8S      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 :;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~None!"&'(>KLN&TCopied from Data.Type.Natural because the data-level version is not exported there.+Type synonym for (prime :: Int, exponent :: Int) pair,&Constraint synonym for coprimality of  types-'Constraint synonym for divisibility of  types/Kind-restricted synonym for 2. Use this in constraints for types requiring a  type.0Kind-restricted synonym for 2. Use this in constraints for types requiring a  type.1Kind-restricted synonym for 2. Use this in constraints for types requiring a  type.2;Type (family) synonym to create a Factored from a prime Nat3,Type (family) synonym for multiplication of  types4&Type (family) synonym for division of  types:Entails constraint for transitivity of division, i.e. if k|l and l|m, then k|m.5Entails constraint for divisibility by GCD, i.e. if  g=GCD(m1,m2), then g|m1 and g|m2.2Entails constraint for LCM divisibility, i.e. if  l=LCM(m1,m2), then m1|l and m2|l.JEntails constraint for LCM divisibility, i.e. the LCM of two divisors of m also divides m.Entails basic facts for p-free division, i.e. if f is m after removing all p-factors, then f|m and  gcd(f,p)=1Entails basic facts for p-free division, i.e., if m|m', then p-free(m) | p-free(m')2Value-level prime-power factorization tagged by a  type.Int representing the value of a  typeInt representing the totient of a  type's valueInt representing the "hat" of a  type's value m: m, if m is odd, or m/2 otherwise.Int< representing the radical (product of prime divisors) of a  typeIntD representing the odd radical (product of odd prime divisors) of a  type Reflects a  type to a + value"Reflects the prime component of a  type%Reflects the exponent component of a  typeInt representing the value of a  typeInt representing the totient of a  type's valueInt representing the value of a Returns m, if m is odd, or m/2 otherwise Converts a  prime-power pair to an Int prime-power pairEvaluates a prime-power pair (p,e) to p^e.Euler's totient function of a prime-power pair)The prime component of a prime-power pairGThe odd radical of a prime-power pair (p,_): p if p is odd, 1 if p==2 Product of values of individual +s"Product of totients of individual +s"Product of radicals of individual +s&Product of odd radicals of individual +s        !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJK L!"#$%&'MNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~     ()* !"#$%&'()*+,-./0123456789:;<=>?@ABCDE+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~FGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~10/".) (!2  3 %- &4#$, '*+5cqbx`|_p^}a~]n\[ZmYXwWlVUTkSvRQjPONiM{LhKJuIgHfGtFEDCeBzA@d?s>=yr<;o:9876s        !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJK L!"#$%&'MNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~     ()* !"#$%&'()*+,-./0123456789:;<=>?@ABCDE+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~FGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~None7Represents cyclotomic rings that are rescalable over their base rings. (This is a class because it allows for more efficient specialized implementations.)Rescale in the given basis.*Represents the powerful or decoding basis.None '(3457>NReflection without fundep, and with tagged value. Intended only for low-level code; build specialized wrappers around it for specific functionality.)Reflect the value assiated with the type a.None&(+-./47>?CLN/Indexed Zip Vector: a wrapper around a (boxed)  that has zip-py  behavior, analogous to  for lists. The index m9 enforces proper lengths (and is necessary to implement ).Deconstructor for IZipVectorVSmart constructor that checks whether length of input is right (should be totient of m).None !"%&(357KLNSane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Convenient synonym for (Ord a, Transcendental a)Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .Sane synonym for .The Prelude definition of .The Prelude definition of .The sane definition of  from  rather than the default from NumericPrelude.The hidden NP function from .BOur custom exponentiation, overriding NP's version that requires  exponent. Copied from Jhttp://hackage.haskell.org/package/base-4.7.0.0/docs/src/GHC-Real.html#%5E Inverse of a modulo q , in range 0..q-1'. (Argument order is infix-friendly.)XDecompose an element into a list of "centered" digits with respect to relative radices.Yield ceil (log_b(x)).3Deterministically round to the nearest multiple of i.<Randomly round to the nearest larger or smaller multiple of i1, where the round-off term has expectation zero. Variant of ) in which the remainder is in the range  [-b/2,b/2)."IntegralDomain instance for Double       !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~None%(*+3457>CLN9Newtype wrapper (with slightly different instances) for  Rhttps://hackage.haskell.org/package/numeric-prelude-0.4.2/docs/Number-Complex.htmlnumeric-prelude Complex.@Rounds the real and imaginary components to the nearest integer. t9 is a complex value with magnitude 1 and phase t (modulo 2*Pi).#Real component of a complex number.(Imaginary component of a complex number.:Embeds a scalar as the real component of a complex number. None%&'(*34579>CIKLNRepresents that the target ring can "noisily encode" values from the source ring, in either "most significant digit" (MSD) or "least significant digit" (LSD) encodings, and provides conversion factors between the two types of encodings.The factor that converts an element from LSD to MSD encoding in the target field, with associated scale factor to apply to correct the resulting encoded value.Represents that a can be rescaled to b-, as an "approximate" additive homomorphism.Fun-dep version of Lift.Represents that b can be lifted to a "short" a congruent to b.Represents that b is a quotient group of a.0Represents a quotient group modulo some integer. Poor man's .Inverted entries of .*A default implementation of rescaling for  types.>Deterministically round to a nearby value in the desired coset Version of  with an error message.(Apply any applicative to a Tagged value.#Expose the monad of a tagged value.!Hide the monad of a tagged value.DUse a singleton as a witness to extract a value from a tagged value.Monadic version of .+          !"#$%&'()*+,-./012 3456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^ _`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~<!    