I was wondering if we could construct a symmetric encryption scheme by assuming that the secret key itself in GGH is public and the shared "key" is the error vector $e$.

To encrypt we would take the lattice basis $B$ and our shared secret $e \in \mathbb{R}^n$ and do:

$c = m*B + e$

and to decrypt:

$m = (c-e) * B^{-1}$

Without the correct $e$ this should not decrypt correctly. But how could I attack such an encryption?


1 Answer 1


That wouldn't appear to work. In a known plaintext attack, that is, where the attacker knows both $m$ and $c$, he can compute:

$$e = c - m * B$$

recovering the secret key.

Alternatively, in a ciphertext-only scenario, the attacker could take two ciphertexts $c, c'$ and compute

$$(c - c') * B^{-1} = m - m'$$

resulting in the difference between the two plaintexts.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.