a590003

void addAllMatrices(FHESecKey& sKey, long keyID=0);
For i = keyID, generate key-switching matrices W [s i (X t ) ⇒ s i (X)] for all t ∈ Z ∗ m.
void add1DMatrices(FHESecKey& sKey, long keyID=0);
For i = keyID, generate key-switching matrices W [s i (X ge ) ⇒ s i (X)] for every generator g of
Z ∗ m/ 〈2〉 with order ord(g), and every exponent 0 < e < ord(g). Also if the order of g in Z ∗ m is
not the same as its order in Z ∗ m/ 〈2〉, then generate also the matrices W [s i (X g−e ) ⇒ s i (X)]
(cf. Section 2.4).
We note that these matrices are enough to implement all the automorphisms that are needed
for the data-movement routines from Section 4.
void addSome1DMatrices(FHESecKey& sKey, long bound=100,long keyID=0);
For i = keyID, we generate just a subset of the matrices that are generated by add1DMatrices,
so that each of the automorphisms X ↦→ X ge can be implemented by at most two steps (and
similarly for X ↦→ X g−e for generators whose orders in Z ∗ m and Z ∗ m/ 〈2〉 are different). In
other words, we ensure that the graph G i (cf. Section 3.2.2) has a path of length at most 2
from g e to 1 (and also from g −e to 1 for g’s of different orders).
In more details, if ord(g) ≤ bound then we generate all the matrices W [s i (X ge ) ⇒ s i (X)]
(or W [s i (X g−e ) ⇒ s i (X)]) just like in add1DMatrices. When ord(g) > bound, however, we
generate only O( √ ord(g)) matrices for this generator: Denoting B g = ⌈ √ ord(g)⌉, for every
0 < e < B g let e ′ = e · B g mod m, then we generate the matrices W [s i (X ge ) ⇒ s i (X)] and
W [s i (X ge′ ) ⇒ s i [(X)]. In addition, ] if if g has a different order in Z ∗ m and Z ∗ m/ 〈2〉 then we
generate also W s i (X g−e′ ) ⇒ s i (X) .
void addFrbMatrices(FHESecKey& sKey, long keyID=0);
For i = keyID, generate key-switching matrices W [s i (X 2e ) ⇒ s i (X)] for 0 < e < d where d is
the order of 2 in Z ∗ m.
4 The Data-Movement Layer
At the top level of our library, we provide some interfaces that allow the application to manipulate
arrays of plaintext values homomorphically. The arrays are translated to plaintext polynomials using
the encoding/decoding routines provided by PAlgebraModTwo/PAlgebraMod2r (cf. Section 2.5),
and then encrypted and manipulated homomorphically using the lower-level interfaces from the
crypto layer.
4.1 The classes EncryptedArray and EncryptedArrayMod2r
These classes present the plaintext values to the application as either a linear array (with as many
entries as there are elements in Z ∗ m/ 〈2〉), or as a multi-dimensional array corresponding to the
structure of the group Z ∗ m/ 〈2〉. The difference between EncryptedArray and EncryptedArrayMod2r
is that the former is used when the plaintext-space modulus is 2, while the latter is used when it is
2 r for some r > 1. Another difference between them is that EncryptedArray supports also plaintext
values in binary extension fields F 2 n, while EncryptedArrayMod2r only support integer plaintext
values from Z 2 r. This is reflected in the constructor for these types: For EncryptedArray we have
the constructor
29
16. Design and Implementation of a Homomorphic-Encryption Library