut *Ciphertext) (err error)

AddConstNew adds the input constant (which can be an uint64, int64, float64 or complex128) to ct0 and returns the result on ctOut.

func (*Evaluator) AddConstNew 

func (evaluator *Evaluator) AddConstNew(ct0 *Ciphertext, constant interface{}) (ctOut *Ciphertext)

AddConstNew adds the input constant (which can be an uint64, int64, float64 or complex128) to ct0 and returns the result on a new element.

func (*Evaluator) AddNew 

func (evaluator *Evaluator) AddNew(op0, op1 Operand) (ctOut *Ciphertext, err error)

Add adds op0 to op1 and returns the result on a newly created element.

func (*Evaluator) AddNoMod 

func (evaluator *Evaluator) AddNoMod(op0, op1 Operand, ctOut *Ciphertext) (err error)

AddNoMod adds op0 to op1 and returns the result on ctOut, without modular reduction.

func (*Evaluator) AddNoModNew 

func (evaluator *Evaluator) AddNoModNew(op0, op1 Operand) (ctOut *Ciphertext, err error)

Add adds op0 to op1 without modular reduction, and returns the result on a newly created element.

func (*Evaluator) Conjugate 

func (evaluator *Evaluator) Conjugate(ct0 *Ciphertext, evakey *RotationKey, ctOut *Ciphertext) (err error)

ConjugateNew conjugates c0 (which is equivalement to a row rotation) and returns the result on c1. If the provided element is a ciphertext, a keyswitching operation is necessary and a rotation key for the row rotation needs to be provided.

func (*Evaluator) ConjugateNew 

func (evaluator *Evaluator) ConjugateNew(ct0 *Ciphertext, evakey *RotationKey) (ctOut *Ciphertext, err error)

ConjugateNew conjugates ct0 (which is equivalement to a row rotation) and returns the result on a newly created element. If the provided element is a ciphertext, a keyswitching operation is necessary and a rotation key for the row rotation needs to be provided.

func (*Evaluator) DivByi 

func (evaluator *Evaluator) DivByi(ct0 *Ciphertext, c1 *Ciphertext) (err error)

DivByi multiplies ct0 by the imaginary number 1/i = -i, and returns the result on c1. Does not change the scale.

func (*Evaluator) DivByiNew 

func (evaluator *Evaluator) DivByiNew(ct0 *Ciphertext) (ctOut *Ciphertext, err error)

DivByiNew multiplies ct0 by the imaginary number 1/i = -i, and returns the result on a newly created element. Does not change the scale.

func (*Evaluator) DropLevel 

func (evaluator *Evaluator) DropLevel(ct0 *ckksElement, levels uint64) error

DropLevel reduces the level of ct0 by levels and returns the result on ct0. No rescaling is applied during this procedure.

func (*Evaluator) DropLevelNew 

func (evaluator *Evaluator) DropLevelNew(ct0 *ckksElement, levels uint64) (ctOut *ckksElement, err error)

DropLevel reduces the level of ct0 by levels and returns the result on a newly created element. No rescaling is applied during this procedure.

func (*Evaluator) EvaluateCheby 

func (evaluator *Evaluator) EvaluateCheby(ct *Ciphertext, cheby *chebyshevinterpolation, evakey *EvaluationKey) (res *Ciphertext, err error)

EvaluateCheby evaluates a chebyshev approximation in log(n) + 1 (+1 if 2/(b-a) is not a gaussian integer) levels.

func (*Evaluator) ExtractImag 

func (evaluator *Evaluator) ExtractImag(ct0 *Ciphertext, evakey *RotationKey, ctOut *Ciphertext) (err error)

ExtractImag sets the real part of ct0 to the imaginary part of ct0 and sets the imaginary part of ct0 to zero, and returns the result on ctOut. ex. f(a + b*i) = b. Requires a rotationkey for which the conjugate key has been generated. Scale is increased by one.

func (*Evaluator) ExtractImagNew 

func (evaluator *Evaluator) ExtractImagNew(ct0 *Ciphertext, evakey *RotationKey) (ctOut *Ciphertext, err error)

ExtractImagNew sets the real part of ct0 to the imaginary part of ct0 and sets the imaginary part of ct0 to zero, and returns the result on a new element. ex. f(a + b*i) = b. Requires a rotationkey for which the conjugate key has been generated. Scale is increased by one.

