Efficient Public Key Encryption Based on Ideal Lattices

!"#$&%('$)"*+#$+,-*'$/.0'12")

3 46587:9<;>=@?9<ACB:D 1,2 E2FHG ;I=@?9<7J;LKM9<B:N 2 ECO 9<7:PRQCST9VUW46;X46SY4 3 E 46;2N O 9<7J?4[Z 46\]4_^`4 3

1 abWcWd6efgih6jkMlnmogipqlsrt"u jlnvwgim$jlnxzyij|p6 dql~jlnxzlnxzyi:CwWpwxgknMxlHr|tXdqwwp6g$bd_||6lMk~jzxj_qR| "¡M¢£q¤w¥<¦§R6_¥L¡¨©i!ª1¤_££|«"¬<R«®¢©-¡ 6¢_¯q¥|°_© X¡²±<®_|<R| X¡n¢£q¤6¥

2 agipqlMkngt³rk´jp6yigRHar|moh6wlnxzpwµ¶zµrknxzlnvwmo´j|p6 a"kMhwlnr|µ|k~j|hwvqqfghYjkMlnmogp_lsr|tXar|moh6wlnxzpwµw6u j|yR·q6jknxzg¸Wp6xz<gknMxzl²q_bdq¹_ºi»YwlMk~j|zxj

®_©R 6¢|¦_<¨¢-¡³w¼2¡²|½"¡½ ª1¤_£<£«"¬<¾¾<¾X¡M<¨¢-¡³w¼2¡²|½"¡½wq¿®_©R 6¢3 fghYjkMlnmogp_lsr|tXu jlnv6gim$jlnxyij|@j|pY armoh6lnxzp6µod_yixzgip6ygiiYÀ@rÁqqr`Â²p6lnxlnwlngWr|tXÀ-giy~v6pwrzrµqYÃj|hYjp

ÄÅ _<¢R½ Å LÆÇq§<|¾_qÈ<É|¦_<¢-¡²£_£q_¨R¤X¡_¨-¡Ê«Ëª`¤_£<£|«"¬<¾<¾<¾2¡M<¢-¡²£_£q_¨R¤X¡_¨-¡ÊR«wq¿ Å _¢R½ Å Ìª1¤_£<£«"¬<|Ç<§q|¾_L¡: £

ÍÎ-ÏiÐiÑÒYÓÐÔ ÀsvwghrlngipqlnxjYv6xzµ|vogÕoyixzgipwy1rt-hw6Ö6zxzy¶×Á<gØgipwykMhwlnxzrpoÖ6j|MgR1r|p$lMkn6ylnkngR`jlMlnxzyigi"ÙÚj|XÛ6knlxzpYwxzyRjlngRÜÖq8lnvwg bÀscÚÝykMhwlnr|lngim CÙ´v6xzy~vÜÙÚj$hwknrhr|MgRÞjÖrlËºR!<gRjknHj|µ|rw"Wpt³r|kMlnwpYjlngiqClnv6gMgiyiknxzl²Hr|tCbWÀscÚßxz´rpwvwgiwknxzlnxzywÀsv_6ixlÚkngim$j|xzpwgRÌjpxzmohr|kMl~jpqlskngiMgRjknyv y~vYjzgp6µglnryirpwlMkn6yljpgÕoyixzgipqlWgip6ykMhlnxr|p My~v6gimog¸ÖYjMgR rpVlMknwylnwkngRjlMlnxzyigiWÙ´vwxy~v!jmoxzlnjohwknrqrtXr|t"Mgiyiwknxl²Ìkngijlnxz<g¸lnr$jÙsgiz"gil~j|ÖwxzMvwgRykMhwlnr|µ|k~jh6v6xzyojMM6mohlnxr|p@T[g`m$j|Á<ghwknrµkngiM¸xzp[jwkngiMMxzpwµÌlnv6gojÖr<goyv6j|zzgip6µ|g][gMv6rRÙ0vwrRÙÜlnr¸yir|p6lMkn6ylsj¸asàT¶×Mgiywkng´h6wÖ6zxzy¶×Á<ggip6ykMhlnxr|p1My~v6gimogsÙ´xlnv$Mgiyiknxzl²1hknr|j|Öw`Ö6j|MgR1r|p1lnv6gÙsrknlsyRjMgv6jk~wpwgiMrtTlnv6g´j|hwhwknrRáxzm$jlngdvwr|kMlngil"â"gylnr|kà2knr|Ö6zgimãxzpolMkn6ylnkngR`xwgRjYjlMlnxzyigii_pYgk2lnv6gj|MMwmohwlnxzrp lnv6jllnv6g¸jlMlngkWxgáhrpwgipqlnxjzz vYjk~ÌlnroMr|z<gg<gip Ù´xlnv!jH·q6j|pqln6myir|moh6lngkR6r|wkWMyvwgimogkngiMxzlnXj|pqØM6Ögáhrpwgipqlnxj|_jlMl~jyÁØjpYräTgknÚ:·qYjMxz¶r|hwlnxzm$j|j|mohlnr|lnxzyhgkMtår|knm$jp6yigæxt n xzLlnv6gsMgyiwknxlhYjk~j|moglngkRÖr|lnv1Ág"jkngrtTÖ6xlM¶×zgip6µlnv eO(n) jpYlnvwgjmor|kMlnxzçigRyirln"r|tTÖr|lnvogp6ykMhwlnxzr|poj|p61wgiykMwhlnxzrpjkng eO(1) hgkWmogiMnj|µ|g1Ö6xlR@èWwkyirpwlMkn6ylnxzrpjwj|hlnWlnv6gØlMk~j|hTwrqrk¸rpwg¶:ÙÚjiËt³wp6ylnxzrp!r|tséWgipqlMkMq]àLgixzÁ<gkMlj|p6$â"j|xzÁ_6pql~jpYjlnv6j|p ×dÀ´èaÜ|ê<ÖYjMgR1rpolnv6gë]gRjknpwxpwµ/xlnvìCkMknr|kn"hwknr|Ö6zgim lnr¸lMknwylnwkngR1jlMlnxygiièWwkXm$j|xzp1lngiy~v6pwxzyRj|lnrqrzsjkngjp$jwj|hwl~jlnxzrp$r|t]2íl~j|xJî "lMk~jhTwrqrksÁ<gµgp6gk~jlnxr|pHj|zµrknxzlnvwm(JÂasWë@àïºR»|»»lnr1lMkn6ylnwkngRHxgRj|]jlMlnxzyigiiYj|p6Ìjkng¶×xzpqlngknhwkngl~jlnxzrpr|t2cgiµgiî ´·qYjp_lnwmðkngR6ylnxzr|p ÖglÙgigipHlnv6g¸azrMglâ"gylnr|kØàCknrÖwgmñj|p6!njmoh6zxzp6µÌMvwr|kMl¸jlMlnxzyig`<giylnrkni]glnvwxpwÁ lnv6giMglngiyvwp6x·q6gijkng1<gkMËzxÁgi!lnrHÛYp6t³kMlnv6gkj|hwh6zxzyRjlnxzr|p6xpHlnv6gWtåwlnkngòÌó_ô@õØö Ñ÷LÏø"ù¸ú-ÎLûåü³Ó|ý òÌó_ôÿþ ÓÑ ô ÐRü ö ÒwÐiÐRü³Ó ó Ï ùÑ ö ÒYÎLû ó]ó Óqú@ÑüåÐ ô ù ö ÏiÐýoú@Ò ÐúØÑ ô Ð ö ýÑÒ ô

! #"#$%&'

(46?R?R7*)q9,+.-X4YP9qN/)10324C? G \0454CA28AX4YP6-s9q9<;70454C7:NLB828NC919T96?i?467@7J;A@CBBDFE8@,G E ôA G ) G ;2PR?30RQ=)<?9qN 4 G ;29,+n^`4C2KQC;=)<?R7 G ;[ô7J?RAï4H9T91046\T9,+&)_4YP9P9H)<Q0R7J?2I40 G 9Y45-CB82J09<B×46?9qN/? G ?RA29Ë^ G 0PR?K+&)_4YP9L) G 574CB:9,M-7J?2 G KWAX450N/B×46?R?R7*)q9N40 G -CB:9<5 PCO2U1A29!46?R?304 )<?R789T9<;29qPPG KØB×46?R?R7*)q9,+.-X4YP9qNP)10324C? G \0454CA;2 PR?9<5 PKQ0 G 5 7J?PR40 G 945-CB:9[P9H)<Q0R7J?&2I\QX45046;]?9q9qP E ^`9<BJBPR?RQ2NL7:9qN ?RA29 G 09<?R7*)_46BQC;2NC91034C7J;C;C7J;C\TP E PR7J574CBJ7*)<7J?2ð46;2NS4 G ?9<;]?R7×46Bo9,TU)<7:9<;=)12WV91946BJQX46?R7J;C\X>#?i?467.YP G ;29,+n^14H2 KQC;=)<?R7 G ; 9qPP9<;]?R7×46BJB82) G ;2PR7:PR?P G K ?Q2P?4o5ï46?30R7ZM+.9T9H)<? G 05!QCBJ?R784CBJ7*)_46?R7 G ; G 9T9104oPR5ï46BJB[2;C7J?9![X9<B:N\ E 46;2N46B:P G ?RA294544X4509<;@?P9H)<Q0R7J?&246\]467J;2PR?^]@QX46;]?RQC5_) G 574CQC?R7J;C\ß46?R?4 )SLPCOsU1A295ï467J;P) G 574CB:9,M-7J?2 4YPPRQC574C?R7 G ;>7J;>B×46?R?R7*)q9,+.-X4YP9qNP)10324C? G \04+4CA;2Þ7:Po?RA29 AX450NL;29qPP G K45440 G ML7J5ï46?9L9T910P7 G ;2P G K?RA29=@A G 0R?9qP?a`¸9H)<? G 0cb!0 G -CB:9<5dV

SVP\,OCU1A29

γ(n)+SVP40 G -CB:9<5 7:PH? G [2;2N E \789T9<; 48B×46?R?R7*)q9 G KØNL7J5 9<;2PR7 G ; n E 4ï; G ;+.e_910 G B×46?R?R7*)q9f9T9H)<? G 0 G K¸B:9<;C\?RA>46?5 G PR? γ(n)?R7J5 9qP0?RA29 B:9<;C\?RA G K!?RA29>PRA G 0R?9qPR?0; G ;+.e_910 G B×46?R?R7*)q9X9T9H)<? G 0COoU1A29X) G 574CB:9,ML7J?&2 G K γ(n)

+SVP

7J;=)109_4YP9qPô7J?RA

n E -CQC?NC9H)109_4YP9qP!ô7J?RA γ(n)O'>BJ?RA G QC\Aã?RAC7:Pf) G 574CB:9,M-7J?27:PL-s9<BJ7:919T9qN? G -s9 9,M4 G ;29<;@?R7×46B7J; n

K G 046;;2J4 G B82@; G 587×46B γ(n) E 587J;C7J5878eq7J;C\ï?RA29ËNC9<\09q9 G K γ(n)

7:Pa9T9103207J574 G 0R?46;]?7J;A404 )<?R7*)q9 E ? G 46BJB G ^ ?RA29ËQ2P9G K¸4g404 )<?R7*)_46BNL7J5 9<;2PR7 G ; n

K G 0H4[\789T9<;ßP9H)<Q0R7J?20B:919T9<B.OhjikklQmnoqp=irsn=tvu=wxpzy;lQm=oqn|n=~xm |jukl~6U1A29[=0P?f40 G 9Y45-CB82ãP9H)<Q09ÜB×46?R?R7*)q9,+.-X4YP9qN)10324C? G P32LPR?9<5^`4YP40 G 4 G P9qN-2>#??467$46;2N3Ì^ G 0RSE G E 46;2N09<BJ7:9qP G ;?RA290^ G 0P?K+&)_4YP90AX450NL;29qPP G K Poly(n)

+SVP

7J;

4503-C7J?3045032ÿB×46?R?R7*)q9qPCOs=-919T91046BWPQ-2P9H]]Q29<;@?H^ G 0RS-PHK G )<Q2P9qN G ;I7J5740 G 9-7J;C\Ü7J?PÌ9,TU)<7:9<;=)12SE5 E E @C E BG&OsU1A29)<Q0309<;]?IPR?46?9 G K?RA29 450R?SE8@C E BG!7:Pÿ4 P)A29<5 9 ô7J?RA4CQ-CBJ7*)s40R789Y46?9ST912 B:9<;C\?RA O(n2)

46;2Nñ9<;=)10324+?R7 G ;6NC9H)10324C?R7 G ;!?RA0 G QC\A4CQC? G K O(n)

-C7J? G 4s91046?R7 G ;2Px4s910Ú5 9qPP46\T9!-C7J?COH?P´P9H)<Q0R7J?2V46\]467J;2PR?x4 G B82@; G 587×46BJB82+- G QC;2NC9qN046?R?4 )S-P<09<BJ7:9qP G ;0?RA29R]]QX46;@?RQC5^ G 0PR?K+&)_4YP9ÌAX450NL;29qPP G K O(n1.5)

+=`Rb 7J;/4503-C7J?3045032ïB×46?R?R7*)q9qPCO;4X45046BJB:9<B? G ?RA2940 G 9Y45-CB82ÜP9H)<Q09H9<;=)10324C?R7 G ;ÞPq)A29<5 9qP E ?RA29109HAX4C9T9Ì46B:P G -9q9<;ÜA29<Q0R7:PR?R7*)c40 G 4 G P46B:PRE8@1 E @CG&O;L4X450R?R7*)<QCB×450 E QC;CBJ7JST9Ø?RA2945- G 9T9#40 G 945-CB82!P9H)<Q09¸P)A29<5 9qPWôAC7*)A!Q2P9¸QC;2PR?30RQ=)<?RQ09qNf046;2N G 55ï46?30R7*)q9qP E ?RA29ÌU F 9<;=)10324C?R7 G ;ÜP)A29<5 9NE8@CG"9,M4CB G 7J?P¸?RA29a40 G 4s910R?R7:9qP G K,,H3Ü5ï46?30R7*)q9qPwB×46?R?R7*)q9qP? G 4 )AC7:919T9HAC7J\A9,TU)<7:9<;=)12ô7J?RAg09qP49H)<?? G - G ?RAF4CQ-CBJ7*)s40R78946?9oST912VB:9<;C\?RAV O(n)

-C7J?P\W46;2N[9<;=)10324C?R7 G ;6NC9H)10324C?R7 G ;/) G P?VO(1)

-C7J? G 4s91046?R7 G ;J4910`5 9qPP46\T9c-C7J?\,O ;LK G 0R?RQC;X46?9<B82 E ?RA29ÌP9H)<Q0R7J?&2 G K'U F< 09<5ï467J;2PÀ29<Q0R7:PR?R7*)Ë46;2NÜ7J?^`4YPÌ46;/7J574 G 0R?46;@? G 4s9<;)AX46BJB:9<;C\T9!? G 40 G 9-7:NC94g40 G 9Y45-CB82/P9H)<Q09VPq)A29<5 9Ëô7J?RA) G 574X45045-CB:99,TU)<7:9<;=)12O cz¡ipzyq|¢znmzw'nJ¢zm£xn¤¥n=rR¦!¤§tniyFhjikzklQmn=r;¨ß7*)H)<7×46;=)<7 G E@,GL7J;]?30 G NLQ=)q9qN?RA29©)<B×4YPP G KXPR?30RQ=),+?RQ09qNª1«1¬®8B×46?R?R7*)q9qP E ôAC7*)A¯) G 0309qP4 G ;2N>? G 7:NC9_46B:PË7J;°4 G B82@; G 587×46B!0R7J;C\TP Z[x]/(xn − 1) E 46;2NX409qP9<;]?9qN?RA29F[=0PR?f>6?i?467Z+n?&249F40 G 9Y45-CB82P9H)<Q09 G ;29,+n^`4C2>KQC;=)<?R7 G ;-X4YP9qN G ; ?RA298^ G 0PR?K+&)_4YP9 AX450NL;29qPP G Ko?RA29709,+PR?30R7*)<?R7 G ; G K Poly(n)

+SVP

? G )12)<BJ7*)ÿB×46?R?R7*)q9qPCO6>1?ï?RA29ÿP465 9/?R7J5 9 E ?RAX46;CSLP ? G 7J?PÜ46BJ\T91-0467*)ßP?30RQ=)<?RQ09 E?RAC7:P G ;29,+n^`4H2ÝKQC;=)<?R7 G ; 9<; ? G 2-PïAC7J\A 9,TU)<7:9<;=)12ª) G 574X45045-CB:9 ? G ?RA29ÌU F P)A29<5 9V

O(n)919Y46BJQX46?R7 G ;

?R7J5 9 46;2NÜPR? G 046\T9R) G PR?\,OC=@Q-2P9H]@Q29<;]?RB82 E (2-Q-X4YPRA2919LPRS2ï46;2NIÏ7*)H)<7×46;=)<7 G E8@CBG´46;2NÜ7J;2NC9149<;2NC9<;@?RB82/bW9<7JST910R?46;2N FG P9<;±E²G PRA G ^`9qN A G ^ ? G 5 G NL7³K2:¨ß7*)H)<7×46;=)<7 G YPïKQC;=)<?R7 G ; ? G ) G ;2PR?30RQ=)<?/46;(9,TU)<7:9<;@?046;2N³40 G 9+45-CB82 P9H)<Q09A) G BJBJ7:PR7 G ;:09qPR7:PR?46;@? AX4YPRA KQC;=)<?R7 G ;xO6´ G 08?RAC7:P E ?RA2912 7J;]?30 G NLQ=)q9qN?RA2905 G 090\T9<;291046Bc)<B×4YPP G Kµ;3¶ ¬CB×46?R?R7*)q9qP E ôAC7*)A°) G 0309qP34 G ;2Nÿ? G 7:NC9_46B:PH7J;·4 G B82-; G 587×46B0R7J;C\TP Z[x]/f(x)

OXU1A29f) G BJBJ7:PR7 G ;X09qPR7:PR?46;=)q9 G K?RA29AX4YPRA KQC;=)<?R7 G ;°09<BJ7:9qP G ;I?RA29AX450NL;29qPP G KØ?RA29g09qPR?30R7*)<?R7 G ; G K Poly(n)

+SVP

? G 7:NC9_46BB×46?R?R7*)q9qPV)_46BJB:9qNPoly(n)

+Ideal-SVP

\,O>9450R7×46;]?LVn=¸´jÚc=¸¹º´jÚ1Z^\AX4YP©-s9q9<;Þ7J574CB:9<5 9<;]?9qNÿ46;2NÞPRQ-C587J?R?9qNÞ? G ?RA29Ri=-U(=»R>c+ AX4YPRAU) G 574s9<?R7J?R7 G ;XE½¼sG&O]U1A294H9T91046\T9,+&)_4YP9¥) G BJBJ7:PR7 G ;+µ[2;2NL7J;C\g40 G -CB:9<5K G 0¸?RAC7:PØAX4YPRA8KQC;=)<?R7 G ;7:P4ÿ;X46?RQ046B©) G 574CQC?46?R7 G ;X46B<40 G -CB:9<5¾)_46BJB:9qN

Ideal-SIS E ôAC7*)A AX4YPL-s9q9<;ðPA G ô;ã? G -9Ü4YPVAX450Nð4YP!?RA29^ G 0P?K+&)_4YP9Þ7J;2PR?46;=)q9qP G K Ideal-SVPO'b!0 G 9Y45-CB82 P9H)<Q09Ü9,TU)<7:9<;@?8PR7J\;X46?RQ09ÜPq)A29<5 9qPKQ0 G 5 7:NC9_46B`B×46?R?R7*)q9qP

AX4H9T9 46B:P G -s9q9<;°40 G 4 G P9qNE² E @s¼ E @C¿ E @CDG&O'» G ^919T910 E ) G ;2PR?30RQ=)<?R7J;C\ÿ9,TU)<7:9<;@?^40 G 945-CB82 P9H)<Q09f4CQ-CBJ7*)[ST9129<;=)10324C?R7 G ;/KQ0 G 5¹7:NC9_46B´B×46?R?R7*)q9qP$^14YP46;/7J;]?9109qP?R7J;C\ G 4s9<;À40 G -CB:9<5ÀOÁ wxnrswxy,kr;6~;?RAC7:PN4X454910 E ^9ïNC9qPq)10R78-9ï?RA29F[=0PR?N40 G 9Y45-CB82P9H)<Q0974CQ-CBJ7*) ST912 9<;=)10324C?R7 G ; P)A29<5 9ôA G P9P9H)<Q0R7J?&209<BJ7:9qP G ;ï?RA29HAX450NL;29qPP G KÚ?RA29$^ G 0P?K+&)_4YP9H7J;2P?46;=)q9qP G K O(n2)

+Ideal-SVP

46\]467J;2PR?`PRQ-9,M+4 G ;29<;]?R7×46BJB82^- G QC;2NC9qNL]]QX46;@?RQC5 46?R?4 )SLPCOC?4 )AC7:919T9qP4YP32-574C? G ?R7*)_46BJB82 G 4C?R7J5ï46B]9,TU)<7:9<;=)12zÂ?RA29j4CQ-CBJ7*)s40R789Y46?9ST912ÞB:9<;C\?RAÿ7:P

O(n)-C7J?P46;2N0?RA29465 G 0R?R78e_9qNß9<;=)10324C?R7 G ;6NC9H)10324C?R7 G ;°) G PR?PH4509 O(1)

-C7J? G 4s91046?R7 G ;2P4s9105 9qPP46\T9<-C7J?CO ¸9`; G ?91?RAX46? G Q0¸P9H)<Q0R7J?25 G NC9<B0RQCB:9qP G QC?919T9<;ïPRQ-s9,M4 G ;29<;@?R7×46BC?R7J5 9$46?R?4 )SLP E ?46S@7J;C\ KQCBJB4YN946;]?46\T9 G K?RA29f) G 585 G ;CB82À-s9<BJ7:919T9qNß9,M4 G ;29<;]?R7×46BAX450NL;29qPP G K Poly(n)

+SVP E 919T9<; 46\]467J;2PR?¥]@QX46;]?RQC546?R?4 )SLPCO=@Q=)A 4ßP9H)<Q0R7J?&2 5 G NC9<B G -2P G B:9<?9qP5 G PR? G Ko5 G NC910R;¯4CQ-CBJ7*)ïST912S)10324C? G \0454CA2ð46;2N AC7J\ACBJ7J\A]?P

?RA29ïP?309<;C\?RA G KoB×46?R?R7*)q9,+.-X4YP9qN)10324C? G \0454CA;2O!ÃQ0!5ï467J;ð?9H)AC;C7*)_46B`? G@G B:P4509ï46; 4YN2454C?46?R7 G ; G Ka>6?i?467.YP?30454sN G@G 0¸ST912[\T9<;291046?R7 G ;/46BJ\ G 0R7J?RAC5ÄEG"? G PR?30RQ=)<?RQ09qN 7:NC9_46B"B×46?R?R7*)q9qP E 46;2NÜ4Å09,+n7J;]?9103409<?46?R7 G ; G K F 9<\T919YP]@QX46;]?RQC5Æ09qNLQ=)<?R7 G ;°E5 Gz-9<?^9q9<;0?RA29RÇB G P9qPR?#`¸9H)<? G 0<b!0 G -CB:9<5 46;2NïP46574CBJ7J;C\[PRA G 0R?B×46?R?R7*)q9c9T9H)<? G 0PCO¸9?RAC7J;CS?RA29qP91?9H)AC;C7*]@Q29qP4509a9T91032BJ7JST9<B82? G [2;2N[KQ0R?RA2910Ø4544CBJ7*)_46?R7 G ;2P7J;8?RA29`KQC?RQ09O>P¸9,M246574CB:9qP E ^`9H46B:P GQ2P9 G Q0!09qPRQCBJ?P¸? G ) G ;2PR?30RQ=)<?Ø9,TU)<7:9<;]?#40 G 945-CB82[P9H)<Q091?30454N G-G 0¸PR7J\;X46?RQ09qP46;2N73¥+.-X4YP9qN[7:NC9<;]?R7Z[)_46?R7 G ;P)A29<5 9qPCO

>BJB40919@7 G Q2P!)10324C? G P32LPR?9<5 P-X4YP9qN G ;\T9<;291046BLB×46?R?R7*)q9qPE5 E E @C E BG09<B82 G ;[?RA2914C9T91046\T9a)_4YP9ÀX450N+;29qPP G K?RA29LÈ'¶ ÉÉÊ¯ËJQQÌ7Í3Î UV LWE

\!40 G -CB:9<57J;@?30 G NLQ=)q9qN07J;°E5 G&O=ÃQ01Pq)A29<5 9 7:P1PR7J587JB×450RB82U-X4YP9qNG ;Ü4!PR?30RQ=)<?RQ09qN9450R7×46;]? G K LWE E ?RAX46?Ø^9¥)_46BJB Ideal-LWE

