[      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'( ) * + , - . / 0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !" # $ % & ' ( ) * + , -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~                 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.None%&)*+,-DORT* Convert a  to an integral type.+Kind-restricted synonym for .,Kind-restricted synonym for .3 Convert a  to an integral type.4Reify a  as a singleton.5Reify a  for a  constraint.6Reify a  as a singleton.7Reify a  for a  constraint.8 Template Haskell splice for the  type representing a given , e.g.,  $(posType 8).9 Template Haskell splice for the  type representing a given , e.g.,  $(binType 89).:)Template Haskell splice that defines the  type synonym Pn.;)Template Haskell splice that defines the  type synonym Bn.<6Template Haskell splice that declares a type synonym <pfx>n as the type f n.=;Infinite list of primes, built using Sieve of Erastothenes.>Search for the argument in =. This is not particularly fast, but works well enough for moderate-sized numbers that would appear as (divisors of) cyclotomic indices of interest.V  !"#$%&'()*+,-./0123456789:;< pfx f n=>0  !"#$%&'()*+,-./0123456789:;<=>=  !"#$%&'()*+,-./0123456789:;<=>None,?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~None059;<=  None059;<=  None059;<=  None059;<=            None059;<=    None059;<=&'&'&'&' None +9:;DRT(KConversion between Haskell types and their protocol buffer representations.)The protocol buffer type for a.*:Convert from a type to its protocol buffer representation.+.Convert from a protocol buffer representation.,0Serialize a Haskell type to its protocol buffer .-Read a protocol buffer  to a Haskell type.()*+,-./()*+,-()*+/.,-()*+,-./None%&)*,9;<=QRT0Sane synonym for .1Sane synonym for .2Sane synonym for .3Sane synonym for .4Sane synonym for .5Sane synonym for .6Convenient synonym for ( a, 8 a)7Sane synonym for .8Sane synonym for .9Sane synonym for .:Sane synonym for .;Sane synonym for .<Sane synonym for .=Sane synonym for .>Sane synonym for .?Sane synonym for .@Sane synonym for .ASane synonym for .BSane synonym for .CThe Prelude definition of .DThe Prelude definition of .EThe sane definition of  from  ! rather than the default from NumericPrelude.FThe hidden NP function from Algebra.ToRational.GBOur custom exponentiation, overriding NP's version that requires  exponent. Copied from Jhttp://hackage.haskell.org/package/base-4.7.0.0/docs/src/GHC-Real.html#%5EH Inverse of a modulo q , in range [0,q-1]'. (Argument order is infix-friendly.)IXDecompose an element into a list of "centered" digits with respect to relative radices.J3Deterministically round to the nearest multiple of  i .K<Randomly round to the nearest larger or smaller multiple of  i 1, where the round-off term has expectation zero.L Variant of "#) in which the remainder is in the range  [-b/2,b/2).0123456789:;<=>?@ABCDEFGHIJKL dividend adivisor b(quotient, remainder)       !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~0123456789:;<=>?@ABCDEFGHIJKL0123456789:;<=>?@ABCDEFGHIJKL$None),/59:;<=DIRTM9Newtype wrapper (with slightly different instances) for Number.Complex.N@Rounds the real and imaginary components to the nearest integer.OO t/ is a complex value with magnitude 1 and phase t \bmod 2\cdot\pi).P#Real component of a complex number.Q(Imaginary component of a complex number.R:Embeds a scalar as the real component of a complex number.Custom instance replacing the one provided by numeric prelude: it always returns 0 as the remainder of a division. (The NP instance sometimes has precision issues, because it yields nonzero remainders, which is a problem for divG methods.)MNOPQRMNOPQR MNOPQR%None%&*+,-DOQRT2iType synonym for (prime, exponent) pair.j&Constraint synonym for coprimality of  types.k'Constraint synonym for divisibility of  types.lKind-restricted synonym for .mKind-restricted synonym for .nKind-restricted synonym for .o,Type (family) synonym for multiplication of  types.p&Type (family) synonym for division of  types.rReify a  as a singleton.sReify a  for a n constraint.tReify a  as a singleton.uReify a  for a m constraint.vReify a  as a singleton.wReify a  for a l constraint.x:Entails constraint for transitivity of division, i.e. if  k \mid l  and  l \mid m , then  k \mid m .y(Entailment for divisibility by GCD: if  g=\gcd(m_1,m_2)  then  g \mid m_1  and  g \mid m_2 .z%Entailment for LCM divisibility: if  l=\lcm(m_1,m_2)  then  m_1 \mid l  and  m_2 \mid l .{=Entailment for LCM divisibility: the LCM of two divisors of  m  also divides  m .|Entailment for  p -free division: if  f  is m  after removing all  p -factors, then  f \mid m  and  \gcd(f,p)=1 .}Entailment for  p -free division: if  m \mid m' , then ) \text{p-free}(m) \mid \text{p-free}(m') .~2Value-level prime-power factorization tagged by a  type.The value of a  type.The totient of a  type's value.The "hat" of a  type's value: _ \hat{m} = \begin{cases} m & \mbox{if } m \text{ is odd} \\ m/2 & \text{otherwise} \end{cases} .-The radical (product of prime divisors) of a  type.5The odd radical (product of odd prime divisors) of a  type. Reflect a  type to a i value.!Reflect the prime component of a  type.$Reflect the exponent component of a  type.The value of a  type.The totient of a  type's value.The value of a  type.Return  m  if  m  is odd, and  m/2  otherwise. Conversion.The value of a prime power.Totient of a prime power.The radical of a prime power.!The odd radical of a prime power. Product of values of individual is"Product of totients of individual is"Product of radicals of individual is&Product of odd radicals of individual is Template Haskell splice for the ? type corresponding to a given positive prime integer. (Uses > to enforce primality of the base, so should only be used on small-to-moderate-sized arguments.) This is the preferred (and only) way of constructing a concrete ! type (and is used to define the Primep type synonyms). Template Haskell splice for the  type corresponding to a given i . (Calls  on the first component of its argument, so should only be used on small-to-moderate-sized numbers.) This is the preferred (and only) way of constructing a concrete  type. Template Haskell splice for the u type corresponding to a given positive integer. Factors its argument using a naive trial-division algorithm with =o, so should only be used on small-to-moderate-sized arguments (any reasonable cyclotomic index should be OK).)Template Haskell splice that defines the  type synonym Primep for a positive prime integer  p .)Template Haskell splice that defines the  type synonym PPn, where  n=p^e .)Template Haskell splice that defines the  type synonym Fn for a positive integer n.Factorize a positive integer into an ordered list of its prime divisors, with possible duplicates. First argument is infinite list of primes left to consider.kFactorize a positive integer into a list of (prime,exponent) pairs, in strictly increasing order by prime.4      STUVWXY !"#$%&'()*+,-./01234567Z[89:;\]<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~^_`abcde      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~fghijklmnopqrstuvwxyz{|}~  6 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~STUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      STUVWXY !"#$%&'()*+,-./01234Z[89:;765\]<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~^_`abcde      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~fghijklmnopqrstuvwxyz{|}~None,L      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !  6 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~STUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !vwSltuTmrsUng_f`h^ ZY [X W V\]ockdpabjeq~xyz{|}i,*)( 458:'%&!"#$ -+6739;201./<=>NMLKJIHGFEDCBA@?~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPO~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!      ~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!      !            !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      ! None +,9:;<=DT"Reflection without fundep, and with tagged value. Intended only for low-level code; build specialized wrappers around it for specific functionality.#)Reflect the value assiated with the type a."#$%&'("#"#"#$%&'(&None*,234:<=DEIRT/Indexed Zip Vector: a wrapper around a (boxed)  that has zip-py  behavior, analogous to '( for lists. The index m9 enforces proper lengths (and is necessary to implement ). DeconstructorVSmart constructor that checks whether length of input is right (should be totient of m).Unzip an IZipVector. NoneI)Turns a  g into a standard .* Evaluate a . computation using a cryptographic generator gN, seeded by system entropy. Note that the updated generator is not returned.)*+)*)*)*+None)*+,/9:;<=?DIOQRT!/Represents that the target ring can "noisily encode" values from the source ring, in either "most significant digit" (MSD) or "least significant digit" (LSD) encodings, and provides conversion factors between the two types of encodings.0The factor that converts an element from LSD to MSD encoding in the target field, with associated scale factor to apply to correct the resulting encoded value.1Represents that a can be rescaled to b-, as an "approximate" additive homomorphism.3Fun-dep version of Lift.5The type of representatives of b.6Represents that b can be lifted to a "short" a congruent to b.7Represents that b is a quotient group of a.9Represents that a is a subgroup of b.;0Represents a quotient group modulo some integer.