Configuration options

A key generator takes its configuration as a mapping of options; it is converted into the config class of its scheme (pyfe4ai.core.config) and completed by its security profile before the key generator is built. Crypto objects take their config as given. Options not listed are ignored.

Server and client ids

A server id (an entry of lst_sid) or a client id (an entry of lst_nid) is a str or an int (not a bool; pyfe4ai.core.ids), and one list holds ids of one of the two types. A key generator (and FESchemeWrapper) refuses with FEValidationError a list of other values (bytes, floats, None, bool, tuples, numpy integers), a list that mixes str and int ids (JSON names 1 and "1" alike) and a value that is not a list or tuple (a string, a set, a dict): convert numpy integers with int(), other ids with str(). Partial decryptions, key shares, EncryptedGradient and ThresholdPartial carry ids of these two types only.

After setup, wherever an id is given – the server or client named when keys are issued, a crypto object’s id, the enrolled servers of share_decrypt, servers= and server= of the ML adapter, nid= of encrypt_gradient, the keys of the weights and encrypted gradients the adapter aggregates, the ids of partial decryptions and gradients read back – a numpy integer (numpy.integer) is read as the int it equals (list(rng.choice(lst_sid, t, replace=False)) gives such ids), so that key shares, partial decryptions and gradients carry plain ints. Other values that equal an id (1.0, True, numpy.bool_) are no ids: the key generators issue no key share and no encryption key for them (None, as for an unknown server or client), a server refuses an enrolled set that holds one, or an id that is one, and the ML adapter refuses such servers and such keys – before anything is computed.

JSON writes an integer that keys an object as a string (1 becomes "1"). The ML adapter reads integer ids back from the JSON of its records (EncryptedGradient, ThresholdPartial), and a threshold server finds its tag in a ciphertext that went through JSON; an application that moves other objects keyed by ids through JSON itself (key shares, the ciphertexts of a request as {nid: ciphertext}) uses string ids.

Security profiles

security_profile = 'toy' (the default) uses the config as given. 'standard' sets the minima below where the config has no value and refuses weaker ones (FEValidationError); see pyfe4ai.core.profiles.

kind	schemes	under standard
dcr	sife/paillier, mife/paillier, mcfe/paillier, mcfe/paillier_decentralized	bit_length >= 1536; stat_param >= 128
dl	sife/ddh, sife/damgard, sife/ddh_dynamic, mife/ddh, mife/damgard, mife/ddh_threshold, mcfe/ddh, mcfe/damgard, mcfe/ddh_threshold, mcfe/ddh_decentralized	sec_param >= 3072; modulus_length >= 3072; stat_param >= 128
ec	sife/ddh_ristretto255, mife/ddh_ristretto255, mcfe/ddh_ristretto255	nothing to set
lwe	mcfe/lwe, mcfe/fullysec_lwe, mcfe/lwe_threshold, mcfe/lwe_decentralized	stat_param >= 128; lwe_n = 'auto'
lwe_abdp15	sife/lwe, mife/lwe, mife/lwe_threshold	stat_param >= 128; lwe_n = 'auto'
lwe_matrix	sife/fullysec_lwe, mife/fullysec_lwe	refused
pairing	sife/fh_ipe_pairing, sife/part_fh_ipe_pairing, mife/fh_ipe_pairing, mife/fh_multi_ipe_pairing, mcfe/fh_multi_ipe_pairing, mcfe/fh_multi_ipe_pairing_threshold, mcfe/fh_multi_ipe_pairing_decentralized, quadratic/quad, quadratic/sgp, quadratic/miqfe	pairing_group_param = 'BLS12-381' only, with a FESecurityWarning
ring_lwe	sife/ring_lwe, sife/fullysec_ring_lwe, mife/ring_lwe, mcfe/ring_lwe, mcfe/ring_lwe_threshold, mcfe/ring_lwe_decentralized	sec_param >= 128; stat_param >= 128; ring_n = 'auto'

Refused under standard (FEValidationError):

• sife/fullysec_lwe, mife/fullysec_lwe: at a 128-bit dimension (lwe_n = 3328 to 4352 for X = Y <= 50, eta <= 10) its public matrix has 1 to 2*10^10 entries and every ciphertext m = 4 n log2 q = 2.9 to 4.5*10^6 coordinates of 219 to 258 bits (80 to 145 MB); use sife/fullysec_ring_lwe for adaptive security, or the Ring-LWE scheme of the same family.

