当前位置：文档库 › 2008 Trapdoors for Hard Lattices__ and New Cryptographic Constructions

2008 Trapdoors for Hard Lattices__ and New Cryptographic Constructions

Trapdoors for Hard Lattices

and New Cryptographic Constructions

Craig Gentry?

Stanford University cgentry@https://www.wendangku.net/doc/a86882816.html,

Chris Peikert?

SRI International

cpeikert@https://www.wendangku.net/doc/a86882816.html,

Vinod Vaikuntanathan?

MIT

vinodv@https://www.wendangku.net/doc/a86882816.html, November18,2007

Abstract

We show how to construct a variety of“trapdoor”cryptographic tools assuming the worst-case hardness of standard lattice problems(such as approximating the shortest nonzero vector

to within small factors).The applications include trapdoor functions with preimage sampling,

simple and e?cient“hash-and-sign”digital signature schemes,universally composable oblivious

transfer,and identity-based encryption.

A core technical component of our constructions is an e?cient algorithm that,given a basis

of an arbitrary lattice,samples lattice points from a Gaussian-like probability distribution whose

standard deviation is essentially the length of the longest vector in the basis.In particular,the

crucial security property is that the output distribution of the algorithm is oblivious to the

particular geometry of the given basis.

?Supported by the Herbert Kunzel Stanford Graduate Fellowship.

?This material is based upon work supported by the National Science Foundation under Grants CNS-0716786and CNS-0749931.Any opinions,?ndings,and conclusions or recommedations expressed in this material are those of the author(s)and do not necessarily re?ect the views of the National Science Foundation.

?The majority of this work was performed while at SRI International.

1Introduction

Ever since the seminal work of Ajtai[Ajt96]connecting the average-case complexity of lattice prob-lems to their complexity in the worst case,there has been an intriguing and fruitful e?ort to base cryptography(which requires security for randomly chosen keys)on worst-case lattice assumptions. In addition to their unique theoretical niche,lattice-based schemes enjoy many advantages:?rst, their asymptotic e?ciency and simplicity(usually requiring only linear operations on small inte-gers);second,their resistance so far to cryptanalysis by quantum algorithms(as opposed to schemes based on factoring or discrete log);and third,the guarantee that their random instances are“as hard as possible.”

To date,the known constructions of such primitives have been limited mainly to one-way and collision-resistant hash functions[Ajt96,GGH96,CN97,Mic04,MR07]and public-key encryp-tion[AD97,Reg04,Reg05].Of particular note is the lack of any“direct”construction of digital signatures having the simplicity and e?ciency of other lattice-based primitives,even in the random oracle model.1(An early signature proposal by Goldreich,Goldwasser,and Halevi[GGH97]was directly related to a certain lattice problem,but it lacked a security proof,and recently,Nguyen and Regev[NR06]showed how to completely recover the secret key from a transcript of signatures (on random messages).We discuss the GGH scheme in more detail below.)

There have been some recent developments in the construction of stronger cryptographic tools based on lattices(such as chosen ciphertext-secure encryption[PW07]).But despite many advances in the study of lattices in cryptography,it is still unknown how to realize several notions that were long ago constructed based on other number-theoretic problems,such as those related to factoring.

1.1Overview of Results and Techniques

Our main thesis in this work is that lattices admit natural and innate“trapdoors”that have a num-ber of useful cryptographic applications.Going at least as far back as the GGH proposal[GGH97], is was intuitively believed that a short basis of a lattice could serve as such a trapdoor.Our main contribution is to show how to use a trapdoor basis in a theoretically sound and secure way.

As a basic tool,we?rst construct a collection of trapdoor functions having some special prop-erties.The functions are many-to-one,(i.e.,every output value has several preimages),and the trapdoor inversion algorithm samples from among all the preimages under an appropriate distribu-tion.Building upon this foundation,we demonstrate e?cient realizations of several more advanced cryptographic tools,including signature schemes,universally composable oblivious transfer,and identity-based encryption.

The core technique underlying all these results is an e?cient algorithm that“obliviously”sam-ples from Gaussian-like probability distributions over arbitrary lattices,given a basis(or even just a full-rank set)of appropriate length.This technique also yields simpler and(slightly)tighter worst-case/average-case connections for lattice problems,and may have additional applications in complexity theory and cryptography.