> Poor man's .@4The characteristic of a ring, represented as a type.AInverted entries of 0.B*A default implementation of rescaling for ; types.C?Deterministically round to a nearby value in the desired coset.D Version of  with an error message.EApply any applicative to a  value.FExpose the monad of a  value.GHide the monad of a  value.H7Use a singleton as a witness to extract a value from a  value.ITransformer version of H.KEncode for a product ringLRescale up to a product ring of \Z_qsMRescale up to a product ring of \Z_qsN"Rescale a (multi-)product ring of \Z_qsO"Rescale a (multi-)product ring of \Z_qsPRescale a product ring of \Z_qsQRescale a product ring of \Z_qsRReduce into product ring.SProduct ring of \Z_qs as a \Z_q (with  modulus)T+Product ring as an (almost) integral domainU!Product ring as an (almost) fieldVPair as product ringWLift product ring of \Z_qs to -/0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWX      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQ  RSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~6       !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !/0123456789:;<=>?@ABCDEFGHI?>?;<=9:78563412/0A@CDEFBA@?>=<;:9876543210GHIJKLMNOPQRBCDEFGHI#/0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWX None )+9:;<=DRT\,A ring with a ring embedding into some ring ] r0 that has an invertible CRT transformation for every positive index m.^ Embeds from r to ] r_Projects from ] r to r`aA ring that (possibly) supports invertible Chinese remainder transformations of various indices.The values of a for different indices m- should be consistent, in the sense that if \omega_m,  \omega_{m'} are respectively mth, m'th roots of unity where m divides m'#, then it should be the case that \omega_{m'}^{m'/m}=\omega_m.ab for a given index mn. The method itself may be slow, but the function it returns should be fast, e.g., via internal memoization.b^Information that characterizes the (invertible) Chinese remainder transformation over a ring R (represented by the type r ), namely: a function that returns the ith power of some  principal m'th root of unity (for any integer i)the multiplicative inverse of  \hat{m}\in R.c Embeds into the complex numbers \C(. (May not have sufficient precision.)d Embeds into the complex numbers \C.e Embeds into the complex numbers \C.f Embeds into the complex numbers \C.gReturns HhReturns HiReturns HjReturns Hk Self-embedlComplex numbers have ` for any index mm Product ringn Product ring\]^_`ab  cdefghijklmn\]^_`ab`a\]^_b\]^_`ab  cdefghijklmn None)*+,-:<=DEIRT o"Convenience data type for writing q instances.qRepresents fields over which we can get irreducible polynomials of desired degrees. (An instance of this class is defined in !Crypto.Lol.Types.IrreducibleChar2 and exported from Crypto.Lol.Types.)s=This wrapper for a list of coefficients is used to define a \F_{p^d}#-module structure for tensors over \F_p of dimension n, where d \mid n.v&Constraint synonym for a finite field.w%Constraint synonym for a prime field.x$A finite field of given degree over \F_p.yYield a list of length exactly d* (i.e., including trailing zeros) of the \F_p.-coefficients with respect to the power basis.z"Yield a field element given up to d/ coefficients with respect to the power basis.{The order of the field: size (GF fp d) =  p^d |Trace into the prime subfield. #Traces of the power basis elements \{1, x, x^2, \ldots, x^{d-1}\}.}!Convenience function for writing q instances.opqrstuvwx yz { | }~opqrstuvwxyz{|}xwv{|yzqrop}stuopqrstuvwx yz { | }~None*+,:<=DLOQRT>2A Kronecker product of zero of more matrices over r.Y encapsulates all the core linear transformations needed for cyclotomic ring arithmetic. The type t m r6 represents a cyclotomic coefficient tensor of index m over base ring r. Most of the methods represent linear transforms corresponding to operations in particular bases. CRT-related methods are wrapped in GK because they are well-defined only when a CRT basis exists over the ring r for index m._The superclass constraints are for convenience, to ensure that we can sample error tensors of Es.WARNING:5 as with all fixed-point arithmetic, the methods in  may result in overflow (and thereby incorrect answers and potential security flaws) if the input arguments are too close to the bounds imposed by the base type. The acceptable range of inputs for each method is determined by the linear transform it implements.Constraints needed by t to hold type r.-Properties that hold for any index. Use with .5Holds for any (legal) fully-applied tensor. Use with .5Holds for any (legal) fully-applied tensor. Use with .5Holds for any (legal) fully-applied tensor. Use with .5Holds for any (legal) fully-applied tensor. Use with .5Holds for any (legal) fully-applied tensor. Use with .5Holds for any (legal) fully-applied tensor. Use with .3Convert a scalar to a tensor in the powerful basis.P converts from decoding-basis representation to powerful-basis representation;  is its inverse.P converts from decoding-basis representation to powerful-basis representation;  is its inverse. Multiply by g_m in the powerful/decoding basis Multiply by g_m in the powerful/decoding basis Divide by g_m& in the powerful/decoding basis. The Gj output indicates that the operation may fail, which happens exactly when the input is not divisible by g_m. Divide by g_m& in the powerful/decoding basis. The Gj output indicates that the operation may fail, which happens exactly when the input is not divisible by g_m.FA tuple of all the operations relating to the CRT basis, in a single G value for safety. Clients should typically not use this method directly, but instead call the corresponding top-level functions: the elements of the tuple correpond to the functions , , , , .6Sample from the "tweaked" Gaussian error distribution t\cdot D in the decoding basis, where D has scaled variance v. Given the coefficient tensor of e( with respect to the decoding basis of R&, yield the (scaled) squared norm of  g_m \cdot e) under the canonical embedding, namely, .\hat{m}^{-1} \cdot \| \sigma(g_m \cdot e) \|^2.The twaceS linear transformation, which is the same in both the powerful and decoding bases.The embed> linear transformations, for the powerful and decoding bases.The embed> linear transformations, for the powerful and decoding bases.A tuple of all the extension-related operations involving the CRT bases, for safety. Clients should typically not use this method directly, but instead call the corresponding top-level functions: the elements of the tuple correpond to the functions , .BMap a tensor in the powerful/decoding/CRT basis, representing an \O_{m'}/ element, to a vector of tensors representing \O_m$ elements in the same kind of basis.7The powerful extension basis w.r.t. the powerful basis.'A list of tensors representing the mod-p CRT set of the extension.!Potentially optimized version of ( for types that satisfy .Potentially optimized monadic (.5Potentially optimized zipWith for types that satisfy .3Potentially optimized unzip for types that satisfy .%Convenience value indicating whether  exists.cYield a tensor for a scalar in the CRT basis. (This function is simply an appropriate entry from .) Multiply by g_mG in the CRT basis. (This function is simply an appropriate entry from .) Divide by g_mH in the CRT basis. (This function is simply an appropriate entry from .)HThe CRT transform. (This function is simply an appropriate entry from .)PThe inverse CRT transform. (This function is simply an appropriate entry from .)SThe "tweaked trace" function for tensors in the CRT basis: For cyclotomic indices  m \mid m', 5\Tw(x) = (\hat{m}/\hat{m}') \cdot \Tr((g'/g) \cdot x)6. (This function is simply an appropriate entry from .)Embed a tensor with index m* in the CRT basis to a tensor with index m'G in the CRT basis. (This function is simply an appropriate entry from .) For a prime power p^e, converts any matrix M for prime p to \vece{1}_(p^{e-1}) \otimes M, where \vece{1} denotes the all-1s vector. Extract the (i,j) element of a .A  \varphi(m)(-by-1 matrix of the CRT coefficients of g_m, for mth cyclotomic.A  \varphi(m)0-by-1 matrix of the inverse CRT coefficients of g_m, for mth cyclotomic.The "tweaked" \CRT^* matrix: %\CRT^* \cdot \text{diag}(\sigma(g_m)). The "tweaked" \CRT^* matrix (for prime powers): %\CRT^* \cdot \text{diag}(\sigma(g_p)). A (p-1)(-by-1 matrix of the CRT coefficients of g_p, for pth cyclotomic. A (p-1)0-by-1 matrix of the inverse CRT coefficients of g_p , for the pth cyclotomic.1Base-(p) digit reversal; input and output are in [p^e]. Convert a \Z_m^*# index to a linear tensor index in [m]. For a prime power p^e1, map a tensor index to the corresponding power j \in [\varphi(p^e)], as in the powerful basis. For a prime power p^e3, map a tensor index to the corresponding element i \in \Z_{p^e}^*.  Convert a \Z_m^* index to a linear tensor index.  