func (*Evaluator) InverseNew 

func (evaluator *Evaluator) InverseNew(ct0 *Ciphertext, steps uint64, evakey *EvaluationKey) (res *Ciphertext, err error)

InverseNew computes 1/ct0 and returns the result on a new element, iterating for n steps and consuming n levels. The algorithm requires the encrypted values to be in the range [-1.5 - 1.5i, 1.5 + 1.5i] or the result will be wrong. Each iteration increases the precision.

func (*Evaluator) MulByPow2 

func (evaluator *Evaluator) MulByPow2(ct0 *ckksElement, pow2 uint64, ctOut *ckksElement) (err error)

MutByPow2New multiplies ct0 by 2^pow2 and returns the result on ctOut.

func (*Evaluator) MulByPow2New 

func (evaluator *Evaluator) MulByPow2New(ct0 *Ciphertext, pow2 uint64) (ctOut *Ciphertext, err error)

MutByPow2New multiplies the ct0 by 2^pow2 and returns the result on a newly created element.

func (*Evaluator) MulRelin 

func (evaluator *Evaluator) MulRelin(op0, op1 Operand, evakey *EvaluationKey, ctOut *Ciphertext) error

MulRelinNew multiplies ct0 by ct1 and returns the result on ctOut. The new scale is the multiplication between scales of the input elements (addition when the scale is represented in log2). An evaluation key can be provided to apply a relinearization step and reduce the degree of the output element. This evaluation key is only required when the two inputs elements are ciphertexts. If not evaluationkey is provided and the input elements are two ciphertexts, the resulting ciphertext will be of degree two. This function only accepts plaintexts (degree zero) and/or ciphertexts of degree one.

func (*Evaluator) MulRelinNew 

func (evaluator *Evaluator) MulRelinNew(op0, op1 Operand, evakey *EvaluationKey) (ctOut *Ciphertext, err error)

MulRelinNew multiplies ct0 by ct1 and returns the result on a newly created element. The new scale is the multiplication between scales of the input elements (addition when the scale is represented in log2). An evaluation key can be provided to apply a relinearization step and reduce the degree of the output element. This evaluation key is only required when the two inputs elements are ciphertexts. If not evaluationkey is provided and the input elements are two ciphertexts, the resulting ciphertext will be of degree two. This function only accepts plaintexts (degree zero) and/or ciphertexts of degree one.

func (*Evaluator) MultByConstAndAdd 

func (evaluator *Evaluator) MultByConstAndAdd(ct0 *Ciphertext, constant interface{}, ctOut *Ciphertext) (err error)

MultByConstAndAdd multiplies ct0 by the input constant, and adds it to the receiver element (does not modify the input element), ex. ctOut(x) = ctOut(x) + ct0(x) * (a+bi). This functions removes the need of storing the intermediate value c(x) * (a+bi). This function will modifie the level and the scale of the receiver element depending on the level and the scale of the input element and the type of the constant. The level of the receiver element will be set to min(input.level, receiver.level). The scale of the receiver element will be set to the scale that the input element would have after the multiplication by the constant.

func (*Evaluator) MultByi 

func (evaluator *Evaluator) MultByi(ct0 *Ciphertext, ctOut *Ciphertext) (err error)

MultByiNew multiplies ct0 by the imaginary number i, and returns the result on c1. Does not change the scale.

func (*Evaluator) MultByiNew 

func (evaluator *Evaluator) MultByiNew(ct0 *Ciphertext) (ctOut *Ciphertext, err error)

MultByiNew multiplies ct0 by the imaginary number i, and returns the result on a newly created element. Does not change the scale.

func (*Evaluator) MultConst 

func (evaluator *Evaluator) MultConst(ct0 *Ciphertext, constant interface{}, ctOut *Ciphertext) (err error)

MultConstNew multiplies ct0 by the input constant and returns the result on ctOut. The scale of the output element will depend on the scale of the input element and the constant (if the constant needs to be scaled (its rational part is not zero)). The constant can be an uint64, int64, float64 or complex128.

func (*Evaluator) MultConstNew 

func (evaluator *Evaluator) MultConstNew(ct0 *Ciphertext, constant interface{}) (ctOut *Ciphertext, err error)

