Error Estimation of Practical Convolution Discrete Gaussian Sampling

Transcription

1 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling Zhongxing Zheng, Xioyun Wng,3, Gungwu Xu 4, Chunhun Zho Deprtment of Computer Science nd Technology, Tinghu Univerity, Beijing 00084, Chin Intitute for Advnced Study, Tinghu Univerity, Beijing 00084, Chin 3 Key Lbortory of Cryptologic Technology nd Informtion Security, Minitry of Eduction, Shndong Univertiy, Jinn 5000, Chin 4 Deprtment of Electricl Engineering nd Computer Science, Univerity of Wiconin, Milwukee, WI 530, USA xioyunwng@mil.tinghu.edu.cn Abtrct. Dicrete Guin Smpling i fundmentl tool in lttice cryptogrphy which h been ued in digitl ignture, identifybed encryption, ttribute-bed encryption, zero-knowledge proof nd fully homomorphic cryptoytem. How to obtin integer under dicrete Guin ditribution more ccurtely nd more efficiently with more eily implementble procedure i core problem in dicrete Guin Smpling. In 00, Peikert firt formulted convolution theorem for mpling dicrete Guin nd demontrted it theoreticl oundne. Severl improved nd more prcticl verion of convolution bed mpling hve been propoed recently. In thi pper, we improve the error etimtion of convolution dicrete Guin mpling by conidering different type of error (including ome type tht re miing from previou work) nd expnding the theoreticl reult into prcticl nlyi. Our reult provide much more ccurte error bound which re tightly mtched by our experiment. Furthermore, we nlyze two exiting prcticl convolution mpling cheme under our frmework. We oberved tht their et of prmeter need to be modified in order to chieve their preet gol. Thee gol cn be met uing the uggeted prmeter bed on our etimtion reult nd our experiment how the conitence well. In thi pper, we lo prove ome improved inequlitie for dicrete Guin meure. Key word: Dicrete Guin Smpling, convolution theorem, lttice, error etimtion Introduction In recent yer, reerch in lttice-bed cryptogrphy h ttrcted coniderble ttention. Thi i minly becue mthemticl nd computtionl propertie of lttice provide bi for dvnced cheme, uch digitl ignture, identity-bed nd ttribute-bed encryption, zero-knowledge proof nd fully

2 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho homomorphic cheme, nd ome of the lttice-bed cryptoytem re likely to be effective gint quntum computing ttck in the future. Mny of thee lttice-bed cheme rely on polynomil-time lgorithm which mple from dicrete Guin ditribution over lttice. Thu dicrete Guin mpling i one of the fundmentl tool of lttice cryptogrphy. Dicrete Guin over lttice h been well tudied in mthemtic [, ] nd become n exceedingly ueful nlyticl tool in dicuing the computtionl complexity of lttice problem [3, 4, ]. A dicrete Guin mpling lgorithm tke bi of the lttice Λ, vector c R n, nd width prmeter > 0 input, nd output vector v tht obey the ditribution D Λ+c, which ign probbility proportionl to e π v c /. Two of the mot influentil dicrete Guin mpling lgorithm re Bbi neret-plne lgorithm [5] nd the mpling lgorithm of Gentry, Peikert nd Vikuntnthn [9]. Bbi lgorithm w propoed in 986 nd Gentry, Peikert nd Vikuntnthn improved it by replcing the determinitic rounding proce in ech itertion by probbilitic rounding proce which i determined by it ditnce from the trget point [5]. The work [9] lo provided n nlyi of the mple ditribution uing moothing prmeter of Miccincio nd Regev [6], in term of ttiticl ditnce. A further improvement nd extenion of the mpling lgorithm of [9] w obtined by Peikert [] in 00, where prllelizble Guin mpling lgorithm i etblihed bed the fmou convolution theorem of dicrete Guin well it theoreticl bound. The convolution theorem of dicrete Guin llow the genertion of mple with reltively lrge tndrd devition by combining reult of different mple with mll tndrd devition. Thi technique gretly improve the efficiency for mpling with lrge tndrd devition. Mny prcticl improvement bout Guin mpling hve been mde bed on the convolution theorem. For exmple, Pöppelmnn, Duc nd Güneyu propoed highly efficient lttice-bed ignture on reconfigurble hrdwre in 04 [3] nd Miccincio nd Wlter provided generic Guin mpling lgorithm with high efficiency nd contnt-time in 07 [8]. Improvement hve been reported in recent work [0, 4], where reult of [8] were further utilized nd expnded. The error etimtion of convolution theorem of dicrete Guin mpling i one of the key iue in employing convolution theorem of dicrete Guin mpling. Peikert [] gve theoreticl error etimtion ε ( ε / i bounded by moothing prmeter ) without conidertion bout floting-point error nd trunction error. Pöppelmnn, Duc nd Güneyu [3] dpted Peikert nlyi by cling the tndrd devition of one of the be mpler by fctor of nd provided n error etimtion 3ε which i till theoreticl reult without conidertion bout floting-point error nd trunction error. Miccincio nd Wlter [8] mde more prcticl nlyi bout error

3 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 3 etimtion of convolution theorem by involving floting-point error nd uing novel notion of mx-log ditnce. However, there eem to be problem without conidering trunction error which might reult in bigger devition. In thi pper, we concentrte on the prcticl error etimtion of convolution theorem of dicrete Guin mpling. By conidering the floting-point error nd trunction error, we provide more ccurte prcticl bound for convolution theorem. More pecificlly, we combine Peikert theoreticl reult with the nlyi of floting-point error nd trunction error nd preent our etimtion under everl different ditnce (divergence). Our extenive experiment gree very well with our etimtion reult. Furthermore, we ue thee new error etimtion reult to nlye the mpling cheme propoed in [8, 3] nd provide uggeted prmeter under which their intended gol cn be chieved. Our experiment how tight mtch with our theoreticl bound. The experiment lo indicte tht convolution reult from the exiting work my hve lrger error rnge nd fil to be within their preet error bound if their originl prmeter re ued nd the trunction error i miing from the conidertion. Thi pper lo contin ome improved inequlitie concerning dicrete Guin meure. The ret of the pper i orgnized follow. In ection, we introduce ome bckground bout lttice, dicrete Guin mpling, well error etimtion reult for convolution theorem from [8,, 3]. Our prcticl etimtion nd it nlyi re preented in ection 3. In ection 4, we decribe experiment reult nd dicu ppliction of our work. Finlly, concluion i given in ection 5. Preliminrie. Error Etimtion Sttiticl Ditnce. Sttiticl ditnce i defined the um of bolute error, let P nd Q be two ditribution over common countble et S, the ttiticl ditnce between ditribution P nd Q, denoted SD, i: SD (P, Q) = P (x) Q(x) Reltive Ditnce. Reltive ditnce i defined the mximum rtio between bolute error nd correponding probbility, let P nd Q be two ditribution over common countble et S, the reltive ditnce, denoted RE between ditribution P nd Q, i: where δ RE (P (x), Q(x)) = RE (P, Q) = mx δ RE(P (x), Q(x)) P (x) Q(x) P (x).

