This is the scalar core of a Module-LWE key encapsulation scheme — the same mathematical idea CRYSTALS-Kyber uses, just with single integers mod q instead of polynomial rings. Every value lives on a circle of q residues (angle = 2π·value/q). Drag the ring to orbit the view, exactly like the 3D version's camera.
Key gen: secret s, error e small (|·| ≤ η)
public key (a, b), b = a·s + e (mod q)
Encrypt m∈{0,1}: fresh r, e1, e2 small (|·| ≤ η)
u = a·r + e1 (mod q)
v = b·r + e2 + m·⌊q/2⌋ (mod q)
Decrypt: w = v − s·u (mod q)
= e·r + e2 − s·e1 + m·⌊q/2⌋
m' = 0 if w is near 0, m' = 1 if w is near q/2
Worst-case |noise| ≤ |e·r| + |e2| + |s·e1| ≤ 2η² + η
(needs to stay below q/4 for reliable decryption)
- Bit 0 / Bit 1 — the message being encapsulated; it lands near angle 0° or 180° on the ring after decryption.
- η slider — the size of the secret and every noise term. Correctness needs the accumulated noise e·r+e2−s·e1 to stay below q/4; push η too high for a given q and points start crossing into the wrong half — a real decryption failure, exactly the trade-off Kyber's parameter sets are tuned to avoid. The margin bar below the readout shows the theoretical worst case 2η²+η against that q/4 threshold directly.
- q selector — the ring size. A larger q gives more headroom for the same η, which is why real Kyber uses q = 3329.
- Trials slider — how many independent encryptions are drawn and decrypted per resample; more trials give a steadier success-rate estimate.
- Resample — draws fresh independent encryptions of the current bit with new randomness and decrypts all of them with the secret key, colouring each by whether it decoded correctly, and appends the resulting rate to the history strip.
- Drag the ring — rotates and tilts the view (equivalent to orbit-controls in the 3D version); it only changes what you see, never the underlying math.
Security rests on the Learning-With-Errors problem: without s, the public pairs (a,b) and ciphertexts (u,v) are computationally indistinguishable from uniform noise on the ring — there is no known efficient classical or quantum algorithm (including Shor's, which only breaks the factoring/discrete-log structure behind RSA and elliptic-curve cryptography) that recovers s from them. That quantum resistance is exactly why NIST standardised Kyber (now ML-KEM) for post-quantum key exchange.