1Indirect(but complex and ine?cient)constructions are of course possible by a generic transformation from universal one-way hash functions[NY89],or(in the random oracle model)by applying the Fiat-Shamir heuristic[FS86] to lattice-based identi?cation schemes[MV03].

1.1.1Gaussian Sampling Algorithm

Because it is the main foundation of our cryptographic results,we start with a summary of our sampling algorithm.Given a basis B?R n of some arbitrary n-dimensional lattice2Λ(or even just a full-rank set S?Λ),the algorithm chooses a lattice vector at random under a Gaussian-like probability distribution whose standard deviation is essentially the length of the longest vector in B(or S).Such discrete Gaussian distributions over lattices have been used in mathematics to prove tight“transference theorems”for lattices[Ban93,Ban95],and more recently have proved exceedingly useful in studying the computational complexity of lattice problems[AR03,AR05, Pei07],particularly their worst-case/average-case connections(e.g.,[Reg04,MR07,Reg05]).Up to this point,however,discrete Gaussians have been used primarily as an analysis tool,rather than an algorithmic one.

The sampling algorithm can also be viewed as a randomized decoder that,given some short lattice vectors as“advice,”outputs a lattice vector that is relatively close to any given target point t∈R n.The key feature of the decoder is that its output distribution depends only on the length of the advice vectors,and is otherwise oblivious to their particular geometry.This will be a crucial security property in our cryptographic applications.

The algorithm itself is actually a simple randomized variant of Babai’s“nearest-plane”algo-rithm[Bab86],with one small di?erence.Instead of always choosing the nearest plane,the algorithm chooses a particular plane with a probability determined by its distance from the target point.It turns out that this simple change causes the output distribution to be statistically close to a dis-crete Gaussian,though the analysis is non-trivial and crucially uses the notion of the smoothing parameter introduced by Micciancio and Regev[MR07].3The full details are given in Section3.

1.1.2Cryptographic Constructions

For all of our cryptographic constructions,we will need to generate a“hard”public basis for a random latticeΛ,together with a short private basis forΛ,which will be used as advice for the sampling algorithm.Our preferred approach is due to Ajtai[Ajt99],who described a way to generate such bases so that the public basis has worst-case hardness.(As far as we know,our results are the?rst use of Ajtai’s generator in cryptography or otherwise.)

Trapdoor functions with preimage sampling.The basic object underlying our higher-level cryptographic tools is a collection of one-way(and also collision-resistant)trapdoor functions.Very informally,evaluating a public function f corresponds to choosing a lattice point v∈Λ“uniformly at random”and perturbing it by some short error term e,yielding a point y=v+e.4Finding a preimage of y corresponds to decoding it to a su?ciently nearby lattice point v ∈Λ(not necessarily the original v).This is easy using our sampling algorithm with the trapdoor,but should otherwise be hard(for the particular distribution ofΛand y).

Our trapdoor functions have two crucial properties for security in cryptographic applications. First,the input(the error term e)is drawn from a Gaussian distribution with relatively small 2The lattice generated by the basis B={b

,...,b n}is the set of all integer combinations of the linearly-

independent vectors b1,...,b n.

3In private communication,Lyubashevsky has pointed out that Klein[Kle00]also proposed a randomized nearest-plane algorithm in another context,but gave only a limited analysis of its output distribution.See Section1.2.

4Being an in?nite set,the latticeΛcannot support a uniform distribution.In actuality,the function simply reduces the error term e modulo the public basis forΛ.

standard deviation,and under this distribution,the output y is statistically close to uniform over the range.This equates the inversion problem with decoding a uniformly random point given the public basis,for which we can show worst-case hardness.Second,the trapdoor inversion algorithm does not just?nd an arbitrary preimage of y,but actually samples from all its preimages(under the appropriate conditional distribution),using our discrete Gaussian sampling algorithm.In other words,the inverter samples an input e from the Gaussian input distribution,conditioned on the event that f(e)=y.Taken together,these two properties imply that there are two(nearly) equivalent ways of choosing a pair(e,y=f(e)):either choose e from the input distribution and compute y=f(e),or choose y uniformly at random and sample e from f?1(y).As we shall see, this makes our trapdoor functions“as good as”trapdoor permutations in certain applications.5 Further discussion of random lattices,the hard decoding problem,and the full details of our trapdoor functions appear in Section4.

