A CryptoContextImpl is the object used to access the OpenFHE library
All OpenFHE functionality is accessed by way of an instance of a CryptoContextImpl; we say that various objects are “created in” a context, and can only be used in the context in which they were created
All OpenFHE methods are accessed through CryptoContextImpl methods. Guards are implemented to make certain that only valid objects that have been created in the context are used
Contexts are created using GenCryptoContext(), and can be serialized and recovered from a serialization
This stores the private key in the crypto context. This is only intended for debugging and should not be used in production systems. Please define DEBUG_KEY in openfhe.h to enable this.
If used, one can create a key pair and store the secret key in th crypto context like this:
auto keys = cc->KeyGen(); cc->SetPrivateKey(keys.secretKey);
After that, anyone in the code, one can access the secret key by getting the crypto context and doing the following:
This gets the private key from the crypto context. This is only intended for debugging and should not be used in production systems. Please define DEBUG_KEY in openfhe.h to enable this.
If used, one can create a key pair and store the secret key in th crypto context like this:
auto keys = cc->KeyGen(); cc->SetPrivateKey(keys.secretKey);
After that, anyone in the code, one can access the secret key by getting the crypto context and doing the following:
COMPLEX ARITHMETIC IS NOT AVAILABLE, AND THIS METHOD BE DEPRECATED. USE THE REAL-NUMBER METHOD INSTEAD. MakeCKKSPackedPlaintext constructs a CKKSPackedEncoding in this context from a vector of complex numbers
Parameters
value – - input vector of complex number
scaleDeg – - degree of scaling factor used to encode the vector
level – - level at each the vector will get encrypted
params – - parameters to be usef for the ciphertext
NOT SUPPORTED BY ANY CRYPTO SCHEME NOW SparseKeyGen generates a key pair with special structure, and without full entropy, for use in special cases like Ring Reduction
EvalMultKeyGen creates a relinearization key (for s^2) that can be used with the OpenFHE EvalMult operator the new evaluation key is stored in cryptocontext
EvalMultsKeyGen creates a vector evalmult keys that can be used with the OpenFHE EvalMult operator 1st key (for s^2) is used for multiplication of ciphertexts of depth 1 2nd key (for s^3) is used for multiplication of ciphertexts of depth 2, etc. a vector of new evaluation keys is stored in crytpocontext
Rotates a ciphertext by an index (positive index is a left shift, negative index is a right shift). Uses a rotation key stored in a crypto context. Calls EvalAtIndex under the hood.
Generally, automorphisms are performed with three steps: (1) the automorphism is applied on the ciphertext, (2) the automorphed values are decomposed into digits, and (3) key switching is applied to make it possible to further compute on the ciphertext.
Hoisted automorphisms is a technique that performs the digit decomposition for the original ciphertext first, and then performs the automorphism and the key switching on the decomposed digits. The benefit of this is that the digit decomposition is independent of the automorphism rotation index, so it can be reused for multiple different indices. This can greatly improve performance when we have to compute many automorphisms on the same ciphertext. This routinely happens when we do permutations (EvalPermute).
EvalFastRotationPrecompute implements the digit decomposition step of hoisted automorphisms.
Parameters
ciphertext – the input ciphertext on which to do the precomputation (digit decomposition)
Generally, automorphisms are performed with three steps: (1) the automorphism is applied on the ciphertext, (2) the automorphed values are decomposed into digits, and (3) key switching is applied to make it possible to further compute on the ciphertext.
Hoisted automorphisms is a technique that performs the digit decomposition for the original ciphertext first, and then performs the automorphism and the key switching on the decomposed digits. The benefit of this is that the digit decomposition is independent of the automorphism rotation index, so it can be reused for multiple different indices. This can greatly improve performance when we have to compute many automorphisms on the same ciphertext. This routinely happens when we do permutations (EvalPermute).
EvalFastRotation implements the automorphism and key swithcing step of hoisted automorphisms.
This method assumes that all required rotation keys exist. This may not be true if we are using baby-step/giant-step key switching. Please refer to Section 5.1 of the above reference and EvalPermuteBGStepHoisted to see how to deal with this issue.
Parameters
ciphertext – the input ciphertext to perform the automorphism on
index – the index of the rotation. Positive indices correspond to left rotations and negative indices correspond to right rotations.
m – is the cyclotomic order
digits – the digit decomposition created by EvalFastRotationPrecompute at the precomputation step.