O;» G ^919T910 E ^9$7J;@?30 G NLQ=)q9; G 9T9<B"?9H)AC;C7*]@Q29qP`? GG 9T910) G 5 9?~^ G 5ï467J; NL7ZTU)<QCBJ?R7:9qPH?RAX46?450R7:P9 KQ0 G 5¹?RA29L09qPR?30R7*)<?R7 G ;I? G 7:NC9_46B´B×46?R?R7*)q9qPCO´780P?RB82 E ?RA29L40919-7 G Q2P)10324C? G P32-P?9<5 PN-X4YP9qN G ; QC;2PR?30RQ=)<?RQ09qN 5ï46?30R7*)q9qP[46BJB`5ï46ST9ÜQ2P9 G K F 9<\T919zYP^ G P?K+&)_4YP9ï? G 4H9T91046\T9,+&)_4YP9)<B×4YPPR7*)_46Bj09qNLQ=)<?R7 G ;³E5 GK0 G 54I)<B G P9qPR?Å9T9H)<? G 0^40 G -CB:9<57J;4Ü\789T9<; B×46?R?R7*)q9 E ? G 46; LWE

40 G -CB:9<5ÏV?RAC7:P

7:P$?RA29I1¬8¶5q,¶¬'1&&Ð>7J;I?RA29N]@QX46;]?RQC5Ä09qNLQ=)<?R7 G ; G KE5 GKQ0 G 5 SVP? G LWE

\,O2U1AC7:P¥09qNLQ=)<?R7 G ;>P9q9<5 PH? GA29_4H9-7JB82I09<B82 G ;/?RA29ÌQC;2PR?30RQ=)<?RQ09qN+n;29qPP G K?RA29^) G ;2PR7:NC9109qN0B×46?R?R7*)q9qP E 46;2N/N G 9qP1; G ?$P9q9<5? G )_4503032 G 9T910$? G?RA29ÌPR?30RQ=)<?RQ09qNÞB×46?R?R7*)q9qP7J;9 G B89T9qN07J; Ideal-LWE

OL=-9H) G ;2NLB82 E ?RA29 G ?RA29107J;C\09qNL7:9<;@?oQ2P9qNï7J;I40919-7 G Q2P)10324+? G P32LPR?9<5 P E ;X465 9<B82 F 9<\T919zYPc09qNLQ=)<?R7 G ;E5 GKQ0 G 5¹?RA29N) G 574CQC?46?R7 G ;X46Bj9Y450R7×46;@? G K LWE

? G 7J?PHNC9H)<7:PR7 G ;X46B9450R7×46;]? E 46B:P G KM467JB:PK G 0 Ideal-LWE

O¸9846B:P G 09<5ï450RSÿ?RAX46? E QC;CBJ7JST97J; ?RA29g)_4YP9 G K14503-C7J?3045032ßB×46?R?R7*)q9qP E ?RA29NC9H)<7:PR7 G ;X46B=9450R7×46;]? G K Poly(n)

+Ideal-SVP

)_46;7-s91?30R789@7×46BJB828P G B89T9qN 7J;4 G B82-; G 587×46B2?R7J5 9LE@,G&O]U1AC7:P7J574CBJ7:9qP?RAX46?cbW9<7JST910R?CYPc09H)q9<;@?¥)<B×4YPP7*)_46B09qNLQ=)<?R7 G ;EBG´K0 G 5?RA29VNC9H)<7:PR7 G ;X46Bx9450R7×46;]? G K SVP

? G LWE7:P$QC;CBJ7JST9<B82

? G -s9ËQ2P9KQCB E 919T9<;ÿ7³KW7J?) G QCB:NÀ-9V4YN2454C?9qNß? G ^ G 0RSÞK G 0o7:NC9_46BB×46?R?R7*)q9qPCOÃQ0!P G BJQC?R7 G ;ã? G ?RA29ï45- G 9T9ïNL7ZTU)<QCBJ?R7:9qP4C9 G 7:NCP!?RA29H¬Z¶5µ¶ ¬!1&&Ð G K`?RA29709qNLQ=)<?R7 G ;ãKQ0 G 5ÏE5 G`46BJ? G +

\T9<?RA2910COz~;2PR?9_4YN E ^9VK G )<Q2P G ;I?RA29/Ñ1¶ ÉÒÓ,&&Ð G K?RA29N09qNLQ=)<?R7 G ;IK0 G 5dE5 G46;2NßQ2P9V7J?? G ) G ;2PR?30RQ=)<?Ë4;29<^³]@QX46;]?RQC54H9T91046\T9c)_4YP9<09qNLQ=)<?R7 G ; K0 G 5 SIS

V?RA29oQC;2P?30RQ=)<?RQ09qN9450R7×46;]? G K Ideal-SIS\W? G LWE

OTU1AC7:P09qNLQ=)<?R7 G ;ÿ46B:P G ^ G 0RS-PØK0 G 5 Ideal-SIS

? G Ideal-LWEOÇ G 5f-C7J;29qN0ô7J?RAï?RA29S@; G ô;/09qNLQ=)<?R7 G ;ÞK0 G 5 ^ G 0PR?

)_4YP9Ideal-SVP

? G 4H9T91046\T9,+&)_4YP9 Ideal-SISE8@CBG!V7.O9O E ?RA2940 G-G K G Kx) G BJBJ7:PR7 G ;U09qPR7:P?46;=)q9oK G 0`=¸¹º´jÚÔE½¼sGQ\ E

^9 G -C?467J;ñ4S]@QX46;]?RQC5Õ09qNLQ=)<?R7 G ; K0 G 5 Ideal-SVP? G Ideal-LWE

OU1AC7:PÜPA G ^$PÜ?RA29ßAX450NL;29qPP G KË?RA29) G 574CQC?46?R7 G ;X46B9Y450R7×46;@? G K Ideal-LWE

O"=@7J;=)q9Ë^9!N G ; G ? G -C?467J;ÿ?RA29 AX450NL;29qPP G KW?RA29VNC9H)<7:P7 G ;X46Bx9Y450R7×46;@?G K Ideal-LWE E ^`9VQ2P9Ë?RA29gÖ G B:N09<7*)A+&(´919-7J; AX450N) G 09ËKQC;=)<?R7 G ;E8@C E =-9H)OzOG? G NC910R789T9L42P9<Q2N G 046;2N G 5-C7J?P8K G 0ï9<;=)10324C?R7 G ;xO#×`QC?8K G 0ïNC9H)10324C?R7 G ; E ^`9ß46B:P G ;29q9qN(46; Ideal-LWE

7J;9T910PR7 G ; ?30454N G-G 0CO¸U G ?RAC7:P9<;2N E ^9 PRA G ^ñA G ^ ? G 4YN2454C?`? G 7:NC9_46BsB×46?R?R7*)q9qP1?RA29Ì?30454N G-G 01\T9<;291046?R7 G ;ß46BJ\ G 0R7J?RAC5 G K>#??467!EG E 09H)q9<;]?RB827J5740 G 9T9qN-;2A>BJ^9<;+&bW9<7JST910R?gEDG&O

U1A29o5ï467J;Ü7:NC9_4 G K G Q0¸;29<^³]@QX46;]?RQC5v09qNLQ=)<?R7 G ;ïK0 G 5 Ideal-SIS? G Ideal-LWE

7:P`4Å09,+n7J;]?9103409<?46?R7 G ;G K F 9<\T919zYPJ]@QX46;]?RQC5 P?914 7J;ØE5 G&OoU1A29 B×46?R?910/^`4YPÀ409qP9<;]?9qN 4YPÿ4ð^ G 0P?À)_4YP9°]]QX46;@?RQC5Ù09qNLQ=)<?R7 G ;K0 G 5 P46574CBJ7J;C\ PRA G 0R?!B×46?R?R7*)q9/9T9H)<? G 0P!7J; 4/B×46?R?R7*)q9 L

? G P G B89@7J;C\ 4À)<B G P9qPR?f9T9H)<? G 0N40 G -CB:9<5 7J;ã?RA29ÜNLQX46BB×46?R?R7*)q9

LOÃQ0U[=0PR? G -2P9103946?R7 G ; 7:P ?RAX46?Þ?RAC7:P09qNLQ=)<?R7 G ; 7:PÜ4 )<?RQX46BJB82 P?30 G ;C\T910CÂØ7J?Ü7:PÜ46; 4C9T91046\T9°)_4YP9

09qNLQ=)<?R7 G ;ßôAC7*)Aß^ G 0RS-PH\789T9<;I46; G 04 )<B:9 K G 0 CVP7J;

Lô7J?RA 4[; G 0R5ï46BJB82/NL7:PR?30R78-CQC?9qNß91030 G 09T9H)<? G 0COzÃQ0

P9H) G ;2N G -2P91039Y46?R7 G ;Ü7:P¸?RAX46? LWE)_46;U-s9$P9q9<;Ü4YP`4L)<B G P9qPR?#9T9H)<? G 0#40 G -CB:9<5 ô7J?RA04 ; G 0R5ï46BJB82ïNL7:PR?30R78-CQC?9qN

91030 G 0[7J;Ý4)q910R?467J;B×46?R?R7*)q9ÞôA G P90NLQX46B17:P?RA29 SISB×46?R?R7*)q9PVQ4 ? G 4ßPq)_46BJ7J;C\IKn4 )<? G 0\,O6Ç G 5N-C7J;C7J;C\?RA29qP9

G -2P9103946?R7 G ;2PB:9_4YNCP? G G Q0 SIS? G LWE

09qNLQ=)<?R7 G ;xO´W7J;X46BJB82!^`9oPRA G Â G ^? G 4544CB827J?? G 09qNLQ=)q9 Ideal-SIS? G Ideal-LWE Ú ?RA29`5ï467J;8?9H)AC;C7*)_46B2A@Q0NLB:9oA29109`7J;;9 G B89T9qP4¥40 G -X45-C7JBJ7:PR?R7*)1B G ^9106- G QC;2NK G 0?RA291587J;C7J5QC5G K´?RA29 Ideal-LWE

B×46?R?R7*)q9FV(9<585ï4gO\,O¸9¥-9<BJ7:919T9 G Q0`;29<^ SIS? G LWE

09qNLQ=)<?R7 G ;07:P G K7J;2NC914s9<;2NC9<;]?7J;]?9109qP?CO´ G 0[9,M246574CB:9 E ôA29<;)A G@G P7J;C\X404 )<?R7*)_46B<4X450465 9<?910P[K G 0!B×46?R?R7*)q9,+.-X4YP9qN9<;=)10324C?R7 G ;ÔVP9q9 E 9O \=O EE5 GQ\ E 7J?Ø7:P¸7J57404 )<?R7*)_46Bs? G 09<B82 G ;ï?RA29$^ G 0PR?<)_4YP9$AX450NL;29qPP G K SVP

O;;2PR?9_4YN E ?RA29c404 )<?R7*)_46Bs4C9T91046\T9R)_4YP9AX450NL;29qPP G K LWE

7:PË91946BJQX46?9qN°-X4YP9qN G ;>?RA29F-s9qPR?S-; G ô;ã46?R?4 )S>ôAC7*)AS) G ;2PR7:PR?P 7J; P G B89-7J;C\ SISOxÃQ0

09qNLQ=)<?R7 G ;I?Q2P?R7Z[X9qPH?RAC7:PA29<Q0R7:PR?R7*)7J;IP G 5 9P9<;2P9N-;2ßPA G ô7J;C\Þ?RAX46?7J?Ì7:PH7J;2NC9q9qNI;29H)q9qPP45032ß? G -09_46S SIS7J; G 0NC910? G P G B89T9 LWEOzÃQ0c09qNLQ=)<?R7 G ;·)_46;>46B:P G -s9VP9q9<;I4YPÌ4[QC;C7Z[)_46?R7 G ; G K?RA29!P9H)<Q0R7J?&2A40 G-G KP G KØ46BJB

B×46?R?R7*)q9,+.-X4YP9qNI)10324C? G \0454CA2 E PR7J;=)q9$7J?46BJB G ^$P`? G 5ï46ST946BJB"?RA29$^ G 0PR?©)_4YP9H? G 4H9T91046\T9Å)_4YP909qNLQ=)<?R7 G ;2P©09<B82P G B:9<B82 G ; SIS

OÛÜÝl~ÔuÞnrsr;©ÃQ0!9<;=)10324C?R7 G ;ðP)A29<5 9 7:PLº3¥+ºÇbz>P9H)<Q09O'?Ë7:PL9T91032 BJ7JST9<B82 ?RAX46?V7J?N)_46;S-s95 G NL7Z[X9qN? G 4 )AC7:919T9Uº3¥+ºÇaÇ>Å0P9H)<Q0R7J?&2 E -;24YN2454C?R7J;C\ß?RA29 \T9<;291046BØ?9H)AC;C7*]@Q29qPNC9qP)10R78-9qN7J;³EB E G&O>; G ?RA2910c]]Q29qP?R7 G ;ÿ?RAX46?H^`9!4509L)<Q0309<;]?RB82/7J;9T9qPR?R7J\]46?R7J;C\Þ7:PoA G ^ ? G )A G-G P9^404 )<?R7*)_46B4X450465 9<?910P$K G 0 G Q0P)A29<5 9OßÅzito,¤iuxz;ß=-9H)<?R7 G ; E ^9Å40 G 9@7:NC9 ?RA29Å-X4 )S@\0 G QC;2N/?RAX46?o7:P1;29H)q9qPP45032ï? G ?RA29ÌQC;2NC910PR?46;2NL7J;C\ G K G Q009qPRQCBJ?PCO2=-9H)<?R7 G ;·PRA G ^$P1A G ^ñ? G AC7:NC9Ë4?30454sN G@G 017J;0?RA29V4YN2454C?46?R7 G ; G K SIS

? G 7:NC9_46BÚB×46?R?R7*)q9qPsOX=-9H)<?R7 G ;A) G ;]?467J;2P$?RA29 ;29<^¹09qNLQ=)<?R7 G ;-9<?^9q9<; SIS

46;2NLWE

O´W7J;X46BJB82 E 7J;ß=-9H)<?R7 G ; E ^9Å409qP9<;@? G Q0$9<;=)10324C?R7 G ;P)A29<5 9!46;2NA-0R7:9,à=2/NC9qP)10R78-s9 G ?RA2910¥)10324C? G \0454CAC7*)N) G ;2PR?30RQ=)<?R7 G ;2PCO

ág'kikl~6#`¸9H)<? G 0P[ô7JBJB<-9ÞNC9<; G ?9qN 7J;- G B:NOj¨ G PR? G K G Q0g9T9H)<? G 0P 4509J) G BJQC58;9T9H)<? G 0PCOj~K x,y4509

?~^ G 9T9H)<? G 0P E ^`9ÜNC9<; G ?9Ü?RA29<780!7J;C;2910g40 G NLQ=)<?g-;2 〈x,y〉 OnK x ∈ Rn E ?RA29<; ‖x‖ VQ09qP34xO ‖x‖∞\VNC9<; G ?9qP

?RA29ÅâQ=)<BJ7:NC9_46;¯VQ09qP34xO-7J;[2;C7J?&2=\; G 0R5 G K x O¸9NC9<; G ?9Å-2 ρs(x)VQ09qP34xO

νs\¸?RA29ÌP?46;2N2450N

n+~NL7J5 9<;2P7 G ;X46B

ÖË46Q2PP7×46;¯VQ09qP34xOÖË46Q2PP7×46;ÿNL7:PR?30R78-CQC?R7 G ;\1ô7J?RA)q9<;@?910046;2NÀ9Y450R7×46;=)q9

s E 7.O9O E ρs(x) = exp(−π‖x‖2/s2)VQ09qP34xOνs(x) = ρs(x)/sn \,O6¸9ß5ï46ST9ÿQ2P9 G KË?RA29IPR?46;2N2450NW(46;2N246Q ; G ?46?R7 G ;2P04YPÜ^9<BJB 4YPï?RA29ß; G ?4+

?R7 G ;2P O(·) 46;2N Ω(·) VôAC7*)AÜAC7:NC9a4 G B82;+nB G \]450R7J?RAC587*)HKM4 )<? G 0P,\,OnK X 7:PØ4^046;2N G 59450R7×45-CB:9 E ?RA29a40 G -X45-C7JBJ7J?&2G KØ?RA29[919T9<;]? X = x

7:PÌNC9<; G ?9qN°-2 Pr[X = x]O~K

D146;2N

D24509!?^ G 40 G -X45-C7JBJ7J?&2>NL7:PR?30R78-CQC?R7 G ;2P G 9T910

4ÞNL7:P)109<?9[N G 5ï467J; E E ?RA29<780VPR?46?R7:PR?R7*)_46BNL7:PR?46;=)q9[7:P ∆(D1, D2) = 12

∑x∈E |D1(x) − D2(x)| Oz~K`4ïKQC;=),+?R7 G ; f G 9T910 47) G QC;]?45-CB:9N G 5ï467J; E

?46ST9qP$; G ;+n;29<\]46?R789T9f09_46Bx946BJQ29qP E 7J?PHPQC5 G 9T910Ì46; 4503-C7J?3045032 F ⊆ Eô7JBJB!-s9NC9<; G ?9qNS-;2 f(F )O~K

q7:PV4I40R7J5 9[;]QC5f-910 E ^98NC9<; G ?97-2 Zq

?RA29g[X9<B:N G K`7J;]?9<\T910P!5 G NLQCB G qO

¸9VNC9<; G ?9^-2 Ψs?RA29^09qNLQ=)<?R7 G ;I5 G NLQCB G q G K νs

O

ã äXåæ¹%# #å=;çJè# êéJè$;ëì''"#© íäXåç5"©îµçA'Ýïcè %&$åç

´ G 0H4NC9<?467JB:9qN/7J;@?30 G NLQ=)<?R7 G ;ÿ? G ?RA29Å) G 574CQC?46?R7 G ;X46B4YP349H)<?P G KWB×46?R?R7*)q9qP E ^9Å09KM910o? G EG&O~;0?RA29Å409qP9<;@?P9H)<?R7 G ; E ^`9J09<587J;2N?RA29J09_4YNC9109T91032]]QC7*)S@B82 P G 5 9ÞKQC;2N2465 9<;]?46B¥40 G 4910R?R7:9qP G K B×46?R?R7*)q9qP8?RAX46? ^`90ô7JBJB;29q9qNO¸9H?RA29<;Þ7J;]?30 G NLQ=)q9Ì?RA29P G +&)_46BJB:9qNÜ7:NC9_46BsB×46?R?R7*)q9qP E 46;2N[2;X46BJB828K G 0R5ï46BJB82 NC9,[2;29 P G 5 9R) G 574CQC?46?R7 G ;X46B40 G -CB:9<5 PCO

ðñò óÅôõ;ö÷øù;ú=ûWöQúüHüs÷õ;ù;ý>;

n+~NL7J5 9<;2PR7 G ;X46BoB×46?R?R7*)q9 L

7:P[?RA29ÞP9<? G KË46BJB17J;]?9<\T910 BJ7J;29_450709<B×46?R7 G ;2P G K P G 5 9ÞBJ7J;29_450RB82ð7J;2NC914s9<;2NC9<;]?9T9H)<? G 0P b1, . . . , bn ∈ Rn E 7.O9O E L =

∑Zbi

O-U1A29biYP`4509R)_46BJB:9qN/4^-X4YPR7:P G K L O@U1A29 i

?RAÞ587J;C7J5!QC5λi(L)

7:P?RA29`PR5ï46BJB:9qPR?

rPQ=)A?RAX46?

L) G ;]?467J;2P i

BJ7J;29_450RB82V7J;2NC914s9<;2NC9<;]?j9T9H)<? G 0P G K2; G 0R5 P ≤ rOs¸9ØB:9<?

λ∞1 (L)

NC9<; G ?9?RA29f[=0PR?Ì587J;C7J5!QC5 G K L

ô7J?RAX09qP349H)<? ? G ?RA29!7J;[2;C7J?2I; G 0R5ÀO~K B = (b1, . . . , bn)7:PË4-X4YP7:P E ^`9[NC9,[2;29

7J?Po; G 0R5Ó-;2 ‖B‖ = max ‖bi‖46;2N/7J?P$KQC;2N2465 9<;@?46B'4X45046BJB:9<B:914C784s9qN-2

P (B) = ∑i cibi : c ∈ [0, 1)n OÖÌ789T9<;ÿ4f-X4YPR7:PBK G 01B×46?R?R7*)q9 L

46;2N04f9T9H)<? G 0 c ∈ Rn E ^`9ËNC9,[2;29 c mod L4YP`?RA29 QC;C7*]@Q29R9T9H)<? G 0o7J; P (B)PRQ=)A8?RAX46?

c−(c mod L) ∈ LV?RA29-X4YPR7:Pj-9<7J;C\ 7J574CBJ7*)<7J?\,OTU1A29ÖR0465F+=)AC587:NL? G 0R?RA G \ G ;X46BJ78e46?R7 G ;XV.Ö!=Ã^\

7:P`?RA29H?RQ4CB:9(b∗1, . . . , b

∗n)NC9,[2;29qN/4YPØK G BJB G ^$PCÂ-?RA29R9T9H)<? G 0 b∗i

7:P`?RA29R) G 574 G ;29<;@? G K biôAC7*)A07:P G 0R?RA G \ G ;X46B

? G ?RA298BJ7J;29_450!P4X46; G K b1, . . . , bi−1OÚU1A29/Ö!=Ã; G 0R57:P ‖B∗‖ = max ‖b∗i ‖

O´ G 04Þ\789T9<;B×46?R?R7*)q9 L46;2N

4 \789T9<;4X450465 9<?910s > 0 E ?RA29 PRQC5 ρs(L)

7:PI[2;C7J?9Oa¸9 NC9,[2;29 ?RA29>B×46?R?R7*)q9ÖË46Q2PPR7×46;ñNL7:PR?30R78-CQC?R7 G ;-;2

DL,s(b) = ρs(b)ρs(L)

E K G 0V46;;2 b ∈ LOz~K

L7:PË4 B×46?R?R7*)q9 E 7J?P NLQX46BB×46?R?R7*)q9 L

7:PÌ?RA29P9<? G K#9T9H)<? G 0P b7J;

Rn

PRQ=)A?RAX46? 〈b, b〉 ∈ ZK G 0 46BJB b ∈ L

Oj´ G 0 ε > 0 E ^9/NC9,[2;290?RA290PR5 G-G ?RAC7J;C\P4X450465 9<?910 ηε(L)4YP?RA29

PR5ï46BJB:9qPR?s > 0

PRQ=)A?RAX46?ρ1/s(L \ 0) ≤ ε

O¸98AX4C9T9ηε(L) ≤

√ln(2n(1 + 1/ε))/π/λ∞

1 (L)VP9q9E¿ E

(´9<585ï4/OGQ\,O¸9 ô7JBJB´Q2P9 ?RA29 K G BJB G ô7J;C\/09qPRQCBJ?PCOþ ùÿ¯ÿ¯ú¯ðñò þ ùÿÿSúSðñòò Cñ Î^¶É=«

xQÉ·¶ É

n QÒ1ÉµÎ É¶ ¬¬8¶µµq L ε ∈ (0, 1/3)¶ É

s ≥2ηε(L) ^Ì¶5 DL,s(x) ≤ 2−n+1 þ ùÿ¯ÿ¯ú¯ðñ ð*ð þ ùÿÿSúÔðñò Cñ 5,ÉW¶É

n QÒ1ÉµÎ É¶ ¬©¬Z¶µq L /Ì¶5 Prx∼DL,s[‖x‖ >

s√

n] ≤ 2−n+1

ðñ ð 1øù;ú=ö<öQúüHüs÷Qõù;ýNC9_46B2B×46?R?R7*)q9qP4509H4 P49H)<7×46BXPQ-2P9<? G KB×46?R?R7*)q9qPØ?RAX46?64 G PP9qPP?RA29) G 574CQC?46?R7 G ;X46BJB82ï7J;]?9109qPR?R7J;C\f40 G 4910R?2 G K-s9<7J;C\^09<B×46?9qN8? G PR?30RQ=)<?RQ09qN85ï46?30R7*)q9qPØ46;2NF4 G B82-; G 587×46B:PCOTU1A29 n

+~NL7J5 9<;2PR7 G ;X46B25ï46?30R7ZM+n5ï46?30R7ZMï46;2NF9T9H)<? G 0K+

5ï46?30R7ZM³40 G NLQ=)<?PÞ?RA29<;W09qP34s9H)<?R789T9<B82W) G P? O(n2)46;2N

O(n)450R7J?RAC5 9<?R7*) G 491046?R7 G ;2P07J;2P?9_4YN G K O(n3)46;2N

O(n2)O

(´9<?f ∈ Z[x]

4 5 G ;C7*)INC9<\09q9 n4 G B82@; G 587×46B.O´ G 0Þ46;2 g ∈ Q[x] E ?RA29109I7:PÜ4>QC;C7*]@Q29À4X46780 (q, r)ô7J?RA

deg(r) < n46;2N

g = qf + rO¸9NC9<; G ?9 r

-;2g mod f

46;2N 7:NC9<;]?R7³K2rô7J?RA>?RA29g9T9H)<? G 0 r ∈ Qn

G KØ7J?PÅ) G 9,TU)<7:9<;]?PCO¸9[NC9,[2;29 rotf (r) ∈ Qn×n 4YP ?RA295ï46?30R7ZMIôA G P9g0 G ^$PV4509?RA29 xir(x) mod f(x)YP E

K G 0 i ∈ [0, n − 1]O¸989,ML?9<;2N ?RAX46?V; G ?46?R7 G ;ã? G ?RA29[5ï46?30R7*)q9qP A G 9T910 Q[x]/f

Â-2°0914CB×4 )<7J;C\ß9_4 )AAi,j-;2

rotf (Ai,j)E-G ;29 G -C?467J;2P rotf (A)

O G ?9Ì?RAX46? rotf (g1)rotf (g2) = rotf (g1g2)K G 0o46;;2 g1, g2 ∈ Q[x]/f

OU1A29$PR?309<;C\?RA2P G K G Q0#)10324C? G \0454CAC7*)R) G ;2PR?30RQ=)<?R7 G ;2P`NC9149<;2N G ; ?RA29c)A G 7*)q9 G K f O?P6]@QX46BJ7J?&287:P6]@QX46;]?R7Z[X9qN-;207J?P$9,M4X46;2PR7 G ;0Kn4 )<? G 0fV^94YN2454C?H?RA29ËNC9,[2;C7J?R7 G ; G KaE8@CBG? G ?RA29Lâ¸Q=)<BJ7:NC9_46;ß; G 0R5/\,Â

EF(f, k) = max

‖g mod f‖‖g‖ | g ∈ Z[x] \ 0

46;2Ndeg(g) ≤ k (deg(f) − 1)

,

ôA29109^`97:NC9<;]?R7Z[X9qN!?RA29!4 G B82-; G 587×46B g mod fVQ09qP34xO

g\ô7J?RA!?RA296) G 9,TU)<7:9<;@?Px9T9H)<? G 0COC G ?9?RAX46?´7³K deg(g) <

n E ?RA29<; ‖rotf (g)‖ ≤ EF(f, 2) · ‖g‖ O=¸9Ëô7JBJB') G ;=)q9<;@?3046?9 G ;/?RA29L4 G B82-; G 587×46B:P x2k+ 1 E 46BJ?RA G QC\AI5 G PR?

