Abstract
In 2005, O.Regev proposed the first LWE public key cryptosystem at Tel Aviv University in Israel based on LWE distribution \(A_{s,\chi }\). Because of this paper, Regev won the highest award for theoretical computer science in 2018—the Godel Award. The size of public key is \(\tilde{O}(n^2)\) bits, and the size of private key s and ciphertext is \(\tilde{O}(n)\) bits. The plaintext encrypted each time is 1 bit. In fact, the LWE public key cryptosystem is a probabilistic cryptosystem, which depends on a high probability algorithm. Since the security of LWE problem has been clearly proved (see Chap. 3), the LWE cryptosystem has received extensive attention as soon as it was proposed, and it becomes the most cutting-edge research topic in the lattice-based cryptosystem study.
You have full access to this open access chapter, Download chapter PDF
In 2005, O.Regev proposed the first LWE public key cryptosystem at Tel Aviv University in Israel based on LWE distribution \(A_{s,\chi }\). Because of this paper, Regev won the highest award for theoretical computer science in 2018—the Godel Award. The size of public key is \(\tilde{O}(n^2)\) bits, and the size of private key s and ciphertext is \(\tilde{O}(n)\) bits. The plaintext encrypted each time is 1 bit. In fact, the LWE public key cryptosystem is a probabilistic cryptosystem, which depends on a high probability algorithm. Since the security of LWE problem has been clearly proved (see Chap. 3), the LWE cryptosystem has received extensive attention as soon as it was proposed, and it becomes the most cutting-edge research topic in the lattice-based cryptosystem study.
4.1 LWE Cryptosystem of Regev
Let \(n\geqslant 1\), \(q\geqslant 2\) be positive integers, \(\chi \) be a given probability distribution in \(\mathbb {Z}_q\). By Definition 4.3.1 in Chap. 3, the LWE distribution \(A_{s,\chi }\) is
where \(a\in \mathbb {Z}_q^n\) is uniformly distributed, \(s\in \mathbb {Z}_q^n\) is the private key chosen at random, \(e\in \mathbb {Z}_q\), \(e\leftarrow \chi \) is called error distribution. LWE cryptosystem depends on LWE distribution \(A_{s,\chi }\), and its workflow has the following three steps:
(1) Public key.
First we choose \(s\in \mathbb {Z}_q^n\) at random as the private key, let \(m=O(n\text {log}q)\). Then we choose m samples distributed from \(A_{s,\chi }\), \((a_i,b_i)\in \mathbb {Z}_q^n\times \mathbb {Z}_q\), \(e_i\in \mathbb {Z}_q\), \(e_i\leftarrow \chi \), \(1\leqslant i\leqslant m\). Let
where \(\overline{A}\) is a matrix uniformly at random, \(e\leftarrow \chi ^m\) indicates the m samples are independent. The public key of LWE cryptosystem is the following \((n+1)\times m\) matrix
If the uniformly random matrix \(\overline{A}\) is given and saved for all the users of LWE cryptosystem, then the true public key is \(b=\begin{pmatrix} b_1 \\ b_2 \\ \vdots \\ b_m \end{pmatrix}\in \mathbb {Z}_q^m\) with size \(O(m)=\tilde{O}(n)\). The public key and private key satisfy the following equation:
(2) Encryption.
In order to encrypt plaintext of 1 bit \(u\in \mathbb {Z}_2\), let \(x\in \{0,1\}^m\) be an uniformly distributed m dimensional vector with each entry 0 or 1. The ciphertext \(c\in \mathbb {Z}_q^{n+1}\) is an \((n+1)\) dimensional vector in \(\mathbb {Z}_q\), defined by
where \(0=\begin{pmatrix} 0 \\ 0 \\ \vdots \\ 0 \end{pmatrix}\in \mathbb {Z}_q^n\), \(u \lfloor \frac{q}{2}\rceil \in \mathbb {Z}_q\), \(\lfloor \frac{q}{2}\rceil \) is the nearest integer to \(\frac{q}{2}\). We call \(f_A\) the encryption algorithm of LWE. In order to understand the encryption algorithm better, we give another definition of \(f_A\).