ComposedEvalMult - calls multiplication, relinearization, and then modulus switching/rescaling. Uses a relinearization key stored in the crypto context.
Compress - Reduces the size of ciphertext modulus to minimize the communication cost before sending the encrypted result for decryption. Similar to ModReduce but for BFV where ModReduce is not exposed directly.
Parameters
ciphertext – - input ciphertext
numTowers – - number of RNS limbs after compressing (default is 1)
EvalAddManyInPlace - Evaluate addition on a vector of ciphertexts. Addition is computed in a binary tree manner. Difference with EvalAddMany is that EvalAddManyInPlace uses the input ciphertext vector to store intermediate results, to avoid the overhead of using extra tepmorary space.
EvalMultMany - OpenFHE function for evaluating multiplication on ciphertext followed by relinearization operation (at the end). It computes the multiplication in a binary tree manner. Also, it reduces the number of elements in the ciphertext to two after each multiplication. Currently it assumes that the consecutive two input arguments have total number of ring elements smaller than the supported one (for the secret key degree used by EvalMultsKeyGen). Otherwise, it throws an error.
Method for evaluation for polynomials represented as power series. Supported only in CKKS. If the degree of the polynomial is less than 5, use EvalPolyLinear (naive linear method), otherwise, use EvalPolyPS (Paterson-Stockmeyer method).
Parameters
ciphertext – input ciphertext
&coefficients – is the vector of coefficients in the polynomial; the size of the vector is the degree of the polynomial + 1
Naive method for polynomial evaluation for polynomials represented in the power series (fast only for small-degree polynomials; less than 10). Uses a binary tree computation of the polynomial powers. Supported only in CKKS.
Parameters
cipherText – input ciphertext
&coefficients – is the vector of coefficients in the polynomial; the size of the vector is the degree of the polynomial
Method for evaluating Chebyshev polynomial interpolation; first the range [a,b] is mapped to [-1,1] using linear transformation 1 + 2 (x-a)/(b-a) If the degree of the polynomial is less than 5, use EvalChebyshevSeriesLinear (naive linear method), otherwise, use EvalChebyshevSeriesPS (Paterson-Stockmeyer method). Supported only in CKKS.
Parameters
cipherText – input ciphertext
&coefficients – is the vector of coefficients in Chebyshev expansion
a – - lower bound of argument for which the coefficients were found
b – - upper bound of argument for which the coefficients were found
Naive linear method for evaluating Chebyshev polynomial interpolation; first the range [a,b] is mapped to [-1,1] using linear transformation 1 + 2 (x-a)/(b-a). Supported only in CKKS.
Parameters
cipherText – input ciphertext
&coefficients – is the vector of coefficients in Chebyshev expansion
a – - lower bound of argument for which the coefficients were found
b – - upper bound of argument for which the coefficients were found
Paterson-Stockmeyer method for evaluating Chebyshev polynomial interpolation; first the range [a,b] is mapped to [-1,1] using linear transformation 1 + 2 (x-a)/(b-a). Supported only in CKKS.
Parameters
cipherText – input ciphertext
&coefficients – is the vector of coefficients in Chebyshev expansion
a – - lower bound of argument for which the coefficients were found
b – - upper bound of argument for which the coefficients were found
Merges multiple ciphertexts with encrypted results in slot 0 into a single ciphertext. The slot assignment is done based on the order of ciphertexts in the vector. Requires the generation of rotation keys for the indices that are needed.
Parameters
ciphertextVector – vector of ciphertexts to be merged.
Threshold FHE: Generation of a public key derived from a previous joined public key (for prior secret shares) and the secret key share of the current party.
Parameters
publicKey – joined public key from prior parties.
makeSparse – set to true if ring reduce by a factor of 2 is to be used. NOT SUPPORTED BY ANY SCHEME ANYMORE.
fresh – set to true if proxy re-encryption is used in the multi-party protocol or star topology is used
Returns
key pair including the secret share for the current party and joined public key
Threshold FHE: Generates a partial evaluation key for homomorphic multiplication based on the current secret share and an existing partial evaluation key
Parameters
privateKey – current secret share.
evalKey – prior evaluation key.
keyId – - new key identifier used for the resulting evaluation key
Threshold FHE: Aggregates a vector of masked decryptions and re-encryotion shares, which is the second step of the interactive multiparty bootstrapping procedure.
