Program Listing for File rgsw-cryptoparameters.h

↰ Return to documentation for file (binfhe/include/rgsw-cryptoparameters.h)

//==================================================================================
// BSD 2-Clause License
//
// Copyright (c) 2014-2026, NJIT, Duality Technologies Inc. and other contributors
//
// All rights reserved.
//
// Author TPOC: contact@openfhe.org
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice, this
//    list of conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice,
//    this list of conditions and the following disclaimer in the documentation
//    and/or other materials provided with the distribution.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
//==================================================================================

#ifndef SRC_BINFHE_INCLUDE_RGSW_CRYPTOPARAMETERS_H_
#define SRC_BINFHE_INCLUDE_RGSW_CRYPTOPARAMETERS_H_

#include <cstdint>
#include <map>
#include <memory>
#include <string>
#include <unordered_map>
#include <utility>
#include <vector>

#include "binfhe-constants.h"
#include "lattice/lat-hal.h"
#include "lwe-ciphertext.h"
#include "lwe-cryptoparameters.h"
#include "lwe-keyswitchkey.h"
#include "math/discretegaussiangenerator.h"
#include "math/nbtheory.h"
#include "utils/serializable.h"
#include "utils/utilities.h"

namespace lbcrypto {

class RingGSWCryptoParams : public Serializable {
  public:
    RingGSWCryptoParams() = default;

    explicit RingGSWCryptoParams(uint32_t N, NativeInteger Q, NativeInteger q, uint32_t baseG, uint32_t baseR,
                                 BINFHE_METHOD method, double std, SecretKeyDist keyDist = UNIFORM_TERNARY,
                                 bool signEval = false, uint32_t numAutoKeys = 10)
        : m_Q(Q),
          m_q(q),
          m_N(N),
          m_baseG(baseG),
          m_baseR(baseR),
          m_polyParams{std::make_shared<ILNativeParams>(2 * N, Q)},
          m_method(method),
          m_keyDist(keyDist),
          m_numAutoKeys(numAutoKeys) {
        if (baseG <= 1 || !IsPowerOfTwo(baseG))
            OPENFHE_THROW("Gadget base should be a power of two.");
        if ((method == LMKCDEY) && (numAutoKeys == 0))
            OPENFHE_THROW("numAutoKeys should be greater than 0.");
        m_digitsG = DigitsForBase(m_Q, m_baseG);
        CheckDigitsG(m_baseG, m_digitsG);
        m_dgg.SetStd(std);
        PreCompute(signEval);
    }

    explicit RingGSWCryptoParams(uint32_t N, NativeInteger Q, NativeInteger q, uint32_t baseG,
                                 const std::map<uint32_t, uint32_t>& baseGMap, uint32_t baseR, BINFHE_METHOD method,
                                 double std, SecretKeyDist keyDist = UNIFORM_TERNARY, bool signEval = false,
                                 uint32_t numAutoKeys = 10)
        : m_Q(Q),
          m_q(q),
          m_N(N),
          m_baseG(baseG),
          m_baseG_map(baseGMap),
          m_baseR(baseR),
          m_polyParams{std::make_shared<ILNativeParams>(2 * N, Q)},
          m_method(method),
          m_keyDist(keyDist),
          m_numAutoKeys(numAutoKeys) {
        if (baseGMap.empty())
            OPENFHE_THROW("Gadget base map should not be empty.");
        if (!IsPowerOfTwo(baseG))
            OPENFHE_THROW("Gadget base should be a power of two.");
        for (const auto& [baseG, count] : baseGMap) {
            if (count == 0 || baseG <= 1 || !IsPowerOfTwo(baseG))
                OPENFHE_THROW("Gadget base should be a power of two and its count should be greater than zero.");
            CheckDigitsG(baseG, DigitsForBase(Q, baseG));
        }
        if ((method == LMKCDEY) && (numAutoKeys == 0))
            OPENFHE_THROW("numAutoKeys should be greater than 0.");
        m_digitsG = DigitsForBase(m_Q, m_baseG);
        CheckDigitsG(m_baseG, m_digitsG);
        m_dgg.SetStd(std);
        PreCompute(signEval);
    }

