?      !"#$%&'()*+,-./012 3 4 5 6 7 8 9 : ; < = > ? @ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~               !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~-NoneCTurns a  g into a standard . Evaluate a . computation using a cryptographic generator gN, seeded by system entropy. Note that the updated generator is not returned.None+0357 !"#$ !"#$ !"#$ !"#$None+0357 %&'(%&'(%&'( %&'(None+0357 )*+,)*+,)*+, )*+,None+0357 -./01-./01-./01 -./01 None+0357 234523452345 2345 None+035767676767 None '345>LN8KConversion between Haskell types and their protocol buffer representations.9The protocol buffer type for a.::Convert from a type to its protocol buffer representation.;.Convert from a protocol buffer representation.<0Serialize a Haskell type to its protocol buffer .=Read a protocol buffer  to a Haskell type.89:;<=>?89:;<=89:;?><=89:;<=>?None !"%&(357KLN@Sane synonym for .ASane synonym for .BSane synonym for .CSane synonym for .DSane synonym for .EConvenient synonym for (Ord a, Transcendental a)FSane synonym for .GSane synonym for .HSane synonym for .ISane synonym for .JSane synonym for .KSane synonym for .LSane synonym for .MSane synonym for .NSane synonym for .OSane synonym for .PSane synonym for .QSane synonym for .RThe Prelude definition of R.SThe Prelude definition of S.TThe sane definition of T from  rather than the default from NumericPrelude.UThe hidden NP function from  !.VBOur custom exponentiation, overriding NP's version that requires  exponent. Copied from Jhttp://hackage.haskell.org/package/base-4.7.0.0/docs/src/GHC-Real.html#%5EW Inverse of a modulo q , in range 0..q-1'. (Argument order is infix-friendly.)XXDecompose an element into a list of "centered" digits with respect to relative radices.Y3Deterministically round to the nearest multiple of i.Z<Randomly round to the nearest larger or smaller multiple of i1, where the round-off term has expectation zero.[ Variant of "#) in which the remainder is in the range  [-b/2,b/2).@ABCDEFGHIJKLMNOPQRSTUVWXYZ[ dividend adivisor b(quotient, remainder)       !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~@ABCDEFGHIJKLMNOPQRSTUVWXYZ[@ABCDEFGHIJKLMNOPQRSTUVWXYZ[$None%(*03457>CLN\9Newtype wrapper (with slightly different instances) for  Rhttps://hackage.haskell.org/package/numeric-prelude-0.4.2/docs/Number-Complex.htmlnumeric-prelude Complex.]@Rounds the real and imaginary components to the nearest integer.^^ t9 is a complex value with magnitude 1 and phase t (modulo 2*Pi)._#Real component of a complex number.`(Imaginary component of a complex number.a:Embeds a scalar as the real component of a complex number.Custom instance replacing the one provided by numeric prelude: it always returns 0 as the remainder of a division. (The NP instance sometimes has precision issues, because it yields nonzero remainders, which is a problem for divG methods.)\]^_`a\]^_`a \]^_`a%None!"%&'()>ILNn Convert a  to an integral type.oKind-restricted synonym for .pKind-restricted synonym for .w Convert a  to an integral type.xReify a  as a singleton.yReify a  for a  constraint.zReify a  as a singleton.{Reify a  for a  constraint.| Template Haskell splice for the  type representing a given #, e.g.,  $(posType 8).} Template Haskell splice for the  type representing a given #, e.g.,  $(binType 89).~)Template Haskell splice that defines the  type synonym Pn.)Template Haskell splice that defines the  type synonym Bn.6Template Haskell splice that declares a type synonym  pfxn as the type f n.;Infinite list of primes, built using Sieve of Erastothenes.Search for the argument in . This is not particularly fast, but works well enough for moderate-sized numbers that would appear as (divisors of) cyclotomic indices of interest.V bcdefghijk lmn opq   rstuv wxyz{|}~ pfx f n!0 bcdefghijk lmnopqrstuv wxyz{|}~= bcdefghijklmn  opq   rstuvwxyz{|}~! None(      bcdefghijk lmnopqrstuv wxyz{|}~     bpnmcldxy|~kijefgh qoz{w}vturs          &None!"&'()>IKLN2)Type synonym for (prime, exponent) pair.*&Constraint synonym for coprimality of  types.+'Constraint synonym for divisibility of  types.,Kind-restricted synonym for .-Kind-restricted synonym for ..Kind-restricted synonym for ./,Type (family) synonym for multiplication of  types0&Type (family) synonym for division of  types2Reify a  as a singleton.3Reify a  for a . constraint.4Reify a  as a singleton.5Reify a  for a - constraint.6Reify a  as a singleton.7Reify a  for a , constraint.8:Entails constraint for transitivity of division, i.e. if k|l and l|m, then k|m.9(Entailment for divisibility by GCD: if  g=GCD(m1,m2) then g|m1 and g|m2.:%Entailment for LCM divisibility: if  l=LCM(m1,m2) then m1|l and m2|l.;=Entailment for LCM divisibility: the LCM of two divisors of m also divides m.<Entailment for p-free division: if f is m after removing all p-factors, then f|m and  gcd(f,p)=1.=Entailment for p-free division: if m|m', then p-free(m) | p-free(m').>2Value-level prime-power factorization tagged by a  type.?The value of a  type.@The totient of a  type's value.AThe "hat" of a  type's value: hat{m} is m if m is odd, and m/2 otherwise.B-The radical (product of prime divisors) of a  type.C5The odd radical (product of odd prime divisors) of a  type.D Reflect a  type to a ) value.E!Reflect the prime component of a  type.F$Reflect the exponent component of a  type.GThe value of a  type.HThe totient of a  type's value.IThe value of a  type.JReturn m if m is odd, and m/2 otherwise.K Conversion.LThe value of a prime power.MTotient of a prime power.NThe radical of a prime power.O!The odd radical of a prime power.P Product of values of individual )sQ"Product of totients of individual )sR"Product of radicals of individual )sS&Product of odd radicals of individual )sT Template Haskell splice for the ? type corresponding to a given positive prime integer. (Uses  to enforce primality of the base, so should only be used on small-to-moderate-sized arguments.) This is the preferred (and only) way of constructing a concrete ! type (and is used to define the Primep type synonyms).U Template Haskell splice for the  type corresponding to a given ) . (Calls T on the first component of its argument, so should only be used on small-to-moderate-sized numbers.) This is the preferred (and only) way of constructing a concrete  type.V Template Haskell splice for the u type corresponding to a given positive integer. Factors its argument using a naive trial-division algorithm with o, so should only be used on small-to-moderate-sized arguments (any reasonable cyclotomic index should be OK).W)Template Haskell splice that defines the  type synonym Primep for a positive prime integer p.X)Template Haskell splice that defines the  type synonym PPn, where n=p^e.Y)Template Haskell splice that defines the  type synonym Fn for a positive integer n."Factorize a positive integer into an ordered list of its prime divisors, with possible duplicates. First argument is infinite list of primes left to consider.#kFactorize a positive integer into a list of (prime,exponent) pairs, in strictly increasing order by prime.4 $%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXY"# bcdefghijk lmnopqrstuv wxyz{|}~     \ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXY $%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ^_`a]\[bcdefghijklmnopqrstuvwxyz{|}~ !"#$%      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXY"#None(FZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ bcdefghijk lmnopqrstuv wxyz{|}~     \ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~67,VY45-UX23.TW'& (    /#+$0!"*%1>?@ABCDEFGHI89:;<=J)KLMNOPQRSYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!      ~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!      ~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[Z[Zba`_^]\fedcihg~}|{zyxwvutsrqponmlkjZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ None '(3457>NReflection without fundep, and with tagged value. Intended only for low-level code; build specialized wrappers around it for specific functionality.)Reflect the value assiated with the type a. None7Represents cyclotomic rings that are rescalable over their base rings. (This is a class because it allows for more efficient specialized implementations.)Rescale in the given basis.?Represents the basis used to rescale a cyclotomic ring element."Specialized convenience functions."Specialized convenience functions.'None&(-./47>?CLN/Indexed Zip Vector: a wrapper around a (boxed)  that has zip-py  behavior, analogous to () for lists. The index m9 enforces proper lengths (and is necessary to implement ). DeconstructorVSmart constructor that checks whether length of input is right (should be totient of m).Unzip an IZipVector.        