Am/feat/noise squashing

[IceTDrinker]

This change is 

[IceTDrinker]

backward data will be added with the HL commits

[mayeul-zama]

Reviewed 2 of 2 files at r1, 1 of 1 files at r2, 3 of 3 files at r3, 4 of 4 files at r4, 5 of 5 files at r5, 6 of 6 files at r6, 13 of 15 files at r7, all commit messages.
Reviewable status: 33 of 35 files reviewed, 4 unresolved discussions (waiting on @nsarlin-zama and @tmontaigu)

---

tfhe/src/shortint/noise_squashing/server_key.rs line 67 at r7 (raw file):

                let modulus_switch_noise_reduction_key = noise_squashing_parameters
                    .modulus_switch_noise_reduction_params
                    .map(|p| {

p could be renamed modulus_switch_noise_reduction_params

---

tfhe/src/shortint/noise_squashing/server_key.rs line 107 at r7 (raw file):

        let output_message_modulus =
            MessageModulus(ciphertext.message_modulus.0 * ciphertext.carry_modulus.0);

We may want to only support squashing clean ciphertexts (empty carry) and use output_message_modulus = message_modulus

This would reduce constraints for the optimizer.

---

tfhe/src/shortint/noise_squashing/server_key.rs line 176 at r7 (raw file):

            output_message_modulus,
            CarryModulus(1),
            PaddingBit::Yes,

I think we don't need a padding bit as the output is never bootstrapped

---

tfhe/src/shortint/noise_squashing/private_key.rs line 36 at r7 (raw file):

            message_modulus: ciphertext.message_modulus(),
            carry_modulus: CarryModulus(1),
            padding_bit: PaddingBit::Yes,

I think we don't need a padding bit (related to sibling comment)

[IceTDrinker]

Reviewable status: 33 of 35 files reviewed, 4 unresolved discussions (waiting on @mayeul-zama, @nsarlin-zama, and @tmontaigu)

---

tfhe/src/shortint/noise_squashing/private_key.rs line 36 at r7 (raw file):

Previously, mayeul-zama wrote…

I think we don't need a padding bit (related to sibling comment)

currently this is how it has been optimized, I'm going to stick to it for now and let the R&D know we likely can drop the padding bit

---

tfhe/src/shortint/noise_squashing/server_key.rs line 67 at r7 (raw file):

Previously, mayeul-zama wrote…

p could be renamed modulus_switch_noise_reduction_params

do you think it's useful here as the full name is just above and it's in a map call ?

---

tfhe/src/shortint/noise_squashing/server_key.rs line 107 at r7 (raw file):

Previously, mayeul-zama wrote…

We may want to only support squashing clean ciphertexts (empty carry) and use output_message_modulus = message_modulus

This would reduce constraints for the optimizer.

Actually the original constraint was putting the msg bits in the upper part of the plaintext multiplying by 4, the packing requires a multiplication by 5 (if ciphertexts are correlated) and the parameters when regenerated did not change with the new dot product of 5 vs 4, so I think we are okay here following the existing optimization

---

tfhe/src/shortint/noise_squashing/server_key.rs line 176 at r7 (raw file):

Previously, mayeul-zama wrote…

I think we don't need a padding bit as the output is never bootstrapped

see answer on the other comment about it