MultConstNew multiplies ct0 by the input constant and returns the result on a newly created element. The scale of the output element will depend on the scale of the input element and the constant (if the constant needs to be scaled (its rational part is not zero)). The constant can be an uint64, int64, float64 or complex128.

func (*Evaluator) Neg 

func (evaluator *Evaluator) Neg(ct0 *Ciphertext, ctOut *Ciphertext) (err error)

Neg negates the ct0 and returns the result on ctOut.

func (*Evaluator) NegNew 

func (evaluator *Evaluator) NegNew(ct0 *Ciphertext) (ctOut *Ciphertext)

Neg negates ct0 and returns the result on a newly created element.

func (*Evaluator) Power 

func (evaluator *Evaluator) Power(ct0 *Ciphertext, degree uint64, evakey *EvaluationKey, res *Ciphertext) (err error)

Power compute ct0^degree, consuming log(degree) levels, and returns the result on res. Providing an evaluation key is necessary when degree > 2.

func (*Evaluator) PowerNew 

func (evaluator *Evaluator) PowerNew(op *Ciphertext, degree uint64, evakey *EvaluationKey) (opOut *Ciphertext)

Power compute ct0^degree, consuming log(degree) levels, and returns the result on a new element. Providing an evaluation key is necessary when degree > 2.

func (*Evaluator) PowerOf2 

func (evaluator *Evaluator) PowerOf2(el0 *Ciphertext, logPow2 uint64, evakey *EvaluationKey, elOut *Ciphertext) (err error)

PowerOf2 compute ct0^(2^logPow2), consuming logPow2 levels, and returns the result on ct1. Providing an evaluation key is necessary when logPow2 > 1.

func (*Evaluator) Reduce 

func (evaluator *Evaluator) Reduce(ct0 *Ciphertext, ctOut *Ciphertext) error

Reduce applies a modular reduction ct0 and returns the result on ctOut. To be used in conjonction with function not applying modular reduction.

func (*Evaluator) ReduceNew 

func (evaluator *Evaluator) ReduceNew(ct0 *Ciphertext) (ctOut *Ciphertext)

Reduce applies a modular reduction ct0 and returns the result on a newly created element. To be used in conjonction with function not applying modular reduction.

func (*Evaluator) Relinearize 

func (evaluator *Evaluator) Relinearize(ct0 *Ciphertext, evakey *EvaluationKey, ctOut *Ciphertext) (err error)

RelinearizeNew applies the relinearization procedure on ct0 and returns the result on ctOut. Requires the input ciphertext to be of degree two.

func (*Evaluator) RelinearizeNew 

func (evaluator *Evaluator) RelinearizeNew(ct0 *Ciphertext, evakey *EvaluationKey) (ctOut *Ciphertext, err error)

RelinearizeNew applies the relinearization procedure on ct0 and returns the result on a newly created ciphertext. Requires the input ciphertext to be of degree two.

func (*Evaluator) RemoveImag 

func (evaluator *Evaluator) RemoveImag(ct0 *Ciphertext, evakey *RotationKey, ctOut *Ciphertext) (err error)

RemoveImag sets the imaginary part of ct0 to zero and returns the result on ctOut, ex. f(a + b*i) = a. Requires a rotationkey for which the conjugate key has been generated. Scale is increased by one.

func (*Evaluator) RemoveImagNew 

func (evaluator *Evaluator) RemoveImagNew(ct0 *Ciphertext, evakey *RotationKey) (ctOut *Ciphertext, err error)

RemoveImagNew sets the imaginary part of ct0 to zero and returns the result on a newly created element, ex. f(a + b*i) = a. Requires a rotationkey for which the conjugate key has been generated. Scale is increased by one.

func (*Evaluator) RemoveReal 

func (evaluator *Evaluator) RemoveReal(ct0 *Ciphertext, evakey *RotationKey, ctOut *Ciphertext) (err error)

RemoveReal sets the real part of ct0 to zero and returns the result on ctOut, ex. f(a + b*i) = b*i. Requires a rotationkey for which the conjugate key has been generated. Scale is increased by one.

func (*Evaluator) RemoveRealNew 

func (evaluator *Evaluator) RemoveRealNew(ct0 *Ciphertext, evakey *RotationKey) (ctOut *Ciphertext, err error)

RemoveRealNew sets the real part of ct0 to zero and returns the result on a newly created element, ex. f(a + b*i) = b*i. Requires a rotationkey for which the conjugate key has been generated. Scale is increased by one.