G K G Q0<09qPRQCBJ?P$4509 5 G 09 \T9<;291046B.O¸9Å09H)_46BJB´P G 5 9¥-X4YP7*)¥40 G 4s910R?R7:9qP G K x2k+ 1

VP9q9gEBGÚK G 0`?RA29 B×4YPR? G ;29s\,O

þ ùÿ¯ÿ¯ú¯ðññ È'Hk ≥ 0

¶ Ézn = 2k ! Ì,É f(x) = xn +1

Q3 1#",¬*^QÉQ[x] $ QR&%,Ð¶ É,Î É('1¶C.Î

EF(f, 2) ≤√

2 *) ¬½HÎ 'HÎ À¶ É=« g =∑

i<n gixi ∈ Q[x]/f + IÌ¶5 rotf (g)T = rotf (g) Ì,3 g =

g0 −∑1≤i<n gn−ixi 1QÌ,,Ò7Î3 ' q

U¶UÐ,QÒ,,Ì¯QÌ¶2n|(q − 1) QÌ,É f(x)

Ì¶5nµÊ

1'H¶H.Î LÉZq[x] É¶¬¬®« ' k ≥ 2

¶ Éqf¶ÅÐzQÒU QÌ q ≡ 3 mod 8 QÌ1É f = f1f2 mod q Ì, 'HÎ f¶ É=«

i ∈ 1, 2 , NÌ¶5gQÌ¶ fi LQ3 1#",¬*FQÉ

Zq[x]¶ ÉJ¶ É-"q µ&,É fi = xn/2 + tix

n/4 − 1 QÌ ti ∈ Zq

(´9<?

I-946;I7:NC9_46B G K¸?RA29N0R7J;C\ Z[x]/f E 7.O9O E 4ïPRQ-2P9<? G K Z[x]/f

?RAX46?7:P¥);

f+3¶ ¬x¬8¶µµq!7:PH4[PRQ-CB×46?R?R7*)q9 G K Zn ?RAX46?c) G 0309qP34 G ;2NCPo? G 46;ÿ7:NC9_46B I ⊆ Z[x]/f

O

ðñ .Àú0/ø¹öúüHüs÷Qõù213/5476öQùÿ¯ýU1A29[5 G PR?ÌKn465 G Q2PËB×46?R?R7*)q9F40 G -CB:9<57:P

SVPO'ÖÌ789T9<;ã4/-X4YPR7:P G K14ÜB×46?R?R7*)q9 L E 7J?!467J5 PV46?Å[2;2NL7J;C\ß4ÞPRA G 0R?K+9qPR?^9T9H)<? G 0V7J; L \ 0

O~?PVNC9H)<7:P7 G ;S9T910PR7 G ;7:PLRbj+nAX450N QC;2NC910N046;2N G 5878e_9qNS09qNLQ=)<?R7 G ;2PIEG&O SVP)_46;S-9

09<B×4MC9qN-2I4YPRS-7J;C\ K G 0Ì4ï; G ;+.e_910 G 9T9H)<? G 0 ?RAX46?H7:P; G B G ;C\T910?RAX46; γ(n)?R7J5 9qPË4ïP G BJQC?R7 G ;I? G SVP E K G 0Ì4409qP)10R78-s9qN8KQC;=)<?R7 G ; γ(·) O]U1A29c-9qP?!4 G B82-; G 587×46BX?R7J5 9H46BJ\ G 0R7J?RAC5 E E DG"P G B89T9qP γ

+SVP G ;CB82K G 0Ø4ËPRBJ7J\A]?RB82PRQ-s9,M4 G ;29<;]?R7×46B γ O¸(A29<; γ

7:P#4 G B82-; G 587×46B"7J; n E ?RA29<;Ü?RA295 G PR?`9,TU)<7:9<;]?$46BJ\ G 0R7J?RAC5 EGAX4YP146;Ü9,M4 G ;29<;+?R7×46B¸^ G 0PR?K+&)_4YP9U) G 574CB:9,ML7J?&2P- G ?RA7J;?R7J5 9Ü46;2NP34X4 )q9O'~K^`909qPR?30R7*)<?!?RA29 P9<? G K17J;4CQC?!B×46?R?R7*)q9qP!? G 7:NC9_46BB×46?R?R7*)q9qP E ^9 G -C?467J;ð?RA2940 G -CB:9<5 Ideal-SVP

VQ09qP34xOγ+Ideal-SVP

\ E ôAC7*)Aã7:PV7J574CBJ7*)<7J?RB82¯4X450465 9<?910R78e_9qN-;2ã4ßP9H]@Q29<;=)q9 G K4 G B82@; G 587×46B:P f G K$\0 G ô7J;C\ NC9<\09q9qPCOWU1A29U) G 574CQC?46?R7 G ;X46BoAX450NL;29qPP G K Ideal-SVP

7:PQC;CS-; G ô; E -CQC?Ø? G ?RA29c-9qP? G K G Q0ØS-; G ôB:9qNL\T9 E ; G 46BJ\ G 0R7J?RAC5 7:P¸S-; G ô;Þ? G 4s910iK G 0R5 ; G ;+n;29<\BJ7J\78-CB82-s9<?R?910K G 0 Ideal-SVP

?RAX46;K G 0 SVPOx?V7:PL-s9<BJ7:919T9qN?RAX46?!; G PRQ-s9,M4 G ;29<;]?R7×46B]]QX46;@?RQC546BJ\ G 0R7J?RAC5 P G B89T9qPV?RA29

) G 574CQC?46?R7 G ;X46B'9450R7×46;]?P G K SVP G 0 Ideal-SVP7J;/?RA29 ^ G 0PR?)_4YP9O¸9V4509 7J;]?9109qPR?9qNß7J;/?RA29 ^ G 0PR?K+&)_4YP9

7J;2PR?46;=)q9qP G K´?RA29qP9c40 G -CB:9<5 PCOLU1A29<780^ G 0PR?K+&)_4YP9ÌAX450NL;29qPP)_46;/-s909qNLQ=)q9qNÞ? G ?RA29 4H9T91046\T9,+&)_4YP9AX450NL;29qPPG K?RA29 K G BJB G ô7J;C\40 G -CB:9<5 P E 7J;]?30 G NLQ=)q9qNÿ7J;SEGW46;2NSE8@CG&O

8 ù:9!û÷ üs÷4zûWðñòñ Ì<;Ò7¶¬¬ $ É&.Ê;,=;Î ¬ µÎ ÉSÐzKÎ>"1¬8,Ò QÌ·Ð¶ K¶ÒH&,q q(·) m(·) β(·) ? SISq,m,β @À¶ A'1Î ¬Q¬8Î CB 5,É n¶ Éz¶Ò¶,D%

G1¶ Ò¥Ð¬*3É= 'HÎ ,ÒF¬ «SQÉ

Zm(n)×nq(n) !E É e ∈ Zm(n) \ 0

,,ÌQÌ¶

eT G = 0 mod q(n) ? QÌLÒÎC¬®;F"q,ÉÊJ.¶HG ,ÉSÎ Ò¥ÐÎÉz,É I C @ ¶ É ‖e‖ ≤ β(n)

Ì $ 3¶ ¬;Ò7¶¬¬ $ É&µÊ;,J;zÎ ¬®µÎ ÉgÐ3Î>",¬*,Ò QQÌRÐ¶ 3¶ ÒU1&, q(·) m(·) β(·) ¶ É f ? Ideal-SISfq,m,β @a¶5K'HÎ ¬¬8Î LB 5,É n

¶ ÉmÐÎ ¬®« ÉÎ ÒFµ¶ ¬½

g1, . . . , gm1ÌÎ5H1É/É= '1Î ,ÒF¬ «L¶ ÉzLQÉ;&Ð=,É;,É¬ «LQÉ

Zq[x]/f E É e1, . . . , em ∈ Z[x]

ÉzÎ¶¬¬7M,KÎU,,ÌQÌ¶ ∑i≤m eigi = 0

QÉZq[x]/f

¶ É ‖e‖ ≤ β Ì, e LQÌ

53C.Î gÎ>"H.¶ É3=",«/ÎÉ¶&,Éz¶ÉÊJQÌgÎsN³1.,ÉQFÎO'LQÌei P

U1A29qP9 ?^ G 4H9T91046\T9,+&)_4YP9S40 G -CB:9<5 PA)_46;W-s9ß7J;@?9103409<?9qN4YPÞB×46?R?R7*)q9X40 G -CB:9<5 PCO<~;2NC9q9qN E ) G ;2PR7:NC910ÿ45ï46?30R7ZM

G ∈ Zm×nq

OXU1A29P9<?G⊥ = b ∈ Zm : bT G = 0 mod q 7:P 46; m

+~NL7J5 9<;2PR7 G ;X46BWB×46?R?R7*)q9Os= G B89-7J;C\SIS

) G 0309qP4 G ;2NCP? G [2;2NL7J;C\4 PRA G 0R?; G ;+.e_910 G 9T9H)<? G 0¸7J; G⊥ O]=@7J587JB×450RB82 E Ideal-SIS) G 0309qP34 G ;2NCPØ? G [2;2NL7J;C\

4 PR5ï46BJBË; G ;+.e_910 G 9<B:9<5 9<;@?ÿ7J;ñ?RA29 Z[x]/f+n5 G NLQCB:9 M⊥(g) = b ∈ (Z[x]/f)m, 〈b, g〉 = 0 mod q EôA29109

g = (g1, . . . , gm)OIdeal-SIS

)_46;/-s9ÌP9q9<;ÿ4YP`4B×46?R?R7*)q9R40 G -CB:9<5 -;2Þ4544CB82-7J;C\[?RA29rotf

G 491046? G 01? G?RA29ËB×46?R?910HNC9qPq)10R784C?R7 G ;xO G ?9 ?RAX46?$?RA29 m G K SIS

7:Pn?R7J5 9qP$B×450R\T910$?RAX46;ß?RA29

m G K Ideal-SISO

(2-Q-X4YPRA2919LPRS2 46;2N³Ï7*)H)<7×46;=)<7 G E8@CBGÌ\]4H9T9>4P09qNLQ=)<?R7 G ; K0 G 5+?RA29I^ G 0PR?K+&)_4YP9 γ+&NC9_46BZ+=`Rb ? G ?RA29

4H9T91046\T9,+&)_4YP9F40 G -CB:9<5 γ+Ideal-SIS

O"U1A29845440 G ML7J5ï46?R7 G ;>KM4 )<? G 0P7VM46;2N ?RA29f40 G -CB:9<5 P\H7J;E8@CBGØ4509\789T9<;7J;Ý?910R5 P G K ?RA29/7J;[2;C7J?2 ; G 0R5ÀO©´ G 0 G Q074CQ034 G P9qP E 7J?87:P 5 G 09/;X46?RQ046BHQ2P90?RA29âQ=)<BJ7:NC9_46; ; G 0R5ÀO¸U G4H9 G 7:NðB G PR7J;C\ 4 √

nKn4 )<? G 0g-;2PR7J574CB82ã4544CB82-7J;C\I?RA29Ü; G 0R59H]]QC78946B:9<;=)q9 K G 0R5!QCB×4 E ^9Ü5 G NL7³KQ2 ?RA29U40 G@G K

G K6E8@CBG&O¸946B:P G 4YN2454C?Ø7J?¸? G AX46;2NLB:9$?RA29c)_4YP9oôA29109$?RA29o\789T9<; SISfq,m,β

46BJ\ G 0R7J?RAC5 AX4YP4ËPQ-9,M4 G ;29<;@?R7×46BPRQ=)H)q9qPP©40 G -X45-C7JBJ7J?&2 E 46?`?RA29c) G P? G K46;/4YNCNL7J?R7 G ;X46BKM4 )<? G 0 G K O(

√n)7J;Þ?RA29

SVP45440 G ML7J5ï46?R7 G ;0KM4 )<? G 0 γV?RAC7:P`7J;;9 G B89T9qP1Q2PR7J;C\ 4!B×450R\T910cÖË46Q2PPR7×46;0P)_46BJ7J;C\g4X450465 9<?910o? G 7J5740 G 9T9 ?RA29(QzPR5 G-G ?RAC7J;C\=Y409H)<7:PR7 G ;\,OLU1A29

NC9<?467JB:P$ô7JBJB'-9 \789T9<;ÿ7J;/?RA29ËKQCBJB9T910PR7 G ;xOR(S ù>47/ùÿ ðñQòñ ;CÐ;ÐÎ5HQÌ¶

f I,3 HT",¬*°Î51

Q ËF·Î É,,¶ É³QÉ&µÊ, m = Poly(n)¶ Éz

¶Ð,QÒq = Ω(EF(f, 3)βm2n) U) ÐÎ ¬®« ÉÎ ÒFµ¶ ¬ ÒU ? 3,.Ð "&%ÐÎÉz,Éµ¶ ¬ QÒ @ ¶¬ ÊÎQÌ;Ò 1Î ¬V QÉÊ

Ideal-SISfq,m,β QÌ·ÐKÎ"3¶>",Q¬ « 1/Poly(n) ? .Ð 2−o(n) @ ¶ ÉW"·H:.ÎPHÎ ¬V5 γ Ideal-SVP

QÉÐÎ ¬®« ÉÎ ÒFµ¶ ¬ ÒU ? &Ð ,0"X%ÐÎ Éz1É¶¬ ÒU @ QQÌ γ = O(EF2(f, 2)βmn1/2) ? &Ð γ = O(EF2(f, 2)βmn) @

U1A29LWE

40 G -CB:9<57:PNLQX46BX? G SIS7J;Ü?RA29$P9<;2P9o?RAX46?7³K

G ∈ Zm×nq

7:P¸?RA29SIS+n5ï46?30R7ZM E 7J?Ø7J;9 G B89T9qPØ?RA29

NLQX46B G K?RA29ËB×46?R?R7*)q9 G⊥ O¸9 AX4C9T9 G⊥ = 1qL(G)

ôA29109L(G) = b ∈ Zm : ∃s ∈ Zn

q , Gs = b mod q O8 ù:9!û÷ üs÷4zûWðñ ðñ ÌPÈ'3¶ ,É=QÉÊ ËJQÌ¹Í,KÎ ÀÐzKÎ>"1¬8,Ò QÌÐ¶ 3¶ ÒU1&, q(·),m(·) ¶ É¶Ô 1#", µÎ É

χ(·) ÎÉ R/[1, q(·)] ? LWEq,m;χ @ ¥¶5Y'HÎ ¬Q¬ZÎ CB 5,É n ¶gÒ¶% G ∈ Zm(n)×nq(n)

1¶ Ò¥Ð¬*3gÉ= '1Î ,ÒF¬ «¶¥K¶ÉÎ Ò ¶ É

Gs + e ∈ (R/[1, q(n)])n J Ì, s ∈ Znq(n)

/,ÌÎ5C,É:É= 'HÎ ,ÒF¬ «·¶¥3¶ É;Î Ò ¶ Éz·QÌÎCÎK QÉ¶&,gÎO'

e ∈ (R/q(n))m(n) ¶ LQÉ;Ð,É;1É¬ «U1¶ Ò¥Ð¬*3Z',KÎÒ χ(n) E É s Ì $ ;¶ ¬ È3¶ ,É=ÉÊJËJQQÌ¥Í,KÎqÐ3Î>",¬*,Ò QÌ©Ð¶ K¶ÒH&,q q(·),m(·) ¶Å ,,T",µÎ É χ(·) ÎÉ R/[1, q(·)]¶ Éf ? Ideal-LWEf

m,q;χ @ QÌ1¶Ò¶5a¶"3Î5 X%q&ÐzQÌ¶ G aÎO'QÌK'HÎ ÒG = rotf (g) QQÌ g

,ÌÎ H,ÉÉ= 'HÎ ,ÒF¬ «7QÉ

(Zq[x]/f)m Ç G ;@?3045032? G Ideal-SIS E 40 G -CB:9<5 Ideal-LWE

N G 9qP!; G ?VAX4H9T9Þ40;X46?RQ046B#4 G B82-; G 587×46BØ7J;]?9103409<?46?R7 G ;K G 0 4ï\T9<;291046B f E 4YPH^`984509!5QCBJ?R784CB82@7J;C\ rotf (g) G ;I?RA29g0R7J\A]?CO» G ^`919T910 E 7³K G ;29Q2P9qP f = xn + 1 E ?RA29<;(´9<585ï4ÔÌ46BJB G ^$P? G 7J;]?9103409<? Ideal-LWE

4YPm4 G B82-; G 587×46BL5!QCBJ?R784CBJ7*)_46?R7 G ;2PCO¸9`ô7JBJBLQ2P9?RA29¸K G BJB G ô7J;C\

09qPRQCBJ?Po? G - G QC;2N/?RA29ËP5 G@G ?RAC7J;C\4X450465 9<?910P G KB×46?R?R7*)q9qP G⊥ OCU1A29VP9H) G ;2N G ;29Ë7:Pa40 G 9T9qNÿ7J;I45449<;2NL7ZMOþ ùÿ¯ÿ¯ú¯ðñ[\Qòð] þ ùÿ¯ÿ¯ú_^ñ0 Cñ È1

n,m¶É

q"ÅQÉ&µÊ;1q QQÌ q

Ð,ÒU^¶Ém ≥ 2n log q ` Ì,É'HÎ N¶ ¬Q¬a",<¶b'3¶HµÎ É ≤ q−n ÎO'LQÌ G P ^QÉ Zm×n

q ! ÅÌ¶c5 λ∞1 (L(G)) ≥ q/4

þ ùÿ¯ÿ¯ú¯ðñd^ñ È'Hn,m

¶ Éq"7É&µÊ;, QÌ q = 3 mod 4

ÐQÒU7¶ Ém ≥ 9 log q

¶ Én = 2k '1Î

1ÎÒk ≥ 2 * Ì,É('HÎ L¶ ¬Q¬]",©¶e'3¶HµÎ É ≤ q−n Î&'ÅQÌ g P ÅÉ (Zq[x]/f)m ÅÌ¶5 λ∞

1 (L(rotf (g))) ≥q/4

D

f g% #%&#ì³èih¥;èkj #jxX%Ideal-SIS

U1A29!4CQ034 G P9 G KC?RA29!409qP9<;@?P9H)<?R7 G ;!7:PÚ? G NC9<5 G ;2PR?3046?9ØA G ^ã? G AC7:NC9Ø41?30454sN G@G 0´7J;!?RA29!40 G -CB:9<5 Ideal-SISO

>#??467EGPA G ^9qNãA G ^? G PR7J5!QCBJ?46;29 G Q2PB82 \T9<;291046?9Ü4SV SIS\5ï46?30R7ZM

G ∈ Zm×nq

46;2Nã4SV?30454sN G-G 0\R-X4+PR7:P

B = (b1, . . . , bm) ∈ Zm×m G K?RA29B×46?R?R7*)q9 G⊥ = b ∈ Zm : bT G = 0 mod q E ô7J?RA>?RA29K G BJB G ô7J;C\40 G 4s910R?R7:9qPCÂ@OCU1A29VNL7:PR?30R78-CQC?R7 G ; G K G

7:PoPR?46?R7:PR?R7*)_46BJB82A)BJ^9<;Ü46;2N7bW9<7JST910R?¥EDG27J5740 G 9T9qNU>#??467.YP!) G ;2P?30RQ=)<?R7 G ;ï7J;8?RA29oP9<;2P9`?RAX46?¸?RA29a)109_46?9qN-X4YPR7:P

AX4YPÌPRA G 0R?910¥9T9H)<? G 0PsÂ ‖B‖ = O(√

m) E ôA29109 m = Ω(n)O¸95 G NL7³K2A>6?i?467.YP¥) G ;2P?30RQ=)<?R7 G ; ? GÞG -C?467J; 4

?30454sN G@G 0Ë\T9<;291046?R7 G ;ð46BJ\ G 0R7J?RAC5K G 0 ?RA29g40 G -CB:9<5 Ideal-SIS E ô7J?RAã4U09qPQCBJ?R7J;C\0KQCBJBZ+.046;CS>P9<? G KBJ7J;29_450RB827J;2NC914s9<;2NC9<;]?VB×46?R?R7*)q979T9H)<? G 0PVôA G P9[B:9<;C\?RA2P!4509 4YPËPR5ï46BJBØ4YP ?RA G P9 G K`?RA29F-X4YPR7:P^9T9H)<? G 0P G K<>HBJ^`9<;ã46;2NbW9<7JST910R?CO'×2IQ2P7J;C\I40PR?46;2N2450N?9H)AC;C7*]]Q29·E E (´9<585ï4¼O8@,G E ?RA29qP979T9H)<? G 0PN)_46;¯-9[?3046;2PiK G 0R5 9qN 7J;@? G 4-X4YPR7:PôA G P9LÖV=Ã ; G 0R57:P©- G QC;2NC9qNI-2 ?RA29P|465 9¥]@QX46;]?R7J?2Þ46;2NÜôA G P9ÌB:9<;C\?RAÜ7:P O(

√mn)

B G ;C\T910CO-U1AC7:P7:P$?RA@Q2P$^`9_46ST910H?RAX46;EDG E -CQC?$K G 0 G Q0Ì4544CBJ7*)_46?R7 G ;2P G ;CB82Þ?RA29gÖV=Ã ; G 0R5 46;2Nÿ?RA29VB:9<;C\?RA G K?RA29ËBJ7J;29_450RB827J;2NC914s9<;2NC9<;]?HB×46?R?R7*)q9N9T9H)<? G 0P$5ï46?R?910CO¸9!N G ; G ?$S@; G ^ A G ^ ? G 4YN2454C?$?RA29L) G ;2PR?30RQ=)<?R7 G ; G K<EDGKQ0 G 5 SIS? G Ideal-SIS E ?RA29 NL7ZTU)<QCBJ?2PR?9<58587J;C\ÿK0 G 5?RA298B×4 )S G KH4A»Ì910R587J?9 G 0R5ï46B#´ G 0R5 K G 0V?RA29U) G ;2PR7:NC9109qN0R7J;C\TPCO