    struct BaseGParams {
        uint32_t baseG{0};
        uint32_t digitsG{0};
        uint32_t gBits{0};
        const std::vector<NativeInteger>* gpow{nullptr};
        uint32_t teamWidth{0};
    };

    void PreCompute(bool signEval = false);

    const std::vector<NativeInteger>& PrecomputeGPower(uint32_t baseG);

    uint32_t GetN() const {
        return m_N;
    }

    NativeInteger GetQ() const {
        return m_Q;
    }

    NativeInteger Getq() const {
        return m_q;
    }

    uint32_t GetBaseG() const {
        return m_baseG;
    }

    uint32_t GetDigitsG() const {
        return m_digitsG;
    }

    BaseGParams GetDefaultBaseGParams() const {
        return {m_baseG, m_digitsG, lbcrypto::GetMSB(m_baseG) - 1, &m_Gpower,
                m_baseGByIndex.empty() ? ((m_digitsG - 1) << 1) : m_teamWidth};
    }

    BaseGParams GetBaseGParams(uint32_t index) const {
        if (m_baseGByIndex.empty())
            return GetDefaultBaseGParams();
        if (index >= m_baseGByIndex.size())
            OPENFHE_THROW("Gadget base map does not cover the LWE dimension.");
        return m_baseGByIndex[index];
    }

    uint32_t GetBaseG(uint32_t index) const {
        return GetBaseGParams(index).baseG;
    }

    uint32_t GetDigitsG(uint32_t index) const {
        return GetBaseGParams(index).digitsG;
    }

    // empty when no per-dimension base map is in use; then GetDefaultBaseGParams() applies to
    // every index
    const std::vector<BaseGParams>& GetBaseGByIndex() const {
        return m_baseGByIndex;
    }

    void VerifyBaseGCoverage(uint32_t n) const {
        if (!m_baseGByIndex.empty() && m_baseGByIndex.size() != n)
            OPENFHE_THROW("Gadget base map does not cover the LWE dimension.");
    }

    uint32_t GetBaseR() const {
        return m_baseR;
    }

    uint32_t GetNumAutoKeys() const {
        return m_numAutoKeys;
    }

    const std::vector<NativeInteger>& GetDigitsR() const {
        return m_digitsR;
    }

    uint32_t GetDigitExtentR(uint32_t pos) const {
        if (pos + 1 < m_digitsR.size())
            return m_baseR;
        return static_cast<uint32_t>((m_q.ConvertToInt<uint64_t>() - 1) / m_digitsR.back().ConvertToInt<uint64_t>()) +
               1;
    }

    const std::shared_ptr<ILNativeParams> GetPolyParams() const {
        return m_polyParams;
    }

    const std::vector<NativeInteger>& GetGPower() const {
        return m_Gpower;
    }

    const std::vector<NativeInteger>& GetGPower(uint32_t baseG) const {
        auto it = m_Gpower_map.find(baseG);
        if (it == m_Gpower_map.end())
            OPENFHE_THROW("No GPower found for the requested gadget base.");
        return it->second;
    }

    const std::vector<NativeInteger>& GetGPowerByIndex(uint32_t index) const {
        const auto* gpow = GetBaseGParams(index).gpow;
        return (gpow == nullptr) ? m_Gpower : *gpow;
    }

    const std::vector<uint32_t>& GetAutoMap(uint32_t index) const {
        auto it = m_autoMap.find(index);
        if (it == m_autoMap.end())
            OPENFHE_THROW("No automorphism map precomputed for index " + std::to_string(index));
        return it->second;
    }

    const std::vector<int32_t>& GetLogGen() const {
        return m_logGen;
    }

    const std::map<uint32_t, std::vector<NativeInteger>>& GetGPowerMap() const {
        return m_Gpower_map;
    }

    const DiscreteGaussianGeneratorImpl<NativeVector>& GetDgg() const {
        return m_dgg;
    }

    const std::vector<NativeInteger>& GetGateConst() const {
        return m_gateConst;
    }

    const NativePoly& GetMonomial(uint32_t i) const {
        return m_monomials[i];
    }

    bool HasMonomials() const {
        return !m_monomials.empty();
    }

    void ClearMonomials() {
        std::vector<NativePoly>().swap(m_monomials);
    }

    void EnsureMonomials() {
        if (m_method == BINFHE_METHOD::GINX && m_monomials.empty())
            BuildMonomials();
    }