• mife/lwe_threshold: read at the width sigma / (1 + 4 X sqrt(eta)) of its security reduction, the LWE of its flooding-enlarged q (stat_param 128) needs a dimension at the very end of the 128-bit table (5888 to 6144, a public matrix of 6.5 to 7.8*10^9 entries) for a few small bounds, e.g. X = Y in {1, 2, 3, 8, 10} at eta = 1, and beyond it for most others (X = Y = 4 to 6, X = Y >= 12, most eta >= 2; about 6500 for X = Y = 50); use mife/ddh_threshold, or mcfe/ring_lwe_threshold with labels.

• mcfe/paillier_decentralized: its key shares would be combined under a DCR modulus of more than 15000 bits; use mcfe/ddh_decentralized.

Refused and constrained combinations

schemes	options	outcome
pairing schemes	security_profile = 'standard' with pairing_group_param other than BLS12-381	FEValidationError; with BLS12-381 a FESecurityWarning (about 120 to 126-bit security)
sife/lwe, mife/lwe, the MCFE LWE schemes (mcfe/lwe, fullysec_lwe, lwe_threshold, lwe_decentralized), the Ring-LWE schemes	security_profile = 'standard' with gaussian_sampler = 'rounded' (also a crypto object’s, for public parameters made under standard)	FEValidationError
Ring-LWE schemes	security_profile = 'standard' with an explicit ring_n whose modulus falls below the 128-bit table, or bounds too large for any tabulated dimension	FEValidationError
LWE schemes	security_profile = 'standard' with an explicit lwe_n below the 128-bit table, or bounds too large for any tabulated dimension	FEValidationError
sife/ring_lwe, sife/fullysec_ring_lwe	ring_modulus other than prime	FEValidationError
mife/ring_lwe, mcfe/ring_lwe, mcfe/ring_lwe_decentralized	ring_modulus = 'rns' with a modulus that two NTT primes below 2^62 cannot hold (above about 124 bits; large bounds)	FEValidationError
sife/fullysec_ring_lwe	m <= 4	FEValidationError
mife/lwe_threshold, mcfe/lwe_threshold, mcfe/ring_lwe_threshold	sharing = 'shamir' with t < s	FEValidationError under standard, else a FESecurityWarning
mife/lwe_threshold, mcfe/ring_lwe_threshold	flooding_accounting = 'kl' with t != s, or without a positive max_partial_decryptions; max_partial_decryptions with per-sample	FEValidationError
mife/lwe_threshold	flooding_accounting = 'kl' with a sharing other than shamir	FEValidationError
mcfe/ring_lwe_threshold	flooding_accounting = 'kl' with flooding = 'uniform' or a sharing other than shamir	FEValidationError
mcfe/ring_lwe_threshold	key_shares = 'split' with sharing = 'replicated-seeded'	FEValidationError
mcfe/ring_lwe_threshold	ring_modulus = 'rns' with a factor of the modulus not above s	FEValidationError
mcfe/ring_lwe_threshold (crypto)	ct_format other than the public parameters’	FEValidationError
mcfe/lwe_threshold	any flooding_accounting other than per-sample, or max_partial_decryptions	FEValidationError
threshold schemes	t outside 1 .. s (also the defaults t = 2, s = 1), or s other than len(lst_sid)	FEValidationError
threshold LWE / Ring-LWE servers (crypto)	a Shamir key share with t < s (versions <= 0.3.0) without legacy_shamir = 'warn', or under standard	FESchemeError at the partial decryption
mife/lwe_threshold, mcfe/ring_lwe_threshold servers (crypto)	flooding_accounting = 'kl' public parameters without a partial_budget, or one above their max_partial_decryptions	FESchemeError / FEValidationError
DDH schemes	group other than the scheme’s (modp, or ristretto255)	FEValidationError
mcfe/ddh	eta as a dict whose length is not n	FEValidationError
mcfe/ddh_decentralized	eta as a dict	FEValidationError
decentralised MCFE (DDH, DCR, LWE, Ring-LWE, FH)	n < 2	FEValidationError at setup
mife/fh_multi_ipe_pairing	n = 1	FEKeyError
quadratic/miqfe	no n	FEValidationError
Damgard and Paillier schemes	bounds too large for the modulus (2 n eta bound^2 not below q, or N): raise modulus_length / bit_length	FEValidationError (ValueError for sife/paillier)
mcfe/damgard	mddh_k < 1	FEValidationError
sife/part_fh_ipe_pairing	subspace_dim not in 1 .. eta - 1; bound < subspace_dim * coeff_bound (at a public encryption)	FEValidationError
pairing and quadratic schemes	a discrete-log bound above 2^48 (e.g. eta bound_x bound_y, n m bound^3)	ValueError at decryption (quadratic schemes: None and a warning)