Signature schemes.There are several(relatively e?cient)digital signature schemes in the liter-ature based on trapdoor permutations:full-domain hash-like schemes[DH76,BR93,BR96,Cor02] that follow the so-called“hash-and-sign paradigm”and have security analyses in the random oracle model,and the scheme of Bellare and Micali[BM92]that is secure in the standard model.

We show that all of the above permutation-based signature schemes can be instantiated equally well using trapdoor functions with preimage sampling,and retain their security analyses in their respective models(though subtleties can arise when dealing with multiple queries on the same mes-sage).In fact,we can demonstrate tight security reductions using the collision-resistance property of our functions,rather than just their one-wayness.

Concretely,our hash-and-sign signatures bear a close resemblance to the original(but insecure) GGH proposal and its variants[GGH97,HHGP+03]:informally,a message is hashed to a ran-dom point in space,and its signature is essentially a nearby lattice point,which is found using a short basis.Our schemes have two main di?erences:?rst,they are based on random lattices that enjoy worst-case hardness;second and more importantly,the signatures are generated by a randomized decoding algorithm,whose output distribution is oblivious to the particular geometry of the trapdoor basis.(The original GGH proposal was insecure precisely because its signatures leaked information about the“shape”of the private basis,allowing full key recovery[NR06].) Signature schemes are constructed and analyzed in Section5.

E?cient universally composable oblivious transfer.Our next applications are centered around a cryptosystem of Regev that is based on a problem called learning with error(LWE)[Reg05]. We demonstrate a trapdoor that applies to an optimized version of the system in which all parties generate their public keys relative to some shared random lattice.6

The?rst application of this trapdoor is universally composable oblivious transfer,the topic of a concurrent work by Peikert et al.[PVW07].The central objects of study in that work are called message-lossy(or“messy”)public keys,whose de?ning property is that a ciphertext produced under such a key carries no information(statistically)about the encrypted message.

5It is also possible to use other(non-Gaussian)input distributions,as long as the function’s output remains close to uniform and there is an e?cient way to sample preimages under the(conditional)input distribution.

6The existence of a trapdoor means that users of the system must implicitly trust the creator of the shared lattice, because it can extract secret keys from any properly-generated public keys.We note that this by no means constitutes a“break”of Regev’s system,because parties can generate their own individual lattices.

Prior works on lattice-based encryption[AD97,Reg04,Reg05]used probabilistic arguments to show that messy keys are very dense.In this work,we give an explicit geometric description of messy keys in(a slight variant of)Regev’s cryptosystem.Essentially,a public key is messy if,after adjoining it to the shared lattice,the minimum distance of the lattice remains large.We then show how to recognize such keys,by using our Gaussian sampling algorithm to e?ciently implement the preprocessing step of an algorithm that identi?es points that are far from a given lattice,due to Aharonov and Regev[AR05].

The trapdoor for Regev’s cryptosystem is described in further detail in Section6.

Identity-based encryption.Identity-based encryption(IBE),?rst proposed by Shamir[Sha84], permits arbitrary strings to serve as public keys in a cryptosystem.Thus far,IBE has been realized using groups with bilinear pairings(e.g.,[BF03,BB04,Wat05])and under the quadratic residuosity (QR)assumption in the random oracle model,or under an“interactive”QR assumption in the standard model[Coc01,BGH07].

Our?nal application is an e?cient IBE based on LWE in the random oracle model,or under an interactive assumption on the hardness of LWE in the standard model.Although it is possible to extract secret keys from public keys(using a trapdoor)in Regev’s LWE-based cryptosystem, obtaining IBE is still not entirely straightforward.Essentially,the problem is that well-formed public keys are exponentially sparse,because they consist only of points that are very close to the shared lattice.Hence,it is di?cult to see how a hash function or a random oracle could map identities to valid public keys.We circumvent this problem by constructing a“dual”of Regev’s cryptosystem,in which the key generation and encryption algorithms are e?ectively swapped.In the resulting system,every point in space is a valid public key that has many equivalent secret keys,which are simply the lattice points su?ciently close to the public key.

Due to its use of a trapdoor for extracting secret keys,our IBE is structurally most similar to those based on QR[Coc01,BGH07].It is remarkably e?cient,at least in an asymptotic sense:for ?Θ(n)-bit messages(where n is the security parameter),the amortized running time of encryption

and decryption is only?O(n)bit operations per encrypted bit.The ciphertext expansion is O(1), and can even brought arbitrarily close to1under a strong enough(but still polynomial)assumption on LWE.One possible drawback of our system is that the master public key and individual secret keys are?O(n2)bits.

