feat(transciphering): add OPRF generation

Co-authored-by: Thomas Montaigu <thomas.montaigu@zama.ai>
Co-authored-by: Arthur Meyre <arthur.meyre@zama.ai>

Author: 3 people

tfhe/src/shortint/backward_compatibility/parameters/mod.rs

@@ -4,6 +4,7 @@ pub mod list_compression;
 pub mod modulus_switch_noise_reduction;
 pub mod noise_squashing;
 pub mod re_randomization;
+pub mod transciphering;
 
 use crate::core_crypto::commons::parameters::{
     DecompositionBaseLog, DecompositionLevelCount, DynamicDistribution, GlweDimension,

tfhe/src/shortint/backward_compatibility/parameters/transciphering.rs

@@ -0,0 +1,7 @@
+use super::parameters::transciphering::TranscipheringParameters;
+use tfhe_versionable::VersionsDispatch;
+
+#[derive(VersionsDispatch)]
+pub enum TranscipheringParametersVersions {
+    V0(TranscipheringParameters),
+}

tfhe/src/shortint/oprf.rs

@@ -678,6 +678,32 @@ impl<C: Container<Element = c64> + Sync> GenericOprfServerKey<C> {
                 prf_re_randomization_context,
             )
     }
+
+    /// Uniformly generates a sequence of encrypted random bits from a single seed in one call.
+    ///
+    /// Returns `num_blocks` blocks, each ciphertext encrypting a value in `[0, 2[`, i.e. a single
+    /// random bit whatever the message modulus of `target_sks`.
+    ///
+    /// # Panics
+    ///
+    /// * Panics if `self` is not compatible with `target_sks`
+    pub fn generate_random_boolean_sequence(
+        &self,
+        seed: impl OprfSeed,
+        num_blocks: u64,
+        target_sks: &ServerKey,
+    ) -> Vec<Ciphertext> {
+        let max_random_bits_per_block = 1;
+        self.inner
+            .generate_pseudo_random_bits_chunks(
+                seed,
+                &[num_blocks],
+                max_random_bits_per_block, // Each ciphertext is a boolean
+                target_sks,
+            )
+            .pop()
+            .unwrap()
+    }
 }
 
 // Owned-only methods.

tfhe/src/shortint/parameters/mod.rs

@@ -51,6 +51,7 @@ pub mod parameters_wopbs_only;
 pub mod re_randomization;
 #[cfg(test)]
 pub mod test_params;
+pub mod transciphering;
 pub mod v0_10;
 pub mod v0_11;
 pub mod v1_0;
@@ -73,6 +74,7 @@ use super::server_key::PBSConformanceParams;
 pub use super::PBSOrder;
 use crate::shortint::ciphertext::MaxDegree;
 pub use crate::shortint::parameters::list_compression::CompressionParameters;
+pub use crate::shortint::parameters::transciphering::TranscipheringParameters;
 pub use classic::ClassicPBSParameters;
 pub use compact_public_key_only::{
     CastingFunctionsOwned, CastingFunctionsView, CompactCiphertextListExpansionKind,

tfhe/src/shortint/parameters/transciphering.rs

@@ -0,0 +1,17 @@
+use crate::named::Named;
+use crate::shortint::backward_compatibility::parameters::transciphering::TranscipheringParametersVersions;
+use serde::{Deserialize, Serialize};
+use tfhe_versionable::Versionize;
+
+/// Parameters of the key material used by the transciphering subsystem.
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Versionize)]
+#[versionize(TranscipheringParametersVersions)]
+#[non_exhaustive]
+pub enum TranscipheringParameters {
+    /// Generate the transciphering key with the parameters of the compute key.
+    SameAsCompute,
+}
+
+impl Named for TranscipheringParameters {
+    const NAME: &'static str = "shortint::TranscipheringParameters";
+}

tfhe/src/transciphering/backward_compatibility/mod.rs

@@ -1,6 +1,10 @@
 use tfhe_versionable::VersionsDispatch;
 