Parameters
sharesPairVec – vector of pair of ciphertexts, each element of this vector contains (h_0i, h_1i) - the masked-decryption and encryption shares ofparty i
Threshold FHE: Does public key encryption of lead party’s masked decryption as part of interactive multi-party bootstrapping, which increases the ciphertext modulus and enables future computations. This operation is done by the lead party as the final step of interactive multi-party bootstrapping.
Parameters
publicKey – the lead party’s public key
sharesPair – aggregated decryption and re-encryption shares
Bootstrap functionality: There are three methods that have to be called in this specific order:
EvalBootstrapSetup: computes and encodes the coefficients for encoding and decoding and stores the necessary parameters
EvalBootstrapKeyGen: computes and stores the keys for rotations and conjugation
EvalBootstrapPrecompute: computes and stores the plaintexts for encoding and decoding if not already done in EvalBootstrapSetup
EvalBootstrap: refreshes the given ciphertext Sets all parameters for both linear and FFT-like methods. Supported in CKKS only.
Parameters
levelBudget – - vector of budgets for the amount of levels in encoding and decoding
dim1 – - vector of inner dimension in the baby-step giant-step routine for encoding and decoding
slots – - number of slots to be bootstrapped
correctionFactor – - value to internally rescale message by to improve precision of bootstrapping. If set to 0, we use the default logic. This value is only used when NATIVE_SIZE=64
precompute – - flag specifying whether to precompute the plaintexts for encoding and decoding.
Defines the bootstrapping evaluation of ciphertext using either the FFT-like method or the linear method
Parameters
ciphertext – the input ciphertext.
numIterations – number of iterations to run iterative bootstrapping (Meta-BTS). Increasing the iterations increases the precision of bootstrapping.
precision – precision of initial bootstrapping algorithm. This value is determined by the user experimentally by first running EvalBootstrap with numIterations = 1 and precision = 0 (unused).
Scheme switching between CKKS and FHEW functionality There are three methods that have to be called in this specific order:
EvalCKKStoFHEWSetup: generates a FHEW cryptocontext and returns the key, computes and encodes the coefficients for encoding and decoding and stores the necessary parameters
EvalCKKStoFHEWKeyGen: computes and stores the keys for rotations and conjugation
EvalCKKStoFHEW: returns the FHEW/CGGI ciphertext 1’. EvalFHEWtoCKKSwitchetup: takes in the CKKS cryptocontext and sets the parameters 2’. EvalFHEWtoCKKSKeyGen: computes and stores the switching key and the keys for rotations and conjugation 3’. EvalFHEWtoCKKS: returns the CKKS ciphertext 1’’. EvalSchemeSwitchingSetup: generates a FHEW cryptocontext and returns the key, computes and encodes the coefficients for encoding and decoding and stores the necessary parameters 2’’. EvalSchemeSwitchingKeyGen: computes and stores the switching key and the keys for rotations and conjugation 3’’. EvalCompareSchemeSwitching/EvalFuncSchemeSwitching: returns the CKKS ciphertext of the function specified Sets all parameters for switching from CKKS to FHEW
Parameters
params – objects holding all necessary paramters
Returns
the FHEW secret key TODO: add an overload for when BinFHEContext is already generated and fed as a parameter
Generates all keys for scheme switching: the rotation keys for the linear transform in the homomorphic decoding, conjugation keys, switching key from CKKS to FHEW
Performs precomputations for the homomorphic decoding in CKKS. Given as a separate method than EvalCKKStoFHEWSetup to allow the user to specify a scale that depends on the CKKS and FHEW cryptocontexts
Parameters
scale – factor with which to scale the matrix in the linear transform
Generates all keys for scheme switching: the rotation keys for the baby-step/giant-step strategy in the linear transform for the partial decryption, the switching key from FHEW to CKKS
Parameters
keypair – CKKS key pair
lwesk – FHEW secret key
numSlots – number of slots for the CKKS encryption of the FHEW secret key
numCtxts – number of values to encrypt from the LWE ciphertexts in the new CKKS ciphertext
dim1 – baby-step for the linear transform
L – level on which the hom. decoding matrix should be. We want the hom. decoded ciphertext to be on the last level
Performs the scheme switching on a vector of FHEW ciphertexts
Parameters
LWECiphertexts – FHEW/LWE ciphertexts to switch
numCtxts – number of values to encrypt from the LWE ciphertexts in the new CKKS ciphertext
numSlots – number of slots to use in the encoding in the new CKKS/RLWE ciphertext
p – plaintext modulus to use to decide postscaling, by default p = 4