4 4 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho Kullbck-Leibler Divergence. Let P nd Q be two ditribution over common countble et Ω, nd let S Ω be the trict upport of P (P (i) > 0 iff i S). The Kullbck-Leibler divergence, denoted KL of Q from P, i defined : KL (P, Q) = ln P (x) Q(x) P (x) where ln(x/0) = + for ny x > 0. Mx-log Ditnce. Thi metric i firt introduced in [8]. Given two ditribution P nd Q over common countble et S, their mx-log ditnce ML i defined : ML (P, Q) = mx δ ML(P (x), Q(x)) where δ ML (P (x), Q(x)) = ln P (x) ln Q(x). Reltionhip between Cloene Metric. For rel number x nd it p-bit pproximtion x which tore the p mot ignificnt bit of x in binry, we hve 5 : δ RE (x, x) < p+ A reltion tht link ttiticl ditnce nd KL i decribed by the following Pinker inequlity: For KL nd RE, the inequlity KL (P, Q) SD(P, Q). KL (P, Q) RE(P, Q) w proved in [3] under the condition tht RE (P, Q) < /4. Actully, thi rgument i pecil ce of generl reult: ume tht for ny i S, there exit ome δ(i) (0, /4) uch tht P (x) Q(x) δ(x)p (x), then KL (P, Q) δ (x)p (x) hold. The reltionhip between KL nd RE follow by etting δ(i) = RE (P, Q). Recently in [8], the bove reltion w further improved to KL (P, Q) (8/9) RE(P, Q). In fct, [8] etblihed more generl inequlity KL (P, Q) for the ce RE (P, Q) <. RE (P,Q) ( RE (P,Q)) 5 When we tore n infinite-bit rel number x = k + i= xi i p-motignificnt-bit rel number x = k p i= xi i where k i cler tht enure x = nd x i {0, } for ll i >, the reltive error µ = x x / x = k + i=p+ xi i /( k p i= xi i ) < p / = p+.

5 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 5 Lemm 4. of [8] et up reltion between ML nd RE. We hll prove lightly more precie inequlity for thee two quntitie. It hould be pointed out tht we ume tht P nd Q hre exctly the me trict upport S. Thi i lwy true if the condition RE (P, Q) < hold. Lemm. If RE (P, Q) <, then ML (P, Q) RE (P, Q) RE (P, Q) ( RE (P, Q)). Proof. Note tht for t <, we hve ln( t) = t + t + t For x S, we et t x = P (x) Q(x) P (x). On the one hnd, we hve Q(x) ln P (x) = ln( tx ) = tx + t x + t3 x 3 + tx + t x RE (P, Q) + RE (P, Q) + 3 RE (P, Q) + 3 RE (P, Q) RE (P, Q) + ( RE (P, Q)). + t x 3 3 Thi give ML (P, Q) RE (P, Q) + On the other hnd, Q(x) ln P (x) = ln( t x ) t x t x + t3 x 3 +. So RE (P,Q) ( RE (P,Q)). t x Q(x) ln P (x) + t x + t3 x 3 + mx Q(x) ln P (x) + RE (P, Q) ML (P, Q) + RE (P, Q) ( RE (P, Q)). Thi yield RE (P, Q) ML (P, Q) RE (P, Q) + 3 RE (P,Q) ( RE (P,Q)) nd the lemm i proved. It hould be pointed out tht the reult of the lemm i lo true if we ue δ RE nd δ ML. For ditribution P i nd Q i over upport i S i, [8] lo proved tht if ML (P i i, Q i i ) /3 for ll i nd i j<i S j, then SD ((P i ) i, (Q i ) i ) (mx i ML (P i i, Q i i )) i ()

6 6 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho. Dicrete Guin Smpling Given x R n nd nd countble et A R n, we define the Guin function ρ,c (x) = e ρ,c(x) ρ,c(a) x c π nd Guin um ρ,c (A) = x A ρ,c(x), then P r(x) = give dicrete (Guin) probbility ditribution on A which we cll D A,c,. The ubindexe c or/nd re omitted if c = 0 or/nd =. Guin function cn be defined in term of poitive definite mtrix inted of. The inight-conveying concept of moothing prmeter of Miccincio nd Regev [6] for n n-dimenionl lttice Λ i with repect to n ε > 0 nd given by η ε (Λ) = min{r : ρ /r (Λ ) + ε}. One of the bound given in [6] tte For the pecil ce of Λ = Z, we hve η ε (Λ) ln(n( + /ε))/π λ n (Λ). η ε (Z) ln ( + /ε)/π. Thi, together with the fct tht e πηε(z) < ρ (Z \ {0}) ε, yield ηε(z) e π(ηε(z)) < ε e π(ηε(z)). We hll ume tht η ε (Z) ince ε i mll. Note tht ρ(z) < , it i thu meningful to chooe ε < in the ret of our dicuion. Next, we will prove little tighter til bound bout dicrete Guin probbility which improve Lemm 4. of [9]. To thi end, we lo need to develop lightly more precie etimtion over Bnzczyk lemm [] for the ce of Z. Lemm. Let, t be poitive number uch tht t nd c [0, ). We hve. k Z k c t. If η ε (Z), then x Z x c t ρ (k c) e πt ( + P r x DZ,c, (x) e πt + ε ε πt e + πt e (ρ (Z) ) ). () (ρ (Z) ). (3) ρ (Z) Remrk.3. We include proof of the lemm in the ppendix.. We remrk tht the proof of eqution () cn be eily extended to get n lterntive proof of Bnzczyk lemm (Lemm.4 in []) for generl lttice L R n.

