… Each such polynomial \(f(x)\) gives rise to a weak instance of PLWE, according to our attack.
However, to obtain an attack on RLWE, we would need to check that the first 4 properties …

… q such that the decision version of PLWE is weak. The attack can be … Applying \(\phi \) to the
PLWE samples results in equations of … too much modulo q, this attack breaks decision PLWE. …

… Furthermore, if the algorithm returns NOT PLWE, then the samples were not valid Poly-LWE
samples. If it outputs anything other than NOT PLWE, then the samples are valid Poly-LWE …

… at least as hard as \(\mathsf {PLWE}\) for any f in an exponentially large … We construct
the OHCP instance from the decision \(\mathsf {… the plausibility of weak fields for \(\mathsf {RLWE}\). …

… more number fields weak to the … instances weak against the methods. And they showed
that RLWE attack is also possible using the isomorphism between PLWE and RLWE instances …

… Having established the mapped distribution, we demonstrate how effective distinguishers
can be built for weak instances recognized by our method, with or without information of the …

… decision-PLWE problem succeed with sufficiently high probability in polynomial time under
certain assumptions, one of which is that the defining polynomial of the PLWE instance splits …

… We emphasize that PLWE is implicit in [26] and we just make … We notice that (a ,as + 2e)
is exactly a PLWE instance, so it is … The above implies a very weak form of KDM: that it is …

… As we shall see, the attacks are all instances of the following framework. … We remark
that Condition (2) is actually a bit weaker than what is required by [16, Theorem 4.1] (worst-case …

… x) and the reduction from RLWE to PLWE was extended by weakening … PLWE holds and
RLWE samples can be converted to PLWE samples, thus providing examples of weak instances …