I am currently reading the ETSI white paper Quantum Safe Cryptography and Security
On page 24 one finds the following statement:
Lattice problems also benefit from something called worst-case to average-case reduction, which means that all keys are as hard to break in the easiest case as in the worst case when setting up any of the parameters of a lattice based cryptosystem. In a crypto system like RSA, generating keys involves picking two very large random numbers, that should be prime and should yield a hard instance of the factorization problem, but there is a certain degree of probability of choosing wrong and resulting in a weak security level. In lattice-based cryptography, all possible key selections are strong and hard to solve.
This puzzled me, because I had a different understanding of worst-case to average case reduction in lattices. According to my understanding it means the following:
A lattice cryptosystem on the average (i.e. with randomly chosen keys) is as hard as the hardest problem of the underlying lattice problem. This does not imply that all possible key selections are strong and hard to solve.
Now, who is wrong? Me or ETSI ?