7 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 7 3. Our new bound () improve ( the originl ) bound e πt ρ (Z) to Ce πt ρ (Z) with C = πt ρ (Z) + e ρ (Z). Obviouly under the nturl condition we hve tht C 6. Thi C cn be much mller. For exmple, in our lter ppliction, we will chooe = 34, t = 6, o C < Convolution Theorem nd it Improvement In 00, convolution theorem for dicrete Guin w formulted nd proved by Peikert [] which utilize moothing prmeter. The convolution theorem tte Theorem.4 (Convolution Theorem []) Let Σ, Σ > 0 be poitive definite mtrice nd et Σ = Σ +Σ nd Σ3 = Σ +Σ. Let Λ, Λ be lttice uch tht Σ η ε (Λ ) nd Σ 3 η ε (Λ ) for ome poitive ε /, nd let c, c R n be rbitrry. Chooe x D Λ+c, Σ nd x x + D Λ+c x, Σ. If D c+λ, Σ i the ditribution of x, then + ε δ RE (P r Dc [x = x], P r +Λ, Dc Σ +Λ, [x = x]) ( Σ ε ). Thi convolution theorem w trengthened by Miccincio nd Peikert in 03 (Theorem 3.3 of [7]). We oberve tht the proof in [7] cn be modified o tht n improved verion of Theorem 3.3 of [7] cn be tted. For vector z Z m, we denote z mx nd z min to be the lrget nd mllet component (in bolute vlue) of z repectively, then our form of the theorem i: Theorem.5 Let Λ be n n-dimenionl lttice, z Z m nonzero integer vector, R m with i zmx + zmin η ε(z) for ll i m nd c i + Λ rbitrry coet. Let y i be independent mple from D ci +Λ, i, repectively. Let Y = i z ic i + gcd(z)λ nd = i (z i i ). Then D Y,, the ditribution of y = z i y i, i cloe to D Y,. More preciely, δ RE (P r DY, [x = x], P r DY, [x = x]) + ε ε. Remrk. We note tht the umption of Theorem 3.3 of [7] w i z η ε (Z). Our verion i more efficient z mx + z min z. Notice tht in ppliction, one often require gcd(z) =, o z mx > z min nd hence z mx + z min < z. The proof jut modifie the lt prt of tht given in [7] nd we include tht prt in the ppendix. 6 Note tht by the Poion Summtion formul we get < ρ (Z) < + e π e 3π.

8 8 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho Pöppelmnn, Duc nd Güneyu conidered one-dimenionl ce in [3]. Uing KL inted of SD nd with one lttice being mpled to be kz, their improved convolution theorem tte: Theorem.6 (Convolution Theorem [3]) Let x D Z,, x D kz, for ome poitive rel,, nd let 3 = + nd = +. For ny ε (0, /) if η ε (Z) nd 3 η ε (kz), to the ditribution of x = x + x, denoted D x, i cloe to D Z, under KL-divergence: KL (D x, D Z, ) ( ( + ε ε ) ). Another ueful bound in tudying error etimtion of convolution theorem i lo propoed in [8] which decribe error when continuouly uing pproximted output reult input of the next round. Theorem.7 Let be ueful or efficient metric. Let A P querying ditribution enemble P θ t mot q time. Then: be n lgorithm (A Q, R) (A P, R) + q (P θ, Q θ ) for ny ditribution R nd ny enemble Q θ. Miccincio nd Wlter re the firt to nlyze error etimtion of convolution dicrete Guin mpling uing the metric ML by combining eqution (), theorem.4, theorem.5, nd theorem.7. Their reult i lo the firt prcticl refinement of convolution theorem tht tke flot-point error into ccount. The following two corollrie from [8] give error etimtion under mx-log ditnce. Corollry.8 (Corollry 4. of [8]) Let z Z m be nonzero integer vector with gcd(z) = nd R m with i z η ε (Z) for ll i m. Let y i be independent mple from D Z,i, repectively, with ML (D Z,i, D Z,i ) µ i for ll i. Let DZ, be the ditribution of y = z i y i nd = i.then ML (D Z,, D Z, ) ε + i µ i. Remrk. The umption of i z η ε (Z) cn be replced by i z mx + z min η ε(z) ccording to Theorem.5. Corollry.9 (Corollry 4. of [8]) Let, > 0 with = + nd 3 = +. Let Λ = KZ be copy of the integer lttice Z cled by contnt K. For ny c nd c R, denote the ditribution of x x + D c x +Z,, where x D c+λ,, by D c+z,. If η ε (Z), 3 η ε (Λ) = Kη ε (Z), ML (D c+λ,, D c+λ, ) µ nd ML (D c+z,, D c+z, ) µ for ny c R, then ML (D c+z,, D c+z,) 4ε + µ + µ.

9 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 9 3 Our Refinement of Prcticl Convolution Theorem In thi ection, we conider convolution dicrete Guin mpling. We will ue the relxed verion of Convolution Theorem (Theorem.5) for deling with two rndom vrible, nd nlye three type of error, nmely, convolution error, trunction error, well flot-point error. The effectivene of convolution re evluted by ttiticl ditnce, KL-divergence, reltive difference nd mxlog ditnce. We will ue the til bound from Lemm. to control trunction error. For rel number t >, we denote ε t = ρ /t (Z) = + i i= e πt (e πt e, πt ). We will ue ε e 3πt t to control the trunction error with repect to t, it cn be verified tht ε t < for ll t >. Nottion. To implify our preenttion, we hll ue the following nottion in our dicuion. Let, b be poitive integer nd, t poitive rel number, we denote η = +b, ψ = +b b nd ω = η ψt. Theorem 3. Let > b Z be nonzero integer with gcd(, b) = nd R with = + b η ε (Z) 7. Let x i [ t i, t i ] be independent mple from D Z,i repectively, with flot-point error µ i µ for i =,. Let D Z, be the ditribution of x = x + bx S = [ t, t] where = + b. Then SD ( D Z,, D Z, ) C ε t + µ + ε + O(ε t + µε + ε t ε + ε t µ) RE ( D Z,, D Z, ) C 3 ε ω ψ t + µ + ε + O(ε +ω ψ t ML ( D Z,, D Z, ) C 3 ε ω ψ t + µ + ε + O(ε ω ψ t + µε + ε ψ t ε + ε ψ t µ) + µ + ε + µε + ε ψ t ε + ε ψ t µ) KL ( D Z,, D Z, ) (C + C 4 )ε t + µ + ε + O(ε t + µ + ε 3 + µε + ε t ε + ε t µ) Epecilly when t = η ε (Z) nd ε t = ε where C 4 = πt e SD ( D Z,, D Z, ) (C + )ε + µ + O(ε + εµ) RE ( D Z,, D Z, ) C 3 ε ω ψ + µ + O(ε + ε ω ψ µ) ML ( D Z,, D Z, ) C 3 ε ω ψ + µ + O(ε ω ψ + µ + ε ω ψ µ) KL ( D Z,, D Z, ) (C + C 4 )ε + µ + O(ε + µ + εµ) C = πt e + e πt. + e πt, C 3 = ( e π(ωψηt+η ) ) (+e πη (+e 4πη )), nd 7 It i note tht our dicuion cn be extended to the ce of. We chooe = i for the purpoe of implifying our dicuion. Thi i lo very common et ued in prctice.

