【转载】LWE问题简介

最新推荐文章于 2025-08-22 14:36:50 发布

转载最新推荐文章于 2025-08-22 14:36:50 发布 · 1.2k 阅读

1 ·

CC 4.0 BY-SA版权

原文链接：https://blog.youkuaiyun.com/qq_44925830/article/details/126288136

文章标签：

#网络安全

LWE 同时被 2 个专栏收录

1 篇文章

订阅专栏

同态加密算法

1 篇文章

订阅专栏

原文链接：https://blog.youkuaiyun.com/qq_44925830/article/details/126288136

文章目录

解线性方程组问题
LWE问题
搜索LWE问题
判定LWE问题
两个LWE问题之间的规约
LWE问题的复杂性结论
平均情况下的复杂性结论
其他版本的LWE问题
其他信息
论文索引

容错学习(learning with errors, LWE)问题就是求解带噪声的线性方程组问题, 由Oded Regev在[Reg05] 中提出, 他也因此结果荣获2018年的哥德尔奖. LWE问题的困难性基于的复杂性假设非常弱, 但是功能却异常强大, 由于LWE问题尚无有效的量子求解算法, 因此基于LWE假设的加密方案被认为是抗量子的.

LWE问题是求解带噪声的线性方程组问题. LWE问题的困难性基于的复杂性假设非常弱, 但是功能却异常强大, 由于LWE问题尚无有效的量子求解算法, 因此基于LWE假设的加密方案被认为是抗量子的.

终于到了介绍LWE的时间. LWE几乎是每个当代密码学学者\学生必须要有所了解的工具, 基于LWE, 我们能够构造一大批功能强大且安全的加密方案, 如选择密钥攻击安全的公钥加密方案(IND-CCA2 PKE), 有损加密方案(Lossy PKE), 基于属性加密(ABE), 全同态加密(FHE), 密钥交换(Key Exchange), 非交互零知识证明(NIZK), 程序混淆(Obfuscation)….

本文中, 我们将介绍LWE相关知识, 包括Basic Idea, 两种基本问题和他们之间的规约, 变体问题及其困难性规约, LWE算法的复杂性结论.

解线性方程组问题

没有什么可以说的呀, 求兼容的线性方程组的特解或者通解都是

    P
   
  
  
   \mathbf P
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord mathbf">P</span></span></span></span></span>问题. 我们说的方程之间不兼容, 实际上是就是以下一种情况:</p>

没有几个相互矛盾的方程, 比如一会儿又让

      x
     
     
      1
     
    
    
     +
    
    
     
      x
     
     
      2
     
    
    
     =
    
    
     1
    
   
   
    x_1+x_2=1
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.7333em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">x</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">x</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">2</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">1</span></span></span></span></span>, 一会儿又让<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      x
     
     
      1
     
    
    
     +
    
    
     
      x
     
     
      2
     
    
    
     =
    
    
     2
    
   
   
    x_1+x_2=2
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.7333em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">x</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">x</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">2</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">2</span></span></span></span></span>.</li></ul>

但是产生这种情况的情形, 可能是多种的:

消元消除了

     c
    
    
     =
    
    
     0
    
   
   
    c=0
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">c</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">0</span></span></span></span></span>, 其中<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     c
    
   
   
    c
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">c</span></span></span></span></span>是一个非零常数</li><li>两个方程系数有公约数, 模出来之后左边相同了右边又不同</li></ul>

不过, 大体上对于一个随机的

    m
   
  
  
   m
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span></span></span></span></span>元<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    n
   
  
  
   n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>个方程组成的模<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    q
   
  
  
   q
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span></span></span></span></span>方程组, 只要参数得当(比如不要作死选<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    m
   
   
    &lt;
   
   
    n
   
  
  
   m&lt;n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5782em; vertical-align: -0.0391em;"></span><span class="mord mathnormal">m</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">&lt;</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>), 得到的方程几乎是可以解的. 一种比较好的方式的, 首先编造出来方程的解, 再来随机生成系数得到方程, 这样生成的方程组始终是有解的. 无论是哪种方式, 我们要解决的问题都是求线性方程组的解. 求解下列方程是容易的:</p>

在这里插入图片描述

为了保持LWE问题研究的传统, 我们用

    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>来表示方程的解, 并称其为秘密向量. 这个问题是这样的, 首先, 挑战者(challenger)会均匀随机地选择一个<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    n
   
  
  
   n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>维的<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>作为解. 我们作为攻击者(adversary)可以不断地向挑战者索要方程地组中的一个方程. 实际上, 此时挑战者在先前并没有准备方程, 此时挑战者会均匀随机的选择行向量<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     a
    
    
     i
    
   
  
  
   \mathbf a_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5944em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>作为方程的系数, 然后计算<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     b
    
    
     i
    
   
   
    =
   
   
    
     a
    
    
     i
    
   
   
    ⋅
   
   
    s
   
  
  
   b_i=\mathbf a_i\cdot \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8444em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.5945em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>, 并将<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    (
   
   
    
     a
    
    
     i
    
   
   
    ,
   
   
    
     b
    
    
     i
    
   
   
    )
   
  
  
   (\mathbf a_i,b_i)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mclose">)</span></span></span></span></span>返回给攻击者. 攻击者在拿到一定数量(<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    m
   
  
  
   m
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span></span></span></span></span>个)的方程后可以构建方程组<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    A
   
   
    s
   
   
    =
   
   
    b
   
  
  
   \mathbf A\mathbf s=\mathbf b
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord mathbf">As</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathbf">b</span></span></span></span></span>, 可以很有把握地输出方程地解<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    x
   
  
  
   \mathbf x
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">x</span></span></span></span></span>. 这里的<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    A
   
  
  
   \mathbf A
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord mathbf">A</span></span></span></span></span>就是方程的系数矩阵即<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    A
   
  
  
   \mathbf A
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord mathbf">A</span></span></span></span></span>的每一行就是由<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     a
    
    
     1
    
   
   
    ,
   
   
    ⋯
    
   
    ,
   
   
    
     a
    
    
     m
    
   
  
  
   \mathbf a_1,\cdots, \mathbf a_m
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6389em; vertical-align: -0.1944em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="minner">⋯</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">m</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>构成. 实际上, 我们知道我们只要拿到<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    n
   
  
  
   n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>个线性无关<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     a
    
    
     i
    
   
  
  
   \mathbf a_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5944em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>构成的方程就可以成功解出<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    x
   
  
  
   \mathbf x
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">x</span></span></span></span></span>.</p>

如果我们将问题变得复杂一些呢? 此时攻击者不会直接给我们

    (
   
   
    
     a
    
    
     i
    
   
   
