[Paper Review] On the hardness of the Learning with Errors problem with a discrete reproducible error distribution

Filipp Valovich|arXiv (Cornell University)|May 6, 2016

Cryptography and Data Security3 citations

TL;DR

This paper establishes the average-case hardness of the Learning with Errors (LWE) problem when errors follow a symmetric Skellam distribution, leveraging lossy codes and a sample-preserving search-to-decision reduction. The key contribution is a post-quantum cryptographic protocol for differentially private data analysis in the distributed model, where the same Skellam noise ensures both cryptographic security and differential privacy, achieving optimal accuracy with a tight security-accuracy trade-off.

ABSTRACT

In this work we show that the hardness of the Learning with Errors problem with errors taken from the discrete Gaussian distribution implies the hardness of the Learning with Errors problem with errors taken from the symmetric Skellam distribution. Due to the sample preserving search-to-decision reduction by Micciancio and Mol the same result applies to the decisional version of the problem. Thus, we provide a variant of the Learning with Errors problem that is hard based on conjecturally hard lattice problems and uses a discrete error distribution that is similar to the continuous Gaussian distribution in that it is closed under convolution. As an application of this result we construct a post-quantum cryptographic protocol for differentially private data anlysis in the distributed model. The security of this protocol is based on the hardness of the new variant of the Decisional Learning with Errors problem. A feature of this protocol is the use of the same noise for security and for differential privacy resulting in an efficiency boost.

Motivation & Objective

• To establish the average-case hardness of the LWE problem under a symmetric Skellam error distribution, which is reproducible and discrete, unlike the standard discrete Gaussian.
• To enable a post-quantum, distributed protocol for differentially private data analysis where cryptographic security and privacy are simultaneously achieved via the same noise.
• To reduce the reliance on discrete Gaussian distributions in LWE-based cryptography by introducing a new, practically efficient error distribution with favorable algebraic and probabilistic properties.
• To demonstrate that the Skellam distribution supports a sample-preserving search-to-decision reduction, extending the hardness of LWE to its decisional variant under this new error model.
• To construct a Private Stream Aggregation (PSA) scheme based on the new LWE variant, where noise generation is both secure and privacy-preserving in a distributed setting.

Proposed method

• The authors use lossy codes from prior work to construct a worst-case-to-average-case reduction, showing that solving the LWE problem with symmetric Skellam errors implies solving the worst-case lattice problems SIVP and GAPSVP.
• They define the error distribution as the symmetric Skellam distribution Sk_μ with variance μ = (ρq)²/4, ensuring reproducibility and discrete support suitable for cryptographic operations.
• A sample-preserving search-to-decision reduction is applied, showing that the decisional version of the LWE problem with Skellam errors is as hard as the search version.
• The protocol uses the same Skellam noise for both security (via the DLWE assumption) and differential privacy (via the Skellam mechanism), eliminating the need for separate noise sources.
• The security parameter κ is set such that μ/n = λ²κ, ensuring that the noise is large enough to resist quantum attacks while remaining efficient for distributed noise aggregation.
• The accuracy of the final statistics is analyzed under sequential composition, with bounds derived using logarithmic terms in β and δ to quantify (α, β)-accuracy.

Experimental results

Research questions

• RQ1 Can the hardness of the LWE problem be established for a discrete, reproducible error distribution other than the discrete Gaussian?
• RQ2 Does the symmetric Skellam distribution support a sample-preserving search-to-decision reduction in the LWE setting?
• RQ3 Can a single noise distribution be used to simultaneously ensure cryptographic security and differential privacy in a distributed protocol?
• RQ4 What is the minimal variance of the Skellam distribution required to maintain hardness under the LWE assumption?
• RQ5 Can the Ring-LWE problem be made hard with Skellam errors, and does it support a search-to-decision reduction?

Key findings

• The LWE problem with symmetric Skellam errors is as hard as the worst-case lattice problems SIVP and GAPSVP, with approximation factors of Õ(λκ/ρ) when the error variance is set to (ρq)²/4.
• The decisional version of the LWE problem with Skellam errors is hard under the same assumptions, due to the sample-preserving search-to-decision reduction from Micciancio and Mol.
• A post-quantum Private Stream Aggregation (PSA) scheme is constructed where the same Skellam noise provides both cryptographic security and differential privacy, achieving computational (ε,δ)-DP.
• The protocol achieves (α, β)-accuracy per query of Ω(λ√(κn)), which is optimal with respect to sequential composition and matches known lower bounds.
• For a concrete example with n=20,000 users, m=1000, ε=1, δ=0.1, and κ=200, the required noise variance satisfies the hardness condition, ensuring both security and privacy.
• The security and privacy trade-off is formalized: ε ≤ √(2m² log(1/δ)/(κn)), showing that privacy loss depends inversely on the square root of the security parameter and number of users.