Options of every key generator

option	meaning	default	accepted
security_profile	toy (small, fast, not secure) or standard (see pyfe4ai.core.profiles)	'toy'	toy, standard
sec_param	the DDH modulus bits, the Ring-LWE kappa, or only recorded (the scheme says which)	128
stat_param	statistical parameter of the schemes that use one	unused	an int of at most 256
n	number of clients (slots)	–
s	number of decryption servers (threshold schemes)	–
lst_nid	client ids	nid_0 … nid_{n-1} when n is given	n distinct ids (str or int, see pyfe4ai.core.ids)
cache_dir	parameter cache directory	PYFE4AI_CACHE_DIR or the per-user cache directory	a non-empty path

Crypto objects take:

option	meaning	default	accepted
keys	{'pp': public parameters} plus 'sk' (encryptors) or a key	–	a non-empty mapping
id	the client or server id	–
type	unused	–
precision	decimal digits kept when values are scaled to integers	0	a non-negative int
cache_dir	parameter cache directory	PYFE4AI_CACHE_DIR or the per-user cache directory	a non-empty path

Options of each scheme

The options of every key generator above, where a scheme changes them, and the scheme’s own.

sife/ddh

SIFEDDHConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	bits of the safe prime p (not a security level)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
group	the group (fixed by the scheme)	'modp'		modp
eta	inputs per client (the length of each inner product)	5		a positive int

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

sife/ddh_ristretto255

SIFEDDHRistretto255Config; kind ec.

option	meaning	default	standard	accepted
sec_param	recorded only (the group is fixed)	128
group	the group (fixed by the scheme)	'ristretto255'		ristretto255
eta	inputs per client (the length of each inner product)	5		a positive int

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

sife/lwe

SIFELWEConfig; kind lwe_abdp15.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	5		a positive int
bound_x	bound X on the plaintext entries	20		a non-negative int
bound_y	bound Y on the weights	20		a positive int
lwe_n	LWE dimension	32	'auto'	auto (the 128-bit table) or a positive int
matrix_mode	how the seeded public matrix A is held: expanded once, or per batch	'memory'		memory, stream
gaussian_sampler	sampler of the Gaussian key noise	the library-wide sampler (rounded unless PYFE4AI_GAUSSIAN_SAMPLER, set_gaussian_sampler or a gaussian_sampler() block says otherwise); facct under standard	rounded refused	rounded, facct

Crypto objects also take:

option	meaning	default	accepted
matrix_mode	how the seeded public matrix A is held: expanded once, or per batch	'memory'	memory, stream

sife/paillier

SIFEPaillierConfig; kind dcr.

option	meaning	default	standard	accepted
sec_param	recorded only (bit_length sizes N)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
bit_length	bits of each safe prime of the Paillier modulus N	128	>= 1536 (its default)	an int >= 6 large enough that N exceeds the inner products
bound_x	bound X on the plaintext entries	100		a positive int
bound_y	bound Y on the weights	100		a positive int
eta	inputs per client (the length of each inner product)	5		a positive int

sife/damgard

SIFEDamgardConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	the DDH modulus bits, the Ring-LWE kappa, or only recorded (the scheme says which)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
modulus_length	bits of the modulus p of the Damgard / MDDH group	sec_param	>= 3072 (its default)	an int >= 3 large enough that 2 n eta bound^2 < q
bound	bound on the plaintext entries and the weights	100		a positive int
eta	inputs per client (the length of each inner product)	5		a positive int

sife/ring_lwe

SIFERingLWEConfig; kind ring_lwe.

