RLWE Cryptosystem

In the RLWE cryptosystem, the formula in

⟨

Summary B-1.2

⟩

is the same, but

\vec{s}, {\vec{a}}^{⟨ i ⟩}, b^{⟨ i ⟩}, m^{⟨ i ⟩}, e^{⟨ i ⟩}

are replaced by polynomials

S, A^{⟨ i ⟩}, B^{⟨ i ⟩}, M^{⟨ i ⟩}, E^{⟨ i ⟩}

as follows:

$⟨$ Summary B-1.3 $⟩$ Lattice-based RLWE Cryptosystem

Encryption: $B^{⟨ i ⟩} = S \cdot A^{⟨ i ⟩} + Δ \cdot M^{⟨ i ⟩} + E^{⟨ i ⟩}$ , where $B^{⟨ i ⟩}$ and $A^{⟨ i ⟩}$ are publicly known also to the attacker, while $S, M^{⟨ i ⟩}, E^{⟨ i ⟩}$ are unknown (only known by the secret key owner).
Decryption: $\frac{⌈ B^{⟨ i ⟩} - S \cdot A^{⟨ i ⟩} ⌋_{Δ}}{Δ} = \frac{⌈ Δ M^{⟨ i ⟩} + E^{⟨ i ⟩} ⌋_{Δ}}{Δ} = M^{⟨ i ⟩}$
$($ provided $| | E^{⟨ i ⟩} | |_{\infty} < \frac{Δ}{2}$ , meaning each coefficient of $E^{⟨ i ⟩}$ has a magnitude less than $\frac{Δ}{2})$

$⌈ ⌋_{Δ}$ is equivalent to rounding each term’s coefficient in the polynomial.