Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with lwe
Search options not deleted
user 21818
Learning with Errors is a form of lattice problem used in the design of cryptographic primitives. LWE is based on the Closest Vector Problem (CVP).
5
votes
Understand LWE(Learning With Error) negligible error probability
The probability of error is negligible "as a function of $n$", meaning that the probability of error will decrease (quickly) as $n$ grows. Increasing $n$ should solve your issue.
- 1,356
5
votes
Accepted
Minimum distance between polynomials in ring-LWE
I'm assuming $n$ is a power of $2$ and that $q$ is an odd prime larger than $n$. I'm discarding the trivial case $s_1 = s_2$.
If you consider everything $\mod q$, then it is most likely over the choi …
- 1,356
2
votes
Accepted
Prove that a small Ring-LWE secret is unique
The statement you are trying to make is information-theoretic (existence of something), not computational (easiness of finding something), so the fact that you invoke the RLWE hardness assumption is c …
- 1,356
1
vote
Accepted
Refreshing Procedure in FHEW: membership test
There are to my knowledge two articles that develop further on generalized member test (or even function) extraction, I hope this may help you out:
https://link.springer.com/chapter/10.1007/978-3-319 …
- 1,356
1
vote
Is the discretization of the Guassian distribution on torus still a discrete Gaussian distri...
There are two ways to discretize: rounding and conditioning.
The first discretization you use to define $D_{\mathbb Z,s}$ from $\rho_s$ is using conditionning.
The second one defining $\bar \Psi_s$ fr …
- 1,356
2
votes
SIS vs LWE Problem
Regarding Hardness, solving SIS over $A^t$ quite directly allows to solve LWE over $A$. In the other direction there is also a reduction which is quantum. … In particular, LWE is with some huge parameters provably quantumly harder than SIS with certain more reasonable parameter. …
- 1,356
3
votes
LWE with a binary matrix A
My understanding is that when $A$ is binary, the problem is completely broken by this paper:
LP Solutions of Vectorial Integer Subset Sums - Cryptanalysis of Galbraith's Binary Matrix LWE
Alexander May …
- 1,356
4
votes
Accepted
Not able to reproduce the security estimates in Kyber through leaky-LWE-estimator
The code from your update (July 20, 2024) is essentially that of kyber-bkz.sage script from the leaky-LWE repo (NIST-round3) branch. … But I think this is more a issue of code and installation than a crypto question: I invite you to move this discussion to the github bugtracker https://github.com/lducas/leaky-LWE-Estimator/issues . …
- 1,356