Record Grotto half-ulp tables and comparison geneval, and factor shared beaver terms before the quotient.
Horner and window evaluation need those tables in the tree. Comparison geneval opens the same value words as a Doerner–Shelat key. A factor common to every polynomial term is multiplied first so that preprocessing stays smaller. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
parent
3f10e05176
commit
875f09fec1
14 changed files with 42668 additions and 184 deletions
|
|
@ -2,19 +2,19 @@
|
|||
/// @brief Noninteractive cubic evaluation after the public offset is opened.
|
||||
/// @details The dealer keys one comparison at `center` per power
|
||||
/// `1, center, center^2, center^3` in Z/2^64. After the parties open
|
||||
/// `eta`, each party shifts the knots by `eta` and sorts them. The
|
||||
/// `eta`, each party shifts the knots by `eta`, inserts the domain
|
||||
/// minimum and the public carry threshold, and sorts. The
|
||||
/// sign-respecting segment walk then returns additive shares of
|
||||
/// `center^m` on the piece that contains the wrapped sum
|
||||
/// `center + eta`, and shares of 0 on the other pieces. A public
|
||||
/// binomial combination of those shares is a share of the coefficients
|
||||
/// of that piece as a polynomial in `eta`. Horner at the public `eta`
|
||||
/// needs no further round.
|
||||
/// `center^m` on the refined piece that contains `center`. On each
|
||||
/// refined piece the wrapped input is `center + kappa` for a public
|
||||
/// `kappa`: `eta` on the side that does not overflow, and
|
||||
/// `eta ∓ 2^n` on the side that does. A public binomial shift by that
|
||||
/// `kappa`, dotted with the segment shares, is a share of the
|
||||
/// polynomial at the wrapped group element. No further round.
|
||||
///
|
||||
/// The opened value is that polynomial at `lift(center) + lift(eta)`
|
||||
/// in Z/2^64. `lift` sign-extends a signed domain element and
|
||||
/// zero-extends an unsigned one. This equals the polynomial at the
|
||||
/// wrapped group element only when the domain addition does not
|
||||
/// overflow. Piece selection still follows the wrapped element.
|
||||
/// Domains of 63 bits or more are already the ring Z/2^64, so the
|
||||
/// carry adjustment is the identity there. `lift` sign-extends a
|
||||
/// signed domain element and zero-extends an unsigned one.
|
||||
///
|
||||
/// `offset_horner_at_x_plus_r` is the wiring from the reconstruction
|
||||
/// the parties already do: `eta = x - r` and `center = 2r`.
|
||||
|
|
@ -26,6 +26,8 @@
|
|||
#include <array>
|
||||
#include <cstddef>
|
||||
#include <cstdint>
|
||||
#include <limits>
|
||||
#include <optional>
|
||||
#include <stdexcept>
|
||||
#include <tuple>
|
||||
#include <type_traits>
|
||||
|
|
@ -159,18 +161,13 @@ std::vector<shifted_piece<Degree, InputT>> shift_and_sort(
|
|||
return rows;
|
||||
}
|
||||
|
||||
template <typename Key, typename InputT>
|
||||
std::vector<uint64_t> segments_of(const Key & key, const std::vector<InputT> & knots,
|
||||
uint64_t wrap_share)
|
||||
inline std::vector<uint64_t> segments_from_prefixes(
|
||||
