# Why don't we use an Extendable Output Function to efficiently store the public key of Regev's LWE-based encryption scheme over standard lattices?

In LWE-based schemes the public key is generated by choosing a random matrix (or polynomial) $A$, and outputting the pair $(A, b = A\cdot s + e)$, where $s$ and $e$ are vectors/polynomials with coefficients taken from some error distribution.

In the Kyber encryption scheme the first part (the matrix/polynomial $A$) is not a part of the public key. Instead they save the seed to the (publicly known) extendable output function (EOF) that was used to generate $A$. If someone wants to know the public key, then he can just ask for the seed and generate $A$ himself. This saves a lot of space.

Why is this not proposed for schemes based on general lattices (standard LWE)? The big problem of these standard LWE schemes is the huge public key size, but this EOF solution would resolve that. However, it is not mentioned in any of the implementations that I found, like this one.

I believe it is also used in other lattice based schemes that use standard LWE. For example, the Frodo paper. They used a $seed_A$ and a Gen($\cdot$) function to compute $A$. Then Alice sends $seed_A$ instead of $A$ for the actually exchange. Gen($\cdot$) is a prior-agreed pseudorandom function that extracts and extends the seed.