None %345>LN ,A ring with a ring embedding into some ring CRTExt r0 that has an invertible CRT transformation for every positive index m. Embeds from r to CRTExt rProjects from CRTExt r to raA ring that (possibly) supports invertible Chinese remainder transformations of various indices.The values of  for different indices m- should be consistent, in the sense that if omega, omega'+ are respectively the values returned for m, m' where m' divides m#, then it should be the case that omega^(m/m')=omega'. for a given index m. The method itself may be slow, but the function it returns should be fast, e.g., via internal memoization. The default implementation returns 4.^Information that characterizes the (invertible) Chinese remainder transformation over a ring r , namely: a function that returns the ith power of some m'th root of unity (for any integer i)the multiplicative inverse of \hat{m} in r.Default implementation of omegaPow for  types. The implementation finds an integer element of maximal multiplicative order, and raises it to the appropriate power. Therefore, the functions returned for different values of the first argument are consistent, i.e., omega_{m'}^(m'/m) = omega_m. wrapper for 1 types. wrapper for 0 types. wrapper for / types.A function that returns the ith embedding of  g_{p^e} = g_p for i in Z*_{p^e}.A function that returns the ith embedding of g_p for i in Z*_p , i.e.,  1-omega_p^i. zqHasCRT m q says whether Z_q has an  invertible CRT transform of index m, i.e., Z_q) has an element of multiplicative order m, and mhat is invertible in Z_q.*+,-./0123456*+,-./0123456None%N7Using polar form of Box-Muller transform, returns a pair of centered, Gaussian-distributed real numbers with scaled variance svar = true variance * (2*pi). See < Thttp://www.alpheratz.net/murison/Maple/GaussianDistribution/GaussianDistribution.pdf this link> for details.8 Generate n0 real, independent gaussians of scaled variance svar = true variance * (2*pi).9|Execute an action repeatedly until its result fails to satisfy a predicate, and return that result (discarding all others).: Analogue of ()0 Yields the result of applying f until p holds.789:78789: None!"%&(3457>?CIKLN;*a DSL for tensor transforms on Repa arrays<| identity sentinel=&| (function) composition of transforms>3Indexed newtype for 1-dimensional Unbox repa arrays?An > filled with the argument.@Monadic version of ?.AZFor a factored index, tensors up any function defined for (and tagged by) any prime powerBoFor a prime power pp > 1, tensors up any function f defined for (and tagged by) a prime to (I_(pp/p) otimes f)C-Returns the (linear) dimension of a transformD#smart constructor from a TensorableEcompose transformsF!tensor/Kronecker product (otimes)GACreates an evaluatable Haskell function from a tensored transformHMonadic version of GI~maps the innermost dimension to a 2-dim array with innermost dim d, for performing a I_l otimes f_d otimes I_r transformationJinverse of exposeK6general matrix multiplication along innermost dim of vL7multiplication by a diagonal matrix along innermost dimMeEmbeds a scalar into a powerful-basis representation of a Repa array, tagged by the cyclotomic indexN+Forces a delayed array to a manifest array.O5Sum the inner-most dimension of an array sequentiallyP.Sum all array indices to a scalar sequentially;<=QRS>T?@ABUCDEFVGHIJKLMNOPWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~;<>T?@ABCDEFGHKLMNOP;<=QRS>T?@ABUCDEFVGHIJKLMNOPWXY!None%&4NA function tagged by the cyclotomic index which, given a (scaled) variance, outputs a Gaussian-distributed vector in the decoding basis#The fully tensored D transformation The D transformation for a prime"None !"%&47INbArbitrary-index L transform to convert a dec-basis Repa array to its powerful-basis representationiArbitrary-index L^{ -1 } transform to convert a powerful-basis Repa array to its dec-basis representationJArbitrary-index multiplication by the ring element g in the powerful basisEArbitrary-index multiplication by the ring element g in the dec basissArbitrary-index division by the ring element g in the powerful basis. May fail if the input is not a multiple of g.tArbitrary-index multiplication by the ring element g in the dec basis. May fail if the input is not a multiple of g.hThis is not a constant-time algorithm! Depending on its usage, it might provide a timing side-channel.None %&'(4>L"Convenience data type for writing  instances.Represents prime-order fields over which we can get irreducible polynomials of desired degree. (An instance of this class is defined in #$ and exported from %&.)5The characteristic of a field, represented as a type.*Constraint synonym for prime-order fields.!Convenience function for writing  instances.!Convenience function for writing  instances.'None %'35>LNNone %&'4>?CN$A finite field of given degree over F_p.The order of the field: size (GF fp deg) = p^degTrace into the prime subfield.=Traces of the power basis elements 1, x, x^2, ..., x^(deg-1).       None &(4>FIKLN12A Kronecker product of zero of more matrices over r.Y encapsulates all the core linear transformations needed for cyclotomic ring arithmetic. The type t m r6 represents a cyclotomic coefficient tensor of index m over base ring r. Most of the methods represent linear transforms corresponding to operations in particular bases. CRT-related methods are wrapped in K because they are well-defined only when a CRT basis exists over the ring r for index m.]The superclass constraint is for convenience, to ensure that we can sample error tensors of %s.Constraints needed by t to hold type r.-Properties that hold for any index. Use with .EProperties that hold for any (legal) fully-applied tensor. Use with .3Converts a scalar to a tensor in the powerful basisP converts from decoding-basis representation to powerful-basis representation;  is its inverse.P converts from decoding-basis representation to powerful-basis representation;  is its inverse. Multiply by g in the powerful/decoding basis Multiply by g in the powerful/decoding basis Divide by g& in the powerful/decoding basis. The j output indicates that the operation may fail, which happens exactly when the input is not divisible by g. Divide by g& in the powerful/decoding basis. The j output indicates that the operation may fail, which happens exactly when the input is not divisible by g. FA tuple of all the operations relating to the CRT basis, in a single  value for safety. Clients should typically not use this method directly, but instead call the corresponding top-level functions: the elements of the tuple correpond to the functions , , , , . 