Inverse of  . <Correspondences between the linear indexes into a basis of \O_{m'}*, and pair indices into (extension basis) \otimes (basis of \O_m). The work the same for Pow, Dec, and CRT bases because all these bases have that factorization. The first argument is the list of (\varphi(m),\varphi(m'))) pairs for the (merged) prime powers of m,(m').qA collection of useful information for working with tensor extensions. The first component is a list of triples (p,e,e') where e, e') are respectively the exponents of prime p in m, m'. The next two components are  \varphi(m) and  \varphi(m')!. The final component is a pair ! ( \varphi(p^e), \varphi(p^{e'}))) for each triple in the first component. A vector of  \varphi(m) entries, where the i;th entry is the index into the powerful/decoding basis of \O_{m'} of the i+th entry of the powerful/decoding basis of \O_m. A vector of  \varphi(m) blocks of \varphi(m')/\varphi(m)T consecutive entries. Each block contains all those indices into the CRT basis of \O_{m'}A that "lie above" the corresponding index into the CRT basis of \O_m.A lookup table for   applied to indices  [\varphi(m')].A lookup table for   applied to indices  [\varphi(m')].Same as 7, but only includes the second component of each pair.The i_0th entry of the i_1th vector is    (i_1,i_0). Convenient reindexing functionsMaps an index of the extension ring array to its corresponding index in the base ring array (if it exists), with sign, under the decoding basis.K        !   " #       $  % &44+        !   " #       $  % &)None +:<=DQRT ' ( ) * + , - . / 0 1 2 3 4 ' ) + , - . / 0 1 2 3 4 ' ( ) * + , - . / 0 1 2 3 4None )+9;DRT 5 6 7 5 6 7None:DR)Represents integers modulo a prime power.8An implementation of the integers modulo the prime base.&The prime and exponent of the modulus. Lift from \Z_p to a representative.None%&)*+,-9:;<=DOQRT+Convenient synonym for  8-able element type.1Constraints needed for CRT-related operations on  data.%Represents a cyclotomic ring such as  \Z[\zeta_m],  \Z_q[\zeta_m], and  \Q(\zeta_m)! in an explicit representation: t is the ( type for storing coefficient tensors; m is the cyclotomic index; rep is the representation (, , or ); r- is the base ring of the coefficients (e.g., \Z, \Z_q).The ', ,  9 and  :? instances all work coefficient-wise (in the specified basis).1Convenient synonym for either CRT representation.KNullary index type representing the CRT basis over extension of base ring.=Nullary index type representing the CRT basis over base ring.3Nullary index type representing the decoding basis.3Nullary index type representing the powerful basis."Embed a scalar from the base ring."Embed a scalar from the base ring.1Type-restricted (and potentially more efficient) ($ for powerful-basis representation.1Type-restricted (and potentially more efficient) ($ for decoding-basis representation.Unzip in the powerful basis.Unzip in the decoding basis.GUnzip in the CRT basis over the base ring. The output components are O/ because each target base ring may not support .XUnzip in the CRT basis over the extension of the base ring. The output components are O1 because each target base might instead support . Multiply by the special element g_m.Divide by the special element g_m. WARNING: this implementation is not a constant-time algorithm, so information about the argument may be leaked through a timing channel.!Yield the scaled squared norm of  g_m \cdot e* under the canonical embedding, namely, .\hat{m}^{-1} \cdot \| \sigma(g_m \cdot e) \|^2 .6Sample from the "tweaked" Gaussian error distribution t\cdot D in the decoding basis, where D has scaled variance v.Generate an LWE error term from the "tweaked" Gaussian with given scaled variance, deterministically rounded using the decoding basis. (Note: This implementation uses Em precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.)MGenerate an LWE error term from the "tweaked" Gaussian with scaled variance  v \cdot p^23, deterministically rounded to the given coset of R_p< using the decoding basis. (Note: This implementation uses Em precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.)5Embed into an extension ring, for the powerful basis.5Embed into an extension ring, for the decoding basis.EEmbed into an extension ring, for the CRT basis. (The output is an O. because the extension ring might not support .) Similar to . (The output is an O+ because the extension ring might support , in which case we never use .)-Twace into a subring, for the powerful basis.-Twace into a subring, for the decoding basis.=Twace into a subring, for the CRT basis. (The output is an O' because the subring might not support .) Similar to . (The output is an O$ because the subring might support , in which case we never use .) Yield the \O_m-coefficients of an \O_{m'}1-element, with respect to the relative powerful \O_m-basis. Yield the \O_m-coefficients of an \O_{m'}1 element, with respect to the relative decoding \O_m-basis.The relative powerful basis of \O_{m'} / \O_m. The relative mod-(r) CRT set of \O_{m'} / \O_mm, represented with respect to the powerful basis (which seems to be the best choice for typical use cases).)Convert to powerful-basis representation. ;Convenient version of  for O CRT basis type.)Convert to decoding-basis representation.&Convert to a CRT-basis representation.7apply coefficient-wise (with respect to decoding basis)7apply coefficient-wise (with respect to powerful basis)R_p is an \F_{p^d} -module when d divides  \varphi(m), by applying d -dimensional \F_p-linear transform on d&-dim chunks of powerful basis coeffs.'only for appropriate CRT representation3only for appropriate CRT representation (otherwise # would violate internal invariant)N < = > ? ;  %%J < = > ? ;  *None)T @Using polar form of Box-Muller transform, returns a pair of centered, Gaussian-distributed real numbers with scaled variance svar = true variance * (2*pi). See < Thttp://www.alpheratz.net/murison/Maple/GaussianDistribution/GaussianDistribution.pdf this link> for details. A Generate n0 real, independent gaussians of scaled variance svar = true variance * (2*pi). B|Execute an action repeatedly until its result fails to satisfy a predicate, and return that result (discarding all others). C Analogue of (+,)0 Yields the result of applying f until p holds. @ A B C @ A @ A B C-None%&)*,9:;<=DEIOQRT D*a DSL for tensor transforms on Repa arrays E| identity sentinel F&| (function) composition of transforms G3Indexed newtype for 1-dimensional Unbox repa arrays HAn  G filled with the argument. IMonadic version of  H. JZFor a factored index, tensors up any function defined for (and tagged by) any prime power KYFor a prime power p^e, tensors up any function f defined for (and tagged by) a prime to I_(p^{e-1}) otimes f L-Returns the (linear) dimension of a transform M#smart constructor from a Tensorable Ncompose transforms O!tensor/Kronecker product (otimes) PACreates an evaluatable Haskell function from a tensored transform QMonadic version of  P R~maps the innermost dimension to a 2-dim array with innermost dim d, for performing a I_l otimes f_d otimes I_r transformation Sinverse of expose T6general matrix multiplication along innermost dim of v U7multiplication by a diagonal matrix along innermost dim VeEmbeds a scalar into a powerful-basis representation of a Repa array, tagged by the cyclotomic index W+Forces a delayed array to a manifest array. X5Sum the inner-most dimension of an array sequentially Y.Sum all array indices to a scalar sequentially" D E F Z [ \ G ] H I J K ^ L M N O _ P Q R S T U V W X Y ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~  D E G ] H I J K L M N O P Q T U V W X Y D E F Z [ \ G ] H I J K ^ L M N O _ P Q R S T U V W X Y ` a b c d e.None %&*:<=T 4Embeds a scalar into the CRT basis (when it exists).  Multiply by g_m# in the CRT basis (when it exists).  Divide by g# in the CRT basis (when it exists). The coefficient vector of g# in the CRT basis (when it exists). The coefficient vector of g^{ -1 }# in the CRT basis (when it exists). XThe Chinese Remainder Transform. Exists if and only if CRT exists for all prime powers. `The inverse Chinese Remainder Transform. Exists if and only if CRT exists for all prime powers.                   /None)*:T Given v=r^2P, yields the decoding-basis coefficients of a sample from the tweaked Gaussian  t_m cdot D_r. The E_m! transformation for an arbitrary m. The E_p transformation for a prime p. Given coefficient tensor e( with respect to the decoding basis of R%, yield the (scaled) squared norm of  g_m cdot e+ under the canonical embedding, namely, /hat{m}^{ -1 } cdot || sigma(g_m -- cdot e) ||^2 .  Multiply by hat{m}- times the Gram matrix of decoding basis of R^vee. GMultiply by (scaled) Gram matrix of decoding basis: (I_{p-1} + all-1s).           0None %&)*:<=OT Arbitrary-index LQ transform, which converts from decoding-basis to powerful-basis representation. Arbitrary-index L^{ -1 }Q transform, which converts from powerful-basis to decoding-basis representation. "Arbitrary-index multiplication by g_m in the powerful basis. "Arbitrary-index multiplication by g_m in the decoding basis. Arbitrary-index division by g_m! in the powerful basis. Outputs H* if the input is not evenly divisible by g_m. Warning: not constant time! Arbitrary-index division by g_m! in the decoding basis. Outputs H) if the input is no evenly divisible by g_m. Warning: not constant time! hThis is not a constant-time algorithm! Depending on its usage, it might provide a timing side-channel.              !                    !None*+,9:;<=DLRT &Error correction relative to a gadget. 4Error-correct a "noisy" encoding of an element (see 7), returning the encoded element and the error vector. #Decomposition relative to a gadget.The ring that u decomposes over.Yield a short vector  x  such that  \langle g, x\rangle = u .Gadget) vectors, parameterized by an index type.The gadget vector over u.Yield an error-tolerant encoding of an element with respect to the gadget. (Mathematically, this should just be the product of the input with the gadget, but it is a class method to allow for optimized implementations.)#Dummy type representing the gadget  [1,b,b^2,\ldots] .#Dummy type representing the gadget  [1] .Alternative to .Decompose a list entry-wise.Decompose a matrix entry-wise. Product ring<Product ring: concatenate decompositions for component rings6Product ring: concatenate gadgets over component rings               None)*+,9:;<=DEIRT The ring \Z_q of integers modulo q!, using underlying integer type z. "Yield a  principal mth root of unity \omega_m \in \Z_q^*. The implementation requires q3 to be prime. It works by finding a generator of \Z_q^* and raising it to the  (q-1)/m4 power. Therefore, outputs for different values of m are consistent, i.e., \omega_{m'}^(m'/m) = \omega_m. # The base-(b) gadget for modulus q$, over integers (not mod anything). $SYield the error vector for a noisy multiple of the gadget (all over the integers).+ Embeds into the complex numbers  \C .& % & ' ( ) " * + # $modulus qbase b input vector v = s cdot g^t + eerror e , - !"#$%&'()*+,-./01234# % ( ) " * + # $ , & - ' !"#$%&'()*+,-./01234None)*+9:;<=DIRT< The ring \R/(q\Z) of reals modulo q", using underlying floating type r.< . / 0 1 2=>? 3 4@ABC<< < . 1 2=>? 3 / 4 0@ABC1None*+,9:;<=DQRT 5DClass to safely match Haskell types with the appropriate C function. 6Equivalent to Tensors crt. 7Equivalent to Tensors crtInv. 8Equivalent to Tensors  tGaussianDec. 9Equivalent to Tensors l. :Equivalent to Tensors lInv. ;Equivalent to Tensors  gSqNormDec. <Equivalent to Tensors mulGPow. =Equivalent to Tensors mulGDec. >Equivalent to Tensors divGPow. ?Equivalent to Tensors divGDec. @Equivalent to  zipWith (*) ASingle-argument synonym for  Dispatch'. B"C representation of a prime power. C>Convert a list of prime powers to a suitable C representation. DDEvaluates a C function that takes an "a** ptr" on a list of Vectors.J 5 6 7 8 9 : ; < = > ? @ A E F G H I J K L M N O P B Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p C D q r s t u v w x y z { | } ~  @ ? > = < ; : 9 8 7 6 A B C D9 5 6 7 8 9 : ; < = > ? @ A E F G H I J K L M N O P B Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p C D q r s t u v w x y z { | } ~2None)*+,:<=DQRT The multiplicative order of p (the argument) modulo m . Requires  \gcd(p,m)=1. Given p', returns a partition of the cosets of \Z_{m'}^* / <p>y (specified by representatives), where the cosets in each component are in bijective correspondence with the cosets of  \Z_m^* / <p>, under the natural ((bmod m)) homomorphism.   3None)*+,:<=DQRT O(n)5 Yield the vector obtained by replacing each element i of the index vector by xs i. This is equivalent to  (xs ) is# but is often much more efficient. 3backpermute <a,b,c,d> <0,3,2,3,1,0> = <a,d,c,d,b,a> Embeds an vector in the powerful basis of the the mth cyclotomic ring to an vector in the powerful basis of the m'th cyclotomic ring when m | m' Embeds an vector in the decoding basis of the the mth cyclotomic ring to an vector in the decoding basis of the m'th cyclotomic ring when m | m' Embeds an vector in the CRT basis of the the mth cyclotomic ring to an vector in the CRT basis of the m'th cyclotomic ring when m | m' maps a vector in the powerful/decoding basis, representing an O_m' element, to a vector of arrays representing O_m elements in the same type of basis The "tweaked trace" function in either the powerful or decoding basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'. wThe powerful extension basis, wrt the powerful basis. Outputs a list of vectors in O_m' that are an O_m basis for O_m' KA list of vectors representing the mod-p CRT set of the extension O_m'/O_m is index vector (of length n)xs value vector   None%&)*+,-/9:;<=DEILOQRTKAn implementation of  backed by C++ code.  Newtype wrapper around a Vector. Useful coersion for defining coeffs in the Tensor interface. Using  * alone is insufficient for type inference. Useful coersion for defining  powBasisPow and  crtSetDec in the Tensor interface. Using  * alone is insufficient for type inference.5 K LMNOPQRSTUVWXYZ[KK1 K  LMNOPQRSTUVWXYZ[4None*+,9:;<=DQRT The "tweaked trace" function in either the powerful or decoding basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'. lThe "tweaked trace" function in the CRT basis of the m'th cyclotomic ring to the mth cyclotomic ring when m | m'. Embeds an array in the powerful basis of the the mth cyclotomic ring to an array in the powerful basis of the m'th cyclotomic ring when m | m' Embeds an array in the decoding basis of the the mth cyclotomic ring to an array in the decoding basis of the m'th cyclotomic ring when m | m' Embeds an array in the CRT basis of the the mth cyclotomic ring to an array in the CRT basis of the m'th cyclotomic ring when m | m' maps an array in the powerful/decoding basis, representing an O_m' element, to an array of arrays representing O_m elements in the same type of basis vThe powerful extension basis, wrt the powerful basis. Outputs a list of arrays in O_m' that are an O_m basis for O_m' JA list of arrays representing the mod-p CRT set of the extension O_m'/O_m    None%&)*+,/9:;<=DEQRT`An implementation of  backed by repa.` abcdefghijklmn``` abcdefghijklmn5None)*<K`None<=pRepresents cyclotomic rings that are rescalable over their base rings. (This is a class because it allows for more efficient specialized implementations.)qRescale in the given basis.r?Represents the basis used to rescale a cyclotomic ring element.u"Specialized convenience functions.v"Specialized convenience functions.pqrstuvpqrtsuvrstpquvpqrstuvNone%&*+,9:;<=DOQRT*w1Constraints needed for most operations involving x data.x%Represents a cyclotomic ring such as  \Z[\zeta_m],  \Z_q[\zeta_m], and  \Q[\zeta_m]! in an explicit representation: t is the ' type for storing coefficient tensors; m is the cyclotomic index; r. is the base ring of the coefficients (e.g., \Z, \Z_q).yWrap a  as a x.zWrap a  as a x.{Wrap a  as a x.|Wrap a  as a x.}Wrap a  as a x.~Convenience wrapper.Convenience wrapper.:Embed a scalar from the base ring as a cyclotomic element. Unwrap a x as a " in powerful-basis representation. Unwrap a x as a " in decoding-basis representation. Unwrap a x as a  in a CRT-basis representation.Same as ,, but for the powerful-basis representation.Same as ,, but for the powerful-basis representation.!Yield an equivalent element that mayS be in a CRT representation. This can serve as an optimization hint. E.g., call ; prior to multiplying the same value by many other values. Multiply by the special element g of the mth cyclotomic. Divide by g , returning H if not evenly divisible. WARNING: this implementation is not a constant-time algorithm, so information about the argument may be leaked through a timing channel.6Sample from the "tweaked" Gaussian error distribution t\cdot D in the decoding basis, where D has scaled variance v.!Yield the scaled squared norm of  g_m \cdot e* under the canonical embedding, namely, .\hat{m}^{-1} \cdot \| \sigma(g_m \cdot e) \|^2.Generate an LWE error term with given scaled variance, deterministically rounded with respect to the decoding basis. (Note: This implementation uses Em precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.)6Generate an LWE error term with given scaled variance  v \cdot p^2x over the given coset, deterministically rounded with respect to the decoding basis. (Note: This implementation uses Em precision to generate the Gaussian sample, which may not be sufficient for rigorous proof-based security.)&Embed (lazily) into an extension ring. Force to a non- % constructor (for internal use only).&The "tweaked trace" (twace) function 9\Tw(x) = (\hat{m} / \hat{m}') \cdot \Tr((g' / g) \cdot x), which fixes R pointwise (i.e., twace . embed == id).Return the given element's coefficient vector with respect to the (relative) powerful/decoding basis of the cyclotomic extension \O_{m'} / \O_m . See also , .Specialized version of  for powerful basis.Specialized version of  for decoding basis.The relative powerful basis of \O_{m'} / \O_m.The relative mod-r CRT set of the extension.Lift using the specified basis.Lift using the powerful basis.Lift using the decoding basis.Unzip for a pair base ring. ?Force to powerful-basis representation (for internal use only). ?Force to decoding-basis representation (for internal use only). 