Why in BCNC key-exchange protocol (page 8), Bob instead of:

$K_B \leftarrow \lfloor \bar v \rceil_{2q,2} \in \{ 0, 1\}^n$

do this instead:

$K_B \leftarrow rec(2bs', c) \in \{0, 1\}^n$.

or they are the same thing ... am I missing something? I don't understand the purpose of modular rounding function as defined by Peikert in Lattice Cryptography for the Internet (page 9) and BCNS (page 6)

Because the idea is one party (i.e. Bob) sends a signal or reconciliation information (i.e. $c$) to other party (i.e. Alice) and then both should follow the exact same approach to get one bit from every coefficient.

  • $\begingroup$ This is Avery interesting question. But I need some ground work to answer $\endgroup$
    – user38956
    Commented Mar 17, 2017 at 2:29
  • $\begingroup$ @Node.JS in Ring-LWE key-exchange the resulting polynomial of both parties are not exactly equal but the coefficients are very close. So the reconciliation method tries to extract a bit from every coefficient. What I don't understand is that both parties should follow the same reconciliation approach, maybe they are already doing the same thing approach but I did not understand. This is the wiki page for R-LWE key-exchange: en.wikipedia.org/wiki/Ring_learning_with_errors_key_exchange $\endgroup$
    – Node.JS
    Commented Mar 17, 2017 at 2:34

1 Answer 1


Answer of your question is in page $7$.


For odd $q$, let $v=w+e\in Z_q$ for $w,e\in Z_q$ such that $2e\pm 1\in E \pmod q$. Let $\bar v=dbl(v)$ then $rec(2w,\langle \bar v\rangle _{2q,2})=\lfloor \bar v \rceil _{2q,2}$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.