The constructions of the dual cryptosystem and IBE appear in Section7.

1.2Assumptions

Our trapdoor functions and signatures are built upon an average-case“absolute distance”decoding problem on random lattices.Our“encryption-like”primitives,i.e.,oblivious transfer and identity-based encryption,are built on the average-case learning with error(LWE)problem,de?ned by Regev[Reg05].LWE can seen as a“unique decoding”problem on a certain family of random lattices, and is a generalization(to larger moduli)of the well-studied learning parity with noise problem, which is believed to be hard and has seen many applications in cryptography(e.g.,[BKW03,HB01, JW05,KS06]).

Both of the above decoding problems are hard on the average if standard lattice problems(like the shortest vector problem)are hard to approximate to within small polynomial factors in the dimension of the lattice,in the worst case.However,the reduction for LWE is quantum[Reg05],i.e., LWE is hard if certain lattice problems are hard in the worst case for quantum algorithms.Given

the state of the art,a stronger assumption for encryption-like primitives is necessary,because there is no known cryptosystem based on classical worst-case hardness for general lattices.7

For the lattice problems underlying our schemes,the best known classical (and quantum)algo-rithms require time and space exponential in the dimension of the lattice [?],and the best known polynomial-time algorithms deliver exponentially-loose approximations [?,?].

1.3Related Work

Using completely di?erent techniques,Peikert and Waters [PW07]have constructed an entirely complementary collection of injective trapdoor functions based on lattice problems (among others).Their TDFs are based on the hardness of LWE ,whereas ours are based entirely on classical worst-case hardness.Their TDFs are injective with exponentially-sparse images,whereas ours are many-to-one and surjective.Their TDFs imply chosen ciphertext-secure encryption,but the sparse images seem to make them less well-suited toward applications like signature schemes and IBE.Finally,from a purely aesthetic point of view,our trapdoor functions correspond more directly to a “natural”decoding problem on lattices.

As mentioned above,Peikert,Vaikuntanathan,and Waters [PVW07]have constructed e?cient and universally composable oblivious transfer protocols from worst-case lattice assumptions (among others),using our trapdoor for detecting messy keys.That work predates this one,and provided motivation for our trapdoor techniques and Gaussian sampling algorithm.

In private communication,Lyubashevsky has pointed out that the randomized nearest-plane algorithm we use for Gaussian sampling is essentially the same algorithm proposed by Klein [Kle00]for solving a di?erent problem.Klein considers a restricted variant of the closest vector problem,in which the target point is guaranteed to be “unusually close”to the lattice.His analysis shows that under such a promise,the algorithm outputs the closest lattice vector with noticeable probability.Our contribution is an analysis of the entire output distribution of the algorithm for arbitrary target points,which shows that the distribution is oblivious to the advice basis.

Preliminaries 2.1Notation

We denote set of real numbers by R and the integers by Z .For a positive integer n ,[n ]denotes {1,...,n }.We extend any real function f (·)to a countable set A by de?ning f (A )= x ∈A f (x ).

By convention,vectors are assumed to be in column form and are written using bold lower-case letters,e.g.x .The i th component of x will be denoted by x i .Matrices are written as bold capital letters,e.g.X ,and the i th column vector of a matrix X is denoted x i .The length of a matrix is the norm of its longest column: X =max i x i .For notational convenience,we sometimes view a matrix as simply the set of its column vectors.

The natural security parameter throughout the paper is n ,and all other quantities are implicitly functions of n .We use standard big-O notation to classify the growth of functions,and say that f (n )=?O

(g (n ))if f (n )=O (g (n )·log c n )for some ?xed constant c .We let poly(n )denote an unspeci?ed function f (n )=O (n c )for some constant c .A negligible function,denoted generically

The cryptosystems from [AD97,Reg04]are based on classical worst-case hardness,but for a restricted class of lattices having “unique”shortest nonzero vectors.6

by negl (n ),is an f (n )such that f (n )=o (n ?c )for every ?xed constant c .We say that a probability (or fraction)is overwhelming if it is 1?negl (n ).

The statistical distance between two distributions X and Y over a domain D is de?ned to be 12 d ∈D |X (d )?Y (d )|.We say that two distributions (formally,two ensembles of distributions indexed by n )are statistically close if their statistical distance is negligible in n .