None%&'(*34579>CIKLN!Represents that the target ring can "noisily encode" values from the source ring, in either "most significant digit" (MSD) or "least significant digit" (LSD) encodings, and provides conversion factors between the two types of encodings.The factor that converts an element from LSD to MSD encoding in the target field, with associated scale factor to apply to correct the resulting encoded value.Represents that a can be rescaled to b-, as an "approximate" additive homomorphism.Fun-dep version of Lift.The type of representatives of b.Represents that b can be lifted to a "short" a congruent to b.Represents that b is a quotient group of a.Represents that a is a subgroup of b.0Represents a quotient group modulo some integer. Poor man's .4The characteristic of a ring, represented as a type.Inverted entries of .*A default implementation of rescaling for  types.>Deterministically round to a nearby value in the desired coset Version of   with an error message.(Apply any applicative to a Tagged value.#Expose the monad of a tagged value.!Hide the monad of a tagged value.DUse a singleton as a witness to extract a value from a tagged value.Transformer version of .Encode for a product ringRescale up to a product ring of ZqsRescale up to a product ring of Zqs"Rescale a (multi-)product ring of Zqs"Rescale a (multi-)product ring of ZqsRescale a product ring of ZqsRescale a product ring of ZqsReduce into product ring.Product ring of Zqs as a Zq (with  modulus)+Product ring as an (almost) integral domain!Product ring as an (almost) fieldPair as product ringLift product ring of Zqs to / !      !"#$%&'()*+,-. /0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ"#$%&[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'()*+,-./0123456789:;<=>@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijk lmnopqrstuv wxyz{|}~     \ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~>RSTUQPONMLKJIHGFEDCBA@VWXYZ[\]^_`a% !None %'3457>LN,A ring with a ring embedding into some ring CRTExt r0 that has an invertible CRT transformation for every positive index m. Embeds from r to CRTExt r Projects from CRTExt r to r aA ring that (possibly) supports invertible Chinese remainder transformations of various indices.The values of   for different indices m- should be consistent, in the sense that if omega, omega'/ are respectively the roots of unity used for m, m' where m divides m'#, then it should be the case that omega'^(m'/m)=omega.   for a given index mn. The method itself may be slow, but the function it returns should be fast, e.g., via internal memoization. ^Information that characterizes the (invertible) Chinese remainder transformation over a ring r , namely: a function that returns the ith power of some  principal m"th root of unity (for any integer i)the multiplicative inverse of \hat{m} in r.?CEmbeds into complex numbers. (May not have sufficient precision.)@Embeds into complex numbersAEmbeds into complex numbersBEmbeds into complex numbersCReturns 0DReturns 0EReturns 0FReturns 0G Self-embedHComplex numbers have   for any index mI Product ringJ Product ring    KL?@ABCDEFGHIJ            KL?@ABCDEFGHIJNone%&'()47>?CLN  "Convenience data type for writing  instances.Represents fields over which we can get irreducible polynomials of desired degrees. (An instance of this class is defined in *+ and exported from ,-.)=This wrapper for a list of coefficients is used to define a GF(p^d)#-module structure for tensors over F_p of dimension n , where d | n.&Constraint synonym for a finite field.%Constraint synonym for a prime field.$A finite field of given degree over F_p.Yield a list of length exactly d* (i.e., including trailing zeros) of the fp.-coefficients with respect to the power basis."Yield a field element given up to d/ coefficients with respect to the power basis.The order of the field: size (GF fp d) = p^dTrace into the prime subfield.M;Traces of the power basis elements 1, x, x^2, ..., x^(d-1).!Convenience function for writing  instances. NOPQRMSTUVWX   NOPQRMSTUVWXNone&'(47>FIKLN92A Kronecker product of zero of more matrices over r.Y encapsulates all the core linear transformations needed for cyclotomic ring arithmetic. The type t m r6 represents a cyclotomic coefficient tensor of index m over base ring r. Most of the methods represent linear transforms corresponding to operations in particular bases. CRT-related methods are wrapped in K because they are well-defined only when a CRT basis exists over the ring r for index m._The superclass constraints are for convenience, to ensure that we can sample error tensors of !s.WARNING:5 as with all fixed-point arithmetic, the methods in  may result in overflow (and thereby incorrect answers and potential security flaws) if the input arguments are too close to the bounds imposed by the base type. The acceptable range of inputs for each method is determined by the linear transform it implements.Constraints needed by t to hold type r.-Properties that hold for any index. Use with . EProperties that hold for any (legal) fully-applied tensor. Use with .&3Convert a scalar to a tensor in the powerful basis.''P converts from decoding-basis representation to powerful-basis representation; ( is its inverse.('P converts from decoding-basis representation to powerful-basis representation; ( is its inverse.) Multiply by g in the powerful/decoding basis* Multiply by g in the powerful/decoding basis+ Divide by g& in the powerful/decoding basis. The j output indicates that the operation may fail, which happens exactly when the input is not divisible by g., Divide by g& in the powerful/decoding basis. The j output indicates that the operation may fail, which happens exactly when the input is not divisible by g.-FA tuple of all the operations relating to the CRT basis, in a single  value for safety. Clients should typically not use this method directly, but instead call the corresponding top-level functions: the elements of the tuple correpond to the functions <, =, >, ?, @..6Sample from the "tweaked" Gaussian error distribution t*D in the decoding basis, where D has scaled variance v./ Given the coefficient tensor of e( with respect to the decoding basis of R%, yield the (scaled) squared norm of  g_m cdot e* under the canonical embedding, namely, ,hat{m}^{ -1 } cdot || sigma(g_m cdot e) ||^2 .0The twaceS linear transformation, which is the same in both the powerful and decoding bases.1The embed> linear transformations, for the powerful and decoding bases.2The embed> linear transformations, for the powerful and decoding bases.3A tuple of all the extension-related operations involving the CRT bases, for safety. Clients should typically not use this method directly, but instead call the corresponding top-level functions: the elements of the tuple correpond to the functions A, B.4BMap a tensor in the powerful/decoding/CRT basis, representing an O_m'. element, to a vector of tensors representing O_m% elements in the same kind of basis.57The powerful extension basis w.r.t. the powerful basis.6'A list of tensors representing the mod-p CRT set of the extension.7!Potentially optimized version of  for types that satisfy .8Potentially optimized monadic .95Potentially optimized zipWith for types that satisfy .:3Potentially optimized unzip for types that satisfy .;%Convenience value indicating whether - exists.<cYield a tensor for a scalar in the CRT basis. (This function is simply an appropriate entry from -.)= Multiply by gG in the CRT basis. (This function is simply an appropriate entry from -.)> Divide by gH in the CRT basis. (This function is simply an appropriate entry from -.)?HThe CRT transform. (This function is simply an appropriate entry from -.)@PThe inverse CRT transform. (This function is simply an appropriate entry from -.)A\The "tweaked trace" function for tensors in the CRT basis: For cyclotomic indices m | m', #Tw(x) = (mhat/m'hat) * Tr(g'/g * x)6. (This function is simply an appropriate entry from 3.)BEmbed a tensor with index m* in the CRT basis to a tensor with index m'G in the CRT basis. (This function is simply an appropriate entry from 3.)YFor a prime power p^e, converts any matrix M for prime p to 1_(p^{e-1}) otimes M, where 1 denotes the all-1s vector.C Extract the (i,j) element of a .DA tot(m)(-by-1 matrix of the CRT coefficients of g_m, for mth cyclotomic.EA tot(m)0-by-1 matrix of the inverse CRT coefficients of g_m, for mth cyclotomic.FThe "tweaked" CRT^* matrix: CRT^* . diag(sigma(g_m)).Z/The "tweaked" CRT^* matrix (for prime powers): CRT^* * diag(sigma(g_p)).[A (p-1)(-by-1 matrix of the CRT coefficients of g_p, for pth cyclotomic.\A (p-1)0-by-1 matrix of the inverse CRT coefficients of g_p , for the pth cyclotomic.G/Base-p digit reversal; input and output are in [p^e].H Convert a Z_m^*# index to a linear tensor index in [m].]For a prime power p^e6, map a tensor index to the corresponding power j in  [phi(p^e)], as in the powerful basis.^For a prime power p^e8, map a tensor index to the corresponding element i in  Z_{p^e}^*._/Convert a Z_m^* index to a linear tensor index.