6

I would like to know whether these two problems are equivalent or not, namely:

$SIS_\alpha$: Given $A \in \mathbb{Z}_q^{n\times m}$ find $ e \in \mathbb{Z}_q^{m}$ such that $ Ae = 0$ and and $\|e\| \le \alpha$.

$ISIS_\alpha$: Given $A \in \mathbb{Z}_q^{n\times m}, y \in \mathbb{Z}_q^{n}$ find $ e \in \mathbb{Z}_q^{m}$ such that $ Ae = y$ and $\|e\| \le \alpha$.

I did some research and found the following Lemma 10 at second page of the document claiming that an efficient solution to $ISIS_\alpha$ implies an efficient solution to $SIS_\alpha$ but the proof is incorrect since it is not showing that $e' \neq e$.

crypton00b
  • 63
  • 4

1 Answers1

5

Write $A = [A_1 ~~ A_2]$ with $A_1 \in \mathbb{Z}_q^{n\times m'}$ and $A_2 \in \mathbb{Z}_q^{n\times (m-m')}$.

Likewise, $e = (e_1 ~~ e_2)$ with $e_1 \in \mathbb{Z}_q^{m'}$ and $e_2 \in \mathbb{Z}_q^{m-m'}$.

Then,

$$Ae = 0 \bmod q \iff A_2e_2 = -A_1e_1 \bmod q.$$

So, given an instance of SIS, that is, an $n\times m$ matrix $A$, if you have an oracle to solve ISIS, then you can write $A$ per blocks as above, sample a short $e_1$, define $y := -A_1e_1 \bmod q$, and use the oracle to obtain a short $e_2$ such that $A_2e_2 = y \bmod q$.

Your SIS solution will then be $e = (e_1 ~~ e_2)$.