1
$\begingroup$

based crypto
And I would like to use the lwe estimator to calculate bound for ring LWE

Found in this issue It seems to me I can set up parameters like
params = LWE.Parameters(n=2^14, q=2^438, Xs = ND.Uniform(-1,1,n), Xe=ND.DiscreteGaussian(3.19) My first question is that does "n" mean the terms of the polynomial ring and "q" is the mod q in the ring?
And my second question is that how do I know which parameters do I need to pass in the discrete gaussian to make sure the lwe is parameterized for having say like 128 bits security? Or I need to keep passing parameters and find it?
TIA

$\endgroup$

1 Answer 1

1
$\begingroup$

To answer your first question, yes, the $n$ is the dimension of the of the system and $q$ is the modulus of the ring. A full description of the parameters is in the documentation.

For your second question, I am afraid that searching the parameter space is the only approach at present. The absence of a straightforward closed expression for complexity/security of LWE is what motivates the estimator in the first place. However, you should roughly find that increasing the variance increases the security so that particular levels of security can be found by varying only this parameter in a binary search.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.