Two ensembles of distributions {X n }and {Y n }are computationally indistinguishable if for every probabilistic poly-time machine A ,|Pr[A (1n ,X n )=1]?Pr[A (1n ,Y n )=1]|is negligible (in n ).The de?nition can be extended to non-uniform families of poly-sized circuits in the standard way.

2.2Standard De?nitions

TODO:strong unforgeability under chosen-message attack

TODO:(ANON-)IND-CPA for IBE.

2.3Lattices

An n -dimensional lattice of rank k ≤n is

Λ=L (B )= Bc :c ∈Z k ,B ∈R n ×k where the k columns b 1,...,b k ∈R n of the basis B are linearly independent.The dual lattice of Λ,denoted Λ?,is de?ned as Λ?={x ∈span(Λ):?v ∈Λ, x ,v ∈Z }.

The minimum distance λ1(Λ)of a lattice Λis the length (in some norm,implicitly the Euclidean 2norm)of its shortest nonzero element:λ1(Λ)=min 0=x ∈Λ x .More generally,the i th successive minimum λi (Λ)is the smallest radius r such that Λcontains i linearly independent vectors of norm at most r .We will write λ∞1to denote the minimum distance measured in the ∞norm (which is de?ned as x ∞=max |x i |).

A lattice is a discrete additive subgroup of R n .Therefore for lattices Λ ?Λ,the quotient group Λ/Λ (also written Λmod Λ )is well-de?ned as the group of distinct cosets v +Λ for v ∈Λ,with addition of cosets de?ned in the usual way.In particular,if both Λ and Λare of the same rank k ,then Λ/Λ is ?nite.

For completeness,we recall two standard worst-case approximation problems on lattices (though we will not need to refer to their speci?c de?nitions at any point).In both problems,γ=γ(n )is the approximation factor as a function of the dimension.

De?nition 2.1(Shortest Vector Problem (Decision Version)).An input to GapSVP γis a pair (B ,d )where B a basis for a full-rank n -dimensional lattice and d ∈R .It is a YES instance if λ1(L (B ))≤d ,and is a NO instance if λ1(L (B ))>γ(n )·d .

De?nition 2.2(Shortest Independent Vectors Problem).An input to SIVP γis a full-rank basis B of an n -dimensional lattice.The goal is to output a set of n linearly independent lattice vectors S ?L (B )such that S ≤γ(n )·λn (L (B )).

2.4Gaussians on Lattices

Our review of Gaussian measures over lattices follows the development by prior works [Reg04,AR05,MR07].For any s >0de?ne the Gaussian function on R n centered at c with parameter s :

?x ∈R n ,ρs,c (x )=exp(?π x ?c 2/s 2).

The subscripts s and c are taken to be 1and 0(respectively)when omitted.

For any c ∈R n ,real s >0,and n -dimensional lattice Λof rank k ≤n ,de?ne the discrete Gaussian distribution over Λas:

?x ∈Λ,D Λ,s,c (x )=ρs,c (x )ρs,c (Λ)

.(As above,we may omit the parameters s or c .)Note that the denominator in the above expression is simply a normalization factor;the probability D Λ,s,c (x )is simply proportional to ρs,c (x ).There-fore for any c ∈R n ,the distributions D Λ,s,c and D Λ,s,c are identical,where c is the orthogonal projection of c onto span(Λ).

Micciancio and Regev [MR07]proposed a lattice quantity called the smoothing parameter :De?nition 2.3([MR07]).For any n -dimensional lattice Λand positive real >0,the smoothing parameter η (Λ)is the smallest real s >0such that ρ1/s (Λ?\{0})≤ .

We recall two bounds on the smoothing parameter.The ?rst relates the smoothing parameter of a rank-k lattice to its k th successive minimum λk (in 2norm).

Lemma 2.4([MR07]).For any n -dimensional lattice Λof rank k and real >0,we have

η (Λ)≤λk (Λ)· log(2k (1+1/ ))/π.

Then for any ω(√log n )function,there is a negligible (n )for which η (Λ)≤λk (Λ)·ω(√log n ).