option	meaning	default	standard	accepted
sec_param	kappa of the BMMS21 widths and noise bound	128	>= 128 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	5		a positive int
bound_x	bound X on the plaintext entries	4		a positive int
bound_y	bound Y on the weights	4		a positive int
ring_modulus	ring modulus: an NTT prime, or a product of NTT primes (RNS)	'prime'		prime
ring_n	ring dimension	32 (also for None)	'auto'	auto (the 128-bit table) or a power of two >= 2
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct

Crypto objects also take:

option	meaning	default	accepted
gaussian_sampler	sampler of the encryption noise	the public parameters’ sampler, else facct	rounded, facct

sife/fullysec_ring_lwe

SIFEFullySecRingLWEConfig; kind ring_lwe.

option	meaning	default	standard	accepted
sec_param	kappa of the BMMS21 widths and noise bound	128	>= 128 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	5		a positive int
bound_x	bound X on the plaintext entries	4		a positive int
bound_y	bound Y on the weights	4		a positive int
ring_modulus	ring modulus: an NTT prime, or a product of NTT primes (RNS)	'prime'		prime
ring_n	ring dimension	32 (also for None)	'auto'	auto (the 128-bit table) or a power of two >= 2
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct
m	number of key polynomials	'auto'		auto (the smallest admitting a modulus) or an int >= 5
ndarray_layout	ndarray ciphertexts: one per element, or packed (one per ring_n elements)	'elementwise'		elementwise, packed

Crypto objects also take:

option	meaning	default	accepted
gaussian_sampler	sampler of the encryption noise	the public parameters’ sampler, else facct	rounded, facct

sife/fullysec_lwe

SIFEFullySecLWEConfig; kind lwe_matrix.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
eta	inputs per client (the length of each inner product)	5		a positive int
bound_x	bound X on the plaintext entries	20		a non-negative int
bound_y	bound Y on the weights	20		a non-negative int
lwe_n	LWE dimension	64		an int >= 2

sife/ddh_dynamic

SIFEDDHDynamicConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	bits of the safe prime p (not a security level)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
group	the group (fixed by the scheme)	'modp'		modp
eta	the largest number of inputs (keys may cover a prefix)	5		a positive int

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

sife/fh_ipe_pairing

SIFEFHIPEPairingConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
eta	inputs per client (the length of each inner product)	5		a positive int
bound_x	bound X on the plaintext entries	16		a positive int
bound_y	bound Y on the weights	16		a positive int

sife/part_fh_ipe_pairing

SIFEPartFHIPEPairingConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
eta	inputs per client (the length of each inner product)	5		an int above subspace_dim
bound	bound on the plaintext entries and the weights	bound_x, else 16		a positive int
bound_x	the default of bound	16		a positive int
subspace_dim	dimension k of the plaintext subspace	1		1 <= k < eta
coeff_bound	bound on the subspace coefficients of a public encryption	1		a positive int with k coeff_bound <= bound

mife/ddh

MIFEDDHConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	bits of the safe prime p (not a security level)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
group	the group (fixed by the scheme)	'modp'		modp
eta	inputs per client (the length of each inner product)	1		a positive int, or one per client (a dict keyed by lst_nid)

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

mife/ddh_ristretto255

MIFEDDHRistretto255Config; kind ec.

option	meaning	default	standard	accepted
sec_param	recorded only (the group is fixed)	128
group	the group (fixed by the scheme)	'ristretto255'		ristretto255
eta	inputs per client (the length of each inner product)	1		a positive int, or one per client (a dict keyed by lst_nid)

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

mife/lwe

MIFELWEConfig; kind lwe_abdp15.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	20		a non-negative int
bound_y	bound Y on the weights	20		a positive int
lwe_n	LWE dimension	32	'auto'	auto (the 128-bit table) or a positive int
matrix_mode	how the seeded public matrix A is held: expanded once, or per batch	'memory'		memory, stream
gaussian_sampler	sampler of the Gaussian key noise	the library-wide sampler (rounded unless PYFE4AI_GAUSSIAN_SAMPLER, set_gaussian_sampler or a gaussian_sampler() block says otherwise); facct under standard	rounded refused	rounded, facct

