New answers tagged lattice-crypto
0
votes
Ring LWE distribution definitions
$R_q=R/qR, R_q^{\lor}=R^{\lor}/qR^{\lor}$.
$R^{\lor}$is R-module, $R_q^{\lor}$ is $R_q$-module(define as: $\forall x\in R,y\in R^{\lor}, (x+qR)(y+qR^{\lor})=xy+qR^{\lor}$)
$a\in R_q,s\in R_q^{\lor}$，...
- 3
3
votes
Do we know that LWE is harder than Ring LWE?
Few things: Circulant LWE is easy --- it corresponds to RLWE in $\mathbb{Z}_q[x]/(x^n-1)$, which (for $n = 2^k$) is (ring) isomorphic to $\mathbb{Z}_q[x]/(x-1)\times \prod_i \mathbb{Z}_q[x]/(x^{2^i}+1)...
- 11.7k
2
votes
Definition of Dual Lattice
For the highlighted lines, we first note that for any invertible matrix $M$ for the field of definition of the inner product we trivially have
$$\langle \mathbf x,\mathbf y\rangle = \langle \mathbf x,...
- 21.9k
2
votes
Arithmetic in Cyclotomic Number Rings with Shoup's Number Theory Library (NTL)
Operations on $R_p = \mathbb{Z}_p[X] /< \phi_m(x)>$ are usually implemented using double-CRT representation (aka RNS), because the integer modulus $p$ is typically big. If it is small in your ...
7
votes
Accepted
NTRU Cryptosystem: Why "rotated" coefficients of key f work the same as f
In NTRUEncrypt we work with in the ring $\mathbb Z[X]/(X^N-1)$. it looks like for your example you have taken $N=4$.
In this ring, multiplying $X$ is equivalent to rotating the coefficients so that in ...
- 21.9k
0
votes
GSW Homomorphic Encryption
The actual schemes are using $\mathbb Z_q$, but the implementations of those schemes in practice need to be mapped into 0/1 bits.
In the implementation, you need to map the field into 0 and 1. In most ...
1
vote
Is there an efficient way to check if a lattice has a point with all non-zero components?
This looks like a hard problem in general, although the lattice viewpoint may not be the right one to look at it. Basically, this is a coding theory question: you are asking about the existence of a ...
- 2,114
Top 50 recent answers are included