Solving Learning With Errors Instances Using Quantum Reductions

Maria Schuld, Francesco Petruccione

Kyohei Sudo, Keisuke Hara, Masayuki Tezuka +1 more

The learning with errors (LWE) problem is one of the fundamental problems in cryptography and it has many applications in post-quantum cryptography. There are two variants of the problem, the decisional-LWE problem, and the search-LWE problem. LWE search-to-decision reduction shows that the hardness of the search-LWE problem can be reduced to the hardness of the decisional-LWE problem. The efficiency of the reduction can be regarded as the gap in difficulty between the problems. We initiate a study of quantum search-to-decision reduction for the LWE problem and propose a reduction that satisfies sample-preserving. In sample-preserving reduction, it preserves all parameters even the number of instances. Especially, our quantum reduction invokes the distinguisher only 2 times to solve the search-LWE problem, while classical reductions require a polynomial number of invocations. Furthermore, we give a way to amplify the success probability of the reduction algorithm. Our amplified reduction is incomparable to the classical reduction in terms of sample complexity and query complexity. Our reduction algorithm supports a wide class of error distributions and also provides a search-to-decision reduction for the learning parity with noise problem. In the process of constructing the search-to-decision reduction, we give a quantum Goldreich-Levin theorem over ℤq where q is a prime. In short, this theorem states that, if a hardcore predicate a・s (mod q) can be predicted with probability distinctly greater than (1/q) with respect to a uniformly random a ∈ ℤqn, then it is possible to determine s ∈ ℤqn.

Zvika Brakerski, Adeline Roux-Langlois, Chris Peikert +2 more

We show that the Learning with Errors (LWE) problem is classically at least as hard as standard worst-case lattice problems, even with polynomial modulus. Previously this was only known under quantum reductions. Our techniques capture the tradeoff between the dimension and the modulus of LWE instances, leading to a much better understanding of the landscape of the problem. The proof is inspired by techniques from several recent cryptographic constructions, most notably fully homomorphic encryption schemes.

Tran Quy Ban, Cat Luong, Susan A. Mengel

Yasuhito Kawano

The learning with errors (LWE) problem is a problem derived from machine learning that is believed to be intractable for quantum computers. This paper proposes a method that can reduce an LWE problem to a set of maximum independent set (MIS) problems, which are graph problems that are suitable for a quantum annealing machine to solve. The reduction algorithm can reduce an n-dimensional LWE problem to several small MIS problems with at most [Formula: see text] nodes when the lattice-reduction algorithm used in the LWE-reduction method successfully finds short vectors. The algorithm is useful for solving LWE problems in a quantum-classical hybrid manner by using an existing quantum algorithm to solve the MIS problems. For example, the smallest LWE challenge problem is reduced to MIS problems with about 40,000 vertices. This result means that the smallest LWE challenge problem will be within the scope of a real quantum computer in the near future.

Yaru Wang, Haodong Jiang, Zhi Ma +2 more