6Force to a CRT representation (for internal use only).Cpromoted from base ring, using the decoding basis for best geometryCpromoted from base ring, using the powerful basis for best geometrypromoted from base ring*specialized instance for product rings of \Z_qs: ~2x faster algorithmR_p is an \F_{p^d} -module when d divides  \varphi(m), by applying d -dimensional \F_p-linear transform on d&-dim chunks of powerful basis coeffs.;wx yz{|}~  "wxyz{|}~"xwyz{|}~6wx yz{|}~  None*,/:<=DEIQRTQA convenient constraint synonym for extending a linear function to larger rings.An E-linear function from R to S. Construct an E8-linear function given a list of its output values (in S$) on the relative decoding basis of R/EM. The number of elements in the list must not exceed the size of the basis.1Evaluates the given linear function on the input. Extend an E-linear function R\to S to an E'-linear function R'\to S'1. (Mathematically, such extension only requires \lcm(r,e') | r' (not equality), but this generality would significantly complicate the implementation, and for our purposes there's no reason to use any larger r'.)7lifts with respect to powerful basis, for best geometry   None)*:<=T4Common constraints for working with continuous RLWE.A continuous RLWE sample  (a,b) \in R_q \times K/(qR). (The second component is a  because the base type rrq representing \R/(q\Z)I, is an additive group but not a ring, so we can't usefully work with a x over it.)CA continuous RLWE sample with the given scaled variance and secret.=The error term of an RLWE sample, given the purported secret.The B of the error term of an RLWE sample, given the purported secret.A bound such that the % of a continuous error generated by  with scaled variance v (over the mTth cyclotomic field) is less than the bound except with probability approximately \epsilon.the scaled variance\epsilonNone)*:<=T2Common constraints for working with discrete RLWE.A discrete RLWE sample  (a,b) \in R_q \times R_q.AA discrete RLWE sample with the given scaled variance and secret.=The error term of an RLWE sample, given the purported secret.The B of the error term of an RLWE sample, given the purported secret.A bound such that the + of a discretized error term generated by  with scaled variance v (over the mSth cyclotomic field) is less than the bound except with probability approximately \epsilon.the scaled variance\epsilon6None)      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQ  RSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~6       !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !/0123456789:;<=>?@ABCDEFGHI   pqrtsuvwxyz{|}~None*:<=T)Common constraints for working with RLWR.An RLWR sample  (a,b) \in R_q \times R_p.%An RLWR sample with the given secret.The b( component of an RLWR sample for secret s and given a, produced by rounding a\cdot s in the decoding basis. 789:;<=>?@AB%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%TUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  @     !"#$%&'()*+,,-./0123456789::  ;<=>?@ABCDEFGHHIJKLMNOPQRSTUVW X Y Z [ \ ] ^ _`abcdefghijklmnopqrstuvwxyz{|$}$~$$$$%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQ R S T U V W X Y Z [ \]^_`abcdefghijklmnopqrstuvwxyz{|}~                                                   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~   XY                  "     st u!"#$%7&'()7*+7*,7-.7/07/17&27&37&475677877977:77;77<77=77>77?77@77A77B77CDEF7&G7&H7&I7&J7&K7&L7&M7&NOPQRS7TU7TV7TW7XY7XZ7X[7X\7]^7]_7]`7]a7]b7]c7]d7]e7]f7gh7gijklmno7&p7&q7&rstuvw7xy7xz7x{7*|7-}7-~7-7-7-7-7-7-7-7-7-7-7777]7]7]7]7]7]7]7]7]7777x77777T7T77X7X7X7X7X7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*7*77/7/7&7&,7&7&7&7&7&7&7&77                                                                 " " " " " "#                 !"#$%$&$}$'$($)$*$+$,%-%.%/%%%0%1%2%3%4%5%6%7%8%9%:%;%<%=%>%?%@%A%B%C%D%%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%{%|%}%~%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % % % %%%%%%%%%%%%%%%%%%% %!%"%#%$%%%&%'%(%)%*%+%,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%<%=%>%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%w%x%y%z%{%|%}%~%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % % % % &    7& 7& & & & & & & &           Y7       7 ! "7 ! #7 ! #7 ! $7 ! $   %   &   '   (   )   *   +   ,   -   .   /   0   1   2   3   4   5   6   7   8   9   :   ; < = >  ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z) [) [) \) \) ]) ^) _) `) a) b) c) d) e) f g h i j k7] l7g m n o p* q* r* s* t- u- v- w- x- - y- z- {- |- }- ~- - - - - - - - - - - - - - - x- - - - - - - -  3      ,  '                                                                     ! " # " $ " % " " & " ' " ( " ) " * " + " , " - " . " / " 0 " 1 2 3 2 4  5 6. 7. 8. 9. :. ;. <. =. >. ?. @. A. B. C. D. E. F. G. H. I/ J/ K/ L/ M/ N/ O0 P0 Q0 R0 S0 T0 U0 V0 W0 X0 Y0 Z0 [0 \0 ]0 ^ _ ` a b c d e f g h i jg k l e f m n1 o1 p1 q1 r1 s1 t1 u1 v1 w1 x1 y1 z1 {1 |1 }1 ~1 1 1 1 1 1 1 1 1 1 1 1 1 |1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 7 2 2 2 3  3 3 3 3 3 3 3   (    v               M        y    > : ; 4 4 4 4 4 4 4 4 4 4 4 4 4444444                 "lol-0.4.0.0-Hq7yJLXL6nv1Kryzi3iwmwCrypto.Lol.PreludeCrypto.Lol.FactoredCrypto.Proto.RLWE.RqCrypto.Proto.RLWE.SampleDiscCrypto.Proto.RLWE.SampleRLWRCrypto.Proto.RLWE.KqCrypto.Proto.RLWE.SampleContCrypto.Proto.RLWECrypto.Lol.Types.ProtoCrypto.Lol.ReflectsCrypto.Lol.Types.RandomCrypto.Lol.CRTransCrypto.Lol.Types.FiniteFieldCrypto.Lol.Cyclotomic.Tensor!Crypto.Lol.Types.IrreducibleChar2Crypto.Lol.Types.ZPPCrypto.Lol.Cyclotomic.UCycCrypto.Lol.GadgetCrypto.Lol.Types.ZqBasicCrypto.Lol.Types.RRq$Crypto.Lol.Cyclotomic.Tensor.CTensor'Crypto.Lol.Cyclotomic.Tensor.RepaTensor Crypto.Lol.Cyclotomic.RescaleCycCrypto.Lol.Cyclotomic.CycCrypto.Lol.Cyclotomic.LinearCrypto.Lol.RLWE.ContinuousCrypto.Lol.RLWE.DiscreteCrypto.Lol.RLWE.RLWRCrypto.Lol.PosBinDefsCrypto.Lol.PosBinCrypto.Lol.Types.NumericNumericPreludeNumericAlgebra.IntegralDomaindivModCrypto.Lol.Types.ComplexCrypto.Lol.FactoredDefsCrypto.Lol.Types.IZipVectorControl.ApplicativeZipList!Crypto.Lol.Cyclotomic.CRTSentinelCrypto.Lol.GaussRandomPreludeuntil0Crypto.Lol.Cyclotomic.Tensor.RepaTensor.RTCommon+Crypto.Lol.Cyclotomic.Tensor.RepaTensor.CRT+Crypto.Lol.Cyclotomic.Tensor.RepaTensor.Dec*Crypto.Lol.Cyclotomic.Tensor.RepaTensor.GL,Crypto.Lol.Cyclotomic.Tensor.CTensor.BackendCrypto.Lol.Types.ZmStar.Crypto.Lol.Cyclotomic.Tensor.CTensor.Extension1Crypto.Lol.Cyclotomic.Tensor.RepaTensor.ExtensionCrypto.Lol.Types Crypto.LolbaseGHC.IntInt64subPosaddPosPosOSBinB1D0D1unFunPPprimePP exponentPPPrimeBin PrimePowerFactoredfMulfPPMul fOddRadicalfDivfDividesfLCMfGCDppToFpToPPpToFpFree&constraints-0.8-4c3b6cnEJINLrFZUA2mlxrData.Constraint\\%singletons-2.1-GAYntqZs97cHcgq9YYk7wIData.SingletonsSingSPosAddPosSubPos AddPosSym0 AddPosSym1 SubPosSym0 SubPosSym1SSym0SSym1OSym0sSubPossAddPosposToIntBinCPosCSBinD1Sym0D1Sym1D0Sym0D0Sym1B1Sym0binToIntreifyPos reifyPosIreifyBin reifyBinIposTypebinTypeposDecbinDecintDecprimesprimeP16P15P14P13P12P11P10P9P8P7P6P5P4P3P2P1B128B127B126B125B124B123B122B121B120B119B118B117B116B115B114B113B112B111B110B109B108B107B106B105B104B103B102B101B100B99B98B97B96B95B94B93B92B91B90B89B88B87B86B85B84B83B82B81B80B79B78B77B76B75B74B73B72B71B70B69B68B67B66B65B64B63B62B61B60B59B58B57B56B55B54B53B52B51B50B49B48B47B46B45B44B43B42B41B40B39B38B37B36B35B34B33B32B31B30B29B28B27B26B25B24B23B22B21B20B19B18B17B16B15B14B13B12B11B10B9B8B7B6B5B4B3B2Rqmqxs $fTextMsgRq $fTextTypeRq$fReflectDescriptorRq$fGPBRq$fMessageAPImsg'(->)Rq$fWireRq $fDefaultRq $fMergeableRq$fShowRq$fEqRq$fOrdRq$fDataRq $fGenericRq SampleDiscab$fTextMsgSampleDisc$fTextTypeSampleDisc$fReflectDescriptorSampleDisc$fGPBSampleDisc$fMessageAPImsg'(->)SampleDisc$fWireSampleDisc$fDefaultSampleDisc$fMergeableSampleDisc$fShowSampleDisc$fEqSampleDisc$fOrdSampleDisc$fDataSampleDisc$fGenericSampleDisc SampleRLWR$fTextMsgSampleRLWR$fTextTypeSampleRLWR$fReflectDescriptorSampleRLWR$fGPBSampleRLWR$fMessageAPImsg'(->)SampleRLWR$fWireSampleRLWR$fDefaultSampleRLWR$fMergeableSampleRLWR$fShowSampleRLWR$fEqSampleRLWR$fOrdSampleRLWR$fDataSampleRLWR$fGenericSampleRLWRKq $fTextMsgKq $fTextTypeKq$fReflectDescriptorKq$fGPBKq$fMessageAPImsg'(->)Kq$fWireKq $fDefaultKq $fMergeableKq$fShowKq$fEqKq$fOrdKq$fDataKq $fGenericKq SampleCont$fTextMsgSampleCont$fTextTypeSampleCont$fReflectDescriptorSampleCont$fGPBSampleCont$fMessageAPImsg'(->)SampleCont$fWireSampleCont$fDefaultSampleCont$fMergeableSampleCont$fShowSampleCont$fEqSampleCont$fOrdSampleCont$fDataSampleCont$fGenericSampleCont protoInfofileDescriptorProto Protoable ProtoTypetoProto fromProtomsgPutmsgGet$fProtoable(,) $fProtoable[]Matrix PolynomialPID RealIntegralAbsolute ToIntegerOrdFloatRealTranscendentalTranscendental Algebraic RealFieldRealRingField ToRationalIntegralDomainModuleRingAdditive ZeroTestablemaxminabs realToField^modinvdecomp roundMultroundScalarCentered divModCentComplex roundComplexcisrealimagfromReal SFactored SPrimePower SPrimeBin ExponentPPPrimePPUnPPUnFsUnFsUnPPFPPMulFMulPToFPToPPPpToFFGCDFLCMFDividesFDiv FOddRadicalsPpToFsPToPPsPToFPPCoprimeDividesFactPPowPrime*/PFree reifyPrime reifyPrimeI reifyPPow reifyPPowI reifyFact reifyFactI transDivides gcdDivides lcmDivides lcm2DividespSplitTheorems pFreeDividesppsFact valueFact totientFact valueHatFact radicalFactoddRadicalFactppPPow primePPow exponentPPow