    ,
   
   
    
     b
    
    
     i
    
   
   
    =
   
   
    
     a
    
    
     i
    
   
   
    ⋅
   
   
    s
   
   
    )
   
  
  
   (\mathbf a_i,b_i=\mathbf a_i\cdot \mathbf s)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.5945em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord mathbf">s</span><span class="mclose">)</span></span></span></span></span>, 而是会在此基础上加一些料, 给<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     b
    
    
     i
    
   
  
  
   b_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8444em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>一些扰动<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    (
   
   
    
     a
    
    
     i
    
   
   
    ,
   
   
    
     b
    
    
     i
    
   
   
    =
   
   
    
     a
    
    
     i
    
   
   
    ⋅
   
   
    s
   
   
    +
   
   
    
     e
    
    
     i
    
   
   
    )
   
  
  
   (\mathbf a_i,b_i=\mathbf a_i\cdot \mathbf s+e_i)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.5945em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6667em; vertical-align: -0.0833em;"></span><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mclose">)</span></span></span></span></span>, 其中<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     e
    
    
     i
    
   
  
  
   e_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>服从一个均值为0, 方程较小的错误分布. 此时求解问题变成了求解这样的方程的解<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    x
   
  
  
   \mathbf x
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">x</span></span></span></span></span>.</p>

在这里插入图片描述

有两种极端的情况, 这两种情况是神仙也不能处理的:

方程数量过少, 只有小于或等于

     n
    
   
   
    n
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>个方程.</li><li>错误过大, 例如错误是均与随机的.</li></ul>

对于第一种情况, 我们如果按照线性方程组进行求解, 最好的情况也就是求出

    A
   
   
    s
   
   
    =
   
   
    e
   
   
    +
   
   
    b
   
  
  
   \mathbf A\mathbf s=\mathbf e+\mathbf b
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord mathbf">As</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6667em; vertical-align: -0.0833em;"></span><span class="mord mathbf">e</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathbf">b</span></span></span></span></span>唯一的特解, 由于我们不知道除了<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    e
   
  
  
   \mathbf e
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">e</span></span></span></span></span>的分布外有关它的任何信息, 根据这个信息来猜<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    x
   
  
  
   \mathbf x
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">x</span></span></span></span></span>, 结果不会太好. 例如, 如果<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    e
   
  
  
   \mathbf e
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">e</span></span></span></span></span>的每一行都是离散高斯分布, 且取到<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    0
   
  
  
   0
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">0</span></span></span></span></span>的概率是<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    C
   
  
  
   C
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6833em;"></span><span class="mord mathnormal" style="margin-right: 0.0715em;">C</span></span></span></span></span>, 由于<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     e
    
    
     i
    
   
  
  
   e_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>取<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    0
   
  
  
   0
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">0</span></span></span></span></span>的概率最大, 因此我们最佳的策略就是猜所有的<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     e
    
    
     i
    
   
   
    =
   
   
    0
   
  
  
   e_i=0
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">0</span></span></span></span></span>, 在这样最优的策略下, 我们正确解出<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    x
   
  
  
   \mathbf x
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">x</span></span></span></span></span>的概率是<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     C
    
    
     n
    
   
  
  
   C^n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6833em;"></span><span class="mord"><span class="mord mathnormal" style="margin-right: 0.0715em;">C</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.6644em;"><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">n</span></span></span></span></span></span></span></span></span></span></span></span>, 这是一个<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     n
    
    
     e
    
    
     g
    
    
     l
    
   
   
    (
   
   
    n
   
   
    )
   
  
  
   \mathsf{negl}(n)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathsf">negl</span></span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span>的概率.</p>

对于第二种情况, 另一种情况, 我们相当于拿到的

    (
   
   
    
     a
    
    
     i
    
   
   
    ,
   
   
    
     b
    
    
     i
    
   
   
    )
   
  
  
   (\mathbf a_i,b_i)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mclose">)</span></span></span></span></span>中的<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     b
    
    
     i
    
   
  
  
   b_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8444em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>永远是均匀的, 与<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>一点关系都没有, 又由于<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     a
    
    
     i
    
   
  
  
   \mathbf a_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5944em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>也是挑战者均匀选取的, 因此攻击者拿到的永远是均匀随机的<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    (
   
   
    
     a
    
    
     i
    
   
   
    ,
   
   
    
     b
    
    
     i
    
   
   
    )
   
  
  
   (\mathbf a_i,b_i)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mclose">)</span></span></span></span></span>, 也就与<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    x
   
  
  
   \mathbf x
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">x</span></span></span></span></span>无关的信息, 也就不可能能够求解出<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>.</p>

我在这里是不太想要讲解如何来解决这个问题的, 因为这里直接解释这个问题的Naive解法没有任何意义, 它需要用到BitDecomp的原理将方程

     a
    
    
     i
    
   
   
    ⋅
   
   
    s
   
   
    +
   
   
    
     e
    
    
     i
    
   
   
    =
   
   
    
     b
    
    
     i
    
   
  
  
   \mathbf{a}_i\cdot \mathbf s+e_i=b_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5945em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6667em; vertical-align: -0.0833em;"></span><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.8444em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>转化为<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     P
    
    
     o
    
    
     w
    
    
     e
    
    
     r
    
    
     o
    
    
     f
    
    
     2
    
   
   
    (
   
   
    
     a
    
    
     i
    
   
   
    )
   
   
    ⋅
   
   
    
     B
    
    
     i
    
    
     t
    
    
     D
    
    
     e
    
    
     c
    
    
     o
    
    
     m
    
    
     p
    
   
   
    (
   
   
    s
   
   
    )
   
   
    +
   
   
    
     e
    
    
     i
    
   
   
    =
   
   
    
     b
    
    
     i
    
   
  
  
   \mathsf{Powerof2}(\mathbf a_i)\cdot \mathsf{BitDecomp}(\mathbf s)+e_i=b_i
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathsf">Powerof2</span></span><span class="mopen">(</span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mclose">)</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathsf">BitDecomp</span></span><span class="mopen">(</span><span class="mord mathbf">s</span><span class="mclose">)</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.8444em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>后再做处理. 在学习完同态加密中BV11b方案后, 希望读者可以自行构造出naive的解法. 因此, 我将上述问题的naive算法作为了习题放在了介绍BV11b方案的文章中.</p>

LWE问题

有了上述基础, 现在我们可以介绍LWE问题. 最基本的LWE问题有着两个版本, 这两个版本分别对应计算复杂性中两类最基本的问题, 且两个问题之间存在多项式时间的归约. 我们将分别介绍两个版本的LWE问题, 再介绍它们之间的归约方法.