10 0 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho We would like to remrk tht C, C 3, C 4 re conidered contnt becue the prmeter of convolution theorem re elected = + b η ε (Z), t η ε (Z). It i obviou tht C, C 4 (0, ) nd C = O(e πt/ ), C 4 = O(e πt/ ). We lo hve ε t = O(e πt ) ε = O(e πη ε (Z) ) nd µ p+ (p [53, 00]), note tht e πt e πη ε (Z) e πt e πt/ e πt/ (i.e when tke = 34, t = η ε (Z) = 6, ε t = ε 60 nd C ε /(t) 0.78 nd there re imilr ce for C 3 nd C 4 ). So C, C 3, C 4 cn be viewed contnt tht do not ffect the nlyi of ε t, ε nd µ. We would lo like to remrk tht our reult i quite different from the exiting one, even compred with the prcticl reult of [8]. It i noted tht the reltionhip between ML nd other metric re preented in [8], but the influence of trunction error, which ct dominnt term in computing ML, eem to be ignored. Our nlyi of prcticl convolution theorem cn be divided into three prt by the nture of error, i.e., convolution error, flot-point error nd trunction error. Detil of our nlyi will be given in the following ubection. Our verion of convolution theorem (Theorem.5) will be ued. 3. Error Anlyi Proof of Theorem 3. We trt the nlyi by conidering two be mpler which mple x D c, nd x D c, repectively. A the prcticl preciion well the et of x, x cn not be infinite, there exit both trunction error nd flotpoint error for be mpler. Without lo of generlity, we ume c = c = c = 0, =. The trunction rnge for x nd x re denoted by S = [ t, t ] nd S = [ t, t ] repectively. A mentioned erlier, we et ε t = + i i= to be the trunction error nd we know tht ε e πt t < for ll t >. Denote flot-point error µ, µ with µ µ, µ µ. We firt tret trunction error: ρ x Z x t ρ (x ) P r D (x = x ) = ρ (x) P r D (x = x ) = ρ (x ) x Z ρ (x) From Lemm. nd the fct tht ρ (Z) > we get πt (x) e ( + ) ( πt e (ρ (Z) ) ε t ( πt e ε t + πt e + e πt ) ρ (Z) = C ε t ρ (Z) ) (ρ (Z) )

11 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling where C = πt e + e πt. From the fct tht ρ (Z) < + e π e 3π get nd ε t (e πt, e πt e 3πt ), we where C = ρ (x) x Z x t e 3πt e πt + e π e 3π e πt e πt ε t Thee yield tht for ll x S. e 3πt ε t e πt e 3πt e πt + e π e 3π ρ (Z) = C ε t ρ (Z) P r D (x = x ) C ε t P r D (x = x ) P r D (x = x ) C ε t Since the probbilitie of be mpler re tored with finite preciion p which my introduce reltive error lrge µ p+, for be mpler which mple x D (or x D ), we hve P r D (x = x ) C ε t [ µ, + µ] P r D (x = x ) P r D (x = x ) C ε t P r D (x = x ) C ε t + µ + O(ε t µ) P r D (x = x ) A C > C, the reltive error i bounded by: P r D (x = x ) C ε t µ + O(ε t µ) (4) δ RE (P r D (x = x ), P r D (x = x )) C ε t + µ + O(ε t µ) Next, let u nlyze the joint ditribution of the two independent be mpler. Recll tht we et = nd c = c = c = 0, nd S = [ t, t ], S = [ t, t ], S = [ t, t] with = + b. The Convolution Theorem (Thoerem.5) prove tht δ RE (P r DY, [x = x], P r DY, [x = x]) + ε ε. It hould be noted tht Theorem.5 pplie to the idel itution where we cn obtin ll poibilitie with neither trunction error nor flot-point error, thu for ll x c S = [ t, t], P r DY, (x = x c ) = x Z,x Z P r D (x = x c=x +bx x ) P r D (x = x ). A reult, we hve

12 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho P r D (x = x c ) = ( + (x c )) P r (x = x D ) P r (x = x D ) x Z,x Z x c=x +bx where ( + (x c )) [ ε +ε, +ε ε ] for ll x c Z. On the other hnd, we know the probbility of convolution of two be mple i given by P r D (x = x c ) = P r D x S,x S x c=x +bx (x = x ) P r D (x = x ) According to the previou nlyi bout reltive error of be mpler, it i cler tht P r D (x = x c) = P r D (x = x) P r D (x = x) x S,x S x c=x +bx = C t P r D (x = x) P rd (x = x) x S,x S x c=x +bx [ for ome C t, ], where C ( C ε t +µ) ( C ε t µ), C previouly defined. Reorgnizing thi, we get P r D (x = x c) = C t (x,x ) S S xc=x +bx P r D (x = x ) P r D (x = x ) = C t P r D (x = x ) P r D (x = x ) P r D (x = x ) P r D (x = x ) (x,x ) Z (x,x ) / S S xc=x +bx xc=x +bx = C t ( b(x c)) P r D (x = x ) P r D (x = x ) (x,x ) Z xc=x +bx = C t b(xc) + (x P r D (x = xc) c) = g(x c) P r D (x = x c) where g(x c ) = C t b(xc) +(x c), with b(x c) = β(xc) α(x c) = (x,x ) / S S P r D (x=x ) P r D (x=x ) xc=x +bx (x,x ) Z P r D (x=x ) P r D (x=x. ) xc=x +bx Now we hll nlye b(x c ). Given x c, we denote l xc the line defined by the eqution x c = x + bx in the (x, x )-plne. We re concerning with the integrl point (x, x ) Z on the line l xc. Note tht P r D (x = x ) P r D (x = x ) = (e π/ ) (x +x ) (ρ (Z)) = x +x ρ (Z) e π.

