Changes for README.md: 2 added lines, 2 removed lines.
Original line number
Diff line number
Diff line
@@ -18,9 +18,9 @@ Using the `scripts` files, the user can manually generate the complete list of c
Clone the repository
--------------------
As our code exploits the actual structure of the code from the [LaZer library](https://github.com/lazer-crypto/lazer),
As our code exploits the actual structure of the code from the [LaZer library](https://github.com/lazer-crypto/lazer)and from the [LWE-estimator](https://github.com/malb/lattice-estimator).
we manage to use and link the github repository from the Library directly in ours.
Then, in order to have the entire list of files from our code with the [LaZer library](https://github.com/lazer-crypto/lazer), run:
Then, in order to have the entire list of files from our code with the libraries, run:
hard_mlwe_dim = 64 # guess for upper bound for MLWE dim
sigma_2 = mpf(2)*smoothing_param_bound(hard_mlwe_dim*d, lambda_classic, param_sec) # SD of the randomness s_2 : later (depends on length of randomness s2)
frak_s_2 = mp.sqrt(2)*smoothing_param_bound(hard_mlwe_dim*d, lambda_classic, param_sec) # SD of y_2 : later (depends on length of randomness s2)
# find upper actual bound (and possibly improve lower bound)
if get_delta_msis(bound_know_soundness(), kmsis, d, 2 ** log2q) < ROOT_HERMITE_128 and bound_know_soundness() < 2 ** log2q and get_delta_msis(bound_binding(), kmsis, d, 2 ** log2q) < ROOT_HERMITE_128 and bound_binding() < 2 ** log2q:
break
# Find the largest possible gamma which makes the MSIS solution still small.
gamma = 2 ** log2q
while True: # searching for right gamma
gamma /= 2
if get_delta_msis(Bound(), kmsis, d, 2 ** log2q) < DELTA128 and Bound() < 2 ** log2q:
if get_delta_msis(bound_know_soundness(), kmsis, d, 2 ** log2q) < ROOT_HERMITE_128 and bound_know_soundness() < 2 ** log2q and get_delta_msis(bound_binding(), kmsis, d, 2 ** log2q) < ROOT_HERMITE_128 and bound_binding() < 2 ** log2q:
break
# Finding exact values for q, b and gamma:
true_gamma_found = false # Boolean for finding correct gamma
b = 2^(log2q//k) # we need p to be congruent to 5 modulo 8
p = b^2 + 1
b = 2 ** (log2q//k) - 1
while true_gamma_found == false:
b = b+1
p = b^2 + 1
while not is_prime(p) or not p%8 == 5:
b = b+1
p = b^2 + 1
div_b = divisors(b^2) # consider divisors of b
if is_prime(p): # we need p to be prime
if p%8 == 5: # we need p to be congruent to 5 modulo 8
div_b = divisors(p-1) # consider divisors of b^2
for i in div_b:
if gamma*4/5 < i and i <= gamma and is_even(i): # find a divisor which is close to gamma
gamma = i # we found a good candidate for gamma
true_gamma_found = true
m = (p-1) / gamma
# Find the largest possible D which makes the MSIS solution small
D = log2q
while True:
while D != 0:
D -= 1
if get_delta_msis(Bound(), kmsis, d, p) < DELTA128 and Bound() < 2 ** log2q and 2 ** (D-1)*omega*d < gamma:
if get_delta_msis(bound_know_soundness(), kmsis, d, p) < ROOT_HERMITE_128 and bound_know_soundness() < p and get_delta_msis(bound_binding(), kmsis, d, p) < ROOT_HERMITE_128 and bound_binding() < p and 2 ** (D-1)*omega*d < gamma:
full_size = kmsis * d * (log2q - D) + l* d * log2q
challenge = ceil(log(2*omega+1,2)) * d
short_size1 = m1 * d * (ceil(log(stdev1,2) + 2.57)) + (m2 - kmsis) * d * (ceil(log(stdev2,2) + 2.57))
logp = ceil(mp.log(p,2))
full_size = kmsis * d * (logp - D) + l * d * logp
hint = 2.25 * kmsis * d
challenge = ceil(mp.log(2*omega+1,2)) * d
length_z_1 = (k * m_1) * d * (ceil(2 * mp.log( eta * (b+1) * sigma_1 + mp.sqrt(2)*frak_s_1,2)) + 2.57)
length_z_2 = m_2 * d * (ceil(2 * mp.log( eta * sigma_2 + frak_s_2,2)) + 2.57)
enablePrint()
printv(f"auto-generated by modified-abdlop-codegen.sage from {params_file}.")
printv(f"")
if not (kmlwe >= 0 and kmlwe == m2 - kmsis - l):
err("protocol not simulatable")
if not (kmlwe >= 0 and kmlwe == m_2 - kmsis - l):
err("protocol not simulatable because of the parameters")
printv(
f"the commitment scheme is hiding under MLWE({kmlwe},{kmsis+l}) with sd={nstr(sigma_2, prec)})")
f"the commitment scheme is binding under MSIS({kmsis},{k*m_1 - l + m_2}) with bound={nstr(bound_binding(), prec)})")
printv(
f"the commitment scheme is hiding under MLWE({kmsis+l},{kmlwe}) with sd={nstr(sigma_2, prec)})")
printv(
f"protocol is simulatable under Hint-MLWE implied by MLWE({kmlwe},{kmsis+l}) with sd={nstr(varsigma_2, prec)})")
f"protocol is simulatable under Hint-MLWE implied by MLWE({kmsis+l},{kmlwe}) with sd={nstr(varsigma_2(), prec)})")
eknow = mpf(1)/mpf(Csize)
printv(
f"protocol is knowledge-sound with knowledge error <= 2^({nstr(mp.ceil(mp.log(eknow,2)),prec)})")
f"protocol is knowledge-sound with knowledge error <= 2^({nstr(mp.ceil(mp.log(eknow,2)),prec)}) under MSIS({kmsis},{k*m_1- l + m_2}) with bound={nstr(bound_know_soundness(), prec)})")