在介绍两类问题之前, 我们首先介绍一些基础知识. 首先是LWE分布.

LWE分布

给定某个

      s
     
     
      ∈
     
     
      
       Z
      
      
       q
      
      
       n
      
     
    
    
     \bf s\in \mathbb Z_q^n
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 1.072em; vertical-align: -0.3831em;"></span><span class="mord"><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">∈</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mord"><span class="mord mathbb">Z</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.6741em;"><span class="" style="top: -2.453em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathbf mtight">q</span></span></span><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathbf mtight">n</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.3831em;"><span class=""></span></span></span></span></span></span></span></span></span></span></span>和错误分布<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      χ
     
    
    
     \chi
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal">χ</span></span></span></span></span>, 定义LWE分布<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
       A
      
      
       
        s
       
       
        ,
       
       
        χ
       
      
     
    
    
     A_{\mathbf s,\chi}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.9694em; vertical-align: -0.2861em;"></span><span class="mord"><span class="mord mathnormal">A</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1611em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">s</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>为: 均匀选择<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      a
     
     
      ←
     
     
      
       Z
      
      
       q
      
      
       n
      
     
    
    
     \mathbf a\leftarrow \mathbb Z_q^n
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">a</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">←</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1.072em; vertical-align: -0.3831em;"></span><span class="mord"><span class="mord mathbb">Z</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.6644em;"><span class="" style="top: -2.453em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span></span></span><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">n</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.3831em;"><span class=""></span></span></span></span></span></span></span></span></span></span>并采样<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      e
     
     
      ←
     
     
      χ
     
    
    
     e\leftarrow \chi
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">e</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">←</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal">χ</span></span></span></span></span> ,计算<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      b
     
     
      =
     
     
      a
     
     
      ⋅
     
     
      s
     
     
      +
     
     
      e
     
    
    
     b=\mathbf a\cdot \mathbf s+e
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal">b</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.4445em;"></span><span class="mord mathbf">a</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6667em; vertical-align: -0.0833em;"></span><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">e</span></span></span></span></span>并输出<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      (
     
     
      a
     
     
      ,
     
     
      b
     
     
      )
     
    
    
     (\mathbf a,b)
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord mathbf">a</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord mathnormal">b</span><span class="mclose">)</span></span></span></span></span>.</p> </li></ul>

这里

    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>也就是秘密向量, 称<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    χ
   
  
  
   \chi
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal">χ</span></span></span></span></span>为噪声(或错误)分布, 称<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    e
   
  
  
   e
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">e</span></span></span></span></span>为噪声(或错误). 我们可以理解为, 每次从LWE分布<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     A
    
    
     
      s
     
     
      ,
     
     
      χ
     
    
   
  
  
   A_{\mathbf s,\chi}
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.9694em; vertical-align: -0.2861em;"></span><span class="mord"><span class="mord mathnormal">A</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1611em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">s</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>中采样, 都可以得到一个近似解为<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>的线性方程. 如果有一个专门提供这样的分布的Oracle, 那么我们就可以多次来调用该Oracle已积攒足够数量的方程来求解该问题. 应该注意到, <span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     A
    
    
     
      s
     
     
      ,
     
     
      χ
     
    
   
  
  
   A_{\mathbf s,\chi}
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.9694em; vertical-align: -0.2861em;"></span><span class="mord"><span class="mord mathnormal">A</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1611em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">s</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>中我们省略了参数<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    n
   
  
  
   n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>, 这是一种常用的写法, 因为这里的<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    n
   
  
  
   n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>可以根据上下文推出. 我们牺牲部分符号上的严谨性来与大多数论文统一符号, 来帮助读者快速熟悉这些记号.</p>

搜索LWE问题

搜索LWE问题(search LWE problem, SLWE)就是我们前边提到的解近似线性方程组的问题, 即

搜索LWE问题

SLWE

        n
       
       
        ,
       
       
        q
       
       
        ,
       
       
        χ
       
       
        ,
       
       
        m
       
      
     
    
    
     _{n,q,\chi,m}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>问题定义为: 给出<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
       A
      
      
       
        s
       
       
        ,
       
       
        χ
       
      
     
    
    
     A_{\mathbf s,\chi}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.9694em; vertical-align: -0.2861em;"></span><span class="mord"><span class="mord mathnormal">A</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1611em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">s</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的Oracle,<br> 在最多进行<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      m
     
    
    
     m
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span></span></span></span></span>次Oracle访问的情况下求<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      s
     
    
    
     \mathbf s
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>.</p> </li></ul>

该问题的表述可以是多种多样的, 有的表述中, 直接将

    m
   
  
  
   m
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span></span></span></span></span>个Oracle的结果一并给出, 即均匀选择<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    A
   
   
    ∈
   
   
    
     Z
    
    
     q
    
    
     
      m
     
     
      ×
     
     
      n
     
    
   
  
  
   \mathbf A\in\Z_q^{m\times n}
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.7252em; vertical-align: -0.0391em;"></span><span class="mord mathbf">A</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">∈</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1.1544em; vertical-align: -0.3831em;"></span><span class="mord"><span class="mord mathbb">Z</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.7713em;"><span class="" style="top: -2.453em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span></span></span><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">m</span><span class="mbin mtight">×</span><span class="mord mathnormal mtight">n</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.3831em;"><span class=""></span></span></span></span></span></span></span></span></span></span>和采样<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    e
   
   
    ←
   
   
    
     χ
    
    
     m
    
   
  
  
   \mathbf e\leftarrow\chi^m
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">e</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">←</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.8588em; vertical-align: -0.1944em;"></span><span class="mord"><span class="mord mathnormal">χ</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.6644em;"><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">m</span></span></span></span></span></span></span></span></span></span></span></span>, 计算<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    b
   
   
    =
   
   
    
     A
    
    
     s
    
   
   
    +
   
   
    e
   
  
  
   \mathbf b=\mathbf {As}+\mathbf e
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathbf">b</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.7694em; vertical-align: -0.0833em;"></span><span class="mord"><span class="mord mathbf">As</span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">e</span></span></span></span></span>, 根据<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    (
   
   
    A
   
   
    ,
   
   
    b
   
   
    )
   
  
  
   (\mathbf A,\mathbf b)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord mathbf">A</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord mathbf">b</span><span class="mclose">)</span></span></span></span></span>求<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>.</p>

一般来说, 我们会要求

    m
   
  
  
   m
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span></span></span></span></span>是一个有关于<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    n
   
  
  
   n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>的多项式, 即<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    m
   
   
    =
   
   
    m
   
   
    (
   
   
    n
   
   
    )
   
  
  
   m=m(n)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord mathnormal">m</span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span>是一个多项式函数. 毕竟, 对于一个只能在概率多项式时间内运行的攻击者是无法有充足的时间访问超多项式次Oracle的.</p>

判定LWE问题

判定LWE问题同其他判定一样, 要求输出的是YES/NO(或1/0).