` Inverse of ^.aCorrespondences between the linear indexes into a basis of O_m', and pair indices into (extension basis) otimes (basis of O_m). The work the same for Pow,Dec,CRT bases because all these bases have that factorization. The first argument is the list of (phi(m),phi(m'))( pairs for the (merged) prime powers of m,m'.IrA collection of useful information for working with tensor extensions. The first component is a list of triples (p,e,e') where e, e') are respectively the exponents of prime p in m, m'. The next two components are phi(m) and phi(m')". The final component is a pair (phi(p^e), phi(p^e'))) for each triple in the first component.J A vector of phi(m) entries, where the i;th entry is the index into the powerful/decoding basis of O_m' of the i+th entry of the powerful/decoding basis of O_m.K A vector of phi(m) blocks of phi(m')/phi(m)T consecutive entries. Each block contains all those indices into the CRT basis of O_m'A that "lie above" the corresponding index into the CRT basis of O_m.LA lookup table for a applied to indices  [phi(m')].MA lookup table for b applied to indices  [phi(m')].NSame as L7, but only includes the second component of each pair.OThe i0th entry of the i1 th vector is c (i1,i0).bConvenient reindexing functionsMaps an index of the extension ring array to its corresponding index in the base ring array (if it exists), with sign, under the decoding basis.Kdefg !"#$%&'()*+,-./0123456789:;<=>?@ABhYCDEFZij[\GklH]^_`acIJKmLMNObno4 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNO4 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFHIJKOLMNG+defg !"#$%&'()*+,-./0123456789:;<=>?@ABhYCDEFZij[\GklH]^_`acIJKmLMNObno.None '47>KLNpqrstuvwxyz{|} prtuvwxyz{|} pqrstuvwxyz{|}/None %'35>LN~~None4>LP)Represents integers modulo a prime power.Q8An implementation of the integers modulo the prime base.R&The prime and exponent of the modulus.S Lift from Z_p to a representative.PQRSPQRSPQRSPQRSNone!"%&'()3457>IKLN+TConvenient synonym for -able element type.U1Constraints needed for CRT-related operations on V data.V%Represents a cyclotomic ring such as Z[zeta], Zq[zeta], and Q(zeta) in an explicit representation: t is the ' type for storing coefficient tensors; m is the cyclotomic index; rep is the representation ([, Z, or Y); r- is the base ring of the coefficients (e.g., Z, Zq).The , ,  and ? instances all work coefficient-wise (in the specified basis).W1Convenient synonym for either CRT representation.XKNullary index type representing the CRT basis over extension of base ring.Y=Nullary index type representing the CRT basis over base ring.Z3Nullary index type representing the decoding basis.[3Nullary index type representing the powerful basis.\"Embed a scalar from the base ring.]"Embed a scalar from the base ring.^1Type-restricted (and potentially more efficient) $ for powerful-basis representation._1Type-restricted (and potentially more efficient) $ for decoding-basis representation.`Unzip in the powerful basis.aUnzip in the decoding basis.bGUnzip in the CRT basis over the base ring. The output components are &/ because each target base ring may not support Y.cXUnzip in the CRT basis over the extension of the base ring. The output components are &1 because each target base might instead support Y.d Multiply by the special element g.eDivide by the special element g. WARNING: this implementation is not a constant-time algorithm, so information about the argument may be leaked through a timing channel.f!Yield the scaled squared norm of  g_m cdot e* under the canonical embedding, namely, ,hat{m}^{ -1 } cdot || sigma(g_m cdot e) ||^2 .g6Sample from the "tweaked" Gaussian error distribution t*D in the decoding basis, where D has scaled variance v.hGenerate an LWE error term from the "tweaked" Gaussian with given scaled variance, deterministically rounded using the decoding basis. (Note: This implementation uses Double precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.)iMGenerate an LWE error term from the "tweaked" Gaussian with scaled variance v * p^23, deterministically rounded to the given coset of R_p using the decoding basis. (Note: This implementation uses Double precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.)j5Embed into an extension ring, for the powerful basis.k5Embed into an extension ring, for the decoding basis.lEEmbed into an extension ring, for the CRT basis. (The output is an &. because the extension ring might not support Y.)m Similar to l. (The output is an &+ because the extension ring might support Y, in which case we never use X.)n-Twace into a subring, for the powerful basis.o-Twace into a subring, for the decoding basis.p=Twace into a subring, for the CRT basis. (The output is an &' because the subring might not support Y.)q Similar to p. (The output is an &$ because the subring might support Y, in which case we never use X.)r Yield the O_m-coefficients of an O_m'1-element, with respect to the relative powerful O_m-basis.s Yield the O_m-coefficients of an O_m'1 element, with respect to the relative decoding O_m-basis.tThe relative powerful basis of  O_m' / O_m.uThe relative mod-r CRT set of  O_m' / O_mm, represented with respect to the powerful basis (which seems to be the best choice for typical use cases).v)Convert to powerful-basis representation.Convenient version of v for & CRT basis type.w)Convert to decoding-basis representation.x&Convert to a CRT-basis representation.7apply coefficient-wise (with respect to decoding basis)7apply coefficient-wise (with respect to powerful basis)Rp is an F_{p^d} -module when d divides phi(m), by applying d -dimensional Fp-linear transform on d%-dim chunks of powerful basis coeffs'only for appropriate CRT representation3only for appropriate CRT representation (otherwise # would violate internal invariant)PTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwx%TUVWXYZ[\]^_`abcdefghijklmnopqrstuvwx%V[ZYXWUTvwx^_`abc\]defghijklmnopqrstuLTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwx0None%NUsing polar form of Box-Muller transform, returns a pair of centered, Gaussian-distributed real numbers with scaled variance svar = true variance * (2*pi). See < Thttp://www.alpheratz.net/murison/Maple/GaussianDistribution/GaussianDistribution.pdf this link> for details. Generate n0 real, independent gaussians of scaled variance svar = true variance * (2*pi).|Execute an action repeatedly until its result fails to satisfy a predicate, and return that result (discarding all others). Analogue of (12)0 Yields the result of applying f until p holds.3None!"%&(3457>?CIKLN*a DSL for tensor transforms on Repa arrays| identity sentinel&| (function) composition of transforms3Indexed newtype for 1-dimensional Unbox repa arraysAn  filled with the argument.Monadic version of .ZFor a factored index, tensors up any function defined for (and tagged by) any prime powerYFor a prime power p^e, tensors up any function f defined for (and tagged by) a prime to I_(p^{e-1}) otimes f-Returns the (linear) dimension of a transform#smart constructor from a Tensorablecompose transforms!tensor/Kronecker product (otimes)ACreates an evaluatable Haskell function from a tensored transformMonadic version of ~maps the innermost dimension to a 2-dim array with innermost dim d, for performing a I_l otimes f_d otimes I_r transformationinverse of expose6general matrix multiplication along innermost dim of v7multiplication by a diagonal matrix along innermost dimeEmbeds a scalar into a powerful-basis representation of a Repa array, tagged by the cyclotomic index+Forces a delayed array to a manifest array.5Sum the inner-most dimension of an array sequentially.Sum all array indices to a scalar sequentially"                           ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i4None!"&47N j4Embeds a scalar into the CRT basis (when it exists). k Multiply by g_m# in the CRT basis (when it exists). l Divide by g# in the CRT basis (when it exists). mThe coefficient vector of g# in the CRT basis (when it exists). nThe coefficient vector of g^{ -1 }# in the CRT basis (when it exists). oXThe Chinese Remainder Transform. Exists if and only if CRT exists for all prime powers. p`The inverse Chinese Remainder Transform. Exists if and only if CRT exists for all prime powers. j k l q m n o p r s t u v w x y z { | j k l m n o p j k l q m n o p r s t u v w x y z { |5None%&4N }Given v=r^2P, yields the decoding-basis coefficients of a sample from the tweaked Gaussian  t_m cdot D_r. ~The E_m! transformation for an arbitrary m. The E_p transformation for a prime p. Given coefficient tensor e( with respect to the decoding basis of R%, yield the (scaled) squared norm of  g_m cdot e+ under the canonical embedding, namely, /hat{m}^{ -1 } cdot || sigma(g_m -- cdot e) ||^2 .  Multiply by hat{m}- times the Gram matrix of decoding basis of R^vee. GMultiply by (scaled) Gram matrix of decoding basis: (I_{p-1} + all-1s). } ~   }  } ~  6None !"%&47IN Arbitrary-index LQ transform, which converts from decoding-basis to powerful-basis representation. Arbitrary-index L^{ -1 }Q transform, which converts from powerful-basis to decoding-basis representation. "Arbitrary-index multiplication by g_m in the powerful basis. "Arbitrary-index multiplication by g_m in the decoding basis. Arbitrary-index division by g_m! in the powerful basis. Outputs 0* if the input is not evenly divisible by g_m. Warning: not constant time! Arbitrary-index division by g_m! in the decoding basis. Outputs 0) if the input is no evenly divisible by g_m. Warning: not constant time! hThis is not a constant-time algorithm! Depending on its usage, it might provide a timing side-channel.   