const std::vector<uint64_t> & prefix, uint64_t wrap_share, uint64_t mask)
|
||||
{
|
||||
using namespace dpf::detail::dcf_impl;
|
||||
const std::size_t n = knots.size();
|
||||
const uint64_t mask = key.cmp().mask;
|
||||
const std::size_t n = prefix.size();
|
||||
if (n == 1)
|
||||
return std::vector<uint64_t>{wrap_share & mask};
|
||||
|
||||
std::vector<uint64_t> prefix(n);
|
||||
signed_prefix_parities_into(key, knots.data(), n, prefix.data());
|
||||
std::vector<uint64_t> seg(n);
|
||||
for (std::size_t i = 0; i < n; ++i)
|
||||
{
|
||||
|
|
@ -181,23 +178,87 @@ std::vector<uint64_t> segments_of(const Key & key, const std::vector<InputT> & k
|
|||
return seg;
|
||||
}
|
||||
|
||||
template <std::size_t Degree>
|
||||
void accumulate(std::array<uint64_t, Degree + 1> & out,
|
||||
const std::array<std::vector<uint64_t>, Degree + 1> & seg,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff)
|
||||
template <typename Key, typename InputT>
|
||||
std::vector<uint64_t> segments_of(const Key & key, const std::vector<InputT> & knots,
|
||||
uint64_t wrap_share)
|
||||
{
|
||||
const std::size_t n = coeff.size();
|
||||
for (std::size_t i = 0; i < n; ++i)
|
||||
const std::size_t n = knots.size();
|
||||
if (n == 1)
|
||||
return std::vector<uint64_t>{wrap_share & key.cmp().mask};
|
||||
std::vector<uint64_t> prefix(n);
|
||||
signed_prefix_parities_into(key, knots.data(), n, prefix.data());
|
||||
return segments_from_prefixes(prefix, wrap_share, key.cmp().mask);
|
||||
}
|
||||
|
||||
template <typename T>
|
||||
int64_t math_lift(T value) noexcept
|
||||
{
|
||||
if constexpr (std::is_signed_v<T>)
|
||||
return static_cast<int64_t>(value);
|
||||
else
|
||||
return static_cast<int64_t>(lift(value));
|
||||
}
|
||||
|
||||
template <typename T>
|
||||
T domain_min() noexcept
|
||||
{
|
||||
if constexpr (std::is_signed_v<T>)
|
||||
return std::numeric_limits<T>::min();
|
||||
else
|
||||
return T{0};
|
||||
}
|
||||
|
||||
/// Public center-space cut where `center + eta` crosses the domain end.
|
||||
/// Empty when that cut is outside the domain, including `eta == 0`.
|
||||
template <typename T>
|
||||
std::optional<T> carry_threshold(T eta) noexcept
|
||||
{
|
||||
constexpr unsigned bits = dpf::utils::bitlength_of_v<T>;
|
||||
if (bits > 62)
|
||||
return std::nullopt;
|
||||
const int64_t mod = int64_t{1} << bits;
|
||||
const int64_t half = mod >> 1;
|
||||
const int64_t ez = math_lift(eta);
|
||||
if constexpr (std::is_signed_v<T>)
|
||||
{
|
||||
for (std::size_t m = 0; m <= Degree; ++m)
|
||||
{
|
||||
for (std::size_t k = 0; k <= m; ++k)
|
||||
{
|
||||
// seg[m-k] opens to center^{m-k} on this piece.
|
||||
const uint64_t weight = seg[m - k][i];
|
||||
out[k] += weight * coeff[i][m] * binom[m][k];
|
||||
}
|
||||
}
|
||||
if (ez > 0)
|
||||
return static_cast<T>(half - ez);
|
||||
if (ez < 0)
|
||||
return static_cast<T>(-half - ez);
|
||||
return std::nullopt;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (ez == 0)
|
||||
return std::nullopt;
|
||||
return static_cast<T>(mod - ez);
|
||||
}
|
||||
}
|
||||
|
||||
/// `center + kappa` is the wrapped representative, as a mathematical integer.