5Sample from the "skewed" Gaussian error distribution t*D in the decoding basis, where D has scaled variance v. The twaceS linear transformation, which is the same in both the powerful and decoding bases. The embed> linear transformations, for the powerful and decoding bases. The embed> linear transformations, for the powerful and decoding bases.A tuple of all the extension-related operations involving the CRT bases, for safety. Clients should typically not use this method directly, but instead call the corresponding top-level functions: the elements of the tuple correpond to the functions , .BMap a tensor in the powerful/decoding/CRT basis, representing an O_m'. element, to a vector of tensors representing O_m% elements in the same kind of basis.7The powerful extension basis w.r.t. the powerful basis.'A list of tensors representing the mod-p CRT set of the extension.!Potentially optimized version of 2 when the input and output element types satisfy .Potentially optimized monadic .%Convenience value indicating whether   exists.cYield a tensor for a scalar in the CRT basis. (This function is simply an appropriate entry from  .) Multiply by gG in the CRT basis. (This function is simply an appropriate entry from  .) Divide by gH in the CRT basis. (This function is simply an appropriate entry from  .)HThe CRT transform. (This function is simply an appropriate entry from  .)PThe inverse CRT transform. (This function is simply an appropriate entry from  .)\The "tweaked trace" function for tensors in the CRT basis: For cyclotomic indices m | m', #Tw(x) = (mhat/m'hat) * Tr(g'/g * x)6. (This function is simply an appropriate entry from .)Embed a tensor with index m* in the CRT basis to a tensor with index m'G in the CRT basis. (This function is simply an appropriate entry from .) Extract the (i,j) element of a .The "tweaked" CRT^* matrix: CRT^* . diag(sigma(g_m)). /The "tweaked" CRT^* matrix (for prime powers): CRT^* * diag(sigma(g_p))./Base-p digit reversal; input and output are in [p^e]. Convert a Z_m^*# index to a linear tensor index in [m]. For a prime power p^e6, map a tensor index to the corresponding power j in  [phi(p^e)], as in the powerful basis.For a prime power p^e8, map a tensor index to the corresponding element i in  Z_{p^e}^*./Convert a Z_m^* index to a linear tensor index. Inverse of .Correspondences between the linear indexes into a basis of O_m', and pair indices into (extension basis) otimes (basis of O_m). The work the same for Pow,Dec,CRT bases because all these bases have that factorization. The first argument is the list of (phi(m),phi(m'))( pairs for the (merged) prime powers of m,m'. rA collection of useful information for working with tensor extensions. The first component is a list of triples (p,e,e') where e, e') are respectively the exponents of prime p in m, m'. The next two components are phi(m) and phi(m')". The final component is a pair (phi(p^e), phi(p^e'))) for each triple in the first component.! A vector of phi(m) entries, where the i;th entry is the index into the powerful/decoding basis of O_m' of the i+th entry of the powerful/decoding basis of O_m." A vector of phi(m) blocks of phi(m')/phi(m)T consecutive entries. Each block contains all those indices into the CRT basis of O_m'A that "lie above" the corresponding index into the CRT basis of O_m.#A lookup table for  applied to indices  [phi(m')].$A lookup table for  applied to indices  [phi(m')].%Same as #7, but only includes the second component of each pair.&The i0th entry of the i1 th vector is  (i1,i0).Convenient reindexing functionsMaps an index of the extension ring array to its corresponding index in the base ring array (if it exists), with sign, under the decoding basis.@        !"#$%&.      !"#$%&.      !"&#$%$        !"#$%&(None!"&4N9Embeds a scalar into the CRT-basis when such basis exists(Multiplies an array in the CRT basis by g, when the CRT basis exists %Divides an array in the CRT basis by g, when the CRT basis exists.! The CRT-basis representation of g"*The CRT-basis representation of 'g^{ -1 }'#fThe chinese remainder transform on Repa arrays. Exists if and only if crt exists for all prime powers$nThe inverse chinese remainder transform on Repa arrays. Exists if and only if crt exists for all prime powers !"#$%&'()*+,-. !"#$ !"#$%&'()*+,-. None4>L')Represents integers modulo a prime power.(8An implementation of the integers modulo the prime base.)&The prime and exponent of the modulus.* Lift from Z_p to a representative.'()*'()*'()*'()* None&'(+3457>FLN +&Error correction relative to a gadget.,.Correct a "noisy" encoding of an element (see 2).-#Decomposition relative to a gadget..The ring that u decomposes over./Yield a short vector x such that  <g, x> = u.0Gadget) vectors, parameterized by an index type.1The gadget vector over u.2Yield an error-tolerant encoding of an element with respect to the gadget. (Mathematically, this should just be the product of the input with the gadget, but it is a class method to allow for optimized implementations.)3#Dummy type representing the gadget  [1,b,b^2,...].4#Dummy type representing the gadget [1]. +,-./01234/0 +,-./01234 012-./+,43+,-./01234/0 None%&'(*+3457>?CLN5 The ring Z_q of integers modulo q!, using underlying integer type z."1523456789:;<=>?@ABCDEFGHIJKLMNOPQ5515256789:3;4<=>?@ABCDEFGHIJKLMNOPQ)None %&'(4>KLNRThe multiplicative order of p (the argument) modulo m . Requires  gcd(p,m)=1.SGiven p', returns a partition of the cosets of Z_{m'}^* / <p>y (specified by representatives), where the cosets in each component are in bijective correspondence with the cosets of  Z_m^* / <p> under the natural (mod m) homomorphism.RTSRSRTS*None %&(47>KLNUO(n)5 Yield the vector obtained by replacing each element i of the index vector by xsVi. This is equivalent to   (xsV) is# but is often much more efficient. 3backpermute <a,b,c,d> <0,3,2,3,1,0> = <a,d,c,d,b,a>WEmbeds an vector in the powerful basis of the the mth cyclotomic ring to an vector in the powerful basis of the m'th cyclotomic ring when m | m'XEmbeds an vector in the decoding basis of the the mth cyclotomic ring to an vector in the decoding basis of the m'th cyclotomic ring when m | m'YEmbeds an vector in the CRT basis of the the mth cyclotomic ring to an vector in the CRT basis of the m'th cyclotomic ring when m | m'Zmaps a vector in the powerful/decoding basis, representing an O_m' element, to a vector of arrays representing O_m elements in the same type of basis[The "tweaked trace" function in either the powerful or decoding basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'.\wThe powerful extension basis, wrt the powerful basis. Outputs a list of vectors in O_m' that are an O_m basis for O_m']KA list of vectors representing the mod-p CRT set of the extension O_m'/O_mUis index vector (of length n)xs value vectorWXYZ[\]UWXYZ[\]UWXYZ[\] None!"%&'()*+3457>?CFIKLN6DClass to safely match Haskell types with the appropriate C function.7=Class to dispatch to the C backend for various element types.8An implementation of  backed by C code.