a590003

is a coset of the lattice Λ = L( [ ] √
R
I
). It remains to show that r Σ3 ≥ η ɛ (Λ), so that the rightmost term
in (5.1) above is essentially a constant (up to some factor in [ 1−ɛ
1+ɛ
, 1]) independent of ¯x, by Lemma 2.5. Then
we can conclude that p¯x ∈ [ 1−ɛ
1+ɛ , 1+ɛ
1−ɛ ] · ρ r √ Σ
(¯x), from which the theorem follows.
To show that r √ Σ 3 ≥ η ɛ (Λ), note that since Λ ∗ ⊂ V , for any covariance Π we have ρ √
P Π
(Λ ∗ ) =
ρ √ Π (Λ∗ ), and so P √ Π ≥ η ɛ (Λ) if and only if √ Π ≥ η ɛ (Λ). Now because both Σ p , Σ y ≥ 2 [ ]
R
I
[ R t I ], we
have
Σ + p + Σ + y ≤ ( [ ]
R
I
[ R t I ]) + .
Because r [ ]
R
I
≥ ηɛ (Λ) for ɛ = negl(n) by Lemma 2.3, we have r √ √
Σ 3 = r (Σ + p + Σ + y ) + ≥ η ɛ (Λ), as
desired.
5.5 Trapdoor Delegation
Here we describe very simple and efficient mechanism for securely delegating a trapdoor for A ∈ Z n×m
q
to a trapdoor for an extension A ′ ∈ Z n×m′
q of A. Our method has several advantages over the previous
basis delegation algorithm of [CHKP10]: first and most importantly, the size of the delegated trapdoor grows
only linearly with the dimension m ′ of Λ ⊥ (A ′ ), rather than quadratically. Second, the algorithm is much
more efficient, because it does not require testing linear independence of Gaussian samples, nor computing
the expensive ToBasis and Hermite normal form operations. Third, the resulting trapdoor R has a ‘nice’
Gaussian distribution that is easy to analyze and may be useful in applications. We do note that while the
delegation algorithm from [CHKP10] works for any extension A ′ of A (including A itself), ours requires
m ′ ≥ m + w. Fortunately, this is frequently the case in applications such as HIBE and others that use
delegation.
Algorithm 4 Efficient algorithm DelTrap O (A ′ = [A | A 1 ], H ′ , s ′ ) for delegating a trapdoor.
Input: an oracle O for discrete Gaussian sampling over cosets of Λ = Λ ⊥ (A) with parameter s ′ ≥ η ɛ (Λ).
• parity-check matrix A ′ = [A | A 1 ] ∈ Z n×m
q × Z n×w
q ;
• invertible matrix H ′ ∈ Z n×n
q ;
Output: a trapdoor R ′ ∈ Z m×w for A ′ with tag H ∈ Z n×n
q .
1: Using O, sample each column of R ′ independently from a discrete Gaussian with parameter s ′ over the
appropriate coset of Λ ⊥ (A), so that AR ′ = H ′ G − A 1 .
Usually, the oracle O needed by Algorithm 4 would be implemented (up to negl(n) statistical distance) by
Algorithm 3 above, using a trapdoor R for A where s 1 (R) is sufficiently small relative to s ′ . The following
is immediate from Lemma 2.9 and the fact that the columns of R ′ are independent and negl(n)-subgaussian.
A relatively tight bound on the hidden constant factor can also be derived from Lemma 2.9.
Lemma 5.7. For any valid inputs A ′ and H ′ , Algorithm 4 outputs a trapdoor R ′ for A ′ with tag H ′ , whose
distribution is the same for any valid implementation of O, and s 1 (R ′ ) ≤ s ′ · O( √ m + √ w) except with
negligible probability.
29
4. Trapdoors for Lattices