All Questions
Tagged with ring-lwe gaussian-noise
6 questions
1
vote
1
answer
64
views
Gaussian width in lattice setting
In the lattice setting (like LWE, RLWE) , the Gaussian function is often defined as
$$
\rho_{\Sigma}(x) = e^{-\pi x^T\Sigma^{-1}x}
$$
The discrete Gaussian distribution $\mathcal{D}_{\Lambda, \Sigma}$ ...
- 11
1
vote
1
answer
229
views
Why predicting an error in Crystal Kyber is considered to be hard?
Hi I have started studying on crystal kyber recently. Gained some knowledge regarding its algorithm and how it works. My doubt is why it is tough for attacker to extract secret vector from pk itself ...
- 21
2
votes
1
answer
166
views
How is it legal to use a rounded Gaussian for LWE?
As far as I understood, in Regev's initial paper, the error distribution was first constructed as follows:
Then rounded in the following way:
Using this distribution, the reduction in the theorem ...
- 505
1
vote
0
answers
516
views
Is the error distribution in Learning with Errors (LWE), the discrete Gaussian distribution?
In $\mathbb{Z}$, the discrete Gaussian distribution is defined as $D_{Z,s}(x) = \frac{\rho_s(x)}{\rho_s(\mathbb{Z})}, x\in \mathbb{Z}$.
In LWE, $(\overrightarrow{a}, b = \langle \overrightarrow{a}, \...
- 519
1
vote
1
answer
141
views
Is the discretization of the Guassian distribution on torus still a discrete Gaussian distribution?
Let $\rho_s(x) = e^{-\pi x^2/s^2}$ be the Gaussian measures, then the discrete Gaussian distribution on $\mathbb{Z}$ could be defined as $D_{\mathbb{Z},s}(x) = \rho_s(x)/\sum_{n\in \mathbb{Z}}\rho_s(n)...
- 519
3
votes
1
answer
556
views
How small can the error be in LWE?
For modulus $Q$ and stddev $\sigma$, [GHS12] suggests that, to achieve 128-bit security, just choose the dimension $N$:
$$
N\geq(Q/\sigma)\cdot 33.1
$$
This seems to suggest flexibility to choose ...
- 564