# Tag Info

You must choose q so that the noise in the ciphertext doesn't overflow. For example, if $p = 2$ and $n = 256$ you can use $q = 7681$ (taken from Kyber). There are many possible instantiations, and the important point is that the norm $||c_0 - c_1 s||_\infty = ||p (e r + e_2 - e_1 s) + m||_\infty$ is less than $q/2$.