|
||||
template <typename T>
|
||||
int64_t kappa_for(T left, T eta) noexcept
|
||||
{
|
||||
constexpr unsigned bits = dpf::utils::bitlength_of_v<T>;
|
||||
const int64_t ez = math_lift(eta);
|
||||
if (bits > 62)
|
||||
return ez;
|
||||
const int64_t mod = int64_t{1} << bits;
|
||||
const int64_t left_i = math_lift(left);
|
||||
if constexpr (std::is_signed_v<T>)
|
||||
{
|
||||
const int64_t half = mod >> 1;
|
||||
if (ez > 0 && left_i >= half - ez)
|
||||
return ez - mod;
|
||||
if (ez < 0 && left_i < -half - ez)
|
||||
return ez + mod;
|
||||
return ez;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (ez != 0 && left_i >= mod - ez)
|
||||
return ez - mod;
|
||||
return ez;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -232,6 +293,85 @@ std::array<uint64_t, Degree + 1> binomial_coefficients(
|
|||
return c;
|
||||
}
|
||||
|
||||
template <std::size_t Degree, typename InputT>
|
||||
struct prepared_piece
|
||||
{
|
||||
InputT knot{};
|
||||
std::array<uint64_t, Degree + 1> coeff{};
|
||||
int64_t kappa = 0;
|
||||
};
|
||||
|
||||
template <std::size_t Degree, typename InputT>
|
||||
void insert_cut(std::vector<shifted_piece<Degree, InputT>> & rows, InputT point)
|
||||
{
|
||||
for (const auto & row : rows)
|
||||
{
|
||||
if (row.knot == point)
|
||||
return;
|
||||
}
|
||||
std::vector<InputT> knots;
|
||||
knots.reserve(rows.size());
|
||||
for (const auto & row : rows)
|
||||
knots.push_back(row.knot);
|
||||
const int hot = piece_index<Degree>(point, knots);
|
||||
shifted_piece<Degree, InputT> extra;
|
||||
extra.knot = point;
|
||||
extra.coeff = rows[static_cast<std::size_t>(hot)].coeff;
|
||||
rows.push_back(std::move(extra));
|
||||
std::sort(rows.begin(), rows.end(),
|
||||
[](const shifted_piece<Degree, InputT> & a, const shifted_piece<Degree, InputT> & b) {
|
||||
return a.knot < b.knot;
|
||||
});
|
||||
}
|
||||
|
||||
template <std::size_t Degree, typename InputT>
|
||||
std::vector<prepared_piece<Degree, InputT>> prepare_pieces(
|
||||
const std::vector<InputT> & knots,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff,
|
||||
InputT eta)
|
||||
{
|
||||
auto rows = shift_and_sort<Degree>(knots, coeff, eta);
|
||||
constexpr unsigned bits = dpf::utils::bitlength_of_v<InputT>;
|
||||
if (bits <= 62)
|
||||
{
|
||||
insert_cut<Degree>(rows, domain_min<InputT>());
|
||||
if (const auto cut = carry_threshold(eta))
|
||||
insert_cut<Degree>(rows, *cut);
|
||||
}
|
||||
std::vector<prepared_piece<Degree, InputT>> out;
|
||||
out.reserve(rows.size());
|
||||
for (const auto & row : rows)
|
||||
{
|
||||
prepared_piece<Degree, InputT> piece;
|
||||
piece.knot = row.knot;
|
||||
piece.coeff = row.coeff;
|
||||
piece.kappa = kappa_for(row.knot, eta);
|
||||
out.push_back(std::move(piece));
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
/// `out[k]` sums to the polynomial at the wrapped input. It is
|
||||
/// `center^k` times the public binomial coefficient of `kappa`, not a
|
||||
/// coefficient you Horner-evaluate at `eta`.
|
||||
template <std::size_t Degree>
|
||||
std::array<uint64_t, Degree + 1> contributions(
|
||||
const std::array<std::vector<uint64_t>, Degree + 1> & seg,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff,
|
||||
const std::vector<int64_t> & kappa)
|
||||
{
|
||||
std::array<uint64_t, Degree + 1> out{};
|
||||
const std::size_t n = coeff.size();
|
||||
for (std::size_t i = 0; i < n; ++i)
|
||||
{
|
||||
const auto q = binomial_coefficients<Degree>(
|
||||
coeff[i], static_cast<uint64_t>(kappa[i]));
|
||||
for (std::size_t k = 0; k <= Degree; ++k)
|
||||
out[k] += seg[k][i] * q[k];
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
} // namespace offset_horner_detail
|
||||
|
||||
/// Both parties' comparison keys and wrap-piece shares for one center.
