Design and Implementation of a Homomorphic ... - Researcher

On subsequent calls with the same powers and Rb, these arrays are not computed again but taken
from the pre-computed arguments. If the powers and Rb arguments are initialized, then it is
assumed that they were computed correctly from root. The behavior is undefined when calling
with initialized powers and Rb but a different root. (In particular, to compute the inverse-FFT
using root −1 , one must provide different powers and Rb arguments than those that were given
when computing in the forward direction using root.) This procedure cannot be used for in-place
FFT, calling BluesteinFFT(x, x, · · · ) will just zero-out the polynomial x.
The classes Cmodulus and CModulus. These classes provide an interface layer for the FFT
routines above, relative to a single prime (where Cmodulus is used for smallint primes and CModulus
for bigint primes). They keep the NTL “current modulus” structure for that prime, as well as the
powers and Rb arrays for FFT and inverse-FFT under that prime. They are constructed with the
constructors
Cmodulus(const PAlgebra& ZmStar, const long& q, const long& root);
CModulus(const PAlgebra& ZmStar, const ZZ& q, const ZZ& root);
where ZmStar described the structure of Z ∗ m (see Section 2.4), q is the prime modulus and root
is a primitive 2m−’th root of unity modulo q. (If the constructor is called with root = 0 then it
computes a 2m-th root of unity by itself.) Once an object of one of these classes is constructed, it
provides an FFT interfaces via
void Cmodulus::FFT(vec long& y, const ZZX& x) const; // y = FFT(x)
void Cmodulus::iFFT(ZZX& x, const vev long& y) const; // x = FFT −1 (y)
(And similarly for CModulus using vec ZZ instead of vec long). These method are inverses of
each other. The methods of these classes affect the NTL “current modulus”, and it is the responsibility
of the caller to backup and restore the modulus if needed (using the NTL constructs
zz pBak/ZZ pBak).
2.4 PAlgebra: The Structure of Z ∗ m and Z ∗ m/ 〈2〉
The class PAlgebra is the base class containing the structure of Z ∗ m, as well as the quotient group
Z ∗ m/ 〈2〉. We represent Z ∗ m as Z ∗ m = 〈2〉 × 〈g 1 , g 2 , . . .〉 × 〈h 1 , h 2 , . . .〉, where the g i ’s have the same
order in Z ∗ m as in Z ∗ m/ 〈2〉, and the h i ’s generate the group Z ∗ m/ 〈2, g 1 , g 2 , . . .〉 and they do not have
the same order in Z ∗ m as in Z ∗ m/ 〈2〉.
We compute this representation in a manner similar (but not identical) to the proof of the fundamental
theorem of finitely generated abelian groups. Namely we keep the elements in equivalence
classes of the “quotient group so far”, and each class has a representative element (called a pivot),
which in our case we just choose to be the smallest element in the class. Initially each element
is in its own class. At every step, we choose the highest order element g in the current quotient
group and add it as a new generator, then unify classes if their members are a factor of g from each
other, repeating this process until no further unification is possible. Since we are interested in the
quotient group Z ∗ m/ 〈2〉, we always choose 2 as the first generator.
One twist in this routine is that initially we only choose an element as a new generator if its
order in the current quotient group is the same as in the original group Z ∗ m. Only after no such
elements are available, do we begin to use generators that do not have the same order as in Z ∗ m.
Once we chose all the generators (and for each generator we compute its order in the quotient
group where it was chosen), we compute a set of “slot representatives” as follows: Putting all the
5