I've been studying Ring-LWE based crytposystems such as the one in this paper, but I can't seem to find/come up with a proof of correctness for this particular scheme.
The encryption goes as follows:
given a message $m \in R_2 $ and sampling a secret key $s$ from a distribution $\chi$, one samples $a$ from $R_q$ and $e \leftarrow \chi$, the ciphertext $c$ is a pair such that $c = ( c_0,c_1) = (a, as+2e+m)$.
given $c=(c_0,c_1)$ one computes $c_0 + c_1s ~~mod~2$
Can someone please try and help me with that?
thanks in advance.