R(S ù>47/ùÿlxñQòñ Ì,L&% ,QR¶RÐKÎ"3¶>",Q¬ ,µ©ÐÎ¬ « ÉÎ ÒFµ¶ ¬QÒUÅ¶ ¬ ÊÎ ,QQÌ;Ò QÌQÌ3'HÎ ¬¬8Î QÉÊcÐ3ÎÐ,1. $ ^.¶HG ,A¶5JQÉ ÐQ n, σ, r > 0 ¶ ÉWÎC;IÐ,ÒU q ¶ É¯¶ ÉªQÉ&µÊ;, m ≥ (dlog qe + 1)(σ + r) *$ L¶ ¬ 1Î.¶HG ,A¶5JQÉ ÐL¶¯;µÊ3nÐÎ ¬®« ÉÎ ÒFµ¶ ¬

f ∈ Z[x] Ë7J¬*1 f =∏

i≤t fi"JQb'H¶H.Î ,MC¶µÎ ÉWÎ ,

Zq

Ìg¶ ¬ ÊÎ ,QQÌÒ qq35 QQÌfÐ3Î>"3¶>"1¬®Q« ≥ 1 − p QÌ p = 1 −∏i≤t(1 − q−deg fi·σ) ËIÌ,É°Q<Îs, 1,Ég ∈ (Zq[x]/f)m ¶É¶,',¬Q¬ 3¶ É0GgH1 S Î&'¥¬®É3¶ ,¬ «FQÉ;&Ð1É;,É`53H.Îq^QÉQÌR¬8¶µµq

rotf (g)⊥ ,ÌÀQÌ¶mBn o Ìg ,.¶Éqf.ÎÉ= '1ÎÒF«UÎO' g

N¶#Ò7Î ,p + m

2

(∏i≤t

(1 +

( q3r

)deg fi

)− 1)1/2

p Ë7LÌ¶5 ‖S‖ ≤ EF(f, 2) ·√

(9r + σ) · √n

ñò qIù>rzôöQú0/ ÷üts;I?RA29g>6?i?467W46;2N°>BJ^9<;+&bW9<7JST910R?N) G ;2PR?30RQ=)<?R7 G ;2P E 4 K9<^ QC;C7³K G 0R58B82 NL7:PR?30R78-CQC?9qNX046;2N G 5 9T9H)<? G 0P (gi)i≤σ4509g[=0PR?Ë\T9<;291046?9qNã46;2N?RA29<;ã4509[Q2P9qN4YP!40P9q9qN ? G 40 G NLQ=)q9 G ?RA2910L046;2N G 5 9T9H)<? G 0P (gi)i>σ

?RAX46?!4509P9q9<587J;C\B82ÜQC;C7³K G 0R58B82ÞNL7:PR?30R78-CQC?9qNOCU1A29ËNC910R789T9qNI9T9H)<? G 0P$4509ËPR5ï46BJB046;2N G 57J;@?9<\T910) G 5N-C7J;X46?R7 G ;2P G K?RA29P9q9qN9T9H)<? G 0P E ?RA]Q2PF)109_46?R7J;C\PRA G 0R?g9T9H)<? G 0P7J; ?RA29ÜB×46?R?R7*)q9 G⊥ 4YPg-2;+.40 G NLQ=)<?PCOU1A290P G QC;2NL;29qPP G K$?RA2940 G )q9qNLQ0907:P\QX45046;@?9q9qN:-;2 4 P G +&)_46BJB:9qN09<\QCB×450R7J?&2 B:9<585ï4O!~; ?RA29J)_4YP9 G K¥0R7J;C\ 9<B:9<5 9<;]?P87J;2P?9_4YN G K9T9H)<? G 0P E PQ=)A 4709<\QCB×450R7J?&2/B:9<585ï48^14YP$\789T9<;·-;2A¨ß7*)H)<7×46;=)<7 G 7J;¯E@,G&OXU1A29^409H)<7:P9^09qPRQCBJ?NC9_46BJ?Hô7J?RAÿ?RA294X450R?R7*)<QCB×450c0R7J;C\

Zq[x]/(xn − 1)-CQC?o7J?Pa40 G-G Kj)_46;À-s9Ë9_4YPR7JB82/4YN2454C?9qNÿ? G8G -C?467J;I?RA29ÌK G BJB G ô7J;C\=O

R(S ù>47/ùÿlxñ*ðu&vFøú01üCù;øxwI/54zÿy8ðò R(S ñz[xñ ð Cñ È'1F"F¶ E É=& E ,¬8I¶É f ∈ F[x]

"fÒÎ É=µg¶ ÉÎO'U;.Ê 3q

n > 0 È'H R"IQÌ/,ÉÊ

F[x]/f È'H D ⊆ F¶ Éz

r > 0 Î g1, . . . , gr ∈ R e I;,ÉÎ&",«H(g1, . . . , gr)

QÌf3¶ ÉÎ Ò|¶ ,¶>"1¬8 ∑i≤r bigi ∈ R Ì,gQÌ bi P f¶ fµÊ < n

ÐÎ ¬®« ÉÎ ÒF¶¬½ QÌÎsN³1µ1ÉQc,ÌÎ5C,ÉUQÉ;&Ð=,É;,É¬ «f¶ÉÅÉ= 'HÎ ,ÒF¬ «ÅQÉD $ ' U1, . . . , Ur

¶ É&Ð,É,ÉÉ= '1Î ,ÒÝK¶ÉÎ Ò¼

¶ ,µ¶>",¬*NQÉR QÌ,É°QÌL,.¶,µ¶ ¬ 1.¶ Éqf.ÎUÉ 'HÎ ,Òg«UÎO' (U1, . . . , Ur,H(U1, . . . , Ur))

("q,¬ZÎ B

1

2

√√√√∏

i≤t

(1 +

( |F||D|r

)deg fi

)− 1,

Ì, f =∏

i≤t fi^QÌz'H¶H.Î ,MC¶µÎ ÉPÎO'

fÎ51

F ´0 G 5; G ^ G ; E ^9Ìô7JBJBx)A G-G P9 F = Zq

ô7J?RAq46; G NCNI40R7J5 9 E 46;2N D = −1, 0, 1 O=(´9<?1Q2Pa) G 585 9<;]?

G ;ñ?~^ GÝG 44 G PR7J?9PR7J?RQX46?R7 G ;2PCOa~K?RA29°4 G B82-; G 587×46B fP4CBJ7J?PÀ) G 574CB:9<?9<B82 G 9T910 F E ?RA29<; ?RA29 NL7:P?46;=)q9 ? GQC;C7³K G 0R587J?&2)_46;·-9Ë5ï4YNC9!;29<\BJ7J\78-CB:9!ô7J?RA·09qP34s9H)<?H? G n-2/?46S@7J;C\

r = ω(log(nq))O» G ^919T910 E ? G 9<;2PRQ09

?RAX46?7J?7:PW9,M4 G ;29<;]?R7×46BJB82[PR5ï46BJB EYG ;29;29q9qNCP? G ?46ST9 r = Ω(n+log q)O G ^ E 7³K f 7:PW780309qNLQ=)<78-CB:9 G 9T910 F E ?RA29<;)A G-G PR7J;C\ r ≥ 1 + log3 q

PRQTU)q9qP$? G 40 G 9@7:NC9!46;I9,M4 G ;29<;]?R7×46BJB82/PR5ï46BJBP?46?R7:PR?R7*)_46BNL7:PR?46;=)q9Ë? G QC;C7³K G 0R587J?&2O

ñ ð v üL/5ú016øa4]47/~wm47/Ideal-SIS

¸9Ë; G ^Ü) G ;2PR?30RQ=)<??RA29Ë?30454N G-G 0$K G 0 Ideal-SISO=¨ G 09^409H)<7:P9<B82 E ^`9V^146;]?H? G PR7J5!QCBJ?46;29 G Q2PB82À) G ;2PR?30RQ=)<?

4ÜQC;C7³K G 0R5 g ∈ Rm ô7J?RA R = Zq[x]/f E 46;2N>4ÜKQCBJBZ+.046;CS>P9<? S G K`PR5ï46BJBBJ7J;29_450RB82 7J;2NC9149<;2NC9<;@?L9T9H)<? G 0P-s9<B G ;C\7J;C\Ì? G ?RA29B×46?R?R7*)q9 G⊥ ôA29109 G = rotf (g)

O´ G 0?RAC7:P E 7J?WPQTU)q9qP? G [2;2N[4046;CS mP9<? G K R0

+nBJ7J;29_450RB827J;2NC914s9<;2NC9<;]?¸PRA G 0R?j9T9H)<? G 0P7J;[?RA29Ø5 G NLQCB:9 M⊥(g) = a ∈ Rm

0 | 〈a, g〉 ≡ 0 mod q E ô7J?RA R0 = Z[x]/fO

=@Q44 G P9/[=0PR?[?RAX46?8^9Þ\T9<;291046?9¯VQC;C7³K G 0R58B82 46;2N 7J;2NC914s9<;2NC9<;]?RB82=\ k9<B:9<5 9<;@?P87J; R O PR7J;C\ U1A29 G +09<5êO E ?RA2912f)_46;g-s9Q2P9qN!? G P46574CB:9 k′ G ?RA29109<B:9<5 9<;]?P G K R ôAC7*)Aï4509RVM46BJ5 G P?\´QC;C7³K G 0R58B82!NL7:PR?30R78-CQC?9qNO

;ÿ? G ?46B E ^9!\T9<? k + k′ 9<B:9<5 9<;@?PH7J; R E -CQC?$^`9 G ;CB820AX4H9T9 k′ PR5ï46BJB'09<B×46?R7 G ;2Pc-9<?^9q9<; ?RA29<5ÀO» G ^`919T910 E^9 ;29q9qN

k + k′ BJ7J;29_450RB82Þ7J;2NC9149<;2NC9<;@?HPR5ï46BJB09<B×46?R7 G ;2P E 46;2NÞ7J?o7:P1; G ?a)<B:9_450oA G ^ñ? G [2;2N/46; G ?RA2910 kO>B:P GCE

; G ?R7*)q9?RAX46? G Q0R09<B×46?R7 G ;2P A G B:N G 9T910 R0E 7.O9O E ?RA2912IN G ; G ? 5ï46ST9Q2P9 G KØ?RA295 G NLQCBJQ2P q

Oz>6?i?467.YPÌ^ G 0RS+450 G QC;2N/7J;SEG) G ;2P7:PR?P17J;ÿQ2PR7J;C\ï46;/7J;@?910R5 9qNL7×46?9P9<? G K0R7J;C\ï9<B:9<5 9<;]?PgV G 0046?RA2910 E 7J;/AC7:P)_4YP9 E 9T9H)<? G 0P\,OU1A29^40R7J;=)<784CB:9Ë7:P$?RA29 K G BJB G ô7J;C\=Â

´W780PR?W\T9<;291046?9oP G 5 9`P9q9qN9<B:9<5 9<;@?P g1, . . . , gσ7J; R O6U1A2912Vô7JBJB-s9Ø?RA29#[=0PR?9<B:9<5 9<;]?P G KX?RA29 Ideal-SIS7J;2PR?46;@?R7×46?R7 G ;xOU1A2912 ;29q9qNPRQTU)<7:9<;@?L2-7:9<B:NP G ?RAX46?!4503-C7J?3045032 9<B:9<5 9<;]?P G K R )_46;P-9[â0R7J?R?9<;ðQ4ã4YP

BJ7J;29_450c) G 5f-C7J;X46?R7 G ;2P G KW?RA29<5ÀO ´0 G 5?RA29$P9q9qN E NC910R789T9HP G 5 9o7J;@?910R5 9qNL7×46?9c0R7J;C\9<B:9<5 9<;]?P hσ+1, . . . , hm

O>5 G ;C\!?RA29<5 E ?RA29109HPRA G QCB:N-s9PQTU)<7:9<;]?RB82ß5ï46;2VP4C2ÿ?RA29B×4YPR?

r G ;29qP,\o?RAX46?V4509QC;C7³K G 0R58B82ßNL7:P?30R78-CQC?9qN>7J; R E P G ?RAX46? ^95ï4H2Q2P98U1A29 G 09<5¾OOÚ1A29g[=0PR?hiYPVAX4H9T98?RA298?9H)AC;C7*)_46B#4CQ034 G P9 G K$46BJB G ô7J;C\I? G AX4H9T9 PR5ï46BJB#09<B×46?R7 G ;2P

-s9<?~^`9q9<;g1, . . . , gσ, hσ+1, . . . , hm

O¨ G 09^409H)<7:P9<B82 E ^`9Ëô7JBJBÁX4C9T9Â

[A|B](g1, . . . , gσ, hσ+1, . . . , hm)T = (0, . . . , 0)T ,VK@s\

ôA29109A ∈ R(m−σ)×σ

0

46;2NB ∈ R(m−σ)×(m−σ)

0

AX4C9T9IPR5ï46BJBÌ9<;]?30R7:9qP/46;2NB7:PÜB G ^`910Ü?30R7×46;C\QCB×450

ô7J?RA1YP G ;ß?RA29VNL7×46\ G ;X46B.O

´W7J;X46BJB82 E PR7J;=)q9 ?RA29VB×4YPR? r G K4 G B82-; G 587×46B:P hm−r+1, . . . , hm4509ËQC;C7³K G 0R58B82ÞNL7:P?30R78-CQC?9qN/7J; R E ^`9 ?46ST9?RA29<5 4YP$?RA29ËB×4YPR?

giYP E 46;2N0^9N) G ;2P?30RQ=)<?$?RA29Ë587:PPR7J;C\ gi

YPa-;2Â

gi =

hi + H(hm−r+1, . . . , hm), ∀i ∈ [σ + 1,m − r],hi, ∀i ∈ [m − r + 1,m].

Vµ\

U1AX46;CSLP`? G U1A29 G 09<5O E ^9 P9q9?RAX46?1ôAX46?919T910`^`9109Ì?RA29c[=0P? hiYP E ?RA29QC;C7³K G 0R587J?2 G K´?RA29ÌB×4YPR? G ;29qP

40 G 9@7:NC9qPÌ4F)<B G P9 ? G QC;C7³K G 0R5 NL7:P?30R78-CQC?R7 G ; G K (g1, . . . , gm)O¸9ËAX4C9T9Ë?RAX46? E K G 0H46BJB i ∈ [σ + 1,m − r] E

¿

gi = hi +∑m

j=m−r+1 yi,jhjE ôA291099_4 )A yi,j

7:P4ïNC9<\09q9< n

4 G B82@; G 587×46BWô7J?RA·) G 9,TU)<7:9<;]?PÅ)A G P9<;7J;2NC914s9<;2NC9<;]?RB82ß46;2N/QC;C7³K G 0R58B8207J; D

O¸9VNC9,[2;29C ∈ R(m−σ)×(m−σ)

0

4YP1K G BJB G ^$PCÂ

C =

[Idm−σ−r (yi,j)

0 Id r

].

â6]@QX46?R7 G ;Vµ\7J574CBJ7:9qPH?RAX46?

C · (hσ+1, . . . , hm)T = (gσ+1, . . . , gm)T46;2N

[A | B · C] · (g1, . . . , gm)T = (0, . . . , 0)T .

= G Kn450 E ^9ËAX4C9T9ËPRA G ^`9qN/A G ^ ? G )109_46?9Ë?RA29 giYPCO¸(AX46?o7:P1B:9qPPa)<B:9_450o7:P1?RAX46?o^`9L)_46;0AX4H9T9

mBJ7J;29_450RB82

7J;2NC914s9<;2NC9<;]?PA G 0R?x9T9H)<? G 0P´7J; MOqU1AX46;CS-P? G â6]@QX46?R7 G ;2P©VK@s\Ú46;2N/Vµ\ E ^9AX4C9T9 m−σ

BJ7J;29_450RB82 7J;2NC914s9<;2NC9<;]?PR5ï46BJBx09<B×46?R7 G ;2PsO>\]467J; E 4YP$7J;ÿ?RA29L[=0PR?46?R?9<574C? E P G 5 9^09<B×46?R7 G ;2P 4509Ë587:PPR7J;C\Ü46;2NI46BJB?RA G P9Ë^`9VAX4C9T9!N G; G ?$7J;9 G B89T9V?RA29Ë5 G NLQCBJQ2P q

O=×`QC?$?RA29VPRAX454s9 G K?RA29 m − σ09<B×46?R7 G ;2P^9ËAX4C9T946BJB G ^$PHQ2P$N G -CQC7JB:Nÿ9,M-?304+

09<B×46?R7 G ;2P`?RAX46?1^9R)_46;/40 G 9T9BJ7J;29_450RB82ï7J;2NC9149<;2NC9<;@?CO´ G 07J;2P?46;=)q9 E 465 G ;C\[?RA29 hiYP E P|4H28?RA29 σ

-s9K G 09H?RA2909<\QCB×450R7J?&2 G ;29qPV7.O9O E hm−r−σ+1, . . . , hm−r

\ E ^`9a)109_46?9o?304542PCO F 9H)_46BJBC?RAX46?^`9a)_46;8AX4H9T9$4503-C7J?3045032 hiYP¸4YP

B G ;C\ 4YP1?RA29ÌB×4YPR? G ;29qP$4509ÌQC;C7³K G 0R58B82ÜNL7:PR?30R78-CQC?9qNÿ46;2NJâ6]@QX46?R7 G ;¯VK@s\ØA G B:NCPCO~;Þ?RA29 P465 9 P34C780R7J?$4YPÅEG E ^`9NC9,[2;29

hm−r−σ+i = 2−1giE K G 0 i ≤ σ E ôA29109H?RA297J;;9T910P9Ì7:P`?46ST9<;05 G NLQCB G q

O@U1AC7:P`\789T9qP`Q2Pσ4YNCNL7J?R7 G ;X46B

09<B×46?R7 G ;2P E P7J;=)q9UV²K G 0 i ≤ σ\,Â

2gm−r−σ+i = 2hm−r−σ+i + 2H(hm−r+1, . . . , hm) = gi + 2H(gm−r+1, . . . , gm) mod q.Vµ\

(´9<?2gm−r−σ+i = gi + 2

∑mj=m−r+1 zi,jgj

G 9T910 Z E ôA291099_4 )A zi,j7:PÌ4 NC9<\09q9

< n4 G B82-; G 587×46BôAC7*)A

AX4YPa) G 9,TU)<7:9<;]?Pc)A G P9<;ÿQC;C7³K G 0R58B82046;2N07J;2NC914s9<;2NC9<;]?RB82ÞK0 G 5 DO¸9ËNC9,[2;29Ë?RA29

σ × (m − σ)5ï46?30R7ZM

KÂ

K =[0 −2Idσ 2(zi,j)

].

´0 G 5 â6]@QX46?R7 G ;Vµ\ E ^9AX4H9T9?RAX46? [Idσ | K] · (g1, . . . , gm)T ≡ (0, . . . , 0)T mod qOÃ¥9T91046BJB E ^`9 G -C?467J;

V)<B G P9Ë? G \QC;C7³K G 0R58B82/NL7:PR?30R78-CQC?9qN giYPH46;2NA09<B×46?R7 G ;2P G K?RA29Ë?24s9V G 9T910 R \,Â

[A B · C

Idσ K

]·

g1OOOgm

=

0OOO0

,

ôA29109A46;2N

B4509[?RA G P9 G Kaâ6]]QX46?R7 G ;¹VK@s\ E C ∈ R(m−σ)×(m−σ)

0

7:PËQ44s910V?30R7×46;C\QCB×450Vô7J?RA1YP G ; 7J?P

NL7×46\ G ;X46B E 46;2N K ∈ Rσ×(m−σ)0

7:PNL789@7:PR78-CB:9¥-;22O>HBJB"?RA29qP9$5ï46?30R7*)q9qPAX4H9T9ÌPR5ï46BJBs9<;]?30R7:9qPCO-U G P9q9$?RAX46??RA29

09<B×46?R7 G ;2P[45098BJ7J;29_450RB82 7J;2NC9149<;2NC9<;@? G 9T910 R E ; G ?R7*)q9 ?RAX46?V?RA29ÜNC9<?910R587J;X46;]? G K1?RA29Ü45- G 9T9-CB G )S+n5ï46?30R7ZM5 G NLQCB G 27:P

1ÂC?RA29VNC9<?910R587J;X46;@? G K B

46;2NC4509Å- G ?RA 1 E 46;2N K = 0 mod 2

O? G ;CB82¥09<5ï467J;2P? G 9,M4CB×467J;VA G ^?RA29¸5ï46?30R7*)q9qP A 46;2N B

4509!-CQC7JBJ?COÇ9¸PR?450R?-;2 \T9<;291046?R7J;C\hm−r+1, . . . , hmQC;C7³K G 0R58B82ã46;2N7J;2NC914s9<;2NC9<;]?RB82ã7J; R Ox>oNCNL7J?R7 G ;X46BJB82 E ^9ÞP9<? hm−r−σ+i = 2−1gi

K G 0 i ≤ σO'~Ko^9 ;29q9qN

G ?RA2910 hiYP E ?RA29qP9f)_46;X-s94503-C7J?30450R7JB82X)A G P9<;xO´ G 0Ë46;;2 i ∈ [m − r − σ + 1,m] E ^9â0R7J?9 hi

4YPÌ4ïBJ7J;29_450) G 5N-C7J;X46?R7 G ;±V G 9T910 R \ G K$?RA29ÞP9q9qNCPCÂ hi =

∑j≤σ xi,jgj

O F 9<5 9<5N-s910?RAX46? σ7:Pf)A G P9<; P G ?RAX46??RAC7:P7:P

4 )<?RQX46BJB82A4 G PPR78-CB:9O2U1A29 xi,jYP4509^4 G B82-; G 587×46B:PHô7J?RA) G 9,TU)<7:9<;]?P5 G NLQCB G q

O¸9ËQ2P9Ë?RA29L-C7J;X45032ÿNC9H) G 5F+4 G PR7J?R7 G ;2P G Ko?RA29qP974 G B82@; G 587×46B:P!? G â0R7J?9Â hi =

∑κ−1k=0

∑j≤σ xi,j,kgj2

k E ô7J?RA κ = dlog qe OU1A29 xi,j,kYP

4509^4 G B82@; G 587×46B:P$ô7J?RA 0, 1 +&) G 9,TU)<7:9<;]?PCO

B

¸9!Q2P9Ë?RA29xi,j,k

YP$7J;AOXU1A29!B×46?R?910PR?450R?Pô7J?RA

k + σ-CB G )S-P G K Rκ×σ

0

VM46;2Nÿ?RA29<;·e_910 G P\,OXU1A29 i?RA

-CB G )S/7:P$5ï4YNC9 G K¸?RA29 xi,j,kYPgV²K G 0 j ≤ s

46;2N0 ≤ k ≤ κ − 1

\a-;2ÿNC9H)109_4YPR7J;C\/9Y46BJQ29 G K kO"U1A29V5ï46?30R7ZM

B7:PH4YP1K G BJB G ^$PsÂ

B =

T O O OT

E Id

,

ôA29109Ë?RA29109!4509r + σ

-CB G )SLP T46;2N

E[i, j] = −17³K

i = jκ46;2N

0 G ?RA2910Rô7:P9O

ñ vIûú=ödsxý÷ý47wü S ùÀüL/5ú016ø34]4/õ:4zû'ýCüL/5ôõüs÷4û³ú=û'ø¹õ:4ÿÿSùûzüCýU1A29N) G 0309H)<?R;29qPP G K?RA29N) G ;2P?30RQ=)<?R7 G ;IAX4YPÌ46B809_4YN2A-9q9<; 9qPR?45-CBJ7:PRA29qNO?c)_46;>46B:P G -s9L0RQC;ÿ7J;·4 G B82-; G 587×46B?R7J5 9O!¸ AX46?709<5ï467J;2P8? G -s90PR?RQ2NL7:9qN7:P[?RA29À]@QX46BJ7J?&2V7J;?910R5 P G K NL7J5 9<;2PR7 G ;(46;2N ; G 0R5/\ G K ?RA29J-CQC7JBJ??30454sN G@G 0CO

¸9^)A G@G P9 σB×450R\T9Ë9<; G QC\AÿP G ?RAX46?o?RA29 P9q9qNÞ\T9<;291046?9qP R

ô7J?RA/AC7J\AI40 G -X45-C7JBJ7J?2OXU1A29ÌKn467JBJQ09R40 G -+45-C7JBJ7J?&2Ü7:P#- G QC;2NC9qN/-;2 1−∏i≤t(1− q− deg fi·σ) E ôA29109 f =

∏i≤t fi

7:P`?RA29$Kn4 )<? G 0R78e46?R7 G ; G K f 5 G NLQCB G qO

G ?9$?RAX46?1919T9<;Ü7J;Þ?RA29H? G ?46BJB82 P4CBJ7J?R?R7J;C\F)_4YP9 E ^9R)_46;J)A G-G P9 σ = 146;2NU09º?R9H)<?Ø?RA29¥046;2N G 58B82 \T9<;291046?9qN

P9q9qN 9<B:9<5 9<;]?Þ4YP[B G ;C\ã4YP[7J?7:P[; G ?87J;9T910R?R78-CB:9O!¸9/N G ; G ?8\T9<? 4 QC;C7³K G 0R58B82 NL7:PR?30R78-CQC?9qN7J;2PR?46;@?R7×46?R7 G ;G K Ideal-SIS