valuePPow totientPPow valuePrimevalueHatppToPPvaluePP totientPP radicalPP oddRadicalPPvaluePPs totientPPs radicalPPs oddRadicalPPspTypeppTypefTypepDecppDecfDecF512F511F510F509F508F507F506F505F504F503F502F501F500F499F498F497F496F495F494F493F492F491F490F489F488F487F486F485F484F483F482F481F480F479F478F477F476F475F474F473F472F471F470F469F468F467F466F465F464F463F462F461F460F459F458F457F456F455F454F453F452F451F450F449F448F447F446F445F444F443F442F441F440F439F438F437F436F435F434F433F432F431F430F429F428F427F426F425F424F423F422F421F420F419F418F417F416F415F414F413F412F411F410F409F408F407F406F405F404F403F402F401F400F399F398F397F396F395F394F393F392F391F390F389F388F387F386F385F384F383F382F381F380F379F378F377F376F375F374F373F372F371F370F369F368F367F366F365F364F363F362F361F360F359F358F357F356F355F354F353F352F351F350F349F348F347F346F345F344F343F342F341F340F339F338F337F336F335F334F333F332F331F330F329F328F327F326F325F324F323F322F321F320F319F318F317F316F315F314F313F312F311F310F309F308F307F306F305F304F303F302F301F300F299F298F297F296F295F294F293F292F291F290F289F288F287F286F285F284F283F282F281F280F279F278F277F276F275F274F273F272F271F270F269F268F267F266F265F264F263F262F261F260F259F258F257F256F255F254F253F252F251F250F249F248F247F246F245F244F243F242F241F240F239F238F237F236F235F234F233F232F231F230F229F228F227F226F225F224F223F222F221F220F219F218F217F216F215F214F213F212F211F210F209F208F207F206F205F204F203F202F201F200F199F198F197F196F195F194F193F192F191F190F189F188F187F186F185F184F183F182F181F180F179F178F177F176F175F174F173F172F171F170F169F168F167F166F165F164F163F162F161F160F159F158F157F156F155F154F153F152F151F150F149F148F147F146F145F144F143F142F141F140F139F138F137F136F135F134F133F132F131F130F129F128F127F126F125F124F123F122F121F120F119F118F117F116F115F114F113F112F111F110F109F108F107F106F105F104F103F102F101F100F99F98F97F96F95F94F93F92F91F90F89F88F87F86F85F84F83F82F81F80F79F78F77F76F75F74F73F72F71F70F69F68F67F66F65F64F63F62F61F60F59F58F57F56F55F54F53F52F51F50F49F48F47F46F45F44F43F42F41F40F39F38F37F36F35F34F33F32F31F30F29F28F27F26F25F24F23F22F21F20F19F18F17F16F15F14F13F12F11F10F9F8F7F6F5F4F3F2F1F2048F1024PP128PP64PP32PP16PP8PP4PP2PP81PP27PP9PP3PP11PP7PP5Prime659Prime653Prime647Prime643Prime641Prime631Prime619Prime617Prime613Prime607Prime601Prime599Prime593Prime587Prime577Prime571Prime569Prime563Prime557Prime547Prime541Prime523Prime521Prime509Prime503Prime499Prime491Prime487Prime479Prime467Prime463Prime461Prime457Prime449Prime443Prime439Prime433Prime431Prime421Prime419Prime409Prime401Prime397Prime389Prime383Prime379Prime373Prime367Prime359Prime353Prime349Prime347Prime337Prime331Prime317Prime313Prime311Prime307Prime293Prime283Prime281Prime277Prime271Prime269Prime263Prime257Prime251Prime241Prime239Prime233Prime229Prime227Prime223Prime211Prime199Prime197Prime193Prime191Prime181Prime179Prime173Prime167Prime163Prime157Prime151Prime149Prime139Prime137Prime131Prime127Prime113Prime109Prime107Prime103Prime101Prime97Prime89Prime83Prime79Prime73Prime71Prime67Prime61Prime59Prime53Prime47Prime43Prime41Prime37Prime31Prime29Prime23Prime19Prime17Prime13Prime11Prime7Prime5Prime3Prime2Reflectsvalue$fReflectsTYPEqr$fReflectsFactoredmi$fReflectsPrimePowerppi$fReflectsPrimeBinpi$fReflectsNatai CryptoRandevalCryptoRandIO$fRandomGenCryptoRand$fCryptoRandomGenCryptoRand$fMonadRandomTaggedT$fNFDataTaggedTEncodelsdToMSDRescalerescaleLift'liftLiftOfLiftReducereduceSubgroup fromSubgroupModModRepmodulus EnumerablevaluesCharOfmsdToLSD rescaleMod roundCoset fromJust'pureTpeelTpasteT withWitness withWitnessT $fRandom(,) $fEncodes(,) $fRescaleb(,) $fRescalea(,) $fRescale(,)a $fRescale(,)c$fRescale(,)a0 $fRescale(,)b $fReducea(,)$fMod(,)$fC(,)$fC(,)0$fC(,)1 $fLift'(,) $fDefaultBool$fVectorVectorMaybe$fMVectorMVectorMaybe $fUnboxMaybeCRTEmbedCRTExttoExtfromExtCRTranscrtInfoCRTInfo$fCRTEmbedInteger$fCRTEmbedInt64 $fCRTEmbedInt$fCRTEmbedDouble$fCRTransMaybeInteger$fCRTransMaybeInt64$fCRTransMaybeInt$fCRTransMaybeDouble$fCRTEmbedComplex$fCRTransmonComplex $fCRTEmbed(,)$fCRTransmon(,)XIrreduciblePolyirreduciblePoly TensorCoeffsCoeffsunCoeffsGFCtx PrimeFieldGFtoListfromListsizetrace^^$fCGFTensorCoeffs$fCRTransMaybeGF$fCGF$fCGF0$fEnumerableGF$fEqGF$fShowGF$fCGF1$fCGF2 $fNFDataGF$fCTensorCoeffsKronTensorTElt entailIndexT entailEqT entailZTT entailNFDataT entailRandomT entailShowT entailModuleT scalarPowllInvmulGPowmulGDecdivGPowdivGDeccrtFuncs tGaussianDec gSqNormDec twacePowDecembedPowembedDec crtExtFuncscoeffs powBasisPow crtSetDecfmapTfmapTMzipWithTunzipT hasCRTFuncs scalarCRTmulGCRTdivGCRTcrtcrtInvtwaceCRTembedCRTindexKgCRTKgInvCRTKtwCRTsdigitRevzmsToIndexFact indexInfoextIndicesPowDec extIndicesCRTbaseIndicesPowbaseIndicesDecbaseIndicesCRTextIndicesCoeffs$fIrreduciblePolyaZPPZpOf modulusZPPliftZpNFEltUCRTEltUCycUCycECECDPfmapPowfmapDecunzipPowunzipDec unzipCRTC unzipCRTEmulGdivGgSqNorm tGaussian errorRounded errorCoset embedCRTC embedCRTEtwacePowtwaceDec twaceCRTC twaceCRTE coeffsPow coeffsDecpowBasiscrtSettoPowtoDectoCRT$fProtoableUCyc $fNFDataUCyc$fArbitraryUCyc$fArbitraryUCyc0$fRandomEither $fRandomUCyc $fRandomUCyc0$fTraversableUCyc$fTraversableUCyc0$fFoldableUCyc$fFoldableUCyc0$fFoldableUCyc1$fApplicativeUCyc$fApplicativeUCyc0 $fFunctorUCyc$fFunctorUCyc0$fRescaleUCycUCyc$fRescaleUCycUCyc0 $fLift'UCyc $fLift'UCyc0$fReduceUCycUCyc$fReduceUCycUCyc0 $fCGFUCyc $fCrEither$fCrUCyc $fCrUCyc0 $fCEither $fCEither0$fCUCyc$fCUCyc0$fCUCyc1$fCUCyc2$fCUCyc3$fEqUCyc $fEqUCyc0 $fEqUCyc1Correctcorrect DecomposeDecompOf decomposeGadgetgadgetencodeBaseBGadTrivGad decomposeT decomposeListdecomposeMatrix$fCorrectkgad(,)$fDecomposekgad(,)$fGadgetkgad(,)ZqBasic$fVectorVectorZqBasic$fMVectorMVectorZqBasic$fUnboxZqBasic$fArbitraryZqBasic$fRandomZqBasic$fCorrectTYPEBaseBGadZqBasic$fDecomposeTYPEBaseBGadZqBasic$fGadgetTYPEBaseBGadZqBasic$fCorrectTYPETrivGadZqBasic$fDecomposeTYPETrivGadZqBasic$fGadgetTYPETrivGadZqBasic $fCZqBasic $fCZqBasic0 $fCZqBasic1 $fCZqBasic2$fCRTEmbedZqBasic$fCRTransMaybeZqBasic$fEncodeZqBasicZqBasic$fRescaleZqBasicZqBasic$fLift'ZqBasic$fReduceIntegerZqBasic$fReducezZqBasic $fZPPZqBasic $fModZqBasic$fEnumerableZqBasic $fEqZqBasic $fOrdZqBasic $fCZqBasic3 $fEltZqBasic $fShowZqBasic$fNFDataZqBasic$fStorableZqBasicRRq$fVectorVectorRRq$fMVectorMVectorRRq $fUnboxRRq$fSubgroupZqBasicRRq$fCRRq $fLift'RRq $fReducerRRq$fEqRRq$fOrdRRq$fCRRq0$fEltRRq $fShowRRq $fNFDataRRq $fStorableRRqCT $fNFDataCT $fRandomCT $fRandomCT' $fArbitraryCT$fArbitraryCT' $fTensorCT$fTraversableCT $fFoldableCT$fApplicativeCT $fFunctorCT$fCGFCT$fCCT$fCCT0 $fProtoableCT$fProtoableCT0$fEqCT $fShowCT'$fEqCT' $fNFDataCT'$fShowCTRT $fNFDataRT $fArbitraryRT $fRandomRT$fCGFRT$fCRT$fCRT0$fTraversableRT $fFoldableRT$fApplicativeRT $fFunctorRT $fTensorRT$fEqRT $fProtoableRT$fProtoableRT0$fShowRT RescaleCyc rescaleCycBasisPowDec rescalePow rescaleDecCEltCyccycPowcycDeccycCRTcycCRTCcycCRTEcycPCcycPE scalarCycuncycPowuncycDecuncycCRT advisePow adviseDec adviseCRTembedtwace coeffsCycliftCycliftPowliftDecunzipCyc$fProtoableCyc$fArbitraryCyc $fRandomCyc $fNFDataCyc$fCorrectkgadCyc$fDecomposekgadCyc$fGadgetkgadCyc$fRescaleCycCyc(,)b$fRescaleCycCycab$fReduceCycCyc$fCGFCyc$fCCyc$fCCyc0$fEqCyc$fCCyc1 ExtendLinIdxLinear linearDecevalLin extendLin $fLift'Linear$fReduceLinearLinear $fCLinear$fNFDataLinearRLWECtxSamplesample errorTerm errorGSqNorm errorBoundRLWRCtx roundedProdSingIghc-prim GHC.TypesIntEquals_1627476497Compare_1627476768Equals_1627482301Case_1627482352Case_1627482365Compare_1627482370Compare_1627476768Sym0#Compare_1627476768Sym0KindInferenceCompare_1627476768Sym1#Compare_1627476768Sym1KindInferenceCompare_1627476768Sym2AddPosSym0KindInferenceAddPosSym1KindInference AddPosSym2SubPosSym0KindInferenceSubPosSym1KindInference SubPosSym2SSym0KindInferenceSOSSD:R:DemoteRepPosKProxyCompare_1627482370Sym0#Compare_1627482370Sym0KindInferenceCompare_1627482370Sym1#Compare_1627482370Sym1KindInferenceCompare_1627482370Sym2!Let1627482357Scrutinee_1627482227%Let1627482357Scrutinee_1627482227Sym02Let1627482357Scrutinee_1627482227Sym0KindInference%Let1627482357Scrutinee_1627482227Sym12Let1627482357Scrutinee_1627482227Sym1KindInference%Let1627482357Scrutinee_1627482227Sym2!Let1627482344Scrutinee_1627482229%Let1627482344Scrutinee_1627482229Sym02Let1627482344Scrutinee_1627482229Sym0KindInference%Let1627482344Scrutinee_1627482229Sym12Let1627482344Scrutinee_1627482229Sym1KindInference%Let1627482344Scrutinee_1627482229Sym2D1Sym0KindInferenceD0Sym0KindInferenceSB1SD0SD1D:R:DemoteRepBinKProxybytestring-0.10.8.1Data.ByteString.Lazy.Internal ByteString,numeric-prelude-0.4.2-AxnCLRTDf88Ccu2lqsej2qMathObj.MatrixTMathObj.PolynomialAlgebra.PrincipalIdealDomainAlgebra.RealIntegralAlgebra.AbsoluteAlgebra.ToInteger GHC.ClassesOrdAlgebra.RealTranscendentalAlgebra.TranscendentalAlgebra.AlgebraicAlgebra.RealFieldAlgebra.RealRing Algebra.FieldAlgebra.ToRationalAlgebra.Module Algebra.RingAlgebra.AdditiveAlgebra.ZeroTestable integer-gmpGHC.Integer.TypeInteger $fNFDataT $fCDoubleGHC.Base++GHC.PrimseqGHC.Listfilterzip System.IOprint Data.Tuplefstsnd otherwisemap$GHC.Real realToFracGHC.EnumBoundedminBoundmaxBoundEnumenumFrom enumFromThenenumFromThenTo enumFromTofromEnumtoEnumsuccpredEq==/=Monad>>=>>returnfailFunctorfmap<$>=><<=compareGHC.ReadRead readsPrecreadListGHC.ShowShow showsPrecshowshowList