All Questions
Tagged with lattice-crypto implementation
7 questions with no upvoted or accepted answers
8
votes
0
answers
316
views
How are the constants found in the AVX2 implementation of CRYSTALS-KYBER round 2 generated?
The post-quantum lattice-based cryptosystem CRYSTALS-KYBER which has made it to the second round of NIST PQC includes two implementations: 1) a baseline reference implementation in C and 2) an ...
- 315
5
votes
0
answers
748
views
Lattices with hidden short vectors and an algorithm for a special case of the SVP
For the purpose of testing algorithms for lattice basis reduction or finding short vectors, it would be useful to have examples of lattices where short vectors are hidden, that is, a nontrivial ...
- 51
4
votes
0
answers
438
views
Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?
The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems ...
- 94.5k
1
vote
0
answers
38
views
CRYSTALS-Kyber Central Binomial Distribution reference inplementation in c
In lines 8 to 10, why it does not get input bytes as it is (i.e., line 8)? It first does some changes (line 9 and 10).
Do authors do this changes as we cannot work with binary form of a variable ...
- 586
1
vote
0
answers
77
views
Difference between TFHE and CKKS?
What are the differences in parameters while implementing CKKS vs TFHE?
For example modulus size, ring dimensions, bit security. Any pointers to literature would be appreciated
- 19
0
votes
0
answers
34
views
How to get a sample from $D_{q\mathbb{Z}+c,r}$？
In the paper Compact Lattice Gadget and Its Applications to Hash-and-Sign Signatures, the preimage sampling boils down to only n times sampling of $D_{q\mathbb{Z}+c,r}$. How can we obtain a sample ...
- 51
0
votes
0
answers
84
views
CKKS encoding. Why not just use fft
I am studying the ckks scheme from this blog post. In the vanilla encoding part we want to encode a complex vector of size N to a complex polynomial of degree N-1. This of course is possible if we ...
