格密码学重要概念: 高斯平滑参数

简介:格最短向量范数‘密度’的下界。

¹第一次提到平滑参数
Micciancio2007提到的平滑参数。²
平滑参数是格上高斯的一个测量值，类似与高斯函数的偏差。

1 为什么要用到平滑参数？

实际上，平滑参数只是定义了一个临界值，当格上的离散高斯分布的标准方差大于此参数时，那么从此分布中选取的点在模格的单元平行多面体中后，几乎将服从均匀随机分布，而当小于此参数时，则不服从均匀随机分布。

2 什么是平滑参数？

定义 (Smoothing parameter [MR07]). For any $n$-dimensional lattice $\Lambda$and real $\epsilon$ > 0, the smoothing parameter ${\eta }_{\epsilon }(\Lambda )$ is the smallest $s>0$ such that ${\rho }_{1/s\sqrt{2\pi },0}({\Lambda }^{\ast }\backslash 0)\le \epsilon$.
We also define scaled version ${\eta }_{\epsilon }^{\prime }(\Lambda )=\frac{1}{\sqrt{2}}{\eta }_{\epsilon }(\Lambda )$
注意：${\rho }_{1/s}({\Lambda }^{\ast }\backslash 0)\le \epsilon$是一个连续且严格递减的函数。
越密集格具有更小的平滑参数。

3运用场景

[19]=²

Lemma
For any n-dimensional lattice $\Lambda$ of rank $k$, and any real $\epsilon$ > 0,
$${\eta }_{\epsilon }(\Lambda )\le {\lambda }_k(\Lambda )\sqrt{\log (2k(1+1/\epsilon ))/\pi }$$
${\lambda }_k(\Lambda )$:是协方差矩阵$\sum$的最小特征值。

This is in particular the case for the correctness of the sampling algorithm of [GPV08]: it is correct up to negligible statistical distance for any choice of $s=\omega (\sqrt{\log n})\cdot \Vert \tilde{\mathbf{B}}\Vert$. A concrete sufficient condition to ensure $\lambda$-bits of security was computed in [DN12a]

---

1. P.Q. Ngayen, O. Regev. Learning a parallelepiped: cryptanalysis of GGH and
   NTRU signatures. In: Advances in cryptology Eurocrypt 2006. Lecture notes in
   computer science. Springer, New York, pp. 215-233. ↩︎

2. Worst-case to average-case reductions based on gaussian measures ↩︎ ↩︎