The second bound relates the smoothing parameter of a lattice to the minimum distance of its dual lattice,in ∞norm .We note that the smoothing parameter can also be related to the dual minimum distance in 2norm (as shown in [MR07]),but the ∞norm turns out to be easier to analyze for random lattices,and will also yield the tightest bounds on their smoothing parameters.Lemma 2.5([Pei07]).For any n -dimensional lattice Λof rank k and real >0,we have

η (Λ)≤ log(2k/(1+1/ ))/πλ∞1

(Λ?).Then for any ω(√log n )function,there is a negligible (n )for which η (Λ)≤ω(√log n )/λ∞1(Λ?).

We now state some central facts regarding discrete Gaussians that apply when the Gaussian parameter s exceeds the smoothing parameter of the lattice.The following lemma states that the total Gaussian measure on any translate of the lattice is essentially the same.

Lemma 2.6([MR07],implicit).Let Λbe any n -dimensional lattice of rank k .Then for any s ≥η (Λ),real ∈(0,1),and c ∈span(Λ),we have

ρs,c (Λ)∈[1? 1+ ,1]·ρs (Λ).

A corollary is that a Gaussian sample over Λis distributed almost-uniformly modulo a sublattice Λ (of the same rank),for s ≥η (Λ ).

Corollary 2.7.Let Λ,Λ be n -dimensional lattices of rank k ,with Λ ?Λ.Then for any ∈(0,12),any s ≥η (Λ ),and any c ∈R n ,the distribution of (D Λ,s,c mod Λ )is within statistical distance at most 2 of uniform over (Λmod Λ ).

Proof.We can assume c ∈span(Λ)without loss of generality.Consider the marginal distribution of (z mod Λ )where z ←D Λ,s,c .Then for any coset v +Λ of Λ/Λ ,the probability that z =v mod Λ is proportional to

ρs,c (v +Λ )=ρs,c ?v (Λ )∈[1? 1+ ,1]·ρs (Λ )

by Lemma

2.6.By a routine calculation,it follows that for every v ,the probability that z =v mod Λ is within (1±4 )/|Λ/Λ |,which yields the claim.

Another fact we need says that a sample from a discrete Gaussian with parameter s is at most s √n away from its center (in 2norm),with overwhelming probability.

Lemma 2.8([MR07]).For any n -dimensional lattice Λof rank k ,c ∈span(Λ),real ∈(0,1),and s ≥η (Λ),we have Pr x ←D Λ,s,c

x ?c >s √n ≤1+ 1? ·2?k .The ?nal fact we need for certain applications is an upper bound on the probability of the mode (the most likely element)of a discrete Gaussian;equivalently,it is a lower bound on the min-entropy of the distribution.A bound that applies when s ≥2η (Λ)was ?rst proved in [PR06];here we give a di?erent style of proof that works for s ≥η (Λ)(the di?erence is mainly aesthetic).Lemma 2.9.For any n -dimensional lattice Λof rank k ,center c ∈R n ,positive

D Λ,s,c (x )≤1+ 1? ·2?k .

In particular,the min-entropy of D Λ,s,c is at least k ?1.

Proof.We can assume without loss of generality that c ∈span(Λ).For any x ∈Λ,we have

D Λ,s,c (x )=ρs,c (x )ρs,c (Λ)≤1ρs,c (Λ)≤1+ 1? ·1ρs (Λ)

,where the ?nal inequality is by Lemma 2.6.Therefore it su?ces to show that ρs (Λ)≥2k .

By the Poisson summation formula,

ρs (Λ)=det(Λ?)·s k ·ρ1/s (Λ?)≥det(Λ?)·s k .

(2.1)Now by Minkowski’s second theorem,we have

det(Λ?)≥ i ∈[k ]

λi (Λ?)≥(λ?1)k ,

(2.2)

where we write λ?1=λ1(Λ?).Let v ∈Λ?be such that v =λ?1.Now because s ≥η (Λ),we have

≥ρ1/s (Λ?\{0})≥ρ1/s (v )=exp(?π·(sλ?1)2).Therefore s ≥ ln(1/ )/π/λ?1≥2/λ?https://www.wendangku.net/doc/a86882816.html,bining this with Inequalities (2.1)and (2.2),we con-

clude that ρs (Λ)≥2k as desired.

2.5Learning with Error

We start by introducing the learning with error (LWE )problems,for the most part following [Reg05].For x ∈R , x = x +1/2 denotes a nearest integer to x .Denote T =R /Z as the group of reals [0,1)with mod 1addition.

