4

In the LWE assumption, if I set $m=n$, making $A$ an $n\times n$ square matrix, provided that $\det(A)\neq0(\mod q)$(i.e., full rank), is the LWE assumption still valid?

In this case, $A$ is invertible $\mod q$, one may recover the secret via $s=A^{-1}(b-e)$. But I think that the unknown noise vector $e$ still makes recovery hard.

X.H. Yue
  • 498
  • 3
  • 11

1 Answers1

4

Any choice of $m$ that is at most polynomial in the size of $n$ is a valid LWE instance. Moreover, in any instance where $m\ge n$ we could (with high probability) find a full rank subsystem which could be inverted as you describe. As you surmise the unknown vector $\mathbf e$ prevents recovery of $\mathbf s$. Indeed, absent further information about $\mathbf s$, we could recover a different, ostensibly legitimate solution for each choice of $A, \mathbf b, \mathbf e$, rendering the unique recovery of the causal solution impossible.

Daniel S
  • 29,316
  • 1
  • 33
  • 73