# Security of ring-lwe sample? can we do it simpler?

Assuming

• a secret key $$s\in \mathbb{Z}_2[X]/\langle X^n+1\rangle$$,

• a plaintext $$m\in \mathbb{Z}_2[X]/\langle X^n+1\rangle$$,

• $$e,e'$$ are sampled from B-bounded Discrete Gaussian Distribution over $$\mathbb{Z}[X]/\langle X^n+1 \rangle$$ with reasonable standard deviation for security.

• $$a$$ (a part of public key) is a random element sampled unformly at random from $$\mathbb{Z}_q[X]/\langle X^n+1\rangle$$ (q >> 2),

• $$b=[-a \cdot s-e]_q$$ (a part of public key)

• $$u$$ is an element over $$\mathbb{Z}_2[X]/\langle X^n+1\rangle$$ (with small coefficient).

Then, is the following RLWE sample secure?

$$([u \cdot b + 2 \cdot e' + m]_q, [u \cdot a]_q)$$

• In other word, can we recover $m$ from the RLWE sample without knowing the secret key? – mallea Oct 8 '18 at 13:29