Design and Implementation of a Homomorphic ... - Researcher

Automorphism. “Raw” automorphism is implemented in the method
void Ctxt::automorph(long k);
For convenience we also provide Ctxt& operator>>=(long k); that does the same thing. These
methods just apply the automorphism X ↦→ X k to every part of the current ciphertext, without
changing the noise estimate, and multiply by k (modulo m) the powerOfX value in the handles of
all these parts.
“Smart” Automorphism. Higher-level automorphism is implemented in the method
void Ctxt::smartAutomorph(long k);
The difference between automorph and smartAutomorph is that the latter ensures that the result
can be re-linearized using key-switching matrices from the public key. Specifically, smartAutomorph
breaks the automorphism X ↦→ X k into some number t ≥ 1 of steps, X ↦→ X k i
for i = 1, 2, . . . t,
such that the public key contains key-switching matrices for re-linearizing all these steps (i.e.
W = W [s(X k i
) ⇒ s(X)]), and at the same time we have ∏ t
i=1 k i = k (mod m). The method
smartAutomorph then begin by re-linearizing its argument, then in every step it performs one of
the automorphisms X ↦→ X k i
followed by re-linearization.
The decision of how to break each exponent k into a sequence of k i ’s as above is done off line
during key-generation, as described in Section 3.2.2. After this off-line computation, the public key
contains a table that for each k ∈ Z ∗ m indicates what is the first step to take when implementing the
automorphism X ↦→ X k . The smartAutomorph looks up the first step k 1 in that table, performs
the automorphism X ↦→ X k 1
, then compute k ′ = k/k 1 mod m and does another lookup in the table
for the first step relative to k ′ , and so on.
3.1.8 More Ctxt methods
The Ctxt class also provide the following utility methods:
void clear(); Removes all the parts and sets the noise estimate to zero.
xdouble modSwitchAddedNoiseVar() const; computes the added-noise from modulus-switching,
namely it returns ∑ j (φ(m)·p2 /12)·(r j )!·H r j
j
where H j and r j are respectively the Hamming
weight of the secret key that the j’th ciphertext-part points to, and the power of that secret
key (i.e., the powerOfS value in the relevant handle).
void findBaseSet(IndexSet& s) const; Returns in s the largest prime-set such that modulusswitching
to s would make ctxt.modSwitchAddedNoiseVar the most significant noise term.
In other words, modulus-switching to s results in a significantly smaller noise than to any
larger prime-set, but modulus-switching further down would not reduce the noise by much.
When multiplying ciphertexts using the multiplyBy “high-level” methods, the ciphertexts
are reduced to (the intersection of) their “base sets” levels before multiplying.
long getLevel() const; Returns the number of primes in the result of findBaseSet.
bool inCanonicalForm(long keyID=0) const; Returns true if this is a canonical ciphertexts,
with only two parts: one that points to 1 and the other that points to the “base” secret key
s i (X), (where i = keyId is specified by the caller).
23