2

The standard SIS problem present as below.

SIS Problem. Let $A\in\mathbb{Z}_q^{n\times m}$ be an $n\times m$ matrix with entries in $\mathbb{Z}_q$ that consists of $m$ uniformly random vectors $\boldsymbol{a_i}\in\mathbb{Z}_q^n{:}A=[\boldsymbol{a_1}|\cdots|\boldsymbol{a_m}]$. Find a nonzero vector $\boldsymbol{x}\in\mathbb{Z}^m$ such that for some norm $\|\cdot\|:$ $\begin{aligned}&\bullet0<\|\boldsymbol{x}\|\leq\beta,\\ &\bullet f_A(\boldsymbol{x}):=A\boldsymbol{x}=\boldsymbol{0}\in\mathbb{Z}_q^n.\end{aligned}$.

My lattice problem, or called SIS with noise problem, is:

Let $B=A+E\in\mathbb{Z}_q^{n\times n}$ be an $n\times n$ matrix with entries in $\mathbb{Z}_q$ that consists of $n$ uniformly random vectors $\boldsymbol{a_i}\in\mathbb{Z}_q^n{:}A=[\boldsymbol{a_1}|\cdots|\boldsymbol{a_n}]$, $E\gets\mathbb{Z}^{n\times n}_q$ is a noise matrix and each entry in $E$ is smaller than $\alpha$. Find a nonzero vector $\boldsymbol{x}\in\mathbb{Z}^n$ such that for some norm $\|\cdot\|:$

$\begin{aligned} &\bullet 0<\|\boldsymbol{x}\|\leq\beta,\\ &\bullet \boxed{0<\|B\boldsymbol{x}\|\leq\gamma}. \end{aligned}$ where $\beta,\gamma\ll q,\gamma:=\alpha\cdot\beta$, and $A$ comes from SIS when $n=m$.

Note that, the adversary only known $B,n,q$ and $\gamma$.

For example, $q>2^\lambda,\beta<2^{\frac{\lambda}{8}},\gamma<2^{\frac{\lambda}{2}}$ and $\lambda=128,n=256$.

Similarly, this question discusses the hardness for the ISIS problem in the case of $Ax=b,b\neq 0$ and $m=n$. However, an additional condition in my problem is the bound of the result, i.e, we require $0<\|b\|<\gamma$.

Can the above problem reduce to the SIS problem, LWE problem or ISIS problem? Or the problem is easy when we bound the range of output of $Bx$?

X.H. Yue
  • 498
  • 3
  • 11

0 Answers0