Python Implementation of the Number Theoretic Transform (NTT), developed with numpy. NTT PY supports both the cyclic form and negacylic form of the transform.

Ensure all prerequisies are satisfied (pip install -r requirements.txt).

Use ntt for the forward transform:

>>> import numpy as np
>>> from src.ntt import ntt, intt
>>> q = 11; w = 3;
>>> a_hat = ntt(np.array([7, 8, 3, 4, 10]), w, q)
>>> print(a_hat)
[10.  8. 10.  8. 10.]

and intt for the backwards transform:

>>> a = intt(a_hat, w, q)
>>> print(a)
[ 7.  8.  3.  4. 10.]

Import with from src.ntt_n import ntt_n, intt_n and use ntt_n for the forward transform and intt_n for the backward transform.

Given the finite field $\mathbb{Z}_q$ , for $q > 1$ prime, and a primitive $N$ th root of unity over $\mathbb{Z}_q$, $\omega \in \mathbb{Z}_q$, the NTT is the map $\textbf{NTT}: \mathbb{Z}_q^N \rightarrow \mathbb{Z}_q^N $ which sends $(a_0, a_1, ... , a_{N-1})$ to $(\hat{a}_0, \hat{a}_1, ... , \hat{a}_{N-1})$ using the rule:

for $0 \leq k < N$: such is the cyclic form of the transform. Indeed, the vector $(a_0, a_1, ... , a_{N-1})$ is identified with the coefficients of the $\mathbb{Z}_q$ valued polynomial $a_0 + a_1 x + \dotsm + a_{N-1} x^{N-1}$ in the quotient ring $\mathbb{Z}_q[x] / \langle x^N - 1 \rangle $. In this light, the NTT in its cyclic form computes the following ring isomorphism:

which is an expression of the Chinese Remainder Theorem. Note that in the product ring, multiplication is point-wise. Thus, one can easily perform multiplication in $\mathbb{Z}_q[X]$, modulo $x^N - 1$, as follows:

where $\cdot$ is meant to denote the dot product and $\textbf{NTT}^{-1}$ is the inverse NTT, defined by:

Here, we require some $\psi \in \mathbb{Z}_q$ such that $\psi^2 = \omega$. That is, $\psi$ is a $2N$ th root of unity over $\mathbb{Z}_q$. We hence send $(a_0, a_1, ... , a_{N-1})$ to $(\hat{a}_0, \hat{a}_1, ... , \hat{a}_{N-1})$ using the rule:

for $0 \leq k < N$: such is the negacyclic form of the transform. Identifying vectors with polynomials in $\mathbb{Z}_q[x] / \langle x^N + 1 \rangle $, the NTT in negacyclic form computes the ring isomorphism:

Note that here, the inverse transform is: