lol: A library for lattice cryptography.

[ crypto, gpl, library ] [ Propose Tags ]

Λ ∘ λ (Lol) is a general-purpose library for ring-based lattice cryptography. For a detailed description of interfaces and functionality, see Λ ∘ λ: Functional Lattice Cryptography. For example cryptographic applications, see lol-apps.

[Skip to Readme]
Versions [faq],,,,,,,,, (info)
Change log
Dependencies arithmoi (>= && <0.5), base (>=4.8 && <5), binary, bytestring, constraints, containers (>= && <0.6), crypto-api, data-default (>=0.3.0 && <0.8), deepseq (>= && <1.5), monadcryptorandom, MonadRandom (>=0.2 && <0.5), mtl (>=2.2.1 && <2.3), numeric-prelude (>=0.4.2 && <0.5), protocol-buffers, protocol-buffers-descriptor, QuickCheck (==2.8.*), random (==1.1.*), reflection (>=1.5.1 && <2.2), repa (==3.4.*), singletons (>= && <2.2), tagged-transformer (>=0.7 && <0.9), template-haskell (>=, th-desugar (>=1.5.4 && <1.7), transformers (>= && <0.6), vector (==0.11.*), vector-th-unbox (>= && <0.3) [details]
License GPL-2.0-only
Copyright Eric Crockett, Chris Peikert
Author Eric Crockett <>, Chris Peikert <>
Maintainer Eric Crockett <>
Revised Revision 1 made by crockeea at Sun Aug 14 13:20:00 UTC 2016
Category Crypto
Home page
Bug tracker
Source repo head: git clone
Uploaded by crockeea at Sun Aug 14 02:17:31 UTC 2016
Distributions NixOS:
Downloads 4149 total (84 in the last 30 days)
Rating (no votes yet) [estimated by rule of succession]
Your Rating
  • λ
  • λ
  • λ
Status Hackage Matrix CI
Docs available [build log]
Last success reported on 2016-08-14 [all 1 reports]





Compile via LLVM. This produces much better object code, but you need to have the LLVM compiler installed.


Turn on library optimizations


Use -f <flag> to enable a flag, or -f -<flag> to disable that flag. More info


Note: This package has metadata revisions in the cabal description newer than included in the tarball. To unpack the package including the revisions, use 'cabal get'.

Maintainer's Corner

For package maintainers and hackage trustees

Readme for lol-

[back to package description]
Most of the functionality in Lol is exported by two modules:

* 'Crypto.Lol' exports the primary *interfaces* of Lol

* 'Crypto.Lol.Types' exports concrete types that would be used by most
  instantiations including tensors, base rings, and cryptographic

For a brief introduction to relevant mathematical notation, see 'Crypto.Lol'.

Overview of key modules, roughly from highest- to lowest-level:

Cyclotomic layer:
* 'Crypto.Lol.Cyclotomic.Cyc', which defines an interface for using cyclotomic
  fields, rings \( R \), and quotient rings \( R_q=R/qR \); as well as many
  other commonly used operations, e.g., converting
  between rings, decoding and decomposing elements, modulus
  reduction/rounding, etc. 'Cyc' is a safe wrapper around the
  'UCyc' type, which exposes some representation-dependent operations.
  'UCyc' (and hence 'Cyc') is implemented using a generic 'Tensor'
  (described below).

Tensor layer:
* 'Crypto.Lol.Cyclotomic.Tensor', which defines a class that encapsulates all
  the necessary linear transformations for operating on representations of
  \( R \)- and \( R_q \)-elements, e.g., the CRT transform, converting between
  the powerful and decoding bases, generating error terms, etc.

* 'Crypto.Lol.Cyclotomic.Tensor.RepaTensor', which gives an
  implementation of the 'Tensor' class based on the "repa"
  package, a highly optimized and parallelizable array library.

* 'Crypto.Lol.Cyclotomic.Tensor.CTensor', which gives an
  implementation of the 'Tensor' class using a C++ backend via Haskell's FFI.

Base ring layer:
* 'Crypto.Lol.Types.FiniteField', which gives an unoptimized implementation of
  finite field arithmetic. To use this module, you will need an instance of
  'IrreduciblePoly'. These instances provide irreducible polynomials
  for various degrees and base fields.  One (orphan) instance is provided for
  characteristic 2 fields of size up to 2^128 in
  'Crypto.Lol.Types.IrreducibleChar2', and is exported by 'Crypto.Lol.Types'.
  If you need to use an unsupported finite field,  define your own
  instance of 'IrreduciblePoly' and do **not** import 'IrreducibleChar2'.

* 'Crypto.Lol.Types.ZqBasic', which is a basic implementation of
  \( \Z_q=\Z/q\Z \) arithmetic.

* 'Crypto.Lol.Factored', which contains type-level support code for
  factored integers. It also supports "reifying" 'Int's at runtime as static
  types and "reflecting" those types as integers back to the code..
  'Factored' types are mainly used to represent cyclotomic indices.