The following set \(\{1,2,\dots ,m\}\) has \(2^m\) subsets. We choose a subset \(S\subset \{1,2,\dots ,m\}\) uniformly at random which is called the index set. Then the encryption algorithm \(f_A(u)\) for plaintext \(u\in \mathbb {Z}_2\) is
In fact, the subset S is corresponding to the uniformly chosen vector \(x\in \{0,1\}^m\). The above algorithm (4.1.5) was proposed by Regev originally.
(3) Decryption.
We use the private key \(s\in \mathbb {Z}_q^n\) for decryption of the ciphertext c. Actually we only need to decrypt for the last entry of vector c. We have
The error samples are much smaller than q, namely
Therefore, by comparing the distances between the right side of (4.1.6) and 0 or \(\lfloor \frac{q}{2}\rceil \), one can decrypt successfully:
finally we have \(f_A^{-1}(c)=u\) and finish the whole workflow of LWE cryptosystem.
Both of the encryption algorithm and decryption algorithm of LWE are probabilistic algorithms, so we should verify the correctness, namely
Here \(\delta (n)\) is a negligible function of n, i.e. \(\delta (n)=o\left( \frac{1}{\text {log}^{\epsilon }n}\right) \), \(\forall \epsilon >0\), more precisely:
We prove (4.1.9) with given discrete Gauss distribution \(\chi =\overline{\psi }_{\alpha }\). For \(a\in \mathbb {Z}_q\), \(\mathbb {Z}_q=\{0,1,\dots ,q-1\}\),
For \(x\in \mathbb {T}=[0,1)\), we define
Lemma 4.1.1
Let \(\delta >0\), \(0\leqslant k\leqslant m\), if the distribution \(\chi ^k\) satisfies
then (4.1.9) holds, i.e.
Proof
When we choose the error samples \(e_i\in \mathbb {Z}_q\), \(e_i\leftarrow \chi \), we can always guarantee \(e_i=|e_i|\) without changing the probability distribution. By (4.1.7), suppose that \(|S|=k\), the corresponding sample
As long as (4.1.7) holds, i.e.
then
   \(\square \)
Next we prove (4.1.12) holds for discrete Gauss distribution \(\overline{\psi }_{\alpha }\) in \(\mathbb {Z}_q\). The following assumptions are made for the selection of parameters:
where the symbol o indicates
For example, we can choose \(\alpha (n)=\frac{1}{\sqrt{n}\text {log}^2 n}\), or
Lemma 4.1.2
Under the condition for parameters of (4.1.13), for any \(0\leqslant k\leqslant m\), we have
where \(\delta (n)=o\left( \frac{1}{\text {log}^{\epsilon }n}\right) \), \(\forall \epsilon >0\), is a negligible function.
Proof
Based on (4.1.13), when \(n\geqslant n_0\), it is easy to see that
The k samples \(e=\begin{pmatrix} e_1 \\ \vdots \\ e_k \end{pmatrix}\) distributed as \(\overline{\psi }_{\alpha }^k\) could be obtained from the k samples \(x_1,x_2,\dots ,x_k\) of distribution \(\psi _{\alpha }\), where
Here the set of representative elements of \(\mathbb {Z}_q\) is
So we have
Note that
Therefore,
we have \(|e|<\lfloor \frac{q}{2}\rceil /2\). Since \(\sum \nolimits _{i=1}^k x_i\ \text {mod}\ 1\) distributed as \(\psi _{\sqrt{k}\alpha }\), where \(\sqrt{k}\cdot \alpha =o\left( \frac{1}{\sqrt{\text {log}n}}\right) \), so
where \(\delta (n)=\sqrt{k}\cdot \alpha =o\left( \frac{1}{\sqrt{\text {log}n}}\right) \). We complete the proof. Â Â Â \(\square \)
4.2 The Proof of Security
To prove the security of Regev’s cryptosystem, we first prove some general properties for the probability distribution of Abel group by Impagliazzo and Zurkerman Impagliazzo and Zuckerman (1989).