func (*Evaluator) Rescale 

func (evaluator *Evaluator) Rescale(ct0, c1 *Ciphertext) (err error)

RescaleNew divides ct0 by the last modulus in the modulus chain, repeats this procedure (each time consuming a level) until the scale reaches the original scale or would go below it, and returns the result on c1. Since all the moduli in the modulus chain are generated to be close to the original scale, this procedure is equivalement to dividing the input element by the scale and adding some error.

func (*Evaluator) RescaleNew 

func (evaluator *Evaluator) RescaleNew(ct0 *Ciphertext) (ctOut *Ciphertext, err error)

RescaleNew divides ct0 by the last modulus in the modulus chain, repeats this procedure (each time consuming a level) until the scale reaches the original scale or would go below it, and returns the result on a newly created element. Since all the moduli in the modulus chain are generated to be close to the original scale, this procedure is equivalement to dividing the input element by the scale and adding some error.

func (*Evaluator) RotateColumns 

func (evaluator *Evaluator) RotateColumns(ct0 *Ciphertext, k uint64, evakey *RotationKey, ctOut *Ciphertext) (err error)

RotateColumns rotates the columns of ct0 by k position to the left and returns the result on the provided receiver. If the provided element is a ciphertext, a keyswitching operation is necessary and a rotation key for the specific rotation needs to be provided.

func (*Evaluator) RotateColumnsNew 

func (evaluator *Evaluator) RotateColumnsNew(ct0 *Ciphertext, k uint64, evakey *RotationKey) (ctOut *Ciphertext, err error)

RotateColumnsNew rotates the columns of ct0 by k position to the left, and returns the result on a newly created element. If the provided element is a ciphertext, a keyswitching operation is necessary and a rotation key for the specific rotation needs to be provided.

func (*Evaluator) ScaleUp 

func (evaluator *Evaluator) ScaleUp(ct0 *Ciphertext, scale uint64, ctOut *Ciphertext) (err error)

ScaleUpNew multiplies ct0 by 2^scale and sets its scale to its previous scale plus 2^n. Returns the result on ctOut.

func (*Evaluator) ScaleUpNew 

func (evaluator *Evaluator) ScaleUpNew(ct0 *Ciphertext, scale uint64) (ctOut *Ciphertext, err error)

ScaleUpNew multiplies ct0 by 2^scale and sets its scale to its previous scale plus 2^n. Returns the result on a newly created element.

func (*Evaluator) Sub 

func (evaluator *Evaluator) Sub(op0, op1 Operand, ctOut *Ciphertext) (err error)

Sub subtracts op0 to op1 and returns the result on ctOut.

func (*Evaluator) SubNew 

func (evaluator *Evaluator) SubNew(op0, op1 Operand) (ctOut *Ciphertext, err error)

SubNew subtracts op0 to op1 and returns the result on a newly created element.

func (*Evaluator) SubNoMod 

func (evaluator *Evaluator) SubNoMod(op0, op1 Operand, ctOut *Ciphertext) (err error)

SubNoMod subtracts op0 to op1 and returns the result on ctOut, without modular reduction.

func (*Evaluator) SubNoModNew 

func (evaluator *Evaluator) SubNoModNew(op0, op1 Operand) (ctOut *Ciphertext, err error)

SubNoModNew subtracts op0 to op1 without modular reduction, and returns the result on a newly created element.

func (*Evaluator) SwapRealImag 

func (evaluator *Evaluator) SwapRealImag(ct0 *Ciphertext, evakey *RotationKey, ctOut *Ciphertext) (err error)

SwapRealImagNew swaps the real and imaginary parts of ct0 and returns the result on ctOut, ex. f(a + b*i) = b + a * i. Requires a rotationkey for which the conjugate key has been generated.

func (*Evaluator) SwapRealImagNew 

func (evaluator *Evaluator) SwapRealImagNew(ct0 *Ciphertext, evakey *RotationKey) (ctOut *Ciphertext, err error)

SwapRealImagNew swaps the real and imaginary parts of ct0 and returns the result on a newly created element, ex. f(a + b*i) = b + a * i. Requires a rotationkey for which the conjugate key has been generated.

