New answers tagged

3

As Peikert have commented (and my first answer was not dealing with this problem carefully), the LWE problem asks you to distinguish between $(\vec a, \langle \vec a, \vec s \rangle + e \mod q) \in \mathbb{Z}_q^{n+1}$ and $\vec u \in \mathbb{Z}_q^{n+1}$ (with each entry of $\vec u$ sampled uniformly from $\mathbb{Z}_q$) given many samples. This is why the ...


1

δ_0: the root Hermite factor required β: the BKZ block size d: the dimension of the lattice being reduced m: the number of LWE samples used


1

The message bit should be just that, a single bit, and $v$ should be a single integer modulo $q$. I am not sure how you’re getting $v$ to be a vector. Note that $b^t x$ is an inner product (mod $q$), so it is also a single integer mod $q$.


3

Everything you write looks correct. However, you may be expecting the distributed decryption protocol to have a security property that it does not (and was not intended to, and really cannot in your example) have. Specifically, the Mukherjee-Wichs paper you linked defines security to say (roughly) that, given the evaluated ciphertext, its underlying ...


Top 50 recent answers are included