None&'(3457>FLN y&Error correction relative to a gadget.z4Error-correct a "noisy" encoding of an element (see 7), returning the encoded element and the error vector.{#Decomposition relative to a gadget.|The ring that u decomposes over.}Yield a short vector x such that  <g, x> = u.~Gadget) vectors, parameterized by an index type.The gadget vector over u.Yield an error-tolerant encoding of an element with respect to the gadget. (Mathematically, this should just be the product of the input with the gadget, but it is a class method to allow for optimized implementations.)#Dummy type representing the gadget  [1,b,b^2,...].#Dummy type representing the gadget [1].  Product ring <Product ring: concatenate decompositions for component rings 6Product ring: concatenate gadgets over component rings yz{|}~ yz{|}~ ~{|}yzyz{|}~ None%&'(3457>?CLN The ring Z_q of integers modulo q!, using underlying integer type z. Yield a  principal mth root of unity  omega_m in Z_q^*. The implementation requires q3 to be prime. It works by finding a generator of Z_q^* and raising it to the (q-1)/m4 power. Therefore, outputs for different values of m are consistent, i.e., omega_{m'}^(m'/m) = omega_m@.  The base-b gadget for modulus q$, over integers (not mod anything). SYield the error vector for a noisy multiple of the gadget (all over the integers). Embeds into complex numbers( modulus qbase b input vector v = s cdot g^t + eerror e %   None%&'3457>CLN The ring RR_q of reals modulo q", using underlying floating type r.     7None &'3457>LN DClass to safely match Haskell types with the appropriate C function. Equivalent to Tensors crt. Equivalent to Tensors crtInv. Equivalent to Tensors  tGaussianDec. Equivalent to Tensors l. Equivalent to Tensors lInv. Equivalent to Tensors  gSqNormDec. Equivalent to Tensors mulGPow. Equivalent to Tensors mulGDec. Equivalent to Tensors divGPow. Equivalent to Tensors divGDec. Equivalent to  zipWith (*) Single-argument synonym for  Dispatch'. "C representation of a prime power. >Convert a list of prime powers to a suitable C representation. $Evaluates a C function that takes a a** ptr on a list of Vectors.G              6               8None%&'(47>KLN The multiplicative order of p (the argument) modulo m . Requires  gcd(p,m)=1. Given p', returns a partition of the cosets of Z_{m'}^* / <p>y (specified by representatives), where the cosets in each component are in bijective correspondence with the cosets of  Z_m^* / <p> under the natural (mod m) homomorphism.        9None %&'(47>KLN O(n)5 Yield the vector obtained by replacing each element i of the index vector by xs i. This is equivalent to  (xs ) is# but is often much more efficient. 3backpermute <a,b,c,d> <0,3,2,3,1,0> = <a,d,c,d,b,a> Embeds an vector in the powerful basis of the the mth cyclotomic ring to an vector in the powerful basis of the m'th cyclotomic ring when m | m' Embeds an vector in the decoding basis of the the mth cyclotomic ring to an vector in the decoding basis of the m'th cyclotomic ring when m | m' Embeds an vector in the CRT basis of the the mth cyclotomic ring to an vector in the CRT basis of the m'th cyclotomic ring when m | m' maps a vector in the powerful/decoding basis, representing an O_m' element, to a vector of arrays representing O_m elements in the same type of basis The "tweaked trace" function in either the powerful or decoding basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'. wThe powerful extension basis, wrt the powerful basis. Outputs a list of vectors in O_m' that are an O_m basis for O_m' KA list of vectors representing the mod-p CRT set of the extension O_m'/O_m is index vector (of length n)xs value vector                       None!"%&'()*3457>?CFIKLNAn implementation of  backed by C++ code.  Newtype wrapper around a Vector. Useful coersion for defining coeffs in the Tensor interface. Using  !* alone is insufficient for type inference. "Useful coersion for defining  powBasisPow and  crtSetDec in the Tensor interface. Using  !* alone is insufficient for type inference.5 # $ % &  ' ( ) * + , - . / " 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S1 # $ % &  ' ( ) * + , - . / " 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S:None&'(3457>KLN TThe "tweaked trace" function in either the powerful or decoding basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'. UlThe "tweaked trace" function in the CRT basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'. VEmbeds an array in the powerful basis of the the mth cyclotomic ring to an array in the powerful basis of the m'th cyclotomic ring when m | m' WEmbeds an array in the decoding basis of the the mth cyclotomic ring to an array in the decoding basis of the m'th cyclotomic ring when m | m' XEmbeds an array in the CRT basis of the the mth cyclotomic ring to an array in the CRT basis of the m'th cyclotomic ring when m | m' Ymaps an array in the powerful/decoding basis, representing an O_m' element, to an array of arrays representing O_m elements in the same type of basis ZvThe powerful extension basis, wrt the powerful basis. Outputs a list of arrays in O_m' that are an O_m basis for O_m' [JA list of arrays representing the mod-p CRT set of the extension O_m'/O_m \ ] ^ _ T U V W X Y Z [ ` a b c d e f T U V W X Y Z [ \ ] T U V W X Y Z [ ` a b c d e f _ ^None!"%&'(*3457>?KLNAn implementation of  backed by repa. g h i j k l m n o p q r s t u v w x y z { g h i j k l m n o p q r s t u v w x y z {None!"&'(3457>IKLN+1Constraints needed for most operations involving  data.%Represents a cyclotomic ring such as Z[zeta], Zq[zeta], and Q(zeta) in an explicit representation: t is the ' type for storing coefficient tensors; m is the cyclotomic index; r. is the base ring of the coefficients (e.g., Z, Zq).Wrap a V as a .Wrap a V as a .Wrap a W as a .Wrap a V as a .Wrap a V as a .Convenience wrapper.Convenience wrapper.:Embed a scalar from the base ring as a cyclotomic element. Unwrap a  as a V" in powerful-basis representation. Unwrap a  as a V" in decoding-basis representation. Unwrap a  as a V in a CRT-basis representation.Same as ,, but for the powerful-basis representation.Same as ,, but for the powerful-basis representation.!Yield an equivalent element that mayS be in a CRT representation. This can serve as an optimization hint. E.g., call ; prior to multiplying the same value by many other values. Multiply by the special element g of the mth cyclotomic. Divide by g , returning 0 if not evenly divisible. WARNING: this implementation is not a constant-time algorithm, so information about the argument may be leaked through a timing channel.6Sample from the "tweaked" Gaussian error distribution t*D in the decoding basis, where D has scaled variance v.!Yield the scaled squared norm of  g_m cdot e* under the canonical embedding, namely, ,hat{m}^{ -1 } cdot || sigma(g_m cdot e) ||^2 . Generate an LWE error term with given scaled variance, deterministically rounded with respect to the decoding basis. (Note: This implementation uses Double precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.)6Generate an LWE error term with given scaled variance * p^2 over the given coset, deterministically rounded with respect to the decoding basis. (Note: This implementation uses Double precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.)&Embed (lazily) into an extension ring. |Force to a non- }% constructor (for internal use only).&The "tweaked trace" (twace) function 'Tw(x) = (mhat / m'hat) * Tr(g' / g * x), which fixes R pointwise (i.e., twace . embed == id).Return the given element's coefficient vector with respect to the (relative) powerful/decoding basis of the cyclotomic extension  O_m' / O_m . See also , .Specialized version of  coeffsCyc for powerful basis.Specialized version of  coeffsCyc for decoding basis.The relative powerful basis of  O_m' / O_m.The relative mod-r CRT set of the extension.Lift using the specified basis.Lift using the powerful basis.Lift using the decoding basis.Unzip for a pair base ring. ~?Force to powerful-basis representation (for internal use only). ?Force to decoding-basis representation (for internal use only). 6Force to a CRT representation (for internal use only). Cpromoted from base ring, using the decoding basis for best geometry Cpromoted from base ring, using the powerful basis for best geometry promoted from base ring *specialized instance for product rings of Zqs: ~2x faster algorithm generic instance Rp is an F_{p^d} -module when d divides phi(m), by applying d -dimensional Fp-linear transform on d%-dim chunks of powerful basis coeffs< } | ~  'T'T7 } | ~  None&(*47>?CKLNQA convenient constraint synonym for extending a linear function to larger rings.An E-linear function from R to S. Construct an E8-linear function given a list of its output values (in S$) on the relative decoding basis of R/EM. The number of elements in the list must not exceed the size of the basis.1Evaluates the given linear function on the input. Extend an E-linear function R->S to an E'-linear function R'->S'2. (Mathematically, such extension only requires lcm(r,e') | r' (not equality), but this generality would significantly complicate the implementation, and for our purposes there's no reason to use any larger r'.) 