Crypto objects also take:

option	meaning	default	accepted
matrix_mode	how the seeded public matrix A is held: expanded once, or per batch	'memory'	memory, stream

mife/paillier

MIFEPaillierConfig; kind dcr.

option	meaning	default	standard	accepted
sec_param	recorded only (bit_length sizes N)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
bit_length	bits of each safe prime of the Paillier modulus N	128	>= 1536 (its default)	an int >= 6 large enough that N exceeds the inner products
bound_x	bound X on the plaintext entries	100		a positive int
bound_y	bound Y on the weights	100		a positive int
eta	inputs per client (the length of each inner product)	1		a positive int

mife/damgard

MIFEDamgardConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	the DDH modulus bits, the Ring-LWE kappa, or only recorded (the scheme says which)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
modulus_length	bits of the modulus p of the Damgard / MDDH group	sec_param	>= 3072 (its default)	an int >= 3 large enough that 2 n eta bound^2 < q
bound	bound on the plaintext entries and the weights	100		a positive int
eta	inputs per client (the length of each inner product)	1		a positive int

mife/ring_lwe

MIFERingLWEConfig; kind ring_lwe.

option	meaning	default	standard	accepted
sec_param	kappa of the BMMS21 widths and noise bound	128	>= 128 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	4		a positive int
bound_y	bound Y on the weights	4		a positive int
ring_modulus	ring modulus: an NTT prime, or a product of NTT primes (RNS)	'prime'		prime, rns
ring_n	ring dimension	32 (also for None)	'auto'	auto (the 128-bit table) or a power of two >= 2
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct

Crypto objects also take:

option	meaning	default	accepted
gaussian_sampler	sampler of the encryption noise	the public parameters’ sampler, else facct	rounded, facct
ct_format	ciphertext format: JSON lists, or the binary format 1	'json'	json, binary

mife/fullysec_lwe

MIFEFullySecLWEConfig; kind lwe_matrix.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	20		a non-negative int
bound_y	bound Y on the weights	20		a non-negative int
lwe_n	LWE dimension	64		an int >= 2

mife/fh_ipe_pairing

MIFEFHIPEPairingConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	16		a positive int
bound_y	bound Y on the weights	16		a positive int

mife/fh_multi_ipe_pairing

MIFEFHMultiIPEPairingConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
n	number of clients (slots)	–		an int >= 2
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	16		a positive int
bound_y	bound Y on the weights	16		a positive int
sec_level	k of the k-Lin assumption	2		a positive int

mife/ddh_threshold

ThresholdMIFEDDHConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	bits of the safe prime p (not a security level)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
s	number of decryption servers	len(lst_sid), else 1		len(lst_sid)
t	threshold: partial decryptions needed to decrypt	2		1 <= t <= s
lst_sid	server ids	sid_0 … sid_{s-1}		s distinct ids (str or int, see pyfe4ai.core.ids)
group	the group (fixed by the scheme)	'modp'		modp
eta	inputs per client (the length of each inner product)	1		a positive int, or one per client (a dict keyed by lst_nid)

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

mife/lwe_threshold

ThresholdMIFELWEConfig; kind lwe_abdp15.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
s	number of decryption servers	len(lst_sid), else 1		len(lst_sid)
t	threshold: partial decryptions needed to decrypt	2		1 <= t <= s
lst_sid	server ids	sid_0 … sid_{s-1}		s distinct ids (str or int, see pyfe4ai.core.ids)
sharing	how the functional keys are shared among the servers	replicated for t < s, else shamir	shamir with t < s refused	shamir, replicated, replicated-seeded
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	20		a non-negative int
bound_y	bound Y on the weights	20		a positive int
lwe_n	LWE dimension	32	'auto'	auto (the 128-bit table) or a positive int
matrix_mode	how the seeded public matrix A is held: expanded once, or per batch	'memory'		memory, stream
gaussian_sampler	sampler of the Gaussian key noise	the library-wide sampler (rounded unless PYFE4AI_GAUSSIAN_SAMPLER, set_gaussian_sampler or a gaussian_sampler() block says otherwise); facct under standard	rounded refused	rounded, facct
flooding_accounting	accounting of the flooding noise: per sample, or the opt-in KL bound of a run	'per-sample'		per-sample, kl
max_partial_decryptions	partial decryptions each server may produce (flooding_accounting = 'kl' only)	–		a positive int with kl; absent otherwise

