EvalRot behaviour

[somnus]

@dcousins

“Why does it put zeros at the end instead of the rotated elements?”

When you encrypt a vector into a ciphertext, it actually stores it in the first available ‘slots’. There are ringsize/2 CKKS slots and ringsize BGV/BFV slots (there is a method that lets you get this value.
ALL other locations are zeroed out.

when you rotate a ciphertext you rotate the entire number of slots left and right. so the zeros come in from the other end.

take this example with a ringsize of 8 (that is artificial, they are never smaller than at least 2^10 slots for realistic security).
ct =[a b c 0 0 0 0] Rotated left one → [b c 0 0 0 0 a] rotated right one → [ 0 a b c 0 0 0]

rotating by negative numbers is left rotate, positive is right rotate. (forgive me if I get that backwards).
As Ian says, you have to generate the rotation keys for all indices you use (each key is large and takes storage, so we let you specify exactly which ones you want to generated).

Hi, it seems that in BFV it’s a bit different. It’s actually doing rotations in half of the ring size and in 2 batches. As I also mentioned here: Rotation in BFV

Suppose we have a ciphertext with 8192 slots encrypted using BFV, e.g., C = Enc([1, 2, 3, 4, …, 8192]).

Then we rotate this ciphertext for 1 step and get C’ = EvalRotate(C, 1).

I wanted to get C’ = Enc([8192, 1, 2, 3, 4, …, 8191]) but I noticed that the result is rotated in “2 batches”:
C’ = Enc([4096, 1, 2, 3, 4, …, 4095, 8192, 4097, 4098, 4099, …, 8191]).
That is, both the first and the second half of C are rotated by one step.

Is it possible to disable this feature and just rotate the whole ciphertext by one step? Or can I change the “batch number” and get C’ = Enc([128, 1, 2, 3, …, 127, 256, 129, 130, …, 255, …])?