7lifts with respect to powerful basis, for best geometry      None%&47N4Common constraints for working with continuous RLWE.A continuous RLWE sample (a,b) in R_q times K/qR. (The second component is a V because the base type rrq representing RR/qZ, the reals modulo qZI, is an additive group but not a ring, so we can't usefully work with a  over it.)DA continuous RLWE sample with the given scaled variance and secret.=The error term of an RLWE sample, given the purported secret.The fB of the error term of an RLWE sample, given the purported secret.A bound such that the f% of a continuous error generated by g with scaled variance v (over the mTth cyclotomic field) is less than the bound except with probability approximately eps.the scaled variance epsNone%&47N2Common constraints for working with discrete RLWE.A discrete RLWE sample (a,b) in R_q times R_q.BA discrete RLWE sample with the given scaled variance and secret.=The error term of an RLWE sample, given the purported secret.The B of the error term of an RLWE sample, given the purported secret.A bound such that the + of a discretized error term generated by  with scaled variance v (over the mTth cyclotomic field) is less than the bound except with probability approximately eps.the scaled variance eps;None"      !"#$%&'()*+,-. /0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ"#$%&[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'()*+,-./0123456789:;<=>@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijk lmnopqrstuv wxyz{|}~     \ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~Tyz{|}~None&47N)Common constraints for working with RLWR.An RLWR sample (a,b) in R_q times R_p.%An RLWR sample with the given secret.The b( component of an RLWR sample for secret s and given a, produced by rounding a*s in the decoding basis. <=>%?%@%A%B%C%D%E%F%G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&YZ[\]^_`abbcdeffghiighjjcde k k g h l m n o p q r s t uvwxyz{|}~!$$$$$$%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFE&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&Y&Z&[&\&]&^&_&`&a&b&c&d&e&f&g&h&i&j&k&l&m&n&o&p&q&r&s&t&u&v&w&x&y&z&{&|&}&~&&&&&&&&&&&&&&&      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~               !"#$%&'()*+,-./0123456789:;<=>?@AABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~Yode`           " !"#$%<&'<()*+,<-.<-/<01<23<24<&5<&6<&7<(8<9:<9;<9<<9=*>?*>@<&A<&B<&C<&D<&E<FG<9H<9I*>J<&K<&L*>M<NO<PQ*RS*RT*RU*RV*RW*RX*RY<Z[<&\*R]*R^<Z_<Z`*Ra*Rb*Rc<&d<&e<-f<9g<9h<ij<ik<0l<0m<0n<0o<0p<0q<0r<0s<0t<0u<0v<0w<xy<z{<x|<x}<~<~<<<<<<<<<<<<<<<<<<<Z<<<<<N<N<N<N<<9<9<9<9<P<P<P<P<P<P<P<P<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<-<<2<2<&<&2<&<&<&<&<&<&<&<&*>*>*>*>*>*>*>*>d     """"#""c  !"#$%&'()*$+$$,$-$.$/$0$1]^2%3%4%5%6%7%8%9%:%;%<%=%>%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^&_&`&a&&]&b&c&d&e&f&g&h&i&j&k&l&m&n&o&p&q&r&s&t&u&v&&w&x&y&z&{&|&}&~&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& & & & & &&&&&&&&&&&&&&&&&&& &!&"&#&$&%&&&'&(&)&*&+&,&-&.&/&0&1&2&3&4&5&6&7&8&9&:&;&<&=&>&?&@&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&Y&Z&[&\&]&^&_&`&a&b&c&d&e&f&g&h&i&j&k&l&m&n&o&p&q&r&s&t&u&v&w&x&y&z&{&|&}&~&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& & & & & &&&&&&&&&&&&&&&&&&& &!&"&#&$&%&&&'&(&)&*&+&,&-&.&/&0&1&2&3&4&5&6 7 8 9 : ;'<=>?<&@<&A'B'C'D'<'E'F'G<HIJKLMNOPQRSTUVWXYZ[\<]^<]_<]_<]`<]`abcabdabeabfabgabhabiabjabkablabmabnaboabpabqabrabsabtabuabvabwabxabyabz{|}~I..............///g/<<i000033333E33333333333333333 3 3 3 33 3 3 3 3 3 3 3                         ! " # $ % $ & $ ' $ ( $ ) $ * + +6 + , + - + . + / 0 1  2  3  4    5  6  7  /  8  9  :  ;  <  = > ? > @ > A > B > C > D > E F G H I H J H K L M L N L O L P L Q L R L' L S L T U V U W U X U Y Z [ \  ] ^ ] _ ] ` ] a b c b d b e f g f h i j i j i k i k i l i m i n i o i p q r q s q t q u q v q w q w q x q x q y q z q { q | q } q ~       K   J   L   =  4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6                                                         7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 !7 "7 #7 $7 %7 &7 7 '7 (7 )7 *7 +7 ,7 -7 .7 /7 07 17 27 37 47 57 67 77 87 97 :7 ;7 <7 =7 >7 ?7 @7 A7 B7 C7 D7 E7 F7 G7 H7 I7 J7 K7 L7 M7 N7 O7 P7 Q< R S8 T8 U8 V9 W= X 9 Y9 Z9 [9 \9 ]9 ^9 _ ` a*+ b c d e f ` g h i j k l m n o p q r  s t u v w xE y z    { | } ~             : ]: {: Y: Z: [: \: ^: _: : : : :}:~:::::  f   i k l                                            EtXyKMV3mO1EpeLGqdCPI0Crypto.Lol.PreludeCrypto.Lol.PosBinCrypto.Lol.FactoredCrypto.Lol.Types.RandomCrypto.Proto.RLWE.RqCrypto.Proto.RLWE.SampleDiscCrypto.Proto.RLWE.SampleRLWRCrypto.Proto.RLWE.KqCrypto.Proto.RLWE.SampleContCrypto.Proto.RLWECrypto.Lol.Types.ProtoCrypto.Lol.Reflects Crypto.Lol.Cyclotomic.RescaleCycCrypto.Lol.CRTransCrypto.Lol.Types.FiniteFieldCrypto.Lol.Cyclotomic.TensorCrypto.Lol.Types.ZPPCrypto.Lol.Cyclotomic.UCycCrypto.Lol.GadgetCrypto.Lol.Types.ZqBasicCrypto.Lol.Types.RRq$Crypto.Lol.Cyclotomic.Tensor.CTensor'Crypto.Lol.Cyclotomic.Tensor.RepaTensorCrypto.Lol.Cyclotomic.CycCrypto.Lol.Cyclotomic.LinearCrypto.Lol.RLWE.ContinuousCrypto.Lol.RLWE.DiscreteCrypto.Lol.RLWE.RLWRCrypto.Lol.Types.NumericNumericPreludeNumericAlgebra ToRationalAlgebra.IntegralDomaindivModCrypto.Lol.Types.ComplexCrypto.Lol.PosBinDefsCrypto.Lol.FactoredDefsCrypto.Lol.Types.IZipVectorControl.ApplicativeZipListCrypto.Lol.TypesIrreducibleChar2CryptoLol!Crypto.Lol.Cyclotomic.CRTSentinel!Crypto.Lol.Types.IrreducibleChar2Crypto.Lol.GaussRandomPreludeuntil0Crypto.Lol.Cyclotomic.Tensor.RepaTensor.RTCommon+Crypto.Lol.Cyclotomic.Tensor.RepaTensor.CRT+Crypto.Lol.Cyclotomic.Tensor.RepaTensor.Dec*Crypto.Lol.Cyclotomic.Tensor.RepaTensor.GL,Crypto.Lol.Cyclotomic.Tensor.CTensor.BackendCrypto.Lol.Types.ZmStar.Crypto.Lol.Cyclotomic.Tensor.CTensor.Extension1Crypto.Lol.Cyclotomic.Tensor.RepaTensor.Extension Crypto.LolbaseGHC.IntInt64subPosaddPosPosOSBinB1D0D1unFunPPprimePP exponentPPPrimeBin PrimePowerFactoredfMulfPPMul fOddRadicalfDivfDividesfLCMfGCDppToFpToPPpToFpFreeLCDoso4EH8bBMNLXVv1Ts5Data.Constraint\\2MQXkhpWt0ECjykbHZVup7Data.SingletonsSing CryptoRandevalCryptoRandIORqmqxs SampleDiscab SampleRLWRKq SampleCont protoInfofileDescriptorProto Protoable ProtoTypetoProto fromProtomsgPutmsgGet$fProtoable(,) $fProtoable[] PolynomialPID RealIntegralAbsolute ToIntegerOrdFloatRealTranscendentalTranscendental Algebraic RealFieldRealRingFieldIntegralDomainModuleRingAdditive ZeroTestablemaxminabs realToField^modinvdecomp roundMultroundScalarCentered divModCentComplex roundComplexcisrealimagfromRealSPosAddPosSubPos AddPosSym0 AddPosSym1 SubPosSym0 SubPosSym1SSym0SSym1OSym0sSubPossAddPosposToIntBinCPosCSBinD1Sym0D1Sym1D0Sym0D0Sym1B1Sym0binToIntreifyPos reifyPosIreifyBin reifyBinIposTypebinTypeposDecbinDecintDecprimesprimeP16P15P14P13P12P11P10P9P8P7P6P5P4P3P2P1B128B127B126B125B124B123B122B121B120B119B118B117B116B115B114B113B112B111B110B109B108B107B106B105B104B103B102B101B100B99B98B97B96B95B94B93B92B91B90B89B88B87B86B85B84B83B82B81B80B79B78B77B76B75B74B73B72B71B70B69B68B67B66B65B64B63B62B61B60B59B58B57B56B55B54B53B52B51B50B49B48B47B46B45B44B43B42B41B40B39B38B37B36B35B34B33B32B31B30B29B28B27B26B25B24B23B22B21B20B19B18B17B16B15B14B13B12B11B10B9B8B7B6B5B4B3B2 SFactored SPrimePower SPrimeBin ExponentPPPrimePPUnPPUnFsUnFsUnPPFPPMulFMulPToFPToPPPpToFFGCDFLCMFDividesFDiv FOddRadicalsPpToFsPToPPsPToFPPCoprimeDividesFactPPowPrime*/PFree reifyPrime reifyPrimeI reifyPPow reifyPPowI reifyFact reifyFactI transDivides gcdDivides lcmDivides lcm2DividespSplitTheorems pFreeDividesppsFact valueFact totientFact valueHatFact radicalFactoddRadicalFactppPPow primePPow exponentPPow valuePPow totientPPow valuePrimevalueHatppToPPvaluePP totientPP radicalPP oddRadicalPPvaluePPs totientPPs radicalPPs