Evasive LWE ⇒ BE

Standard model · Wee22

Statement

Evasive LWE together with LWE yields optimal BE: for $N$ users, the public key, each secret key and the ciphertext have size $\mathrm{poly}(\lambda ,\log N)$, and security is selective, the adversary fixing the recipient set before seeing the public key — Wee22.

Notes

• First candidate optimal BE that is plausibly post-quantum secure — Wee22.