5
$\begingroup$

Learning with Errors Problem (LWE): Given a polynomial number of random noisy linear equations $b_i$ in the form of pairs

$$ (a_i, \quad b_i = \langle s, a_i \rangle + e_i) $$ where $a_i \in \mathbb{Z}^n_q$ are uniformly random, $e_i$ is sampled from some noise distribution such that $e_i \ll q$, and $\langle s, a_i \rangle$ denotes the inner product of $s$ and $a_i$, find the secret vector $s \in \mathbb{Z}^n_q$.

This problem is supposed to rely on the hardness of GapSVP. In Regev's paper, he showed a complicated reduction from GapSVP. Is there a way to see the immediate connection between the two problems? What are $a_i$, $b_i$ and $\langle s, a_i \rangle$ with regards to a lattice?

Thanks!

$\endgroup$
  • $\begingroup$ You could try reading e.g. Section 3 of eprint.iacr.org/2013/602.pdf outlining the related lattice and the gap between $\lambda_1$ and $\lambda_2$. $\endgroup$ – TMM Feb 19 '17 at 9:56
  • $\begingroup$ Thanks for your answer, that really helped. You should post it as the actual answer! $\endgroup$ – LQWE Feb 20 '17 at 5:12
3
$\begingroup$

Taking $n$ LWE samples, the associated vector $\mathbf{b} = (b_1, \dots, b_n)$ can be written as $A\mathbf{s}+\mathbf{e}$ with $A^T = (\mathbf{a}_1 | \dots | \mathbf{a}_n)$ and $\mathbf{e} = (e_1, \dots, e_n)$ a small noise vector. The vector $A\mathbf{s}$ could be interpreted as a lattice point in the lattice $\mathcal{L}(\mathbf{a}_1, \dots, \mathbf{a}_n)$, with unknown coefficients defined by the secret vector $\mathbf{s}$, and $\mathbf{e}$ is small so $\mathbf{b}$ is pretty close to this lattice point. This corresponds to a CVP/BDD-style problem, where you want to find the closest lattice vector to $\mathbf{b}$ in this lattice.

Finally, Kannan's embedding technique shows how to translate CVP instances to (Gap-)SVP instances. Quoting Hanrot, Pujol, and Stehle, at the end of Section 4:

enter image description here

I'm not sure if this is also how Regev reduces GapSVP to LWE, but it's probably the most intuitive way to see how CVP-style problems and SVP-style problems are usually related.

$\endgroup$
2
$\begingroup$

SVP and GapSVP

For uniformly distributed $a_i \in \mathbb{Z}^n_q$ we are tasked with finding $s \in \mathbb{Z}^n_q$. This can be seen as the search form SVP, but by stating that the hardness derives from GapSVP the claim then becomes a decision form. GapSVP is also shown to reduce to GapCVP, and SVP is not harder than CVP (source). It has also been shown that SVP reduces to GapSVP (source)

Intuitive Sense

For the noisy linear $b_i$ w.r.t. $(a_i, \quad b_i = \langle s, a_i \rangle + e_i)$ can you show that $s$ is the shortest non-zero vector when you only know $(a_i, b_i)$ and $a$ is uniformly random? To put it another way, I task you with finding the shortest non-zero vector $s$, but to each vector I add slight noise using a Guassian distribution. You will not be able to determine if $s$ is indeed this short vector, since the noise used can lead to an $s$ modulo an arbitrary number of decimal places.

LWE and GapSVP

The immediate connection between LWE and GapSVP is that in both you are tasked with finding the shortest non-zero vector in the presence of a uniformly distributed noise. In both, LWE and GapSVP have the difficulty of finding the secret $s$ which is as hard as distinguishing pairs such that the shortest non-zero vector has at most length $d$ from the pairs. If I can't find the shortest non-zero vector, how can I decide if a pair of which the shortest vector is an element is at most length $d$? Since I can't find $s$, I can't show that $s$ has a length greater than $f(n)*d$, which is the GapSVP problem.

GapSVP and Lattices

In the work by Regev, cited in the question (source), Regev covers basic definitions of lattices and lattice problems on page 8. He defines the lattice in $\mathbb{R}^n$ with respect to the set of all integer combinations of $n$ linearly independent vectors. The set of $n$ linearly independent vectors is the basis of the lattice.

In LWE a number field $K$ is added to an $n$-dimensional vector space over $\mathbb{Q}$ which is used to introduce a cyclotomic polynomial. These properties allow for the canonical embedding described by Regev in section 2.3.2. One of the final requirements to establish the lattice geometry is to select a relevant norm. Regev uses the norm of $l_\infty$. This norm determines the expansion that occurs between elements under multiplication.

LWE uses a decision problem involving samples of LWE and a uniform distribution on $\mathbb{Z}^{n}_{q} \times \mathbb{Z}_{q}$ (Section 3, page 12).

Applied Lattices

Returning to the short basis generator and vector pairs $(a_i, \quad b_i = \langle s, a_i \rangle + e_i)$ and $e_i \ll q$, I use $s$ to encrypt text which produces $e$. Since $a_i$ is uniformly random, I take secret key $s$ as pair of $a$ and add it to the encrypted $e$. I now have $b_i$ which I pair with $a_i$. Now, any attempts to attack the scheme require finding $b_i$ compared to $a_i$, which is the SVP problem. To separate $b_i$ from $a_i$ after finding $b_i$, is the GapSVP problem. In the image below, the red vector represents the shortest non-zero vector, and the blue vectors are linearly independent of the red vectors and have basis $b_i$. The red vector is private key $s$, and the blue vectors represent the public key of $m$ samples $(\mathbf{a}_i, b_i)$ from LWE distribution with secret $s$, mod $q$, and error parameter $\alpha$. In the image you can easily see that neighboring points of the $s$ vector are approximate equidistant to the basis vector $b_i$, granting the security of private key $s$. To place final context on this answer, you have to determine if $(b_1,b_2)$ are at most distance $d$ from $s$.

SVP Problem

$\endgroup$
  • $\begingroup$ The only thing I don't understand is: In what sense am I looking for a shortest non-zero vector in LWE? What do s and bi stand for with regards to lattices? Thanks! $\endgroup$ – LQWE Feb 16 '17 at 6:41
  • $\begingroup$ (s) is the key for encrypted (e). These two are (b), and you need to separate (a) from (b) to start any attack. At the same time, (a) is also a generator paired with (s) which forms the vector. So you first need to find (a), and then determine if it satisfies conditions for (b). $\endgroup$ – nonce Feb 16 '17 at 7:08
  • $\begingroup$ To see how this fits within the context of lattices, this video is a good overview. The maths is nontrivial, but he uses graphs. Skip to 56:38. youtu.be/P3I3kCJedIo $\endgroup$ – nonce Feb 16 '17 at 7:17
  • $\begingroup$ It might help to explain in the answer how solving LWE relates to solving a lattice problem, i.e. what lattice this corresponds to and how a solution corresponds to a shortest vector in this lattice. $\endgroup$ – TMM Feb 16 '17 at 9:44
  • $\begingroup$ @TMM I've updated the answer to reflect your concerns. $\endgroup$ – nonce Feb 16 '17 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.