Add encryption and decryption lowering for CKKS

lib/Dialect/LWE/Conversions/LWEToPolynomial/BUILD

@@ -16,6 +16,7 @@ cc_library(
         ":pass_inc_gen",
         "@heir//lib/Dialect/LWE/IR:Dialect",
         "@heir//lib/Dialect/ModArith/IR:Dialect",
+        "@heir//lib/Dialect/ModArith/IR:TypeInterfaces",
         "@heir//lib/Dialect/Polynomial/IR:Dialect",
         "@heir//lib/Dialect/RNS/IR:Dialect",
         "@heir//lib/Dialect/Random/IR:Dialect",

lib/Dialect/LWE/Conversions/LWEToPolynomial/LWEToPolynomial.td

@@ -7,7 +7,28 @@ def LWEToPolynomial : Pass<"lwe-to-polynomial"> {
   let summary = "Lower `lwe` to `polynomial` dialect.";
 
   let description = [{
-    This pass lowers the `lwe` dialect to `polynomial` dialect.
+    This pass lowers the `lwe` dialect to `polynomial` dialect, making the
+    polynomial arithmetic behind each ciphertext operation explicit.
+
+    Types are lowered as follows:
+
+    - An RLWE ciphertext made of `N` polynomials, e.g., `(c_0, c_1)`, becomes
+      a `tensor<N x !polynomial.polynomial<...>>` over the ciphertext ring.
+      Tensors of ciphertexts become higher-dimensional tensors of polynomials.
+    - Plaintexts and ring elements become a single polynomial over their ring.
+    - Secret keys become a tensor of one polynomial `s`, and public keys a
+      tensor of two polynomials `(b, a) = (-a * s + e, a)`.
+
+    A ciphertext `(c_0, c_1, ..., c_k)` represents the polynomial
+    `c_0 + c_1 * s + ... + c_k * s^k` in the secret key `s`, so decrypting a
+    two-polynomial ciphertext computes `c_0 + c_1 * s`. Encryption samples its
+    randomness with the `random` dialect, and how the plaintext and noise are
+    combined depends on the ciphertext's encryption type (see
+    `LweEncryptionType`). The plaintext and ciphertext rings must be related
+    as that encryption type expects: e.g., CKKS plaintexts must already be
+    encoded into the ciphertext's ring.
+
+    (* example filepath=tests/Dialect/LWE/Conversions/lwe_to_polynomial/doctest.mlir *)
   }];
 
   let dependentDialects = [

lib/Dialect/LWE/IR/LWEAttributes.td

@@ -259,9 +259,22 @@ def LWE_KeyAttr : AttrDef<LWE_Dialect, "Key"> {
 def LWE_EncryptionTypeEnum : I32EnumAttr<"LweEncryptionType", "An enum attribute representing an encryption method", [
   I32EnumAttrCase<"msb", 0>,
   I32EnumAttrCase<"lsb", 1>,
-  I32EnumAttrCase<"mix", 2>
+  I32EnumAttrCase<"ckks", 2>
 ]> {
     let cppNamespace = "::mlir::heir::lwe";
+    let description = [{
+      Describes how the (already encoded) plaintext polynomial `m` and the
+      encryption noise `e` are combined in a ciphertext, i.e., what
+      `c_0 + c_1 * s` decrypts to:
+
+      - `lsb` (BGV): `m + t * e`, the message is in the least significant
+        bits and the noise is scaled by the plaintext modulus `t`.
+      - `msb` (BFV): `floor(Q/t) * m + e`, the message is scaled to the most
+        significant bits at encryption time and the noise is unscaled.
+      - `ckks` (CKKS): `m + e`, neither is scaled at encryption time. The
+        message is scaled by the CKKS scaling factor during encoding, so the
+        noise sits in the least significant bits below it.
+    }];
 }
 
 def LWE_CiphertextSpaceAttr : AttrDef<LWE_Dialect, "CiphertextSpace", [OpAsmAttrInterface]> {
@@ -303,7 +316,7 @@ def LWE_CiphertextSpaceAttr : AttrDef<LWE_Dialect, "CiphertextSpace", [OpAsmAttr
     ```
 
     The ciphertext encoding info is used to describe the way the plaintext data
-    is encoded into the ciphertext (in the MSB, LSB, or mixed).
+    is encoded into the ciphertext (see `LweEncryptionType`).
 
