a590003

EncryptedArray(const FHEcontext& context, const GF2X& G=GF2X(1,1));
that takes as input both the context (that specifies m) and a binary polynomial G for the representation
of F 2 n (with n the degree of G). The default value for the polynomial is G(X) = X,
resulting in plaintext values in the base field F 2 = Z 2 (i.e., individual bits). On the other hand, the
constructor for EncryptedArrayMod2r is
EncryptedArrayMod2r(const FHEcontext& context);
that takes only the context (specifying m and the plaintext-space modulus 2 r ), and the plaintext
values are always in the base ring Z 2 r. In either case, the constructors computes and store various
“masks”, which are polynomials that have 1’s in some of their plaintext slots and 0 in the other
slots. There masks are used in the implementation of the data movement procedures, as described
below.
The multi-dimensional array view. This view arranges the plaintext slots in a multi-dimensional
array, corresponding to the structure of Z ∗ m/ 〈2〉. The number of dimensions is the same as the
number of generators that we have for Z ∗ m/ 〈2〉, and the size along the i’th dimension is the order
of the i’th generator.
Recall from Section 2.4 that each plaintext slot is represented by some t ∈ Z ∗ m, such that the set
of representatives T ⊂ Z ∗ m has exactly one element from each conjugacy class of Z ∗ m/ 〈2〉. Moreover,
if f 1 , . . . , f n ∈ T are the generators of Z ∗ m/ 〈2〉 (with f i having order ord(f i )), then every t ∈ T can
be written uniquely as t = [ ∏ i f e i
i
] m with each exponent e i taken from the range 0 ≤ e i < ord(f i ).
The generators are roughly arranges by their order (i.e., ord(f i ) ≥ ord(f i+1 )), except that we put
all the generators that have the same order in Z ∗ m and Z ∗ m/ 〈2〉 before all the generators that have
different orders in the two groups.
Hence the multi-dimensional-array view of the plaintext slots will have them arranged in a n-
dimensional hypercube, with the size of the i’th side being ord(f i ). Every entry in this hypercube
is indexed by some ⃗e = (e 1 , e 2 , . . . , e n ), and it contains the plaintext slot associated with the
representative t = [ ∏ i f e i
i
] m ∈ T . (Note that the lexicographic order on the vectors ⃗e of indexes
induces a linear ordering on the plaintext slots, which is what we use in our linear-array view
described below.) The multi-dimensional-array view provides the following interfaces:
long dimension() const; returns the dimensionality (i.e., the number of generators in Z ∗ m/ 〈2〉).
long sizeOfDimension(long i); returns the size along the i’th dimension (i.e., ord(f i )).
long coordinate(long i, long k) const; return the i’th entry of the k’th vector in lexicographic
order.
void rotate1D(Ctxt& ctxt, long i, long k) const;
This method rotates the hypercube by k positions along the i’th dimension, moving the
content of the slot indexed by (e 1 . . . , e i , . . . e n ) to the slot indexed by (e 1 . . . , e i + k, . . . e n ),
addition modulo ord(f i ). Note that the argument k above can be either positive or negative,
and rotating by −k is the same as rotating by ord(f i ) − k.
The rotate operation is closely related to the “native” automorphism operation of the lowerlevel
Ctxt class. Indeed, if f i has the same order in Z ∗ m as in Z ∗ m/ 〈2〉 then we just apply the
automorphism X ↦→ X f i
k on the input ciphertext using ctxt.smartAutomorph(fi k). If f i has
different orders in Z ∗ m and Z ∗ m/ 〈2〉 then we need to apply the two automorphisms X ↦→ X f i
k
30
16. Design and Implementation of a Homomorphic-Encryption Library