Score:3

Is the scheme in LWE also valid in R-LWE?

ro flag

One way of interpreting matrices in RLWE is that they are a subset of standard integer matrices that have special structure. For example, rather than using a random matrix $A\in\mathbb{Z}_q^{n\times n}$ (as we might in LWE-based constructions), we can replace this a matrix with a matrix where the first column (or row) is random, and the rest have a cyclic rotation structure:

$$\begin{pmatrix} a_1 & a_n & \dots & a_2\\ a_2 & a_1 & \dots & a_3\\ \vdots & &\ddots & \\ a_n & a_{n-1} & \dots & a_1 \end{pmatrix} = [\vec a, \mathsf{rot}(\vec a),\mathsf{rot}^2(\vec a),\dots, \mathsf{rot}^{n-1}(\vec a)]$$

Other "special structures" of course exist (say negacyclic rotations).

How far does this analogy stretch? In particular, for any scheme based on LWE, is there a corresponding R-LWE scheme, where one samples the random matrices from this special subset (rather than uniformly randomly)?

For example, in standard Regev-style encryption (that was designed for LWE), can we choose the matrix in the above way to build an R-LWE version of Regev encryption?

a196884 avatar
cn flag
To answer your final question, the RLWE paper https://eprint.iacr.org/2012/230.pdf gives a 'Regev'-style encryption scheme for RLWE, on page 4.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.