On the Hardness of Module-LWE with Binary Secret

Abstract

We prove that the Module Learning With Errors (M-LWE) problem with binary secrets and rank d is at least as hard as the standard version of M-LWE with uniform secret and rank k, where the rank increases from k to d ≥ (k + 1) log 2 q + ω(log 2 n), and the Gaussian noisewhere n is the ring degree and q the modulus. Our work improves on the recent work by Boudgoust et al. in 2020 by a factor of √ md in the Gaussian noise, where m is the number of given M-LWE samples, when q fulfills some number-theoretic requirements. We use a different approach than Boudgoust et al. to achieve this hardness result by adapting the previous work from Brakerski et al. in 2013 for the Learning With Errors problem to the module setting. The proof applies to cyclotomic fields, but most results hold for a larger class of number fields, and may be of independent interest.

A Survey on Exotic Signatures for Post-quantum Blockchain: Challenges and Research Directions

“…Concrete aggregated signature size of 36 bytes at 128-bit security level is reported in [59]. However, it was recently pointed out [31] that the compressing linear map used in MMSAT and MMSATK implies that the security of these aggregate signatures relies on the hardness of a problem we call T-Vandermonde-SIS, a variant of Vandermonde-SIS but with signiicantly reduced security against lattice attacks with the parameter choices in [59]. Consequently, only the 'response' part of the signature can be securely aggregated, not the 'commitment' part.…”

“…Consequently, only the 'response' part of the signature can be securely aggregated, not the 'commitment' part. Due to a similar issue, the aggregatable signature from M-LWE and M-SIS problems constructed in [31] also does not produce substantially shorter signatures than concatenated regular signatures.…”