a590003

k = n/2, and it suffices to set the other parameters so that
s ≥ (Cm) 2c−1 and q ≥ (4s) c/(c−1) ≥ 4 c/(c−1) · (Ccn) 2c+1+1/(c−1) = k O(1) .
(We can also obtain better lower bounds on s and q by letting k be a smaller constant fraction of n.) This
proves the hardness of LWE with uniform noise of polynomial magnitude s = n O(1) , and any linear number
of samples m = O(n). Note that for m = cn, any instantiation of the parameters requires the magnitude s
of the errors to be at least n c−1 . For c > 3/2, this is more noise than is typically used in the standard LWE
problem, which allows errors of magnitude as small as O( √ n), but requires them to be independent and
follow a Gaussian-like distribution. The novelty in this last instantiation of Theorem 4.6 is that it allows for a
much wider class of error distributions, including the uniform distribution, and distributions where different
components of the error vector are correlated.
Proof of Theorem 4.6. We prove the one-wayness of SIS(m, m − n, q) (equivalently, LWE(m, n, q) via
Proposition 2.9) using the second part of Theorem 4.5 with σ = 3 √ k. Using l ≥ k and the primality of q,
the conditions on the size of X in Theorem 4.5 can be replaced by simpler bounds
(3C ′ ms) l
ɛ
≤ |X| ≤ ɛ · q m−n ,
or equivalently, the requirement that the quantities (3C ′ ms) l /|X| and |X|/q m−n are negligible in k. For the
first quantity, letting C = 4C ′ and using |X| ≥ s m and s ≥ (4C ′ m) l/(n−k) , we get that (3C ′ ms) l /|X| ≤
(3/4) −l ≤ (3/4) −k is exponentially small (in k). For the second quantity, using |X| ≤ (2s + 1) m and
q ≥ (4s) m/(m−n) , we get that |X|/q m−n ≤ (3/4) m is also exponentially small.
Theorem 4.5 also requires the pseudorandomness of SIS(l, m−n, q) with respect to the discrete Gaussian
input distribution Y = DZ,σ l , which can be based on the (quantum) worst-case hardness of SIVP on k-
dimensional lattices using Corollary 2.14. (Notice the use of different parameters: SIS(m, m − n, q) in
Corollary 2.14, and SIS(m − n + k, m − n, q) here.) After properly renaming the variables, and using
σ = 3 √ k, the hypotheses of Corollary 2.14 become ω(log k) ≤ m − n ≤ k O(1) , 3 √ k < q < k O(1) , which
are all satisfied by the hypotheses of the Theorem. The corresponding assumption is the worst-case hardness
of SIVP γ on k-dimensional lattices, for γ = kω k q/σ = √ kω k q/3 = Õ(√ kq), as claimed. This concludes
the proof of the one-wayness of LWE.
The pseudorandomness of LWE follows from the sample-preserving search-to-decision reduction of
[17].
References
[1] M. Ajtai. Generating hard instances of lattice problems. Quaderni di Matematica, 13:1–32, 2004.
Preliminary version in STOC 1996.
[2] S. Arora and R. Ge. New algorithms for learning in presence of errors. In ICALP (1), pages 403–415,
2011.
[3] A. Banerjee, C. Peikert, and A. Rosen. Pseudorandom functions and lattices. In EUROCRYPT, pages
719–737, 2012.
[4] M. Bellare, E. Kiltz, C. Peikert, and B. Waters. Identity-based (lossy) trapdoor functions and applications.
In EUROCRYPT, pages 228–245, 2012.
22
10. Hardness of SIS and LWE with Small Parameters