Learning with Errors and Extrapolated Dihedral Cosets

Abstract

The hardness of the learning with errors (LWE) problem is one of the most fruitful resources of modern cryptography. In particular, it is one of the most prominent candidates for secure post-quantum cryptography. Understanding its quantum complexity is therefore an important goal. We show that under quantum polynomial time reductions, LWE is equivalent to a relaxed version of the dihedral coset problem (DCP), which we call extrapolated DCP (eDCP). The extent of extrapolation varies with the LWE noise rate. By considering different extents of extrapolation, our result generalizes Regev's famous proof that if DCP is in BQP (quantum poly-time) then so is LWE (FOCS 02). We also discuss a connection between eDCP and Childs and Van Dam's algorithm for generalized hidden shift problems (SODA 07). Our result implies that a BQP solution for LWE might not require the full power of solving DCP, but rather only a solution for its relaxed version, eDCP, which could be easier.

Advances in quantum cryptography

“…The research in quantum algorithms is not as mature as in classical algorithms, therefore the confidence we have on the hardness of problems still changes. For example, in a recent result [734] one of the best candidates for post-quantum cryptography, the learning-with-errors (LWE) problem, was proven to be equivalent to the dihedral-coset problem, for which there is a sub-exponential quantum algorithm. While this algorithm still would not fully break the security of LWE, it certainly weakens its security and one may wonder whether we should base the security of our communications on such computational assumptions.…”

Two quantum Ising algorithms for the shortest-vector problem

“…The quantum Fourier transform (QFT) plays a part in many quantum algorithms, such as those for solving variants of the hidden subgroup problem (HSP)-Shor's is an example. The dihedral coset problem is another type of HSP; a relaxed form, the extrapolated dihedral coset problem, has been shown to be equivalent to LWE [26]. Lattice problems in certain algebraic number fields can be solved using quantum HSP algorithms that compute unit groups [27] and principal ideals [28].…”

Quantum algorithms for typical hard problems: a perspective of cryptanalysis

“…In 2013, Li et al [77] present a quantum algorithm to generate the input of the two-point problem which hides the solution of LWE; then they give a new reduction from two-point problem to Fig. 6 From LWE to EDCP [80]. GR02 is the algorithm in [81]…”

“…In 2018, Brakerski et al [80] show the equivalence between LWE and the extrapolated dihedral coset problem (EDCP) by building quantum reductions between them. The EDCP problem over D N is specified as follows: Given many registers in a normalized state corresponding to…”

“…Fig.7From EDCP to LWE[80]. F Z n q is Fourier transform over Z n q , and U E DC P is the output state…”