I was recently reading the lattice-based signature scheme GPV08 (full paper), and the following statement confuses me alot (which is in the section 5.1, page 17&18): Throughout the paper, we use two easy but important facts about the lattices defined above. First... The second fact is that the q...

We know that CRYSTALS-KYBER's KEM (key encapsulation mechanism) key generation algorithm is Output: Public key *pk* $\in B^{12\cdot k\cdot n/8+32}$, Secret key *sk* $\in B^{24\cdot k\cdot n/8+96}$ 1 $z \leftarrow B^{32}$ (32-byte string) 2 $(pk, sk′) =$ Kyber.CPAPKE.KeyGen() 3 sk $=$...

Let $\mathbb{Z}_p$ be a prime field, $a, b$ be two random elements independently drawn from $\mathbb{Z}_p^*$, and $$ c = a* b \mod p,$$ is $c$ uniformly random? and why? How is this question related to the discrete-log assumption? Because if $a =b$, then my understanding is that the discrete-log ...

I'd like to generate a QR code (or some other 2D barcode) that would include a HMAC of its contents. Since it's a printed QR code, and since it will already contain a fair amount of data, I'd like the HMAC overhead to be as small as possible, while still making it reasonably difficult to crack. By "