a590003

Let Λ ⊂ R n be a lattice, let c ∈ R n , and let Σ ≥ 0 be a positive semidefinite matrix such that
(Λ + c) ∩ span(Σ) is nonempty. The discrete Gaussian distribution D √
Λ+c, Σ
is simply the Gaussian
distribution D √ Σ
restricted to have support Λ + c. That is, for all x ∈ Λ + c,
D Λ+c,
√
Σ
(x) =
ρ√ Σ (x)
ρ √ Σ (Λ + c) ∝ ρ√ Σ (x).
We recall the definition of the smoothing parameter from [MR04], generalized to non-spherical (and
potentially degenerate) Gaussians. It is easy to see that the definition is consistent with the partial ordering of
positive semidefinite matrices, i.e., if Σ 1 ≥ Σ 2 ≥ η ɛ (Λ), then Σ 1 ≥ η ɛ (Λ).
Definition 2.2. Let Σ ≥ 0 and Λ ⊂ span(Σ) be a lattice. We say that √ Σ ≥ η ɛ (Λ) if ρ √ Σ + (Λ ∗ ) ≤ 1 + ɛ.
The following is a bound on the smoothing parameter in terms of any orthogonalized basis. Note that for
practical choices like n ≤ 2 14 and ɛ ≥ 2 −80 , the multiplicative factor attached to ‖ ˜B‖ is bounded by 4.6.
Lemma 2.3 ([GPV08, Theorem 3.1]). Let Λ ⊂ R n be a lattice with basis B, and let ɛ > 0. We have
η ɛ (Λ) ≤ ‖ ˜B‖ · √ln(2n(1
+ 1/ɛ))/π.
In particular, for any ω( √ log n) function, there is a negligible ɛ(n) for which η ɛ (Λ) ≤ ‖ ˜B‖ · ω( √ log n).
For appropriate parameters, the smoothing parameter of a random lattice Λ ⊥ (A) is small, with very high
probability. The following bound is a refinement and strengthening of one from [GPV08], which allows for a
more precise analysis of the parameters and statistical errors involved in our constructions.
Lemma 2.4. Let n, m, q ≥ 2 be positive integers. For s ∈ Z n q , let the subgroup G s = {〈a, s〉 : a ∈ Z n q } ⊆
Z q , and let g s = |G s | = q/ gcd(s 1 , . . . , s n , q). Let ɛ > 0, η ≥ η ɛ (Z m ), and s > η be reals. Then for
uniformly random A ∈ Z n×m
q ,
E
A
[
ρ 1/s (Λ ⊥ (A) ∗ )
In particular, if q = p e is a power of a prime p, and
{
m ≥ max n +
]
≤ (1 + ɛ) ∑
max{1/g s , η/s} m . (2.1)
log(3 + 2/ɛ)
,
log p
s∈Z n q
}
n log q + log(2 + 2/ɛ)
, (2.2)
log(s/η)
then E A
[
ρ1/s (Λ ⊥ (A) ∗ ) ] ≤ 1+2ɛ, and so by Markov’s inequality, s ≥ η 2ɛ/δ (Λ ⊥ (A)) except with probability
at most δ.
Proof. We will use the fact (which follows from the Poisson summation formula; see [MR04, Lemma 2.8])
that ρ t (Λ) ≤ ρ r (Λ) ≤ (r/t) m · ρ t (Λ) for any rank-m lattice Λ and r ≥ t > 0.
For any A ∈ Z n×m
q , one can check that Λ ⊥ (A) ∗ = Z m + {A t s/q : s ∈ Z n q }. Note that A t s is uniformly
12
4. Trapdoors for Lattices