oddRadicalPPspTypeppTypefTypepDecppDecfDecF512F511F510F509F508F507F506F505F504F503F502F501F500F499F498F497F496F495F494F493F492F491F490F489F488F487F486F485F484F483F482F481F480F479F478F477F476F475F474F473F472F471F470F469F468F467F466F465F464F463F462F461F460F459F458F457F456F455F454F453F452F451F450F449F448F447F446F445F444F443F442F441F440F439F438F437F436F435F434F433F432F431F430F429F428F427F426F425F424F423F422F421F420F419F418F417F416F415F414F413F412F411F410F409F408F407F406F405F404F403F402F401F400F399F398F397F396F395F394F393F392F391F390F389F388F387F386F385F384F383F382F381F380F379F378F377F376F375F374F373F372F371F370F369F368F367F366F365F364F363F362F361F360F359F358F357F356F355F354F353F352F351F350F349F348F347F346F345F344F343F342F341F340F339F338F337F336F335F334F333F332F331F330F329F328F327F326F325F324F323F322F321F320F319F318F317F316F315F314F313F312F311F310F309F308F307F306F305F304F303F302F301F300F299F298F297F296F295F294F293F292F291F290F289F288F287F286F285F284F283F282F281F280F279F278F277F276F275F274F273F272F271F270F269F268F267F266F265F264F263F262F261F260F259F258F257F256F255F254F253F252F251F250F249F248F247F246F245F244F243F242F241F240F239F238F237F236F235F234F233F232F231F230F229F228F227F226F225F224F223F222F221F220F219F218F217F216F215F214F213F212F211F210F209F208F207F206F205F204F203F202F201F200F199F198F197F196F195F194F193F192F191F190F189F188F187F186F185F184F183F182F181F180F179F178F177F176F175F174F173F172F171F170F169F168F167F166F165F164F163F162F161F160F159F158F157F156F155F154F153F152F151F150F149F148F147F146F145F144F143F142F141F140F139F138F137F136F135F134F133F132F131F130F129F128F127F126F125F124F123F122F121F120F119F118F117F116F115F114F113F112F111F110F109F108F107F106F105F104F103F102F101F100F99F98F97F96F95F94F93F92F91F90F89F88F87F86F85F84F83F82F81F80F79F78F77F76F75F74F73F72F71F70F69F68F67F66F65F64F63F62F61F60F59F58F57F56F55F54F53F52F51F50F49F48F47F46F45F44F43F42F41F40F39F38F37F36F35F34F33F32F31F30F29F28F27F26F25F24F23F22F21F20F19F18F17F16F15F14F13F12F11F10F9F8F7F6F5F4F3F2F1F2048F1024PP128PP64PP32PP16PP8PP4PP2PP81PP27PP9PP3PP11PP7PP5Prime659Prime653Prime647Prime643Prime641Prime631Prime619Prime617Prime613Prime607Prime601Prime599Prime593Prime587Prime577Prime571Prime569Prime563Prime557Prime547Prime541Prime523Prime521Prime509Prime503Prime499Prime491Prime487Prime479Prime467Prime463Prime461Prime457Prime449Prime443Prime439Prime433Prime431Prime421Prime419Prime409Prime401Prime397Prime389Prime383Prime379Prime373Prime367Prime359Prime353Prime349Prime347Prime337Prime331Prime317Prime313Prime311Prime307Prime293Prime283Prime281Prime277Prime271Prime269Prime263Prime257Prime251Prime241Prime239Prime233Prime229Prime227Prime223Prime211Prime199Prime197Prime193Prime191Prime181Prime179Prime173Prime167Prime163Prime157Prime151Prime149Prime139Prime137Prime131Prime127Prime113Prime109Prime107Prime103Prime101Prime97Prime89Prime83Prime79Prime73Prime71Prime67Prime61Prime59Prime53Prime47Prime43Prime41Prime37Prime31Prime29Prime23Prime19Prime17Prime13Prime11Prime7Prime5Prime3Prime2Reflectsvalue RescaleCyc rescaleCycBasisPowDec rescalePow rescaleDecEncodelsdToMSDRescalerescaleLift'liftLiftOfLiftReducereduceSubgroup fromSubgroupModModRepmodulus EnumerablevaluesCharOfmsdToLSD rescaleMod roundCoset fromJust'pureTpeelTpasteT withWitness withWitnessTCRTEmbedCRTExttoExtfromExtCRTranscrtInfoCRTInfoXIrreduciblePolyirreduciblePoly TensorCoeffsCoeffsunCoeffsGFCtx PrimeFieldGFtoListfromListsizetrace^^MatrixTensorTElt entailIndexT entailEqT entailZTT entailNFDataT entailRandomT entailShowT entailModuleT scalarPowllInvmulGPowmulGDecdivGPowdivGDeccrtFuncs tGaussianDec gSqNormDec twacePowDecembedPowembedDec crtExtFuncscoeffs powBasisPow crtSetDecfmapTfmapTMzipWithTunzipT hasCRTFuncs scalarCRTmulGCRTdivGCRTcrtcrtInvtwaceCRTembedCRTindexMgCRTMgInvCRTMtwCRTsdigitRevzmsToIndexFact indexInfoextIndicesPowDec extIndicesCRTbaseIndicesPowbaseIndicesDecbaseIndicesCRTextIndicesCoeffsZPPZpOf modulusZPPliftZpNFEltUCRTEltUCycUCycECECDPfmapPowfmapDecunzipPowunzipDec unzipCRTC unzipCRTEmulGdivGgSqNorm tGaussian errorRounded errorCoset embedCRTC embedCRTEtwacePowtwaceDec twaceCRTC twaceCRTE coeffsPow coeffsDecpowBasiscrtSettoPowtoDectoCRTCorrectcorrect DecomposeDecompOf decomposeGadgetgadgetencodeBaseBGadTrivGadZqBasicRRqCTRTCEltCyccycPowcycDeccycCRTcycCRTCcycCRTEcycPCcycPE scalarCycuncycPowuncycDecuncycCRT advisePow adviseDec adviseCRTembedtwace coeffsCycliftCycliftPowliftDecunzipCyc ExtendLinIdxLinear linearDecevalLin extendLinRLWECtxSamplesample errorTerm errorGSqNorm errorBoundRLWRCtx roundedProd8SWC0KCQHE4G7v6JHXtV5e Crypto.RandomCryptoRandomGenFDxw8MeZdq3EsvcqVWcvl2 System.Random RandomGen3kdDVz3QA9dFBKBGB3OdeqControl.Monad.RandomRandT$fRandomGenCryptoRand $fTextMsgRq $fTextTypeRq$fReflectDescriptorRq$fGPBRq$fMessageAPImsg'(->)Rq$fWireRq $fDefaultRq $fMergeableRq$fTextMsgSampleDisc$fTextTypeSampleDisc$fReflectDescriptorSampleDisc$fGPBSampleDisc$fMessageAPImsg'(->)SampleDisc$fWireSampleDisc$fDefaultSampleDisc$fMergeableSampleDisc$fTextMsgSampleRLWR$fTextTypeSampleRLWR$fReflectDescriptorSampleRLWR$fGPBSampleRLWR$fMessageAPImsg'(->)SampleRLWR$fWireSampleRLWR$fDefaultSampleRLWR$fMergeableSampleRLWR $fTextMsgKq $fTextTypeKq$fReflectDescriptorKq$fGPBKq$fMessageAPImsg'(->)Kq$fWireKq $fDefaultKq $fMergeableKq$fTextMsgSampleCont$fTextTypeSampleCont$fReflectDescriptorSampleCont$fGPBSampleCont$fMessageAPImsg'(->)SampleCont$fWireSampleCont$fDefaultSampleCont$fMergeableSampleContbytes_6VWy06pWzJq9evDvK2d4w6Data.ByteString.Lazy.Internal ByteString6JehqylTAqt4H6WwLaZ9wxMathObj.PolynomialTAlgebra.PrincipalIdealDomainAlgebra.RealIntegralAlgebra.AbsoluteAlgebra.ToIntegerAlgebra.RealTranscendentalAlgebra.TranscendentalAlgebra.AlgebraicAlgebra.RealFieldAlgebra.RealRing Algebra.FieldAlgebra.ToRationalAlgebra.Module Algebra.RingAlgebra.AdditiveAlgebra.ZeroTestable integer-gmpGHC.Integer.TypeInteger $fNFDataT $fCDoubleGHC.Base++GHC.Errerrorghc-primGHC.PrimseqGHC.Listfilterzip System.IOprint Data.Tuplefstsnd otherwisemap$ undefinedGHC.EnumenumFrom enumFromThen enumFromToenumFromThenTo GHC.Classes==>=fail>>=>>fmapreturnGHC.Real realToFracBoundedEnumEqMonadFunctorOrdGHC.ReadReadGHC.ShowShow GHC.TypesBoolCharDoubleFloatIntOrderingIO Data.EitherEitherStringFalseTrueLeftRightLTEQGTJustNothing takeWhilemaxBoundminBoundData.TraversablesequencemapMreadIOreadLn appendFile writeFilereadFileinteract getContentsgetLinegetCharputStrLnputStrputCharGHC.IO.ExceptionioErrorGHC.IOFilePath userErrorIOError Text.Readreadreads Data.FoldablenotElemallanyorand concatMapconcat sequence_mapM_minimummaximumelemlengthnullfoldl1foldr1foldlfoldreither Data.OldListunwordswordsunlineslineslex readParenreadList readsPrecText.ParserCombinators.ReadPReadSfromEnumtoEnumpredsucc showParen showStringshowCharshowsShowSshowListshow showsPrecunzip3unzipzipWith3zipWithzip3!!lookupreversebreakspansplitAtdroptake dropWhilecycle replicaterepeatiteratescanr1scanrscanl1scanlinitlasttailhead Data.MaybemaybeuncurrycurryasTypeOf$!flip.constid=<<Maybe<$/=compare<=&&||not<>atan2approxRationalroundtruncatefloorceilingfraction splitFraction*>^?atanhacoshasinhtanhcoshsinhatanacosasintancossin**logBaselogexppi^/sqrt fieldPower ringPower fromIntegral toIntegerquotRemremquot toRational fromRational^- fromRational'recip Number.Ratio% denominator numeratorRationalsignumextendedEuclideuclidlcmgcd extendedGCD Algebra.Units stdUnitInvstdUnit stdAssociateisUnitoddevendividesmoddivproduct1productsqr fromIntegeroneisZerosum1sumsubtractnegate-+zeroNumericPrelude.BasecatchFmRMS3RTa3iA2aVFq2IbmcData.Bool.HT.Private ifThenElse $fCComplex3 V_Complex MV_Complex $fEltComplex$fRandomComplex$fNFDataComplexTFCo:R:VectorComplexSingIEquals_1627663467Compare_1627665594Equals_1627670319Case_1627670370Case_1627670383Compare_1627670388Compare_1627665594Sym0#Compare_1627665594Sym0KindInferenceCompare_1627665594Sym1#Compare_1627665594Sym1KindInferenceCompare_1627665594Sym2AddPosSym0KindInferenceAddPosSym1KindInference AddPosSym2SubPosSym0KindInferenceSubPosSym1KindInference SubPosSym2SSym0KindInferenceSOSSTFCo:R:DemoteRepPosKProxyCompare_1627670388Sym0#Compare_1627670388Sym0KindInferenceCompare_1627670388Sym1#Compare_1627670388Sym1KindInferenceCompare_1627670388Sym2!Let1627670375Scrutinee_1627670305%Let1627670375Scrutinee_1627670305Sym02Let1627670375Scrutinee_1627670305Sym0KindInference%Let1627670375Scrutinee_1627670305Sym12Let1627670375Scrutinee_1627670305Sym1KindInference%Let1627670375Scrutinee_1627670305Sym2!Let1627670362Scrutinee_1627670307%Let1627670362Scrutinee_1627670307Sym02Let1627670362Scrutinee_1627670307Sym0KindInference%Let1627670362Scrutinee_1627670307Sym12Let1627670362Scrutinee_1627670307Sym1KindInference%Let1627670362Scrutinee_1627670307Sym2D1Sym0KindInferenceD0Sym0KindInferenceSB1SD0SD1TFCo:R:DemoteRepBinKProxy factorize' factorizeunPFEquals_1627724828Equals_1627724839Equals_1627724850Compare_1627724903ppMulppsMulCase_1627731360 ppsOddRadppsDiv ppsDividesppsLCMppsGCDCase_1627739740Case_1627739860Case_1627739896Case_1627739932Case_1627740029Case_1627740225Case_1627740353Case_1627771204Compare_1627724903Sym0#Compare_1627724903Sym0KindInferenceCompare_1627724903Sym1#Compare_1627724903Sym1KindInferenceCompare_1627724903Sym2UnPUnPSym0UnPSym0KindInferenceUnPSym1ExponentPPSym0ExponentPPSym0KindInferenceExponentPPSym1 PrimePPSym0PrimePPSym0KindInference PrimePPSym1UnPPSym0UnPPSym0KindInferenceUnPPSym1UnFSym0UnFSym0KindInferenceUnFSym1FSym0FSym0KindInferenceFSym1PPSym0PPSym0KindInferencePPSym1PSym0PSym0KindInferencePSym1SFSPPSPsPrimePP sExponentPPsUnPTFCo:R:DemoteRepFactoredKProxyPpsMulPpMul FPPMulSym0FPPMulSym0KindInference FPPMulSym1FPPMulSym1KindInference FPPMulSym2FMulSym0FMulSym0KindInferenceFMulSym1FMulSym1KindInferenceFMulSym2 PpsMulSym0PpsMulSym0KindInference PpsMulSym1PpsMulSym1KindInference PpsMulSym2 PpMulSym0PpMulSym0KindInference PpMulSym1PpMulSym1KindInference