In the LWE symmetric encryption scheme, a ciphertext encrypting a message $\mu \in \{0,1\}$ under the secret key $\mathbf{s} \in \mathbb{Z}_q^n$ is $(\mathbf{a}, \mathbf{b}=\mathbf{a} \cdot \mathbf{s}+e+\frac{q}{2}\mu)$, where $\mathbf{a} \in \mathbb{Z}_q^n$ is a uniformly sampled vector and $e \in \mathbb{Z}_q$ is a noise.

My question: Using the ciphertext as a commitment and $(\mu, \mathbf s)$ as revealed values, can we transform the LWE symmetric encryption scheme into a commitment scheme? While it clearly satisfies a hiding property under the LWE assumption, its binding property is not obvious.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.