^ Newtype wrapper around a Vector._Useful coersion for defining coeffs in the Tensor interface. Using `* alone is insufficient for type inference.aUseful coersion for defining  powBasisPow and  crtSetDec in the Tensor interface. Using `* alone is insufficient for type inference.r6bcdefghijklmnopqr7stuvwxy8z{^|}~_a678876Y6 bcdefghijklmnopqr7stuvwxy8z{^|}~_a+None&(3457>KLNThe "tweaked trace" function in either the powerful or decoding basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'.mThe "tweaked trace" function in the CRT basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'.Embeds an array in the powerful basis of the the mth cyclotomic ring to an array in the powerful basis of the m'th cyclotomic ring when m | m'Embeds an array in the decoding basis of the the mth cyclotomic ring to an array in the decoding basis of the m'th cyclotomic ring when m | m'Embeds an array in the CRT basis of the the mth cyclotomic ring to an array in the CRT basis of the m'th cyclotomic ring when m | m'maps an array in the powerful/decoding basis, representing an O_m' element, to an array of arrays representing O_m elements in the same type of basisvThe powerful extension basis, wrt the powerful basis. Outputs a list of arrays in O_m' that are an O_m basis for O_m'JA list of arrays representing the mod-p CRT set of the extension O_m'/O_m None!"%&()*+3457>?KLN9An implementation of  backed by repa.9999None!"%&'()+3457>IKLN:ZShorthand for frequently reused constraints that are needed for most functions involving < and ,.;VCollection of constraints need to work on most functions over a particular base ring r.RShorthand for frequently reused constraints that are needed for change of basis.<6A data type for representing cyclotomic rings such as Z[zeta], Zq[zeta], and Q(zeta): t is the ! type for storing coefficients; m is the cyclotomic index; r. is the base ring of the coefficients (e.g., Z, Zq).=Same as - , but for <.>Same as . , but for <.?Same as / , but for <.@Same as 0 , but for <.ASame as 1 , but for <.BSame as 2 , but for <.CSame as 3 , but for <.DSame as 4 , but for <.+Deterministically round to the given coset c+pR, using the decoding basis.ESame as 5 , but for <.FSame as 6 , but for <.GSame as 7 , but for <.HSame as 8 , but for <.ISame as 9 , but for <.J:Yield an equivalent element whose internal representation must7 be in the indicated basis: powerful or decoding (for 3  and 3 " arguments, respectively), or any r,-basis of the implementation's choice (for 47 argument). (See also the convenient specializations K, L, M.)K3Force a cyclotomic element into the powerful basis.L3Force a cyclotomic element into the decoding basis.MForce a cyclotomic into any r'-basis of the implementation's choice.NA more specialized version of : apply a function coordinate-wise in the current representation. The caller must ensure that the current representation is an rM-basis (one of powerful, decoding, or CRT, if it exists), usually by using J or its specializations (K, L, M%). Otherwise, behavior is undefined.OMonadic version of N.Force embed, to a non- constructor. Preserves Scalar, Pow, Dec constructors, and CRTr/CRTe constructor if valid in both source and target ring (we rely on this in toCRT').+Force the argument into the decoding basis.@Force the argument into the "valid" CRT basis for our invariant.7:;<=>?@ABCDEFGHIJKLMNO     :;<=>?@ABCDEFGHIJKLMNO<:;@A=>?BCDEFGHIJKLMNO1:;<=>?@ABCDEFGHIJKLMNO     None!"&'(*3457>CIKLNPWrapper around <) that exposes a narrower, safe interface.QUnsafe deconstructor for P.R=Smart constructor (to prevent clients from pattern-matching).S!Yield an equivalent element that mayS be in a CRT representation. This can serve as an optimization hint. E.g., call S; prior to multiplying the same value by many other values.TSame as S,, but for the powerful-basis representation.USame as S,, but for the powerful-basis representation.V Multiply by the special element g of the mth cyclotomic.W Divide by g , returning 4 if not evenly divisible. WARNING: this implementation is not a constant-time algorithm, so information about the argument may be leaked through a timing channel.X6Sample from the "tweaked" Gaussian error distribution t*D in the decoding basis, where D has scaled variance v. Note: This implementation uses Double precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.YhGenerate an LWE error term with given scaled variance, deterministically rounded in the decoding basis.Z6Generate an LWE error term with given scaled variance * p^2H over the given coset, deterministically rounded in the decoding basis.[Embed into the extension ring.\&The "tweaked trace" (twace) function 'Tw(x) = (mhat / m'hat) * Tr(g' / g * x), which fixes R pointwise (i.e., twace . embed == id).]Return the given element's coefficient vector with respect to the (relative) powerful/decoding basis of the cyclotomic extension  O_m' / O_m.^The relative powerful basis of  O_m' / O_m._The relative mod-r "CRT set" of the extension.`Lift in the specified basis.a:Embed a scalar from the base ring as a cyclotomic element.PQRSTUVWXYZ[\]^_`a:PQRSTUVWXYZ[\]^_`aPQ:RQVWa`TUSXYZ[\^_]PQRSTUVWXYZ[\]^_`aNone&(*47>?CKLNbQA convenient constraint synonym for extending a linear function to larger rings.cAn E-linear function from R to S.d Construct an E8-linear function given a list of its output values (in S$) on the relative decoding basis of R/EM. The number of elements in the list must not exceed the size of the basis.e1Evaluates the given linear function on the input.f Extend an E-linear function R->S to an E'-linear function R'->S'2. (Mathematically, such extension only requires lcm(r,e') | r' (not equality), but this generality would significantly complicate the implementation, and for our purposes there's no reason to use any larger r'.) bcdefbcdefcbdefbcdefNone!"&(+3457>KLN'g&Constraint synonym for ring tunneling.hIConstraint synonym for multiplying a public value with an encrypted valueiBConstraint synonym for adding a public value to an encrypted valuej%Constraint synonym for key switching.l3Constraint synonym for generating key-switch hints.m)Constraint synonym for modulus switching.n?Constraint synonym for converting between ciphertext encodings.o"Constraint synonym for decryption.pAConstraint synonym for extracting the error term of a ciphertext.q"Constraint synonym for encryption.r/Constraint synonym for generating a secret key.sCiphertext over R'_q, encrypting a plaintext in  R_p (R=O_m).Ciphertext encoding typet plaintextu secret keyvKGenerates a secret key with (index-independent) scaled variance parameter v; see Y.w'Encrypt a plaintext under a secret key.x'Extract the error term of a ciphertext.yDecrypt a ciphertext.zMore general form of x7 that works for unrestricted output coefficient types.