Lossy Codes and a New Variant of the Learning-With-Errors Problem

Abstract

The hardness of the Learning-With-Errors (LWE) Problem has become one of the most useful assumptions in cryptography. It exhibits a worst-to-average-case reduction making the LWE assumption very plausible. This worst-to-average-case reduction is based on a Fourier argument and the errors for current applications of LWE must be chosen from a gaussian distribution. However, sampling from gaussian distributions is cumbersome. In this work we present the first worst-to-average case reduction for LWE with uniformly distributed errors, which can be sampled very efficiently. This new worst-to-average-case connection comes with a slight drawback and we need to use a bounded variant of the LWE problem, where the number of samples is fixed in advance. Most applications of LWE can be based on the bounded variant. The proof is based on a new tool called lossy codes, which might be of interest in the context other lattice/coding-based hardness assumptions.

Computational Fuzzy Extractors

“…Our construction uses private randomness, which is allowed in the fuzzy extractor setting but not in noiseless randomness extraction. Second, the code used is a random linear code, which allows us to use the Learning with Errors (LWE) assumption due to Regev [Reg05,Reg10] and derive a longer key r. Specifically, we use the recent result of Döttling and Müller-Quade [DMQ13], which shows the hardness of decoding random linear codes when the error vector comes from the uniform distribution, with each coordinate ranging over a small interval. This allows us to use w as the error vector, assuming it is uniform.…”

Hardness of SIS and LWE with Small Parameters

“…Beside the use of a similar high level lossyness argument, the technical details of the proof are quite different, and the results are different as well. Just like our work, [11] proves hardness for uniformly distributed errors, and requires the number of m of samples to be fixed in advance. However, [11] requires the noise bound to be bigger than √ n (in fact, at least m √ n, where m is the number of samples,) while in our work the errors can be smaller than √ n, or even binary.…”

“…Just like our work, [11] proves hardness for uniformly distributed errors, and requires the number of m of samples to be fixed in advance. However, [11] requires the noise bound to be bigger than √ n (in fact, at least m √ n, where m is the number of samples,) while in our work the errors can be smaller than √ n, or even binary. On the other hand, when the magnitude of the errors is large √ nm √ n, [11] allows the number of samples m = n O (1) to be an arbitrary large polynomial, while here we require it to be linear m = Θ(n).…”

“…In a recent and independent work Döttling and Müller-Quade [11] also used a lossyness argument to prove new hardness results for LWE. Beside the use of a similar high level lossyness argument, the technical details of the proof are quite different, and the results are different as well.…”

“…On the other hand, when the magnitude of the errors is large √ nm √ n, [11] allows the number of samples m = n O (1) to be an arbitrary large polynomial, while here we require it to be linear m = Θ(n). Another (more technical) difference between the two results is that our proof is based on a fairly general counting argument that allows error distributions that are uniform over arbitrary sets (of short vectors), while [11] only applies to uniform distributions over more structured sets, e.g., all vectors within a regularly shaped convex region of space.…”