-use crate::transciphering::{StreamCipherKind, StreamCiphertext};
+use crate::transciphering::{
+    AesIv, CompressedTranscipheringServerKey, KreyviumIV, OneTimePadFheSecretMask,
+    OneTimePadPlainSecretMask, SerializableAesFheKey, SerializableKreyviumFheKey, StreamCipherKind,
+    StreamCiphertext, TranscipheringPrivateKey, TranscipheringServerKey,
+};
 
 #[derive(VersionsDispatch)]
 pub enum StreamCipherKindVersions {
@@ -11,3 +15,48 @@ pub enum StreamCipherKindVersions {
 pub enum StreamCiphertextVersions {
     V0(StreamCiphertext),
 }
+
+#[derive(VersionsDispatch)]
+pub enum SerializableKreyviumFheKeyVersions {
+    V0(SerializableKreyviumFheKey),
+}
+
+#[derive(VersionsDispatch)]
+pub enum KreyviumIVVersions {
+    V0(KreyviumIV),
+}
+
+#[derive(VersionsDispatch)]
+pub enum SerializableAesFheKeyVersions {
+    V0(SerializableAesFheKey),
+}
+
+#[derive(VersionsDispatch)]
+pub enum AesIvVersions {
+    V0(AesIv),
+}
+
+#[derive(VersionsDispatch)]
+pub enum OneTimePadFheSecretMaskVersions {
+    V0(OneTimePadFheSecretMask),
+}
+
+#[derive(VersionsDispatch)]
+pub enum OneTimePadPlainSecretMaskVersions {
+    V0(OneTimePadPlainSecretMask),
+}
+
+#[derive(VersionsDispatch)]
+pub enum TranscipheringPrivateKeyVersions {
+    V0(TranscipheringPrivateKey),
+}
+
+#[derive(VersionsDispatch)]
+pub enum TranscipheringServerKeyVersions {
+    V0(TranscipheringServerKey),
+}
+
+#[derive(VersionsDispatch)]
+pub enum CompressedTranscipheringServerKeyVersions {
+    V0(CompressedTranscipheringServerKey),
+}

tfhe/src/transciphering/ciphers/aes/mod.rs

@@ -12,8 +12,14 @@ pub use fhe::AesFheState;
 pub use key::AesFheRoundKeys;
 pub use plain::AesPlainState;
 
-use crate::shortint::{Ciphertext, ClientKey};
+use crate::named::Named;
+use crate::shortint::oprf::OprfSeed;
+use crate::shortint::{Ciphertext, ClientKey, ServerKey};
+use crate::transciphering::backward_compatibility::{AesIvVersions, SerializableAesFheKeyVersions};
 use crate::transciphering::ciphers::*;
+use crate::transciphering::TranscipheringServerKey;
+use serde::{Deserialize, Serialize};
+use tfhe_versionable::Versionize;
 
 /// Big endian byte order.
 ///
@@ -73,16 +79,78 @@ impl From<[bool; 128]> for AesPlainKey {
     }
 }
 
+#[derive(Clone, Serialize, Deserialize, Versionize)]
+#[serde(into = "SerializableAesFheKey", try_from = "SerializableAesFheKey")]
+#[versionize(into = "SerializableAesFheKey", try_from = "SerializableAesFheKey")]
 pub struct AesFheKey {
     key: [Ciphertext; 128],
 }
 
