Hacker News Reader

Lattice-based crypto seems to be on the way out already: most papers I see exploring cutting edge crypto are based on ring-LWE, which is a different problem that was proven (by Regev) to reduce to the SVP problem over integer lattices, thus being equally as hard. But it's not actually a lattice problem itself.

View on HN

LWE and SIS-based cryptography absolutely is lattice-based crypto, and I can't really imagine what other kind of scheme you would deem more deserving of the name than those. Even the epitome of classical lattice-based crypto, Ajtai-Dwork, is proved secure under a problem (hidden hyperplane) which is "not actually a lattice problem itself", at least not anymore than LWE and SIS. But being based on a problem equivalent to worst-case lattice problems under polynomial-time reductions strikes me as the strongest possible sense in which you could claim a scheme to be lattice-based.

I meant ring LWE is not the same problem as SVP. Perhaps I have misunderstood the algorithm but I do not see any lattices in the description of ring LWE. The fact that it's equivalent in hardness doesn't, to my mind, imply it's "lattice based".

Reply on news.ycombinator.com