13 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 3 Figure. x c = x + bx in the plne of (x, x ), the Horizontl Axi i for x nd the Verticl Axi for x So we cn connect the convolution probbilitie with the ditnce from the origin of the (x, x )-plne, it i hown in Fig. Since gcd(, b) =, we my ume > b without lo of generlity. By the extended Eucliden lgorithm, there re poitive integer u < b, v < uch tht u bv =. Let ST 0 = {k(b, ) : k Z} denote the et of integrl olution of x +bx = 0. Then the et of integrl olution of l xc : x + bx = x c i ST xc = x c (u, v) + ST 0. Thi men tht point in ST x i of the form : (x c u + kb, x c v k). The point on l xc tht i cloet to the origin i P = ( x c + b, bx c ) = (xc + b u + ξb, x c v ξ) with ξ = ub+v +b x c. So the two poible hortet vector in ST xc re P 0 = (x c u + ξ b, x c v ξ ) nd P = (x c u + ξ b, x c v ξ ).

14 4 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho Conider vector (x c u + kb, x c v k) ST xc. It norm relte the norm of P 0, P through the following 8 9 { (x c u + kb, x c v k) P0 + (i i(ξ ξ )), if i = k ξ, = P + (i (5) + i( ξ ξ)), if i = k ξ. The reltion (5) will be ued in deriving explicit formul of α(x c ) nd β(x c ). Thee formul enble u to etblih key etimtion for the reltive convolution error. More preciely, thi etimtion tte Lemm 3. If t +b ψ, b(x c ) = β(x c) α(x c ) C 3e πω ψ t. The contnt pper in the lemm hve been defined previouly, they re η = +b, ψ = +b b, ω = η ψt, nd C 3 = ( e π(ωψηt+η ) )(+e πη (+e 4πη )). We include proof of the lemm in the ppendix due to pce limittion. According to Lemm 3., we ee tht g(x c ) = C t b(x c) + (x c ) ( C ε t + µ) ( ε)( C 3e πω ( C ε t + µ) ( ε)( C 3ε ω ψ t ) ψ t ) = C 3 ε ω ψ t µ ε + O(ε +ω ψ t ) + O(ε ω ψ t µ) + O(ε ω ψ t ε) + O(µε) To nlyi RE, we hve RE ( D Z,, D Z, ) = mx δ RE(P r D (x), P r D (x)) = mx P r D (x) P r D (x) = mx g(x) P r D (x) C 3 ε ω ψ t + µ + ε + O(ε +ω ψ t ) + O(ε ω ψ t µ) + O(ε ω ψ t ε) + O(µε). 8 Here we jut verify the econd reltion of (5), nd the other i imilr. (x cu + kb, x cv k) ( P = (k ) ξ )(x cub + x cv) + (k ξ )( + b ) = ( +b )(k ξ ) ub+v x +b c+k+ ξ = ( +b )i ( ξ+i+ ξ ) = (i +i( ξ ξ)). 9 It hould be noted tht the reult of (5) i obtined under the condition =, for the ce when, imilr reult cn lo be derived with mll difference ξ = u b+v + b x c.

15 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 5 And from lemm., we lo hve: ML ( D Z,, D Z, ) RE ( D Z,, D Z, ) RE ( D Z,, D Z, ) ( RE ( D Z,, D Z, )). So: ( ML ( D Z,, D Z, ) RE ( D Z,, D Z, ) + ) RE( D Z,, D Z, ) + 3 RE( D Z,, D Z, ) = C 3 ε ω ψ t + µ + ε + O(ε ω ψ t + µ + ε + µε + ε ψ t ε + ε ψ t µ). It i een tht the trunction in the be mpler bring n extr error for the joint ditribution fter convolution. More pecificlly, the extr error i negligible when x i cloe to the center, but it ct the dominnt term when x i cloe to the edge. Thi error h profound effect in computing mx-like divergence, uch ML nd RE, however, when conidering umlike divergence, uch SD nd KL, it contribute little becue the correponding probbility i very mll. So we ue generl bound P r D (x) ( + C ε t + µ + ε + O(ε t + µε + ε t ε + ε t µ) ) P r D (x) (obtined by ignoring b(x c )) to mke following nlyi bout SD, KL : SD ( D Z,, D Z, ) = P r D (x) P r D (x) (C ε t + µ + ε + O(ε t + µε + ε t ε + ε t µ) ) P r D (x) (C ε t + µ + ε + O(ε t + µε + ε t ε + ε t µ) ) = C ε t + µ + ε + O(ε t + µε + ε t ε + ε t µ) For KL : KL ( D Z,, D Z, ) = ( ) P r ln D (x) P r P r D (x) D (x)

16 6 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho Let P r D (x) = ( + c(x))p r D (x) where c(x) C ε t + µ + ε + O(ε t + µε + ε t ε + ε t µ), we hve: KL ( D Z,, D Z, = ( ) ln + c(x) ( + c(x))p r D (x) = ( c(x) ) c (x) + O(c 3 (x)) ( + c(x))p r D (x) = ( c(x) + ) c (x) + O(c 3 (x)) P r D (x) c(x)p r D (x) + ( ) C ε t + µ + ε + O(ε t + µε + ε t ε + ε t µ) P r D (x) ) +O ((C ε t + µ + ε) 3 It i lo noted tht, ccording to Lemm.: P r D (x) = P r D (x) P r D (x) ε t + ε + πt e (ρ (Z) ) ε ρ (Z) x Z x / S According to n erly nlyi of Eqution (4), x S P r D (x ) +C ε t +µ ( ) P r (x D ) + C ε t + µ 0, we hve: P r D (x) = = ( ) + c(x) P r D (x) P r D (x) + c(x)p r D (x) 0 According to the definition, it i nturl to know tht P r D (x) + µ with flot-point error µ. It hould be note tht thi error cn not be fixed effectively by normliztion. For exmple, let µ = p+,p r = p+ i= i + l, P r = l i=p+ i (l > (p + )), we hve P r + P r =. And when we torge them with their p-mot-ignificnt bit P r, P r, P r =, P r = (p+), then P r + P r + µ. Thi ce remin unchnged for P r, P r which re computed fter normliztion where P r P r = P r + P, P r P r r = P r + P. r