VPR7J;=)q9 ?RA29ÜNL7:PR?30R78-CQC?R7 G ; G K g17:PPRST9<^9qN\,O» G ^919T910 E ^9Ü\T9<?4/; G ;+n;29<\BJ7J\78-CB:9I40 G 4 G 0R?R7 G ;

G K Ideal-SIS7J;2P?46;=)q9qP E ôAC7*)A/PRQTU)q9qPK G 01U1A29 G 09<5 O8@gV7J;Þ?RA29c09qNLQ=)<?R7 G ; E 0RQC;Þ?RA29ÌP46574CBJ7J;C\8PR?914ÜQC;@?R7JB

?RA29 G -C?467J;29qN Ideal-SIS7J;2PR?46;=)q9oAX4YP7J?Pj[=0P?!9T9H)<? G 0?RAX46?¸7:P7J;;9T910R?R78-CB:9s\,O@U1A29<4X450465 9<?910 r

7:PNC9<?910R587J;29qN-;2U1A29 G 09<5¾OOU1A29/) G ;2PR?30RQ=)<?R7 G ;ð?RA@Q2PN09H]@QC7809qP m ≥ (r + σ)(1 + κ)

O G ?9ï?RAX46?!?RA298B G ^910g- G QC;2NG ; m

)_46;J-9HKQ0R?RA2910`NC9H)109_4YP9qNI-2ïQ2PR7J;C\84L-X4YP9β > 2

NC9H) G 574 G PR7J?R7 G ; G K´?RA29 xi,jYP7J;2P?9_4YN G KW4N-X4YP9 2NC9H) G 574 G PR7J?R7 G ;xO» G ^`919T910 E ?RAC7:PØ5ï46ST9qP?RA29$; G 0R5 P G KÚ?RA29H5 G NLQCB:99T9H)<? G 0P\0 G ^LO´W7J;X46BJB82 E ?RA29HB×450R\T9qPR?#4 G PK+

PR78-CB:9f9T9H)<? G 0; G 0R5 PÅ) G 5 9!KQ0 G 5 ?RA29N[=0PR?m − σ

5 G NLQCB:9N9T9H)<? G 0PsO"U1A29 A4X450R?ÌAX4YPH; G 0R5 ≤ √

σnôAC7JB:9

?RA297) G 574 G ;29<;]?P G K`?RA29F0R7J\A]?ËAX46;2NCPR7:NC9 45098NC9<\09q9 < n4 G B82-; G 587×46B:P ô7J?RAS) G 9,TU)<7:9<;@?P G K5ï46\;C7J?RQ2NC9qP

-s9<B G ^ 3O

!'æLWE

SIS

¸9$PRA G ^Ý?RAX46?¸7³K46; 9,TU)<7:9<;]?o46BJ\ G 0R7J?RAC5P G B89T9qP LWEô7J?RAïP G 5 9$; G ;+n;29<\BJ7J\78-CB:940 G -X45-C7JBJ7J?&2 E ?RA29<;ï7J?5ï4C2

-s9ïQ2P9qN-;2 4]@QX46;]?RQC5 5ï4 )AC7J;290? G 9,TU)<7:9<;@?RB82 P G B89T9 SISô7J?RA ; G ;+n;29<\BJ7J\78-CB:9A40 G -X45-C7JBJ7J?&2O!> )10RQ=)<7×46B

40 G 4s910R?&2 G K1?RA29709qNLQ=)<?R7 G ;ã7:P!?RAX46?V?RA2985ï46?30R7ZM QC;2NC910RB82@7J;C\I?RA29 SIS46;2N

LWE7J;2PR?46;=)q9qP!7:PL409qP91039T9qNÂ

7³K ?RA29/7J;C7J?R7×46B46BJ\ G 0R7J?RAC5 P G B89T9qP LWEK G 0Ü4 \789T9<; 5ï46?30R7ZM G ∈ Zm×n

qE ?RA29<;Ý?RA29A09qPRQCBJ?R7J;C\ 46BJ\ G 0R7J?RAC5

P G B89T9qP SISK G 0Ø?RA29P465 9o5ï46?30R7ZM G

O@U1AX46?#40 G 4s910R?&2Ü46BJB G ^$PØ?RA29c09qNLQ=)<?R7 G ;Ü? G 09<5ï467J;I946BJ7:N8ôAC7JB:9H^ G 0RS@7J;C\G ; Ideal-SIS

46;2NIdeal-LWE

O

R(S ù>47/ùÿ['ñQòñ È'1q,m, n

"fQÉ&µÊ,q ¶ É α ∈ (0, 1) QÌ Poly(n) ≥ m ≥ 2n log q¶ Éz

α < 116

√m

;sÐÐÎ5CgQÌ¶QÌ,&% ,Qf¶ÉP¶¬ ÊÎQÌ;ÒÓQÌ¶6HÎ ¬V5LWEm,q;Ψαq

ÉPQÒT = 2o(n) ¶ É QÌfÐzKÎ>"¶>",Q¬ «

ε = 2−o(n) , Ì1É·QÌ,g&% ,QL¶UÑ1¶ ÉÒÓ¶ ¬ ÊÎ ,QQÌÒ QÌ¶jHÎ ¬ SIS

m,q;√

n

2α

QÉ·QÒ Poly(T, n)¶É

QÌ7Ð3Î>"3¶>",Q¬®Q« ε3

16 − O(ε5) Z Ìg¬Za,Q¬Q¬xÌÎ ¬85 Ì,ÉS&Ð¬8¶1QÉÊ LWEm,q;Ψαq

",«Ideal-LWEf

m,q;Ψαq¶ ÉSIS

m,q;√

n

2α

",«Ideal-SISf

m,q;√

n

2α

'1Î f = xn + 1 QQÌ n = 2k ¶É q ≡ 3 mod 8 @C²

U1A29X09qNLQ=)<?R7 G ; 7:PÞ5ï4YNC9 G KV?^ G ) G 574 G ;29<;]?PCOa´W780PR? E ^9>450R\Q29 ?RAX46?ÿ46; 46BJ\ G 0R7J?RAC5 P G B89-7J;C\ LWE40 G 9-7:NC9qPÿ46; 46BJ\ G 0R7J?RAC5 ?RAX46?/P G B89T9qP/4¯)q910R?467J;Ô)?RA29 NL7Ds9109<;=)q9>? G ?RA29B×46?R?R7*)q97:PNL7:PR?30R78-CQC?9qN84 )H) G 0NL7J;C\ ? G 46; n

+~NL7J5 9<;2PR7 G ;X46BÖË46Q2PPR7×46;xO~;[4HP9H) G ;2NPR?914 E ^9`PRA G ^ ?RAX46? F 9<\T919YP]@QX46;]?RQC546BJ\ G 0R7J?RAC5ÄE E (´9<585ï4fO8@1 G)_46;ïQ2P9HPRQ=)A046;Þ46BJ\ G 0R7J?RAC5 ? G ) G ;2PR?30RQ=)<?1PR5ï46BJB"P G BJQC?R7 G ;2PØ? G SIS

O

[xñò /54zÿLWE

üL4CVP

>;ß46BJ\ G 0R7J?RAC5 P G B89-7J;C\ LWE46BJB G ^$PQ2Po? G P G B89T9 E K G 0c)q910R?467J;ßB×46?R?R7*)q9qP E 4F9450R7×46?R7 G ; G K?RA29fÇB G P9qPR?`¸9H)<? G 0

b!0 G -CB:9<5ÀO~;8?RAX46?©9Y450R7×46?R7 G ; G K CVP E ?RA29H91030 G 0#9T9H)<? G 0¸7:PP46574CB:9qNÜ4 )H) G 0NL7J;C\? G 4ËP34s9H)<7Z[X9qN NL7:PR?30R78-CQC?R7 G ;xO8 ù:9!û÷ üs÷4zû[xñòñ ÌfÐ3Î>",¬*,Ò CVPχ QÌAÐ¶ 3¶ ÒU1&,X 1#",ÎÉ χ(·) A¶ Z'HÎ ¬Q¬ZÎ LB 5,É¶ É n QÒU,ÉµÎ É¶¬¬8¶µ

L¶ ÉU¶53H.Î

t = b+ e Ì13 b ∈ L¶ Éz

e Å 1#",&3U¶;Î 3 QÉÊU.Î

χ(n) QÌÊÎC¶¬x L.Î E É b ¸9`PRA G ^ ?RAX46?7³K2^9ÀX4C9T9146;846BJ\ G 0R7J?RAC5 ?RAX46?P G B89T9qP LWEm,q;Ψαq

E ?RA29<;^9<)_46;F) G ;]?30RQ=)<?Ø46;846BJ\ G 0R7J?RAC5P G B89-7J;C\ CVPναq

K G 0HP G 5 9 B×46?R?R7*)q9qPCOþ ùÿ¯ÿ¯ú[xñòñ È'H

q,m, n"<QÉ&µÊ,q¶ É

α ∈ (0, 1) QQÌ m, log q = Poly(n)¶ É

α < 116

√m ;sÐÐÎ5C

QÌ¶QÌ,7&% ,Qf¶ÉP¶¬ ÊÎQÌ;Ò A QÌ¶6HÎ ¬ LWEm,q;Ψαq

É°QÒT = 2o(n) ¶ É QQÌgÐ3Î>"3¶",¬®« ε =

2−o(n) Z Ì,É¯QÌ,3/&% ,Q S ⊆ Zm×nq

ÎO'cÐ3ÎÐÎ 1µÎ É ≥ ε/2¶ ÉÀ¶ É¶ ¬ Ê;Î QÌ;Ò A′ ,ÌXQÌ¶< ' G ∈ S ¶ ¬ ÊÎ ,QQÌÒ A′ 1Î ¬V5 CVPναq

'HÎ L(G)

QÉ·QÒUT + Poly(n)

¶É QÌfÐKÎ"3¶>",Q¬ « ≥ ε/2 − 2−Ω(n) 3ÎCÎO' nK G ∈ Zm×n

q

46;2Ns ∈ Zn

q

4509ÞP46574CB:9qNðQC;C7³K G 0R58B82 46;2Nã7³KH?RA29I) G-G 0NL7J;X46?9qP G K e4509ÜP|46574CB:9qN

4 )H) G 0NL7J;C\8? G ΨαqE ?RA29<; A [2;2NCP

sô7J?RAJ40 G -X45-C7JBJ7J?&2 ≥ ε G 9T910o?RA29Å)A G 7*)q9qP G K G, s

46;2Ne46;2N/4PR?30R7J;C\

wG K17J;]?910R;X46B#046;2N G 5 -C7J?PCOÚ1AC7:PË7J574CBJ7:9qP!?RAX46?V?RA29109 9,ML7:PR?PV4/PRQ-2P9<? S G K`?RA29 G

YP G K40 G 4 G 0R?R7 G ; ≥ ε/2PRQ=)A ?RAX46?[K G 0846;;2 G ∈ S E 46BJ\ G 0R7J?RAC5 A PRQ=)H)q9q9qNCP[ô7J?RA40 G -X45-C7JBJ7J?&2 ≥ ε/2 G 9T910[?RA29A)A G 7*)q9qP G K s E e46;2NwO´ G 046;;2 G ∈ S Â

Prs,e,w

[A(y, w) = s] ≥ ε/2,ôA29109

y = Gs + e.

Ã;I7J;4CQC?t = b + e E 46BJ\ G 0R7J?RAC5 A′ ^ G 0RS-P 4YPoK G BJB G ^$PCÂX7J?P46574CB:9qP s ∈ Zn PQ=)Aß?RAX46?7J?H7:PHQC;C7³K G 0R58B82

NL7:PR?30R78-CQC?9qN85 G NLQCB G q 7J?6) G 574CQC?9qP t′ = t+As E ôAC7*)A 7:P G K?RA29`K G 0R5 t′ = Gs′+qk+e E ôA29109 k ∈ Zm 7J?c)_46BJB:P A G ; t′ mod q46;2NJ[2;2NCP

s′Vô7J?RA·40 G -X45-C7JBJ7J?&2 ≥ ε/2

\ 7J?o?RA29<;·) G 574CQC?9qP e′ = t′ − Gs′ mod q46;2N°09<?RQ0R;2Pt − e′ O´=@Q44 G P9[?RAX46? A PRQ=)H)q9q9qNCP E 7.O9O E ^98AX4C9T9 s = s′ OsU1A29<; e′ = e mod q

O PR7J;C\0?RA29PR?46;2N2450Nã?467JB6- G QC;2N G ;?RA29U) G ;@?R7J;]Q G Q2PÖË46Q2PP7×46;ð46;2N?RA298Q44s910N- G QC;2N G ; α

^`9 G -C?467J;ã?RAX46?!ô7J?RA40 G -X45-C7JBJ7J?&2 ≥ 1− exp(−π/(2α)2) = 1− 2−Ω(n) E ^9AX4H9T9 ‖e‖∞ < q/2

O¸9?RA@Q2PÀX4H9T9Pre[e

′ = e|s′ =s] ≥ 1 − 2−Ω(n) O ut

¸9Ì; G ^ñPRA G ^ ?RAX46?o46;/46BJ\ G 0R7J?RAC5 P G B89-7J;C\ CVPναq

)_46;J-9Q2P9qNÜ? G P G B89T9Ë4f]]QX46;@?R78e_9qNJ9T910PR7 G ; G K´?RA29B×46?R?910COU1AC7:Pf]@QX46;]?R78e46?R7 G ;7:Pf09H]@QC7809qNãK G 0!?RA29I]@QX46;]?RQC5¾4X450R? G K G Q0g09qNLQ=)<?R7 G ;xOU1A29Ü7J;]?RQC7J?R7 G ; G K$?RA2940 G-G K7:P`?RAX46?o?RA29 NL7:P)109<?R78e46?R7 G ;ÿ\0R7:N07:P1P G [2;297V?RA29Å4X450465 9<?910 R

)_46;À)A G P9<;ÿ9,M-?309<5 9<B82ÜB×450R\T9s\?RAX46?H46??RA29ËB:919T9 0

¶ É¶ Én ÒU,É,ÎÉ¶ ¬¬8¶µ

L,Ì¯QÌ¶ A 1Î¬5,

CVPνs

'HÎ L QÌ;QÉQÒU T = 2o(n) ¶É QQÌIÐ3Î>"3¶>"1¬®Q« ε = 2−o(n)

Ì,ÉWQÌ,&% ,QA¶ É R b ÌÎ5H="1Q ¬8,ÉÊQÌ^ÐÎ ¬®« ÉÎ ÒFµ¶ ¬©QÉ T, n, log s¶ÉPQÌ="1Q MsAÎO'JQÌ7Ê51É"3¶5, /Î&'

L ¶ É°¶ É:¶ ¬ ÊÎ ,QQÌÒ A′ QÌ¶c1Î¬5, CVPD LR

,s QÌIÐ3Î>"3¶>",Q¬®Q« ≥ ε − 2−Ω(n) ¶ É QQÌÉ:¶

QÒ<ÐÎ ¬®« ÉÎ ÒFµ¶ ¬Élog R

@@

>1?¸?RAC7:P64 G 7J;@? E ^9HAX4H9T9H46; R G KÚPRQ-s9,M4 G ;29<;]?R7×46B=-C7J?K+nB:9<;C\?RA046;2Nï4 PRQ-s9,M4 G ;29<;]?R7×46B"?R7J5 9H46BJ\ G 0R7J?RAC5 B?RAX46? P G B89T9qP CVPD L(G)R

,αq

E K G 0846;2 G7J; 4>PQ-2P9<? S ⊆ Zm×n

qG K¥40 G 4 G 0R?R7 G ; ≥ ε/2 E ô7J?RA:40 G -X45-C7JBZ+

7J?&2 ≥ ε/2 − 2−Ω(n) G 9T910?RA29046;2N G 5¾)A G 7*)q9qP G K e46;2Nð?RA29 7J;@?910R;X46B<046;2N G 58;29qPP w

Ox¸9Ü7J574CB:9<5 9<;]?46BJ\ G 0R7J?RAC5 B ]]QX46;@?RQC58B82/4YP`K G BJB G ^$PsÂC?RA29^]]QX46;@?RQC5 46BJ\ G 0R7J?RAC5 BQ

5ï4542P$?RA29ËPR?46?9 |b〉 |b + e〉 |w〉 ? G ?RA29PR?46?9 |b − B(b + e, w)〉 |b + e〉 |w〉 O

[xñ ð v ûù:_÷ûzüCù>/H1a/5ùüCúüs÷4ûi47weq/ùrù>zZýxô'ú=ûzüsôÿ/5ù;øjô'õüs÷4zû¸9a[=0P?#09H)_46BJB F 9<\T919YP#]@QX46;]?RQC5Æ09qNLQ=)<?R7 G ;°E E (´9<585ï4gO8@1 G&O?ØQ2P9qP`46; G 04 )<B:9?RAX46?P G B89T9qP CVP G ;04\789T9<;ÞB×46?R?R7*)q9

L4YPB G ;C\[4YP`?RA29?450R\T9<?©9T9H)<? G 017:Pô7J?RAC7J;ÿ4L409qP)10R78-s9qNÞNL7:PR?46;=)q9 d < λ1(L)

2G K L O?#09<?RQ0R;2P4[P46574CB:9 K0 G 5 ?RA29ËNL7:PR?30R78-CQC?R7 G ; D

bL,√

n√2d

O

@O=-9<?R? G -984ÜB×450R\T97) G ;2PR?46;]?46;2N·-CQC7JB:N4J]@QX46;]?RQC5P?46?9ôAC7*)A7:P ô7J?RAC7J;

`2NL7:P?46;=)q9

2−Ω(n) G K?RA29Ë; G 0R5ï46BJ78e_9qNIPR?46?9^) G 0309qP34 G ;2NL7J;C\ï? G ∑

x∈LR

,‖x‖<d ρ d√n

(x) |x,x mod L〉 OO PR7J;C\ ?RA29 CVP G 04 )<B:9 E 09<5 G 9T9ã?RA29ð9<;]?46;C\B:9<5 9<;@? ? G G -C?467J; 4ÝPR?46?9ãôAC7*)A 7:Pÿô7J?RAC7J; `2

NL7:PK+?46;=)q9

2−Ω(n) G K?RA29Ë; G 0R5ï46BJ78e_9qNIPR?46?9^) G 0309qP34 G ;2NL7J;C\ï? G ∑x∈L

R,‖x‖<d ρ d√

n

(x) |x mod L〉 OO>¥44CB82!?RA29a]@QX46;]?RQC5´ G Q0R7:910¸?3046;2PiK G 0R5 G 9T910 Zn

R

? GËG -C?467J;ï4 P?46?9?RAX46?7:Pô7J?RAC7J; `2NL7:PR?46;=)q9

2−Ω(n)

G K?RA29Ë; G 0R5ï46BJ78e_9qNßP?46?9^) G 0309qP34 G ;2NL7J;C\Ü? G ∑x∈bL,‖x‖< n

d

ρ√n

d

(x)∣∣∣x mod (R · L)

⟩ O=O¨ 9_4YPRQ09?RA29[B×46?R?910 ? GÞG -C?467J;ã4/9T9H)<? G 0 b mod R · L O PR7J;C\A×o45-X467.YPV46BJ\ G 0R7J?RAC5 E¿G E 09H) G 9T910 b

46;2NG QC?34CQC?$7J?CO~?P$NL7:P?30R78-CQC?R7 G ;ÿ7:Poô7J?RAC7J;ßPR?46?R7:P?R7*)_46BNL7:PR?46;=)q9 2−Ω(n) G K D

bL,√

n√2d

O

´W780PR? E¸G ;29IPRA G QCB:N; G ?R7*)q9ß?RAX46? F 9<\T919YP CVP G 04 )<B:9ß7J;±EGH7:P 7J;ÝKM4 )<?Ü4P046;2N G 5878e_9qN 46BJ\ G 0R7J?RAC5 EP G 46?=@?914Þ?RA29U]]QX46;@?RQC5 G 04 )<B:987:P!46B:P G \789T9<; 40PR?30R7J;C\ |w〉 G K046;2N G 5d]@Q-C7J?PCOÚU1A29 G 04 )<B:9 PRQ=)H)q9q9qNCPô7J?RAÔ40 G -X45-C7JBJ7J?2 ?RAX46?ß7:Pÿ9,M4 G ;29<;]?R7×46BJB82)? G 1

V G 9T910ÿ?RA29S)A G 7*)q9 G K w\,OĆQ0R?RA2910R5 G 09 EG ;29P)_46;

; G ?R7*)q9?RAX46? F 9<\T919zYPÌ46BJ\ G 0R7J?RAC5 N G 9qP; G ?c09H]@QC78094 ^ G 0PR?K+&)_4YP9 CVPP G B89T910CÂ"7J?PQTU)q9qP?RAX46??RA29 G 04 )<B:9

P G B89T9qP CVPD LR

, d√2n

O´7J;X46BJB82 E ^`9 PA G ^ -9<B G ^ ?RAX46?Ü?RA29CVPD L

R, d√

2n

P G B89T910ÞN G 9qPÞ; G ?Þ919T9<; ;29q9qN ? GPRQ=)H)q9q9qN/ô7J?RA G 9T910RôA29<BJ587J;C\I40 G -X45-C7JBJ7J?&2 E -CQC? G ;CB82Þô7J?RAß; G ;+n;29<\BJ7J\78-CB:9L40 G -X45-C7JBJ7J?&2Oþ ùÿ¯ÿ¯ú[xññ ;sÐÐÎ5CgQÌ¶ g¶ 3ÅÊ51ÉP¶É n ÒU,É=µÎ É¶ ¬¬8¶µµq L ¶LÐ¶ 3¶ ÒU1&, R > 22nλn(L) ¶Ð¶ 3¶ ÒU1&,

s < λ1(L)

2√

2n

¶ ÉzÀ¶gÐ3Î>"3¶",¬®,µ/Î 3¶1¬*UQÌ¶1Î¬5,CVPD L

R,s QÌ7Ð3Î>"3¶",¬®« ε = 2−o(n) 3$ '

Î Éz73Ð¬Z¶;qUQÌ Î , q¶5H CVP1Î ¬V5,",«¬Z¶µ&1cÐzKÎ>"¶>",Q¬ ,µ/ÎK¶H¬8 QÌ,ÉcµÊ; P U¶ ¬ ÊÎ ,QQÌ;Ò ?m QQÌÐ¶ 3¶ ÒU1&,

d =√

2ns @ Î ÐQ^¶53C.Î b ∈ L ÌÎ5HN 1#",ÎÉ QÌ;QÉ· ,.¶ É 1− ε2/2 + O(ε4)ÎO'DbL, 1

2s

k$ E É=qÌ,ÅQÉ°ÒU<ÐÎ ¬®«5ÉzÎ ÒF¶ ¬QÉ log R 3ÎCÎO' ¸9R?Q2PR?VP|4q^ ?RAX46?V7³K`?RA29 CVPD L

R,sG 04 )<B:98^`4YPPRQ=)H)q9q9qNL7J;C\ÿô7J?RAP40 G -X45-C7JBJ7J?&2 1 − 2−Ω(n) E ?RA29<;

?RA29 G QC?34CQC?©9T9H)<? G 0 b^ G QCB:N8K G BJB G ^ 4ËNL7:PR?30R78-CQC?R7 G ;ÞôA G P9$PR?46?R7:P?R7*)_46B"NL7:PR?46;=)q9o? G DbL, 1

2s

^ G QCB:N-s9 2−Ω(n) OU G ^ G 0RS 450 G QC;2Nð?RA29U09H]]QC7809<5 9<;@?8?RAX46?!?RA29 G 04 )<B:9ÜPQ=)H)q9q9qNCPô7J?RA G 9T910RôA29<BJ587J;C\P40 G -X45-C7JBJ7J?2 E ^9ÜQ2P9?RA29Ü; G ?R7 G ; G K$?304 )q9ÞNL7:PR?46;=)q9/-9<?^9q9<; ?~^ G ]@QX46;]?RQC5PR?46?9qP E ôAC7*)A 7:P[46; 4YN2454C?46?R7 G ; G K$?RA29ÞPR?46?R7:PR?R7Z+)_46BNL7:PR?46;=)q9AVP9q9JED E ÇAxOBGQ\,OsU1A29?304 )q98NL7:PR?46;=)q9g-s9<?~^9q9<;ã?~^ G VQ4CQ09s\¥]@QX46;]?RQC5PR?46?9qP |t1〉

46;2N |t2〉7:Pδ(|t1〉 , |t2〉) =

√1 − | 〈t1|t2〉 |2

O?P$5 G PR?7J574 G 0R?46;@?R40 G 4s910R?&2/7:P?RAX46?$K G 0Ì46;2/\T9<;291046BJ78e_9qN 5 9_4YPRQ09,+5 9<;]?VbÃ<`Å¨°\ E 7³K D1

VQ09qP34xOD2\Ë7:P?RA29I09qPRQCBJ?R7J;C\°40 G -X45-C7JBJ7J?&2 NL7:PR?30R78-CQC?R7 G ;ôA29<;PR?450R?R7J;C\>K0 G 5 |t1〉VQ09qP34xO |t2〉

\$?RA29<;∆(D1, D2) ≤ δ(|t1〉 , |t2〉)

Oz G ^ E 7³K^9F)_46BJB |t1〉?RA29!7:NC9_46BPR?46?9[46? ?RA299<;2N G K1=@?914S

G K F 9<\T919YPH46BJ\ G 0R7J?RAC5 E 46;2Nß7³K |t2〉7:Po?RA29VP?46?9Ë?RAX46?H^`9 G -C?467J;-2ÞQ2P7J;C\ G Q0$7J574s910iK9H)<? G 04 )<B:9 E ?RA29<;ÿ^`9

@C

AX4H9T9 | 〈t1|t2〉 | ≥ ε − 2−Ω(n) OU1A29109K G 09 E ^`9ïAX4C9T9Þ?RAX46??RA29 G QC?34CQC?[NL7:P?30R78-CQC?R7 G ;ð7:Pô7J?RAC7J; P?46?R7:PR?R7*)_46BNL7:PR?46;=)q9 √

1 − ε2 + 2−Ω(n) G K DbL, 12s

O utU G 40 G 9T9U1A29 G 09<5Ä=O8@ E ^9[4544CB82A(´9<585ï4U=O8? G ?RA29!B×46?R?R7*)q9qP L(G)

K G 0 G ∈ S E ô7J?RA 46BJ\ G 0R7J?RAC5 B O´ G 0Ë?RAX46? E ^`9[;29q9qN>? G 9<;2PQ09[?RAX46?Ì?RA29[A24 G ?RA29qPR7:P αq < λ1(L(G))

2√

2m

7:P P46?R7:PK[X9qNO´=0 G 5_(´9<585ï4ÀO SVM46;2N(´9<585ï4·O/7J;?RA29)_4YP9 G K Ideal-LWE

\ E ^9ïS@; G ^ ?RAX46?Vô7J?RA40 G -X45-C7JBJ7J?&2 1 − 2−Ω(n) G 9T910!?RA29)A G 7*)q9G K G

7J;Zm×n

qE ^`9/AX4H9T9 λ∞

1 (L(G)) ≥ q4

O!¸9À) G ;2PR7:NC910 ?RA29IP9<? S ′ G K ?RA29 GYP 7J; S K G 08ôAC7*)A(?RAX46?