Let G be a finite Abel group, \(k\geqslant 1\) be a positive integer. For any l elements \(g_1,g_2,\dots ,g_l\in G\), suppose \(x\in \{0,1\}^l\), \(g=(g_1,g_2,\dots ,g_l)\), then
is called a subsum of \(\{g_1,g_2,\dots ,g_l\}\). Randomly choose \(x\in \{0,1\}^l\), let gx denote the distribution of subsum, and let U(G) denote the uniformly distribution on G.
Lemma 4.2.1
For any l elements \(\{g_1,g_2,\dots ,g_l\}\) uniformly at random, the expectation of statistical distance between the distribution of subsum and the uniformly distribution on U(G) is
Specially, the probability that the statistical distance is larger than \((|G|/2^l)^{\frac{1}{4}}\) is no more than \((|G|/2^l)^{\frac{1}{4}}\), i.e.
Proof
Let \(g=(g_1,g_2,\dots ,g_l)\) be l group elements chosen at random, \(h\in G\) is a given group element. Define \(P_g(h)\)
we call \(P_g(h)\) the distribution of subsum for g. In order to prove \(P_g(h)\) is close to uniformly distribution, we first prove the \(l_2\) norm between \(P_g(h)\) and the uniformly distribution is very small. In fact, we have:
Note that for any \(x\ne x'\),
So the expectation of \(l_2\) norm for g satisfy
Finally, we have the following estimation
We complete the proof. Â Â Â \(\square \)
The security of LWE public key cryptosystem by Regev is ascribed to the following theorem, which is the most important result in this chapter.
Theorem 4.2.1
For any \(\epsilon >0\), \(m\geqslant (1+\epsilon )(n+1)\text {log}q\), if there is a probabilistic polynomial time algorithm W which distinguishes the plaintext \(u=0\) or \(u=1\) from the ciphertext c, then there exists a polynomial time algorithm solving the \(\text {D-LWE}_{n,q,\chi ,m}\) problem.
Proof
The public key of LWE cryptosystem is \(A=\begin{pmatrix} \overline{A} \\ b' \end{pmatrix}\), where \(\overline{A}\in \mathbb {Z}_q^{n\times m}\) is a matrix uniformly at random, \(b=\begin{pmatrix} b_1 \\ \vdots \\ b_m \end{pmatrix}\in \mathbb {Z}_q^m\) is an m dimensional vector chosen uniformly. The encryption function \(f_A(u)\) is
Since W is a probabilistic polynomial time algorithm, suppose \(P_0(W)\) is the probability that decrypting \(u=0\) from \(f_A(0)\) by W, and \(P_1(W)\) is the probability that decrypting \(u=1\) from \(f_A(1)\), i.e.
If \(b\in \mathbb {Z}_q^m\) is uniformly at random, then LWE distribution \(A_{s,\chi }\) is uniformly LWE distribution. Let \(P_u(W)\) be the probability of decryption successfully by W under the condition of uniformly distribution \(A_{s,\chi }\). Suppose that
Under the assumption of (4.2.2), we will construct a new algorithm \(W'\) satisfying
By (4.2.2), we have
If the first inequality of the above formula holds, let \(W'=W\). If the second inequality of the above formula holds, then construct \(W'\) as follows. Let the function \(\sigma \) be \(f_A(u)\rightarrow f_A(u)+\begin{pmatrix} 0 \\ \frac{q-1}{2} \end{pmatrix}\).
Thus, \(\sigma \) maps the LWE distribution \((\overline{A},b)\) to \((\overline{A},b+\frac{q-1}{2})\). If b is uniformly at random, so is \(b+\frac{q-1}{2}\). We define \(W'\) to be the decryption on LWE distribution \((\overline{A},b+\frac{q-1}{2})\) by W. According to (4.1.5),
so \(W'\) is the algorithm which satisfies (4.2.3).
