a590003

must return this e (but possibly different z) in both games. Finally, the result of decryption is the same in
both games: if ¯v ∈ 2Λ(Āt ) (otherwise, both games return ⊥), then we can express v as
v t = 2(s t A u mod q) + (0, v ′ ) t mod 2q
for some s ∈ Z n q and v ′ ∈ Z nk
2q . Then for any solution R ∈ Z ¯m×nk to A 1 = −ĀR mod q, we have
v t[ R
I
]
= 2(s t h(u)G mod q) + (v ′ ) t mod 2q.
In particular, this holds for the R in H 0 and the ˆR in H 1 that are used for decryption. It follows that both
games output encode −1 (v ′ ), if it exists (and ⊥ otherwise).
Finally, in H 1 we produce the challenge ciphertext (u, b) on a message m ∈ {0, 1} nk as follows. Let
u = u ∗ , and choose s ← Z n q and ē ← D ¯m Z,αq as usual, but do not choose e 1. Note that A u = [Ā | −ĀR].
Let ¯b t = 2(s t Ā mod q) + ē t mod 2q. Let
b t 1 = −¯b t R + ê t + encode(m) mod 2q,
where ê ← D nk
Z,αq √ m·ω( √ log n) , and output (u, b = (¯b, b 1 )). We now show that the distribution of (u, b)
is within negl(n) statistical distance of that in H 0 , given the attacker’s view (i.e., pk and the results of
the decryption queries). Clearly, u and ¯b have essentially the same distribution as in H 0 , because u is
negl(n)-uniform given pk, and by construction of ¯b. By substitution, we have
b t 1 = 2(s t (−ĀR) mod q) + (ēt R + ê t ) + encode(m).
Therefore, it suffices to show that for fixed ē, each 〈ē, r i 〉 + ê i has distribution negl(n)-far from D Z,s , where
s 2 = (‖ē‖ 2 + m(αq) 2 ) · ω( √ log n) 2 , over the random choice of r i (conditioned on the value of Ār i from
the public key) and of ê i . Because each r i is an independent discrete Gaussian over a coset of Λ⊥ (Ā), the
claim follows essentially by [Reg05, Corollary 3.10], but adapted to discrete random variables using [Pei10,
Theorem 3.1] in place of [Reg05, Claim 3.9].
In game H 2 , we only change how the ¯b component of the challenge ciphertext is created, letting it be
uniformly random in Z2q ¯m . We construct pk, answer decryption queries, and construct b 1 in exactly the
same way as in H 1 . First observe that under our (discretized) LWE hardness assumption, games H 1 and
H 2 are computationally indistinguishable by an elementary reduction: given (Ā, ¯b) ∈ Zn× ¯m
q × Z2q ¯m where
Ā is uniformly random and either ¯b t = 2(s t Ā mod q) + e t mod 2q (for s ← Z n q and e ← DZ,αq ¯m ) or ¯b
is uniformly random, we can efficiently emulate either game H 1 or H 2 (respectively) by doing everything
exactly as in the two games, except using the given Ā and ¯b when constructing the public key and challenge
ciphertext.
Now by the leftover hash lemma, (Ā, ¯b t , ĀR, −¯b t R) is negl(n)-uniform when R is chosen as in H 2 .
Therefore, the challenge ciphertext has the same distribution (up to negl(n) statistical distance) for any
encrypted message, and so the adversary’s advantage is negligible. This completes the proof.
References
[ABB10a] S. Agrawal, D. Boneh, and X. Boyen. Efficient lattice (H)IBE in the standard model. In
EUROCRYPT, pages 553–572. 2010.
[ABB10b] S. Agrawal, D. Boneh, and X. Boyen. Lattice basis delegation in fixed dimension and shorterciphertext
hierarchical IBE. In CRYPTO, pages 98–115. 2010.
37
4. Trapdoors for Lattices