func (*Evaluator) SwitchKeys 

func (evaluator *Evaluator) SwitchKeys(ct0 *Ciphertext, switchingKey *SwitchingKey, ctOut *Ciphertext) error

Switchkeys re-encrypts ct0 under a different key and returns the result on ctOut. Requires a switchinkey, which is computed from the key under which the ciphertext is currently encrypted, and the key under which the ciphertext will be re-encrypted.

func (*Evaluator) SwitchKeysNew 

func (evaluator *Evaluator) SwitchKeysNew(ct0 *Ciphertext, switchingKey *SwitchingKey) (ctOut *Ciphertext, err error)

Switchkeys re-encrypts ct0 under a different key and returns the result on a newly created element. Requires a switchinkey, which is computed from the key under which the ciphertext is currently encrypted, and the key under which the ciphertext will be re-encrypted.

type KeyGenerator 

type KeyGenerator struct {
	// contains filtered or unexported fields
}

Keygenerator is a structure that stores the elements required to create new keys, as well as a small memory pool for intermediate values.

func (*KeyGenerator) NewKeyPair 

func (keygen *KeyGenerator) NewKeyPair() (sk *SecretKey, pk *PublicKey)

NewKeyPair generates a new secretkey with distribution [1/3, 1/3, 1/3] and a corresponding public key.

func (*KeyGenerator) NewPublicKey 

func (keygen *KeyGenerator) NewPublicKey(sk *SecretKey) (pk *PublicKey, err error)

NewPublicKey generates a new public key from the provided secret key.

func (*KeyGenerator) NewPublicKeyEmpty added in v1.1.0 

func (keygen *KeyGenerator) NewPublicKeyEmpty() (pk *PublicKey)

func (*KeyGenerator) NewRelinKey 

func (keygen *KeyGenerator) NewRelinKey(sk *SecretKey, bitDecomp uint64) (evakey *EvaluationKey, err error)

NewRelinkey generates a new evaluation key that will be used to relinearize the ciphertexts during multiplication. Bitdecomposition aims at reducing the added noise at the expense of more storage needed for the keys and more computation during the relinearization. However for relinearization this bitdecomp value can be set to maximum as the encrypted value are also scaled up during the multiplication.

func (*KeyGenerator) NewRelinKeyEmpty added in v1.1.0 

func (keygen *KeyGenerator) NewRelinKeyEmpty(bitDecomp uint64) (evakey *EvaluationKey)

func (*KeyGenerator) NewRotationKeys 

func (keygen *KeyGenerator) NewRotationKeys(sk_output *SecretKey, bitDecomp uint64, rotLeft []uint64, rotRight []uint64, conjugate bool) (rotKey *RotationKey, err error)

NewRotationKeys generates a new instance of rotationkeys, with the provided rotation to the left, right and conjugation if asked. Here bitdecomp plays a role in the added noise if the scale of the input is smaller than the maximum size between the modulies.

func (*KeyGenerator) NewRotationKeysEmpty added in v1.1.0 

func (keygen *KeyGenerator) NewRotationKeysEmpty() (rotKey *RotationKey)

NewRotationKeys generates a new instance of rotationkeys, with the provided rotation to the left, right and conjugation if asked. Here bitdecomp plays a role in the added noise if the scale of the input is smaller than the maximum size between the modulies.

func (*KeyGenerator) NewRotationKeysPow2 

func (keygen *KeyGenerator) NewRotationKeysPow2(sk_output *SecretKey, bitDecomp uint64, conjugate bool) (rotKey *RotationKey, err error)

NewRotationkeysPow2 generates a new rotation key with all the power of two rotation to the left and right, as well as the conjugation key if asked. Here bitdecomp plays a role in the added noise if the scale of the input is smaller than the maximum size between the modulies.

func (*KeyGenerator) NewSecretKey 

func (keygen *KeyGenerator) NewSecretKey() (sk *SecretKey)

NewSecretKey generates a new secret key with the distribution [1/3, 1/3, 1/3].

func (*KeyGenerator) NewSecretKeyEmpty added in v1.1.0 

func (keygen *KeyGenerator) NewSecretKeyEmpty() *SecretKey

func (*KeyGenerator) NewSecretKeyWithDistrib added in v1.1.0 

func (keygen *KeyGenerator) NewSecretKeyWithDistrib(p float64) (sk *SecretKey, err error)

NewSecretKey generates a new secret key with the distribution [(p-1)/2, p, (p-1)/2].

