Paper 2026/2289

A Subexponential Algorithm for Binary LWE with Sublinear Samples

Abstract

We study Binary LWE with polynomial modulus in the regime of a linear number of samples. Prior work of Kirchner and Fouque and of Herold, Kirshanova, and May (CRYPTO '15, DCC '18) gives an algorithm running in time $\exp(O(n/\log\log n))$ using $O(n\log n)$ samples, leaving open whether the same complexity can be achieved with only $m=\Theta(n)$ samples. We resolve this problem by showing that the same complexity is achievable with even a sublinear number of samples. Fix any constant $a>1/2$, let $q=n^{a+o(1)}$ be an odd prime, and let $m = \left\lceil n/\log \log n \right\rceil$. We give a randomized algorithm that distinguishes $\bigl(\mathbf{A},\mathbf{A}^{\top}\mathbf{s}+\mathbf{e}\bigr) \in \mathbb{Z}_q^{n\times m}\times\mathbb{Z}_q^m$ from a uniformly random pair, for every fixed secret--error pair satisfying $\lVert\mathbf{s}\rVert_2^2+\lVert\mathbf{e}\rVert_2^2 = O(m+n)$. Its expected running time and space are $\exp\left(O( n/\log \log n )\right)$. A crucial component is a new instantiation of the auxiliary superlattices in the Gaussian--Wagner framework of Ducas, Engelberts, and Loyer (CRYPTO '25). These superlattices have sufficiently small smoothing parameters even when the approximation parameter for the entire output list is subexponentially small, while still admitting exact shifted discrete Gaussian sampling within the claimed running time. A Euclidean dual-minimum argument simultaneously controls the smoothing parameters of all projected relevant lattices. Combining the resulting short vectors with an Aharonov--Regev Fourier distinguisher yields the claimed sublinear sample LWE algorithm.