Data.Foldablefoldrnulllengthfoldlfoldl1foldr1maximumminimumelemData.TraversablemapMsequenceBoolFalseTrueCharDoubleFloatMaybeNothingJustOrderingLTEQGTIO Data.EitherEitherLeftRight takeWhilereadIOreadLn appendFile writeFilereadFileinteract getContentsgetLinegetCharputStrLnputStrputChar Text.ReadreadreadsGHC.IO.ExceptionioErrornotElemallanyorand concatMapconcat sequence_mapM_GHC.IOFilePath userErrorIOErroreither Data.OldListunwordswordsunlineslineslex readParenText.ParserCombinators.ReadPReadS showParen showStringshowCharshowsShowSunzip3unzipzipWith3zipWithzip3!!lookupreversebreakspansplitAtdroptake dropWhilecycle replicaterepeatiteratescanr1scanrscanl1scanlinitlasttailhead Data.MaybemaybeuncurrycurryasTypeOf$!flip.constid=<<StringGHC.Err undefinederror&&||notatan2approxRationaltruncateroundceilingfloor splitFractionfraction*>^?piexplog**logBasesincostanasinacosatansinhcoshtanhasinhacoshatanhsqrt^/ fieldPower ringPower fromIntegral toIntegerquotremquotRem toRational fromRationalrecip fromRational'^- Number.Ratio% numerator denominatorRationalsignumextendedEuclideuclid extendedGCDgcdlcm Algebra.UnitsisUnit stdAssociatestdUnit stdUnitInvoddevendividesmoddivproduct1productsqr fromIntegeroneisZerosum1sumsubtract+-negatezeroNumericPrelude.Basecatch(utility-ht-0.0.11-BVpr5tWJXMj5StSkdnqVlqData.Bool.HT.Private ifThenElse $fCComplex3 V_Complex MV_Complex $fEltComplex$fRandomComplex$fNFDataComplexD:R:VectorComplex0 factorize' factorizeunPFEquals_1627768447Equals_1627768458Equals_1627768469Compare_1627768522ppMulppsMulCase_1627772185 ppsOddRadppsDiv ppsDividesppsLCMppsGCDCase_1627778672Case_1627778792Case_1627778828Case_1627778864Case_1627778961Case_1627779157Case_1627779285Case_1627801854Compare_1627768522Sym0#Compare_1627768522Sym0KindInferenceCompare_1627768522Sym1#Compare_1627768522Sym1KindInferenceCompare_1627768522Sym2UnPUnPSym0UnPSym0KindInferenceUnPSym1ExponentPPSym0ExponentPPSym0KindInferenceExponentPPSym1 PrimePPSym0PrimePPSym0KindInference PrimePPSym1UnPPSym0UnPPSym0KindInferenceUnPPSym1UnFSym0UnFSym0KindInferenceUnFSym1FSym0FSym0KindInferenceFSym1PPSym0PPSym0KindInferencePPSym1PSym0PSym0KindInferencePSym1SFSPPSPsPrimePP sExponentPPsUnPD:R:DemoteRepFactoredKProxyPpsMulPpMul FPPMulSym0FPPMulSym0KindInference FPPMulSym1FPPMulSym1KindInference FPPMulSym2FMulSym0FMulSym0KindInferenceFMulSym1FMulSym1KindInferenceFMulSym2 PpsMulSym0PpsMulSym0KindInference PpsMulSym1PpsMulSym1KindInference PpsMulSym2 PpMulSym0PpMulSym0KindInference PpMulSym1PpMulSym1KindInference PpMulSym2!Let1627772159Scrutinee_1627772066%Let1627772159Scrutinee_1627772066Sym02Let1627772159Scrutinee_1627772066Sym0KindInference%Let1627772159Scrutinee_1627772066Sym12Let1627772159Scrutinee_1627772066Sym1KindInference%Let1627772159Scrutinee_1627772066Sym22Let1627772159Scrutinee_1627772066Sym2KindInference%Let1627772159Scrutinee_1627772066Sym32Let1627772159Scrutinee_1627772066Sym3KindInference%Let1627772159Scrutinee_1627772066Sym42Let1627772159Scrutinee_1627772066Sym4KindInference%Let1627772159Scrutinee_1627772066Sym5Let1627772083PpLet1627772083PpsLet1627772083Pp'Let1627772083PpSym0 Let1627772083PpSym0KindInferenceLet1627772083PpSym1 Let1627772083PpSym1KindInferenceLet1627772083PpSym2 Let1627772083PpSym2KindInferenceLet1627772083PpSym3 Let1627772083PpSym3KindInferenceLet1627772083PpSym4 Let1627772083PpSym4KindInferenceLet1627772083PpSym5Let1627772083PpsSym0!Let1627772083PpsSym0KindInferenceLet1627772083PpsSym1!Let1627772083PpsSym1KindInferenceLet1627772083PpsSym2!Let1627772083PpsSym2KindInferenceLet1627772083PpsSym3!Let1627772083PpsSym3KindInferenceLet1627772083PpsSym4!Let1627772083PpsSym4KindInferenceLet1627772083PpsSym5Let1627772083Pp'Sym0!Let1627772083Pp'Sym0KindInferenceLet1627772083Pp'Sym1!Let1627772083Pp'Sym1KindInferenceLet1627772083Pp'Sym2!Let1627772083Pp'Sym2KindInferenceLet1627772083Pp'Sym3!Let1627772083Pp'Sym3KindInferenceLet1627772083Pp'Sym4!Let1627772083Pp'Sym4KindInferenceLet1627772083Pp'Sym5sPpMulsPpsMulsFMulsFPPMul#D:R:ApplyPrimePower(->)FPPMulSym0l0PpsGCDPpsLCM PpsDividesPpsDiv PpsOddRadPToFSym0PToFSym0KindInferencePToFSym1 PToPPSym0PToPPSym0KindInference PToPPSym1 PpToFSym0PpToFSym0KindInference PpToFSym1FGCDSym0FGCDSym0KindInferenceFGCDSym1FGCDSym1KindInferenceFGCDSym2FLCMSym0FLCMSym0KindInferenceFLCMSym1FLCMSym1KindInferenceFLCMSym2 FDividesSym0FDividesSym0KindInference FDividesSym1FDividesSym1KindInference FDividesSym2FDivSym0FDivSym0KindInferenceFDivSym1FDivSym1KindInferenceFDivSym2FOddRadicalSym0FOddRadicalSym0KindInferenceFOddRadicalSym1 PpsGCDSym0PpsGCDSym0KindInference PpsGCDSym1PpsGCDSym1KindInference PpsGCDSym2 PpsLCMSym0PpsLCMSym0KindInference PpsLCMSym1PpsLCMSym1KindInference PpsLCMSym2PpsDividesSym0PpsDividesSym0KindInferencePpsDividesSym1PpsDividesSym1KindInferencePpsDividesSym2 PpsDivSym0PpsDivSym0KindInference PpsDivSym1PpsDivSym1KindInference PpsDivSym2 PpsOddRadSym0PpsOddRadSym0KindInference PpsOddRadSym1!Let1627779251Scrutinee_1627778632%Let1627779251Scrutinee_1627778632Sym02Let1627779251Scrutinee_1627778632Sym0KindInference%Let1627779251Scrutinee_1627778632Sym12Let1627779251Scrutinee_1627778632Sym1KindInference%Let1627779251Scrutinee_1627778632Sym22Let1627779251Scrutinee_1627778632Sym2KindInference%Let1627779251Scrutinee_1627778632Sym32Let1627779251Scrutinee_1627778632Sym3KindInference%Let1627779251Scrutinee_1627778632Sym42Let1627779251Scrutinee_1627778632Sym4KindInference%Let1627779251Scrutinee_1627778632Sym52Let1627779251Scrutinee_1627778632Sym5KindInference%Let1627779251Scrutinee_1627778632Sym6Let1627779184YsLet1627779184XsLet1627779184YsSym0 Let1627779184YsSym0KindInferenceLet1627779184YsSym1 Let1627779184YsSym1KindInferenceLet1627779184YsSym2 Let1627779184YsSym2KindInferenceLet1627779184YsSym3 Let1627779184YsSym3KindInferenceLet1627779184YsSym4 Let1627779184YsSym4KindInferenceLet1627779184YsSym5 Let1627779184YsSym5KindInferenceLet1627779184YsSym6Let1627779184XsSym0 Let1627779184XsSym0KindInferenceLet1627779184XsSym1 Let1627779184XsSym1KindInferenceLet1627779184XsSym2 Let1627779184XsSym2KindInferenceLet1627779184XsSym3 Let1627779184XsSym3KindInferenceLet1627779184XsSym4 Let1627779184XsSym4KindInferenceLet1627779184XsSym5 Let1627779184XsSym5KindInferenceLet1627779184XsSym6!Let1627779123Scrutinee_1627778634%Let1627779123Scrutinee_1627778634Sym02Let1627779123Scrutinee_1627778634Sym0KindInference%Let1627779123Scrutinee_1627778634Sym12Let1627779123Scrutinee_1627778634Sym1KindInference%Let1627779123Scrutinee_1627778634Sym22Let1627779123Scrutinee_1627778634Sym2KindInference%Let1627779123Scrutinee_1627778634Sym32Let1627779123Scrutinee_1627778634Sym3KindInference%Let1627779123Scrutinee_1627778634Sym42Let1627779123Scrutinee_1627778634Sym4KindInference%Let1627779123Scrutinee_1627778634Sym52Let1627779123Scrutinee_1627778634Sym5KindInference%Let1627779123Scrutinee_1627778634Sym6Let1627778990Pp'Let1627778990YsLet1627778990PpLet1627778990XsLet1627778990Pp'Sym0!Let1627778990Pp'Sym0KindInferenceLet1627778990Pp'Sym1!Let1627778990Pp'Sym1KindInferenceLet1627778990Pp'Sym2!Let1627778990Pp'Sym2KindInferenceLet1627778990Pp'Sym3!Let1627778990Pp'Sym3KindInferenceLet1627778990Pp'Sym4!Let1627778990Pp'Sym4KindInferenceLet1627778990Pp'Sym5!Let1627778990Pp'Sym5KindInferenceLet1627778990Pp'Sym6Let1627778990YsSym0 Let1627778990YsSym0KindInferenceLet1627778990YsSym1 Let1627778990YsSym1KindInferenceLet1627778990YsSym2 Let1627778990YsSym2KindInferenceLet1627778990YsSym3 Let1627778990YsSym3KindInferenceLet1627778990YsSym4 Let1627778990YsSym4KindInferenceLet1627778990YsSym5 Let1627778990YsSym5KindInferenceLet1627778990YsSym6Let1627778990PpSym0 Let1627778990PpSym0KindInferenceLet1627778990PpSym1 Let1627778990PpSym1KindInferenceLet1627778990PpSym2 Let1627778990PpSym2KindInferenceLet1627778990PpSym3 Let1627778990PpSym3KindInferenceLet1627778990PpSym4 Let1627778990PpSym4KindInferenceLet1627778990PpSym5 Let1627778990PpSym5KindInferenceLet1627778990PpSym6Let1627778990XsSym0 Let1627778990XsSym0KindInferenceLet1627778990XsSym1 Let1627778990XsSym1KindInferenceLet1627778990XsSym2 Let1627778990XsSym2KindInferenceLet1627778990XsSym3 Let1627778990XsSym3KindInferenceLet1627778990XsSym4 Let1627778990XsSym4KindInferenceLet1627778990XsSym5 Let1627778990XsSym5KindInferenceLet1627778990XsSym6Let1627778976XsLet1627778976XsSym0 Let1627778976XsSym0KindInferenceLet1627778976XsSym1 Let1627778976XsSym1KindInferenceLet1627778976XsSym2!Let1627778927Scrutinee_1627778640%Let1627778927Scrutinee_1627778640Sym02Let1627778927Scrutinee_1627778640Sym0KindInference%Let1627778927Scrutinee_1627778640Sym12Let1627778927Scrutinee_1627778640Sym1KindInference%Let1627778927Scrutinee_1627778640Sym22Let1627778927Scrutinee_1627778640Sym2KindInference%Let1627778927Scrutinee_1627778640Sym32Let1627778927Scrutinee_1627778640Sym3KindInference%Let1627778927Scrutinee_1627778640Sym42Let1627778927Scrutinee_1627778640Sym4KindInference%Let1627778927Scrutinee_1627778640Sym52Let1627778927Scrutinee_1627778640Sym5KindInference%Let1627778927Scrutinee_1627778640Sym6Let1627778893XsLet1627778893XsSym0 Let1627778893XsSym0KindInferenceLet1627778893XsSym1 Let1627778893XsSym1KindInferenceLet1627778893XsSym2 Let1627778893XsSym2KindInferenceLet1627778893XsSym3 Let1627778893XsSym3KindInferenceLet1627778893XsSym4 Let1627778893XsSym4KindInferenceLet1627778893XsSym5 