Let \(s\in \mathbb {Z}_q^n\), the public key sample satisfies distribution of \((\overline{A},b)\in \mathbb {Z}_q^{n\times m}\times \mathbb {Z}_q^m=A_{s,\chi }\). Let \(P_0(s)\) be the probability of decryption \(u=0\) successfully by \(W'\), i.e.
Similarly, let \(P_u(s)\) be the probability of decryption successfully by \(W'\) if \((\overline{A},b)\) is uniformly at random. Suppose
we define
It’s easy to prove: if \(s\in \mathbb {Z}_q^n\) is uniformly distributed, then we have
Therefore, in order to prove Theorem 4.2.1, we need to find an algorithm Z to determine whether the LWE distribution \(A_{s,\chi }\) is uniformly at random for any \(s\in Y\). The construction of algorithm Z: let R be a probability distribution on \(\mathbb {Z}_q^n\) which is uniform LWE distribution or general LWE distribution when \(s\in Y\), i.e.
Let \(\overline{A}=[a_1,\dots ,a_m]\in \mathbb {Z}_q^{n\times m}\), \(b=\begin{pmatrix} b_1 \\ \vdots \\ b_m \end{pmatrix}\in \mathbb {Z}_q^m\) be m random samples from distribution R. Let \(P_0(R)\) be the probability of decryption \(u=0\) successfully by \(W'\), where \((a,b)=A_{s,\chi }\), \(s\in Y\). In the same way, suppose \(P_u(R)\) is the probability of decryption \(u=0\) successfully by \(W'\) if R is uniform LWE distribution. We estimate \(P_0(R)\) and \(P_u(R)\) by using the algorithm \(W'\) polynomial times so that the error could be controlled within \(\frac{1}{64n^{\delta }}\). If \(|P_0(R)-P_u(R)|\geqslant \frac{1}{16n^{\delta }}\), then the algorithm Z is effective, otherwise it is noneffective.
We first confirm: if R is uniform LWE distribution, then Z is noneffective with high probability. Because in this case, \((\overline{A},b)\in \mathbb {Z}_q^{n\times m}\times \mathbb {Z}_q^m\), b is uniformly at random. According to Lemma 4.2.1, the Abel group \(G=\mathbb {Z}_q^n \times \mathbb {Z}_q\), we have
In this case, Z is noneffective.
If \(R=A_{s,\chi }\), where \(s\in Y\), we are to prove the algorithm Z is effective with probability \(\frac{1}{\text {Poly}(n)}\); i.e. one can distinguish \(s\in Y\) from uniform distribution. Since \(|P_0(R)-P_u(R)|\geqslant \frac{1}{4n^{\delta }}\), in the average sense we get
Thus, the algorithm Z is effective for \(A_{s,\chi }\), \(s\in Y\) with positive probability. We complete the proof of Theorem 4.2.1. Â Â Â \(\square \)
4.3 Properties of Rounding Function
The public key of LWE cryptosystem by Regev is \(A=\begin{pmatrix} \overline{A} \\ b' \end{pmatrix}\in \mathbb {Z}_q^{(n+1)\times m}\), where \(\overline{A}\in \mathbb {Z}_q^{n\times m}\) is a matrix uniformly at random, \(b=\begin{pmatrix} b_1 \\ \vdots \\ b_m \end{pmatrix}\in \mathbb {Z}_q^m\) is a uniform sample vector (see 4.1.2). In this section we will discuss the sampling technique of public key A based on rounding function.
For \(\forall x\in \mathbb {R}\), let \(\{x\}\) be the fractional part of x, \(\lfloor x\rceil \) be the closest integer to x, i.e.
In fact, \(\lfloor x\rceil \) is the only integer satisfying
We call \(\lfloor x\rceil \) rounding function, and its properties could be summarized as the following two lemmas.