+impl AesFheKey {
+    pub fn ciphertexts(&self) -> &[Ciphertext; 128] {
+        &self.key
+    }
+
+    pub fn new_random(
+        seed: impl OprfSeed,
+        transciphering_key: &TranscipheringServerKey,
+        sks: &ServerKey,
+    ) -> Self {
+        let encrypted_bits = transciphering_key
+            .oprf_key()
+            .generate_random_boolean_sequence(seed, 128, sks);
+
+        let key: [Ciphertext; 128] = encrypted_bits.try_into().expect("the vec has 128 elements");
+
+        Self { key }
+    }
+
+    /// Decrypt the key bits
+    pub fn decrypt(&self, client_key: &ClientKey) -> AesPlainKey {
+        let mut decrypted_bits = [false; 128];
+        for (ct, out) in self.key.iter().zip(decrypted_bits.iter_mut()) {
+            *out = client_key.decrypt(ct) != 0;
+        }
+        AesPlainKey::from(decrypted_bits)
+    }
+}
+
+/// Serialization form of [`AesFheKey`]. The 128 key ciphertexts are stored in a
+/// `Vec` because serde/versionize don't support arrays longer than 32; the
+/// fixed-size array is restored on deserialization.
+#[derive(Clone, Serialize, Deserialize, Versionize)]
+#[versionize(SerializableAesFheKeyVersions)]
+pub struct SerializableAesFheKey {
+    key: Vec<Ciphertext>,
+}
+
+impl From<AesFheKey> for SerializableAesFheKey {
+    fn from(value: AesFheKey) -> Self {
+        Self {
+            key: value.key.into(),
+        }
+    }
+}
+
+impl TryFrom<SerializableAesFheKey> for AesFheKey {
+    type Error = crate::Error;
+
+    fn try_from(value: SerializableAesFheKey) -> Result<Self, Self::Error> {
+        let len = value.key.len();
+        let key: [Ciphertext; 128] = value.key.try_into().map_err(|_| {
+            crate::error!("an AES key must hold exactly 128 ciphertexts, got {len}")
+        })?;
+        Ok(Self { key })
+    }
+}
+
 /// AES-128 IV / initial CTR counter, as a plain 128-bit integer.
 ///
 /// The counter is incremented directly (`iv + block_index`), the big-endian
 /// (NIST) convention only applies when bytes are involved, i.e. at the
 /// `[u8; 16]` / `[bool; 128]` construction boundaries.
-#[derive(Clone, Copy)]
+#[derive(Clone, Copy, Serialize, Deserialize, Versionize)]
+#[versionize(AesIvVersions)]
 pub struct AesIv(u128);
 
 impl AesIv {
@@ -110,3 +178,7 @@ impl From<[bool; 128]> for AesIv {
         bits.into()
     }
 }
+
+impl Named for AesIv {
+    const NAME: &'static str = "transciphering::AesIv";
+}

tfhe/src/transciphering/ciphers/aes/test.rs

@@ -128,6 +128,26 @@ fn aes_plain_key_conversions_are_homogeneous() {
     }
 }
 
+/// `AesFheKey::decrypt` must be the exact inverse of `AesPlainKey::encrypt`,
+/// including the byte and bit order they agree on
+#[test]
+fn aes_fhe_key_encrypt_decrypt_round_trip() {
+    let (cks, _sks) = gen_keys(PARAM);
+
+    // An asymmetric value plus both extremes, so a reversed byte or bit order
+    // does not round-trip by accident.
+    for v in [KEY, 0u128, u128::MAX, 0x0123456789abcdeffedcba9876543210] {
+        let plain = AesPlainKey::from(v);
+        let recovered = plain.encrypt(&cks).decrypt(&cks);
+
+        assert_eq!(
+            recovered.to_csprng_key_u128(),
+            plain.to_csprng_key_u128(),
+            "AES key did not survive the encrypt/decrypt round trip for 0x{v:032x}"
+        );
+    }
+}
+
 /// Anchor the plain side to the NIST SP 800-38A AES-128 vector. The other
 /// tests use `AesPlainStream` as oracle.
 #[test]

tfhe/src/transciphering/ciphers/kreyvium/fhe.rs

@@ -1,16 +1,31 @@
 //! TFHE implementation of the Kreyvium Algorithm
 
 use crate::shortint::ciphertext::NoiseLevel;
-use crate::shortint::{Ciphertext, ServerKey};
+use crate::shortint::oprf::OprfSeed;
+use crate::shortint::{Ciphertext, ClientKey, ServerKey};
+use crate::transciphering::backward_compatibility::SerializableKreyviumFheKeyVersions;
 use crate::transciphering::ciphers::shift_register::ShiftRegister;
-use crate::transciphering::{FheKeyStream, InsufficientKeystream, StreamCipherKind, Transcipherer};
+use crate::transciphering::{
+    FheKeyStream, InsufficientKeystream, StreamCipherKind, Transcipherer, TranscipheringServerKey,
+};
+use serde::{Deserialize, Serialize};
+use tfhe_versionable::Versionize;
 
 use super::{
-    collect_boxed_array, KreyviumBackwardRoundOutput, KreyviumIV, KreyviumRound,
+    collect_boxed_array, KreyviumBackwardRoundOutput, KreyviumIV, KreyviumPlainKey, KreyviumRound,
     KreyviumRoundInput, KreyviumRoundOutput, KreyviumState,
 };
 