判定LWE问题

DLWE

        n
       
       
        ,
       
       
        q
       
       
        ,
       
       
        χ
       
       
        ,
       
       
        m
       
      
     
    
    
     _{n,q,\chi,m}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>问题定义为: 给出<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      m
     
    
    
     m
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span></span></span></span></span>个来自一下两个分布中的任何一个的采样结果:</p> <p><span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
       A
      
      
       
        s
       
       
        ,
       
       
        χ
       
      
     
    
    
     A_{\mathbf s,\chi}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.9694em; vertical-align: -0.2861em;"></span><span class="mord"><span class="mord mathnormal">A</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1611em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">s</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>分布 <span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
       Z
      
      
       q
      
      
       n
      
     
     
      ×
     
     
      
       Z
      
      
       q
      
     
    
    
     \mathbb Z_q^n\times \mathbb Z_q
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 1.072em; vertical-align: -0.3831em;"></span><span class="mord"><span class="mord mathbb">Z</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.6644em;"><span class="" style="top: -2.453em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span></span></span><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">n</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.3831em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">×</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.975em; vertical-align: -0.2861em;"></span><span class="mord"><span class="mord mathbb">Z</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>上的均匀分布<br> 求采样结果所服从的分布.</p> </li></ul>

下文中, 我们统一输出结果的方式: 如果拿到的是

     A
    
    
     
      s
     
     
      ,
     
     
      χ
     
    
   
  
  
   A_{\mathbf s,\chi}
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.9694em; vertical-align: -0.2861em;"></span><span class="mord"><span class="mord mathnormal">A</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1611em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">s</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>分布, 输出<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    1
   
  
  
   1
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">1</span></span></span></span></span>为正确答案.</p>

如果两个版本的LWE问题要求

    m
   
  
  
   m
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span></span></span></span></span>均为多项式, 这个问题似乎这个问题看起来更加简单一些? 但是接下来我们将会发现, 这两个问题相互之间是可以概率多项式规约的, 即一台概率图灵机, 如果有求解两个问题中任何一个的Oracle的访问权限, 就可以在多项式时间内以压倒性概率求解另一个问题.</p>

两个LWE问题之间的规约

我们用

     O
    
    
     D
    
   
  
  
   \mathcal O_D
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8333em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathcal" style="margin-right: 0.0278em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3283em;"><span class="" style="top: -2.55em; margin-left: -0.0278em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0278em;">D</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>来表示与上下文相关的DLWE问题的求解器, 用<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     O
    
    
     S
    
   
  
  
   \mathcal O_S
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8333em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathcal" style="margin-right: 0.0278em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3283em;"><span class="" style="top: -2.55em; margin-left: -0.0278em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0576em;">S</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>来表示与上下文相关的SLWE的求解器. 这里参数<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    m
   
   
    =
   
   
    m
   
   
    (
   
   
    n
   
   
    )
   
  
  
   m=m(n)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord mathnormal">m</span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span>是有个有关<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    n
   
  
  
   n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>的多项式函数.</p>

DLWE

       n
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
     
    
   
   
    _{n,q,\chi,m}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span> <span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      ≤
     
     
      
       B
      
      
       P
      
      
       P
      
     
    
   
   
    \leq_\mathbf{BPP}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.786em; vertical-align: -0.15em;"></span><span class="mrel"><span class="mrel">≤</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3303em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">BPP</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span> SLWE<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
     
      
       n
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
     
    
   
   
    _{n,q,\chi,m}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span><br> 在拿到DLWE<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
     
      
       n
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
     
    
   
   
    _{n,q,\chi,m}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的实例<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     (
    
    
     
      A
     
     
      ,
     
     
      
       b
      
      
       )
      
     
    
   
   
    (\bf A, \bf b)
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord mathbf">A</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord"><span class="mord mathbf">b</span><span class="mclose">)</span></span></span></span></span></span></span>之后,<br> 我们调用SLWE<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
     
      
       n
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
     
    
   
   
    _{n,q,\chi,m}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的Oracle, 然后得到<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     s
    
    
     =
    
    
     
      O
     
     
      S
     
    
    
     (
    
    
     A
    
    
     ,
    
    
     b
    
    
     )
    
   
   
    \mathbf s=\mathcal O_S(\mathbf A,\mathbf b)
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathcal" style="margin-right: 0.0278em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3283em;"><span class="" style="top: -2.55em; margin-left: -0.0278em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0576em;">S</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathbf">A</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord mathbf">b</span><span class="mclose">)</span></span></span></span></span>, 然后检验<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     e
    
    
     =
    
    
     A
    
    
     s
    
    
     −
    
    
     b
    
   
   
    \mathbf e=\mathbf A\mathbf s-\mathbf b
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">e</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.7694em; vertical-align: -0.0833em;"></span><span class="mord mathbf">As</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathbf">b</span></span></span></span></span>是否服从<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      χ
     
     
      m
     
    
   
   
    \chi^m
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8588em; vertical-align: -0.1944em;"></span><span class="mord"><span class="mord mathnormal">χ</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.6644em;"><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">m</span></span></span></span></span></span></span></span></span></span></span></span>分布, 如果检验通过则输出<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     1
    
   
   
    1
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">1</span></span></span></span></span>, 否则输出<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     0
    
   
   
    0
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">0</span></span></span></span></span>.</li></ul>

我们非形式化地分析一下这个归约, 形式化的证明请读者自行完成. 假设我们拿到确实是LWE随机分布的随机变量, 这一随机变量交给SLWE的Oracle后我们的确能以非可忽略小的概率拿到

    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>, 重复多次后我们输出<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    1
   
  
  
   1
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">1</span></span></span></span></span>的概率也就是压倒性[1]的. 此处忽略了一些细节, 例如假设检验也有可能出错, 但是这些都是在我们能够处理的范围内.</p>

现在假设我们拿到的是非LWE分布的随机变量

    (
   
   
    A
   
   
    ,
   
   
    b
   
   
    )
   
  
  
   (\mathbf A,\mathbf b)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord mathbf">A</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord mathbf">b</span><span class="mclose">)</span></span></span></span></span>, 该随机变量只有可忽略小的概率是可以表示成LWE分布, 因此<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    s
   
   
    =
   
   
    
     O
    
    
     S
    
   
   
    (
   
   
    A
   
   
    ,
   
   
    b
   
   
    )
   
  
  
