fhelium.engine.ckks_encryptor

CKKS encryption for exact Plaintext values.

CkksEncryptor

class View source

CkksEncryptor(*, config: CkksConfig, device: torch.device, rng: Csprng, rns_layout: RnsLayout, rns_runtime: RnsRuntime, montgomery_parameters: MontgomeryParameters, plaintext_codec: CkksPlaintextCodec, engine_id: str, validate_public_level: Callable[[object], int], ciphertext_from_components: Callable[..., Ciphertext])

Encrypt exact coefficients under one engine-owned public key policy.

The component constructs two-component phases $c_0(X)+c_1(X)s(X)=p(X)+e(X)(\mathrm{mod}{B}_{\ell })$. It owns no key inventory, context, random-number generator, or native runtime; those dependencies are bound by fhelium.engine.CkksEngine.

encrypt

method

def encrypt(plaintext: Plaintext, public_key: PublicKey) -> Ciphertext: ...

Encrypt exact integer coefficients under public_key.

For $p(X)\in R$, generate a phase

$$c_0(X)+c_1(X)s(X)=p(X)+e(X)(\mathrm{mod}{B}_{\ell }).$$

Slots input is encoded first using its stored actual scale. Decode-only approximate_coefficients and RNS input are rejected. Input layout [*batch, coefficient] has engine integral dtype/device and final extent $N$. The new output has [component=2, *batch, limb, coefficient] layout, coefficient domain, canonical standard residues, Q or QP basis selected by the public key, exact active prime_ids, unchanged level, and $\mathrm{\Delta }(c)=\mathrm{\Delta }(p)$. Inputs are not mutated and output storage is independent.

encrypt_message

method

def encrypt_message(message, public_key: PublicKey, *, level: int=0, scale=None) -> Ciphertext: ...

Encode and encrypt one CKKS message at the provided per-value scale.

For canonical slots $m$, compute

$$p_i=\mathrm{SRound}(\mathrm{\Delta }{\mathcal{E}}_g^{-1}(m{)}_i)$$

and encrypt so that $c_0(X)+c_1(X)s(X)=p(X)+e(X)(\mathrm{mod}{B}_{\ell })$.

Coefficients are quantized with the codec's stochastic-rounding law. Ordinary bounded coefficients use the native CUDA lift. If any scaled coefficient exceeds int64, safe coefficients are still stochastically rounded while already-integral wide binary64 coefficients are converted to Python integers and reduced into each RNS row. Both paths produce the same semantic ciphertext representation. Output has layout [component=2, *batch, limb, coefficient], engine integral dtype/device, coefficient domain, canonical standard residues, exact Q or QP prime_ids selected by the key, requested level, and actual scale $\mathrm{\Delta }$. It owns independent storage; message/key inputs are not mutated.