… Closing this gap has been a central goal in the study of FHE … ” FHE can be as secure as any
other lattice-based public-key … ) are identical to Regev’s original lattice-based PKE [18], with …

… the evolution of the various lattice-based PKE, KEX and KEMs … done on physical security
of lattice-based schemes such as … various physical security aspects of lattice-based schemes …

… attacks over IND-CCA secure lattice-based PKE/KEMs to the EM … secure lattice-based
PKE/KEMs. Our work reiterates the need for concrete masking countermeasures for lattice-based …

… PKEs from lattices, it is natural to ask: Can we directly construct a standard model CCA2-secure
PKE from lattices (possibly by carefully exploiting the rich algebraic properties of lattices)…

… techniques to the GSW-FHE, the resulting scheme is matrix-multiplication-homomorphic. (Notably,
their scheme requires a circular security assumption to enable publicly encrypting …

… be secure, encrypting the secret key under the public key in MW needs to be secure (which
translates to a circular security … {PKE}\) is said to be weakly circular secure if it is secure even …

… such as identity-based encryption and fully homomorphic encryption (FHE). … lattice-based
PKE/KEM, we aim to address these objectives and optimize the trade-off parameters of security …

… selective-opening (BiSO) secure PKE. BiSO … a lattice-based AKE protocol with tight
security. We consider a multi-challenge setting defined by the “Single-Bit-Guess” (SBG) security …

… them secure). … security of these lattice-based cryptographic schemes have received only
limited attention in [7,24]. In this paper we analyze side-channel security of several lattice-based …

… upon a latticebased fully-homomorphic encryption (FHE) … an existing CCA-secure public key
encryption (PKE) scheme [… first lattice-based (one-round) threshold CCA-secure PKE where …