Timeline for LWE encryption: Errors for encrypted messages
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 16, 2023 at 14:21 | comment | added | Daniel S | If the entries to $\mathbf r$, $\mathbf s$, $\mathbf e_0$ and $\mathbf e_1$ are all less than $\sqrt{q/4(m+n+1)}$ an $e$ is less than $q/4(m+n+1)$ then the accumulated error is sure to be less than $q/4$ is size and so successful decryption would be assured. OTOH It is safer cryptanalytically to allow large entries. The paper that you quote suggests sampling these values from a discrete Gaussian. Choosing a Gaussian with variance around $q/4(m+n+1)$ will produce few failures. In practical implementations such as Kyber a centred binomial distribution is preferred for ease of implementation. | |
| Mar 15, 2023 at 11:03 | comment | added | user108142 | Additionally, can I know how to generate errors for ciphertext (u, v), where they match with the binary message m? | |
| Mar 15, 2023 at 9:41 | comment | added | user108142 | Thanks, can I know what range do the errors of the ciphertext (u, v) in the encryption process fall into? How can I derive the values for them? | |
| Mar 14, 2023 at 13:14 | history | edited | Daniel S | CC BY-SA 4.0 |
added 215 characters in body
|
| Mar 14, 2023 at 13:07 | history | answered | Daniel S | CC BY-SA 4.0 |