New answers tagged lattice-crypto
2
Here is the optimization in more detail. Start with $[\bar{A} \mid I_n \mid G']$ where $\bar{A} \in \mathbb{Z}_q^{n \times n}$ and $G = [I_n \mid G']$ (where $I_n$ is the $n$-by-$n$ identity matrix).
Note that the concrete gadget matrices $G$ constructed in the paper already contain an identity submatrix (up to reordering of columns). But in general, $G$ ...
3
As a quick aside, while Hermite refers to the same person, "Hermitian" means something different for matrices than "Hermite Normal Form". HNF is essentially "Row Echelon Form/Gaussian Elimination where you can't divide".
HNF Optimization:
First, we can discuss "Reducing the columns of $E$ modulo the HNF", which does ...
1
Apologies for the belated reply.
I've found that the Simons Institute seminar on "Lattices: Algorithms, Complexity, and Cryptography Boot Camp" was pretty good as a generic intro to lattice crypto. [Thomas mentioned something close to this, but I wanted to be more specific.] This event happened Jan. 21 – Jan. 24, 2020 (just a month or so before ...
1
If one expands the discussion to include LWE-type schemes, isn't Module-LWE naturally a "non-commutative" hardness assumption which has practical applications? For example, the Kyber NIST PQC candidate is an MLWE scheme, and is a round 3 finalist.
In general though, I mostly see lattices over "exotic" (at least more so than things like ...
Top 50 recent answers are included
Related Tags
lattice-crypto × 316post-quantum-cryptography × 83
lwe × 51
ring-lwe × 28
homomorphic-encryption × 27
sis × 21
public-key × 17
cryptanalysis × 14
key-exchange × 13
hardness-assumptions × 13
provable-security × 12
ntru × 12
trapdoor × 11
signature × 9
encryption × 7
rsa × 7
side-channel-attack × 6
complexity × 5
number-theory × 5
lenstra-lenstra-lovasz × 5
newhope × 5
zero-knowledge-proofs × 4
randomness × 4
attack × 4
probability × 4