     The `size` parameter is used to describe the number of polynomials
     comprising the ciphertext. This is typically 2 for RLWE ciphertexts that

lib/Dialect/Secret/Conversions/SecretToCKKS/SecretToCKKS.cpp

@@ -73,7 +73,7 @@ class SecretToCKKSTypeConverter : public SecretToRlweTypeConverter {
   }
 
   lwe::LweEncryptionType getEncryptionType() const override {
-    return lwe::LweEncryptionType::mix;
+    return lwe::LweEncryptionType::ckks;
   }
 };
 

tests/Dialect/JaxiteWord/IR/mnist_ops.mlir

@@ -15,9 +15,9 @@
 !pt = !lwe.lwe_plaintext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
 #ring_rns_L1_1_x1024 = #polynomial.ring<coefficientType = !rns_L1, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
-#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = mix>
-#ciphertext_space_L1_D3 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = mix, size = 3>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
+#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = ckks>
+#ciphertext_space_L1_D3 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = ckks, size = 3>
 !ct_L0 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain_L1_C0>
 !ct_L1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L1_C1>
 !ct_L1_1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding1>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L1_C1>

tests/Dialect/JaxiteWord/IR/ops.mlir

@@ -15,9 +15,9 @@
 !pt = !lwe.lwe_plaintext<plaintext_space = <ring = #ring_f64_1_x8, encoding = #inverse_canonical_encoding>>
 #ring_rns_L0_1_x8 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**8>>
 #ring_rns_L1_1_x8 = #polynomial.ring<coefficientType = !rns_L1, polynomialModulus = <1 + x**8>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x8, encryption_type = mix>
-#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x8, encryption_type = mix>
-#ciphertext_space_L1_D3 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x8, encryption_type = mix, size = 3>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x8, encryption_type = ckks>
+#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x8, encryption_type = ckks>
+#ciphertext_space_L1_D3 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x8, encryption_type = ckks, size = 3>
 !ct_L0 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x8, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain_L7_C0>
 !ct_L1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x8, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L7_C1>
 !ct_L1_1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x8, encoding = #inverse_canonical_encoding1>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L7_C1>

tests/Dialect/JaxiteWord/IR/verifier.mlir

@@ -11,8 +11,8 @@
 !rns_L1 = !rns.rns<!Z1073741441_i64, !Z536870273_i64>
 #ring_rns_L0_1_x8 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**8>>
 #ring_rns_L1_1_x8 = #polynomial.ring<coefficientType = !rns_L1, polynomialModulus = <1 + x**8>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x8, encryption_type = mix>
-#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x8, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x8, encryption_type = ckks>
+#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x8, encryption_type = ckks>
 !pt = !lwe.lwe_plaintext<plaintext_space = <ring = #ring_f64_1_x8, encoding = #encoding>>
 !ct_L0 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x8, encoding = #encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain_L0>
 !ct_L1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x8, encoding = #encoding>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L1>

tests/Dialect/JaxiteWord/Transforms/configure_crypto_context.mlir

@@ -12,9 +12,9 @@
 !rns_L1 = !rns.rns<!Z36028797018652673_i64, !Z35184372121601_i64>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
 #ring_rns_L1_1_x1024 = #polynomial.ring<coefficientType = !rns_L1, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
-#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = mix>
-#ciphertext_space_L1_D3 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = mix, size = 3>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
+#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = ckks>
+#ciphertext_space_L1_D3 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = ckks, size = 3>
 !ct_L0 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain_L1_C0>
 !ct_L1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L1_C1>
 !ct_L1_1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding1>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L1_C1>

tests/Dialect/JaxiteWord/Transforms/configure_crypto_context_defaults.mlir

@@ -12,9 +12,9 @@
 !rns_L1 = !rns.rns<!Z36028797018652673_i64, !Z35184372121601_i64>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
 #ring_rns_L1_1_x1024 = #polynomial.ring<coefficientType = !rns_L1, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
-#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = mix>
-#ciphertext_space_L1_D3 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = mix, size = 3>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
+#ciphertext_space_L1 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = ckks>
+#ciphertext_space_L1_D3 = #lwe.ciphertext_space<ring = #ring_rns_L1_1_x1024, encryption_type = ckks, size = 3>
 !ct_L0 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain_L1_C0>
 !ct_L1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L1_C1>
 !ct_L1_1 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding1>, ciphertext_space = #ciphertext_space_L1, key = #key, modulus_chain = #modulus_chain_L1_C1>

tests/Dialect/Kernel/Transforms/prepare_linear_transforms.mlir

@@ -6,7 +6,7 @@
 #ring_f64_1_x1024 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**1024>>
 !rns_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
 !ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain>
 
 // The ciphertext's chain has current 0, so it sits at level 0; its ring has
@@ -33,7 +33,7 @@ module attributes {backend.lattigo, scheme.ckks} {
 #ring_f64_1_x4096 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**4096>>
 !rns_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_L0_1_x4096 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**4096>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x4096, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x4096, encryption_type = ckks>
 !ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x4096, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain>
 
 // The ciphertext's chain has current 0, so it sits at level 0; use the
@@ -61,7 +61,7 @@ module attributes {backend.lattigo, scheme.ckks,  scheme.requested_slot_count =
 #ring_f64_1_x1024 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**1024>>
 !rns_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
 !ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain>
 
 // A target that does not declare hasKernelLinearTransform skips the

tests/Dialect/Kernel/invalid.mlir

@@ -201,7 +201,7 @@ func.func @test_prepare_slots_too_small() -> !kernel.prepared_linear_transform<l
 #ring_f64_1_x1024 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**1024>>
 !rns_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
 !ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain>
 
