def ffsampling_fft(t, T, sigmin, randombytes):
"""Compute the ffsampling of t, using T as auxilary information.
Args:
t: a vector
T: a ldl decomposition tree
Format: FFT
Corresponds to algorithm 11 (ffSampling) of Falcon's documentation.
"""
n = len(t[0]) * fft_ratio
z = [0, 0]
if (n > 1):
l10, T0, T1 = T
z[1] = merge_fft(
ffsampling_fft(split_fft(t[1]), T1, sigmin, randombytes))
t0b = add_fft(t[0], mul_fft(sub_fft(t[1], z[1]), l10))
z[0] = merge_fft(
ffsampling_fft(split_fft(t0b), T0, sigmin, randombytes))
return z
elif (n == 1):
z[0] = [samplerz(t[0][0].real, T[0], sigmin, randombytes)]
z[1] = [samplerz(t[1][0].real, T[0], sigmin, randombytes)]
return z
def ffldl_fft(G):
"""
Compute the ffLDL decomposition tree of G.
Input:
G A Gram matrix
Output:
T The ffLDL decomposition tree of G
Format: FFT
Similar to algorithm ffLDL of Falcon's documentation.
"""
m = len(G) - 1
d = len(G[0][0]) * fft_ratio
# LDL decomposition
L, D = ldl_fft(G)
# General case
if (d > 2):
rep = [L]
for i in range(m + 1):
# Split the output
d0, d1 = split_fft(D[i][i])
Gi = [[d0, d1], [adj_fft(d1), d0]]
# Recursive call on the split parts
rep += [ffldl_fft(Gi)]
return rep
# Bottom case
elif (d == 2):
# Each element is real
return [L, D[0][0], D[1][1]]
def ffnp_fft(t, T):
"""
Compute the FFNP reduction of t, using T as auxilary information.
Input:
t A vector
T The LDL decomposition tree of an (implicit) matrix G
Output:
z An integer vector such that (t - z) * B is short
Format: FFT
"""
m = len(t)
n = len(t[0]) * fft_ratio
z = [None] * m
# General case
if (n > 1):
L = T[0]
for i in range(m - 1, -1, -1):
# t[i] is "corrected", taking into accounts the t[j], z[j] (j > i)
tib = t[i][:]
for j in range(m - 1, i, -1):
tib = add_fft(tib, mul_fft(sub_fft(t[j], z[j]), L[j][i]))
# Recursive call
z[i] = merge_fft(ffnp_fft(split_fft(tib), T[i + 1]))
return z
# Bottom case: round each coefficient in parallel
elif (n == 1):
z[0] = [round(t[0][0].real)]
z[1] = [round(t[1][0].real)]
return z
def ffnp_fft(t, T):
"""Compute the ffnp reduction of t, using T as auxilary information.
Args:
t: a vector
T: a ldl decomposition tree
Format: FFT
"""
n = len(t[0]) * fft_ratio
z = [0, 0]
if (n > 1):
l10, T0, T1 = T
z[1] = merge_fft(ffnp_fft(split_fft(t[1]), T1))
t0b = add_fft(t[0], mul_fft(sub_fft(t[1], z[1]), l10))
z[0] = merge_fft(ffnp_fft(split_fft(t0b), T0))
return z
elif (n == 1):
z[0] = [round(t[0][0].real)]
z[1] = [round(t[1][0].real)]
return z
def ffldl_fft(G):
"""Compute the ffLDL decomposition tree of G.
Args:
G: a Gram matrix
Format: FFT
Corresponds to algorithm 9 (ffLDL) of Falcon's documentation.
"""
n = len(G[0][0]) * fft_ratio
L, D = ldl_fft(G)
# Coefficients of L, D are elements of R[x]/(x^n - x^(n/2) + 1), in FFT representation
if (n > 2):
# A bisection is done on elements of a 2*2 diagonal matrix.
d00, d01 = split_fft(D[0][0])
d10, d11 = split_fft(D[1][1])
G0 = [[d00, d01], [adj_fft(d01), d00]]
G1 = [[d10, d11], [adj_fft(d11), d10]]
return [L[1][0], ffldl_fft(G0), ffldl_fft(G1)]
elif (n == 2):
# End of the recursion (each element is real).
return [L[1][0], D[0][0], D[1][1]]
def ffsampling_fft(t, T):
"""
Compute the fast Fourier sampling of t, using T as auxilary information.
Input:
t A vector
T The LDL decomposition tree of an (implicit) matrix G
Output:
z An integer vector such that (t - z) * B is short
Format: FFT
This algorithim is a randomized version of ffnp_fft,
such that z * B is distributed as a spherical Gaussian
centered around t * B.
"""
m = len(t)
n = len(t[0]) * fft_ratio
z = [None] * m
# General case
if (n > 1):
L = T[0]
for i in range(m - 1, -1, -1):
# t[i] is "corrected", taking into accounts the t[j], z[j] (j > i)
tib = t[i][:]
for j in range(m - 1, i, -1):
tib = add_fft(tib, mul_fft(sub_fft(t[j], z[j]), L[j][i]))
# Recursive call
z[i] = merge_fft(ffsampling_fft(split_fft(tib), T[i + 1]))
return z
# Bottom case: round each coefficient in parallel
elif (n == 1):
z[0] = [sampler_z(T[0], t[0][0].real)]
z[1] = [sampler_z(T[0], t[1][0].real)]
return z