CKKS encode encrypt in R

This blog posts shows how to perform CKKS encoding and encryption, followed by decryption and decoding to obtain the original vector of complex numbers.

The code uses the R package polynom for polynomials. It also uses the HomomorphicEncryption package. If you are reading this before 30 December 2023, you need to install the development version of HomomorphicEncryption from Github. If you are reading it from 30 December 2023, you can install it from CRAN (make sure it is up to date).

Load libraries that will be used.

library(polynom)
library(HomomorphicEncryption)

Set a working seed for random numbers (so that random numbers can be replicated exactly).

set.seed(123)

Set some parameters.

M     <- 8
N     <- M / 2
scale <- 200
xi    <- complex(real = cos(2 * pi / M), imaginary = sin(2 * pi / M))

Create the (complex) numbers we will encode.

z <- c(complex(real=3, imaginary=4), complex(real=2, imaginary=-1))
print(z)
#> [1] 3+4i 2-1i

Now we encode the vector of complex numbers to a polynomial.

m <- encode(xi, M, scale, z)

Let’s view the result.

print(m)
#> 500 + 283*x + 500*x^2 + 142*x^3

Set some parameters.

d  =   4
n  =   2^d
p  =   (n/2)-1
q  = 874
pm = GenPolyMod(n)

Create the secret key and the polynomials a and e, which will go into the public key

# generate a secret key
s = GenSecretKey(n)

# generate a
a = GenA(n, q)

# generate the error
e = GenError(n)

Generate the public key.

pk0 = GenPubKey0(a, s, e, pm, q)
pk1 = GenPubKey1(a)

Create polynomials for the encryption

# polynomials for encryption
e1 = GenError(n)
e2 = GenError(n)
u  = GenU(n)

Generate the ciphertext

ct0 = CoefMod((pk0*u + e1 + m) %% pm, q)
ct1 = EncryptPoly1(pk1, u, e2, pm, q)

Decrypt

decrypt = (ct1 * s) + ct0
decrypt = decrypt %% pm
decrypt = CoefMod(decrypt, q)
print(decrypt[1:length(m)])
#> [1] 450 254 515 119

Let’s decode to obtain the original number:

decoded_z <- decode(xi, M, scale, polynomial(decrypt[1:length(m)]))
print(decoded_z)
#> [1] 2.727297+3.893754i 1.772703-1.256246i

The decoded z is indeed very close to the original z, we round the result to make the clearer.

round(decoded_z)
#> [1] 3+4i 2-1i