Crypto objects also take:

option	meaning	default	accepted
matrix_mode	how the seeded public matrix A is held: expanded once, or per batch	'memory'	memory, stream
legacy_shamir	a server’s handling of a Shamir key share with t < s of versions <= 0.3.0	'refuse'	refuse, warn
partial_budget	the server’s budget of partial decryptions (flooding_accounting = 'kl')	–	a PartialDecryptionBudget of at most the public parameters’ limit

mcfe/ddh

MCFEDDHConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	bits of the safe prime p (not a security level)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
group	the group (fixed by the scheme)	'modp'		modp
eta	inputs per client (the length of each inner product)	1		a positive int, or one per client (a dict of n entries)

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

mcfe/ddh_ristretto255

MCFEDDHRistretto255Config; kind ec.

option	meaning	default	standard	accepted
sec_param	recorded only (the group is fixed)	128
group	the group (fixed by the scheme)	'ristretto255'		ristretto255
eta	inputs per client (the length of each inner product)	1		a positive int, or one per client (a dict keyed by lst_nid)

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

mcfe/lwe

MCFELWEConfig; kind lwe.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	20		a positive int
bound_y	bound Y on the weights	20		a positive int
lwe_n	LWE dimension	32	'auto'	auto (the 128-bit table) or a positive int
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct
label_hash	hash of the labels onto the key space	'shake128-rejection'		shake256-wide, shake256-rejection, shake128-rejection

mcfe/paillier

MCFEPaillierConfig; kind dcr.

option	meaning	default	standard	accepted
sec_param	recorded only (bit_length sizes N)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
bit_length	bits of each safe prime of the Paillier modulus N	128	>= 1536 (its default)	an int >= 6 large enough that N exceeds the inner products
bound_x	bound X on the plaintext entries	100		a positive int
bound_y	bound Y on the weights	100		a positive int
eta	inputs per client (the length of each inner product)	1		a positive int

mcfe/damgard

MCFEDamgardConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	the DDH modulus bits, the Ring-LWE kappa, or only recorded (the scheme says which)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
modulus_length	bits of the modulus p of the Damgard / MDDH group	sec_param	>= 3072 (its default)	an int >= 3 large enough that 2 n eta bound^2 < q
bound	bound on the plaintext entries and the weights	100		a positive int
eta	inputs per client (the length of each inner product)	1		a positive int
mddh_k	k of the MDDH assumption	1		a positive int

mcfe/ring_lwe

MCFERingLWEConfig; kind ring_lwe.

option	meaning	default	standard	accepted
sec_param	kappa of the BMMS21 widths and noise bound	128	>= 128 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	4		a positive int
bound_y	bound Y on the weights	4		a positive int
ring_modulus	ring modulus: an NTT prime, or a product of NTT primes (RNS)	'prime'		prime, rns
ring_n	ring dimension	32 (also for None)	'auto'	auto (the 128-bit table) or a power of two >= 2
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct
label_hash	hash of the labels onto the key space	'shake128-rejection'		shake256-wide, shake256-rejection, shake128-rejection

Crypto objects also take:

option	meaning	default	accepted
gaussian_sampler	sampler of the encryption noise	the public parameters’ sampler, else facct	rounded, facct
ct_format	ciphertext format: JSON lists, or the binary format 1	'json'	json, binary

mcfe/fullysec_lwe

MCFEFullySecLWEConfig; kind lwe.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	20		a positive int
bound_y	bound Y on the weights	20		a positive int
lwe_n	LWE dimension	32	'auto'	auto (the 128-bit table) or a positive int
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct
label_hash	hash of the labels onto the key space	'shake128-rejection'		shake256-wide, shake256-rejection, shake128-rejection

mcfe/fh_multi_ipe_pairing

MCFEFHMultiIPEPairingConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	10		a positive int
bound_y	bound Y on the weights	10		a positive int

mcfe/fh_multi_ipe_pairing_threshold

ThresholdMCFEFHMultiIPEPairingConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
s	number of decryption servers	len(lst_sid), else 1		len(lst_sid)
t	threshold: partial decryptions needed to decrypt	2		1 <= t <= s
lst_sid	server ids	sid_0 … sid_{s-1}		s distinct ids (str or int, see pyfe4ai.core.ids)
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	10		a positive int
bound_y	bound Y on the weights	10		a positive int