|
||||
|
|
@ -272,7 +412,9 @@ offset_horner_keys<InputT, Degree> make_offset_horner_keys(InputT center)
|
|||
return mat;
|
||||
}
|
||||
|
||||
/// Cleartext coefficients of the selected piece, shifted to `center`, in Z/2^64.
|
||||
/// Cleartext binomial coefficients of the selected refined piece in the
|
||||
/// variable `center`: Horner at `lift(center)` is the polynomial at the
|
||||
/// wrapped input.
|
||||
template <std::size_t Degree, typename InputT>
|
||||
std::array<uint64_t, Degree + 1> offset_horner_clear_coefficients(
|
||||
InputT center,
|
||||
|
|
@ -282,15 +424,18 @@ std::array<uint64_t, Degree + 1> offset_horner_clear_coefficients(
|
|||
{
|
||||
using namespace offset_horner_detail;
|
||||
check_knots(knots, coeff.size());
|
||||
const auto rows = shift_and_sort<Degree>(knots, coeff, eta);
|
||||
std::vector<InputT> shifted(rows.size());
|
||||
for (std::size_t i = 0; i < rows.size(); ++i)
|
||||
shifted[i] = rows[i].knot;
|
||||
const int hot = piece_index<Degree>(center, shifted);
|
||||
return binomial_coefficients<Degree>(rows[static_cast<std::size_t>(hot)].coeff, lift(center));
|
||||
const auto pieces = prepare_pieces<Degree>(knots, coeff, eta);
|
||||
std::vector<InputT> cuts;
|
||||
cuts.reserve(pieces.size());
|
||||
for (const auto & piece : pieces)
|
||||
cuts.push_back(piece.knot);
|
||||
const int hot = piece_index<Degree>(center, cuts);
|
||||
const auto & piece = pieces[static_cast<std::size_t>(hot)];
|
||||
return binomial_coefficients<Degree>(
|
||||
piece.coeff, static_cast<uint64_t>(piece.kappa));
|
||||
}
|
||||
|
||||
/// Cleartext value: selected piece at `lift(center) + lift(eta)` in Z/2^64.
|
||||
/// Cleartext value of the selected piece at the wrapped `center + eta`.
|
||||
template <std::size_t Degree, typename InputT>
|
||||
uint64_t offset_horner_clear(
|
||||
InputT center,
|
||||
|
|
@ -299,7 +444,40 @@ uint64_t offset_horner_clear(
|
|||
InputT eta)
|
||||
{
|
||||
const auto c = offset_horner_clear_coefficients<Degree>(center, knots, coeff, eta);
|
||||
return offset_horner_detail::horner_at<Degree>(c, offset_horner_detail::lift(eta));
|
||||
return offset_horner_detail::horner_at<Degree>(c, offset_horner_detail::lift(center));
|
||||
}
|
||||
|
||||
/// `Party` selects `.first` or `.second` of each key pair.