) G ;2NL7J?R7 G ; 7:P[P46?R7:PK[X9qNOWU1A29ÜP9<? S ′ 091409qP9<;]?P 440 G 4 G 0R?R7 G ; ≥ ε/2 − 2−Ω(n) G K Zm×nq

O=@Q44 G P9ï; G ^?RAX46?

G ∈ S ′ O5(9<585ï4Å=O PRA G ^$P?RAX46?^`9a)_46;F[2;2N 4R9T9H)<? G 0 s ∈ G⊥ = qL(G)?RAX46?K G BJB G ^$PØ4ÌNL7:PR?30R78-CQC?R7 G ;

ôA G P98NL7:PR?46;=)q9 ? G DG⊥, 12α

7:P1 − ε2/8 + O(ε4)

OÚU1AX46;CSLPË? G (´9<585ï4YPfO8@ 46;2NSOPVP7J;=)q9 G ∈ S ′ E ^`9AX4H9T9 1

2α ≥ η2−n(G⊥)\ E ^9 AX4H9T9 ?RAX46?oô7J?RAJ40 G -X45-C7JBJ7J?2 1− 2−Ω(n) ?RA29¥09<?RQ0R;29qN s

7:P$4; G ;+.e_910 G 9T9H)<? G 0G K G⊥ ôA G P9 ; G 0R5 7:P ≤

√n

2α

O

/czj6xìx;èkj*#%$j`jî&%$è%&'#ç¸9 ; G ^Q2P9Ì?RA29Å09qPRQCBJ?P G K=-9H)<?R7 G ;2P¥846;2NJ8? G ) G ;2PR?30RQ=)<?$9,TU)<7:9<;]?R)10324C? G \0454CAC7*)^40R7J587J?R789T9qPc-X4YP9qN G ;7:NC9_46B2B×46?R?R7*)q9qPCO]U1AC7:P¸7J;=)<BJQ2NC9qP¸?RA29a[=0PR?B×46?R?R7*)q9,+.-X4YP9qN4CQ-CBJ7*),+nST912 9<;=)10324C?R7 G ;ïP)A29<5 9$ô7J?RAÜ4YP2@574C? G ?R7*)_46BJB82G 4C?R7J5ï46B19<;=)10324C?R7 G ;Ý46;2N NC9H)10324C?R7 G ;) G 574CQC?46?R7 G ;:) G PR?P G K O(1)

-C7J? G 491046?R7 G ;2Pg4s910!5 9qPP46\T9U-C7J? E 4YP^9<BJBW4YPo?30454N G-G 0HPR7J\;X46?RQ09qPÌ46;2NÀ3c+.-X4YP9qN07:NC9<;]?R7Z[)_46?R7 G ;>P)A29<5 9qPCO

^ñò óbõ÷ùûzü~1ôa6jöQ÷Qõtù:sùûõ:/5s1'üs÷4û³ýCõ S ùÿSùÃQ04CQ-CBJ7*)/ST912 9<;=)10324C?R7 G ;(P)A29<5 9/7:PU) G ;2PR?30RQ=)<?9qNÝ7J;Ý?~^ G PR?9142PCO!´W780PR? E ^`9/Q2P9/?RA29(¸¹â 5ï4544C7J;C\(s, e) → G · s + e mod q

4YP46;7J; ?R9H)<?R789T9 ?30454sN G@G 0 G ;29,+n^`4H2>KQC;=)<?R7 G ; E ô7J?RAð?RA298?30454sN G@G 0L-s9<7J;C\ÿ?RA29KQCBJBZ+~NL7J5 9<;2PR7 G ;X46B"P9<? G K9T9H)<? G 0P¸7J; G⊥ KQ0 G 5=-9H)<?R7 G ;J E 46;2N8?RA29 G ;29,+n^`4C2@;29qPP©-s9<7J;C\4YPAX450N 4YP Ideal-SISVM46;2NÜA29<;=)q9

Ideal-SVP\6-;2ÜU1A29 G 09<5Æ=O8@O-U1AC7:P`?30454N G-G 0KQC;=)<?R7 G ;Þ7:P`46;09,TU)<7:9<;]?o7:NC9_46BB×46?R?R7*)q9 46;X46B G \Q29

G KP G 5 9Ë?30454sN G@G 0oKQC;=)<?R7 G ;2P409qP9<;]?9qNÿ7J;E8@C E BGK G 0H4503-C7J?3045032/B×46?R?R7*)q9qPCO=;/?RA29VP9H) G ;2NÿPR?914 E ^94544CB82?RA29IÖ G B:N09<7*)A+&(´919-7J;AX450N¯) G 09ïKQC;=)<?R7 G ;-X4YP9qN G ;ðU G 914CBJ7J?3eÞ5ï46?30R7*)q9qPIE8@C E =-9H)OOG`? GßG Q0?30454N G-G 0KQC;=)<?R7 G ; E 46;2NÞZ¥Ã F ?RA29Ì5 9qPP46\T9ô7J?RA0?RA29HAX450NJ) G 09R-C7J?P`? G[G -C?467J;/4P9<5ï46;@?R7*)_46BJB82ÞP9H)<Q09 9<;=)10324C?R7 G ;xO

ÃQ0Ë?30454sN G@G 0ÌKQC;=)<?R7 G ;>KM46587JB82 Id − Trap7:PËNC9,[2;29qN>7J;P´7J\Q09A@O´ G 0VP9H)<Q0R7J?&2X4X450465 9<?910 n = 2k E

^9U[Mf(x) = xn + 1

46;2Nq = O(Poly(n))

4À40R7J5 9ÞP46?R7:PiK2@7J;C\q ≡ 3 mod 8

O´=0 G 5¾(´9<585ï4°O E 7J?K G BJB G ^$P[?RAX46? f

P34CBJ7J?P5 G NLQCB G q7J;]? G 9,M24 )<?RB82?~^ G 780309qNLQ=)<78-CB:9ÞKn4 )<? G 0P G KHNC9<\09q9 n/2

O¸90P9<?σ = 1 E

r = 1 + log3 q = O(1)46;2N

m = (dlog qe + 1)σ + r = O(1)Oj¸90B:9<? R NC9<; G ?9/?RA29I0R7J;C\ Zq[x]/f

OU1A29ïK G BJB G ô7J;C\IB:9<585ï4VôA G P9/40 G@G K$7:P7J; 4544s9<;2NL7ZM=\!9<;2PRQ09qP?RA29U) G 0309H)<?R;29qPP G K$?RA29ÞP)A29<5 9XV?RAC7:P7:P9qPP9<;@?R7×46BJB82ï7:NC9<;@?R7*)_46BÚ? G EB E =-9H)O=O8@,GQ\`46;2N/4YPP910R?P`?RAX46??RA29 91946BJQX46?R7 G ;ß46;2NÞ7J;;9T910PR7 G ;ÞKQC;=)<?R7 G ;2Pa)_46;I-s97J574CB:9<5 9<;]?9qN 9,TU)<7:9<;]?RB82O

þ ùÿ¯ÿ¯ú^ñòñ È'Hq > 2

√mnL

¶ Ézα < 1

ω(√

log n)L Ì,Éb'1Î a¶ É=« s ∈ R ¶Éz'HÎ

e1¶ÒcÐz¬83!'3Î Ò

Ψαq QÌRQÉ51q,Î ÉÀ¶ ¬ ÊÎ ,QÌ;Ò 33qÎ5,(s, e) QQÌRÐ3Î>"3¶",¬®« 1−n−ω(1) Îc5,ÅQÌ^,ÌÎqNÎO' e ,QÌ1ÒÎ QÌF¶¬ ¶µÎ ÉS¶ ÉUÉ ,q,ÎÉ°¶ ¬ ÊÎ ,QÌ;Òg!'1Î

hg

q¶ É"NÒ¥Ð¬*,ÒU,É&3 QÌI,É QÒU O(n) U1A29 G ;29,+n^`4C2@;29qPP G K Id − Trap

7:P9H]]QC78946B:9<;]?? G LWEm,q,Ψαq

O'ĆQ0R?RA2910R5 G 09 E 46; 7J;2PR?46;=)q9 (G,y =

Gs+e mod q) G K LWEm,q,Ψαq

)_46;F-s9`9,TU)<7:9<;@?RB82g) G ;9T910R?9qNF-;2f0 G QC;2NL7J;C\Ë? G 46;[7J;2PR?46;=)q9 G K LWEm,q,Ψαq

E;X465 9<B82

(G, dyc) = (G,Gs + dec mod q)OCU1AC7:P40 G 9T9qPR(´9<585ï4OO

@C

x ó@ó ÑÒ6ÐRü ; Ò¢¡ú ÓÐiü ö!õ üåÐ ÐiÑÒ ÷ öTö ÑqÔ cwp¸lnvwgjzµr|knxlnvwm>tåknrm>Àsv6girkngim£_º|wMxzp6µ f = xn+1, n, q, r, σ jpY mj|xzp6h6lnid_6hwhrMgxlWMwyiyigigiwiYÂ×lµxz<gij`<giylnr|k g ∈ (Zq [x]/f)m ³t³wp6ylnxzrpËxzp6wgá6sj|p6 j`lMk~j|hTrqr|kt³w¶:k~j|pwÁMgl Sr|t@zxpwgRjknoxzp6wgihgip6wgipqlX<giylnr|knxzp rotf (g)⊥ ⊆ Zmn×mnq

Ù´xzlnv ‖S‖ ≤ 2p

(9r + σ) ·√n =: L ³ÙsgvYjR<g L = eO(√

n) ¥¤ ú Ó|ÐRü öÿós ÒYû³ú@Ò6ÐRü ö Ô éWxz<gipËt³wp6ylnxzr|pxzpYgá g ÙgowgÛ6p6g¸lnv6g¸lMk~j|hTrqr|kt³wp6ylnxzr|p hg : Znq × Zmn

qjt³r|zrRÙí2èWp

xzp6h6l s wp6xt³rknmozÌk~j|pYrm(xp Znqj|p6 e ∈ Zmn

qnj|mohwgiËtknrm Ψαq

:wgÛ6p6gRVj Ψαqjtålngkknr6p6wxzp6µolnr$lnv6gyizrMgil

xzp_lngµgk<giylnr|kÙsgyir|moh6wlngWj|p6knglnwknp]æ

c = hg(s, e) := rotf (g) · s + e mod q.

¥¤ ú Ó|ÐRü ö ü ó ÑÏRü ö Ô éWxz<gp c = hg(s, e) jpY lMk~j|hTrqr|k S Yyirmohwwlng d = ST · c mod q jpY e′ = S−T · d Jxzp Q armohwwlng u = c − e′ mod q j|p6 s′ = (rotf (g1))−1 · u1 mod q YÙ´v6gkng u1

yir|p6Mxzlnr|t2lnvwg¸Ûwknl n yirqr|k~xp6jlngiWr|t u cglnwknp (s′, e′)

¤ ü Ô¦YÔ Àsv6glMk~jhTwrqrktå6pwylnxzrpt³j|moxz Id − Trap

þ ùÿ¯ÿ¯ú^ñ ðñ ;sÐÐÎ5CFQÌ¶<QÌ13/&% ,Qg¶ É¯¶µ.¶G ,7¶CÊ¶É1<QÌFÎ Éz I ¶ « ÉzFÎO' Id − Trap ?m QQÌgÐ¶ 3¶ ÒU1&,m,α, q @ QQÌÉ QÒU T

¶É°,qgÐ3Î>"3¶>"1¬®Q«ε Ì,É³QÌ13X&% ,QÀ¶ ÉW¶ ¬ ÊÎ ,QÌ;Ò QÌ¶

1Î¬5,LWEm,q;Ψαq QÌI,É QÒ T

¶ ÉqaÐ3Î>"3¶>",Q¬®Q«ε

×2°) G 5N-C7J;C7J;C\ G Q0!?30454N G-G 0ËKQC;=)<?R7 G ;ô7J?RA?RA29UÖÅ( AX450NS) G 09KQC;=)<?R7 G ;WE8@C E =-9H)O'OGØ^`98\T9<?Ë?RA299<;=)10324C?R7 G ;>Pq)A29<5 9 G K#´W7J\Q09gOU1A29[P9<5ï46;]?R7*)[P9H)<Q0R7J?2V7J;I?RA29P9<;2P9 G K#º3¥+ºÇbz>Å\oK G BJB G ^$PÌKQ0 G 5 ?RA29G ;29,+n^`4C2@;29qPP G K Id − Trap

V7.O9O E KQ0 G 5 ?RA29ÀX450NL;29qPP G K Ideal-LWE\46;2NK0 G 5 ?RA29aÖ^(0AX450N7) G 09ØKQC;=)<?R7 G ;xO

òÌó_ô7Yó@ó ÑÒ6ÐRü ö Ô 6r|k´Mgyiwknxl$h6jk~jmoglngk n _kn6p$lnv6gÁ<g$µgp6gk~jlnxr|p jµ|r|knxlnv6mrt Id − Trap lnr`µ|glj|pHxzpYwgá g t³rkhg : Zn

q × (Zq)nm j|p6ojlMk~j|hTwrqrk S <gyij|po_xzgÙÞlnvwgrm$jxport hg

jsjMwÖ6Mglr|t Zì

2tår|k ì = O((n+1)m log q) =

eO(n) YÀsvwgh66ÖwzxyWÁ<gHxz g jpY$lnv6gMgiyknglWÁg$xz S þj Ó|Ñ ô ÐRü ö Ô éWxz<gip `m¶×Ö6xlmogiMnj|µ|g m j|p6 hw6Öwxzy$Á<g g 2nj|mohwg (s, e) Ù´xlnv s 6pwxt³r|knm xzp Zn

qjpY e nj|moh6zgR

tåknr|m Ψαq2jpY[gi|j|z6jlng c1 = hg(s, e) CéWgip6gk~jlngÌjËwp6xt³rknmozk~j|p6wrm <gylnr|k r ∈ Z`m+ì

2Xar|moh6wlng c2 = m ⊕

(MGL · (s, e)) qÙ´vwgknglnvwghknr_wwyl MGL · (s, e) xzÚyirmohwwlngR1r<gk Z2j|p6 (s, e) xzs_xzgÙgRjÚj¸lMknxpwµr<gk Zì

2Àsvwg

éë[m$jlMknxá MGL ∈ Z`m×ì

2xzÀ-rqgh6zxlnç³lnv_6jzrRÙ´xzp6µ$tJjlWm6lnxzh6zxzyRjlnxzrp§ |X¨åWj|p6Ìxln i lnv knrRÙ>xz [ri, . . . , rì+i−1]

cglnwknplnvwgyixzh6vwgkMlngá_l (c1, c2, r) ¥© ó ÓÑ ô ÐRü ö Ô éWxz<gipVyixzh6vwgkMlngá_l (c1, c2, r) j|p6 MgiyknglÁg S Txzp_<gkMl c1

lnrHyrmoh6lng (s, e) M6y~v lnvYjl hg(s, e) = c1

j|p6Hknglnknp m = c2 ⊕ (MGL · (s, e))

¤ ü Ô«ª]Ô ÀsvwgMgim$j|pqlnxzyRj|zMgiyiwknggp6ykMhwlnxzr|pÌMy~v6gimog Id − Enc

R(S ù>47/ùÿ¬^ñQòñ ;CÐ;ÐÎ5H^QÌ¶!QÌ,NX% 1QÅ¶ É $&b® ¯ ) ¶µ.¶G ,L¶CÊ¶ QÉ1Id − Enc

É=É=QÉÊgQÉÀÒUT¶ ÉÌ¶cCÉÊ·qNÐ3Î>"3¶",¬®«

1/2 + ε U Ì,É:QÌ,À&% 1QI¶ Éª¶ ¬ ÊÎ ,QQÌ;Ò°'HÎ Ideal-LWEf

m,q;Ψαq QÌ,É ÒU T ′ = O(23`mn3ε−3 · T )

¶É7,qqqcÐ3Î>"3¶>",Q¬®Q«ε′ = Ω(2−`mn−1 · ε)

3ÎCÎO' U1A29\789T9<;ºÌ3c+ºÇbz>(46?R?4 )ST9106)_46;F-9<) G ;;9T910R?9qN ? G 4ÅÖÅ(0AX450N7) G 09KQC;=)<?R7 G ;[NL7:P?R7J;C\QC7:PRA2910?RAX46? E\789T9<;

c1 = hg(s, e) E MGLE 46;2N `m

-C7J?oPR?30R7J;C\z E K G 0 s

P46574CB:9qNÞQC;C7³K G 0R58B82Þ7J; ZnqE e P46574CB:9qNÜKQ0 G 5 Ψαq

E46;2N

MGL) G ;2PR?30RQ=)<?9qNñ4YPÜ7J;(?RA29IST912\T9<;291046?R7 G ;40 G )q9qNLQ09 E NL7:PR?R7J;C\QC7:PA29qP0ôA29<?RA2910 z

7:PïQC;C7³K G 0R58B82046;2N G 5ÄV7J;2NC914s9<;2NC9<;]? G K s 46;2N e

\ G 0 z = MGL · (s, e)O~?AX4YP#0RQC;+n?R7J5 9

T46;2NÞ4YN9Y46;@?46\T9

εO]U1A2909qPRQCBJ?

K G BJB G ^$Pf-;2ã4544CB82-7J;C\I? G ?RA298KQC;=)<?R7 G ; hg

?RA29U(9<585ï4·OO¿ E b!0 G 4 G PR7J?R7 G ;OO½¼ß46;2N¯b!0 G 4 G PR7J?R7 G ;:OO7J;SE8@CG&O ut

×2ÞQ2PR7J;C\U(´9<585ï4O8@46;2NÿU1A29 G 09<5 P¥O8@ E =O8@ E 46;2N·O8@ E ^9Ë\T9<? G Q0o5ï467J;À09qPRQCBJ?CO

@1

± 4/H4ööQú0/5s^ñòñ ;sÐÐÎ5CQÌ¶zQÌ,&% ,Q©¶ É $&b® ¯ ) ¶µ.¶G ,a¶CÊ¶É1QÌ1É1,«qÐÎ ÉgH,Ì,ÒU Id − Enc

QÌ³ÒUqH¶CÊ;S¬8,ÉÊQÌ `m = n/ log n = o(n) ,ÉÉ=ÉÊÉÜÒU 2o(n) ¶ ÉÌ¶CQÉÊ,qqqJÐzKÎ>"¶>",Q¬ «1/2 + 2−o(n) ~ Ì,ÉQÌ,S&% ,Q·¶Ñ1¶ ÉÒÕ¶¬ ÊÎQÌ;Ò|'HÎ

O(n2) Ideal-SVP QQÌ f = xn + 1¶ Én = 2k $ aÌ¶5F,É ÒU 2o(n) ¶ÉÎ , Ì,¬ ÒFQÉÊq^Ð3Î>"3¶>"1¬®Q« 1QÌ,,ÒÎ QÌ71,Ì,ÒU

Id − EncÌ¶5À1É1,«qÐÎ É¹¶ ÉS;1«ÐzµÎ ÉÎ5,Q

O(1)",NÎÐ,3¶µÎ ÉfÐ,,ÉH«Ðz&3¯ÒUqH¶CÊ;_",Q ¶ ÉG ,«5fÎO'

O(n)",Q

^ñ ð R /5ú016øa4]47/ýs÷rûúüsôa/ù·ýCõ S ùÿ¯ùÖ 9<;@?3032/1 ¶¬ E8@CG-PA G ^9qNA G ^ã? G NC910R789T914a40 G -X45-C7JBJ7:P?R7*)¸KQCBJB@N G 5ï467J;AX4YPRA!?30454sN G@G 0WPR7J\;X46?RQ09) G ;2PR?30RQ=),+?R7 G ; PFDHS

ô7J?RAßST9120\T9<;291046?R7 G ; E PR7J\;C7J;C\Ü46;2N9T910R7Z[)_46?R7 G ;>46BJ\ G 0R7J?RAC5 P E KQ0 G 5 46;;2ÿUx0454sN G-G 0ÅÇ G BJBJ7:PR7 G ;F 9qP7:PR?46;]?N» 4YPRAS´X46587JB82>ô7J?RAb!09<7J5ï46\T9Þ=L46574CBJ7J;C\VUcÇ F b=\,O~;LK G 0R5ï46BJB82 E 40UcÇ F b`= fa

7:P!4À) G BJBJ7:PR7 G ;09qPR7:PR?46;@?$KQC;=)<?R7 G ;V²Kn46587JB82=\`K G 0$ôAC7*)A ?RA29109V7:P 4ÀVP9H)109<?\o?30454N G-G 0 t

?RAX46?Ì46BJB G ^$PH? G 9,TU)<7:9<;]?RB82ßP|46574CB:94Q 046;2N G 5ÀY409<7J5ï46\T9ÜQC;2NC910 fa

G K4/\789T9<; ?450R\T9<? yOU1A29Ü?30454sN G@G 0 t

7:PV?RA29ÞPR7J\;2910CYPP9H)109<?ST912 E 46;2N?RA29[PR7J\;X46?RQ09 G ;>4Ü5 9qPP|46\T9 m

AX4YP?RA29K G 0R5 (f−1a (H(m, r)), r) E K G 0Ë4 AX4YPRA KQC;=)<?R7 G ; H

46;2N·046;2N G 5QzP46BJ?CYrO=?o7:PHPRA G ô;ß7J;¯E8@CGA G ^? G 4910iK G 0R5¹PRQ=)A409<7J5ï46\T9!P|46574CBJ7J;C\ K G 0$?RA29 KQC;=)<?R7 G ; fG(x) = xT G EôA29109G ∈ Zm×n

qE Q2PR7J;C\04 ?30454N G-G 0c-X4YP7:P G K G⊥ ô7J?RA PR5ï46BJB!ÖV=Ã ; G 0R5ÀO×2ÿ4544CB82@7J;C\Þ?RAC7:P¥409<7J5ï46\T9

P46574CBJ7J;C\Ü46BJ\ G 0R7J?RAC5¹? G 4P?30RQ=)<?RQ09qN G = rotf (g)46;2N0Q2PR7J;C\8?RA29 ?30454sN G@G 0o\T9<;291046?R7 G ; 46BJ\ G 0R7J?RAC5 K0 G 5

=-9H)<?R7 G ; E ^9 G -C?467J;ÿ4UcÇ F b=°VôA G P9R) G BJBJ7:P7 G ;A09qPR7:PR?46;=)q9R09<BJ7:9qP G ; Ideal-SIS46;2NÞA29<;=)q9

Ideal-SVP\

46;2N0?RA]Q2PÌ4[PR?30RQ=)<?RQ09qNA9450R7×46;]? G K?RA29 ?30454sN G@G 0$PR7J\;X46?RQ09!P)A29<5 9 G KaE8@CG E ô7J?RA O(n)9T910R7Z[)_46?R7 G ;ß?R7J5 9

