Hot answers tagged

12

The TL;DR: From a theoretic point of view, Gaussians are the better choice, both for the easiness of the security proof and its optimality in terms of tightness; In practice, most of the time you can replace Gaussians by other distributions without too much trouble. Theory First, let me elaborate on a few reasons why Gaussians are better in theory: When ...


4

I think you are mixing up some concepts... There are two things here: the embedding and the norm. Those schemes are defined over polynomial rings, but for several reasons (e.g. to relate them with lattice problems, to have some geometry) we want to analyze them in vector spaces. So, representing those ring elements as vectors is what we call embedding. ...


3

There is a condition that is not considered, that is, the value after modulo 257 should be in $\mathbb Z_q$. When $q = 257, \mathbb Z_q = \{ -128, ... , 128 \}$, so, $(4+128)\mod 257$ should be $-125$ rather than $132$ . And $-125 \mod 2 = 1$. Thus, $sk_a \neq sk_b$ and the output of oracle $\mathcal B$ is $0$.


3

(The full version of the paper is at https://eprint.iacr.org/2012/230, and my answer below refers to it.) The answer to your question is that a different part of the reduction ensures that the oracle has advantage very close to 1 over the random samples $(a_i, a_i s + e_i + r_i)$, i.e., the oracle outputs the correct answer for almost all choices of $s, a_i,...


3

Everything you write looks correct. However, you may be expecting the distributed decryption protocol to have a security property that it does not (and was not intended to, and really cannot in your example) have. Specifically, the Mukherjee-Wichs paper you linked defines security to say (roughly) that, given the evaluated ciphertext, its underlying ...


1

This is necessary for security. Consider if $q$ was a multiple of $t$, so $q = v\cdot t$. Take your ciphertext $(a, \langle a, s \rangle + t\cdot e + m)$ and multiply through by $v$. You now have $$(v\cdot a, \langle v\cdot a, s \rangle + v\cdot t\cdot e + v \cdot m) = (v\cdot a, \ \langle v \cdot a, s \rangle + v\cdot m) \mod q$$ Suppose you're playing ...


1

The discrete Gaussian distruibution have the most entropy at the same standard deviation compared to other discrete probability distributions. It's important in some LWE/SIS digital signature algorithms because it helps reduces the signature size (most notably in BLISS and FALCON), but otherwise not so essential in key exchange or encryption (and has been ...


Only top voted, non community-wiki answers of a minimum length are eligible