a590003

3 Search to Decision Reduction
Here we give a new search-to-decision reduction for LWE that essentially subsumes all of the (incomparable)
prior ones given in [BFKL93, Reg05, Pei09b, ACPS09]. 5 Most notably, it handles moduli q that were not
covered before, specifically, those like q = 2 k that are divisible by powers of very small primes. The only
known reduction that ours does not subsume is a different style of sample-preserving reduction recently given
in [MM11], which works for a more limited class of moduli and error distributions; extending that reduction
to the full range of parameters considered here is an interesting open problem. In what follows, ω( √ log n)
denotes some fixed function that grows faster than √ log n, asymptotically.
Theorem 3.1. Let q have prime factorization q = p e 1
1 · · · pe k
k
for pairwise distinct poly(n)-bounded primes p i
with each e i ≥ 1, and let 0 < α ≤ 1/ω( √ log n). Let l be the number of prime factors p i < ω( √ log n)/α.
There is a probabilistic polynomial-time reduction from solving search-LWE q,α (in the worst case, with
overwhelming probability) to solving decision-LWE q,α ′ (on the average, with non-negligible advantage) for
any α ′ ≥ α such that α ′ ≥ ω( √ log n)/p e i
i
for every i, and (α ′ ) l ≥ α · ω( √ log n) 1+l .
For example, when every p i ≥ ω( √ log n)/α we have l = 0, and any α ′ ≥ α is acceptable. (This special
case, with the additional constraint that every e i = 1, is proved in [Pei09b].) As a qualitatively new example,
when q = p e is a prime power for some (possibly small) prime p, then it suffices to let α ′ ≥ α · ω( √ log n) 2 .
(A similar special case where q = p e for sufficiently large p and α ′ = α ≪ 1/p is proved in [ACPS09].)
Proof. We show how to recover each entry of s modulo a large enough power of each p i , given access to the
distribution A s,α for some s ∈ Z n q and to an oracle O solving DLWE q,α ′. For the parameters in the theorem
statement, we can then recover the remainder of s in polynomial time by rounding and standard Gaussian
elimination.
First, observe that we can transform A s,α into A s,α ′ simply by adding (modulo 1) an independent sample
from D √ α ′2 −α
to the second component of each (a, b = 〈a, s〉/q + D 2 α mod 1) ∈ Z n q × T drawn from A s,α .
We now show how to recover each entry of s modulo (powers of) any prime p = p i dividing q. Let
e = e i , and for j = 0, 1, . . . , e define A j s,α
to be the distribution over Z n ′
q × T obtained by drawing
(a, b) ← A s,α ′ and outputting (a, b + r/p j mod 1) for a fresh uniformly random r ← Z q . (Clearly, this
distribution can be generated efficiently from A s,α ′.) Note that when α ′ ≥ ω( √ log n)/p j ≥ η ɛ ((1/p j )Z)
for some ɛ = negl(n), A j s,α
is negligibly far from U = U(Z n ′
q × T), and this holds at least for j = e
by hypothesis. Therefore, by a hybrid argument there exists some minimal j ∈ [e] for which O has a
non-negligible advantage in distinguishing between A j−1
s,α
and A j ′ s,α
, over a random choice of s and all other
′
randomness in the experiment. (This j can be found efficiently by measuring the behavior of O.) Note that
when p i ≥ ω( √ log n)/α ≥ ω( √ log n)/α ′ , the minimal j must be 1; otherwise it may be larger, but there
are at most l of these by hypothesis. Now by a standard random self-reduction and amplification techniques
(e.g., [Reg05, Lemma 4.1]), we can in fact assume that O accepts (respectively, rejects) with overwhelming
probability given A j−1
s,α
(resp., A j ′ s,α
), for any s ∈ Z n ′ q .
Given access to A j−1
s,α
and O, we can test whether s ′ 1 = 0 mod p by invoking O on samples from A j−1
s,α ′
that have been transformed as follows (all of what follows is analogous for s 2 , . . . , s n ): take each sample
(a, b = 〈a, s〉/q + e + r/p j−1 mod 1) ← A j−1
s,α
to ′
(a ′ = a − r ′ · (q/p j ) · e 1 , b ′ = b = 〈a ′ , s〉/q + e + (pr + r ′ s 1 )/p j mod 1) (3.1)
5 We say “essentially subsumes” because our reduction is not very meaningful when q is itself a very small prime, whereas those
of [BFKL93, Reg05] are meaningful. This is only because our reduction deals with the continuous version of LWE. If we discretize
the problem, then for very small prime q our reduction specializes to those of [BFKL93, Reg05].
15
4. Trapdoors for Lattices