46;2NÿPR7J\;X46?RQ09VB:9<;C\?RAxO=¨ G 09!NC9<?467JB:P$ô7JBJB-s9 \789T9<;ß7J;/?RA29 KQCBJB9T910PR7 G ;xO

^ñ 1øùûzüs÷ütsKt6úýCùø¹÷Qøùûzüs÷9õ;úüs÷4zûªýCõ S ùÿSùý´0 G 5B×46?R?R7*)q9,+.-X4YP9qNÜP7J\;X46?RQ09qP E ^`9HNC910R789T9c3¥+.-X4YP9qN 7:NC9<;@?R7Z[)_46?R7 G ;SV×<3\46;2NU3c+.-X4YP9qNïPR7J\;X46?RQ09gV×$=\P)A29<5 9qP#-X4YP9qN G ;ïB×46?R?R7*)q940 G -CB:9<5 PsO¸9a[=0P? G -2P91039T9$?RAX46??RA29cÏ7*)H)<7×46;=)<7 G +.`Ø4YNLAX46;°V¨·`L\40 G ? G ) G BEGK G 0 O(

√n)+CVP

? G \T9<?RA2910/ô7J?RA ?RA29 B×46?R?R7*)q9,+.-X4YP9qN AX4YPRA KQC;=)<?R7 G ;2PPE8@ E @CBGL2@7:9<B:N) G ;=)<Q0309<;]?RB82 P9H)<Q097:NC9<;]?R7Z[)_46?R7 G ;ÿPq)A29<5 9qPCO×0R7:9,à=2ïP34s9_46S@7J;C\ E 7J;ï?RA29ÌP)A29<5 9qP E ?RA29ÌP9H)109<?ØST912 7:P14VPA G 0R?#9T9H)<? G 0 e ∈ Zm 46;2N?RA29L4CQ-CBJ7*)!ST91207:P4[?RQ4CB:9 G K G ∈ Zm×n

q

46;2Ny = eT G mod q

O2U1A29N4CQ-CBJ7*)VST912/7:P$7J;@?9103409<?9qN-2A- G ?RA?RA29L9T910R7Z[X910 46;2Nÿ?RA29N40 G 9T910Ë4YP4F4X46780 G K¸48B×46?R?R7*)q9 G⊥ 46;2N 479T9H)<? G 0 t

PRQ=)Aß?RAX46?y = tT G mod q

O2U1A2940 G 9T910VPA G ^$P ?RAX46? 7J? AX4YP ?RA29B×46?R?R7*)q9F9T9H)<? G 0 s = t − e ∈ G⊥ O"U1A29AX450NL;29qPP G K SIS

VQ09qP34xOIdeal-SIS

\2-7:9<B:NCPo?RA29L) G ;=)<Q0309<;]?ÌP9H)<Q0R7J?&2O

>¥44CB82@7J;C\Ü?RA29P?46;2N2450NßPR?3046?9<\2 E ^9g) G ;2PR?30RQ=)<?ÌB×46?R?R7*)q9,+.-X4YP9qN·º×<1P)A29<5 9qPË4YPoK G BJB G ^$PsÂ"U1A29!5ï4YPR?910\T9<;291046?9qP 4ßST912¯4X46780 G KÌ4ÿB×46?R?R7*)q9,+.-X4YP9qNPR7J\;X46?RQ090P)A29<5 9 E P4C2 (G,S) âØ4 )AQ2P910 G -C?467J;2PK0 G 5 ?RA295ï4YPR?910!40PRA G 0R?^9T9H)<? G 0 e

PQ=)A ?RAX46?eT G = H(id) E ôA29109 H

7:P!4I046;2N G 5 G 04 )<B:9 U1A29740 G 9T910L40 G 9T9qP? G ?RA29N9T910R7Z[X910?RAX46?A29s6PRA29VAX4YP 4 PA G 0R?c9T9H)<? G 0 e?RA0 G QC\AI?RA29f¨`Ý40 G ? G ) G B.O"U1AC7:PR) G 5N-C7J;X46?R7 G ;°2-7:9<B:NCP

) G ;=)<Q0309<;]?RB82 P9H)<Q097º×<$P)A29<5 9qP^-X4YP9qN G ; O(n2)+SVP

46;2NO(n2)

+Ideal-SVP

7J;>?RA29F046;2N G 5 G 04 )<B:95 G NC9<B.O>ÌPH?RA29g¨·`í40 G ? G ) G B7:PHô7J?R;29qPPH7J;2NL7:PR?R7J;C\QC7:PAX45-CB:9 E ^9g)_46;IQ2P9!?RA29f´W7×46?K+=@AX4658780 A29<Q0R7:PR?R7*)IE8@@,G46;2N G -C?467J;P×$=ßP)A29<5 9qPÅ-X4YP9qN G ; B×46?R?R7*)q9F40 G -CB:9<5 PCOsU1A29NC9<?467JB:PV46;2NX0R7J\ G 0 G Q2PÅ40 G-G KPô7JBJB¸45449_450 7J;?RA29 KQCBJB4X454910CO

ä°å²Kå=å©$åçº|$u2íl~jx:qéWgip6gk~jlnxzp6µ´vYjk~xzp6l~j|pwyigi@r|twjlMlnxzyig"hknrÖwgmo"Jgá_lngip6wgRWj|Ö6lMk~jyl<Â²p³K´µ&¶m·m·T¸«¹VºL»«¼]µ½7¾V¿H·kÀCÁ¾V¿`Â5Ã«ÄaÅÆµ«¼#¹DÇLÄµ«º+¾V¿5·bÈ¿H·Tµ«´mÃJµ½,Éµ«Ä3ÅÇL¾¹DºC»AÊÂÈKË3É=ÌÍÍÎIÏRYhYjµgi»|» ª ºiê_]aÚu àCkngiMi@ºR»»|q$u"Xí²l~j|xJßÀsv6gÌMv6r|kMlnglgiylnr|k$hknrÖwgm xp l2

xz$bàC¶×vYjk~ït³rk$k~j|pYrmoxzçigR8kngR6ylnxzrpwËJgá_lngipYgRïj|Ö6lMk~jylÿÂp³k´Tµ&¶m·#·T¸«¹DºL»«¼aµ½¾V¿H·aÐLÑX¾V¿eÂHÃtÄ3ÅÆµ«¼#¹DÇLÄÒµ«ºJ¾V¿H·*È¿H·Tµ«´mÃ,µ½zÉµ«ÄaÅÇL¾¹DºL»JÊÂÈKËÉÌÍÍ«ÁOÏRqhYjµgi|êtÓ ª »£_6aÚuàCkngiMiYºR»|»ê_@C

£_$u´2íl~jx:éWgip6gk~jlnxzp6µ vYjk~/xpwl~j|pwyigiÌrtlnvwgVMv6r|kMlÌÖYjMxÌhwknrÖwzgim ãÂp_³k´Tµ&¶m·#·#¸t¹DºL»«¼Fµ½(¾V¿5·ÌÍÍÍÔmºH¾·I´mºcÕ«¾¹µtºcÕÖÉµÖVÖ×µ&Ø ÇÆ¹VÇÆÄ2µ«º!ÙYÇÆ¾dµtÄ¢Õ«¾dÕ«ÚHÛÕtºL»«Ç5Õ&»C·I¼]ÕtºçY³k´Tµ#»«´TÕtÄ*Ä*¹VºL»*ÊDÔtÉÙYÛ³ÌÍÍÍ ÏR<rzwmogsºR«Ó«ÓWrtÛ·#¶ ¾ÇL´T·kÜzµ«¾·I¼k¹VºZÉµ«ÄaÅÇL¾·I´Â¶ ¹d·Iºc¶m·whYj|µ|gi¸º ª »_Td_hwknxzp6µ|gkM¶×â"gknjµw]ºR»»|»Ó$uwXí²l~j|x@j|p6 awfWÙsrknÁTCIh6wÖ6zxzy¶×Á<g$ykMhlnrlngimðÙ´xlnvÌÙr|knlM¶×yRjMge|jR<gk~jµg¶×yRjMggi·_wxzjgp6yig2Â²p+³k´Tµ&¶m·#·T¸«¹DºC»«¼`µ½¾V¿H·zÀLÍ«¾V¿ZÂHÃtÄ3ÅÆµ«¼#¹DÇLÄ¥µ«ºA¾V¿H·eÈ¿H·Tµ«ÍÃbµ½,Éµ«ÄaÅÇL¾¹DºL»+ÊÂÈKËÉÝÌÍÍLÞ#ÏYhYj|µ|gi|êtÓ ª »£_]aÚu àCkngiMi@ºR»»_ß $u_2íl~jx:<cØà6m$jkR<j|p61f`_d_x|j|Á_wm$jkRT0Mxzgi<gj|zµ|r|knxlnv6mt³rkslnv6g´Mv6rkMlngilsjlMlnxyg<gylnr|khwknrÖwzgim Âpb³k´Tµ&¶m·#·T¸«¹DºC»«¼µ½¾V¿H·!ÐÐ´¸JÂHÃtÄ3ÅÆµt¼m¹VÇÆÄáµtº(¾V¿5·JÈ¿H·Tµ«´mÃbµ½,Éµ«Ä3ÅÇL¾¹DºC»AÊÂÈKË3ÉÀÆÑÑÌIÏRYhYjµgi|º ª ºi]aÚuñà2kngiMiY||º|_oÃwYÙsgpVj|pY aTàLgixzÁ<gkMlRÚéWgip6gk~jlnxzp6µ$Mv6rkMlngkWÖ6j|Mgi´t³rkv6jk~k~jpYwr|mÝjlMlnxzyigii´ÂpA³K´µ&¶I·#·T¸«¹DºC»«¼,µ½!¾V¿H·Õ«ºHº5ÇHÕ«Ö¼#Ã«Ä*âÅÆµ«¼#¹DÇLÄáµ«º+¾V¿5·#µt´#·I¾¹¶#ÕÖ0Õt¼dÅ5·T¶ ¾¼`µ½!¶#µ«ÄaÅÇL¾·I´`¼I¶ ¹d·Iº¶m·eÊÂÈÆÙ`É0Â+ÀLÑÑÍ ÏRë]giylnkngbWrlngi´xp armohwwlngkd_yixzgip6ygd_hwknxzp6µ|gkM¶âXgknj|µ»_

q*ãY´knÖ6xlnm$j|p]Yéwfr|µrp]YâØYëTwwÖYjMv6gi_MÁqq_f`YuÌxyyixj|p6yxr@aàLgixzÁ<gkMlRYjpY ¸6crMgip]Údq/ÂCCÀKäØæYj1hknrhr|nj|@tår|klnvwg¸dÆåW¶£Øl~jpYwjk~]"d_6ÖwmoxMMxzr|plnr1bÂMdwÀW6ê_

ê_oë2Hæj|ÖYjxJÚèWpÌë@rÆç|MçîwjlMlnxzyigkngRwwylnxzrpÌj|pYHlnv6gpwgRjkngiljlMlnxzyig¸hr|xpql´hknrÖ6zgim zÉµtÄ¢è ¹DºÕ«¾dµ«´m¹¶#Õ|_æº ª ºO£Lºi»ê_»_1Â~T:æj|Ág@dT]éjrw@j|p6ËcØ]aTuÌ6zzxp]¸ìCáwhwzxyxzltJjylnr|knxzçRjlnxr|p[r|t x2k

+ 1 rgk fpÙ´xlnvhknxmog p ≡ 3 mod 4 `ÙkÅÅ>éÙaÖ »Cé¹DºZêkºL»Cé×ÚYÉµtÄ*Äeé0Õ«º¸AÉµtÄ3ÅY5Ówæ ê» ª »tÓwLºi»»<q

ºR_oë2wfWgiqknr<gkÜ!µtºâXëº5¹ ½Oµ«´mÄíìÕ«º¸µ«Äïî5Õ«´m¹Õ«¾·Jð·Iº:·I´TÕt¾¹µ«º6sdhknxzp6µgkM¶²âXgknj|µ@ºi»ê|ºº|o¸6LxjljpY ¸d_vYj|moxkRåWrRÙÿlnr1hknrgqrknMgit ª hwk~jylnxzyRj|@MrzwlnxzrpwlnroxgipqlnxzÛ6yRjlnxzr|pËj|p6ÌMxzµpYjlnwknghknrÖ6zgimoi"Âp³k´Tµ&¶m·#·T¸«¹DºL»«¼µ½,É0´mÃIÅH¾dµ+ÌÍÁLÎY<r|wmog¸|«£1r|t7Û·T¶ ¾ÇL´#·!Üzµ«¾·I¼z¹Dº~Éµ«ÄaÅÇL¾·I´!Âc¶ ¹d·Iº¶I·YhYj|µ|gi¸ºRê ª ºi»«Ów@d_hwknxzp6µ|gkM¶×â"gknjµw

ºi»ê_ºq$aéWgp_lMkMq<a_àLgixzÁ<gkMlR_j|p61â<â"j|xzÁ_6pql~jpYjlnv6j|p]À@k~jhTwrqr|kn"t³r|kvYjk~1jlMlnxzyigisjpY1pwgÙ0ykMhlnrµ|k~jh6vwxyýir|p6lMknwylnxzrp6i

Â²pU³K´µ&¶I·#·T¸«¹DºC»«¼eµ½!¾V¿H·zñcÑt¾V¿(ÂHÃtÄ3ÅÆµt¼m¹VÇÆÄòµ«ºF¾V¿H·È¿H·Tµ«´mÃ+µ½bÉµ«Ä3ÅHÇÆ¾¹VºL»UÊÂÈKËÉ<ÀLÑÑ«ÁOÏR]hYjµgi1ºi»< ª ||-aÚu à2kngiMiê_

º&£_$è6éWr_kngixzyv]Kóµ«ÇLºçÕ«¾¹µ«ºH¼`µ½¢É0´mÃIÅ¾dµ#»«´ÕIÅ5¿LÃ<r|z6mogÂMÂ ª æsj|MxzyØhwh6zxzyRjlnxzr|p6iasj|mÖwknxwµ|gWp6xz<gknMxzl²Hà2kngMiT||º|ºOÓ$èséWrkngxy~v@´dT´éWr|ÙÚjMMgkRj|p6/dTkåj|zgi_xJà26Öwxzy¶×Á<gÞykMhlnrlngimootåknr|mjlMlnxzyigËkngR6ylnxzr|p/hwknrÖwzgimoi Âp³k´Tµ&¶m·#·T¸«¹DºL»«¼µ½É0´mÃIÅH¾dµbÌ«ÍÍLÞ_<r|z6mogº»«Ó`rt0Û·#¶ ¾ÇL´T·Üzµ«¾·I¼a¹VºFÉµ«ÄaÅÇL¾·I´Âc¶ ¹d·Iº¶m·_hYj|µ|giWº|º ª º&£_ºTd_hwknxzp6µ|gkM¶×â"gknjµw

ºi»»<qº ß oÃwLår|äTlngixzp]ÃwwàXxzh6vwgkRj|p6ÃLåwdxzz<gknm$jp@@bÀscÚØæ_j¸knxzpwµ`ÖYjMgR$h66ÖwzxyÁ<g1ykMhwlnrlngim ]Â²p³k´Tµ&¶m·#·T¸«¹DºC»«¼!µ½3¾V¿H·Ð´¸ÙÖ »µ«´m¹D¾V¿LÄ¹¶¢Ü3ÇLÄ¢èm·IÁÈ¿H·Tµ«´mÃ(Â5Ã«ÄaÅÆµ«¼#¹DÇLÄÊÙYÜ,ÈÂÔTÔTÔÏR@<rzwmogÌºOÓ<«£Ër|t3Û·T¶ ¾ÇL´#·¢Üzµ«¾·I¼¢¹Dº=Éµ«ÄaÅÇL¾·IéÂc¶ ¹d·Iº¶I·

h6j|µgW< ª |ê|ê@d_hwknxzp6µ|gkM¶×â"gknjµw]ºR»»|êºR_o¸à¸jiÙÚjyvwxJ0à1CÀLjpYjÁj_2j|p6Fà1äWj|µ<jiÙsjarpwyiwkMkngipqln[Mgyiwkng$xwgipqlnxÛYyijlnxzrp8My~v6gimogÖ6j|MgR[r|p[lnv6goÙsrknlM¶²yij|Mg

v6jk~wpwgiM$r|t¸jlMlnxzyigVhknrÖ6zgimoiÿÂ²pô³k´Tµ&¶m·#·#¸t¹DºL»«¼(µ½bÙ3¼#¹Õ¶ ´mÃIÅ¾ÀÆÑÑ«Á|s<r|wmog ß £ ß 8r|tÛ·#¶ ¾ÇL´T·+Ü!µt¾·I¼¹DºÉµ«ÄaÅÇL¾·I´Â¶ ¹d·Iºc¶m·whYj|µ|gia£< ª £|ê»@d_hwknxzp6µ|gkM¶×â"gknjµw6||ê_ºq1âØ_ë]6Ö6j|Mvwgi_MÁ_q]ë@jlMlnxzyig¶×Ö6j|MgR$xwgipqlnxÛYyRjlnxzrp$Myvwgimogi"Mgiyiwkng6p6wgksj|ylnxz<gjlMl~jyÁ_iLÂ²pZ³K´µ&¶I·#·T¸«¹DºC»«¼zµ½Y³õ*ÉÀÆÑÑ«Á

h6j|µg¸ºi< ª º»@ê_ºRê_1âØë]6Ö6j|Mv6gMÁqqÈcµ«ö7Õ«´T¸t¼k³K´Õ¶ ¾¹¶#ÕÖCÛÕ«¾¾¹¶m· â÷YÕ«¼ ·#¸JÉ0ÍÃmÅ¾dµ#»«´TÕmÅ5¿LÃà2v6fÜlnvwgiMxzip6xz<gknMxl²r|t]asjzxztår|knpwxj__dj|p`fWxgµrw

ê_ºR»_1âØ<ëTwwÖYjMv6gi_MÁqj|pY1f_uÌxzyiyixj|pwyixzrw-éWgipwgk~j|zxzçigRoyir|mohYj|yl"Á_p6j|h6njyÁ_"jkngýir|zxzMxzrp$kngiMxzl~j|pqlRTÂpe³K´µ&¶I·#·T¸«¹DºC»«¼µ½Y¾V¿H·ÀÆÑÑÎzÔmºH¾·I´mºcÕt¾¹µ«ºcÕ«ÖÉµÖVÖ×µ&Ø ÇÆ¹VÇÆÄÒµ«ºeÙYÇÆ¾dµtÄ¢Õ«¾dÕ«ÚÛÕ«ºL»«Ç5Õ&»C·I¼Õ«ºç`³k´Tµ#»«´Õ«Ä*Ä¹DºL»ZÊDÔtÉÙYÛ³ÊÀ&Ï#ÏR<rzwmog]Ó< ß Ørt0Û·T¶ ¾ÇL´#·Üzµ«¾·I¼¹DºÉµtÄ3ÅÇL¾·I´!Âc¶ ¹d·Iº¶m·YhYjµgiº ÓÓ ª º ß«ß @dhknxzp6µgkM¶²âXgknj|µ||_1âØYëTwwÖYjMv6gi_MÁqj|pY fTuÌxzyiyixj|pwyixzrwmohlnr|lnxzyRj|zgÕoyixzgipqljlMlnxzyig¶×ÖYjMgRVwxzµxl~j|-Mxµ|pYjlnwkngii´Â²p(³K´µ&¶m·m·T¸«¹VºL»«¼*µ½¾V¿H·zÀÆÑÑ«Á(È¿H·Tµ«´mÃbµ½,É0ÍÃmÅ¾dµ#»«´TÕmÅ5¿LÃ(Éµ«º&½&·I´T·Iºc¶m·JÊmÈKÉ]É:ÏR6h6j|µ|gi3£ ª ß ÓwT||ê_º|1f`@uÌxzyiyxjp6yixzroéWgipwgk~j|zxzçigRyirmoh6j|ylWÁp6j|hwnj|y~ÁiTywyxzy1jlMlnxygii@j|pYVgÕoyxgp_lrp6g¶×ÙsjiËt³6pwylnxzrpwi(ÉµtÄ3ÅÇL¾dÕ«¾¹µtºcÕÖÉµ«ÄaÅcÖø·Tù«¹D¾Ã@ºiwÓ<æ £| ß ª Ówº|º-||<qq1f`6uÌxzyiyixjp6yixzr$j|p6 dYéWr|ÙÚjMMgkR`Éµ«Ä3ÅcÖø·Tù«¹V¾Ãeµ½zÖ×Õ«¾¾¹¶m·ÅH´TµèOÖø·IÄ¼túÕe¶ ´mÃIÅH¾dµ#»«´TÕIÅ5¿C¹¶3Å5·IÍ¼Å5·T¶ ¾¹Dû«·kàqÙgkÚyRjgimoxzy

àCkngiMiY|_«£_1fùÌxzyiyixjp6yixzrïj|p6/ècgiµ|gißr|knlM¶×yRjMg lnr8jR<gk~j|µ|g¶×yRj|MgVkngR6ylnxzrpw$ÖYj|MgiÞrp0µj|wMMxjp/mogRj|MkngiiüÂÆÔTÙYýÿþÆéÉµ«ÄaÅÇL¾éH£<ºRæ |< ª £|<_@_tÓ1fùÌxzyiyixjp6yixzr¸j|p61è|cgµgi³µt¼m¾âKÇ5Õ«º5¾ÇÆÄ¥É0ÍÃmÅ¾dµ#»«´ÕIÅ5¿LÃqy~vYj|hlngkXë-jlMlnxzyig¶×ÖYjMgRoa"kMhwlnr|µ|k~j|hwvqqYd_hwknxzp6µ|gkM¶×â"gknjµw

ê_ ß 1f`|uÌxzyiyxjp6yixzr¸jpY1dâj|wvYjp@wdql~jlnxzlnxzyRj|çigknr¶²Á_pwrÙ´zgRµgÚhknrqr|t³CÙ´xlnv`gÕoyixzgipqlXhwknr<gkniæ|ë-jlMlnxzyigshwknr|Ö6zgimo2jpY¸mor|kng

Â²pA³k´Tµ&¶m·#·#¸t¹DºL»«¼`µ½,É0´mÃIÅH¾dµJÀÆÑÑtÐYh6j|µgWê< ª |»|ê@£_|_$uØ|bWxzgizMgip$jpY`Â~<ë2qav_Yjp6µKÇ5Õ«º5¾ÇÆÄáÉµ«ÄaÅÇL¾dÕ«¾¹µ«ºÕ«ºçKÇ5Õ«ºH¾ÇLÄÔmº&½Oµ«´mÄ¢Õt¾¹µ«º6asj|mÖwknxwµ|gÚWp6xz<gknMxzl²à2kngiMi

_q1âØHã`àCj|p@ÂH¾´mÇ5¶ ¾ÇÆ´T·T¸+Ä,Õ«¾´m¹¶m·I¼,Õ«º¸ÅÆµÖ Ãtºcµ«Ä¹ÕÖ ¼#ÚkÇLº5¹ K·T¸b¼#ÇXÅ5·I´D½ Õ«¼#¾ÕÖ »µtÍ¹D¾V¿CÄ*¼n¸d_hwknxzp6µ|gkM¶×â"gknjµjpY+æxknÁ_v6MgkR