func (*KeyGenerator) NewSwitchingKey 

func (keygen *KeyGenerator) NewSwitchingKey(sk_input, sk_output *SecretKey, bitDecomp uint64) (newevakey *SwitchingKey, err error)

NewSwitchingKey generated a new keyswitching key, that will re-encrypt a ciphertext encrypted under the input key to the output key. Here bitdecomp plays a role in the added noise if the scale of the input is smaller than the maximum size between the modulies.

func (*KeyGenerator) NewSwitchingKeyEmpty added in v1.1.0 

func (keygen *KeyGenerator) NewSwitchingKeyEmpty(bitDecomp uint64) (evakey *SwitchingKey)

func (*KeyGenerator) SetRelinKeys 

func (keygen *KeyGenerator) SetRelinKeys(rlk [][][2]*ring.Poly, bitDecomp uint64) (*EvaluationKey, error)

type Operand added in v1.1.0 

type Operand interface {
	Element() *ckksElement
	Degree() uint64
	Level() uint64
	Scale() uint64
}

type Parameters added in v1.1.0 

type Parameters struct {
	LogN        uint8
	Modulichain []uint8
	Logscale    uint8
	Sigma       float64
}

Parameters is a struct storing the necessary parameters to instantiate a new ckkscontext.

logN : the ring degree such that N = 2^logN

modulichain : a list of moduli in bit size, such that prod(moduli) <= logQ, where logQ is the maximum bit size of the product of all the moduli for a given security parameter. This moduli chain allows to customize the value by which the ciphertexts will be rescaled allong the homomorphic computations, and can enhance performances for optimized applications.

logScale : the default scale of the scheme such that scale = 2^logScale

sigma : the variance used by the ckkscontext to sample gaussian polynomials.

func (*Parameters) Equals added in v1.1.0 

func (p *Parameters) Equals(other *Parameters) bool

Equals compares two sets of parameters for equality

func (*Parameters) MarshalBinary added in v1.1.0 

func (p *Parameters) MarshalBinary() ([]byte, error)

MarshalBinary returns a []byte representation of the parameter set

func (*Parameters) UnMarshalBinary added in v1.1.0 

func (p *Parameters) UnMarshalBinary(data []byte) error

UnMarshalBinary decodes a []byte into a parameter set struct

type Plaintext 

type Plaintext struct {
	// contains filtered or unexported fields
}

Plaintext is BigPoly of degree 0.

func (Plaintext) Ciphertext added in v1.1.0 

func (el Plaintext) Ciphertext() *Ciphertext

func (Plaintext) Copy 

func (el Plaintext) Copy(ctxCopy *ckksElement) (err error)

Copy copies the input element and its parameters on the target element.

func (Plaintext) CopyNew 

func (el Plaintext) CopyNew() *ckksElement

CopyNew creates a new element which is a copy of the target element.

func (Plaintext) CopyParams 

func (el Plaintext) CopyParams(ckkselement *ckksElement)

CopyParams copies the input element parameters on the target element

func (Plaintext) CurrentModulus 

func (el Plaintext) CurrentModulus() *ring.Int

func (Plaintext) Degree 

func (el Plaintext) Degree() uint64

func (Plaintext) Element added in v1.1.0 

func (el Plaintext) Element() *ckksElement

func (Plaintext) InvNTT 

func (el Plaintext) InvNTT(ckkscontext *CkksContext, c *ckksElement) error

InvNTT puts the target element outside of the NTT domain, and sets its isNTT flag to false. If it is not in the NTT domain, does nothing.

func (Plaintext) IsNTT 

func (el Plaintext) IsNTT() bool

func (Plaintext) Level 

func (el Plaintext) Level() uint64

func (Plaintext) NTT 

func (el Plaintext) NTT(ckkscontext *CkksContext, c *ckksElement) error

NTT puts the target element in the NTT domain and sets its isNTT flag to true. If it is already in the NTT domain, does nothing.