Lemma 4.3.1
(i) \(\lfloor x+n\rceil =n+\lfloor x\rceil \), \(n\in \mathbb {Z}\), \(x\in \mathbb {R}\).
(ii) \(\lfloor -x\rceil =\left\{ \begin{array}{l} -\lfloor x\rceil ,\ \text {if}\ \{x\}\ne \frac{1}{2}.\\ -1-\lfloor x\rceil ,\ \text {if}\ \{x\}=\frac{1}{2}. \end{array} \right. \)
(iii) For any integers \(a,b\in \mathbb {Z}\), \(b\ne 0\), we have the following division: \(a=\lfloor \frac{a}{b}\rceil b+r\), where \(-\frac{b}{2}<r\leqslant \frac{b}{2}\).
(iv) \(\lfloor x\rceil +\lfloor y\rceil -1\leqslant \lfloor x+y\rceil \leqslant \lfloor x\rceil +\lfloor y\rceil +1\), \(\forall x,y\in \mathbb {R}\).
(v) \(\lfloor \frac{\lfloor x\rceil }{n}\rceil =\lfloor \frac{x}{n}\rceil \), \(\forall n\in \mathbb {Z}\), \(n\geqslant 1\), \(x\in \mathbb {R}\).
Proof
By (4.3.2),
so (i) holds. If \(\{x\}\ne \frac{1}{2}\), then \(r\ne \frac{1}{2}\), and \(-\frac{1}{2}<r<\frac{1}{2}\), we have
If \(r=\frac{1}{2}\), then \(\{x\}=\frac{1}{2}\), and \(1-r=\frac{1}{2}\), so that
we have (ii). Property (iii) and (iv) can be proved similarly. To prove (v), let \(x=\lfloor x\rceil +r\), then \(-\frac{1}{2n}<\frac{r}{n}\leqslant \frac{1}{2n}\), thus,
Lemma 4.3.1 holds. Â Â Â \(\square \)
Definition 4.3.1
Let t and q be two positive integers, we define function \(f:\mathbb {Z}\rightarrow \mathbb {Z}\) as
Lemma 4.3.2
Let \(a,b\in \mathbb {Z}\), then
Proof
Since \(a\equiv b\ (\text {mod}\ t)\), we write \(a=st+b\), therefore
So we have \(f(a)\equiv f(b)\ (\text {mod}\ q)\). Â Â Â \(\square \)
By the above lemma, f is a function from \(\mathbb {Z}_t\) to \(\mathbb {Z}_q\), we can define its ‘inverse function’ \(f^{-1}:\mathbb {Z}_q\rightarrow \mathbb {Z}_t\) as follows
Lemma 4.3.3
(i) If \(t\leqslant q\), then \(\forall a\in \mathbb {Z}\), we have
(ii) If \(t>q\), and \(a\in \mathbb {Z}\) is uniformly chosen at random, we have
Proof
We first prove (i). If \(t=q\), then
If \(t<q\), then \(\frac{q}{2t}>\frac{1}{2}\), based on the definition of rounding function,
it follows that
So we can get
this is equivalent to
Thus,
This means that
Next we prove (ii), at this time \(q<t\). By Lemma 4.3.2, we only need to consider how many elements a in \(\mathbb {Z}_t\) that satisfies \(f^{-1}f(a)\ne a\). By (i) we get
This is equivalent to
So we have
Here \(0,\left[ \frac{t}{q}\right] ,\left[ \frac{2t}{q}\right] ,\dots ,\left[ \frac{(q-1)t}{q}\right] \) are different from each other in \(\mathbb {Z}_t\). Next we prove that the number of a in \(\mathbb {Z}_t\) satisfying \(f^{-1}(f(a))=a\) is no more than q. Let A be the set containing all the elements satisfying \(f^{-1}(f(a))=a\) in \(\mathbb {Z}_t\). \(\forall a_1,a_2\in A\), \(a_1\ne a_2\) in \(\mathbb {Z}_t\), then we have \(f(a_1)\not \equiv f(a_2)\ (\text {mod}\ q)\), i.e. \(f(a_1)\ne f(a_2)\) in \(\mathbb {Z}_q\). This means the number of A is no more than q. Above all, it shows that \(0,\left[ \frac{t}{q}\right] ,\left[ \frac{2t}{q}\right] ,\dots ,\left[ \frac{(q-1)t}{q}\right] \) are just all the numbers in \(\mathbb {Z}_t\) such that \(f^{-1}(f(a))=a\). Based on a is uniformly chosen in \(\mathbb {Z}_t\), then
We complete the proof. Â Â Â \(\square \)
In order to generalize the function f and \(f^{-1}\) from one dimension to high dimension, we give the following definition.