mcfe/fh_multi_ipe_pairing_decentralized

DecentralizedMCFEFHMultiIPEPairingConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
n	number of clients (slots)	–		an int >= 2 (checked by setup)
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	10		a positive int
bound_y	bound Y on the weights	10		a positive int

mcfe/ddh_threshold

ThresholdMCFEDDHConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	bits of the safe prime p (not a security level)	128	>= 3072 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
s	number of decryption servers	len(lst_sid), else 3		len(lst_sid)
t	threshold: partial decryptions needed to decrypt	2		1 <= t <= s
lst_sid	server ids	sid_0 … sid_{s-1}		s distinct ids (str or int, see pyfe4ai.core.ids)
group	the group (fixed by the scheme)	'modp'		modp
eta	inputs per client (the length of each inner product)	1		a positive int

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

mcfe/ddh_decentralized

DecentralizedMCFEDDHConfig; kind dl.

option	meaning	default	standard	accepted
sec_param	bits of the safe prime p (not a security level)	128	>= 3072 (its default)
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
n	number of clients (slots)	–		an int >= 2
group	the group (fixed by the scheme)	'modp'		modp
eta	inputs per client (the length of each inner product)	1		a positive int (one for every client)

Crypto objects also take:

option	meaning	default	accepted
dlog_bound	bound on |<x, y>| (after scaling) of the final discrete log	10^(precision + 2)	a non-negative int

mcfe/lwe_threshold

ThresholdMCFELWEConfig; kind lwe.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
s	number of decryption servers	len(lst_sid), else 3		len(lst_sid)
t	threshold: partial decryptions needed to decrypt	2		1 <= t <= s
lst_sid	server ids	sid_0 … sid_{s-1}		s distinct ids (str or int, see pyfe4ai.core.ids)
sharing	how the functional keys are shared among the servers	replicated for t < s, else shamir	shamir with t < s refused	shamir, replicated, replicated-seeded
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	20		a positive int
bound_y	bound Y on the weights	20		a positive int
lwe_n	LWE dimension	32	'auto'	auto (the 128-bit table) or a positive int
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct
label_hash	hash of the labels onto the key space	'shake128-rejection'		shake256-wide, shake256-rejection, shake128-rejection
flooding_accounting	accounting of the flooding noise: per sample, or the opt-in KL bound of a run	'per-sample'		per-sample
max_partial_decryptions	partial decryptions each server may produce (flooding_accounting = 'kl' only)	–		none (the option is refused)

Crypto objects also take:

option	meaning	default	accepted
legacy_shamir	a server’s handling of a Shamir key share with t < s of versions <= 0.3.0	'refuse'	refuse, warn

mcfe/lwe_decentralized

DecentralizedMCFELWEConfig; kind lwe.

option	meaning	default	standard	accepted
sec_param	recorded only (lwe_n sets the hardness)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	20		a positive int
bound_y	bound Y on the weights	20		a positive int
lwe_n	LWE dimension	32	'auto'	auto (the 128-bit table) or a positive int
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct
label_hash	hash of the labels onto the key space	'shake128-rejection'		shake256-wide, shake256-rejection, shake128-rejection

mcfe/ring_lwe_threshold

ThresholdMCFERingLWEConfig; kind ring_lwe.

option	meaning	default	standard	accepted
sec_param	kappa of the BMMS21 widths and noise bound	128	>= 128 (its default)
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
s	number of decryption servers	len(lst_sid), else 1		len(lst_sid)
t	threshold: partial decryptions needed to decrypt	2		1 <= t <= s
lst_sid	server ids	sid_0 … sid_{s-1}		s distinct ids (str or int, see pyfe4ai.core.ids)
sharing	how the functional keys are shared among the servers	replicated for t < s, else shamir	shamir with t < s refused	shamir, replicated, replicated-seeded
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	4		a positive int
bound_y	bound Y on the weights	4		a positive int
ring_modulus	ring modulus: an NTT prime, or a product of NTT primes (RNS)	'rns'		prime, rns
ring_n	ring dimension	32 (also for None)	'auto'	auto (the 128-bit table) or a power of two >= 2
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct
label_hash	hash of the labels onto the key space	'shake128-rejection'		shake256-wide, shake256-rejection, shake128-rejection
flooding_accounting	accounting of the flooding noise: per sample, or the opt-in KL bound of a run	'per-sample'		per-sample, kl
max_partial_decryptions	partial decryptions each server may produce (flooding_accounting = 'kl' only)	–		a positive int with kl; absent otherwise
flooding	distribution of the flooding noise of the partial decryptions	uniform; gaussian with flooding_accounting = 'kl'		uniform, gaussian
ct_format	ciphertext format (published in the public parameters): binary format 2, or JSON lists	'binary'		json, binary
key_shares	key shares: a weight part and a label part, or whole key shares per label	full with replicated-seeded, else split		split, full

