New answers tagged

3 votes

Ring Learning With Errors : why is it called ring and referred it as Ring LWE

So $R = \mathbb{Z}[x]/(x^n+1)$, where $x^n+1$ is an irreducible polynomial and n is a power of 2. So, this structure would not be a ring anymore, it would be a field. So, why is it called ring and ...
Mark's user avatar
  • 12.5k
0 votes

How to reconstruct low order bits of $t$ of CRYSTALS-Dilithium from a small number of signatures?

While this doesn't fully answer your question (and is only mildly more interesting than a comment), I think the Dilithium authors just assume the adversary knows $\mathbf{t}_0$. See for example ...
Mark's user avatar
  • 12.5k
3 votes

Quantum attack on CTR

Disclaimer: I'm one of the authors of the article. poncho's answer is great, but I'd like to just add some additional details that may help you in understanding the article. When describing the ...
Tristan Nemoz's user avatar
13 votes
Accepted

Impact of Ryan and Heninger's CRYPTO 2023 paper on post quantum cryptosystems

The following is mostly known to lattices people (and mentioned at the end of the Quanta article), but I also reached out to Keegan to clarify some questions I had. There are (roughly) two main types ...
Mark's user avatar
  • 12.5k
4 votes

The weakening of PQC as a result of lack of KEX?

I don't understand your concern. It sounds like you are assuming that public (and private) keys in lattice-based key exchange are static? I don't believe this is the case though. So if your bank (or ...
Mark's user avatar
  • 12.5k
1 vote

What does it mean the "Distinguisher" in LWE decision version?

what does it mean the distinguisher in LWE problem in which the secret key changes constantly for each ciphertext and plaintext pair? this isn't true, so if you have a particular source that is ...
Mark's user avatar
  • 12.5k
4 votes
Accepted

Quantum attack on CTR

why we have sum over all $x$ here? The difference here is notational. We use the + operator not to mean 'addition with some group operation', but instead that the state can be represented by a ...
poncho's user avatar
  • 146k
0 votes

what does output parameters of lwe estimator stands for?

A full description of the parameters is in the documentation.. Each parameter is related to a specific attack such as Dual, Primal and so on. In summary : rop: Total number of word operations (≈ CPU ...
R. Jalaei Salahi's user avatar
0 votes

Post-quantum hybrid encryption

No, as mentioned above. More importantly, security in cryptography is defined based on the algorithmic complexity of solving a problem. Security protocols that involve solving a difficult problem (...
Victor Espinoza's user avatar
2 votes

Are security assumptions based on quantum computers too strict? Causing cryptographers to tie their own hands

While Kodlu's comment has focused on the case of basic public-key operations, I thought I would respond to Have security assumptions based on quantum computers de facto constrained the emergence and ...
Mark's user avatar
  • 12.5k
2 votes

Are security assumptions based on quantum computers too strict? Causing cryptographers to tie their own hands

The reason quantum-resistant schemes are studied, have been standardized and will be deployed widely is really three-fold: While there is no currently functioning quantum computer which can perform a ...
kodlu's user avatar
  • 22.1k

Top 50 recent answers are included