{More general form of y7 that works for unrestricted output coefficient types.|%Convert a ciphertext to MSD encoding.}%Convert a ciphertext to LSD encoding. FRescale a linear polynomial in MSD encoding, for best noise behavior.~-Rescale a linear ciphertext to a new modulus.FHomomorphically divide a plaintext that is known to be a multiple of (p/p')= by that factor, thereby scaling the plaintext modulus from p to p'.!aAn LWE sample for a given secret (corresponding to a linear ciphertext encrypting 0 in MSD form)"Generate a hint that "encrypts" a value under a secret key, in the sense required for key-switching. The hint works for any plaintext modulus, but must be applied on a ciphertext in MSD form.!Switch a linear ciphertext under s_in to a linear one under s_out[Switch a quadratic ciphertext (i.e., one with three components) to a linear one under the same key.Homomorphically add a public Z_pB value to an encrypted value. The ciphertext must not carry any g factors.Homomorphically add a public R_p value to an encrypted value.8Homomorphically multiply an encrypted value by a public R_p value.#JIncrement the internal g exponent without changing the encrypted message.$Absorb the powers of g associated with the ciphertext, at the cost of some increase in noise. This is usually needed before changing the index of the ciphertext ring.Embed a ciphertext in R' encrypting a plaintext in R to a ciphertext in T' encrypting a plaintext in T. The target ciphertext ring T' must contain both the the source ciphertext ring R' and the target plaintext ring T.3Embed a secret key from a subring into a superring.V"Tweaked trace" function for ciphertexts. Mathematically, the target plaintext ring S= must contain the intersection of the source plaintext ring T and the target ciphertext ring S'.. Here we make the stricter requirement that s = gcd(s', t).Homomorphically apply the EB-linear function that maps the elements of the decoding basis of R/E to the corresponding S-elements in the input array.8g%hi&jk'l(mnopqrs)*+tu,vwx-yz{|} ~!"./0#$1234"ghijklmnopqrstuvwxyz{|}~"utsvwxzy{|}~ihkjlmnqgrop4g%hi&jk'l(mnopqrs)*+tu,vwx-yz{|} ~!"./0#$1234:None       !"#$%&'()*+,-./012 3456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^ _`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~+,-./0123456789:PQRSTUVWXYZ[\]^_`a5;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmCnopqrstuvwxyz{|}~      !"#$%&'()*+,-.//0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcde f g h i j k l m n o p q r s t u v w xyz{-./0123456789|}~,/0123456789.-wST      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~   ;  ;  !"#$%&'()*+; ,;-./01;23;24;56;78;79; :; ;; <;-=;>?;>@;>A;>B/CD/CE; F; G; H; I; J;KL;>M;>N/CO; P; Q/CR;ST;UV/WX/WY/WZ/W[/W\/W]/W^;_`; a/Wb/Wc;_d;_e/Wf/Wg/Wh; i; j;>k;2l;>m;no;np;5q;5r;5s;5t;5u;5v;5w;5x;5y;5z;5{;5|;}~;;};};;;;;;;;;;;;;;;;;;;;;_;;;;;S;S;S;S;;>;>;>;>;U;U;U;U;U;U;U;U;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;;7;7; ; ; ; ; ; ; ; ; ; /C/C/C/C/C/C/C/C       #"!!!!!v        $$$ $!$"$u&#%$%%%&%'%(%)%*+,-./0123456;789:;<=>?@ABCDEFGHIJ;KL;KM;KM;KN;KNOPQOPROPSOPTOPUOPVOPWOPXOPYOPZOP[OP\OP]OP^OP_OP`OPaOPbOPcOPdOPeOPfOPgOPhijklmnopqrstuvwxy z { | }  ~                    }     ;4,           !"#$%&'(')'*'+','-'.'/'0'6'1'2'3'4'5'67879 :;!<!=!>"?"@"A"B"C"D"E"F"G"H"I"J"K"L"M'NOP5QRSTUVWXYZ[\]^_`abcdefghij(k(l(m(n(o(p(q(r(s(t(u(v(w(x(y(z({ | } ~                                )))* *******  /0                          w                                                 ~                                  +++++++++++++`+a+b+c+d+e+ x            ! " # $ % & '()*+,-./0123456789:;<=>?@ABCDEFG,HIJKLMNOPQRSTUVWXwYZ[\]^_`lol_3PPk6qoV7MXHVxgyB4A7MqCrypto.Lol.LatticePreludeCrypto.Lol.FactoredCrypto.Lol.Cyclotomic.UtilityCrypto.Lol.ReflectsCrypto.Lol.CRTransCrypto.Lol.Types.PrimeFieldCrypto.Lol.Types.FiniteFieldCrypto.Lol.Cyclotomic.TensorCrypto.Lol.Types.ZPPCrypto.Lol.GadgetCrypto.Lol.Types.ZqBasic$Crypto.Lol.Cyclotomic.Tensor.CTensor'Crypto.Lol.Cyclotomic.Tensor.RepaTensorCrypto.Lol.Cyclotomic.UCycCrypto.Lol.Cyclotomic.CycCrypto.Lol.Cyclotomic.LinearCrypto.Lol.Applications.SymmSHECrypto.Lol.Types.IZipVectorControl.ApplicativeZipListCrypto.Lol.Types.NumericNumericPreludeNumericAlgebra ToRationalAlgebra.IntegralDomaindivModCrypto.Lol.Types.ComplexCrypto.Lol.GaussRandomPreludeuntil0Crypto.Lol.Cyclotomic.Tensor.RepaTensor.RTCommon-Crypto.Lol.Cyclotomic.Tensor.RepaTensor.Gauss*Crypto.Lol.Cyclotomic.Tensor.RepaTensor.GLCrypto.Lol.TypesIrreducibleChar2CryptoLol!Crypto.Lol.Types.IrreducibleChar2+Crypto.Lol.Cyclotomic.Tensor.RepaTensor.CRTCrypto.Lol.Types.ZmStar.Crypto.Lol.Cyclotomic.Tensor.CTensor.Extension1Crypto.Lol.Cyclotomic.Tensor.RepaTensor.ExtensionCyc scalarCycliftCyc adviseCRTmulGdivG tGaussian errorRounded errorCosetembedtwace coeffsCycpowBasiscrtSet Crypto.LolbaseGHC.IntInt64unPPprimePP exponentPPunF PrimePowerPPFactoredFfMulfPPMul fOddRadicalfDivfDividesfLCMfGCDppToFtoPPpFreeconst_KPyAMKSeQoHLCBnFmrGkLsData.Constraint\\singl_6zuApKrG1Ok6HgOje70glLData.SingletonsSingtypen_29BPbdqzT0LIW1ev9oROCcData.Type.Natural.DefinitionsNat SFactored SPrimePowerUnF ExponentPPPrimePPUnPPsUnPPsUnFFPPMulFMulToPPPpToFPrimeNatFGCDFLCMFDividesFDiv FOddRadicalsPpToFsToPPPFreeCoprimeDividesPrimeNatCPPowFactPToF*/F1F2048F1024F512F256F128F98F96F90F88F84F80F78F76F72F70F68F66F64F60F56F54F52F50F48F44F42F40F38F36F34F32F30F28F26F24F22F20F18F16F14F10F8F6F12F4F2F81F75F63F57F51F45F39F33F27F21F15F99F9F3F95F85F65F55F35F25F5F91F77F49F7F11F13F17F19 transDivides gcdDivides lcmDivides lcm2DividespSplitTheorems pFreeDividesppsFact valueFact totientFact valueHatFact radicalFactoddRadicalFactppPPow primePPow exponentPPow valuePPow totientPPow valueNatCvalueHatppToPPvaluePP totientPP radicalPP oddRadicalPPvaluePPs totientPPs radicalPPs oddRadicalPPs RescaleCyc rescaleCycBasisPowDec $fNFDataBasisReflectsvalue PolynomialPID RealIntegralAbsolute ToIntegerOrdFloatRealTranscendentalTranscendental Algebraic RealFieldRealRingFieldIntegralDomainModuleRingAdditive ZeroTestablemaxminabs realToField^modinvdecomplogCeil roundMultroundScalarCentered divModCentComplex roundComplexcisrealimagfromRealEncodelsdToMSDRescalerescaleLift'LiftOfliftLiftReducereduceModModRepmodulus EnumerablevaluesmsdToLSD rescaleMod roundCoset fromJust'pureTpeelTpasteT withWitness withWitnessTCRTEmbedCRTExttoExtfromExtCRTranscrtInfoCRTInfo omegaPowMod crtInfoFact crtInfoPPow crtInfoNatCgEmbPPowgEmbNatCzqHasCRTXIrreduciblePolyirreduciblePolyCharOf PrimeField taggedProxyGFsizetraceMatrixTensorTElt entailIndexT entailEqT entailZTT entailRingT entailNFDataT entailRandomT scalarPowllInvmulGPowmulGDecdivGPowdivGDeccrtFuncs