Crypto objects also take:

option	meaning	default	accepted
gaussian_sampler	sampler of the encryption noise	the public parameters’ sampler, else facct	rounded, facct
ct_format	ciphertext format (must be the public parameters’)	the public parameters’ format	json, binary
legacy_shamir	a server’s handling of a Shamir key share with t < s of versions <= 0.3.0	'refuse'	refuse, warn
partial_budget	the server’s budget of partial decryptions (flooding_accounting = 'kl')	–	a PartialDecryptionBudget of at most the public parameters’ limit

mcfe/ring_lwe_decentralized

DecentralizedMCFERingLWEConfig; kind ring_lwe.

option	meaning	default	standard	accepted
sec_param	kappa of the BMMS21 widths and noise bound	128	>= 128 (its default)
stat_param	statistical parameter of the schemes that use one	unused	>= 128 (its default)	an int of at most 256
n	number of clients (slots)	–		an int >= 2
eta	inputs per client (the length of each inner product)	1		a positive int
bound_x	bound X on the plaintext entries	4		a positive int
bound_y	bound Y on the weights	4		a positive int
ring_modulus	ring modulus: an NTT prime, or a product of NTT primes (RNS)	'prime'		prime, rns
ring_n	ring dimension	32 (also for None)	'auto'	auto (the 128-bit table) or a power of two >= 2
gaussian_sampler	sampler of the Gaussian key noise	'facct'	rounded refused	rounded, facct
label_hash	hash of the labels onto the key space	'shake128-rejection'		shake256-wide, shake256-rejection, shake128-rejection

Crypto objects also take:

option	meaning	default	accepted
gaussian_sampler	sampler of the encryption noise	the public parameters’ sampler, else facct	rounded, facct
ct_format	ciphertext format: JSON lists, or the binary format 1	'json'	json, binary

mcfe/paillier_decentralized

DecentralizedMCFEPaillierConfig; kind dcr.

option	meaning	default	standard	accepted
sec_param	recorded only (bit_length sizes N)	128
stat_param	statistical parameter (rounding, flooding, masks, key widths)	64	>= 128 (its default)	an int of at most 256
n	number of clients (slots)	–		an int >= 2
bit_length	bits of each safe prime of the Paillier modulus N	128	>= 1536 (its default)	an int >= 6 large enough that N exceeds the inner products
bound_x	bound X on the plaintext entries	100		a positive int
bound_y	bound Y on the weights	100		a positive int
eta	inputs per client (the length of each inner product)	1		a positive int

quadratic/quad

QuadraticQuadConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
n	length of x	2		a positive int
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
m	length of y	n		a positive int
bound	bound on the entries of x, y and the function matrix	16		a positive int

quadratic/sgp

QuadraticSGPConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
n	length of x and y	eta, else 2		a positive int
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
eta	the default of n	2		a positive int
bound	bound on the entries of x, y and the function matrix	16		a positive int

quadratic/miqfe

QuadraticMIQFEConfig; kind pairing.

option	meaning	default	standard	accepted
sec_param	unused (the pairing group fixes the security)	128
n	number of users	–		an int >= 2 (required)
pairing_group_param	pairing group	'BLS12-381'	BLS12-381 only	an asymmetric pairing group (other than BLS12-381: needs charm-crypto)
m	inputs per user	2		a positive int
bound_x	bound X on the plaintext entries	8		a positive int
bound_c	bound on the coefficients of the quadratic function	8		a positive int
mddh_k	k of the bilateral MDDH assumption	2		an int >= 2