   \mathbf s= \mathcal O_S(\mathbf A,\mathbf b)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathcal" style="margin-right: 0.0278em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3283em;"><span class="" style="top: -2.55em; margin-left: -0.0278em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0576em;">S</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathbf">A</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord mathbf">b</span><span class="mclose">)</span></span></span></span></span>能够使得<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    e
   
   
    =
   
   
    
     A
    
    
     s
    
   
   
    −
   
   
    b
   
  
  
   \mathbf e=\mathbf {As}-\mathbf b
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">e</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.7694em; vertical-align: -0.0833em;"></span><span class="mord"><span class="mord mathbf">As</span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">−</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathbf">b</span></span></span></span></span>通过假设检验的概率是可忽略小的, 因此我们重复多项式次后也只能以可忽略小的概率输出<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    1
   
  
  
   1
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">1</span></span></span></span></span>.</p>

SLWE

       n
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
     
    
   
   
    _{n,q,\chi,m}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span> <span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      ≤
     
     
      
       B
      
      
       P
      
      
       P
      
     
    
   
   
    \leq_\mathbf{BPP}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.786em; vertical-align: -0.15em;"></span><span class="mrel"><span class="mrel">≤</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3303em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">BPP</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span> DLWE<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
     
      
       n
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
     
    
   
   
    _{n,q,\chi,m}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span><br> 首先是对于<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     q
    
   
   
    q
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span></span></span></span></span>是素数的情况. 假设我们得到了SLWE<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
     
      
       n
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
     
    
   
   
    _{n,q,χ,m}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的实例<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     (
    
    
     A
    
    
     ,
    
    
     b
    
    
     )
    
   
   
    (\mathbf{A},\mathbf b)
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mopen">(</span><span class="mord mathbf">A</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord mathbf">b</span><span class="mclose">)</span></span></span></span></span>,<br> 假设最终正确的结果是<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     s
    
   
   
    \mathbf s
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>, 我们来看如何用<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      O
     
     
      D
     
    
   
   
    \mathcal O_D
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8333em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathcal" style="margin-right: 0.0278em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3283em;"><span class="" style="top: -2.55em; margin-left: -0.0278em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0278em;">D</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>判断ss的第一位<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      s
     
     
      1
     
    
   
   
    s_1
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>是否为<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     k
    
   
   
    k
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal" style="margin-right: 0.0315em;">k</span></span></span></span></span>.</li></ul>

首先, 均匀选择

     r
    
    
     n
    
   
   
    ←
   
   
    
     Z
    
    
     q
    
   
  
  
   \mathbf r^n\leftarrow\mathbb Z_q
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6644em;"></span><span class="mord"><span class="mord mathbf">r</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.6644em;"><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">n</span></span></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">←</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.975em; vertical-align: -0.2861em;"></span><span class="mord"><span class="mord mathbb">Z</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>, 再将<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    A
   
  
  
   \mathbf A
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord mathbf">A</span></span></span></span></span>的第一列加上<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    r
   
  
  
   \mathbf r
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">r</span></span></span></span></span>得<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    A
   
   
    ’
   
  
  
   \mathbf A’
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathbf">A</span><span class="mord">’</span></span></span></span></span>, 并调用Oracle得到<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    d
   
   
    =
   
   
    
     O
    
    
     D
    
   
   
    (
   
   
    A
   
   
    ’
   
   
    ,
   
   
    b
   
   
    +
   
   
    k
   
   
    ⋅
   
   
    r
   
   
    )
   
  
  
   d=\mathcal O_D(\mathbf A’,\mathbf b+k\cdot \mathbf r)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal">d</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathcal" style="margin-right: 0.0278em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3283em;"><span class="" style="top: -2.55em; margin-left: -0.0278em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0278em;">D</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathbf">A</span><span class="mord">’</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord mathbf">b</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal" style="margin-right: 0.0315em;">k</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord mathbf">r</span><span class="mclose">)</span></span></span></span></span>. 显然, 如果<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     s
    
    
     1
    
   
   
    =
   
   
    k
   
  
  
   s_1=k
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal" style="margin-right: 0.0315em;">k</span></span></span></span></span>, 那么<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    d
   
   
    =
   
   
    
     O
    
    
     D
    
   
   
    (
   
   
    A
   
   
    ’
   
   
    ,
   
   
    b
   
   
    +
   
   
    k
   
   
    ⋅
   
   
    r
   
   
    )
   
  
  
   d=\mathcal O_D(\mathbf A’,\mathbf b+k\cdot \mathbf r)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal">d</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathcal" style="margin-right: 0.0278em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3283em;"><span class="" style="top: -2.55em; margin-left: -0.0278em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0278em;">D</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathbf">A</span><span class="mord">’</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord mathbf">b</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal" style="margin-right: 0.0315em;">k</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord mathbf">r</span><span class="mclose">)</span></span></span></span></span>就仍然是一个LWE的实例, 因为<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    A
   
   
    ’
   
   
    s
   
   
    =
   
   
    A
   
   
    s
   
   
    +
   
   
    
     s
    
    
     1
    
   
   
    ⋅
   
   
    r
   
   
    =
   
   
    b
   
   
    +
   
   
    k
   
   
    ⋅
   
   
    r
   
  
  
   \mathbf A’\mathbf s=\mathbf A\mathbf s+s_1\cdot \mathbf r=\mathbf b+k\cdot\mathbf r
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathbf">A</span><span class="mord">’</span><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.7694em; vertical-align: -0.0833em;"></span><span class="mord mathbf">As</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.5945em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">r</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.7778em; vertical-align: -0.0833em;"></span><span class="mord mathbf">b</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal" style="margin-right: 0.0315em;">k</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">r</span></span></span></span></span>, 其中<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    r
   
  
  
   \mathbf r
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">r</span></span></span></span></span>为每个元素均为<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    r
   
  
  
   r
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal" style="margin-right: 0.0278em;">r</span></span></span></span></span>的列向量. 如果<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     s
    
    
     1
    
   
   
    =
   
  
  
   s_1=
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span></span></span></span></span>的话, 那么<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    A
   
   
    ’
   
   
    s
   
   
    +
   
   
    e
   
   
    =
   
   
    A
   
   
    s
   
   
    +
   
   
    e
   
   
    =
   
   
    b
   
  
  
   \mathbf A’\mathbf s+\mathbf e=\mathbf A\mathbf s+\mathbf e=\mathbf b
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.7778em; vertical-align: -0.0833em;"></span><span class="mord mathbf">A</span><span class="mord">’</span><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">e</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.7694em; vertical-align: -0.0833em;"></span><span class="mord mathbf">As</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">e</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathbf">b</span></span></span></span></span>. 如果<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     s
    
    
     1
    
   
   
