New answers tagged

3

The quote invites computing $5\,P$ on the Elliptic Curve of equation $E:\ Y^2\equiv X^3+3X+7\pmod{11}$ in order to experimentally come to the realization this is the point at infinity $\mathcal O$ (the neutral of point addition), and get the intuition that's why the computation of $5\,P$ on the Elliptic Curve of equation $E:\ Y^2\equiv X^3+3X+7\pmod{187}$ (...


0

This answer restricts to groups under the multiplication operation modulo a large prime $p$, because the question does (others groups are increasingly common in cryptography, including Elliptic Curve Groups). So we'll be working within the group $\mathbb Z_p^*$, a notation for the subset of the ring $\mathbb Z/p\mathbb Z$ formed by elements that have a ...


1

As Hilder mentions, via the technique of "modulus switching" the particular choice of $q$ does not matter much for the security of LWE. Therefore, the particular form of $q$ is mostly to enable efficiency improvements. I'm the wrong person to exhaustively list all of them, but one can easily point to a few by reading the NIST PQC KEM proposals. For ...


2

Not a complete answer, but may already be useful... It is known that only the bit length but not the form of $q$ is important for the security of the LWE (and the RLWE) problem. Moreover, if we can solve $SIS_{n, q, \beta}$ with $\beta = O(q / \sigma)$, then we can solve $LWE_{n, q, \sigma}$ (see Corollary 2 of [MPS15]). Thus, at least for such small bound $\...


Top 50 recent answers are included