2
$\begingroup$

Does module-LWE remains hard for an even modulus $q$, or a power of two?

This is true for Ring-LWE (pseudorandomness) and Module-LWR (SABER).

I can't find any reference to it!

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

Yes. Learning with Rounding (LWR) is a special case of LWE, where the errors are introduced deterministically by scaling and rounding operations. If you had an algorithm that could solve LWE, the same could be used to solve LWR.

Thus, Module-LWE is at least as secure as Module-LWR.

Improve this answer
$\endgroup$
1
  • 5
    $\begingroup$ This is a reasonable guess, but there is no formal proof either way, unless maybe you are ready to amplify noise quite a bit. $\endgroup$
    – LeoDucas
    Apr 27, 2021 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.