1

Assuming

  • a secret key $s\in \mathbb{Z}_2[X]/\langle X^n+1\rangle$,

  • a plaintext $m\in \mathbb{Z}_2[X]/\langle X^n+1\rangle$,

  • $e,e'$ are sampled from B-bounded Discrete Gaussian Distribution over $\mathbb{Z}[X]/\langle X^n+1 \rangle $ with reasonable standard deviation for security.

  • $a$ (a part of public key) is a random element sampled unformly at random from $\mathbb{Z}_q[X]/\langle X^n+1\rangle$ (q >> 2),

  • $b=[-a \cdot s-e]_q$ (a part of public key)

  • $u$ is an element over $\mathbb{Z}_2[X]/\langle X^n+1\rangle$ (with small coefficient).

Then, is the following RLWE sample secure?

$([u \cdot b + 2 \cdot e' + m]_q, [u \cdot a]_q)$

mallea
  • 1,605
  • 1
  • 9
  • 21

0 Answers0