a590003

(large) uniform errors as in [10], but for an unbounded number of samples. In our work, hardness of LWE
for errors smaller than √ n is proved for a much smaller number of samples m, and this is necessary in order
to avoid the subexponential time attack of [2].
While the focus of our work in on LWE with small errors, we remark that our main LWE hardness result
(Theorem 4.6) can also be instantiated using large polynomial errors r = n O(1) to obtain any (linear) number
of samples m = Θ(n). In this setting, [10] provides a much better dependency between the magnitude of the
errors and the number of samples (which in [10] can be an arbitrary polynomial). This is due to substantial
differences in the low-level techniques employed in [10] and in our work to analyze the statistical properties
of the lossy function family. For these same reasons, even for large errors, our results seem incomparable to
those of [10] because we allow for a much wider class of error distributions.
2 Preliminaries
We use uppercase roman letters F, X for sets, lowercase roman for set elements x ∈ X, bold x ∈ X n
for vectors, and calligraphic letters F, X , . . . for probability distributions. The support of a probability
distribution X is denoted [X ]. The uniform distribution over a finite set X is denoted U(X).
Two probability distributions X and Y are (t, ɛ)-indistinguishable if for all (probabilistic) algorithms D
running in time at most t,
2.1 One-Way Functions
|Pr[x ← X : D(x) accepts] − Pr[y ← Y : D(y) accepts]| ≤ ɛ.
A function family is a probability distribution F over a set of functions F ⊆ (X → Y ) with common
domain X and range Y . Formally, function families are defined as distributions over bit strings (function
descriptions) together with an evaluation algorithm, mapping each bitstring to a corresponding function, with
possibly multiple descriptions associated to the same function. In this paper, for notational simplicity, we
identify functions and their description, and unless stated otherwise, all statements about function families
should be interpreted as referring to the corresponding probability distributions over function descriptions.
For example, if we say that two function families F and G are indistinguishable, we mean that no efficient
algorithm can distinguish between function descriptions selected according to either F or G, where F and
G are probability distributions over bitstrings that are interpreted as functions using the same evaluation
algorithm.
A function family F is (t, ɛ) collision resistant if for all (probabilistic) algorithms A running in time at
most t,
Pr[f ← F, (x, x ′ ) ← A(f) : f(x) = f(x ′ ) ∧ x ≠ x ′ ] ≤ ɛ.
Let X be a probability distribution over the domain X of a function family F. We recall the following
standard security notions:
• (F, X ) is (t, ɛ)-one-way if for all probabilistic algorithms A running in time at most t,
Pr[f ← F, x ← X : A(f, f(x)) ∈ f −1 (f(x))] ≤ ɛ.
• (F, X ) is (t, ɛ)-uninvertible if for all probabilistic algorithms A running in time at most t,
Pr[f ← F, x ← X : A(f, f(x)) = x] ≤ ɛ.
6
10. Hardness of SIS and LWE with Small Parameters