In a RLWE setting where you are given a secret key $s$ and an associated public key $pk = (p_0,p_1) = (-(p_1s+e),p_1)$, is it possible/easy to forge a new secret key $s'$ such that $p_0+p_1s'$ has a small infinity norm? In other words is it possible/easy to forge a different secret key generating similar public keys?
$\begingroup$
$\endgroup$
Add a comment
|