Definition 4.3.2
Let t, q, l be positive integers, we define function \(F:\mathbb {Z}_t^l\rightarrow \mathbb {Z}_q^l\) as
and the ‘inverse function’ \(F^{-1}:\mathbb {Z}_q^l\rightarrow \mathbb {Z}_t^l\) as
Lemma 4.3.4
\(\forall a=(a_1,a_2,\dots ,a_l)\in \mathbb {Z}_t^l\), if a is uniformly at random and \(a_1,a_2,\dots ,a_l\) are mutually independent, we have
Proof
If \(t\leqslant q\), from Lemma 4.3.3,
So
If \(t>q\), from Lemma 4.3.3,
Since \(a_1,a_2,\dots ,a_l\) are independent, therefore,
We finish the proof. Â Â Â \(\square \)
4.4 General LWE-Based Cryptosystem
We introduced the LWE cryptosystem proposed by Regev in Sect. 4.1 and proved its security in Sect. 4.2. However, it could only encrypt a single bit of plaintext and the efficiency is low. Based on the definition and properties of rounding function given in Sect. 4.3, Regev presented a general LWE cryptosystem in 2009 Regev (2010), which could encrypt multiple bits of plaintext \(v\in \mathbb {Z}_t^l\) with size \(O(t^l)\) and improve the efficiency signally. In this section, we introduce general LWE cryptosystem first. Then we discuss the probability of decryption error for this cryptosystem and prove that it could be sufficiently small with suitable parameters. So we verify our core result that the LWE cryptosystem could have high security.
Let t, q, m, n, l, r be positive integers, \(q>t\), function F and its ‘inverse function’ are defined in 3.2. The workflow of general LWE cryptosystem is as follows:
(1) Selection of private key S: \(S\in \mathbb {Z}_q^{n\times l}\) is an \(n\times l\) matrix uniformly at random in \(\mathbb {Z}_q\).
In the LWE cryptosystem introduced in Sect. 4.1, the private key is an n dimensional randomly chosen vector \(s\in \mathbb {Z}_q^n\). To encrypt more general plaintext \(v\in \mathbb {Z}_t^l\), we randomly select l private keys \(s_1,s_2,\dots ,s_l\in \mathbb {Z}_q^n\) independently and form an \(n\times l\) matrix \(S=[s_1,s_2,\dots ,s_l]\). This is the private key S for general LWE cryptosystem.
(2) Public key.
When the private key \(S\in \mathbb {Z}_q^{n\times l}\) is fixed, in order to choose samples from LWE distribution, we first select m uniform n dimensional vectors \(a_1,a_2,\dots ,a_m\in \mathbb {Z}_q^n\) in \(\mathbb {Z}_q^n\) and form a uniform random matrix
Then we generate \(m\times l\) noise matrix samples \(E=(E_{ij})_{m\times l}\) from distribution \(\overline{\psi }_{\alpha }\), where \(\overline{\psi }_{\alpha }\) is defined by (4.4.1) and (3.3.13), i.e. \(E_{ij}\in \mathbb {Z}_q\), \(E_{ij}\leftarrow \overline{\psi }_{\alpha }\), \(1\leqslant i\leqslant m\), \(1\leqslant j\leqslant l\), and the \(m\times l\) samples are mutually independent. Finally we get an \(m\times l\) matrix P
The public key of LWE cryptosystem is (A, P), which is similar to that in Sect. 4.1. Here we only change the public key from \(b\in \mathbb {Z}_q^m\) to \(m\times l\) matrix \(P\in \mathbb {Z}_q^{m\times l}\). If the uniformly random matrix A is given and saved for all the users of LWE cryptosystem, then the true public key is the matrix P, and the public key and private key satisfy the following equation
(3) Encryption.