#if NATIVEINT != 32
    const std::shared_ptr<ILNativeParams32>& GetPolyParams32();

    const std::shared_ptr<const std::vector<NativePoly32>>& GetMonomials32();

    const std::shared_ptr<const std::vector<NativeVector32>>& GetMonomialsPrecon32();
#endif

    BINFHE_METHOD GetMethod() const {
        return m_method;
    }

    SecretKeyDist GetKeyDist() const {
        return m_keyDist;
    }

    bool operator==(const RingGSWCryptoParams& other) const {
        return m_N == other.m_N && m_Q == other.m_Q && m_q == other.m_q && m_baseR == other.m_baseR &&
               m_baseG == other.m_baseG && m_baseG_map == other.m_baseG_map && m_method == other.m_method &&
               m_keyDist == other.m_keyDist && m_numAutoKeys == other.m_numAutoKeys &&
               m_dgg.GetStd() == other.m_dgg.GetStd();
    }

    bool operator!=(const RingGSWCryptoParams& other) const {
        return !(*this == other);
    }

    template <class Archive>
    void save(Archive& ar, std::uint32_t const version) const {
        ar(::cereal::make_nvp("bN", m_N));
        ar(::cereal::make_nvp("bQ", m_Q));
        ar(::cereal::make_nvp("bq", m_q));
        ar(::cereal::make_nvp("bR", m_baseR));
        ar(::cereal::make_nvp("bG", m_baseG));
        ar(::cereal::make_nvp("bmethod", m_method));
        ar(::cereal::make_nvp("bs", m_dgg.GetStd()));
        ar(::cereal::make_nvp("bdigitsG", m_digitsG));
        ar(::cereal::make_nvp("bparams", m_polyParams));
        ar(::cereal::make_nvp("numAutoKeys", m_numAutoKeys));
        ar(::cereal::make_nvp("baseGMap", m_baseG_map));
        ar(::cereal::make_nvp("keyDist", m_keyDist));
    }

    template <class Archive>
    void load(Archive& ar, std::uint32_t const version) {
        if (version > SerializedVersion()) {
            OPENFHE_THROW("serialized object version " + std::to_string(version) +
                          " is from a later version of the library");
        }
        ar(::cereal::make_nvp("bN", m_N));
        ar(::cereal::make_nvp("bQ", m_Q));
        ar(::cereal::make_nvp("bq", m_q));
        ar(::cereal::make_nvp("bR", m_baseR));
        ar(::cereal::make_nvp("bG", m_baseG));
        ar(::cereal::make_nvp("bmethod", m_method));
        double sigma = 0;
        ar(::cereal::make_nvp("bs", sigma));
        m_dgg.SetStd(sigma);
        ar(::cereal::make_nvp("bdigitsG", m_digitsG));
        ar(::cereal::make_nvp("bparams", m_polyParams));
        ar(::cereal::make_nvp("numAutoKeys", m_numAutoKeys));
        ar(::cereal::make_nvp("baseGMap", m_baseG_map));
        ar(::cereal::make_nvp("keyDist", m_keyDist));
        PreCompute();
    }

    std::string SerializedObjectName() const override {
        return "RingGSWCryptoParams";
    }

    static uint32_t SerializedVersion() {
        return 1;
    }

    void Change_BaseG(uint32_t BaseG) {
        if (m_baseG != BaseG) {
            if (!m_baseGByIndex.empty())
                OPENFHE_THROW("Change_BaseG is not supported with per-dimension gadget bases");
            CheckDigitsG(BaseG, DigitsForBase(m_Q, BaseG));
            m_baseG = BaseG;
            m_Gpower = PrecomputeGPower(BaseG);
            m_digitsG = DigitsForBase(m_Q, m_baseG);
        }
    }

