Kyber-Style Lattice Encryption (Module-LWE)

Message & Keys

Noise bound η (secret & error size) 2

Modulus q

Live Readout

s = 1 a = 1 b = a·s+e

Decoded bit (highlighted)

Noise term

Decryption success rate (200 trials)

100.0%

How it works

This is the scalar core of a Module-LWE key encapsulation scheme — the same mathematical idea CRYSTALS-Kyber uses, just with single integers mod q instead of polynomial rings. Every value lives on a circle of q residues (angle = 2π·value/q).

Key gen:  secret s, error e small (|·| ≤ η)
          public key (a, b),  b = a·s + e  (mod q)

Encrypt m∈{0,1}:  fresh r, e1, e2 small (|·| ≤ η)
          u = a·r + e1            (mod q)
          v = b·r + e2 + m·⌊q/2⌋  (mod q)

Decrypt:  w = v − s·u (mod q)
            = e·r + e2 − s·e1 + m·⌊q/2⌋
        m' = 0 if w is near 0,  m' = 1 if w is near q/2

Bit 0 / Bit 1 — the message being encapsulated; it lands near angle 0° or 180° on the ring after decryption.
η slider — the size of the secret and every noise term. Correctness needs the accumulated noise e·r+e2−s·e1 to stay below q/4; push η too high for a given q and points start crossing into the wrong half — a real decryption failure, exactly the trade-off Kyber's parameter sets are tuned to avoid.
q selector — the ring size. A larger q gives more headroom for the same η, which is why real Kyber uses q = 3329.
Resample — draws 200 independent encryptions of the current bit with fresh randomness each time and decrypts all of them with the secret key, colouring each by whether it decoded correctly.

Security rests on the Learning-With-Errors problem: without s, the public pairs (a,b) and ciphertexts (u,v) are computationally indistinguishable from uniform noise on the ring — there is no known efficient classical or quantum algorithm (including Shor's, which only breaks the factoring/discrete-log structure behind RSA and elliptic-curve cryptography) that recovers s from them. That quantum resistance is exactly why NIST standardised Kyber (now ML-KEM) for post-quantum key exchange.

Region "decodes to 0" Region "decodes to 1" Highlighted ciphertext

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.