To encrypt multiple bits of plaintext \(v\in \mathbb {Z}_t^l\), let \(a\in \{-r,-r+1,\dots ,r\}^m\) be an m dimensional vector with each entry selected uniformly in \(\{-r,-r+1,\dots ,r\}\), i.e. a is uniformly distributed. Ciphertext \(\begin{pmatrix} u\\ c \end{pmatrix}\) is an \(n+l\) dimensional vector, defined by
where F is defined in (4.3.6), and \(g_{A,P}\) is called the encryption algorithm of LWE cryptosystem.
(4) Decryption.
Given ciphertext (u, c) and the private key S, we compute \(F^{-1}(c-S^T u)\) as the result of decryption. We have
Next we calculate the probability of decryption error for this cryptosystem, namely the probability of \(F^{-1}(E^{T}a+F(v))\ne v\). The following Theorem 4.4.1 gives an estimation for this probability, which is the main result of this section.
Theorem 4.4.1
Suppose \(q>t\), we have the following inequality of the probability of decryption error
Here \(\Phi \) is the cumulative distribution function of the standard normal distribution, i.e. \(\Phi (x)=\int _{-\infty }^{x} \frac{1}{\sqrt{2\pi }} e^{-\frac{t^2}{2}} \textrm{d}t\).
Proof
Denote \(v{=}(v_1,v_2,\dots ,v_l)\), \(E_{m\times l}=(E_1,E_2,\dots ,E_l)\), where \(E_1,E_2,\dots ,E_l\) are all m dimensional column vectors. Let \(f^{-1}(E_i^{T}a+f(v_i))\) be the ith coordinate of \(F^{-1}(E^{T}a+F(v))\), \(1\leqslant i\leqslant l\). According to the definition of rounding function,
So if \(\left| \frac{t}{q}E_i^{T}a\right| <\frac{1}{2}-\frac{t}{2q}\), we get
It follows that
this means
namely if \(|\frac{t}{q}E_i^{T}a|<\frac{1}{2}-\frac{t}{2q}\), we can get \(f^{-1}(E_i^{T}a+f(v_i))=v_i\). Equivalently, if \(f^{-1}\left( E_i^{T}a+f(v_i)\right) \ne v_i\), i.e. the decryption error occurs in the ith letter, then \(\left| \frac{t}{q}E_i^{T}a\right| \geqslant \frac{1}{2}-\frac{t}{2q}\). So the probability of decryption error in one letter is no more than the probability of \(\left| \frac{t}{q}E_i^{T}a\right| \geqslant \frac{1}{2}-\frac{t}{2q}\), i.e.
The next step we estimate the probability of \(|\frac{t}{q}E_i^{T}a|\geqslant \frac{1}{2}-\frac{t}{2q}\). Since each coordinate of \(E_i\) is chosen independently from the Gaussian distribution with mean 0 and standard deviation \(\alpha q/\sqrt{2\pi }\) and the sum of independent Gaussian variables is still a Gaussian variable, \(E_i^{T}a\) is also a Gaussian distribution variable. Let \(a=(a_1,a_2,\dots ,a_m)\) and each \(a_i\) is chosen from \(\{-r,-r+1,\cdots ,r\}\) uniformly at random, then
Therefore \(E_i^{T}a\) is treated as a normal distribution with mean 0 and standard deviation \(\alpha q\sqrt{mr(r+1)}/\sqrt{6\pi }\). We have
So we get the following inequality for probability of decryption error of the LWE cryptosystem
   \(\square \)
The upper bound could be as closed as 0 if we choose \(\alpha \) small enough. It means that the probability of decryption error for the LWE cryptosystem could be made very small with an appropriate setting of parameters.
