What are common bits for the p,q such that it has 128-bit security?
For example, if the error bits are 7, what is the value of q and p?
Hi @guerlando , could you be a bit more specific what you mean by p and q? Do these refer to the ciphertext and plaintext modulus, respectively? Generally, the security of G-/R-/LWE depends on the dimension of the LWE instance and the noise to (ciphertext) modulus ratio, and, to a lesser degree, the number of samples/ciphertexts given. The dimension of the G-/R-/LWE instance is given by the size of the secret n in the case of LWE, the degree N of the ring in case of RLWE, and by k*N (number of ring elements times the degree of the ring) in the case of GLWE. The ciphertext modulus is usually referred to as q and the standard deviation as sigma. Note that often sigma is given in its normalized version, where it’s divided by the ciphertext, giving the noise to modulus ratio directly. For a specific set of parameters you can use the lattice estimator to check the security level.