tGaussianDec twacePowDecembedPowembedDec crtExtFuncscoeffs powBasisPow crtSetDecfmapTfmapTM hasCRTFuncs scalarCRTmulGCRTdivGCRTcrtcrtInvtwaceCRTembedCRTindexMtwCRTsdigitRevzmsToIndexFact indexInfoextIndicesPowDec extIndicesCRTbaseIndicesPowbaseIndicesDecbaseIndicesCRTextIndicesCoeffsZPPZPOf modulusZPPliftZpCorrectcorrect DecomposeDecompOf decomposeGadgetgadgetencodeBaseBGadTrivGadZqBasicDispatchCRNSCTRTCEltREltUCyc forceBasisforcePowforceDecforceAnyfmapCfmapCM unsafeUnCyccyc advisePow adviseDec ExtendLinIdxLinear linearDecevalLin extendLin TunnelCtx MulPublicCtx AddPublicCtx KeySwitchCtxInnerKeySwitchCtx KSHintCtxModSwitchPTCtxToSDCtx DecryptCtx ErrorTermCtx EncryptCtxGenSKCtxPTSKgenSKencrypt errorTermdecrypterrorTermUnrestricteddecryptUnrestrictedtoMSDtoLSDrescaleLinearCT modSwitchPTkeySwitchLinearkeySwitchQuadCirc addScalar addPublic mulPublicembedCTembedSKtwaceCTtunnelCT<<=SingIEquals_1627454393Equals_1627454404ppMulppsMulCase_1627464452Case_1627464480 ppsOddRadppsDiv ppsDividesppsLCMppsGCDprimeNatprimeToFCase_1627477567Case_1627477603Case_1627477639Case_1627477702Case_1627477774Case_1627477810Case_1627477875Case_1627477911Case_1627477969Case_1627477972Case_1627477974Case_1627477976Case_1627477978Case_1627477980Case_1627477982Case_1627477984Case_1627477986Case_1627478007Case_1627478010Case_1627478025Case_1627478029Case_1627502531f19f17f13f11f7f49f77f91f5f25f35f55f65f85f95f3f9f99f15f21f27f33f39f45f51f57f63f75f81f2f4f12f6f8f10f14f16f18f20f22f24f26f28f30f32f34f36f38f40f42f44f48f50f52f54f56f60f64f66f68f70f72f76f78f80f84f88f90f96f98f128f256f512f1024f2048f1UnFSym0UnFSym0KindInferenceUnFSym1ExponentPPSym0ExponentPPSym0KindInferenceExponentPPSym1 PrimePPSym0PrimePPSym0KindInference PrimePPSym1UnPPSym0UnPPSym0KindInferenceUnPPSym1FSym0FSym0KindInferenceFSym1PPSym0PPSym0KindInferencePPSym1SFSPPsPrimePP sExponentPPTFCo:R:DemoteRepFactoredKProxyPpsMulPpMul FPPMulSym0FPPMulSym0KindInference FPPMulSym1FPPMulSym1KindInference FPPMulSym2FMulSym0FMulSym0KindInferenceFMulSym1FMulSym1KindInferenceFMulSym2 PpsMulSym0PpsMulSym0KindInference PpsMulSym1PpsMulSym1KindInference PpsMulSym2 PpMulSym0PpMulSym0KindInference PpMulSym1PpMulSym1KindInference PpMulSym2Let1627464524PpLet1627464524PpSym0 Let1627464524PpSym0KindInferenceLet1627464524PpSym1 Let1627464524PpSym1KindInferenceLet1627464524PpSym2 Let1627464524PpSym2KindInferenceLet1627464524PpSym3!Let1627464454Scrutinee_1627464409%Let1627464454Scrutinee_1627464409Sym02Let1627464454Scrutinee_1627464409Sym0KindInference%Let1627464454Scrutinee_1627464409Sym12Let1627464454Scrutinee_1627464409Sym1KindInference%Let1627464454Scrutinee_1627464409Sym22Let1627464454Scrutinee_1627464409Sym2KindInference%Let1627464454Scrutinee_1627464409Sym32Let1627464454Scrutinee_1627464409Sym3KindInference%Let1627464454Scrutinee_1627464409Sym42Let1627464454Scrutinee_1627464409Sym4KindInference%Let1627464454Scrutinee_1627464409Sym5!Let1627464426Scrutinee_1627464407%Let1627464426Scrutinee_1627464407Sym02Let1627464426Scrutinee_1627464407Sym0KindInference%Let1627464426Scrutinee_1627464407Sym12Let1627464426Scrutinee_1627464407Sym1KindInference%Let1627464426Scrutinee_1627464407Sym22Let1627464426Scrutinee_1627464407Sym2KindInference%Let1627464426Scrutinee_1627464407Sym32Let1627464426Scrutinee_1627464407Sym3KindInference%Let1627464426Scrutinee_1627464407Sym42Let1627464426Scrutinee_1627464407Sym4KindInference%Let1627464426Scrutinee_1627464407Sym5sPpMulsPpsMulsFMulsFPPMul&TFCo:R:Apply(->)PrimePowerFPPMulSym0l0PrimeToFPpsGCDPpsLCM PpsDividesPpsDiv PpsOddRadToPPSym0ToPPSym0KindInferenceToPPSym1ToPPSym1KindInferenceToPPSym2 PrimeToFSym0PrimeToFSym0KindInference PrimeToFSym1 PpToFSym0PpToFSym0KindInference PpToFSym1 PrimeNatSym0PrimeNatSym0KindInference PrimeNatSym1FGCDSym0FGCDSym0KindInferenceFGCDSym1FGCDSym1KindInferenceFGCDSym2FLCMSym0FLCMSym0KindInferenceFLCMSym1FLCMSym1KindInferenceFLCMSym2 FDividesSym0FDividesSym0KindInference FDividesSym1FDividesSym1KindInference FDividesSym2FDivSym0FDivSym0KindInferenceFDivSym1FDivSym1KindInferenceFDivSym2FOddRadicalSym0FOddRadicalSym0KindInferenceFOddRadicalSym1 PpsGCDSym0PpsGCDSym0KindInference PpsGCDSym1PpsGCDSym1KindInference PpsGCDSym2 PpsLCMSym0PpsLCMSym0KindInference PpsLCMSym1PpsLCMSym1KindInference PpsLCMSym2PpsDividesSym0PpsDividesSym0KindInferencePpsDividesSym1PpsDividesSym1KindInferencePpsDividesSym2 PpsDivSym0PpsDivSym0KindInference PpsDivSym1PpsDivSym1KindInference PpsDivSym2 PpsOddRadSym0PpsOddRadSym0KindInference PpsOddRadSym1!Let1627477877Scrutinee_1627477467%Let1627477877Scrutinee_1627477467Sym02Let1627477877Scrutinee_1627477467Sym0KindInference%Let1627477877Scrutinee_1627477467Sym12Let1627477877Scrutinee_1627477467Sym1KindInference%Let1627477877Scrutinee_1627477467Sym22Let1627477877Scrutinee_1627477467Sym2KindInference%Let1627477877Scrutinee_1627477467Sym32Let1627477877Scrutinee_1627477467Sym3KindInference%Let1627477877Scrutinee_1627477467Sym42Let1627477877Scrutinee_1627477467Sym4KindInference%Let1627477877Scrutinee_1627477467Sym52Let1627477877Scrutinee_1627477467Sym5KindInference%Let1627477877Scrutinee_1627477467Sym6!Let1627477841Scrutinee_1627477465%Let1627477841Scrutinee_1627477465Sym02Let1627477841Scrutinee_1627477465Sym0KindInference%Let1627477841Scrutinee_1627477465Sym12Let1627477841Scrutinee_1627477465Sym1KindInference%Let1627477841Scrutinee_1627477465Sym22Let1627477841Scrutinee_1627477465Sym2KindInference%Let1627477841Scrutinee_1627477465Sym32Let1627477841Scrutinee_1627477465Sym3KindInference%Let1627477841Scrutinee_1627477465Sym42Let1627477841Scrutinee_1627477465Sym4KindInference%Let1627477841Scrutinee_1627477465Sym52Let1627477841Scrutinee_1627477465Sym5KindInference%Let1627477841Scrutinee_1627477465Sym6!Let1627477776Scrutinee_1627477471%Let1627477776Scrutinee_1627477471Sym02Let1627477776Scrutinee_1627477471Sym0KindInference%Let1627477776Scrutinee_1627477471Sym12Let1627477776Scrutinee_1627477471Sym1KindInference%Let1627477776Scrutinee_1627477471Sym22Let1627477776Scrutinee_1627477471Sym2KindInference%Let1627477776Scrutinee_1627477471Sym32Let1627477776Scrutinee_1627477471Sym3KindInference%Let1627477776Scrutinee_1627477471Sym42Let1627477776Scrutinee_1627477471Sym4KindInference%Let1627477776Scrutinee_1627477471Sym52Let1627477776Scrutinee_1627477471Sym5KindInference%Let1627477776Scrutinee_1627477471Sym6!Let1627477740Scrutinee_1627477469%Let1627477740Scrutinee_1627477469Sym02Let1627477740Scrutinee_1627477469Sym0KindInference%Let1627477740Scrutinee_1627477469Sym12Let1627477740Scrutinee_1627477469Sym1KindInference%Let1627477740Scrutinee_1627477469Sym22Let1627477740Scrutinee_1627477469Sym2KindInference%Let1627477740Scrutinee_1627477469Sym32Let1627477740Scrutinee_1627477469Sym3KindInference%Let1627477740Scrutinee_1627477469Sym42Let1627477740Scrutinee_1627477469Sym4KindInference%Let1627477740Scrutinee_1627477469Sym52Let1627477740Scrutinee_1627477469Sym5KindInference%Let1627477740Scrutinee_1627477469Sym6Let1627477726XsLet1627477726XsSym0 