3

We know Grover's algorithm speedup brute-force attacks two times faster in block ciphers (e.g brute-forcing 128-bit keys take 264 operations, not $2^{128}$). This is the advertisement of the Lov K. Grover's algorithm. Yes, it reduces the key search into $\mathcal{O}(\sqrt{2^n})$ instead of the $\mathcal{O}(2^n)$. What is generally not mentioned is the ...


1

This question is related. Note that this question does say that security is analyzed by comparison with AES/SHA3, as you suspect. Perhaps the most informative way to learn more about this is to go "hands on" though, and read the security analysis sections of various NIST PQC round 3 candidates. These should be close to the community consensus of ...


1

In general, if you're asking about a particular definition, it is good to include a link to the definition under question. Generally though, it is known that PKE requires randomized encryption (or non-repeating nonces, I will ignore this). This is to say that (except for in specialty settings) the function: $$\mathsf{Enc} : \mathcal{PK}\times\mathcal{M}\to\...


1

Note that you don't strictly need the dual ideal for RLWE's security, you just take an efficiency hit if you don't use it. See page 4 of Algebraically Structured LWE, revisited for some commentary on this. It does show up in the "Bounded Distance Decoding on the dual -> Discrete Gaussian Sampling on the primal -> BDD on the dual -> $\dots$"...


Only top voted, non community-wiki answers of a minimum length are eligible