17 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 7 And P r D (x) = Therefore, x S,x S P r D (x ) P r D (x ) x S,x S P r D (x ) P r D (x ) + µ + C ε t + O(µ ) + O(ε t ) + O(µε t ). c(x)p r D (x) = P r D (x) µ + C ε t + ε t + ε ε P r D (x) x S,x S x=x +bx / S (C + C 4)ε t + µ + O(µ + ε t + µε t + ε tε). P r D (x ) P r D (x ) + πt e (ρ (Z) ) + O(µ + ε t + µε t) ρ (Z) where C 4 = πt e + e πt. Thi yield KL ( D Z,, D Z, ) c(x)p r D (x) + (C ε t + µ + ε) P r D (x) + O ( (C ε t + µ + ε) 3) (C + C 4 )ε t + µ + ε + O(ε t + µ + ε 3 + µε + ε t ε + ε t µ). 4 Experiment Reult In thi ection, we decribe our experiment bout the prcticl error of convolution dicrete Guin mpling, followed by n nlyi bout experiment reult. 4. Convolution Error, Trunction Error nd Flot-point Error Our firt experiment i to eprtely how the influence of convolution error, trunction error nd flot-point error, more pecificlly, we chooe = nd compute the probbility ditribution for x D Z, nd x D Z, under different preciion where x [ t, t ], x [ t, t ]. Then we compute the probbility ditribution of the vrible x = x + bx, denoted D Z,= +b, nd compre it with pre-computed nd much more ccurte probbility ditribution for x D Z,= (i.e the probbility ditribution i computed with much lrger preciion nd t) to get reult of output +b error.

18 8 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho The detiled prmeter re elected = = 9.53 π, =, b =, = + b, x [ t, t ], x [ t, t ], the experiment i conducted with t vrie from 3 to 8 nd preciion vrie from 53 to 00. For the contrt probbility ditribution, the preciion i elected 500 nd t = 0 which mke trunction error nd flot-point error mll poible. An overview reult i followed in Tble, nd we will mke further nlyi for SD nd KL : We hve bounded SD, KL SD C ε t + µ + ε nd KL (C + C 4 )ε t + µ + ε in Section 3, where µ p+. A the bound of ε i limited by = + b η ε (Z) ccording to Theorem 3., we hve: η ε (Z) 9.53 π + ε 88.0 SD ( D Z,, D Z, ) C ε t + µ KL ( D Z,, D Z, ) (C + C 4 )ε t + µ When t = 3, 5, 7 eprtely, ε t 39.79,.3,.09, C ε t 4.9, 4.6, 3.8 nd (C + C 4 )ε t 39.38,.5,.37 with preciion vry from 53 to 00 which indicte µ 54,..., 0, we hve: When t = 3: When t = 5: And when t = 7: SD ( D Z,, D Z, ) 4.9 KL ( D Z,, D Z, ) SD ( D Z,, D Z, ) µ KL ( D Z,, D Z, ).5 + µ SD ( D Z,, D Z, ) µ KL ( D Z,, D Z, ) µ From Fig, we find our theoreticl bound for SD nd KL fit well with prcticl reult. A for RE nd ML, we elect following prmeter to conduct experiment: = = 34, = 4, b = 3, = + b, x [ t, t ], x [ t, t ], Due to the pce limit, Tble only lit bout 0.6% of the totl reult, to obtin the complete reult, one cn cce the public code of our experiment from or run progrm by oneelf. It lo hould be noted tht KL nd RE re not ymmetric metric, nd different input order led to different reult, however, the difference i quite mll, i.e. log ( KL(D Z,, D Z, ) KL ( D Z,,D Z, ) )

19 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 9 Tble. Experiment: Prcticl Error with Different Preciion nd t t log (ε t ) Preciion log (µ) log ( SD ) log ( KL ) with t vrie from 3 to 8 nd preciion vrie from 53 to 00. For the contrt probbility ditribution, the preciion i elected 500 nd t = 0 which mke

20 0 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho Figure. Reltionhip between Bound nd Prcticl Error Meured by SD, KL with Different Preciion trunction error nd flot-point error mll poible, nd n overview of the reult i hown in Tble nd the detil cn be found in Fig 3. A we nlyi RE nd ML : ML (D Z,, D Z, ) RE (D Z,, D Z, ) C 3 ε ω ψ t where ψ = ( )/ , ω 0.965, C µ + ε A C 3 ε ψ t mx(µ, ε), our nlyi indicte tht the prcticl error my not chnge with different preciion from 53 to 00. And it eem the experiment reult fit our reult well. Tble. Experiment: Prcticl Error with Different Preciion nd t t log (ε t ) Preciion log ( RE ) log ( ML ) Appliction of Our Prcticl Bound We hve etblihed new bound for convolution dicrete Guin mpling which fit well with experiment. In thi ection, we ue thi bound to renlye

21 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling Figure 3. Reltionhip between Bound nd Prcticl Error Meured by RE, ML with Different t Guin mpling cheme uing convolution dicrete Guin theorem, uch the mpling cheme of Pöppelmnn, Duc nd Güneyu well Miccincio nd Wlter, nd try to give uggeted modified prmeter bed on our nlyi. 4.. Reviit the Smpling Scheme of Pöppelmnn, Duc nd Güneyu In Pöppelmnn, Duc nd Güneyu mpling cheme [3], the prmeter re elected : = 9.53 π, =, b =, η ε (Z) 3.860, t 5.35 to enure ε t 8 nd preciion i et to 7 with µ 7 (in [3], technique w ued to tore probbilitie with different preciion vry from 6 to 7, here we tke the fixed preciion of 7 which led to mller prcticl error thn uing the originl etting in [3]), the gol of the deign in [3] i to enure: KL 8 (6) Now let u nlye if the cheme cn chieve thi gol, the convolution theorem demnd for = + b η ε (Z), ε i bounded by: η ε (Z) 9.53 π + ε 88.0 Thu: KL ( D Z,, D Z, ) (C + C 4 )ε t + µ + ε 70 The experiment reult hown in Fig 4 indicte tht the error fit well with our etimtion. To mke the convolution of mpling to tify eqution (6), one poible wy with minor modifiction i to et preciion lrger thn 8. Our

