a590003

andom over G m s , for uniformly random A. Then we have
[
]
ρ 1/s (Λ ⊥ (A) ∗ ) ≤ ∑
E
A
s∈Z n q
= ∑
s∈Z n q
≤ ∑
s∈Z n q
[
E ρ1/s (Z m + A t s/q) ] (lin. of E)
A
g −m
s
· ρ 1/s (g −1
s · Z m ) (avg. over A)
g −m
s · max{1, g s η/s} m · ρ 1/η (Z m ), (above fact)
≤ (1 + ɛ) ∑
max{1/g s , η/s} m , (η ≥ η ɛ (Z m )).
s∈Z n q
To prove the second part of the claim, observe that g s = p i for some i ≥ 0, and that there are at most g n
values of s for which g s = g, because each entry of s must be in G s . Therefore,
∑
1/gs m ≤ ∑ p i(n−m) =
i≥0
s∈Z n q
1
1 − p n−m ≤ 1 + ɛ
2(1 + ɛ) .
(More generally, for arbitrary q we have ∑ s 1/gm s ≤ ζ(m − n), where ζ(·) is the Riemann zeta function.)
Similarly, ∑ s (η/s)m = q n (s/η) −m ≤ , and the claim follows.
ɛ
2(1+ɛ)
We need a number of standard facts about discrete Gaussians.
Lemma 2.5 ([MR04, Lemmas 2.9 and 4.1]). Let Λ ⊂ R n be a lattice. For any Σ ≥ 0 and c ∈ R n ,
we have ρ √ Σ (Λ + c) ≤ ρ√ Σ (Λ). Moreover, if √ Σ ≥ η ɛ (Λ) for some ɛ > 0 and c ∈ span(Λ), then
ρ √ 1−ɛ
Σ
(Λ + c) ≥
1+ɛ · ρ√ Σ (Λ).
Combining the above lemma with a bound of Banaszczyk [Ban93], we have the following tail bound on
discrete Gaussians.
Lemma 2.6 ([Ban93, Lemma 1.5]). Let Λ ⊂ R n be a lattice and r ≥ η ɛ (Λ) for some ɛ ∈ (0, 1). For any
c ∈ span(Λ), we have
Pr [ ‖D Λ+c,r ‖ ≥ r √ n ] ≤ 2 −n · 1+ɛ
1−ɛ .
Moreover, if c = 0 then the bound holds for any r > 0, with ɛ = 0.
The next lemma bounds the predictability (i.e., probability of the most likely outcome or equivalently,
min-entropy) of a discrete Gaussian.
Lemma 2.7 ([PR06, Lemma 2.11]). Let Λ ⊂ R n be a lattice and r ≥ 2η ɛ (Λ) for some ɛ ∈ (0, 1). For any
c ∈ R n and any y ∈ Λ + c, we have Pr[D Λ+c,r = y] ≤ 2 −n · 1+ɛ
1−ɛ .
2.4 Subgaussian Distributions and Random Matrices
For δ ≥ 0, we say that a random variable X (or its distribution) over R is δ-subgaussian with parameter
s > 0 if for all t ∈ R, the (scaled) moment-generating function satisfies
E [exp(2πtX)] ≤ exp(δ) · exp(πs 2 t 2 ).
13
4. Trapdoors for Lattices