PpMulSym2!Let1627731334Scrutinee_1627731241%Let1627731334Scrutinee_1627731241Sym02Let1627731334Scrutinee_1627731241Sym0KindInference%Let1627731334Scrutinee_1627731241Sym12Let1627731334Scrutinee_1627731241Sym1KindInference%Let1627731334Scrutinee_1627731241Sym22Let1627731334Scrutinee_1627731241Sym2KindInference%Let1627731334Scrutinee_1627731241Sym32Let1627731334Scrutinee_1627731241Sym3KindInference%Let1627731334Scrutinee_1627731241Sym42Let1627731334Scrutinee_1627731241Sym4KindInference%Let1627731334Scrutinee_1627731241Sym5Let1627731258PpLet1627731258PpsLet1627731258Pp'Let1627731258PpSym0 Let1627731258PpSym0KindInferenceLet1627731258PpSym1 Let1627731258PpSym1KindInferenceLet1627731258PpSym2 Let1627731258PpSym2KindInferenceLet1627731258PpSym3 Let1627731258PpSym3KindInferenceLet1627731258PpSym4 Let1627731258PpSym4KindInferenceLet1627731258PpSym5Let1627731258PpsSym0!Let1627731258PpsSym0KindInferenceLet1627731258PpsSym1!Let1627731258PpsSym1KindInferenceLet1627731258PpsSym2!Let1627731258PpsSym2KindInferenceLet1627731258PpsSym3!Let1627731258PpsSym3KindInferenceLet1627731258PpsSym4!Let1627731258PpsSym4KindInferenceLet1627731258PpsSym5Let1627731258Pp'Sym0!Let1627731258Pp'Sym0KindInferenceLet1627731258Pp'Sym1!Let1627731258Pp'Sym1KindInferenceLet1627731258Pp'Sym2!Let1627731258Pp'Sym2KindInferenceLet1627731258Pp'Sym3!Let1627731258Pp'Sym3KindInferenceLet1627731258Pp'Sym4!Let1627731258Pp'Sym4KindInferenceLet1627731258Pp'Sym5sPpMulsPpsMulsFMulsFPPMul&TFCo:R:Apply(->)PrimePowerFPPMulSym0l0PpsGCDPpsLCM PpsDividesPpsDiv PpsOddRadPToFSym0PToFSym0KindInferencePToFSym1 PToPPSym0PToPPSym0KindInference PToPPSym1 PpToFSym0PpToFSym0KindInference PpToFSym1FGCDSym0FGCDSym0KindInferenceFGCDSym1FGCDSym1KindInferenceFGCDSym2FLCMSym0FLCMSym0KindInferenceFLCMSym1FLCMSym1KindInferenceFLCMSym2 FDividesSym0FDividesSym0KindInference FDividesSym1FDividesSym1KindInference FDividesSym2FDivSym0FDivSym0KindInferenceFDivSym1FDivSym1KindInferenceFDivSym2FOddRadicalSym0FOddRadicalSym0KindInferenceFOddRadicalSym1 PpsGCDSym0PpsGCDSym0KindInference PpsGCDSym1PpsGCDSym1KindInference PpsGCDSym2 PpsLCMSym0PpsLCMSym0KindInference PpsLCMSym1PpsLCMSym1KindInference PpsLCMSym2PpsDividesSym0PpsDividesSym0KindInferencePpsDividesSym1PpsDividesSym1KindInferencePpsDividesSym2 PpsDivSym0PpsDivSym0KindInference PpsDivSym1PpsDivSym1KindInference PpsDivSym2 PpsOddRadSym0PpsOddRadSym0KindInference PpsOddRadSym1!Let1627740319Scrutinee_1627739700%Let1627740319Scrutinee_1627739700Sym02Let1627740319Scrutinee_1627739700Sym0KindInference%Let1627740319Scrutinee_1627739700Sym12Let1627740319Scrutinee_1627739700Sym1KindInference%Let1627740319Scrutinee_1627739700Sym22Let1627740319Scrutinee_1627739700Sym2KindInference%Let1627740319Scrutinee_1627739700Sym32Let1627740319Scrutinee_1627739700Sym3KindInference%Let1627740319Scrutinee_1627739700Sym42Let1627740319Scrutinee_1627739700Sym4KindInference%Let1627740319Scrutinee_1627739700Sym52Let1627740319Scrutinee_1627739700Sym5KindInference%Let1627740319Scrutinee_1627739700Sym6Let1627740252YsLet1627740252XsLet1627740252YsSym0 Let1627740252YsSym0KindInferenceLet1627740252YsSym1 Let1627740252YsSym1KindInferenceLet1627740252YsSym2 Let1627740252YsSym2KindInferenceLet1627740252YsSym3 Let1627740252YsSym3KindInferenceLet1627740252YsSym4 Let1627740252YsSym4KindInferenceLet1627740252YsSym5 Let1627740252YsSym5KindInferenceLet1627740252YsSym6Let1627740252XsSym0 Let1627740252XsSym0KindInferenceLet1627740252XsSym1 Let1627740252XsSym1KindInferenceLet1627740252XsSym2 Let1627740252XsSym2KindInferenceLet1627740252XsSym3 Let1627740252XsSym3KindInferenceLet1627740252XsSym4 Let1627740252XsSym4KindInferenceLet1627740252XsSym5 Let1627740252XsSym5KindInferenceLet1627740252XsSym6!Let1627740191Scrutinee_1627739702%Let1627740191Scrutinee_1627739702Sym02Let1627740191Scrutinee_1627739702Sym0KindInference%Let1627740191Scrutinee_1627739702Sym12Let1627740191Scrutinee_1627739702Sym1KindInference%Let1627740191Scrutinee_1627739702Sym22Let1627740191Scrutinee_1627739702Sym2KindInference%Let1627740191Scrutinee_1627739702Sym32Let1627740191Scrutinee_1627739702Sym3KindInference%Let1627740191Scrutinee_1627739702Sym42Let1627740191Scrutinee_1627739702Sym4KindInference%Let1627740191Scrutinee_1627739702Sym52Let1627740191Scrutinee_1627739702Sym5KindInference%Let1627740191Scrutinee_1627739702Sym6Let1627740058Pp'Let1627740058YsLet1627740058PpLet1627740058XsLet1627740058Pp'Sym0!Let1627740058Pp'Sym0KindInferenceLet1627740058Pp'Sym1!Let1627740058Pp'Sym1KindInferenceLet1627740058Pp'Sym2!Let1627740058Pp'Sym2KindInferenceLet1627740058Pp'Sym3!Let1627740058Pp'Sym3KindInferenceLet1627740058Pp'Sym4!Let1627740058Pp'Sym4KindInferenceLet1627740058Pp'Sym5!Let1627740058Pp'Sym5KindInferenceLet1627740058Pp'Sym6Let1627740058YsSym0 Let1627740058YsSym0KindInferenceLet1627740058YsSym1 Let1627740058YsSym1KindInferenceLet1627740058YsSym2 Let1627740058YsSym2KindInferenceLet1627740058YsSym3 Let1627740058YsSym3KindInferenceLet1627740058YsSym4 Let1627740058YsSym4KindInferenceLet1627740058YsSym5 Let1627740058YsSym5KindInferenceLet1627740058YsSym6Let1627740058PpSym0 Let1627740058PpSym0KindInferenceLet1627740058PpSym1 Let1627740058PpSym1KindInferenceLet1627740058PpSym2 Let1627740058PpSym2KindInferenceLet1627740058PpSym3 Let1627740058PpSym3KindInferenceLet1627740058PpSym4 Let1627740058PpSym4KindInferenceLet1627740058PpSym5 Let1627740058PpSym5KindInferenceLet1627740058PpSym6Let1627740058XsSym0 Let1627740058XsSym0KindInferenceLet1627740058XsSym1 Let1627740058XsSym1KindInferenceLet1627740058XsSym2 Let1627740058XsSym2KindInferenceLet1627740058XsSym3 Let1627740058XsSym3KindInferenceLet1627740058XsSym4 Let1627740058XsSym4KindInferenceLet1627740058XsSym5 Let1627740058XsSym5KindInferenceLet1627740058XsSym6Let1627740044XsLet1627740044XsSym0 Let1627740044XsSym0KindInferenceLet1627740044XsSym1 Let1627740044XsSym1KindInferenceLet1627740044XsSym2!Let1627739995Scrutinee_1627739708%Let1627739995Scrutinee_1627739708Sym02Let1627739995Scrutinee_1627739708Sym0KindInference%Let1627739995Scrutinee_1627739708Sym12Let1627739995Scrutinee_1627739708Sym1KindInference%Let1627739995Scrutinee_1627739708Sym22Let1627739995Scrutinee_1627739708Sym2KindInference%Let1627739995Scrutinee_1627739708Sym32Let1627739995Scrutinee_1627739708Sym3KindInference%Let1627739995Scrutinee_1627739708Sym42Let1627739995Scrutinee_1627739708Sym4KindInference%Let1627739995Scrutinee_1627739708Sym52Let1627739995Scrutinee_1627739708Sym5KindInference%Let1627739995Scrutinee_1627739708Sym6Let1627739961XsLet1627739961XsSym0 Let1627739961XsSym0KindInferenceLet1627739961XsSym1 Let1627739961XsSym1KindInferenceLet1627739961XsSym2 Let1627739961XsSym2KindInferenceLet1627739961XsSym3 Let1627739961XsSym3KindInferenceLet1627739961XsSym4 Let1627739961XsSym4KindInferenceLet1627739961XsSym5 Let1627739961XsSym5KindInferenceLet1627739961XsSym6!Let1627739898Scrutinee_1627739714%Let1627739898Scrutinee_1627739714Sym02Let1627739898Scrutinee_1627739714Sym0KindInference%Let1627739898Scrutinee_1627739714Sym12Let1627739898Scrutinee_1627739714Sym1KindInference%Let1627739898Scrutinee_1627739714Sym22Let1627739898Scrutinee_1627739714Sym2KindInference%Let1627739898Scrutinee_1627739714Sym32Let1627739898Scrutinee_1627739714Sym3KindInference%Let1627739898Scrutinee_1627739714Sym42Let1627739898Scrutinee_1627739714Sym4KindInference%Let1627739898Scrutinee_1627739714Sym52Let1627739898Scrutinee_1627739714Sym5KindInference%Let1627739898Scrutinee_1627739714Sym6!Let1627739862Scrutinee_1627739712%Let1627739862Scrutinee_1627739712Sym02Let1627739862Scrutinee_1627739712Sym0KindInference%Let1627739862Scrutinee_1627739712Sym12Let1627739862Scrutinee_1627739712Sym1KindInference%Let1627739862Scrutinee_1627739712Sym22Let1627739862Scrutinee_1627739712Sym2KindInference%Let1627739862Scrutinee_1627739712Sym32Let1627739862Scrutinee_1627739712Sym3KindInference%Let1627739862Scrutinee_1627739712Sym42Let1627739862Scrutinee_1627739712Sym4KindInference%Let1627739862Scrutinee_1627739712Sym52Let1627739862Scrutinee_1627739712Sym5KindInference%Let1627739862Scrutinee_1627739712Sym6!Let1627739826Scrutinee_1627739710%Let1627739826Scrutinee_1627739710Sym02Let1627739826Scrutinee_1627739710Sym0KindInference%Let1627739826Scrutinee_1627739710Sym12Let1627739826Scrutinee_1627739710Sym1KindInference%Let1627739826Scrutinee_1627739710Sym22Let1627739826Scrutinee_1627739710Sym2KindInference%Let1627739826Scrutinee_1627739710Sym32Let1627739826Scrutinee_1627739710Sym3KindInference%Let1627739826Scrutinee_1627739710Sym42Let1627739826Scrutinee_1627739710Sym4KindInference%Let1627739826Scrutinee_1627739710Sym52Let1627739826Scrutinee_1627739710Sym5KindInference%Let1627739826Scrutinee_1627739710Sym6Let1627739759YsLet1627739759PpLet1627739759YsSym0 Let1627739759YsSym0KindInferenceLet1627739759YsSym1 Let1627739759YsSym1KindInferenceLet1627739759YsSym2 Let1627739759YsSym2KindInferenceLet1627739759YsSym3 Let1627739759YsSym3KindInferenceLet1627739759YsSym4 Let1627739759YsSym4KindInferenceLet1627739759YsSym5 Let1627739759YsSym5KindInferenceLet1627739759YsSym6Let1627739759PpSym0 Let1627739759PpSym0KindInferenceLet1627739759PpSym1 Let1627739759PpSym1KindInferenceLet1627739759PpSym2 