diff --git a/fig-lwe-sis.tex b/fig-lwe-sis.tex index 2684028..5bdedfa 100644 --- a/fig-lwe-sis.tex +++ b/fig-lwe-sis.tex @@ -29,7 +29,7 @@ \draw[matA] (0,0) rectangle node {$\mathbf{A}$} (1.5,1); \draw[|-|, vecX] (1.7, 1) -- node[right] {$\mathbf{x}$} ++ (0, -1.5); \node at (2.4, .25) {$=$}; - \draw[|-|] (2.8, 1) -- node[right] {$\mathbf 0^n$} ++ (0, -1); + \draw[|-|] (2.8, 1) -- node[right] {$\mathbf{0}^n$} ++ (0, -1); \end{tikzpicture},$ and\\$0< \|\textcolor{red!70!black}{\mathbf{x}}\| \leq \beta$. \end{minipage} \hfill diff --git a/sec-lattices.tex b/sec-lattices.tex index 52ff1db..d9935ee 100644 --- a/sec-lattices.tex +++ b/sec-lattices.tex @@ -66,7 +66,7 @@ In order to define the $\SIVP$ problem and assumption, let us first define the s \begin{definition}[Successive minima] \label{de:lattice-lambda} For a lattice $\Lambda$ of dimension $n$, let us define for $i \in \{1,\ldots,n\}$ the $i$-th successive minimum as - \[ \lambda_i(\Lambda) = \inf \bigl\{ r \mid \dim \left( \Span\left(\lambda \cap \mathcal B\left(\mathbf 0, r \right) \right) \right) \geq i \bigr\}, \] + \[ \lambda_i(\Lambda) = \inf \bigl\{ r \mid \dim \left( \Span\left(\lambda \cap \mathcal B\left(\mathbf{0}, r \right) \right) \right) \geq i \bigr\}, \] where $\mathcal B(\mathbf{c}, r)$ denotes the ball of radius $r$ centered in $\mathbf{c}$. \end{definition} diff --git a/sec-stern.tex b/sec-stern.tex index 6444e06..dc46dbf 100644 --- a/sec-stern.tex +++ b/sec-stern.tex @@ -64,7 +64,7 @@ the knowledge of a bounded vector $\mathbf{w} \in [-B,B]^m$ that satisfies relat This reduces to use \cref{le:zk-ktx} to prove the knowledge of $\bar{\mathbf{w}} \in \nbit^{m'}$ for public input $(\mathbf{M} \cdot \mathbf{K}, \mathbf{v})$. To construct such a transfer matrix $\mathbf{K}$, \cite{LNSW13} showed that \textit{decomposing} a vector $\mathbf{x} \in [-B,B]^m$ as a vector $\tilde{\mathbf{x}} \in \nbit^{m \cdot \delta_B}$ and \textit{extending} the resulting vector into $\bar{\mathbf{x}} \in \mathsf{B}^3_{m \delta_B}$ leads to a new statement that can be proven using the~\cite{KTX08} variant of Stern's protocol. -The resulting matrix $\mathbf{K}= \left[\mathbf{K}_{m,B}^{} \mid \mathbf 0^{m \times 2m\delta_B}\right] \in \ZZ^{m \times 3m\delta_B}$, where $\mathbf{K}_{m,B}^{}$ is the \nbit-decomposition matrix $\mathbf{K}_{m,B} = \mathbf{I}_m \otimes \left[B_1 \mid \cdots \mid B_{\delta_B} \right]$ with $B_j^{} = \left\lfloor \frac{B + 2^{j-1}}{2^j} \right\rfloor$ for all $j \in \{1,\ldots,j\}$ can be computed from public parameters. +The resulting matrix $\mathbf{K}= \left[\mathbf{K}_{m,B}^{} \mid \mathbf{0}^{m \times 2m\delta_B}\right] \in \ZZ^{m \times 3m\delta_B}$, where $\mathbf{K}_{m,B}^{}$ is the \nbit-decomposition matrix $\mathbf{K}_{m,B} = \mathbf{I}_m \otimes \left[B_1 \mid \cdots \mid B_{\delta_B} \right]$ with $B_j^{} = \left\lfloor \frac{B + 2^{j-1}}{2^j} \right\rfloor$ for all $j \in \{1,\ldots,j\}$ can be computed from public parameters. \subsection{Abstraction of Stern's Protocol} \label{sse:stern-abstraction}