Let1627477726XsSym0KindInferenceLet1627477726XsSym1 Let1627477726XsSym1KindInferenceLet1627477726XsSym2Let1627477716YsLet1627477716YsSym0 Let1627477716YsSym0KindInferenceLet1627477716YsSym1 Let1627477716YsSym1KindInferenceLet1627477716YsSym2!Let1627477668Scrutinee_1627477481%Let1627477668Scrutinee_1627477481Sym02Let1627477668Scrutinee_1627477481Sym0KindInference%Let1627477668Scrutinee_1627477481Sym12Let1627477668Scrutinee_1627477481Sym1KindInference%Let1627477668Scrutinee_1627477481Sym22Let1627477668Scrutinee_1627477481Sym2KindInference%Let1627477668Scrutinee_1627477481Sym32Let1627477668Scrutinee_1627477481Sym3KindInference%Let1627477668Scrutinee_1627477481Sym42Let1627477668Scrutinee_1627477481Sym4KindInference%Let1627477668Scrutinee_1627477481Sym52Let1627477668Scrutinee_1627477481Sym5KindInference%Let1627477668Scrutinee_1627477481Sym6!Let1627477605Scrutinee_1627477487%Let1627477605Scrutinee_1627477487Sym02Let1627477605Scrutinee_1627477487Sym0KindInference%Let1627477605Scrutinee_1627477487Sym12Let1627477605Scrutinee_1627477487Sym1KindInference%Let1627477605Scrutinee_1627477487Sym22Let1627477605Scrutinee_1627477487Sym2KindInference%Let1627477605Scrutinee_1627477487Sym32Let1627477605Scrutinee_1627477487Sym3KindInference%Let1627477605Scrutinee_1627477487Sym42Let1627477605Scrutinee_1627477487Sym4KindInference%Let1627477605Scrutinee_1627477487Sym52Let1627477605Scrutinee_1627477487Sym5KindInference%Let1627477605Scrutinee_1627477487Sym6!Let1627477569Scrutinee_1627477485%Let1627477569Scrutinee_1627477485Sym02Let1627477569Scrutinee_1627477485Sym0KindInference%Let1627477569Scrutinee_1627477485Sym12Let1627477569Scrutinee_1627477485Sym1KindInference%Let1627477569Scrutinee_1627477485Sym22Let1627477569Scrutinee_1627477485Sym2KindInference%Let1627477569Scrutinee_1627477485Sym32Let1627477569Scrutinee_1627477485Sym3KindInference%Let1627477569Scrutinee_1627477485Sym42Let1627477569Scrutinee_1627477485Sym4KindInference%Let1627477569Scrutinee_1627477485Sym52Let1627477569Scrutinee_1627477485Sym5KindInference%Let1627477569Scrutinee_1627477485Sym6!Let1627477533Scrutinee_1627477483%Let1627477533Scrutinee_1627477483Sym02Let1627477533Scrutinee_1627477483Sym0KindInference%Let1627477533Scrutinee_1627477483Sym12Let1627477533Scrutinee_1627477483Sym1KindInference%Let1627477533Scrutinee_1627477483Sym22Let1627477533Scrutinee_1627477483Sym2KindInference%Let1627477533Scrutinee_1627477483Sym32Let1627477533Scrutinee_1627477483Sym3KindInference%Let1627477533Scrutinee_1627477483Sym42Let1627477533Scrutinee_1627477483Sym4KindInference%Let1627477533Scrutinee_1627477483Sym52Let1627477533Scrutinee_1627477483Sym5KindInference%Let1627477533Scrutinee_1627477483Sym6Let1627477504PLet1627477504PSym0Let1627477504PSym0KindInferenceLet1627477504PSym1Let1627477504PSym1KindInferenceLet1627477504PSym2Let1627477504PSym2KindInferenceLet1627477504PSym3 sPpsOddRadsPpsDiv sPpsDividessPpsLCMsPpsGCD sFOddRadicalsFDiv sFDividessFLCMsFGCD sPrimeNat sPrimeToFTFCo:R:Apply(->)NatToPPSym0l0 PFreeSym0PFreeSym0KindInference PFreeSym1PFreeSym1KindInference PFreeSym2Let1627502462GoLet1627502462GoSym0 Let1627502462GoSym0KindInferenceLet1627502462GoSym1 Let1627502462GoSym1KindInferenceLet1627502462GoSym2 Let1627502462GoSym2KindInferenceLet1627502462GoSym3!Let1627502505Scrutinee_1627502447%Let1627502505Scrutinee_1627502447Sym02Let1627502505Scrutinee_1627502447Sym0KindInference%Let1627502505Scrutinee_1627502447Sym12Let1627502505Scrutinee_1627502447Sym1KindInference%Let1627502505Scrutinee_1627502447Sym22Let1627502505Scrutinee_1627502447Sym2KindInference%Let1627502505Scrutinee_1627502447Sym32Let1627502505Scrutinee_1627502447Sym3KindInference%Let1627502505Scrutinee_1627502447Sym42Let1627502505Scrutinee_1627502447Sym4KindInference%Let1627502505Scrutinee_1627502447Sym5Let1627502479PpLet1627502479PpSym0 Let1627502479PpSym0KindInferenceLet1627502479PpSym1 Let1627502479PpSym1KindInferenceLet1627502479PpSym2 Let1627502479PpSym2KindInferenceLet1627502479PpSym3 Let1627502479PpSym3KindInferenceLet1627502479PpSym4 Let1627502479PpSym4KindInferenceLet1627502479PpSym5sPFreeTFCo:R:Apply(->)NatPFreeSym0l0F1Sym0 F2048Sym0 F1024Sym0F512Sym0F256Sym0F128Sym0F98Sym0F96Sym0F90Sym0F88Sym0F84Sym0F80Sym0F78Sym0F76Sym0F72Sym0F70Sym0F68Sym0F66Sym0F64Sym0F60Sym0F56Sym0F54Sym0F52Sym0F50Sym0F48Sym0F44Sym0F42Sym0F40Sym0F38Sym0F36Sym0F34Sym0F32Sym0F30Sym0F28Sym0F26Sym0F24Sym0F22Sym0F20Sym0F18Sym0F16Sym0F14Sym0F10Sym0F8Sym0F6Sym0F12Sym0F4Sym0F2Sym0F81Sym0F75Sym0F63Sym0F57Sym0F51Sym0F45Sym0F39Sym0F33Sym0F27Sym0F21Sym0F15Sym0F99Sym0F9Sym0F3Sym0F95Sym0F85Sym0F65Sym0F55Sym0F35Sym0F25Sym0F5Sym0F91Sym0F77Sym0F49Sym0F7Sym0F11Sym0F13Sym0F17Sym0F19Sym0sF19sF17sF13sF11sF7sF49sF77sF91sF5sF25sF35sF55sF65sF85sF95sF3sF9sF99sF15sF21sF27sF33sF39sF45sF51sF57sF63sF75sF81sF2sF4sF12sF6sF8sF10sF14sF16sF18sF20sF22sF24sF26sF28sF30sF32sF34sF36sF38sF40sF42sF44sF48sF50sF52sF54sF56sF60sF64sF66sF68sF70sF72sF76sF78sF80sF84sF88sF90sF96sF98sF128sF256sF512sF1024sF2048sF1 coerceFDivs coerceGCD$fReflects*reia$fReflectsFactoredmi$fReflectsPrimePowerppi$fReflectsNatai$fReflectsNatai0 IZipVectorvecto_LmZ3LQW4ivu8MsQuVgukln Data.VectorVectorGHC.Base Applicativepure unIZipVector iZipVectorrepl $fCVector$fApplicativeIZipVectornumer_1lTPOZ9qLwH0bTC8IA0JrMMathObj.PolynomialTAlgebra.PrincipalIdealDomainCAlgebra.RealIntegralAlgebra.AbsoluteAlgebra.ToIntegerAlgebra.RealTranscendentalAlgebra.TranscendentalAlgebra.AlgebraicAlgebra.RealFieldAlgebra.RealRing Algebra.FieldAlgebra.ToRationalAlgebra.Module Algebra.RingAlgebra.AdditiveAlgebra.ZeroTestable integer-gmpGHC.Integer.TypeInteger $fCDouble $fNFDataT++GHC.Errerrorghc-primGHC.PrimseqGHC.Listfilterzip System.IOprint Data.Tuplefstsnd otherwisemap$ undefinedGHC.EnumenumFrom enumFromThen enumFromToenumFromThenTo GHC.Classes==>=fail>>=>>fmapreturnGHC.Real realToFracBoundedEnumEqMonadFunctorOrdGHC.ReadReadGHC.ShowShow GHC.TypesBoolCharDoubleFloatIntOrderingIO Data.EitherEitherStringFalseTrueLeftRightLTEQGTJustNothingminBound takeWhilemaxBoundData.TraversablesequencemapMreadIOreadLn appendFile writeFilereadFileinteract getContentsgetLinegetCharputStrLnputStrputCharGHC.IO.ExceptionioErrorGHC.IOFilePath userErrorIOError Text.Readreadreads Data.FoldablenotElemallanyorand concatMapconcat sequence_mapM_minimummaximumelemlengthnullfoldl1foldr1foldlfoldreither Data.OldListunwordswordsunlineslineslex readParenreadList readsPrecText.ParserCombinators.ReadPReadSfromEnumtoEnumpredsucc showParen showStringshowCharshowsShowSshowListshow showsPrecunzip3unzipzipWith3zipWithzip3!!lookupreversebreakspansplitAtdroptake