|
||||
template <std::size_t Party, std::size_t Degree, typename InputT, typename KeyPair>
|
||||
std::array<uint64_t, Degree + 1> offset_horner_coefficient_share(
|
||||
const std::vector<KeyPair> & keys,
|
||||
const std::array<std::array<uint64_t, 2>, Degree + 1> & wrap_share,
|
||||
const std::vector<InputT> & knots,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff,
|
||||
InputT eta)
|
||||
{
|
||||
static_assert(Party < 2, "offset horner party is 0 or 1");
|
||||
using namespace offset_horner_detail;
|
||||
check_knots(knots, coeff.size());
|
||||
if (keys.size() != Degree + 1)
|
||||
throw std::invalid_argument("offset horner: one comparison key per power");
|
||||
const auto pieces = prepare_pieces<Degree>(knots, coeff, eta);
|
||||
std::vector<InputT> shifted(pieces.size());
|
||||
std::vector<std::array<uint64_t, Degree + 1>> ordered(pieces.size());
|
||||
std::vector<int64_t> kappa(pieces.size());
|
||||
for (std::size_t i = 0; i < pieces.size(); ++i)
|
||||
{
|
||||
shifted[i] = pieces[i].knot;
|
||||
ordered[i] = pieces[i].coeff;
|
||||
kappa[i] = pieces[i].kappa;
|
||||
}
|
||||
|
||||
std::array<std::vector<uint64_t>, Degree + 1> seg;
|
||||
for (std::size_t m = 0; m <= Degree; ++m)
|
||||
{
|
||||
seg[m] = segments_of(std::get<Party>(keys[m]), shifted, wrap_share[m][Party]);
|
||||
}
|
||||
return contributions<Degree>(seg, ordered, kappa);
|
||||
}
|
||||
|
||||
/// One party's coefficient shares. `Party` is 0 or 1.
|
||||
|
|
@ -310,30 +488,164 @@ std::array<uint64_t, Degree + 1> offset_horner_coefficient_share(
|
|||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff,
|
||||
InputT eta)
|
||||
{
|
||||
static_assert(Party < 2, "offset horner party is 0 or 1");
|
||||
using namespace offset_horner_detail;
|
||||
std::vector<typename offset_horner_keys<InputT, Degree>::key_pair> keys(
|
||||
mat.keys.begin(), mat.keys.end());
|
||||
return offset_horner_coefficient_share<Party, Degree>(
|
||||
keys, mat.wrap_share, knots, coeff, eta);
|
||||
}
|
||||
|
||||
/// Both parties' Horner shares from one joint Doerner–Shelat generation.
|
||||
/// `center0 XOR center1` is the comparison point, in geneval's share
|
||||
/// convention (the signed MSB of `center0` is flipped before the XOR, and
|
||||
/// flipped back here). `eta` is already public.
|
||||
template <std::size_t Degree, typename InputT>
|
||||
struct geneval_offset_horner_result
|
||||
{
|
||||
static_assert(Degree <= offset_horner_max_degree, "offset horner degree is at most 3");
|
||||
|
||||
InputT center{};
|
||||
InputT eta{};
|
||||
std::array<uint64_t, Degree + 1> coeff0{};
|
||||
std::array<uint64_t, Degree + 1> coeff1{};
|
||||
uint64_t value0 = 0;
|
||||
uint64_t value1 = 0;
|
||||
};
|
||||
|
||||
/// Logical comparison point for geneval's XOR shares. Matches `make_dpf(P)`
|
||||
/// when `center1 = P XOR center0` or when `center0 = P` and `center1 = 0`.