    ≠
   
   
    k
   
  
  
   s_1\neq k
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8889em; vertical-align: -0.1944em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel"><span class="mrel"><span class="mord vbox"><span class="thinbox"><span class="rlap"><span class="strut" style="height: 0.8889em; vertical-align: -0.1944em;"></span><span class="inner"><span class="mord"><span class="mrel"></span></span></span><span class="fix"></span></span></span></span></span><span class="mrel">=</span></span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal" style="margin-right: 0.0315em;">k</span></span></span></span></span>, 则将会是均匀分布. 显然如果<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     O
    
    
     D
    
   
  
  
   \mathcal O_D
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8333em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathcal" style="margin-right: 0.0278em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3283em;"><span class="" style="top: -2.55em; margin-left: -0.0278em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0278em;">D</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>是一个靠谱的Oracle (即具有多项式分之一的区分优势), 那么我们重复以上过程多次, 将会以压倒性的概率正确判定<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     s
    
    
     1
    
   
  
  
   s_1
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>是否为<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    0
   
  
  
   0
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">0</span></span></span></span></span>.</p>

如果

    q
   
   
    =
   
   
    poly
   
   
    (
   
   
    n
   
   
    )
   
  
  
   q=\text{poly}(n)
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord text"><span class="mord">poly</span></span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span>, 那么经过多项式次上述测试, 就可以压倒性的概率求出<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     s
    
    
     1
    
   
  
  
   s_1
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">s</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的值, 类似的可以依次求出<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>的其他分量.</p>

超多项式的

     q
    
   
   
    q
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span></span></span></span></span> 如果是指数大小的<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     q
    
   
   
    q
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span></span></span></span></span>, 上述方法就不是特别管用了.<br> 更好的办法就是用我们提到过的办法将方程<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      a
     
     
      i
     
    
    
     ⋅
    
    
     s
    
    
     +
    
    
     
      e
     
     
      i
     
    
    
     =
    
    
     
      b
     
     
      i
     
    
   
   
    \mathbf{a}_i\cdot \mathbf s+e_i=b_i
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.5945em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6667em; vertical-align: -0.0833em;"></span><span class="mord mathbf">s</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.8444em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>转化为<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      P
     
     
      o
     
     
      w
     
     
      e
     
     
      r
     
     
      o
     
     
      f
     
     
      2
     
    
    
     (
    
    
     
      a
     
     
      i
     
    
    
     )
    
    
     ⋅
    
    
     
      B
     
     
      i
     
     
      t
     
     
      D
     
     
      e
     
     
      c
     
     
      o
     
     
      m
     
     
      p
     
    
    
     (
    
    
     s
    
    
     )
    
    
     +
    
    
     
      e
     
     
      i
     
    
    
     =
    
    
     
      b
     
     
      i
     
    
   
   
    \mathsf{Powerof2}(\mathbf a_i)\cdot \mathsf{BitDecomp}(\mathbf s)+e_i=b_i
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathsf">Powerof2</span></span><span class="mopen">(</span><span class="mord"><span class="mord mathbf">a</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mclose">)</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">⋅</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathsf">BitDecomp</span></span><span class="mopen">(</span><span class="mord mathbf">s</span><span class="mclose">)</span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.5806em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">e</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.8444em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord mathnormal">b</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3117em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight">i</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>后再做处理, 如果<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     q
    
   
   
    q
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span></span></span></span></span>是一个奇素数,<br> 那么转换后的实例将也是LWE的实例, 且秘密向量都是<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
      B
     
     
      i
     
     
      t
     
     
      D
     
     
      e
     
     
      c
     
     
      o
     
     
      m
     
     
      p
     
    
    
     (
    
    
     s
    
    
     )
    
    
     ∈
    
    
     {
    
    
     0
    
    
     ,
    
    
     1
    
    
     
      }
     
     
      
       n
      
      
       log
      
      
       ⁡
      
      
       q
      
     
    
   
   
    \mathsf{BitDecomp}(\mathbf s)\in\{0,1\}^{n\log q}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord"><span class="mord mathsf">BitDecomp</span></span><span class="mopen">(</span><span class="mord mathbf">s</span><span class="mclose">)</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">∈</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1.0991em; vertical-align: -0.25em;"></span><span class="mopen">{<!-- --></span><span class="mord">0</span><span class="mpunct">,</span><span class="mspace" style="margin-right: 0.1667em;"></span><span class="mord">1</span><span class="mclose"><span class="mclose">}</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.8491em;"><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mspace mtight" style="margin-right: 0.1952em;"></span><span class="mop mtight"><span class="mtight">l</span><span class="mtight">o</span><span class="mtight" style="margin-right: 0.0139em;">g</span></span><span class="mspace mtight" style="margin-right: 0.1952em;"></span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span></span></span></span></span></span></span></span></span></span></span></span></span>. 这样一来就不是紧归约了, 但是对于对于<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     q
    
    
     =
    
    
     
      2
     
     
      
       poly
      
      
       (
      
      
       n
      
      
       )
      
     
    
   
   
    q=2^{\text{poly}(n)}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.888em;"></span><span class="mord"><span class="mord">2</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.888em;"><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord text mtight"><span class="mord mtight">poly</span></span><span class="mopen mtight">(</span><span class="mord mathnormal mtight">n</span><span class="mclose mtight">)</span></span></span></span></span></span></span></span></span></span></span></span></span>来说,<br> 我们仍有SLWE<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
     
      
       n
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
     
    
    
     
      ≤
     
     
      
       B
      
      
       P
      
      
       P
      
     
    
   
   
    _{n,q,\chi,m}\leq_\mathbf{BPP}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.9221em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel"><span class="mrel">≤</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3303em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathbf mtight">BPP</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>DLW<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     
     
      
       n
      
      
       log
      
      
       ⁡
      
      
       q
      
      
       ,
      
      
       q
      
      
       ,
      
      
       χ
      
      
       ,
      
      
       m
      
      
       ’
      
     
    
   
   
    _{n\log q,q,\chi,m’}
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6222em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3361em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mspace mtight" style="margin-right: 0.1952em;"></span><span class="mop mtight"><span class="mtight">l</span><span class="mtight">o</span><span class="mtight" style="margin-right: 0.0139em;">g</span></span><span class="mspace mtight" style="margin-right: 0.1952em;"></span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span><span class="mord mtight">’</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>,<br> 其中<span class="katex--inline"><span class="katex"><span class="katex-mathml">
 
  
   
    
     m
    
    
     ’
    
    
     =
    
    
     poly
    
    
     (
    
    
     n
    
    
     )
    
   
   
    m’=\text{poly}(n)
   
  
 </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6944em;"></span><span class="mord mathnormal">m</span><span class="mord">’</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord text"><span class="mord">poly</span></span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span>.</li></ul>

LWE问题的复杂性结论

最坏情况下的复杂性结论
首先介绍在[Reg05]中最经典的结论.

