a590003

Algorithm 3 Efficient algorithm SampleD O (R, Ā, H, u, s) for sampling a discrete Gaussian over Λ⊥ u (A).
Input: An oracle O(v) for Gaussian sampling over a desired coset Λ ⊥ v (G) with fixed parameter r √ Σ G ≥
η ɛ (Λ ⊥ (G)), for some Σ G ≥ 2 and ɛ ≤ 1/2.
Offline phase:
• partial parity-check matrix Ā ∈ Zn×
¯m
q ;
• trapdoor matrix R ∈ Z ¯m×w ;
• positive definite Σ ≥ [ R
I
]
(2 + ΣG )[ R t I ], e.g., any Σ = s 2 ≥ (s 1 (R) 2 + 1)(s 1 (Σ G ) + 2).
Online phase:
• invertible tag H ∈ Z n×n
q defining A = [Ā | HG − ĀR] ∈ Zn×m q , for m = ¯m + w
(H may instead be provided in the offline phase, if it is known then);
• syndrome u ∈ Z n q .
Output: A vector x drawn from a distribution within O(ɛ) statistical distance of D Λ ⊥ u (A),r·√Σ .
Offline phase:
1: Choose a fresh perturbation p ← D Z m ,r √ Σ p
, where Σ p = Σ − [ R
I
]
ΣG [ R t I ] ≥ 2 [ R
I
]
[ R t I ].
2: Let p = [ p 1
p 2
] for p 1 ∈ Z ¯m , p 2 ∈ Z w , and compute ¯w = Ā(p 1 − Rp 2 ) ∈ Z n q and w = Gp 2 ∈ Z n q .
Online phase:
3: Let v ← H −1 (u − ¯w) − w = H −1 (u − Ap) ∈ Z n q , and choose z ← D Λ ⊥ v (G),r √ Σ G
by calling O(v).
4: return x ← p + [ R
I
]
z.
Step 3 by the unique ¯z ∈ Λ ⊥ v (G) such that ¯x − ¯p = [ R
I
]¯z. It is easy to check that ρ √ ΣG
(¯z) = ρ √ Σ y
(¯x − ¯p),
where
Σ y = [ R
I
]
ΣG [ R t I ] ≥ 2 [ R
I
]
[ R t I ]
is the covariance matrix with span(Σ y ) = V . Note that Σ p + Σ y = Σ by definition of Σ p , and that
span(Σ p ) = R m because Σ p > 0. Therefore, we have (where C denotes a normalizing constant that may
vary from line to line, but does not depend on ¯x):
p¯x = Pr[SampleD outputs ¯x]
∑
=
D √ Z m ,r Σ p
(¯p) · D √ Λ ⊥ v (G),r Σ y
(¯z)
¯p∈Z m ∩(V +¯x)
(def. of SampleD)
= C ∑¯p
ρ √
r Σp
(¯p) · ρ √
r Σy
(¯p − ¯x)/ρ √ r ΣG
(Λ ⊥ v (G)) (def. of D)
= C · ρ √
r Σ
(¯x) · ∑
ρ √ r Σ3
(¯p − c 3 )/ρ √ r ΣG
(Λ ⊥ v (G)) (Fact 5.6)
¯p
∈ C[1, 1+ɛ
1−ɛ ] · ρ r √ Σ (¯x) · ∑
ρ √ r Σ3
(¯p − c 3 )
¯p
(Lemma 2.5 and r √ Σ G ≥ η ɛ (Λ ⊥ (G)))
= C[1, 1+ɛ
1−ɛ ] · ρ r √ Σ (¯x) · ρ r √ Σ 3
(Z m ∩ (V + ¯x) − c 3 ), (5.1)
where Σ + 3 = P(Σ+ p + Σ + y )P and c 3 ∈ v + V = ¯x + V , because the component of ¯x orthogonal to V is the
unique point v ∈ (V + ¯x) ∩ V ⊥ . Therefore,
Z m ∩ (V + ¯x) − c 3 = (Z m ∩ V ) + (¯x − c 3 ) ⊂ V
28
4. Trapdoors for Lattices