Provably Subexponential Algorithms for Bounded-Error LWE with Few Samples
A Kirchner–Fouque BKW variant solves bounded-error LWE subexponentially with near-linear samples.
A variant of the Kirchner–Fouque Wagner/BKW algorithm solves decision and search LWE for dimension-n secrets over moduli q=n^{κ+o(1)}, with errors bounded by exp((ln n)^{o(1)}), in time 2^{O(n/ln ln n)} using n+O(n/ln ln n) samples. If secret coordinates are similarly small, the same runtime holds for n^{o(1)} errors with only O(n/ln ln q) samples. Earlier analyses needed Ω(n log n) samples; the new proof bounds lower moments of a Fourier statistic instead of using lattice chains.
- Subexponential time 2^{O(n/ln ln n)} for bounded-error decision and search LWE.
- Sample count falls to n+O(n/ln ln n), from prior Ω(n log n).
- Bounded secrets allow n^{o(1)} errors using O(n/ln ln q) samples.
- Analysis uses Fourier-statistic moments rather than lattice-chain arguments.
From the original article
1 min read at arxiv.orgWe show that a variant of the Wagner/BKW-style algorithm for LWE of Kirchner and Fouque [KF15] solves decision and search LWE with secrets of size $n$ over prime moduli $q=n^{κ+o(1)}$, for any fixed $κ>0$, with errors bounded by $\exp((\ln n)^{o(1)})$, in time $2^{O(n/\ln\ln n)}$ given $n+O(n/\ln\ln n)$ original samples.
By Haoxing Lin · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.