Rotation-Optimal Noncommutative Prefix Scans in Bit-Reversed Homomorphic Layouts

Abstract

Packed homomorphic encryption evaluates slotwise operations in parallel, but nonlocal communication is realized by cyclic rotations whose cost depends on the physical slot layout. We study ordered prefix computation on $n=2^m$ elements of an associative, possibly noncommutative monoid stored in bit-reversed order. A direct transported-predecessor scan uses $m\cdot(m+1)/2$ rotations because one logical shift decomposes into several cyclic displacement classes. We introduce a replicated-aggregate invariant: every slot of an aligned logical block stores the same complete block aggregate. Since these copies are semantically interchangeable, one global rotation per level supplies each slot with a valid sibling aggregate, without reaching the exact logical partner. The resulting inclusive or exclusive scan uses $m$ rotations, depth $m$, two live state vectors, and at most $2\cdot m-1$ packed monoid compositions. In a model where all non-routing operations are slotwise and every cyclic rotation invocation is counted, these bounds are exact: $D^\star(m)=R^\star(m)=m$. Equality is rigid: the $m$ offsets contain exactly one representative of each $2$-adic valuation. With at most $K$ directly keyed offsets, we prove a product lower bound and an exact frontier $K\cdot(2^{m/K}-1)$ whenever $K$ divides $m$. We instantiate the exclusive scan for radix carry and borrow in bit-reversed \CKKS slots, avoiding layout restoration and the final logical-predecessor shift. In our implementation at $m=7$, the replicated scan reduces the direct bit-reversed baseline from $28$ to $7$ rotations, lowers evaluation-key storage by $70.0\%$, lowers peak heap usage by $63.9\%$, and improves isolated scan latency by $19.9\%$. In a depth-$5$ downstream pipeline, retaining six additional modulus levels avoids one bootstrap and gives a mean paired speedup of $4.31\times$ with $95\%$ confidence interval $[3.69,4.92]$.