a590003

G is primitive, the tag H in the above definition is uniquely determined by (and efficiently computable from)
A and the trapdoor R.
The following lemma says that a good basis for Λ ⊥ (A) may be obtained from knowledge of R. We
do not use the lemma anywhere in the rest of the paper, but include it here primarily to show that our new
definition of trapdoor is at least as powerful as the traditional one of a short basis. Our algorithms for Gaussian
sampling and LWE inversion do not need a full basis, and make direct (and more efficient) use of our new
notion of trapdoor.
Lemma 5.3. Let S ∈ Z w×w be any basis for Λ ⊥ (G). Let A ∈ Z n×m
q
tag H ∈ Z n×n
q . Then the lattice Λ ⊥ (A) is generated by the basis
[ ] [ ]
I R I 0
S A =
,
0 I W S
have trapdoor R ∈ Z (m−w)×w with
where W ∈ Z w× ¯m is an arbitrary solution to GW = −H −1 A[I | 0] T mod q. Moreover, the basis S A
satisfies ‖ ˜S A ‖ ≤ s 1 ( [ ]
I R
0 I ) · ‖˜S‖ ≤ (s1 (R) + 1) · ‖˜S‖, when S A is orthogonalized in suitable order.
Proof. It is immediate to check that A · S A = 0 mod q, so S A generates a sublattice of Λ ⊥ (A). In fact, it
generates the entire lattice because det(S A ) = det(S) = q n = det(Λ ⊥ (A)).
The bound on ‖ ˜S A ‖ follows by simple linear algebra. Recall by Item 3 of Lemma 2.1 that ‖ ˜B‖ = ‖˜S‖
when the columns of B = [ I 0
W S
]
are reordered appropriately. So it suffices to show that ‖˜TB‖ ≤
s 1 (T) · ‖ ˜B‖ for any T, B. Let B = QDU and TB = Q ′ D ′ U ′ be Gram-Schmidt decompositions of B
and TB, respectively, with Q, Q ′ orthogonal, D, D ′ diagonal with nonnegative entries, and U, U ′ upper
unitriangular. We have
TQDU = Q ′ D ′ U ′ =⇒ T ′ D = D ′ U ′′ ,
where T = Q ′ T ′ Q −1 ⇒ s 1 (T ′ ) = s 1 (T), and U ′′ is upper unitriangular because such matrices form a
multiplicative group. Now every row of T ′ D has Euclidean norm at most s 1 (T) · ‖D‖ = s 1 (T) · ‖ ˜B‖,
while the ith row of D ′ U ′′ has norm at least d ′ i,i , the ith diagonal of D′ . We conclude that ‖˜TB‖ = ‖D‖ ≤
s 1 (T) · ‖ ˜B‖, as desired.
We also make the following simple but useful observations:
• The rows of [ R
I
]
in Definition 5.2 can appear in any order, since this just induces a permutation of A’s
columns.
• If R is a trapdoor for A, then it can be made into an equally good trapdoor for any extension [A | B],
by padding R with zero rows; this leaves s 1 (R) unchanged.
• If R is a trapdoor for A with tag H, then R is also a trapdoor for A ′ = A − [0 | H ′ G] with tag
(H − H ′ ) for any H ′ ∈ Z n×n
q , as long as (H − H ′ ) is invertible modulo q. This is the main idea
behind the compact IBE of [ABB10a], and can be used to give a family of “tag-based” trapdoor
functions [KMO10]. In Section 6 we give explicit families of matrices H having suitable properties
for applications.
5.2 Trapdoor Generation
We now give an algorithm to generate a (pseudo)random matrix A together with a G-trapdoor. The algorithm
is straightforward, and in fact it can be easily derived from the definition of G-trapdoor itself. A random
23
4. Trapdoors for Lattices