DGG Distribution (PublicKey CKKS)

[mmazz]

I’m trying to understand the implementation of the publicKey on CKKS.

When I go to the code, I have a problem to understand the DGG.

OpenFHE use DiscreteGaussianGeneratorImpl<VecType>::GenerateIntVector to get a seed, then use static_cast<int64_t>(FindInVector(m_vals, tmp)) * (seed > 0 ? 1 : -1);, etc, etc, etc.

1. Ignoring security reason, we can mainly said that it simple sample a gaussian distribution vector with values from -3.19 to 3.19, and then apply an NTT?

2. Another at openfhe-development/src/pke/lib/schemerns/rns-pke.cpp,
   When encrypting with public key with a secret key with gaussian distribution, e0, e1 and v are all sample from a gaussian with std = 3.19?

3. And I add another one:
   When we are creating the public key, basically we make pk = (e -a*s, a).
   When implementing it, this two things are analogous?
   a) Sample one a from an uniform distribution mod Q, and then mapped to an RNS form.
   b) Sample each limb individually form an uniform distribution mod qi

[ypolyakov]

@mmazz

Ignoring security reason, we can mainly said that it simple sample a gaussian distribution vector with values from -3.19 to 3.19, and then apply an NTT?

No, the values are between -3.19 \delta and 3.19 \delta , where \delta should normally be under 10. Gaussian values can be outside one standard deviation.

@mmazz

Another at openfhe-development/src/pke/lib/schemerns/rns-pke.cpp,
When encrypting with public key with a secret key with gaussian distribution, e0, e1 and v are all sample from a gaussian with std = 3.19?

Yes

@mmazz

When implementing it, this two things are analogous?
a) Sample one a from an uniform distribution mod Q, and then mapped to an RNS form.
b) Sample each limb individually form an uniform distribution mod qi

Yes

[mmazz]

@ypolyakov

No, the values are between -3.19 \delta −3.19δ-3.19 \delta and 3.19 \delta 3.19δ3.19 \delta , where \deltaδ\delta should normally be under 10. Gaussian values can be outside one standard deviation.

I meant that! I needed to confirm it because it was weird for me that the v that its used in encryption is that small compared with the ring qi.

Thanks!