  private:
    // the approximate gadget decomposition drops the first digit, so a single-digit gadget
    // leaves the external product with no rows at all
    static void CheckDigitsG(uint32_t baseG, uint32_t digitsG) {
        if (digitsG < 2)
            OPENFHE_THROW("Gadget base " + std::to_string(baseG) +
                          " is too large for Q: the approximate gadget decomposition needs at least two digits.");
    }

    static uint32_t DigitsForBase(const NativeInteger& Q, uint32_t baseG) {
        return lbcrypto::GetDigitCount(Q.ConvertToInt(), baseG);
    }

    void BuildMonomials();

    // modulus for the RingGSW/RingLWE scheme
    NativeInteger m_Q;

    // modulus for the RingLWE scheme
    NativeInteger m_q;

    // ring dimension for RingGSW/RingLWE scheme
    uint32_t m_N;

    // gadget base used in bootstrapping
    uint32_t m_baseG;

    // number of LWE secret-key coefficients assigned to each gadget base, in ascending base order
    std::map<uint32_t, uint32_t> m_baseG_map;

    // m_baseG_map expanded to one entry per LWE index, filled by PreCompute()
    std::vector<BaseGParams> m_baseGByIndex;
    uint32_t m_teamWidth{0};

    // base used for the refreshing key (used only for DM bootstrapping)
    uint32_t m_baseR;

    // number of digits in decomposing integers mod Q for given baseG
    uint32_t m_digitsG;

    // powers of m_baseR (used only for DM bootstrapping)
    std::vector<NativeInteger> m_digitsR;

    // A vector of powers of baseG
    std::vector<NativeInteger> m_Gpower;

    // A vector of log by generator g (=5) (only for LMKCDEY)
    // Not exactly log, but a mapping similar to logarithm for efficiency
    // m_logGen[5^i (mod M)] = i (i > 0)
    // m_logGen[-5^i (mod M)] = -i ()
    // m_logGen[1] = 0
    // m_logGen[-1 (mod M)] = M (special case for efficiency)
    std::vector<int32_t> m_logGen;

    std::unordered_map<uint32_t, std::vector<uint32_t>> m_autoMap;

    // Error distribution generator
    DiscreteGaussianGeneratorImpl<NativeVector> m_dgg;

    // A map of vectors of powers for each gadget base
    std::map<uint32_t, std::vector<NativeInteger>> m_Gpower_map;

    // Parameters for polynomials in RingGSW/RingLWE
    std::shared_ptr<ILNativeParams> m_polyParams;

    // Constants used in evaluating binary gates
    std::vector<NativeInteger> m_gateConst;

    // Precomputed polynomials in Format::EVALUATION representation for X^m - 1
    // (used only for CGGI bootstrapping)
    std::vector<NativePoly> m_monomials;

#if NATIVEINT != 32
    // transient caches for the 32-bit internal path; never serialized, rebuilt on demand
    std::shared_ptr<ILNativeParams32> m_polyParams32;
    std::shared_ptr<const std::vector<NativePoly32>> m_monomials32;
    std::shared_ptr<const std::vector<NativeVector32>> m_monomialsPrecon32;
#endif

    // Bootstrapping method (DM or CGGI or LMKCDEY)
    BINFHE_METHOD m_method{BINFHE_METHOD::INVALID_METHOD};

    // Secret key distribution: GAUSSIAN, UNIFORM_TERNARY, etc.
    SecretKeyDist m_keyDist{SecretKeyDist::UNIFORM_TERNARY};

    // number of automorphism keys (used only for LMKCDEY bootstrapping)
    uint32_t m_numAutoKeys;
};

}  // namespace lbcrypto

#endif  // SRC_BINFHE_INCLUDE_RGSW_CRYPTOPARAMETERS_H_