Supplementary Materials A Further Details of LWE

A.1 Ring Learning with Errors ( 2) We now define RLWE samples and explain how to get LWE instances from them. We give a proof of the search binary-LWE to decisional binary-LWE reduction. Moreover, there are also attacks that do not use lattice reduction. Binary and ternary secret distributions are widely used in homomorphic encryption schemes. Let us now turn to the attacks on (sparse) binary/ternary secrets.