func (Plaintext) Plaintext added in v1.1.0 

func (el Plaintext) Plaintext() *Plaintext

func (Plaintext) Resize 

func (el Plaintext) Resize(ckkscontext *CkksContext, degree uint64)

func (Plaintext) Scale 

func (el Plaintext) Scale() uint64

func (Plaintext) SetCurrentModulus 

func (el Plaintext) SetCurrentModulus(modulus *ring.Int)

func (Plaintext) SetIsNTT 

func (el Plaintext) SetIsNTT(value bool)

func (Plaintext) SetScale 

func (el Plaintext) SetScale(scale uint64)

func (Plaintext) SetValue 

func (el Plaintext) SetValue(value []*ring.Poly)

func (Plaintext) Value 

func (el Plaintext) Value() []*ring.Poly

type PublicKey 

type PublicKey struct {
	// contains filtered or unexported fields
}

Publickey is a structure that stores the public-key

func (*PublicKey) Get 

func (pk *PublicKey) Get() [2]*ring.Poly

Get returns the value of the the public key.

func (*PublicKey) MarshalBinary added in v1.1.0 

func (pk *PublicKey) MarshalBinary() (data []byte, err error)

MarshalBinary encodes a public-key on a byte slice. The total size is 2 + 16 * N * (level + 1).

func (*PublicKey) Set 

func (pk *PublicKey) Set(poly [2]*ring.Poly)

Set sets the value of the public key to the provided value.

func (*PublicKey) UnMarshalBinary added in v1.1.0 

func (pk *PublicKey) UnMarshalBinary(data []byte) (err error)

UnMarshalBinary decodes a previously marshaled public-key on the target public-key. The target public-key must have the appropriate format and size, it can be created with the methode NewPublicKeyEmpty().

type RotationKey 

type RotationKey struct {
	// contains filtered or unexported fields
}

Rotationkeys is a structure that stores the switching-keys required during the homomorphic rotations.

func (*RotationKey) MarshalBinary added in v1.1.0 

func (rotationkey *RotationKey) MarshalBinary() (data []byte, err error)

MarshalBinary encodes a rotationkeys structure on a byte slice. The total size in byte is approximately 5 + 4*(nb left rot + num right rot) + (nb left rot + num right rot + 1 (if rotate row)) * (level + 1) * ( 1 + 2 * 8 * N * (level + 1) * logQi/bitDecomp).

func (*RotationKey) UnMarshalBinary added in v1.1.0 

func (rotationkey *RotationKey) UnMarshalBinary(data []byte) (err error)

UnMarshalBinary decodes a previously marshaled rotation-keys on the target rotation-keys. In contrary to all the other structures, the unmarshaling for rotationkeys only need an empty receiver, as it is not possible to create receiver of the correct format and size without knowing all the content of the marshaled rotationkeys. The memory will be allocated on the fly.

type SecretKey 

type SecretKey struct {
	// contains filtered or unexported fields
}

Secretkey is a structure that stores the secret-key

func (*SecretKey) Get 

func (sk *SecretKey) Get() *ring.Poly

Get returns the secret key value of the secret key.

func (*SecretKey) MarshalBinary added in v1.1.0 

func (sk *SecretKey) MarshalBinary() (data []byte, err error)

MarshalBinary encodes a secret-key on a byte slice. The total size in byte is 1 + N/4.

func (*SecretKey) Set 

func (sk *SecretKey) Set(poly *ring.Poly)

Set sets the value of the secret key to the provided value.

func (*SecretKey) UnMarshalBinary added in v1.1.0 

func (sk *SecretKey) UnMarshalBinary(data []byte) (err error)

UnMarshalBinary decode a previously marshaled secret-key on the target secret-key. The target secret-key must be of the appropriate format, it can be created with the methode NewSecretKeyEmpty().

type SwitchingKey 

type SwitchingKey struct {
	// contains filtered or unexported fields
}

Switchingkey is a structure that stores the switching-keys required during the key-switching.

func (*SwitchingKey) MarshalBinary added in v1.1.0 

func (switchingkey *SwitchingKey) MarshalBinary() (data []byte, err error)

MarshalBinary encodes an switching-key on a byte slice. The total size in byte will be approximately 5 + (level + 1) * ( 1 + 2 * 8 * N * (level + 1) * logQi/bitDecomp).

func (*SwitchingKey) UnMarshalBinary added in v1.1.0 

func (switchingkey *SwitchingKey) UnMarshalBinary(data []byte) (err error)

UnMarshalBinary decode a previously marshaled switching-key on the target switching-key. The target switching-key must have the appropriate format and size, it can be created with the methode NewSwitchingKeyEmpty(uint64).

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.