22 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho nlyi reult quite different upper bound from tht in [3], nd the difference my be cued by two reon: the firt i tht the convolution theorem tht ued in [3] doe not conider trunction error which contribute ignificntly in etimting RE, nd thu ( +ε ε ) eem fil to be the dominte term for bounding RE. The econd i tht when chooing preciion (ection 3.4 of [3]), the technique of [3] only enure the KL of be mpler i mller thn 8 but whether thi till hold for KL of the output fter convolution i unknown. To vlidte thi nlyi, we lo mke experiment with the uggeted modifiction nd the reult, which re hown in Fig 4, re conit with our etimtion. Figure 4. KL of Revied Prmeter for [3] Scheme with Different Preciion 4.. Reviit the Smpling Scheme of Miccincio nd Wlter In Miccincio nd Wlter mpling cheme, the prmeter re elected itertively, tke the exmple in [8]: The prmeter of the firt round mpling, known the be mpling, re elected : = = 34, = ηε(z) = 4, b = mx(, ) = 3, t = η ε (Z) = 6, ε t = ε 60 with preciion et to 60 bit, nd the gol of the deign in [8] i to enure: ML 55 (7) However, bed on our nlyi: ML (D Z,, D Z, ) RE (D Z,, D Z, ) C 3 ε ω ψ t + µ + ε where ω 0.965, ψ = ( )/ , C Thu we hve: ML (D Z,, D Z, ) RE (D Z,, D Z, ) 9.45

23 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 3 The experiment reult hown in Fig 5 eem to be conitent with our nlyi. To mke ML tifying the originl gol of (7), one hould k ε t 538. Thi would require t to be very lrge nd lo very lrge correponding preciion, i.e. t 0.90 nd preciion lrger thn 538 which eem to be not prcticl both time nd pce complexitie of uing convolution theorem re proportionl to the qure of t nd preciion. Thu one poible wy with the let modifiction i to tke KL 0 inted of ML 55 the gol nd et the preciion lrger thn 0. The difference between our nlye nd tht in [8] re minly cued by the following two reon: the firt i imilr with the previou one where the convolution theorem tht ued in [8] doe not conider bout trunction error which contribute ignificntly in etimting RE ( ML ). The econd reon i concerning the lower bound of reltive metric uch RE nd ML. Although thee metric hve lower bound tht cn be lrger O( KL ), it i not ey to be reched. Thi led to itution tht requiring RE or ML to be le thn k/ i not eier (in fct much hrder t mot time) thn requiring KL or SD le thn k. To vlidte our uggeted prmeter, experiment reult re followed in Fig 5 which upport our nlyi well. Figure 5. ML nd KL of Revied Prmeter for [8] Scheme with Different Preciion 5 Concluion In thi pper, we focu on the prcticl error etimtion of convolution theorem of dicrete Guin mpling. By bringing the floting-point error nd trunction error in conidertion, we re ble to provide more ccurte prcticl

24 4 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho bound for convolution theorem. Extenive experiment hve been conducted nd the reult highly gree with our derived bound. We reviit two previou prcticl convolution bed mpling cheme under our new error etimtion. It i oberved tht under the prmeter originlly propoed, their preet gol my not be chievble due to the bence of trunction error. Our bound ugget modified et of prmeter tht enure their gol to be met. Our experiment reult lo upport the new et of prmeter. Reference. Bnzczyk W. New bound in ome trnference theorem in the geometry of number. Mthemtiche Annlen, 96(4):65-635, Bnzczyk W. Inequlite for convex bodie nd polr reciprocl lttice in Rn. Dicrete & Computtionl Geometry, 3:7-3, Ahronov D, Regev O. A lttice problem in quntum NP. In FOCS, pge 0-9, Ahronov D, Regev O. Lttice problem in NP conp. J. ACM, 5(5): , Lázló Bbi. On Lováz lttice reduction nd the neret lttice point problem. Combintoric, 6():-3, Miccincio D, Regev O. Wort-ce to verge-ce reduction bed on Guin meure. SIAM J. Comput., 37():67-30, 007. Preliminry verion in FOCS Miccincio D, Peikert C. Hrdne of SIS nd LWE with mll prmeter[m]//advnce in Cryptology-CRYPTO 03. Springer, Berlin, Heidelberg, 03: Miccincio D, Wlter M. Guin Smpling over the Integer: Efficient, Generic, Contnt-Time[J]. In proc. CRYPTO 07, pge , Gentry C, Peikert C, Vikuntnthn V. How to Ue Short Bi: Trpdoor for Hrd Lttice nd New Cryptogrphic Contruction, 008[J]. 0. Gür K D, Polykov Y, Rohloff K, et l. Implementtion nd Evlution of Improved Guin Smpling for Lttice Trpdoor[J]. IACR Cryptology eprint Archive 07: 85 (07).. Peikert C. Limit on the hrdne of lttice problem in l p norm. In IEEE Conference on Computtionl Complexity, 7(): , Peikert C. An efficient nd prllel Guin mpler for lttice[c]//annul Cryptology Conference. Springer, Berlin, Heidelberg, 00: Pöppelmnn T, Duc L, Güneyu T. Enhnced lttice-bed ignture on reconfigurble hrdwre[c]//interntionl Workhop on Cryptogrphic Hrdwre nd Embedded Sytem. Springer, Berlin, Heidelberg, 04: Pret T. Shrper bound in lttice-bed cryptogrphy uing the Rnyi divergence[c]//in proc. ASIACRYPTO 07, pge , 07.

25 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 5 Appendix I: Proof of Lemm. Note tht k Z k c t ρ (k c) = e πt k Z k c t = e πt k c+t +e πt k c t e (k c) t π e π ( k c t)( k c +t) e π ( k c t)( k c +t). Since nd k c+t k c t e π ( k c t)( k c +t) = e π ( k c t)( k c +t) k c+t + e πt + e πt k c t + e πt + e πt So we get n improved Bnzczyk bound ( ρ (k c) e πt + k c t e π (k (c+t)) e π (k (c+t))t k= c+t + k= k π e, e π (k (c+t)) e π (k (c t)) e π k (c t) t k= c t k= πt e k π e. e π (k (c t)) (ρ (Z) ) ). Appendix II: Proof of Theorem.5 We jut include the modifiction prt here. Reder re referred to the proof Theorem 3. of [7] for necery nottion.

