Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
in learning with error encryption scheme (e.g. in Kyber scheme). there are two vectors: $u = r^t A + e_2$ and $v= r^t * pk + e_3 + \lfloor \frac{q}{2}\rceil m$ such that $pk = As +e_1$.
my question is does the encryption still secure if we omit $e_3$ so $v = r^t * pk + \lfloor \frac{q}{2}\rceil m $.
as far as I know (and my current level of understanding) the answer is yes since the underlying problem is (Mod/Ring/Primal) LWE problem.
No, it is no longer secure. Kyber is an instantiation of a cryptosystem called "LPR Encryption". Its public key is an LWE encryption of zero $(A, As + e_1)$. Encryption proceeds by computing
To argue security, you first
Argue under the LWE assumption that $As + e_1$ is pseudorandom, i.e. you can replace it with a uniformly random string.
Argue that $v$ is now of the form $\langle r,pk\rangle + (q/2)m+e_3$, i.e. is an LWE encryption of $m$. You further need to argue that releasing $(rA^t + e_2)$ does not hurt security, but ignore this for now (it isn't needed to show the insecurity of your proposal).
Under your modification, this second step would no longer work, as $\langle r, pk\rangle + (q/2)m$ is not an LWE encryption (and is instead a "noiseless LWE encryption"). Noiseless LWE encryptions are known to be susceptible to simple attacks, say using Gaussian elimination. So one could attack your cryptosystem by viewing ($pk, r^tpk + (q/2)m)$ as a noiseless LWE encryption of $m$, and running standard attacks in this setting.
The way I reached the above attack was simple --- look at the proof, see what step no longer works, and see if you can attack it. I would highly encourage you to think through things in this way, rather than simply "It uses LWE so it's secure", as reasoning such as that is nearly never sound in cryptography.