dropWhilecycle replicaterepeatiteratescanr1scanrscanl1scanlinitlasttailhead Data.MaybemaybeuncurrycurryasTypeOf$!flip.constid=<<Maybe<$/=compare<=&&||not<>atan2approxRationalroundtruncatefloorceilingfraction splitFraction*>^?atanhacoshasinhtanhcoshsinhatanacosasintancossin**logBaselogexppi^/sqrt fieldPower ringPower fromIntegral toIntegerquotRemremquot toRational fromRational^- fromRational'recip Number.Ratio% denominator numeratorRationalsignumextendedEuclideuclidlcmgcd extendedGCD Algebra.Units stdUnitInvstdUnit stdAssociateisUnitoddevendividesmoddivproduct1productsqr fromIntegeroneisZerosum1sumsubtractnegate-+zeroNumericPrelude.Basecatchutili_1dKOfAkrqjK4ivPs0wS8vjData.Bool.HT.Private ifThenElse V_Complex MV_Complex $fEltComplex$fRandomComplex$fNFDataComplex $fCComplex3TFCo:R:VectorComplexfromJust $fNFDataProxyV_MaybeMV_Maybe $fRandom(,) $fEncodes(,) $fRescaleb(,) $fRescalea(,) $fRescale(,)a $fRescale(,)c$fRescale(,)a0 $fRescale(,)b $fReducea(,)$fMod(,)$fC(,)$fC(,)0$fC(,)1 $fLift'(,) $fDefaultBoolTFCo:R:VectorMaybe Data.Proxy asProxyTypeOfProxyKProxytagge_JDqTivUd6rsAIEbAkXx0l1Data.Functor.Trans.TaggedwitnessTtagTWith untagTSelftagTSelfunproxyTproxyTasTaggedTypeOf reflectedM reflected mapTaggedTretagtagTwitnesstagWith untagSelftagSelfunproxyproxyuntagtagTaggeduntagTTagTTaggedT omegaPowC$fCRTEmbedInteger$fCRTEmbedInt64 $fCRTEmbedInt$fCRTEmbedDouble$fCRTransInteger$fCRTransInt64 $fCRTransInt$fCRTransDouble$fCRTEmbedComplex$fCRTransComplex $fCRTEmbed(,) $fCRTrans(,) realGaussian realGaussians iterateWhile iterateUntilMTransIdTSnocArrreplMfTensorppTensordimtrans.*@*evalevalMexposeunexposemulMatmulDiag scalarPow'forcesumSsumAllSTransC TensorabledimCevalC$fArbitraryArr $fRandomArr $fNFDataArrayrepa_8K21xoK0Z9yIHJ9bhmydk1Data.Array.Repa.Repr.VectorAVectorData.Array.Repa.Repr.CursoredcursoredExtent ACursored loadCursor shiftCursor makeCursorData.Array.Repa.Repr.Undefined AUndefinedData.Array.Repa.Repr.UnboxedAUnboxed Data.Array.Repa.Repr.PartitionedAPart#Data.Array.Repa.Repr.HintInterleave AInterleaveData.Array.Repa.Repr.ForeignPtr AForeignPtrData.Array.Repa.Repr.ByteString AByteStringData.Array.Repa.Repr.DelayedADelayedData.Array.Repa.Repr.HintSmallASmall#Data.Array.Repa.Operators.ReductionequalsSequalsPfoldAllPfoldAllSfoldPfoldS!Data.Array.Repa.Operators.MappingszipWithsmapTR Structured#Data.Array.Repa.Operators.SelectionselectPunzip6unzip5unzip4zip6zip5zip4 toUnboxed fromUnboxedfromListUnboxedcomputeUnboxedPcomputeUnboxedSUData.Array.Repa.EvalnowsuspendedCopyPcopyScopyPsuspendedComputePcomputeScomputeP Data.Array.Repa.Eval.InterleavedfillInterleavedP$Data.Array.Repa.Operators.Interleave interleave4 interleave3 interleave2$Data.Array.Repa.Operators.IndexSpacesliceextendbackpermuteDft backpermuteextract transposeappendreshape#Data.Array.Repa.Operators.Traversal traverse4 traverse3 traverse2traversedelay toFunction fromFunctionDData.Array.Repa.Eval.ChunkedfillChunkedIOP fillChunkedP fillBlock2S fillLinearSData.Array.Repa.Eval.CursoredfillCursoredBlock2SfillCursoredBlock2P fillBlock2PData.Array.Repa.Eval.SelectionselectChunkedPselectChunkedSData.Array.Repa.SliceAllAny FullShape SliceShape fullOfSlice sliceOfFullSliceData.Array.Repa.Indexix5ix4ix3ix2ix1Z:.DIM0DIM1DIM2DIM3DIM4DIM5Data.Array.Repa.Eval.LoadloadPloadSLoad loadRangeP loadRangeS LoadRangeData.Array.Repa.Eval.TargetfromList touchMVec deepSeqMVecunsafeFreezeMVecunsafeWriteMVecnewMVecMVecTargetData.Array.Repa.Base deepSeqArraystoList! deepSeqArrayunsafeLinearIndex linearIndex unsafeIndexindexextentArraySourceData.Array.Repa.Shape showShapeinShapedeepSeq shapeOfList listOfShape inShapeRange fromIndextoIndex sizeIsValidaddDim intersectDimunitDimzeroDimrankShapeData.Array.Repa.Eval.ElttouchEltData.Vector.Unboxed.BaseUnbox tGaussianDec'fDpDfLfLInvfGPowfGDecfGInvPowfGInvDecdivCheck wrapGInv'pWrappLpLInvpGPowpGDec pGInvPow' pGInvDec'$fIrreduciblePolya powTracesGFCtxsizePP isPrimitivedotptrace' $fCRTransGF$fCGF$fCGF0$fEnumerableGF twCRTsPPow indexToPow indexToZms zmsToIndex zmsToIndexPP toIndexPair baseIndexDec fromIndexPairMNilMKronMatrixCMCfMatrixindexToPowPPowindexToZmsPPow baseWrappermergePPstotients scalarCRT'mulGCRT'divGCRT'gCRTgInvCRTfCRTfCRTInvppDFT ppDFTInv'ppCRT ppCRTInv'pDFTpDFTInv'pCRTpCRTInv'ppTwid ppTwidHat$fDecomposekgad(,)$fGadgetkgad(,) ReflectsTIZqB V_ZqBasic MV_ZqBasicreduce'decode'$fVectorVectorZqBasic$fMVectorMVectorZqBasic$fUnboxZqBasicTFCo:R:VectorZqBasicTFCo:R:MVectorsZqBasic$fArbitraryZqBasic$fRandomZqBasic$fDecompose*BaseBGadZqBasic$fGadget*BaseBGadZqBasic$fCorrect*TrivGadZqBasic$fDecompose*TrivGadZqBasic$fGadget*TrivGadZqBasic $fCZqBasic $fCZqBasic0 $fCZqBasic1 $fCZqBasic2$fCRTEmbedZqBasic$fCRTransZqBasic$fEncodeZqBasicZqBasic$fRescaleZqBasicZqBasic$fLift'ZqBasic$fReduceIntegerZqBasic$fReducezZqBasic $fZPPZqBasicTFCo:R:CharOf*ZqBasic $fModZqBasic$fEnumerableZqBasicorderpartitionCosetscosets backpermute'Data.Vector.Generic embedPow' embedDec' embedCRT'coeffs' twacePowDec' powBasisPow' crtSetDec'CT' coerceCoeffscoerce coerceBasisdcrtdcrtinvdldlinvdmulgpowdmulgdecdginvpowdginvdecdadddmuldgcrtdginvcrt dgaussdecCPPp'e' zipWrapper crtWrapper lgWrapper divGWrapper gaussWrapperEmTwZVunCTaddDaddCaddRaddRqmulCmulRqtensorGaussianDec tensorCRTInvCtensorCRTInvRq tensorCRTC tensorCRTRqtensorGInvDecRqtensorGInvDecRtensorGInvPowRqtensorGInvPowR tensorGDecRq tensorGDecR tensorGPowRq tensorGPowR tensorLInvCtensorLCtensorLInvDouble tensorLDouble tensorLInvRq tensorLRq tensorLInvRtensorLRtoCTtoZVzvToCT'wrapwrapMcoerceTwcoerceEmmulGPow'divGPow'crt' lgDispatchctCRTctCRTInvcheckDiv divIfDivis cZipDispatchcDispatchGaussianruruInv gCoeffsCRT gInvCoeffsCRT twaceCRT'marshalFactors withPtrArraystore$fDispatchInt64$fDispatchDouble$fDispatchComplex$fDispatchZqBasic $fShowCPP $fStorableCPP $fNFDataCT $fRandomCT $fRandomCT' $fArbitraryCT$fArbitraryCT' $fCRNS(,) $fCRNSZqBasic $fCRNSComplex $fCRNSInt64 $fCRNSDouble $fTensorCT$fTraversableCT $fFoldableCT$fApplicativeCT $fFunctorCT$fCCT$fCCT0$fCCT1$fEqCT $fDefault:. $fDefaultZV_DIM1MV_DIM1TFCo:R:Vector:.zvToArrtoRT $fNFDataRT $fArbitraryRT $fRandomRT$fCRT$fCRT0$fCRT1$fTraversableRT $fFoldableRT$fApplicativeRT $fFunctorRT $fTensorRT$fEqRTUCCtx roundCosetDecembed'SubtoDec'toCRT'CRTrCRTeScalartoPow'toCRTrtoCRTeerrApp $fNFDataUCyc$fArbitraryUCyc $fShowUCyc $fRandomUCyc$fTraversableUCyc$fFoldableUCyc$fApplicativeUCyc $fFunctorUCyc$fRescaleCycUCyc(,)b$fRescaleCycUCycab$fCorrectkgadUCyc$fDecomposekgadUCyc$fGadgetkgadUCyc$fReduceUCycUCyc$fCUCyc$fCUCyc0$fCUCyc1$fEqUCycO coerceCyc$fDecomposekgadCyc$fRescaleCycCycab$fReduceCycCyc $fLift'Linear$fReduceLinearLinear $fCLinearEncodingrescaleLinearMSD lweSampleksHintmulGCTabsorbGFactors AbsorbGCtx AddScalarCtx KnapsackCtxLWECtxMSDLSDdivG'*>>knapsackswitch $fNFDataSK