26 6 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho Proof. Our gol i to how tht the reult hold for lrger cope of i where i z mx + z min η ε(z). When bounding the moothing prmeter of L in [7]: η(l) η((s ) (Z Λ)) η ε (Z) bl(z)/ min( i ) where Z = Z m ker(z T ) = {v Z m : z, v = 0} nd bl(λ) repreent the Grm- Schmidt minimum of lttice Λ where bl(λ) = min B B, B = mx i b i nd the minimum i tken over ll be B of Λ. Miccincio nd Peikert bound bl(z) min( z, z ) becue there exit full-rnk et of vector z i e j z j e i Z where z i h the miniml z i 0 nd j i [,.., m]. Among thi et of vector, we hve mx i b i = zmx + zmin where zmx + zmin z when m = it tke equlity nd zmx + zmin z when z mx = z min it tke equlity. And by bounding bl(z) zmx + zmin, we hve η(l) η ε(z) bl(z)/ min( i ) η ε (Z) z mx + zmin / min( i). And for i zmx + zmin η ε(λ), it i een tht η ε (Z) z mx + zmin / min( i). Appendix III: Proof of Lemm 3. Recll tht we ue the following nottion: η = +b, ψ = +b b nd ω = η ψt. Our gol i to how tht under the condition of = nd t +b ψ, we hve b(x c ) = β(x c) α(x c ) Ce πω ψ t. where C = ( e π(ωψηt+η ) )(+e πη (+e 4πη )). We firt nlye α(x c ) α(x c ) = ρ (Z) (x,x ) S xc e π Note tht ξ = ub+v +b x c. By (5), we know tht k= ξ + (xcu+kb) +(xcv+k) π e = e π P x +x. e πη (i +i( ξ ξ)), i= nd k= ξ (xcu+kb) +(xcv+k) π e = e π P 0 e πη (i +i(ξ ξ )). i=

27 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 7 Thu π P e ρ (Z) α(x c) = π P 0 e ρ (Z) i=0 e πη (i +i( ξ ξ)) π P 0 + e i=0 e πη (i +i(ξ ξ )), if ξ / Z, π P 0 + e i= e πη i, if ξ Z. Let d 0 = e πη (+(ξ ξ )) ( + e πη (3+(ξ ξ )) ), d = e πη (+( ξ ξ)) ( + e πη (3+( ξ ξ)) ). We hve + d 0 + d e πη (i +i(ξ ξ )), i=0 e πη (i +i( ξ ξ)). i=0 Thee yield n etimtion of α(x): If ξ / Z ( ρ (Z) e π P ) ( + d ) + e π P 0 ( + d 0) α(x); if ξ Z ( + d 0 )e π P 0 ρ (Z) α(x). And for β(x c ), we hve where x c + b t. β(x c ) = ρ (Z) (x,x ) Sxc x t or x t Three ce hll be dicued eprtely:. ( b) t x c + b t;. ( b) t < x c < ( b) t; 3. nd + b t x c ( b) t. e π x +x.

28 8 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho Ce I: ( b) t x c + b t. In thi ce, condition x t or x t correpond to k t xv or k t xu b. So by (5), β(x c) = = ρ (Z) ρ (Z) ρ (Z) t xcu k= b e e π P π P0 (xcu+kb) +(xcv+k) π e + t xcu i= ξ b t xcv i= ξ t xv k= e πη (i +i( ξ ξ)) e πη (i i(ξ ξ )) + (xu+kb) +(xv+k) π e Note tht ( b) t x c + b t, we ee tht t x c u b ξ t x c u + b ξ b b t + b Obviouly, +b b +b +b b +b > b > 0, we get t x cv t xcv ξ ξ + + b b + b + b t + ( b + b t ). Ce III: + b t x c ( b) t. In thi ce, condition x t or x t correpond to k t x cu b or k t x cv. So imilrly with Ce I, we ee tht t x cv t xcv + b b ξ ξ + b t + b b t. + b Alo t x cu b t xcu ξ b + b ξ + ( b t ). + b Ce II: ( b) t < x c < ( b) t.

29 Error Etimtion of Prcticl Convolution Dicrete Guin Smpling 9 In thi ce, condition x t or x t correpond to k t x cv or k t x cv. So by (5), (xcu+kb) +(xv+k) π β(x) = ρ + (Z) = ρ (Z) ρ (Z) t xcv k= e e π P π P0 e t xcv i= ξ t xcv i= ξ t xcv k= e πη (i +i( ξ ξ)) e πη (i i(ξ ξ )) + (xcu+kb) +(xcv+k) π e Obviouly, +b b ( +b ) t x cv nd t x cv +b b +b t xcv ξ t xcv ξ > b > 0, we hve ξ + b b + b t ( + b ) b t. + b ξ + + b b + b t + ( ( + b ) b t ). + b When t +b ψ, we hve ω 0 nd ψ η t ωψ η t. A reult, for ll x c [ + b t, + b t], we hve e πη (i i(ξ ξ )) D 0, nd t xcv i= ξ t xcv i= e πη (i +i( ξ ξ)) D 0. ξ e where D 0 = πω ψ t. e π(ωψηt+η ) So β(x) ρ (Z) ρ (Z) e e ( ρ (Z) D0 π P π P0 e π P t xcv i= ξ t xcv i= ξ ) + e π P 0 e πη (i +i( ξ ξ)) e πη (i i(ξ ξ )) +

30 30 Zhongxing Zheng, Xioyun Wng, Gungwu Xu, Chunhun Zho Thu when ξ Z where D = ( D 0 b(x c) = β(xc) α(x c) = e π P ) + e π P 0 P π 0 e ( + d 0) ( + e π/ )e πψ ω t ( e π(ωψηt+η ) )( + e πη ( + e 3πη )) D e πω ψ t +e π/ ( e π(ωψηt+η) )(+e πη (+e 3πη )). And when ξ / Z, ume P P 0 without lo of generlity, we hve b(x c) = β(xc) α(x c) π P D 0e + D 0e π P 0 P π e ( + d ) + e π P 0 ( + d 0) e πω ψ t ( e π(ωψηt+η ) )( + e πη ( + e 4πη )) D e πω ψ t where D = ( e π(ωψηt+η) )(+e πη (+e 4πη )). Let C = D > D, for ll ξ, we hve b(x c ) Ce πω ψ t D0e π P 0 P π 0 e ( + d 0) It hould be noted tht to enure ω = +b ψ t 0, t +b ψ i required. Without thi requirement, b(x c ) could be very cloe to nd the dicuion would not be meningful. Beide, theorem 3. demnd + b η ε (Z), t η ε (Z) nd η ε (Z) cn be regrded contnt becue it i controlled by ε which i relted to the deigned error. We hve ω ψη ε(z) It i een tht lrger /b led to mller ψ well ω nd turn out to be much lrger b(x c ).