Questions about the choice of tfhe-ntt parameters

Mr_Fx · March 31, 2026, 10:54am

Hi,

I am interested in using tfhe-ntt and tfhe-rs and would like to ask a few questions:

(a) If I select the parameter sets Concrete_TFHE586 and Concrete_TFHE512 of the lattice-estimator, what are the corresponding parameters for tfhe-ntt?
I think that n (the polynomial size) has to match Concrete_TFHE586 and Concrete_TFHE512 (i.e., 586 and 512), but how to choose the modulus q ?

(b) In tfhe-ntt/examples/mul_poly_prime.rs, I found n=1024 and q=1073479681. Are these values recommended choices?

(c) What is the relationship between the TFHE parameters and NTT parameters? Can the choice of NTT parameters affect the security of TFHE?
Is there an example or tutorial demonstrating how to use tfhe-ntt together with tfhe-rs to perform homomorphic encryption?

IceTDrinker · March 31, 2026, 1:07pm

Could you explain why you want to use the NTT?

Currently the best performing implementation we have is FFT based and we have parameters for it in the library.

Also id you have some code could you share what you are doing? Depending on what you want to do we have some APIs that may be better suited depending on the application.

Regards

Mr_Fx · April 7, 2026, 11:51am

Hi IceTDrinker,

thank you for your help.

I am just curious about the required NTT parameter sizes (N, Q) and I want to see a working example of a TFHE implementation that applies NTT for acceleration. I found the tfhe-rs project and saw a folder in the git called tfhe-ntt and assumed that one can use tfhe-rs with NTT instead of FFT. The performance is not important to me.

IceTDrinker · April 7, 2026, 12:03pm

@Mr_Fx

There are parameters based on an NTT with Q = 2^64 - 2^32 + 1 (goldilocks prime)

github.com/zama-ai/tfhe-rs

tfhe/src/shortint/parameters/v1_6/hpu.rs

3c2cb273d


      
                  message_modulus: MessageModulus(4),
                  carry_modulus: CarryModulus(4),
                  max_noise_level: MaxNoiseLevel::new(5),
                  log2_p_fail: -64.0,
                  post_keyswitch_ciphertext_modulus: CiphertextModulus32::new(1 << 21),
                  ciphertext_modulus: CiphertextModulus::new_native(),
                  modulus_switch_noise_reduction_params: ModulusSwitchType::Standard,
              };
          
          // TUniform parameters set with pfail 2^-128
          pub const V1_6_HPU_PARAM_MESSAGE_2_CARRY_2_KS32_PBS_TUNIFORM_2M128: KeySwitch32PBSParameters =
              KeySwitch32PBSParameters {
                  lwe_dimension: LweDimension(879),
                  glwe_dimension: GlweDimension(1),
                  polynomial_size: PolynomialSize(2048),
                  lwe_noise_distribution: DynamicDistribution::new_t_uniform(3),
                  glwe_noise_distribution: DynamicDistribution::new_t_uniform(17),
                  pbs_base_log: DecompositionBaseLog(23),
                  pbs_level: DecompositionLevelCount(1),
                  ks_base_log: DecompositionBaseLog(2),
                  ks_level: DecompositionLevelCount(8),

however we do not make use of the NTT in higher level APIs in TFHE-rs on CPU today, you will need to take a look at the hpu mockup which makes use of the TFHE-rs low-level APIs to simulate how the HPU (homomorphic processing unit) processes data tfhe-rs/mockups/tfhe-hpu-mockup at 3c2cb273d5647a12ffa662ebca56264ca6b3ed0c · zama-ai/tfhe-rs · GitHub

example where the PBS with “back and forth” NTT is called in the mockup tfhe-rs/mockups/tfhe-hpu-mockup/src/lib.rs at 3c2cb273d5647a12ffa662ebca56264ca6b3ed0c · zama-ai/tfhe-rs · GitHub

Cheers