# Tag Info

7

Thanks for the question! You are correct that there is a bug here. Indeed, the sentence "choose $\mathbf{b}_i$ s.t. $\ldots$" makes no sense: the LHS is in $H$, but the RHS may not be. Fortunately, there is a simple fix which guarantees $\mathbf{y}'_i \in H$. (This must have been what we intended in the first place, based on how the rest of the proof ...

1

That wouldn't appear to work. In a known plaintext attack, that is, where the attacker knows both $m$ and $c$, he can compute: $$e = c - m * B$$ recovering the secret key. Alternatively, in a ciphertext-only scenario, the attacker could take two ciphertexts $c, c'$ and compute $$(c - c') * B^{-1} = m - m'$$ resulting in the difference between the two ...

4

Yes the Bernstein attack is applicable but the impact of the attack is reduced because the party generating the parameter is also going to be a legitimate participant of the key exchange. Here is why the attack does indeed apply. Consider a case where Bob and Alice wish to conduct a key exchange using the New Hope Lattice-Based Key Exchange. Bob will be ...

Top 50 recent answers are included