定理[Reg05]

对于任意

      m
     
     
      =
     
     
      poly
     
     
      (
     
     
      n
     
     
      )
     
    
    
     m=\text{poly}(n)
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord text"><span class="mord">poly</span></span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span>, 任意<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      q
     
     
      ≤
     
     
      
       2
      
      
       
        poly
       
       
        (
       
       
        n
       
       
        )
       
      
     
    
    
     q\leq 2^{\text{poly}(n)}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8304em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">≤</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.888em;"></span><span class="mord"><span class="mord">2</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.888em;"><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord text mtight"><span class="mord mtight">poly</span></span><span class="mopen mtight">(</span><span class="mord mathnormal mtight">n</span><span class="mclose mtight">)</span></span></span></span></span></span></span></span></span></span></span></span></span>和任意的高斯分布<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      χ
     
    
    
     \chi
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal">χ</span></span></span></span></span>满足<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      α
     
     
      q
     
     
      ≥
     
     
      2
     
     
      
       n
      
     
    
    
     \alpha q\geq 2\sqrt n
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8304em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">≥</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1.04em; vertical-align: -0.2397em;"></span><span class="mord">2</span><span class="mord sqrt"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.8003em;"><span class="svg-align" style="top: -3em;"><span class="pstrut" style="height: 3em;"></span><span class="mord mathnormal" style="padding-left: 0.833em;">n</span></span><span class="" style="top: -2.7603em;"><span class="pstrut" style="height: 3em;"></span><span class="hide-tail" style="min-width: 0.853em; height: 1.08em;">
         <svg width="400em" height="1.08em" viewBox="0 0 400000 1080" preserveAspectRatio="xMinYMin slice">
          <path d="M95,702

c-2.7,0,-7.17,-2.7,-13.5,-8c-5.8,-5.3,-9.5,-10,-9.5,-14
c0,-2,0.3,-3.3,1,-4c1.3,-2.7,23.83,-20.7,67.5,-54
c44.2,-33.3,65.8,-50.3,66.5,-51c1.3,-1.3,3,-2,5,-2c4.7,0,8.7,3.3,12,10
s173,378,173,378c0.7,0,35.3,-71,104,-213c68.7,-142,137.5,-285,206.5,-429
c69,-144,104.5,-217.7,106.5,-221
l0 -0
c5.3,-9.3,12,-14,20,-14
H400000v40H845.2724
s-225.272,467,-225.272,467s-235,486,-235,486c-2.7,4.7,-9,7,-19,7
c-6,0,-10,-1,-12,-3s-194,-422,-194,-422s-65,47,-65,47z
M834 80h400000v40h-400000z">
,
其中

      0
     
     
      &lt;
     
     
      α
     
     
      &lt;
     
     
      1
     
    
    
     0&lt;\alpha&lt;1
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6835em; vertical-align: -0.0391em;"></span><span class="mord">0</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">&lt;</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.5782em; vertical-align: -0.0391em;"></span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">&lt;</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">1</span></span></span></span></span>, 如果存在一个高效求解DLWE<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
      
       
        n
       
       
        ,
       
       
        q
       
       
        ,
       
       
        χ
       
       
        ,
       
       
        m
       
      
     
    
    
     _{n,q,\chi,m}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的算法,<br> 则存在一个高效求解<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      n
     
    
    
     n
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>维格上满足参数<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      γ
     
     
      =
     
     
      
       O
      
      
       ~
      
     
     
      (
     
     
      n
     
     
      /
     
     
      α
     
     
      )
     
    
    
     \gamma=\tilde O(n/\alpha)
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0556em;">γ</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1.1702em; vertical-align: -0.25em;"></span><span class="mord accent"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.9202em;"><span class="" style="top: -3em;"><span class="pstrut" style="height: 3em;"></span><span class="mord mathnormal" style="margin-right: 0.0278em;">O</span></span><span class="" style="top: -3.6023em;"><span class="pstrut" style="height: 3em;"></span><span class="accent-body" style="left: -0.1667em;"><span class="mord">~</span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mord">/</span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mclose">)</span></span></span></span></span>的GapSVP<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
      
       γ
      
     
    
    
     _\gamma
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0556em;">γ</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>和SIVP<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
      
       γ
      
     
    
    
     _\gamma
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0556em;">γ</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的量子算法.</p> </li></ul>

这里的

    α
   
   
    q
   
  
  
   \alpha q
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span></span></span></span></span>就是高斯分布的标准差. 该结论也就是所, 如果有高效算法能够解决满足以上参数的DLWE问题, 也就存在一个量子算法能够解决相应的参数的GapSVP问题和SIVP问题. 这里的高效算法指的是<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    B
   
   
    Q
   
   
    P
   
  
  
   \mathbf{BQP}
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8805em; vertical-align: -0.1944em;"></span><span class="mord"><span class="mord mathbf">BQP</span></span></span></span></span></span>算法. 能够归约到的GapSVP问题和SIVP问题的复杂度与参数<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    α
   
   
    q
   
  
  
   \alpha q
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span></span></span></span></span>的选择有关, 如果选择<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    α
   
   
    q
   
   
    =
   
   
    2
   
   
    
     n
    
   
  
  
   \alpha q=2\sqrt n
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1.04em; vertical-align: -0.2397em;"></span><span class="mord">2</span><span class="mord sqrt"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.8003em;"><span class="svg-align" style="top: -3em;"><span class="pstrut" style="height: 3em;"></span><span class="mord mathnormal" style="padding-left: 0.833em;">n</span></span><span class="" style="top: -2.7603em;"><span class="pstrut" style="height: 3em;"></span><span class="hide-tail" style="min-width: 0.853em; height: 1.08em;">
       <svg width="400em" height="1.08em" viewBox="0 0 400000 1080" preserveAspectRatio="xMinYMin slice">
        <path d="M95,702

     N
    
    
     P
    
   
   
    ∩
   
   
    
     c
    
    
     o
    
    
     N
    
    
     P
    
   
  
  
   \mathbf{NP}\cap \mathbf {coNP}
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord"><span class="mord mathbf">NP</span></span><span class="mspace" style="margin-right: 0.2222em;"></span><span class="mbin">∩</span><span class="mspace" style="margin-right: 0.2222em;"></span></span><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord"><span class="mord mathbf">coNP</span></span></span></span></span></span>的, 不太可能是一个<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    N
   
   
    P
   
  
  