pmin, pmax – plaintext space of the resulting messages (by default [0,2] assuming the LWE ciphertext had plaintext modulus p = 4 and only bits were encrypted)
dim1 – baby-step for the linear transform, necessary only for argmin
Returns
a CKKS ciphertext encrypting in its slots the messages in the LWE ciphertexts
Generates all keys for scheme switching: the rotation keys for the linear transform for the homomorphic encoding and partial decryption, the switching key from FHEW to CKKS
Performs precomputations for the homomorphic decoding in CKKS. Given as a separate method than EvalSchemeSwitchingSetup to allow the user to specify a scale that depends on the CKKS and FHEW cryptocontexts
Parameters
pLWE – the desired plaintext modulus for the new FHEW ciphertexts
scaleSign – factor to multiply the CKKS ciphertext when switching to FHEW in case the messages are too small; the resulting FHEW ciphertexts will encrypt values modulo pLWE, so scaleSign should account for this
unit – whether the input messages are normalized to the unit circle
Performs the scheme switching on the difference of two CKKS ciphertexts to compare, evaluates the sign function over the resulting FHEW ciphertexts, then performs the scheme switching back to a CKKS ciphertext
Parameters
ciphertext1, ciphertext2 – CKKS ciphertexts of messages that need to be compared
numCtxts – number of coefficients to extract from the CKKS ciphertext
numSlots – number of slots to encode the new CKKS ciphertext with
pLWE – the desired plaintext modulus for the new FHEW ciphertexts
scaleSign – factor to multiply the CKKS ciphertext when switching to FHEW in case the messages are too small; the resulting FHEW ciphertexts will encrypt values modulo pLWE, so scaleSign should account for this pLWE and scaleSign are given here only if the homomorphic decoding matrix is not scaled with the desired values
unit – whether the input messages are normalized to the unit circle
Returns
a CKKS ciphertext encrypting in its slots the sign of messages in the LWE ciphertexts
Computes the minimum and argument of the first numValues packed in a CKKS ciphertext via repeated scheme switchings to FHEW and back.
Parameters
ciphertext – CKKS ciphertexts of values that need to be compared
publicKey – public key of the CKKS cryptocontext
numValues – number of values to extract from the CKKS ciphertext. We always assume for the moment numValues is a power of two
numSlots – number of slots to encode the new CKKS ciphertext with
pLWE – the desired plaintext modulus for the new FHEW ciphertexts
scaleSign – factor to multiply the CKKS ciphertext when switching to FHEW in case the messages are too small; the resulting FHEW ciphertexts will encrypt values modulo pLWE, so scaleSign should account for this pLWE and scaleSign are given here only if the homomorphic decoding matrix is not scaled with the desired values
Returns
a vector of two CKKS ciphertexts where the first encrypts the minimum value and the second encrypts the index (in the representation specified by oneHot). The ciphertexts have junk after the first slot in the first ciphertext and after numValues in the second ciphertext if oneHot=true and after the first slot if oneHot=false.
Computes the maximum and argument of the first numValues packed in a CKKS ciphertext via repeated scheme switchings to FHEW and back.
Parameters
ciphertext – CKKS ciphertexts of values that need to be compared
publicKey – public key of the CKKS cryptocontext
numValues – number of values to extract from the CKKS ciphertext. We always assume for the moment numValues is a power of two
numSlots – number of slots to encode the new CKKS ciphertext with
pLWE – the desired plaintext modulus for the new FHEW ciphertexts
scaleSign – factor to multiply the CKKS ciphertext when switching to FHEW in case the messages are too small; the resulting FHEW ciphertexts will encrypt values modulo pLWE, so scaleSign should account for this pLWE and scaleSign are given here only if the homomorphic decoding matrix is not scaled with the desired values
Returns
a vector of two CKKS ciphertexts where the first encrypts the maximum value and the second encrypts the index (in the representation specified by oneHot). The ciphertexts have junk after the first slot in the first ciphertext and after numValues in the second ciphertext if oneHot=true and after the first slot if oneHot=false.
DeserializeEvalMultKey deserialize all keys in the serialization deserialized keys silently replace any existing matching keys deserialization will create CryptoContextImpl if necessary
DeserializeEvalSumKey deserialize all keys in the serialization deserialized keys silently replace any existing matching keys deserialization will create CryptoContextImpl if necessary
DeserializeEvalAutomorphismKey deserialize all keys in the serialization deserialized keys silently replace any existing matching keys deserialization will create CryptoContextImpl if necessary