Let1627778893XsSym5KindInferenceLet1627778893XsSym6!Let1627778830Scrutinee_1627778646%Let1627778830Scrutinee_1627778646Sym02Let1627778830Scrutinee_1627778646Sym0KindInference%Let1627778830Scrutinee_1627778646Sym12Let1627778830Scrutinee_1627778646Sym1KindInference%Let1627778830Scrutinee_1627778646Sym22Let1627778830Scrutinee_1627778646Sym2KindInference%Let1627778830Scrutinee_1627778646Sym32Let1627778830Scrutinee_1627778646Sym3KindInference%Let1627778830Scrutinee_1627778646Sym42Let1627778830Scrutinee_1627778646Sym4KindInference%Let1627778830Scrutinee_1627778646Sym52Let1627778830Scrutinee_1627778646Sym5KindInference%Let1627778830Scrutinee_1627778646Sym6!Let1627778794Scrutinee_1627778644%Let1627778794Scrutinee_1627778644Sym02Let1627778794Scrutinee_1627778644Sym0KindInference%Let1627778794Scrutinee_1627778644Sym12Let1627778794Scrutinee_1627778644Sym1KindInference%Let1627778794Scrutinee_1627778644Sym22Let1627778794Scrutinee_1627778644Sym2KindInference%Let1627778794Scrutinee_1627778644Sym32Let1627778794Scrutinee_1627778644Sym3KindInference%Let1627778794Scrutinee_1627778644Sym42Let1627778794Scrutinee_1627778644Sym4KindInference%Let1627778794Scrutinee_1627778644Sym52Let1627778794Scrutinee_1627778644Sym5KindInference%Let1627778794Scrutinee_1627778644Sym6!Let1627778758Scrutinee_1627778642%Let1627778758Scrutinee_1627778642Sym02Let1627778758Scrutinee_1627778642Sym0KindInference%Let1627778758Scrutinee_1627778642Sym12Let1627778758Scrutinee_1627778642Sym1KindInference%Let1627778758Scrutinee_1627778642Sym22Let1627778758Scrutinee_1627778642Sym2KindInference%Let1627778758Scrutinee_1627778642Sym32Let1627778758Scrutinee_1627778642Sym3KindInference%Let1627778758Scrutinee_1627778642Sym42Let1627778758Scrutinee_1627778642Sym4KindInference%Let1627778758Scrutinee_1627778642Sym52Let1627778758Scrutinee_1627778642Sym5KindInference%Let1627778758Scrutinee_1627778642Sym6Let1627778691YsLet1627778691PpLet1627778691YsSym0 Let1627778691YsSym0KindInferenceLet1627778691YsSym1 Let1627778691YsSym1KindInferenceLet1627778691YsSym2 Let1627778691YsSym2KindInferenceLet1627778691YsSym3 Let1627778691YsSym3KindInferenceLet1627778691YsSym4 Let1627778691YsSym4KindInferenceLet1627778691YsSym5 Let1627778691YsSym5KindInferenceLet1627778691YsSym6Let1627778691PpSym0 Let1627778691PpSym0KindInferenceLet1627778691PpSym1 Let1627778691PpSym1KindInferenceLet1627778691PpSym2 Let1627778691PpSym2KindInferenceLet1627778691PpSym3 Let1627778691PpSym3KindInferenceLet1627778691PpSym4 Let1627778691PpSym4KindInferenceLet1627778691PpSym5 Let1627778691PpSym5KindInferenceLet1627778691PpSym6!Let1627778659Scrutinee_1627778648%Let1627778659Scrutinee_1627778648Sym02Let1627778659Scrutinee_1627778648Sym0KindInference%Let1627778659Scrutinee_1627778648Sym12Let1627778659Scrutinee_1627778648Sym1KindInference%Let1627778659Scrutinee_1627778648Sym22Let1627778659Scrutinee_1627778648Sym2KindInference%Let1627778659Scrutinee_1627778648Sym3 sPpsOddRadsPpsDiv sPpsDividessPpsLCMsPpsGCD sFOddRadicalsFDiv sFDividessFLCMsFGCD#D:R:ApplyPrimeBinFactoredPToFSym0l0 PFreeSym0PFreeSym0KindInference PFreeSym1PFreeSym1KindInference PFreeSym2Let1627801785GoLet1627801785GoSym0 Let1627801785GoSym0KindInferenceLet1627801785GoSym1 Let1627801785GoSym1KindInferenceLet1627801785GoSym2 Let1627801785GoSym2KindInferenceLet1627801785GoSym3!Let1627801828Scrutinee_1627801770%Let1627801828Scrutinee_1627801770Sym02Let1627801828Scrutinee_1627801770Sym0KindInference%Let1627801828Scrutinee_1627801770Sym12Let1627801828Scrutinee_1627801770Sym1KindInference%Let1627801828Scrutinee_1627801770Sym22Let1627801828Scrutinee_1627801770Sym2KindInference%Let1627801828Scrutinee_1627801770Sym32Let1627801828Scrutinee_1627801770Sym3KindInference%Let1627801828Scrutinee_1627801770Sym42Let1627801828Scrutinee_1627801770Sym4KindInference%Let1627801828Scrutinee_1627801770Sym5Let1627801802PpLet1627801802PpSym0 Let1627801802PpSym0KindInferenceLet1627801802PpSym1 Let1627801802PpSym1KindInferenceLet1627801802PpSym2 Let1627801802PpSym2KindInferenceLet1627801802PpSym3 Let1627801802PpSym3KindInferenceLet1627801802PpSym4 Let1627801802PpSym4KindInferenceLet1627801802PpSym5sPFree coerceFDivs coerceGCD D:R:ApplyPrimeBin(->)PFreeSym0l0 IZipVector&vector-0.11.0.0-6uB77qGCxR6GPLxI2sqsX3 Data.VectorVector Applicativepure unIZipVector iZipVectorunzipIZVrepl $fCVector$fApplicativeIZipVector(crypto-api-0.13.2-KzqOT4IoLuc1Lbq3hxt3Xl Crypto.RandomCryptoRandomGen!random-1.1-54KmMHXjttlERYcr1mvsAe System.Random RandomGen*MonadRandom-0.4.2.3-BeY4MXl2TWH5X5ex76pU0BControl.Monad.RandomRandTfromJust-tagged-transformer-0.8-IWMRH1mTzxZ4xSsHZktN9YData.Functor.Trans.TaggedTaggedV_MaybeMV_MaybeD:R:VectorMaybe0 Data.Proxy asProxyTypeOfProxyKProxywitnessTtagTWith untagTSelftagTSelfunproxyTproxyTasTaggedTypeOf reflectedM reflected mapTaggedTretagtagTwitnesstagWith untagSelftagSelfunproxyproxyuntagtagTaggedTTagTuntagTcrtInfoC omegaPowC powTraceschunksOfsizePP isPrimitivedotptrace'ppKron twCRTsPPow gCRTPrime gInvCRTPrime indexToPow indexToZms zmsToIndex zmsToIndexPP toIndexPair baseIndexDec fromIndexPairMNilMKronKronCMCfKrongCRTPPow gInvCRTPPowindexToPowPPowindexToZmsPPow baseWrappermergePPstotients ESentinel CSentinel crtSentinel crtCSentinel crtESentinel scalarCRTCScrtCScrtInvCS mulGCRTCS divGCRTCS embedCRTCS twaceCRTCSpolyMap coeffsToPolydeepseq-1.4.2.0Control.DeepSeqdeepseqFoldable TraversabletoPowCECRTCCRTE realGaussian realGaussians iterateWhile iterateUntilMTransIdTSnocArrreplMfTensorppTensordimtrans.*@*evalevalMexposeunexposemulMatmulDiag scalarPow'forcesumSsumAllSTransC TensorabledimCevalC$fArbitraryArr $fRandomArr $fNFDataArray$fCArr$fCArr0$fCArr1#repa-3.4.1.1-8WegHPlyLUhBnx1jAMPd7t#Data.Array.Repa.Operators.ReductionequalsSequalsPfoldAllPfoldAllSfoldPfoldS!Data.Array.Repa.Operators.Mapping StructuredTRsmapszipWith#Data.Array.Repa.Operators.SelectionselectPData.Array.Repa.Repr.Unboxedunzip6unzip5unzip4zip6zip5zip4 toUnboxed fromUnboxedfromListUnboxedcomputeUnboxedPcomputeUnboxedSUData.Array.Repa.EvalnowsuspendedCopyPcopyScopyPsuspendedComputePcomputeScomputeP Data.Array.Repa.Eval.InterleavedfillInterleavedP$Data.Array.Repa.Operators.Interleave interleave4 interleave3 interleave2$Data.Array.Repa.Operators.IndexSpacesliceextendbackpermuteDft backpermuteextract transposeappendreshape#Data.Array.Repa.Operators.Traversal traverse4 traverse3 traverse2traverseData.Array.Repa.Repr.Delayeddelay toFunction fromFunctionData.Array.Repa.Eval.ChunkedfillChunkedIOP fillChunkedP fillBlock2S fillLinearSData.Array.Repa.Eval.CursoredfillCursoredBlock2SfillCursoredBlock2P fillBlock2PData.Array.Repa.Eval.SelectionselectChunkedPselectChunkedSData.Array.Repa.SliceAllAny FullShape SliceShapeSlice sliceOfFull fullOfSliceData.Array.Repa.Indexix5ix4ix3ix2ix1Z:.DIM0DIM1DIM2DIM3DIM4DIM5Data.Array.Repa.Eval.LoadLoadloadSloadP LoadRange loadRangeS loadRangePData.Array.Repa.Eval.TargetTargetMVecnewMVecunsafeWriteMVecunsafeFreezeMVec deepSeqMVec touchMVecData.Array.Repa.Base deepSeqArrays!Data.Array.Repa.Repr.HintSmallASmallADelayedData.Array.Repa.Repr.ByteString AByteStringData.Array.Repa.Repr.ForeignPtr AForeignPtr#Data.Array.Repa.Repr.HintInterleave AInterleave Data.Array.Repa.Repr.PartitionedAPartAUnboxedData.Array.Repa.Repr.Undefined AUndefinedData.Array.Repa.Repr.Cursored ACursoredData.Array.Repa.Repr.VectorAVector makeCursor shiftCursor loadCursorcursoredExtentSourceArrayindex unsafeIndexextent linearIndexunsafeLinearIndex deepSeqArrayData.Array.Repa.Shape showShapeinShapeShaperankzeroDimunitDim intersectDimaddDim sizeIsValidtoIndex fromIndex inShapeRange listOfShape shapeOfListdeepSeqData.Array.Repa.Eval.EltElttouchData.Vector.Unboxed.BaseUnbox scalarCRT'mulGCRT'divGCRT'gCRTgInvCRTfCRTfCRTInv wrapVectorppDFT ppDFTInv'ppCRT ppCRTInv' butterflypDFTpDFTInv'pCRTpCRTInv'ppTwid ppTwidHat tGaussianDec'fEpE gSqNormDec' fGramDec'pGramDecfLfLInvfGPowfGDecfGInvPowfGInvDecdivCheck wrapGInv'pWrappLpLInvpGPowpGDec pGInvPow' pGInvDec'principalRootUnitygadgetZcorrectZZqB V_ZqBasic MV_ZqBasicreduce'decode'mhatInvgadlenD:R:VectorZqBasic0D:R:MVectorsZqBasic0V_RRqMV_RRqD:R:VectorRRq0D:R:MVectorsRRq0 Dispatch'dcrtdcrtinv dgaussdecdldlinvdnormdmulgpowdmulgdecdginvpowdginvdecdmulDispatchCPPmarshalFactors withPtrArrayTuple numComponentsZqTupleModPairs getModuliEqCTypeCTypeOfRRqDInt64DDoubleDComplexDZqB64Dp'e'mulCmulRqtensorGaussianDec tensorCRTInvCtensorCRTInvRq tensorCRTC tensorCRTRqtensorGInvDecCtensorGInvDecRqtensorGInvDecRtensorGInvPowCtensorGInvPowRqtensorGInvPowR tensorGDecC tensorGDecRq tensorGDecR tensorGPowC tensorGPowRq tensorGPowR tensorNormSqD tensorNormSqR tensorLInvCtensorLCtensorLInvDouble tensorLDouble tensorLInvRq tensorLRq tensorLInvRtensorLRstore$fDispatch'Int64DInt64$fDispatch'DoubleDDouble$fDispatch'ComplexDr$fDispatch'ZqB64Dr$fDispatch'RRqDr$fTupleTYPE(,) $fTupleka$fZqTupleTYPE(,)$fZqTupleTYPERRq$fZqTupleTYPEZqBasic $fStorable(,) $fShowCPP $fStorableCPPForeign.Marshal.Array withArrayorderpartitionCosetscosets backpermute'Data.Vector.Generic embedPow' embedDec' embedCRT'coeffs' twacePowDec' powBasisPow' crtSetDec'CT' coerceCoeffscoerce coerceBasisEmTwZVunCTtoCTtoZVzvToCT'wrapwrapMcoerceTwcoerceEmmulGPow'divGPow' withBasicArgs basicDispatchctCRTctCRTInvcheckDiv divIfDivis cZipDispatchcDispatchGaussianruruInv twaceCRT' $fDefault:. $fDefaultZV_DIM1MV_DIM1 D:R:Vector:.0zvToArrtoRTembed'SubtoPow'toDec'toCRT'CRTScalartoZLfromZLRD