 /// A kreyvium key encrypted in LWE, one ciphertext per bit
+#[derive(Clone, Serialize, Deserialize, Versionize)]
+#[serde(
+    into = "SerializableKreyviumFheKey",
+    try_from = "SerializableKreyviumFheKey"
+)]
+#[versionize(
+    into = "SerializableKreyviumFheKey",
+    try_from = "SerializableKreyviumFheKey"
+)]
 pub struct KreyviumFheKey {
     cts: Box<[Ciphertext; 128]>,
 }
@@ -32,9 +47,72 @@ impl KreyviumFheKey {
         Self { cts }
     }
 
+    pub fn new_random(
+        seed: impl OprfSeed,
+        transciphering_key: &TranscipheringServerKey,
+        sks: &ServerKey,
+    ) -> Self {
+        let encrypted_bits = transciphering_key
+            .oprf_key()
+            .generate_random_boolean_sequence(seed, 128, sks);
+
+        let boxed: Box<[Ciphertext; 128]> = encrypted_bits
+            .into_boxed_slice()
+            .try_into()
+            .expect("the vec has 128 elements");
+
+        Self::new(boxed)
+    }
+
     pub fn init_state(self, iv: KreyviumIV, sk: &ServerKey) -> KreyviumFheState {
         KreyviumFheState::new(self, iv, sk)
     }
+
+    /// Decrypt the key bits
+    pub fn decrypt(&self, client_key: &ClientKey) -> KreyviumPlainKey {
+        let mut decrypted_bits = [false; 128];
+        for (ct, out) in self.cts.iter().zip(decrypted_bits.iter_mut()) {
+            *out = client_key.decrypt(ct) != 0;
+        }
+        KreyviumPlainKey::from(decrypted_bits)
+    }
+
+    /// Borrow the underlying 128 single-bit shortint ciphertexts, MSB-first
+    /// within each byte of the packed key (see [`super::KreyviumPlainKey`]).
+    pub fn ciphertexts(&self) -> &[Ciphertext; 128] {
+        &self.cts
+    }
+}
+
+/// Serialization form of [`KreyviumFheKey`]. The 128 key ciphertexts are stored
+/// in a `Vec` because serde/versionize don't support arrays longer than 32; the
+/// fixed-size array is restored on deserialization.
+#[derive(Clone, Serialize, Deserialize, Versionize)]
+#[versionize(SerializableKreyviumFheKeyVersions)]
+pub struct SerializableKreyviumFheKey {
+    cts: Vec<Ciphertext>,
+}
+
+impl From<KreyviumFheKey> for SerializableKreyviumFheKey {
+    fn from(value: KreyviumFheKey) -> Self {
+        let cts: Box<[Ciphertext]> = value.cts;
+        Self {
+            cts: cts.into_vec(),
+        }
+    }
+}
+
+impl TryFrom<SerializableKreyviumFheKey> for KreyviumFheKey {
+    type Error = crate::Error;
+
+    fn try_from(value: SerializableKreyviumFheKey) -> Result<Self, Self::Error> {
+        let len = value.cts.len();
+        let cts: Box<[Ciphertext; 128]> =
+            value.cts.into_boxed_slice().try_into().map_err(|_| {
+                crate::error!("a kreyvium key must hold exactly 128 ciphertexts, got {len}")
+            })?;
+        Ok(Self { cts })
+    }
 }
 
 pub type KreyviumFheState = KreyviumState<Ciphertext>;

tfhe/src/transciphering/ciphers/kreyvium/mod.rs

@@ -12,7 +12,7 @@ mod test;
 
 use super::shift_register::ShiftRegister;
 
-pub use fhe::{KreyviumFheKey, KreyviumFheState};
+pub use fhe::{KreyviumFheKey, KreyviumFheState, SerializableKreyviumFheKey};
 pub use plain::{KreyviumIV, KreyviumPlainKey, KreyviumPlainState};
 use rayon::prelude::*;