Posts  / #POST-001292
REDDIT

Regev's cryptosystem

A
Feb 13, 2025 · 04:38

Hello, i'm sort of confused by a small point on Regev's pke.

Say that the the public parameters is (A, u) = (A, s\^t A + e) with A matrix, s the secret key, e an error.

I see that in the original paper as well as in follow up papers, the encryption part of the system is of the form (A\*r, u\*r + m\*q/2)

However in the following talk at the timestamp in chris peikert's talk, the encryption is of the form (A\*r **+ e**, r\*u + m\*q/2): [https://youtu.be/K\_fNK04yG4o?list=PLgKuh-lKre10rqiTYqJi6P4UlBRMQtPn0&t=2097](https://youtu.be/K_fNK04yG4o?list=PLgKuh-lKre10rqiTYqJi6P4UlBRMQtPn0&t=2097)

Looking more into it, i see another paper in which he defines an improved scheme supposed to generalize 3 former iterations of the scheme. All of the older schemes are of the first form, while the proposed scheme is of the 2nd. it's in chapter 3. [https://eprint.iacr.org/2010/613.pdf](https://eprint.iacr.org/2010/613.pdf)

My question is: what gives? am i looking at papers that are out of date? when someone mentions regev without specifying, will they be thinking of an encryption of the first or second form? What does it change in fine? Is it just that adding an error with one error distribution is equivalent to adding none but selecting r with another distribution?


edit: I also noticed that in ringLWE and moduleLWE, the latter showed up, not the first form