New answers tagged

0 votes

Why does Learning With Errors require a bunch of samples?

There's decision-LWE and there's search-LWE. Decision-LWE can only get harder as the number of samples decreases; if you can distinguish for 1 sample and are given $m$ samples, you can always ignore $...
  • 813
5 votes

What asymmetric encryption to use that is safe against quantum computers?

As @kelalaka already mentioned, standardization is not finished yet. There are candidates for PQ-crypto, but they are still analyzed and revisited. Here you can find the current finalists and ...
  • 1,692
3 votes

Encryption and decryption for LWE

Someone told me that when decrypting we get $qM/2 + r e$. If we can bound $r e$ by $q/4$ then we can retrieve $M$ by checking if this is closer to 0 or $q/2$. May I ask how bounding $r e$ by $q/4$ ...
  • 12k
1 vote

Comparing stateful hash-based signatures to group-based signatures

My question is (ignoring statefullness, focusing on space/time efficiency), how do these schemes (e.g. LMS/XMSS) compare to whatever is used now (RSA, DSA, ECDSA)? Even if we ignore the elephant in ...
  • 135k
6 votes

Post quantum hybrid model and its security

If I understand correctly, in hybrid schemes the input date is first encrypted/signed by classical section's algorithm and then the output of classical section is encrypted/signed by the post-quantum ...
  • 135k

Top 50 recent answers are included