 // The ciphertext sits at level 0 (its chain's current); a transform
@@ -240,7 +240,7 @@ func.func @test_input_plaintext(%arg0: tensor<1x!pt>) -> tensor<1x!pt> {
 #ring_f64_1_x1024 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**1024>>
 !rns_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
 !ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain>
 
 // Each ciphertext is transformed independently, so the diagonals must fit in
@@ -262,7 +262,7 @@ func.func @test_multi_ciphertext_diagonals_too_wide(%arg0: tensor<2x!ct>) -> ten
 #ring_f64_1_x1024 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**1024>>
 !rns_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
 !ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain>
 
 // A scalar ciphertext (e.g. after elementwise-to-affine) is still checked.
@@ -283,7 +283,7 @@ func.func @test_scalar_ciphertext_diagonals_too_wide(%arg0: !ct) -> !ct {
 #ring_f64_1_x1024 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**1024>>
 !rns_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
 !ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain>
 
 // A prepared transform is applied per ciphertext as well.
@@ -305,7 +305,7 @@ func.func @test_apply_multi_ciphertext_slots_too_small(%arg0: tensor<2x!ct>) ->
 #ring_f64_1_x1024 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**1024>>
 !rns_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0_1_x1024, encryption_type = ckks>
 !ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L0, key = #key, modulus_chain = #modulus_chain>
 
 func.func @test_apply_scalar_ciphertext_slots_too_small(%arg0: !ct) -> !ct {

tests/Dialect/Kernel/roundtrip.mlir

@@ -17,7 +17,7 @@
 #ring_f64_1_x1024 = #polynomial.ring<coefficientType = f64, polynomialModulus = <1 + x**1024>>
 !rns_ckks_L0 = !rns.rns<!mod_arith.int<36028797018652673 : i64>>
 #ring_rns_ckks_L0_1_x1024 = #polynomial.ring<coefficientType = !rns_ckks_L0, polynomialModulus = <1 + x**1024>>
-#ckks_ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_ckks_L0_1_x1024, encryption_type = mix>
+#ckks_ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_ckks_L0_1_x1024, encryption_type = ckks>
 !ckks_ct = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x1024, encoding = #inverse_canonical_encoding>, ciphertext_space = #ckks_ciphertext_space_L0, key = #ckks_key, modulus_chain = #ckks_modulus_chain>
 
 // CHECK: module

tests/Dialect/LWE/Conversions/lwe_to_lattigo/bootstrap.mlir

@@ -23,8 +23,8 @@
 !rns_L2 = !rns.rns<!Z1106058412451299513_i64, !Z1056763241666817029_i64, !Z957769724367225479_i64>
 #ring_rns_L13_1_x131072 = #polynomial.ring<coefficientType = !rns_L13, polynomialModulus = <1 + x**131072>>
 #ring_rns_L2_1_x131072 = #polynomial.ring<coefficientType = !rns_L2, polynomialModulus = <1 + x**131072>>
-#ciphertext_space_L13 = #lwe.ciphertext_space<ring = #ring_rns_L13_1_x131072, encryption_type = mix>
-#ciphertext_space_L2 = #lwe.ciphertext_space<ring = #ring_rns_L2_1_x131072, encryption_type = mix>
+#ciphertext_space_L13 = #lwe.ciphertext_space<ring = #ring_rns_L13_1_x131072, encryption_type = ckks>
+#ciphertext_space_L2 = #lwe.ciphertext_space<ring = #ring_rns_L2_1_x131072, encryption_type = ckks>
 !ct_L13 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x131072, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L13, key = #key, modulus_chain = #modulus_chain_L13_C13>
 !ct_L2 = !lwe.lwe_ciphertext<plaintext_space = <ring = #ring_f64_1_x131072, encoding = #inverse_canonical_encoding>, ciphertext_space = #ciphertext_space_L2, key = #key, modulus_chain = #modulus_chain_L2_C2>
 

tests/Dialect/LWE/Conversions/lwe_to_lattigo/entry_level_depth.mlir

@@ -13,8 +13,8 @@
 !rns_L2 = !rns.rns<!mod_arith.int<36028797018652673 : i64>, !mod_arith.int<35184372121601 : i64>, !mod_arith.int<35184372744193 : i64>>
 #ring_rns_L0 = #polynomial.ring<coefficientType = !rns_L0, polynomialModulus = <1 + x**1024>>
 #ring_rns_L2 = #polynomial.ring<coefficientType = !rns_L2, polynomialModulus = <1 + x**1024>>
-#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0, encryption_type = mix>
-#ciphertext_space_L2 = #lwe.ciphertext_space<ring = #ring_rns_L2, encryption_type = mix>
+#ciphertext_space_L0 = #lwe.ciphertext_space<ring = #ring_rns_L0, encryption_type = ckks>
+#ciphertext_space_L2 = #lwe.ciphertext_space<ring = #ring_rns_L2, encryption_type = ckks>
 
 // The fully consumed value carries only one chain element, so its own list puts
 // its "top" at level 0 and would report a depth of 0.