Middle-Product Learning with Errors

A probabilistic algorithm for verifying polynomial middle product in linear time

“…Since quadratic time verification was not feasible, we decided to develop a fast approach. Note that our algorithm might also be of interest for the recent Middle-Product Learning With Error problem [13].…”

Middle-Product Learning with Rounding Problem and Its Applications

“…Motivated by the question of how to choose a good polynomial, Lyubashevsky introduces the so-called R <n -SIS problem [Lyu16], a variant of the Short Integer Solution (SIS) problem, whose hardness does not depend only on a single polynomial, but on a set of polynomials. Inspired by this, Roşca et al [RSSS17] propose its LWE counterpart: the Middle-Product Learning With Errors (MP-LWE) problem. The MP-LWE problem is defined as follows: Taking two polynomials a and s over Z q of degrees less than n and n + d − 1, respectively, the middleproduct a d s is the polynomial of degree less than d given by the middle d coefficients of a • s. In other words, a d s = (a • s mod x n+d−1 )/x n−1 , where the floor rounding • denotes deleting all those terms with negative exponents on x.…”

“…For integers d, n and q with q ≥ 2 and 0 < d ≤ n as parameters, an MP-LWE sample is given by (a, b = a d s + e mod q), where s is a fixed element of Z <n+d−1 q [x], a is sampled from the uniform distribution over Z <n q [x] and e is sampled from a probability distribution χ over R <d [x]. As for the hardness of MP-LWE, Roşca et al [RSSS17] establish a reduction from the P-LWE problem parametrized by a polynomial f to the MP-LWE problem defined independently of any such f . Thus, as long as the P-LWE problem defined over some f (belonging to a huge family of polynomials) is hard, the MP-LWE problem is also guaranteed to be hard.…”

“…Thus, as long as the P-LWE problem defined over some f (belonging to a huge family of polynomials) is hard, the MP-LWE problem is also guaranteed to be hard. As a cryptographic application, Roşca et al [RSSS17] propose a public-key encryption (PKE) scheme that is IND-CPA secure under the MP-LWE hardness assumption, with keys of sizeÕ(λ) and running timeÕ(λ), where λ is the security parameter.…”

“…As a typical application, we propose a PKE scheme based on this MP-CLWR assumption which is IND-CPA secure in the random oracle model (Section 5). The attractiveness of our encryption scheme stems from the fact that we only have to round the middle-product of two polynomials instead of sampling Gaussian error during public key generation while guaranteeing the same security and having the same asymptotic key and ciphertext sizes as [RSSS17] (Section 6). Furthermore, we provide at the end of Section 6 a study of the concrete security of our scheme by looking at the currently best known attacks against it.…”