º||ê_$aTàLgxÁgkMlRë]xmoxlnrpËlnv6gØvYjk~wp6gMWr|t"jlMlnxzyighwknrÖwzgimoWxzp `p

p6r|knmoiJÉµ«ÄaÅÇL¾dÕ«¾¹µ«ºÕÖ]Éµ«Ä3ÅcÖø·Tù«¹V¾Ã|@_ºæ £| ª £ ß ºê_

@CD

|»_$aàLgixzÁ<gkMlRIà26Ö6zxzy¶×Á<gïykMhlnrlngimo1tåknr|m lnv6g Ùr|knlM¶×yRj|MgVMvwr|kMlngilH<giylnr|kHhwknr|Ö6zgim s||» À-r8jh6hgRjkÌxzpÜlnvwghknrqyigigRxpwµ´r|t"dÀ´èaî »Y-|j|xzj|Ö6zg¸jl ¤q£<£|«"¬«q©«¥C¡M¨<¢_¥L¡³Y£2¡½wq¨R«w_ Å <®<£_ £_$aYàLgixzÁ<gkMlWj|pYÌØYcrMgp@ÚìCÕoyixzgipqlyirzzxzMxzrpw¶:kngiMxzl~jp_lvYj|Mvwxzp6µotåknr|mÝÙr|knlM¶×yRjMg`jMM6mohwlnxzr|p6rp yyizxzyØjlMlnxzyigii´Âp³k´Tµ&¶m·#·T¸«¹DºL»«¼`µ½z¾V¿5·`ÀÆÑÑÎ+È¿H·Tµ«´mÃbµ½,É0ÍÃmÅ¾dµ#»«´TÕmÅ5¿LÃ(Éµ«º&½&·I´T·Iºc¶m·JÊmÈKÉ]É:ÏR6h6j|µ|giØº Ó ß ª ºR|]|£º|$a"àLgixzÁ<gkMloj|pYïØXcrMgip]Üë-jlMlnxzyig$lnv6jl$j|wmoxl1zr|µ<jknxlnvwmoxy Ùr|knlM¶×yRjMgÌlnr[jR<gk~jµg¶×yRjMgËyirpwp6giylnxr|pït³j|ylnrkni/Âp³k´Tµ&¶m·#·T¸«¹DºL»«¼`µ½z¾V¿5·ÐCÍ«¾V¿ZÂHÃtÄ3ÅÆµ«¼#¹DÇLÄ¥µ«ºA¾V¿H·eÈ¿H·Tµ«ÍÃbµ½,Éµ«ÄaÅÇL¾¹DºL»¢ÂÈKËÉÀÆÑÑÞYh6j|µgYÓ<|ê ª Ó<ê_]aÚuñà2kngMi<q£<q$a6àLgixzÁ<gkMlR6âwâjxÁ_wp_l~jpYjlnvYj|p]wj|pYbæ6[jlngkniItk~j|mogÙr|knÁ$t³r|kgÕoyxgp_ljpYÌyir|mohrnjÖ6zgrÖwxz_xzrwlMk~jp6t³gkRsÂp³k´Tµ&¶m·#·T¸«¹DºL»«¼µ½É0´mÃIÅH¾dµ¢ÀLÑÑ«Á_<r|z6mog ß º ß Ørt0Û·#¶ ¾ÇL´T·Üzµ«¾·I¼a¹VºFÉµ«ÄaÅÇL¾·I´Âc¶ ¹d·Iº¶m·_hYj|µ|gi ß«ß Ó ª ß qºTd_hwknxzp6µ|gkM¶×â"gknjµwê_££_$è]cgiµgiHèWp!jlMlnxzyigii-zgRjknpwxpwµÌÙ´xlnvgkMknrkni-k~jpYwr|m zxzp6gRjkyr_wgii-j|p6ykMhwlnr|µ|k~jh6vqqoìCá_lngipYgR!gknMxzrp[rt§ £«Ó«¨wjlngRÌu jR _Y||»_-|j|xzj|ÖwgØjllnvwgWcë ¤q£<£|«"¬¾<¾<¾X¡¨<¢-¡²£q½"¡_¨-¡¥<q¿©q<®_ £«Ó$è6cgiµ|gièWpËjlMlnxzyigiizgRjknp6xzp6µ$Ù´xlnvËgkMknr|knik~jpYrmÝzxpwgRjkWyir_wgi]j|pYykMhwlnrµk~j|hwv_qsÂpU³k´Tµ&¶m·#·#¸t¹DºL»«¼*µ½`¾V¿5·*ÐÆÞX¾V¿Â5Ã«ÄaÅÆµ«¼#¹DÇLÄáµ«ºA¾V¿H·JÈ¿H·Tµ«´mÃbµ½,Éµ«Ä3ÅHÇÆ¾¹VºL»AÊÂÈKËÉÀÆÑÑ ÏRYh6j|µgêtÓ ª »£aÚuñàCkngiMiT ß £ ß o¸crMgip$jpY$éqdgiµ|gi]av6r|Mgipw¶×yixzh6vwgkMlngá_lXMgiyiknxzl²1_xjyir|kMkngjlngRohwknr_6ylniÂ²pJ³k´Tµ&¶m·#·#¸t¹DºL»«¼3µ½ÈKÉ]ÉUÀÆÑÑÍq<rzwmogß ÓÓÓortÛ·T¶ ¾ÇL´#·!Üzµ«¾·I¼¹Dº~Éµ«ÄaÅÇL¾·I´zÂc¶ ¹d·Iº¶m·YhYjµgiÓºR» ª Ó£|@dhknxzp6µgkM¶²âXgknj|µ|»£_$a@àL-dy~v6p6rkMkR1v6xzgk~jknyvqVrtÚhrp6r|moxjCjlMlnxzyigoÖYjMxz¸kngiw6ylnxr|pjzµr|knxlnvwmoiÈ¿H·Tµ«Óé3Éµ«Ä3ÅÇL¾é7Â¶ ¹³ ß £æ º ª XÓwºi»ê<q

/H4]4wA47w þ ùÿ¯ÿ¯úWðñd^ñ ×2 Q2PR7J;C\À(´9<585ï4·O E ^98S-; G ^ ?RAX46? f = f1f2 mod qôA29109 E K G 0V9_4 )A i ∈

1, 2 E ?RA29X4 G B82@; G 587×46B fi7:Pï780309qNLQ=)<78-CB:9>7J;

Zq[x]46;2N)_46;¹-9Iâ0R7J?R?9<;

fi = xn/2 + tixn/4 − 1

K G 0P G 5 9 ti ∈ Zq

O(´9<?

s ∈ Znq

46;2Nv ∈ Zmn

q

Oj¸9/^`46;@?ï? G - G QC;2N?RA29J40 G -X45-C7JBJ7J?&2?RAX46? rotf (g)s = vôA29<;

g7:P

?46ST9<; QC;C7³K G 0R58B82/7J; (Zq[x]/f)m O¸9Vâ0R7J?9 g = (g1, . . . , gm)T E 46;2Nß^9g)_46BJB s, v1, . . . , vm?RA299<B:9<5 9<;@?P

G K Zq[x]/f?RAX46?) G 0309qP34 G ;2N/? G s

46;2NvV7:NC9<;@?R7³KQ2-7J;C\9T9H)<? G 0c) G-G 0NL7J;X46?9qPH46;2NA4 G B82-; G 587×46Bx) G 9,TU)<7:9<;@?P\,O

¸9ÌNC9,[2;29?RA295ï454φsKQ0 G 5 Zq[x]/f

? G 7J?P9<B³K?RAX46?15ï4542P g? G g · s O PR7J;C\?RA29 g 7→ g

7:P G 5 G 034CAC7:P5 VP9q9(´9<585ï4/O\ E ^9VP9q9 ?RAX46? G Q0o\ G 46B´7:P$9,M24 )<?RB820?RA29ËP465 9!4YPa- G QC;2NL7J;C\ ∏

j≤m Prg[φs(g) = vj ]O

¸9f) G ;2PR7:NC910H?^ G )_4YP9qP E NC914s9<;2NL7J;C\ïôA29<?RA2910 s46;2N

f4509f) G 40R7J5 9 G 0; G ?CO=nK s

46;2Nf4509N) G 40R7J5 9 E

?RA29<;φs7:PV4I-C7 ?R9H)<?R7 G ; E 46;2N Prg[φs(g) = vj] = q−n O=@Q44 G P9[; G ^ ?RAX46? s = fis

′ K G 0VP G 5 9 i ∈ 1, 246;2Ns′ ∈ Zq[x] G KNC9<\09q9 < n/2

OnKvj7:PÌ; G ? G K?RA29!K G 0R5 fiv

′j

K G 0ÌP G 5 9 v′j ∈ Zq[x] G KNC9<\09q9 < n/2 E?RA29<;Prg[φs(g) = vj] = 0

O5Ã?RA2910Rô7:P9 E PR7J;=)q9?RA29¸ST910R;29<B G K φs7:P G K=)_450NL7J;X46BJ7J?2 qn/2 E ^9AX4H9T9 Prg[φs(g) =

vj ] = q−n/2 O¸9ß; G ^ ?46ST9I4 QC;C7 G ;W- G QC;2N G 9T910/46BJBH?RA299T9H)<? G 0P s ∈ Zn

q \ 046;2NÝ?RA299T9H)<? G 0P v ∈ Zm

q

PRQ=)A?RAX46? ‖v‖∞ < q/4

OoU1A29°40 G -X45-C7JBJ7J?2ØV G 9T910/?RA29 g\ï?RAX46?/^9>AX4C9T9

λ∞1 (L(rotf (g))) < q/4

7:P0Q44s910- G QC;2NC9qNA-;2Â

∑

s ∈ Znq

gcd(s, f) = 1

∑

v ∈ Zmq

‖v‖∞ < q/4

∏

j≤m

Prg

[φs(g) = vi] + 2∑

s ∈ Znq

f1|s

∑

v ∈ Zmq

‖v‖∞ < q/4

∏

j≤m

Prg

[φs(g) = vi].

U1A29c[=0PR??910R57:P ≤ qn(q/2)mnq−mn O@U1A29ÌP9H) G ;2NÜ?910R57:P ≤ 2qn/2Nmq−mn/2 E ôA29109 N7:PØ?RA29;]QC5f-910

G K v ∈ Zq[x]/fPRQ=)A ?RAX46? ‖v‖ < q/4

46;2Nv = f1v

′ K G 0P G 5 9 v′ ∈ Zq[x] G KÚNC9<\09q9 < n/2OTU1AX46;CSLP¸? G ?RA29

PRAX454s9 G K f1E ?RA29!B×46?R?910R) G ;2NL7J?R7 G ;2PÌ7J574CB82ÿ?RAX46? ‖v′′‖∞ < q/4

ôA29109v′′ ∈ Zq[x]

7:PH?RA29N9T9H)<? G 05ï4YNC9 G K?RA29

n/4B G ^9101NC9<\09q9c) G 9,TU)<7:9<;]?P G K v′ O;>P`4^) G ;2P9H]@Q29<;=)q9 E ^`9$AX4H9T9 N ≤ qn/2/2n/4 O> PR?30467J\A]?iK G 0R^`450N

) G 574CQC?46?R7 G ;40 G 9@7:NC9qPH?RA29^09qPRQCBJ?CO ut /H4]4wU4w þ ùÿ¯ÿSú¥[xñ ðñ =@7J;=)q9 A 0RQC;2P7J;?R7J5 9

T E 7J?f)_46;C; G ?B G@G S46?V5 G 09ï?RAX46; B ≤ T-C7J?P G Ko?RA29

P46574CB:9qP!KQ0 G 5 νsO= G 7J?84 )<?RQX46BJB82ãP G B89T9qP CVPD1

ô7J?RAD1 = 2−Bb2Bνsc

O'¸9ÜAX4H9T9 E K G 0[46;;2 x ∈ Zn ÂD1(2

−Bx) =∫t∈2−B(x+[0,1]n) νs(t)dt

O'¸9/)A G@G P9 R = 16 · 22nB+2nn3n · max(sn, 1/sn) · maxi ‖b∗i ‖ EôA29109Ë?RA29b∗iYPH4509 ?RA29fÖV=Ã G K?RA29Ë\789T9<;À-X4YP7:PCO

@s¼

>BJ\ G 0R7J?RAC5 A′ ^ G 0RS-PW4YPsK G BJB G ^$PCÂq7J??46ST9qP t = b+e4YP´7J;4CQC? E ôA29109 b ∈ L

46;2Ne7:PŃL7:PR?30R78-CQC?9qN4 )H) G 0N+

7J;C\ ? G D LR

,s 7J?j0 G QC;2NCP t? G 2−BZn 46;2NF)_46BJB:PØ46BJ\ G 0R7J?RAC5 A 7J?j09<?RQ0R;2P?RA29 G QC?34CQC? G K A O ´ G 0?RA2909qPRQCBJ?? G

A G B:N E 7J?PRQTU)q9qP? G PRA G ^ã?RAX46? ∆(D1, D2) = 2−Ω(n) E ôA29109 D2 = 2−Bb2BD LR

,scO´0 G 5ÆE E (´9<585ï4ROG E

^9`S-; G ^ ?RAX46? ∆(D LR

,s, νs−(νs mod LR)) = 2−Ω(n) O5~?W?RA]Q2PPQTU)q9qP? G PRA G ^?RAX46? ∆(D1, D3) = 2−Ω(n) E

ôA29109D3 = 2−Bb2B(νs − (νs mod L

R ))c O¸9VAX4H9T9 E K G 0H46BJB x ∈ Zn Â

D3(2−Bx) =

∑

bR∈L

R∩2−B(x+[0,1]n)

∫

t∈ 1R

(b+P (L))νs(t)dt =

∫

t∈T (x)νs(t)dt,

ôA29109T (x) = t : t− (t mod L

R ) ∈ 2−B(x + [0, 1]n) O>ÌPo4g) G ;2P9H]]Q29<;=)q9 E ?RA29Å]@QX46;]?R7J?&2 |D1(2−Bx)−

D3(2−Bx)| 7:P`P5ï46BJB:910`?RAX46; s−n ?R7J5 9qP1?RA29R9 G BJQC5 9 G K?RA29 NL7Ds9109<;=)q9R-s9<?~^9q9<;ß?RA29P9<?P 2−B(x + [0, 1]n)46;2NT (x)

O©>P?46;2N2450N 450R\QC5 9<;@?ßPRA G ^$PÜ?RAX46? 2−B(x + [0, 1]n)) G ;]?467J;2P T (x)

VQ09qP34xO`7:PJ) G ;]?467J;29qN7J;

T (x)\ G ;=)q9Ì?RA29HB×46?R?9101AX4YP-s9q9<;ÞPRA0R7J;CST9qN°VQ09qP34xOL9<;CB×450R\T9qN\#-;2Ü4VKn4 )<? G 0 1± 2B

√n max ‖b∗

i ‖R

O@U1A29109K G 09 E^9ÀX4C9T9 |D1(2

−Bx)−D3(2−Bx)| ≤ s−n2−nB

[(1 +

2B√

n max ‖b∗i ‖

R

)n−(1 − 2B

√n max ‖b∗

i ‖R

)−n]

=: CO

G ?R7*)q9H; G ^(?RAX46?ØK G 0©- G ?RA D146;2N

D3E ^9AX4H9T9 Pr[‖2−Bx‖ > 2s

√n] = 2−Ω(n) O;>ÌP14L) G ;2P9H]@Q29<;=)q9Â

∆(D1, D3) ≤ 2−Ω(n) +∑

x, ‖2−Bx‖≤2s√

n

|D1(2−Bx)−D3(2

−Bx)| ≤ 2−Ω(n) +(2B+2s√

n)nC ≤ 2−Ω(n).

U1AC7:P) G 574CB:9<?9qP?RA29Å40 G@G K3O ut /H4]4w4w þ ùÿ¯ÿ¯úx^ñòñ (´9<?

G = rotf (g)O×2NC9,[2;C7J?R7 G ; G K$?RA29 ?30454sN G-G 0 S E ^9ÞAX4H9T9 ST · G = 0

O? K G BJB G ^$PV?RAX46? d = ST e mod q

O»Ì9<;=)q987³K^`9 PRA G ^ ?RAX46?!9_4 )A 9<;]?3032 G K ST eV) G 574CQC?9qN G 9T910 Z[x]/fô7J?RA G QC?a09qNLQ=)<?R7 G ;/5 G NLQCB G q

\¸AX4YP5ï46\;C7J?RQ2NC9< q/2 E ?RA29<;0^9Ìô7JBJBsAX4H9T9 ST e = ST e mod q

O×`QC?o9_4 )A9<;]?3032 G K ST e

7:P146;Þ7J;C;2910<40 G NLQ=)<?LV G 9T910 R\ G K?RA29K G 0R5 〈si, e〉 E

ôA29109si7:P?RA29

i?RAA) G BJQC58; G K S O G ^ E-;2/) G ;2PR?30RQ=)<?R7 G ; E ^9AX4H9T9 e = ec +w E ôA29109 ec

7:P`P46574CB:9qNïKQ0 G 5 ?RA29R) G ;]?R7J;]Q G Q2PRÖË46Q2PPR7×46; ναq46;2N

w7:PÌ?RA29N0 G QC;2NL7J;C\ÿ91030 G 0 E ô7J?RA ‖w‖∞ ≤ 1/2OU1A297J;C;2910Å40 G NLQ=)<? 〈si, ec〉

7:PNL7:P?30R78-CQC?9qN4 )H) G 0NL7J;C\/? G νrô7J?RAr = ‖si‖ · αq ≤ Lαq E P GCE -2/?RA29fÖË46Q2PPR7×46;ß?467JB´7J;29H]]QX46BJ7J?2 E ^`9VAX4C9T9 |〈si, ec〉| ≤ ω(

√log n) · Lαq Eô7J?RAA40 G -X45-C7JBJ7J?&2 1− n−ω(1) O>B:P GCE -;2Ü?RA29V=)A]^14503e!7J;29H]@QX46BJ7J?&2 E ^`9 AX4H9T9 |〈si,w〉| ≤ L

√mn/2

OCU1AX46;CS-P? G ?RA29ß4YPPRQC574C?R7 G ;2P G ; q

46;2Nα E 7J?[K G BJB G ^$P ?RAX46? |〈si, e〉| < q/2

46;2NA29<;=)q9d = St · e

VQ2P7J;C\ ?RA29QC;C7 G ;A- G QC;2N\`ô7J?RAA40 G -X45-C7JBJ7J?&2 1 − n−ω(1) O>Po4F) G ;2P9H]@Q29<;=)q9 E ^`9 AX4H9T9Ë?RAX46? e′ = e E u = G · s mod q46;2N

s′ = s E ô7J?RA/40 G -X45-C7JBJ7J?2 1−n−ω(1) O¸9!?iQ2PR?Q2P9qN ?RA29$KM4 )<??RAX46? rotf (g1)7:P¸KQCBJB046;CS G 9T910 Zq

ô7J?RA40 G -X45-C7JBJ7J?&2 ≥ (1− q−n/2)2 > 1−2q−n/2 G 9T910`?RA29c)A G 7*)q9 G K g1 ∈ R E PR7J;=)q9 f

P34CBJ7J?PØ7J;]? G ?~^ G 780309qNLQ=)<78-CB:9Kn4 )<? G 0Po5 G NLQCB G q G KNC9<\09q9 n/2

9_4 )AxO´ G 0[?RA29/91946BJQX46?R7 G ; G K hg

E ?RA29Þ5ï46?30R7ZM+.9T9H)<? G 0740 G NLQ=)<? G · s7J;;9 G B89T9qP m = O(1)

5QCBJ?R784CBJ7*)_46?R7 G ;2Pgi · s mod q

7J; R O¸9U) G 574CQC?9 gi · s ∈ R -;2°[=0PR?F) G 574CQC?R7J;C\ gi · s7J;

Z[x]/fVô7J?RA G QC?g09qNLQ=)<?R7 G ;

5 G NLQCB G q\46;2N ?RA29<;U09qNLQ=)<7J;C\V5 G NLQCB G q

OTU1A29) G 574CQC?46?R7 G ; G K gi ·s)_46;U-9oN G ;29H7J; O(n)

?R7J5 9a-2Q2P7J;C\4VKM4YPR?´ G Q0R7:910`?3046;2PiK G 0R5 G 9T910 Zq

K G 01P G 5 940R7J5 9 qPRQ=)AÜ?RAX46?

2n|q− 1VP9q9¥(´9<585ï4FO\46;2N

q > 2nq2

VP G ?RAX46? ‖gi · s‖∞ < q/246;2NðA29<;=)q9

gi · s mod q = gi · s\,OW=@7J;=)q9

q = Poly(n) E 7J?VK G BJB G ^$P?RAX46?!?RA29) G 574CQC?46?R7 G ;?46ST9qP O(n)-C7J? G 4s91046?R7 G ;2P E 4YPR09H]]QC7809qNO¸9 46B:P G ;29q9qN>? G -s9[45-CB:9? G P46574CB:9[9,TU)<7:9<;@?RB82

K0 G 5 ?RA29 G ;29,+~NL7J5 9<;2P7 G ;X46BNL7:PR?30R78-CQC?R7 G ; Ψαq7J; ?R7J5 9

O(1)O=@7J;=)q9

αq = O(n) E ?RAC7:P^)_46;P-s9[N G ;29[ô7J?RAPR?46;2N2450N/?9H)AC;C7*]]Q29qPgE8@C²G&O´ G 0Ì?RA297J;;9T910PR7 G ; G K hg

E ^9f09H)_46BJB?RAX46??RA29!5ï46?30R7ZM S) G ;2PR7:PR?P G K m2 -CB G )SLP rotf (si,j)

ô7J?RAsi,j ∈

Z[x]/fOa»Ì9<;=)q9>?RA29>5ï46?30R7ZM

ST ) G ;2PR7:PR?P G K m2 -CB G )S-P rotf (si,j)VP9q9P(9<585ï4ªO\,O$U1A29109K G 09 E ?RA29

@C¿

5!QCBJ?R784CBJ7*)_46?R7 G ; ST · c mod q09qNLQ=)q9qPÞ? G m2 = O(1)

4 G B82-; G 587×46B5QCBJ?R784CBJ7*)_46?R7 G ;2P/7J; R E ôAC7*)A¹)_46;-s9IN G ;29 7J; ?R7J5 9 O(n) E 4YP09,M4CB×467J;29qN 45- G 9T9O´ G 0Þ?RA29 5QCBJ?R784CBJ7*)_46?R7 G ; S−T · d7J;

Q^9X40 G )q9q9qN 4YP

K G BJB G ^$PCO¸9ËAX4H9T9 S−T = rotf (S−1) E ôA29109 S = (si,j)i,j46;2Nÿ?RA29V7J;;9T910P9!7:P G 9T910?RA29Å[X9<B:N Q[x]/f

O¸9409H) G 574CQC?9VNLQ0R7J;C\?RA29HST912 \T9<;291046?R7 G ;\?RA295ï46?30R7ZM S−1 G 9T910 Q

O@3ÌQ0R7J;C\?RA29HST912ï\T9<;291046?R7 G ; E ^`9Ë46B:P G)A G-G P9[440R7J5 9 q′

ôAC7*)A 7:P7VQ4X46780Rô7:P9s\c) G 40R7J5 9ô7J?RA 46BJBW?RA29NC9<; G 587J;X46? G 0PV4544s9_450R7J;C\07J;I?RA29f046?R7 G ;X46B5ï46?30R7ZM

S−T E 46;2NB×450R\T910!?RAX46;ð?RA29ï9<;@?30R7:9qP G K eV?RA29U09qPRQCBJ? G K S−T · d \ E ôAC7*)A AX4YP9<;@?30R7:9qP < q

ô7J?RA40 G -X45-C7JBJ7J?&2 1−n−ω(1) O ¸9a) G 574CQC?9gVM46;2N8PR? G 09H4YPj4X450R? G Ks?RA291?30454sN G@G 0\?RA29o5ï46?30R7ZM T = S−T mod q′

O3ÌQ0R7J;C\ ?RA297J;9T910PR7 G ; G K hg

E ^9`7J574CB:9<5 9<;]?¸?RA2940 G NLQ=)<? S−T ·d G 9T910 Q-2f) G 574CQC?R7J;C\ S−T ·d mod q′ =

rotf (T )·d mod q′OU1A29©40 G NLQ=)<? rotf (T )·d mod q′

)_46;f-s9#) G 574CQC?9qNQ2PR7J;C\ m2 = O(1)5QCBJ?R784CBJ7*)_46?R7 G ;2P

7J;Zq′ [x]/f

OâØ4 )A G K?RA291B×46?R?910!4 G B82@; G 587×46BC5QCBJ?R784CBJ7*)_46?R7 G ;2PØ?46ST9qP¸?R7J5 9 O(n) E -2Q2PR7J;C\!46;´jÚ 5 9<?RA G N4YPH45- G 9T9 E 4YP$B G ;C\Ü4YP q′ = Poly(n)O

?N09<5ï467J;2P? G PA G ^ ?RAX46?^`9/)_46;¯[2;2N 4 q′ = Poly(n)ôAC7*)A 7:PJVQ4X46780Rô7:P9s\L) G 40R7J5 9Üô7J?RA46BJBØ?RA29

NC9<; G 587J;X46? G 0P7J; S−T O ´ G 0?RAC7:PW^9`; G ?9`?RAX46? E ?RAX46;CSLP? G Ç©0465 910CYPj0RQCB:9146;2NF» 4YN2465ï450NYP7J;29H]]QX46BJ7J?2 E ?RA29NC9<; G 587J;X46? G 0P G K?RA29¥046?R7 G ;X46BÚ9<;]?30R7:9qP G K S−T AX4C9T9 45-2P G BJQC?9¥946BJQ29qP ≤ Lmn VQ2PR7J;C\[?RA29$Kn4 )<?`?RAX46? ‖S‖ ≤L\,O»Ì9<;=)q9 ?RA29109V4509 ≤ (nm)2 · log(Lmn) = O(n3)

NL7:PR?R7J;=)<?a40R7J5 9qP$NL789-7:NL7J;C\8?RA29 NC9<; G 587J;X46? G 0P G K S−T

46;2N/^`9L)_46;ÿ?46ST9q′ = O(n3) E 4YPa09H]@QC7809qNO ut

@CB

Efficient Public Key Encryption Based on Ideal Lattices

Documents

Transcript of Efficient Public Key Encryption Based on Ideal Lattices