|
||||
template <typename InputT>
|
||||
InputT geneval_offset_horner_center(InputT center0, InputT center1)
|
||||
{
|
||||
InputT flipped0 = center0;
|
||||
dpf::utils::flip_msb_if_signed_integral(flipped0);
|
||||
InputT mixed = dpf::utils::xor_input_shares(flipped0, center1);
|
||||
dpf::utils::flip_msb_if_signed_integral(mixed);
|
||||
return mixed;
|
||||
}
|
||||
|
||||
namespace offset_horner_detail
|
||||
{
|
||||
|
||||
template <std::size_t Degree, typename InputT, typename Rng>
|
||||
geneval_offset_horner_result<Degree, InputT> geneval_at(
|
||||
InputT center0, InputT center1, InputT center, InputT eta,
|
||||
const std::vector<InputT> & knots,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff,
|
||||
Rng rng)
|
||||
{
|
||||
check_knots(knots, coeff.size());
|
||||
const auto rows = shift_and_sort<Degree>(knots, coeff, eta);
|
||||
std::vector<InputT> shifted(rows.size());
|
||||
std::vector<std::array<uint64_t, Degree + 1>> ordered(rows.size());
|
||||
for (std::size_t i = 0; i < rows.size(); ++i)
|
||||
const auto pieces = prepare_pieces<Degree>(knots, coeff, eta);
|
||||
std::vector<InputT> shifted(pieces.size());
|
||||
std::vector<std::array<uint64_t, Degree + 1>> ordered(pieces.size());
|
||||
std::vector<int64_t> kappa(pieces.size());
|
||||
for (std::size_t i = 0; i < pieces.size(); ++i)
|
||||
{
|
||||
shifted[i] = rows[i].knot;
|
||||
ordered[i] = rows[i].coeff;
|
||||
shifted[i] = pieces[i].knot;
|
||||
ordered[i] = pieces[i].coeff;
|
||||
kappa[i] = pieces[i].kappa;
|
||||
}
|
||||
|
||||
std::array<std::vector<uint64_t>, Degree + 1> seg;
|
||||
uint64_t payload[Degree + 1];
|
||||
fill_payloads<Degree>(lift(center), payload);
|
||||
|
||||
std::array<std::array<uint64_t, 2>, Degree + 1> wrap{};
|
||||
std::array<std::vector<uint64_t>, Degree + 1> seg0;
|
||||
std::array<std::vector<uint64_t>, Degree + 1> seg1;
|
||||
for (std::size_t m = 0; m <= Degree; ++m)
|
||||
{
|
||||
seg[m] = segments_of(std::get<Party>(mat.keys[m]), shifted,
|
||||
mat.wrap_share[m][Party]);
|
||||
const auto opened = dpf::geneval_cmp(center0, center1,
|
||||
shifted.begin(), shifted.end(), rng, payload[m]);
|
||||
const uint64_t blind = dpf::uniform_sample<uint64_t>();
|
||||
wrap[m][0] = blind;
|
||||
wrap[m][1] = payload[m] - blind;
|
||||
seg0[m] = segments_from_prefixes(opened.party0, wrap[m][0], opened.mask);
|
||||
seg1[m] = segments_from_prefixes(opened.party1, wrap[m][1], opened.mask);
|
||||
}
|
||||
std::array<uint64_t, Degree + 1> out{};
|
||||
accumulate<Degree>(out, seg, ordered);
|
||||
|
||||
geneval_offset_horner_result<Degree, InputT> out;
|
||||
out.center = center;
|
||||
out.eta = eta;
|
||||
out.coeff0 = contributions<Degree>(seg0, ordered, kappa);
|
||||
out.coeff1 = contributions<Degree>(seg1, ordered, kappa);
|
||||
for (uint64_t term : out.coeff0)
|
||||
out.value0 += term;
|
||||
for (uint64_t term : out.coeff1)
|
||||
out.value1 += term;
|
||||
return out;
|
||||
}
|
||||
|
||||
/// One party's share of the cubic at `lift(center) + lift(eta)`.
|
||||
} // namespace offset_horner_detail
|
||||
|
||||
/// Geneval-style offset Horner. The center is XOR-shared as in `geneval_point`.
|
||||
/// Comparison keys are opened with the same local Doerner–Shelat protocol
|
||||
/// geneval uses for its correction words. The value dot uses the per-piece
|
||||
/// carry shift and is local.
|
||||
/// A value-correction word is required on every level of the secret path, so
|
||||
/// this does not stop early the way a leaf trie does.
