# How is the security of a plaintext of Ring-LWE without an error term?

I think until public key $\mathsf{pk}=(b=-[as + e]_q,a)$ is broken, Ring-LWE is secure where $a$ is uniformaly random polynomial, $e$ is an error sampled from gaussian distribution with std=$\sigma$ and mean $\mu$=0, and $s$ is a secret key of hamming weight $h$.

$\mathbf{Question }$

Why is error needed for encryption?

A some Ring-LWE based homomorphic encryption schemes encrypts a message $m$ as $\mathsf{ct}=([m+e_0+bv]_q,[av+e_1]_q)$ where

$q$: ciphertext space

$v$: uniformly random small polynomial

I wonder why $m+e_0+bv$ part needs $e_0$. I think m+$bv$ is already uniform because $bv$ looks uniform. So gaussian elimination cannot work here, isnt't it correct?

• Is $p$ randomly chosen at each encryption? Do you have any link pointing to the paper that presents this scheme? – Hilder Vítor Lima Pereira Aug 30 '17 at 7:41
• No. $p$ is fixed. $e_0$ and $e_1$ are randomly chosen every encryption time – mallea Aug 30 '17 at 16:41
• Of course I understood the security of public key which encrypts the secret key by generating a ring-lwe instance, i.e., since $as$ is a constant, we need to add noise term. But as for the public-key-encryption part, because of unknown $bv$ with uniformly random $v$, $m+bv$ already looks uniform. Why is it to be $m+bv+e_0$ with additional noise term? – mallea Sep 2 '17 at 21:34
• But if no error term $e_0$ were added, what would you get if you calculated $ct[0] \pmod b$? – Hilder Vítor Lima Pereira Sep 3 '17 at 12:16