• a secret key $s\in \mathbb{Z}_2[X]/\langle X^n+1\rangle$,

  • a plaintext $m\in \mathbb{Z}_2[X]/\langle X^n+1\rangle$,

  • $e,e'$ are sampled from B-bounded Discrete Gaussian Distribution over $\mathbb{Z}[X]/\langle X^n+1 \rangle $ with reasonable standard deviation for security.

  • $a$ (a part of public key) is a random element sampled unformly at random from $\mathbb{Z}_q[X]/\langle X^n+1\rangle$ (q >> 2),

  • $b=[-a \cdot s-e]_q$ (a part of public key)

  • $u$ is an element over $\mathbb{Z}_2[X]/\langle X^n+1\rangle$ (with small coefficient).

Then, is the following RLWE sample secure?

$([u \cdot b + 2 \cdot e' + m]_q, [u \cdot a]_q)$

  • $\begingroup$ In other word, can we recover $m$ from the RLWE sample without knowing the secret key? $\endgroup$ – mallea Oct 8 '18 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.