fhelium.config.security

Assess complete HE moduli against one exact published parameter table.

The built-in budgets reproduce the parameter limits published in Security Guidelines for Implementing Homomorphic Encryption, IACR Communications in Cryptology 2025. The source data was generated with lattice-estimator and the classical RC.MATZOV cost model measured in ring operations. Its attack set includes primal_usvp, primal_bdd, hybrid_bdd (for N <= 2^14), and hybrid_dual. These values are estimator outputs rather than security proofs. The functions perform no interpolation or extrapolation.

SecurityAssessment

class View source

SecurityAssessment(status: Literal['meets', 'exceeds', 'unsupported'], ring_dimension: int, target_bits: int, secret_distribution: str, error_stddev: float, modulus_bits: int, maximum_modulus_bits: int | None, modulus_margin_bits: int | None, reason: str | None)

Immutable result of one exact built-in parameter assessment.

status is "meets" when $\lceil {\log }_{2}q\rceil$ is at most the exact table budget, "exceeds" when it is larger, and "unsupported" when no exact table row matches the assumptions. An unsupported result has None for maximum_modulus_bits and modulus_margin_bits. A negative modulus margin reports how far a supported parameter tuple exceeds its modulus budget; it is not a bit-security margin.

Attributes

Name	Type	Default/value
status	Literal['meets', 'exceeds', 'unsupported']
ring_dimension	int
target_bits	int
secret_distribution	str
error_stddev	float
modulus_bits	int
maximum_modulus_bits	int | None
modulus_margin_bits	int | None
reason	str | None

assess_config_security

function View source

def assess_config_security(config: CkksConfig) -> SecurityAssessment: ...

Assess a fhelium.config.CkksConfig complete QP modulus.

assess_security

function View source

def assess_security(ring_dimension: int, *, modulus: int | None=None, moduli: Sequence[int] | None=None, target_bits: int=128, secret_distribution: str='ternary', error_stddev: float=_TABLE_ERROR_STANDARD_DEVIATION) -> SecurityAssessment: ...

Assess a complete modulus against one exact built-in budget row.

Parameters

• ring_dimension: Polynomial-ring dimension N.
• modulus: Exact complete parameter modulus q. For CKKS hybrid key switching this is Q * P.
• moduli: Exact factors of the complete parameter modulus. Specify this or modulus, but not both.
• target_bits: Classical security category.
• secret_distribution: Exact table secret distribution, "ternary" or "gaussian".
• error_stddev: Gaussian error standard deviation. The built-in budgets support exactly 3.19.

Returns

A structured assessment with status, exact integer modulus-bit width, budget, margin, and an unsupported reason when applicable. Parameters without an exact row return status="unsupported"; this function never interpolates or extrapolates.

Raises

• TypeError: If an input has the wrong structural type.
• ValueError: If a numeric input is non-positive or non-finite, or the modulus inputs are missing or ambiguous.