New answers tagged lwe
3
As Peikert have commented (and my first answer was not dealing with this problem carefully), the LWE problem asks you to distinguish between
$(\vec a, \langle \vec a, \vec s \rangle + e \mod q) \in \mathbb{Z}_q^{n+1}$
and $\vec u \in \mathbb{Z}_q^{n+1}$ (with each entry of $\vec u$ sampled uniformly from $\mathbb{Z}_q$) given many samples.
This is why the ...
1
δ_0: the root Hermite factor required
β: the BKZ block size
d: the dimension of the lattice being reduced
m: the number of LWE samples used
1
The message bit should be just that, a single bit, and $v$ should be a single integer modulo $q$. I am not sure how you’re getting $v$ to be a vector. Note that $b^t x$ is an inner product (mod $q$), so it is also a single integer mod $q$.
3
Everything you write looks correct. However, you may be expecting the distributed decryption protocol to have a security property that it does not (and was not intended to, and really cannot in your example) have.
Specifically, the Mukherjee-Wichs paper you linked defines security to say (roughly) that, given the evaluated ciphertext, its underlying ...
Top 50 recent answers are included