|
||||
template <std::size_t Degree = offset_horner_max_degree,
|
||||
typename InputT,
|
||||
typename Rng>
|
||||
geneval_offset_horner_result<Degree, InputT> geneval_offset_horner(
|
||||
InputT center0, InputT center1, InputT eta,
|
||||
const std::vector<InputT> & knots,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff,
|
||||
Rng rng)
|
||||
{
|
||||
const InputT center = geneval_offset_horner_center(center0, center1);
|
||||
return offset_horner_detail::geneval_at<Degree>(
|
||||
center0, center1, center, eta, knots, coeff, std::move(rng));
|
||||
}
|
||||
|
||||
template <std::size_t Degree = offset_horner_max_degree, typename InputT>
|
||||
geneval_offset_horner_result<Degree, InputT> geneval_offset_horner(
|
||||
InputT center0, InputT center1, InputT eta,
|
||||
const std::vector<InputT> & knots,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff)
|
||||
{
|
||||
using block = typename dpf::prg::aes128::block_type;
|
||||
dpf::ds_randomness<block (*)(), dpf::detail::urandom_pad_rng> rng{
|
||||
dpf::uniform_sample<block>, {}};
|
||||
return geneval_offset_horner<Degree>(
|
||||
center0, center1, eta, knots, coeff, std::move(rng));
|
||||
}
|
||||
|
||||
/// Additive shares of the input `x` and the mask `r`. Reconstructs
|
||||
/// `eta = x - r` and `center = 2r`, XOR-shares that center as `(center, 0)`,
|
||||
/// and returns both parties' Horner shares of the cubic at `x + r`
|
||||
/// (the group element `x + r`).
|
||||
template <std::size_t Degree = offset_horner_max_degree,
|
||||
typename InputT,
|
||||
typename Rng>
|
||||
geneval_offset_horner_result<Degree, InputT> geneval_offset_horner(
|
||||
InputT x0, InputT x1, InputT r0, InputT r1,
|
||||
const std::vector<InputT> & knots,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff,
|
||||
Rng rng)
|
||||
{
|
||||
const InputT x = offset_horner_group_add(x0, x1);
|
||||
const InputT r = offset_horner_group_add(r0, r1);
|
||||
const InputT eta = offset_horner_group_sub(x, r);
|
||||
const InputT center = offset_horner_group_add(r, r);
|
||||
InputT zero{};
|
||||
return offset_horner_detail::geneval_at<Degree>(
|
||||
center, zero, center, eta, knots, coeff, std::move(rng));
|
||||
}
|
||||
|
||||
template <std::size_t Degree = offset_horner_max_degree, typename InputT>
|
||||
geneval_offset_horner_result<Degree, InputT> geneval_offset_horner(
|
||||
InputT x0, InputT x1, InputT r0, InputT r1,
|
||||
const std::vector<InputT> & knots,
|
||||
const std::vector<std::array<uint64_t, Degree + 1>> & coeff)
|
||||
{
|
||||
using block = typename dpf::prg::aes128::block_type;
|
||||
dpf::ds_randomness<block (*)(), dpf::detail::urandom_pad_rng> rng{
|
||||
dpf::uniform_sample<block>, {}};
|
||||
return geneval_offset_horner<Degree>(
|
||||
x0, x1, r0, r1, knots, coeff, std::move(rng));
|
||||
}
|
||||
|
||||
/// One party's share of the cubic at the wrapped `center + eta`.
|
||||
/// Sum the coefficient shares; they are already scaled by `center^k`.
|
||||
template <std::size_t Party, std::size_t Degree, typename InputT>
|
||||
uint64_t offset_horner_eval(
|
||||
const offset_horner_keys<InputT, Degree> & mat,
|
||||
|
|
@ -342,7 +654,10 @@ uint64_t offset_horner_eval(
|
|||
InputT eta)
|
||||
{
|
||||
const auto shares = offset_horner_coefficient_share<Party, Degree>(mat, knots, coeff, eta);
|
||||
return offset_horner_detail::horner_at<Degree>(shares, offset_horner_detail::lift(eta));
|
||||
uint64_t value = 0;
|
||||
for (uint64_t term : shares)
|
||||
value += term;
|
||||
return value;
|
||||
}
|
||||
|
||||
} // namespace grotto
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue