a590003

The offline ‘bucketing’ approach to Gaussian sampling works without any modification for arbitrary
modulus, with just slighly larger Gaussian parameter s ≥ √ 5 · r, because it relies only on the smoothing
parameter bound of η ɛ (Λ ⊥ (g t )) ≤ ‖˜S k ‖ · ω( √ log n) and the fact that the number of buckets is q. The
randomized nearest-plane approach to sampling does not admit a specialization as simple as the one we have
described for q = 2 k . The reason is that while the basis S is sparse, its orthogonalization ˜S is not sparse in
general. (This is in contrast to the case when q = 2 k , for which orthogonalizing in reverse order leads to
the sparse matrix ˜S = 2I.) Still, ˜S is “almost triangular,” in the sense that the off-diagonal entries decrease
geometrically as one moves away from the diagonal. This may allow for optimizing the sampling algorithm
by performig “truncated” scalar product computations, and still obtain an almost-Gaussian distribution on the
resulting samples. An interesting alternative is to use a hybrid approach, where one first performs a single
iteration of randomized nearest-plane algorithm to take care of the last basis vector s k , and then performs
some variant of the convolution algorithm from [Pei10] to deal with the first k −1 basis vectors [s 1 , . . . , s k−1 ],
which have very small lengths and singular values. Notice that the orthogonalized component of the last
vector s k is simply a scalar multiple of the primitive vector g, so the scalar product 〈s k , t〉 (for any vector t
with syndrome u = 〈g, t〉) can be immediately computed from u as u/q (see Lemma 4.3).
4.3 The Ring Setting
The above constructions and algorithms all transfer easily to compact lattices defined over polynomial rings
(i.e., number rings), as used in the representative works [Mic02, PR06, LM06, LPR10]. A commonly used
example is the cyclomotic ring R = Z[x]/(Φ m (x)) where Φ m (x) denotes the mth cyclotomic polynomial,
which is a monic, degree-ϕ(m), irreducible polynomial whose zeros are all the primitive mth roots of unity
in C. The ring R is a Z-module of rank n, i.e., it is generated as the additive integer combinations of the
“power basis” elements 1, x, x 2 , . . . , x ϕ(m)−1 . We let R q = R/qR, the ring modulo the ideal generated by an
integer q. For geometric concepts like error vectors and Gaussian distributions, it is usually nicest to work
with the “canonical embedding” of R, which roughly (but not exactly) corresponds with the “coefficient
embedding,” which just considers the vector of coefficients relative to the power basis.
Let g ∈ Rq k be a primitive vector modulo q, i.e., one for which the ideal generated by q, g 1 , . . . , g k is the
full ring R. As above, the vector g defines functions f g t : R k → R q and g g t : R q × R k → Rq
1×k , defined as
f g t(x) = 〈g, x〉 = ∑ k
i=1 g i · x i mod q and g g t(s, e) = s · g t + e t mod q, and the related R-module
qR k ⊆ Λ ⊥ (g t ) := {x ∈ R k : f g t(x) = 〈g, x〉 = 0 mod q} R k ,
which has index (determinant) q n = |R q | as an additive subgroup of R k because g is primitive. Concretely,
we can use the exact same primitive vector g t = [1, 2, . . . , 2 k−1 ] ∈ R k q as in Equation (4.1), interpreting its
entries in the ring R q rather than Z q .
Inversion and preimage sampling algorithms for g g t and f g t (respectively) are relatively straightforward
to obtain, by adapting the basic approaches from the previous subsections. These algorithms are simplest
when the power basis elements 1, x, x 2 , . . . , x ϕ(m)−1 are orthogonal under the canonical embedding (which
is the case exactly when m is a power of 2, and hence Φ m (x) = x m/2 + 1), because the inversion operations
reduce to parallel operations relative to each of the power basis elements. We defer the details to the full
version.
21
4. Trapdoors for Lattices