1
$\begingroup$

It seems to me that very often the results on the hardness of LWE problems assumes that the LWE oracle only has access to a bounded number of samples, e.g. the following Corollary 3.3 of [BLP+13] (https://arxiv.org/pdf/1306.0281):

Let $\delta \in (0, 1/2)$, $m \ge n \ge 1$, $q' \ge 25$. Let also $q \in [q', 2q')$ is the smallest power of 2 not smaller than $q'$ and $\alpha \ge \frac{1}{q}\sqrt{\ln(2n(1 + 16/\delta)/\pi)}$. There is an efficient (transformation) reduction from $\textsf{LWE}_{n, m, q, \alpha}$ to $\textsf{LWE}_{n, m', q', \le \beta}$ where $m' = m - (16n + 4 \ln \ln q)$, and $$\beta = C\alpha\sqrt{n} \sqrt{\log(n/\delta)\log(m/\delta)}$$ for some universal constant $C > 0$, that turns advantage of $\zeta$ into an advantage of at least $(\zeta - \delta)/4$.

Does this immediately imply that $\textsf{LWE}_{n,q, \alpha}$ reduces to $\textsf{LWE}_{n, q', \le \beta}$ (where the LWE oracles takes arbitrary number of samples)? If so, how does this affect the error distributions $\alpha$ and $\beta$?

$\endgroup$

1 Answer 1

0
$\begingroup$

Yes, it does immediately imply this. And it doesn't impact the error distributions much. We can worst-case assume that $m = O(2^n)$ (even such large of $m$ is highly unrealistic --- this is roughly the size where an adversary reading this many samples takes approximately as long as breaking LWE with standard techniques).

Anyway, for such $m$, we can get the bound $\beta \leq C\alpha n\sqrt{\log (n/\delta)}$, independently of $m$. So you lose an additional $\sqrt{n}$ factor, which really isn't that bad.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.