Naively, when one applies rounding to a uniform random value one anticipates that the change is uniformly distributed. In lattice-based cryptography, is there a formal notion or proof of equivalence between learning with rounding and learning with uniform error schemes?

Secondly has anyone proposed a dynamic version of learning with rounding where the level of rounding is chosen to optimise the bandwidth savings in the rounded cryptogram. e.g. I might be prepared to round off the last three bits of a binary value 10001010100000000110 allowing me to round to nine significant figures whereas a binary value 1001001101010110101 might be rounded less.

  • $\begingroup$ Would this be of any help? $\endgroup$
    – swineone
    Mar 7 at 20:47
  • $\begingroup$ @swineone As I recall, that thread was a good example of the unedifying exchanges around the NIST process. I'm reluctant to revisit the thread, but if there is an objective, relevant observation in there, I'd be grateful to anyone that can extract it. $\endgroup$
    – Daniel S
    Mar 7 at 20:58
  • 1
    $\begingroup$ Re first question, there are restricted reductions from LWE to LWR: see this paper. $\endgroup$
    – ckamath
    Mar 7 at 21:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.