Naively, when one applies rounding to a uniform random value one anticipates that the change is uniformly distributed. In lattice-based cryptography, is there a formal notion or proof of equivalence between learning with rounding and learning with uniform error schemes?

Secondly has anyone proposed a dynamic version of learning with rounding where the level of rounding is chosen to optimise the bandwidth savings in the rounded cryptogram. e.g. I might be prepared to round off the last three bits of a binary value 10001010100000000110 allowing me to round to nine significant figures whereas a binary value 1001001101010110101 might be rounded less.

  • $\begingroup$ Would this be of any help? $\endgroup$
    – swineone
    Mar 7, 2023 at 20:47
  • $\begingroup$ @swineone As I recall, that thread was a good example of the unedifying exchanges around the NIST process. I'm reluctant to revisit the thread, but if there is an objective, relevant observation in there, I'd be grateful to anyone that can extract it. $\endgroup$
    – Daniel S
    Mar 7, 2023 at 20:58
  • 1
    $\begingroup$ Re first question, there are restricted reductions from LWE to LWR: see this paper. $\endgroup$
    – ckamath
    Mar 7, 2023 at 21:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.