Let1627739759PpSym2KindInferenceLet1627739759PpSym3 Let1627739759PpSym3KindInferenceLet1627739759PpSym4 Let1627739759PpSym4KindInferenceLet1627739759PpSym5 Let1627739759PpSym5KindInferenceLet1627739759PpSym6!Let1627739727Scrutinee_1627739716%Let1627739727Scrutinee_1627739716Sym02Let1627739727Scrutinee_1627739716Sym0KindInference%Let1627739727Scrutinee_1627739716Sym12Let1627739727Scrutinee_1627739716Sym1KindInference%Let1627739727Scrutinee_1627739716Sym22Let1627739727Scrutinee_1627739716Sym2KindInference%Let1627739727Scrutinee_1627739716Sym3 sPpsOddRadsPpsDiv sPpsDividessPpsLCMsPpsGCD sFOddRadicalsFDiv sFDividessFLCMsFGCD&TFCo:R:ApplyFactoredPrimeBinPToFSym0l0 PFreeSym0PFreeSym0KindInference PFreeSym1PFreeSym1KindInference PFreeSym2Let1627771135GoLet1627771135GoSym0 Let1627771135GoSym0KindInferenceLet1627771135GoSym1 Let1627771135GoSym1KindInferenceLet1627771135GoSym2 Let1627771135GoSym2KindInferenceLet1627771135GoSym3!Let1627771178Scrutinee_1627771120%Let1627771178Scrutinee_1627771120Sym02Let1627771178Scrutinee_1627771120Sym0KindInference%Let1627771178Scrutinee_1627771120Sym12Let1627771178Scrutinee_1627771120Sym1KindInference%Let1627771178Scrutinee_1627771120Sym22Let1627771178Scrutinee_1627771120Sym2KindInference%Let1627771178Scrutinee_1627771120Sym32Let1627771178Scrutinee_1627771120Sym3KindInference%Let1627771178Scrutinee_1627771120Sym42Let1627771178Scrutinee_1627771120Sym4KindInference%Let1627771178Scrutinee_1627771120Sym5Let1627771152PpLet1627771152PpSym0 Let1627771152PpSym0KindInferenceLet1627771152PpSym1 Let1627771152PpSym1KindInferenceLet1627771152PpSym2 Let1627771152PpSym2KindInferenceLet1627771152PpSym3 Let1627771152PpSym3KindInferenceLet1627771152PpSym4 Let1627771152PpSym4KindInferenceLet1627771152PpSym5sPFree coerceFDivs coerceGCD#TFCo:R:Apply(->)PrimeBinPFreeSym0l0 $fReflects*qr$fReflectsFactoredmi$fReflectsPrimePowerppi$fReflectsPrimeBinpi$fReflectsNatai IZipVectorL9gd3eHjwn82NRtvEp9glS Data.VectorVector Applicativepure unIZipVector iZipVectorunzipIZVrepl $fCVector$fApplicativeIZipVectorfromJust $fEncodes(,) $fRescaleb(,) $fRescalea(,) $fRescale(,)a $fRescale(,)c$fRescale(,)a0 $fRescale(,)b $fReducea(,)$fMod(,)$fC(,)$fC(,)0$fC(,)1 $fLift'(,) $fNFDataProxyV_MaybeMV_Maybe $fRandom(,)TFCo:R:LiftOf(,) $fDefaultBoolTFCo:R:VectorMaybe Data.Proxy asProxyTypeOfProxyKProxy8Ol3xvIR4LtI7rqC5HgEQ1Data.Functor.Trans.TaggedwitnessTtagTWith untagTSelftagTSelfunproxyTproxyTasTaggedTypeOf reflectedM reflected mapTaggedTretagtagTwitnesstagWith untagSelftagSelfunproxyproxyuntagtagTaggeduntagTTagTTaggedT$fCRTEmbedInteger$fCRTEmbedInt64 $fCRTEmbedInt$fCRTEmbedDouble$fCRTransMaybeInteger$fCRTransMaybeInt64$fCRTransMaybeInt$fCRTransMaybeDouble$fCRTEmbedComplex$fCRTransmonComplex $fCRTEmbed(,)$fCRTransmon(,)crtInfoC omegaPowC powTraceschunksOfsizePP isPrimitivedotptrace'$fCGFTensorCoeffs$fCRTransMaybeGF$fCGF$fCGF0$fEnumerableGFppMatrix twCRTsPPow gCRTPrime gInvCRTPrime indexToPow indexToZms zmsToIndex zmsToIndexPP toIndexPair baseIndexDec fromIndexPairMNilMKronMatrixCMCfMatrixgCRTPPow gInvCRTPPowindexToPowPPowindexToZmsPPow baseWrappermergePPstotients ESentinel CSentinel crtSentinel crtCSentinel crtESentinel scalarCRTCScrtCScrtInvCS mulGCRTCS divGCRTCS embedCRTCS twaceCRTCSpolyMap coeffsToPoly$fIrreduciblePolyadeeps_6vMKxt5sPFR0XsbRWvvq59Control.DeepSeqdeepseqFoldable TraversabletoPowCE $fFunctorUCyc$fFunctorUCyc0 $fCGFUCyc $fCEither $fCEither0CRTCCRTE$fProtoableUCyc $fNFDataUCyc$fArbitraryUCyc$fArbitraryUCyc0$fRandomEither $fRandomUCyc $fRandomUCyc0$fTraversableUCyc$fTraversableUCyc0$fFoldableUCyc$fFoldableUCyc0$fFoldableUCyc1$fApplicativeUCyc$fApplicativeUCyc0$fRescaleUCycUCyc$fRescaleUCycUCyc0 $fLift'UCyc $fLift'UCyc0TFCo:R:LiftOfUCycTFCo:R:LiftOfUCyc0$fReduceUCycUCyc$fReduceUCycUCyc0 $fCrEither$fCrUCyc $fCrUCyc0$fCUCyc$fCUCyc0$fCUCyc1$fCUCyc2$fCUCyc3$fEqUCyc $fEqUCyc0 $fEqUCyc1 realGaussian realGaussians iterateWhile iterateUntilMTransIdTSnocArrreplMfTensorppTensordimtrans.*@*evalevalMexposeunexposemulMatmulDiag scalarPow'forcesumSsumAllSTransC TensorabledimCevalC$fArbitraryArr $fRandomArr $fNFDataArray$fCArr$fCArr0$fCArr1FhM6xMmDQye5PUaGdhV0i3Data.Array.Repa.Repr.VectorAVectorData.Array.Repa.Repr.CursoredcursoredExtent ACursored loadCursor shiftCursor makeCursorData.Array.Repa.Repr.Undefined AUndefinedData.Array.Repa.Repr.UnboxedAUnboxed Data.Array.Repa.Repr.PartitionedAPart#Data.Array.Repa.Repr.HintInterleave AInterleaveData.Array.Repa.Repr.ForeignPtr AForeignPtrData.Array.Repa.Repr.ByteString AByteStringData.Array.Repa.Repr.DelayedADelayedData.Array.Repa.Repr.HintSmallASmall#Data.Array.Repa.Operators.ReductionequalsSequalsPfoldAllPfoldAllSfoldPfoldS!Data.Array.Repa.Operators.MappingszipWithsmapTR Structured#Data.Array.Repa.Operators.SelectionselectPunzip6unzip5unzip4zip6zip5zip4 toUnboxed fromUnboxedfromListUnboxedcomputeUnboxedPcomputeUnboxedSUData.Array.Repa.EvalnowsuspendedCopyPcopyScopyPsuspendedComputePcomputeScomputeP Data.Array.Repa.Eval.InterleavedfillInterleavedP$Data.Array.Repa.Operators.Interleave interleave4 interleave3 interleave2$Data.Array.Repa.Operators.IndexSpacesliceextendbackpermuteDft backpermuteextract transposeappendreshape#Data.Array.Repa.Operators.Traversal traverse4 traverse3 traverse2traversedelay toFunction fromFunctionData.Array.Repa.Eval.ChunkedfillChunkedIOP fillChunkedP fillBlock2S fillLinearSData.Array.Repa.Eval.CursoredfillCursoredBlock2SfillCursoredBlock2P fillBlock2PData.Array.Repa.Eval.SelectionselectChunkedPselectChunkedSData.Array.Repa.SliceAllAny FullShape SliceShape fullOfSlice sliceOfFullSliceData.Array.Repa.Indexix5ix4ix3ix2ix1Z:.DIM0DIM1DIM2DIM3DIM4DIM5Data.Array.Repa.Eval.LoadloadPloadSLoad loadRangeP loadRangeS LoadRangeData.Array.Repa.Eval.Target touchMVec deepSeqMVecunsafeFreezeMVecunsafeWriteMVecnewMVecMVecTargetData.Array.Repa.Base deepSeqArrays! deepSeqArrayunsafeLinearIndex linearIndex unsafeIndexindexextentArraySourceData.Array.Repa.Shape showShapeinShapedeepSeq shapeOfList listOfShape inShapeRange fromIndextoIndex sizeIsValidaddDim intersectDimunitDimzeroDimrankShapeData.Array.Repa.Eval.ElttouchEltData.Vector.Unboxed.BaseUnbox scalarCRT'mulGCRT'divGCRT'gCRTgInvCRTfCRTfCRTInv wrapVectorppDFT ppDFTInv'ppCRT ppCRTInv' butterflypDFTpDFTInv'pCRTpCRTInv'ppTwid ppTwidHat tGaussianDec'fEpE gSqNormDec' fGramDec'pGramDecfLfLInvfGPowfGDecfGInvPowfGInvDecdivCheck wrapGInv'pWrappLpLInvpGPowpGDec pGInvPow' pGInvDec'$fCorrectkgad(,)$fDecomposekgad(,)$fGadgetkgad(,)principalRootUnitygadgetZcorrectZ$fCRTEmbedZqBasicZqB V_ZqBasic MV_ZqBasicreduce'decode'mhatInvgadlen$fVectorVectorZqBasic$fMVectorMVectorZqBasic$fUnboxZqBasicTFCo:R:VectorZqBasicTFCo:R:MVectorsZqBasic$fArbitraryZqBasic$fRandomZqBasic$fCorrect*BaseBGadZqBasic$fDecompose*BaseBGadZqBasic$fGadget*BaseBGadZqBasic$fCorrect*TrivGadZqBasic$fDecompose*TrivGadZqBasic$fGadget*TrivGadZqBasic $fCZqBasic $fCZqBasic0 $fCZqBasic1 $fCZqBasic2$fCRTransMaybeZqBasic$fEncodeZqBasicZqBasic$fRescaleZqBasicZqBasic$fLift'ZqBasicTFCo:R:LiftOfZqBasic$fReduceIntegerZqBasic$fReducezZqBasic $fZPPZqBasicTFCo:R:CharOfkZqBasic $fModZqBasic$fEnumerableZqBasicV_RRqMV_RRq$fVectorVectorRRq$fMVectorMVectorRRq $fUnboxRRqTFCo:R:VectorRRqTFCo:R:MVectorsRRq$fSubgroupZqBasicRRq$fCRRq $fLift'RRqTFCo:R:LiftOfRRq $fReducerRRq Dispatch'dcrtdcrtinv dgaussdecdldlinvdnormdmulgpowdmulgdecdginvpowdginvdecdmulDispatchCPPmarshalFactors withPtrArrayTuple numComponentsZqTupleModPairs getModuliCTypeOfRRqDInt64DDoubleDComplexDZqB64Dp'e'mulCmulRqtensorGaussianDec tensorCRTInvCtensorCRTInvRq tensorCRTC tensorCRTRqtensorGInvDecRqtensorGInvDecRtensorGInvPowCtensorGInvPowRqtensorGInvPowR tensorGDecRq tensorGDecR tensorGPowC tensorGPowRq tensorGPowR tensorNormSqD tensorNormSqR tensorLInvCtensorLCtensorLInvDouble tensorLDouble tensorLInvRq tensorLRq tensorLInvRtensorLRstore$fDispatch'Int64Dr$fDispatch'DoubleDr$fDispatch'ComplexDr$fDispatch'ZqB64Dr$fDispatch'RRqDr $fTuple*(,) $fTupleka $fZqTuple*(,) $fZqTuple*RRq$fZqTuple*ZqBasic $fStorable(,) $fShowCPP $fStorableCPPForeign.Marshal.Array withArrayorderpartitionCosetscosets backpermute'Data.Vector.Generic embedPow' embedDec' embedCRT'coeffs' twacePowDec' powBasisPow' crtSetDec'CT' coerceCoeffscoerce coerceBasisEmTwZVunCTtoCTtoZVzvToCT'wrapwrapMcoerceTwcoerceEmmulGPow'divGPow' withBasicArgs basicDispatchctCRTctCRTInvcheckDiv divIfDivis cZipDispatchcDispatchGaussianruruInv twaceCRT' $fNFDataCT $fRandomCT $fRandomCT' $fArbitraryCT$fArbitraryCT' $fTensorCT$fTraversableCT $fFoldableCT$fApplicativeCT $fFunctorCT$fCGFCT$fCCT$fCCT0 $fProtoableCT$fProtoableCT0$fEqCT $fDefault:. $fDefaultZV_DIM1MV_DIM1TFCo:R:Vector:.zvToArrtoRT $fNFDataRT $fArbitraryRT $fRandomRT$fCGFRT$fCRT$fCRT0$fTraversableRT $fFoldableRT$fApplicativeRT $fFunctorRT $fTensorRT$fEqRT $fProtoableRT$fProtoableRT0embed'SubtoPow'toDec'toCRT'$fCorrectkgadCyc$fDecomposekgadCyc$fGadgetkgadCyc$fRescaleCycCyc(,)b$fRescaleCycCycab$fCGFCycCRTScalartoZLfromZL$fProtoableCyc$fArbitraryCyc $fRandomCyc $fNFDataCycTFCo:R:LiftOfCyc$fReduceCycCyc$fCCyc$fCCyc0$fEqCyc$fCCyc1 $fLift'LinearRDTFCo:R:LiftOfLinear$fReduceLinearLinear $fCLinear