   \mathbf{NP}
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6861em;"></span><span class="mord"><span class="mord mathbf">NP</span></span></span></span></span></span>完备问题.</p>

以上结论有用吗? 在GapSVP和SIVP有关的量子计算下的复杂性结论得出之前, 上述结论不能直接告诉我们什么. Chris Peikert与2009年在[Per09]中将上述结论经典化, 但参数会差一些:

定理[Pei09]

对于任意

      m
     
     
      =
     
     
      poly
     
     
      (
     
     
      n
     
     
      )
     
    
    
     m=\text{poly}(n)
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">m</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1em; vertical-align: -0.25em;"></span><span class="mord text"><span class="mord">poly</span></span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mclose">)</span></span></span></span></span>, 任意<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      q
     
     
      ≥
     
     
      
       2
      
      
       
        n
       
       
        /
       
       
        2
       
      
     
    
    
     q\geq 2^{n/2}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8304em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">≥</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.888em;"></span><span class="mord"><span class="mord">2</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.888em;"><span class="" style="top: -3.063em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mord mtight">/2</span></span></span></span></span></span></span></span></span></span></span></span></span>和任意的高斯分布<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      χ
     
    
    
     \chi
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal">χ</span></span></span></span></span>满足<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      α
     
     
      q
     
     
      ≥
     
     
      2
     
     
      
       n
      
     
    
    
     \alpha q\geq 2\sqrt n
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8304em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mord mathnormal" style="margin-right: 0.0359em;">q</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">≥</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1.04em; vertical-align: -0.2397em;"></span><span class="mord">2</span><span class="mord sqrt"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.8003em;"><span class="svg-align" style="top: -3em;"><span class="pstrut" style="height: 3em;"></span><span class="mord mathnormal" style="padding-left: 0.833em;">n</span></span><span class="" style="top: -2.7603em;"><span class="pstrut" style="height: 3em;"></span><span class="hide-tail" style="min-width: 0.853em; height: 1.08em;">
         <svg width="400em" height="1.08em" viewBox="0 0 400000 1080" preserveAspectRatio="xMinYMin slice">
          <path d="M95,702

      0
     
     
      &lt;
     
     
      α
     
     
      &lt;
     
     
      1
     
    
    
     0&lt;\alpha&lt;1
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.6835em; vertical-align: -0.0391em;"></span><span class="mord">0</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">&lt;</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.5782em; vertical-align: -0.0391em;"></span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">&lt;</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 0.6444em;"></span><span class="mord">1</span></span></span></span></span>, 如果存在一个高效求解DLWE<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
      
       
        n
       
       
        ,
       
       
        q
       
       
        ,
       
       
        χ
       
       
        ,
       
       
        m
       
      
     
    
    
     _{n,q,\chi,m}
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">n</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight" style="margin-right: 0.0359em;">q</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">χ</span><span class="mpunct mtight">,</span><span class="mord mathnormal mtight">m</span></span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的算法,<br> 则存在一个高效求解<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      n
     
    
    
     n
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4306em;"></span><span class="mord mathnormal">n</span></span></span></span></span>维格上满足参数<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      γ
     
     
      =
     
     
      
       O
      
      
       ~
      
     
     
      (
     
     
      n
     
     
      /
     
     
      α
     
     
      )
     
    
    
     \gamma=\tilde O(n/\alpha)
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.625em; vertical-align: -0.1944em;"></span><span class="mord mathnormal" style="margin-right: 0.0556em;">γ</span><span class="mspace" style="margin-right: 0.2778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right: 0.2778em;"></span></span><span class="base"><span class="strut" style="height: 1.1702em; vertical-align: -0.25em;"></span><span class="mord accent"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height: 0.9202em;"><span class="" style="top: -3em;"><span class="pstrut" style="height: 3em;"></span><span class="mord mathnormal" style="margin-right: 0.0278em;">O</span></span><span class="" style="top: -3.6023em;"><span class="pstrut" style="height: 3em;"></span><span class="accent-body" style="left: -0.1667em;"><span class="mord">~</span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">n</span><span class="mord">/</span><span class="mord mathnormal" style="margin-right: 0.0037em;">α</span><span class="mclose">)</span></span></span></span></span>的GapSVP<span class="katex--inline"><span class="katex"><span class="katex-mathml">
  
   
    
     
      
      
       γ
      
     
    
    
     _\gamma
    
   
  </span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4375em; vertical-align: -0.2861em;"></span><span class="mord"><span class=""></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.1514em;"><span class="" style="top: -2.55em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right: 0.0556em;">γ</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.2861em;"><span class=""></span></span></span></span></span></span></span></span></span></span>的算法.</p> </li></ul>

由于整个归约是纯经典的, 因此如果求解DLWE的高效算法是经典的, 那么得到的结论中, 高效求解GapSVP算法也就是经典的.

平均情况下的复杂性结论

其他版本的LWE问题

#错误分布与噪声分布相同
在BGV12同态加密方案中, 我们为了使得密钥

    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>的<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    
     ℓ
    
    
     1
    
   
  
  
   \ell_1
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.8444em; vertical-align: -0.15em;"></span><span class="mord"><span class="mord">ℓ</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height: 0.3011em;"><span class="" style="top: -2.55em; margin-left: 0em; margin-right: 0.05em;"><span class="pstrut" style="height: 2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight">1</span></span></span></span><span class="vlist-s"></span></span><span class="vlist-r"><span class="vlist" style="height: 0.15em;"><span class=""></span></span></span></span></span></span></span></span></span></span>较小哦啊, 而选择从噪声分布中选取<span class="katex--inline"><span class="katex"><span class="katex-mathml">

 
  
   
    s
   
  
  
   \mathbf s
  
 
</span><span class="katex-html"><span class="base"><span class="strut" style="height: 0.4444em;"></span><span class="mord mathbf">s</span></span></span></span></span>. 这里的安全性是有理论依据的. 在[ACPS09]中, 我们有如下结论:</p>

定理[ACPS09]

其他信息

有关Worst-case Hardness与Average-case Hardness的概念及讨论, 可以参考文章Levin’s Theorem, 当这篇文章写成后, 地址将被更新到这里.

论文索引

[ACPS09] B. Applebaum, D. Cash, C. Peikert, and A. Sahai. Fast cryptographic primitives and circular-secure encryption based on hard learning problems. In CRYPTO, pages 595-618. 2009.

[Pei09]

[Reg05] On Lattices, Learning with Errors, Random Linear Codes, and Cryptography. J. ACM, 56(6):1-40, 2009. Preliminary version in STOC 2005.

文章知识点与官方知识档案匹配，可进一步学习相关知识

算法技能树首页概览 31293 人正在系统学习中