4.5 Probability of Decryption Error for General Disturbance
In this section we estimate the probability of decryption error for the LWE cryptosystem when the noise matrix \(E=(E_{ij})_{m\times l}\) is chosen independently from a general common variable, rather than Gauss distribution. We have the following theorem.
Theorem 4.5.1
\(q>t\), \(E=(E_{ij})_{m\times l}\), each element \(E_{ij}\) is selected independently from a common random variable of mean 0 and standard deviation \(\beta \). For any \(\delta >0\), we can find positive integer m, such that the following inequality of the probability of decryption error holds,
Here \(\Phi \) is the cumulative distribution function of the standard normal distribution, i.e. \(\Phi (x)=\int _{-\infty }^{x} \frac{1}{\sqrt{2\pi }} e^{-\frac{t^2}{2}} \textrm{d}t\).
Proof
Similarly as the proof of Theorem 4.4.1, we need to estimate the probability of \(|\frac{t}{q}E_i^{T}a|\geqslant \frac{1}{2}-\frac{t}{2q}\). Since the coordinates of \(E_i^{T}\) are independent identically distributed, \(E_i^{T}\) and a are also independent. By central limit theorem Riauba (1975), \(E_i^{T}a\) is approximately normal distribution with mean 0 and standard deviation \(d=\sqrt{mVar(E_{ij}) Var(a_i)}=\beta \sqrt{\frac{mr(r+1)}{3}}\). Thus, for any sufficiently small \(\delta >0\), there is a positive integer m such that
Here \(|\varepsilon |\leqslant \delta \). Then we get the following inequality for probability of decryption error of the LWE cryptosystem for general disturbance
   \(\square \)
This probability could be also closed to 0 if we choose the parameter \(\beta \sqrt{m}\) and \(\delta \) small enough. Therefore the probability of decryption error of the LWE cryptosystem for general disturbance could be made very small, which leads to high security.
Example 4.5.1
Let \(t=2\), \(q=5\), \(l=1\), \(m=1\), \(r=1\), \(\delta =10^{-3}\), \(\beta =10^{-3}\), \(v\in \mathbb {Z}_2\) is uniformly chosen at random, the disturbance E is a random variable with the distribution \(\psi _{\beta }\) such that \(P\{E=k\}=\frac{\beta ^k}{2\cdot k!} e^{-\beta }\) for positive integer k and \(Pr\{E=0\}=e^{-\beta }\), \(a\in \{-1,0,1\}\) is uniformly chosen at random. Then the probability of decryption error
On the other hand,
So it follows that
The inequality in Theorem 4.5.1 holds.
Example 4.5.2
Let \(t=2\), \(q=5\), \(l=1\), \(m=1\), \(r=1\), \(\delta =10^{-4}\), \(\lambda =0.05\), \(v\in \mathbb {Z}_2\) is uniformly chosen at random, the disturbance E is a Laplace distribution variable with probability density function \(f(x)=\frac{1}{2\lambda }e^{-\frac{|x|}{\lambda }}\) rounding to the nearest integer, \(a\in \{-1,0,1\}\) is uniformly chosen at random. Similarly as Example 4.5.1, the probability of decryption error
On the other hand,
We have
The inequality in Theorem 4.5.1 holds.
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.
Copyright information
© 2023 The Author(s)
About this chapter
Cite this chapter
Zheng, Z., Tian, K., Liu, F. (2023). LWE Public Key Cryptosystem. In: Modern Cryptography Volume 2. Financial Mathematics and Fintech. Springer, Singapore. https://doi.org/10.1007/978-981-19-7644-5_4
Download citation
DOI: https://doi.org/10.1007/978-981-19-7644-5_4
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-19-7643-8
Online ISBN: 978-981-19-7644-5
eBook Packages: Economics and FinanceEconomics and Finance (R0)