Probability distributions.The normal (Gaussian)distribution with mean 0and variance σ2

(or standard deviation σ)is the distribution on R having density function 1σ·√2πexp(?x 2/2σ2).The sum of two independent normal variables with mean 0and variances σ21and σ22(respectively)is a normal variable with mean 0and variance σ21+σ22.We will also need a standard tail inequality:

a normal variable with variance σ2is within distance t ·σ(i.e.,t standard deviations)of its mean,

except with probability at most 1t ·exp(?t 2/2).

For α∈R +,Ψαis de?ned to be the distribution on T of a normal variable with mean 0and standard deviation α/√2π,reduced modulo 1.For any probability distribution φover T and an integer q ∈Z +(often implicit)its discretization ˉφ

is the discrete distribution over Z q of the random variable q ·X φ mod q ,where X φhas distribution φ.

For an integer q ≥2and some probability distribution χover Z q ,an integer dimension n ∈Z +

and a vector s ∈Z n q ,de?ne A s ,χas the distribution on Z n q ×Z q of the variable (a ,a T s +x )where

a ←Z n q is uniform and x ←χare independent,and all operations are performed in Z q .Learning with error (LWE ).For an integer q =q (n )and a distribution χon Z q ,the goal of the (average-case)learning with error problem LWE q,χis to distinguish (with nonnegligible probability)between the distribution A s ,χfor some uniform (secret)s ←Z n q and the uniform distribution on Z n q ×Z q (via oracle access to the given distribution).In other words,if LWE is hard,then the collection of distributions A s ,χis pseudorandom.

Regev demonstrated that for certain moduli q and Gaussian error distributions χ,LWE q,χis as hard as solving several standard worst-case lattice problems using a quantum algorithm .

Proposition 2.10([Reg05]).Let α=α(n )∈(0,1)and let q =q (n )be a prime such that α·q >2√n .If there exists an e?cient (possibly quantum)algorithm that solves LWE q,ˉΨα,then there exists an e?cient quantum algorithm for approximating SIVP and GapSVP in the 2norm,in the worst case,to within ?O

(n/α)factors.Peikert [Pei07]extended this result to hold for SIVP and GapSVP in any p norm,2≤p ≤∞,for essentially the same ?O

(n/α)approximation factors.3Sampling from Discrete Gaussians

Here we show how to e?ciently sample from a discrete Gaussian probability distribution D Λ,s,c ,given any basis (or full-rank set)of length bounded by about s .As a ?rst attempt,we might consider an algorithm that ?rst samples from a continuous Gaussian,and then uses the short basis to “round o?”the sampled point to a nearby lattice point.In fact,Regev used this exact strategy for the “bootstrapping”step of his reduction [Reg05],using an LLL-reduced basis and a Gaussian parameter s that was exponentially larger than the basis length.Unfortunately,it is not clear that this strategy works as well when s is a smaller (e.g.,poly(n ))multiple of the basis length.The problem is that within the region of space that is mapped (via rounding)to a particular lattice

point,the density function of the continuous Gaussian may vary signi?cantly.This makes it di?cult to analyze the total probability mass assigned to each lattice point under the rounding scheme,and to compare it to the desired discrete Gaussian distribution.8

The sampling algorithm below avoids continuous Gaussians altogether,and samples “directly”from the lattice in a tight way.It can be seen as a randomized version of Babai’s nearest plane algorithm [Bab86],where instead of always choosing the nearest plane,the algorithm chooses a plane at random with a probability related to its distance from the target point.The rest of this section is devoted to formally de?ning and analyzing the sampling algorithm.

3.1Sampling Integers

We ?rst develop a core subroutine,which samples from a discrete Gaussian distribution over a particular one-dimensional lattice,namely,the integers Z .This subroutine will depend on a tail inequality for the distribution:

Lemma 3.1.For any >0,any s ≥η (Z ),and any t >0,we have

Pr x ←D Z ,s,c [|x ?c |≥t ·s ]≤2e ?πt 2·1+ 1? .

Then for ∈(0,12

)and t ≥ω(√log n ),the probability that |x ?c |≥t ·s is negligible (in n ).Proof.Let B =(?1,1).We will use the fact (proved more generally in [Ban95])that

ρs ((Z ?c )\t ·s ·B )≤2e ?πt 2

·ρs (Z ).Now consider the total probability assigned by D Z ,s,c to all integers outside t ·s ·(B +c ).This is

D Z ,s,c (Z \(s ·t ·(B +c )))=ρs ((Z ?c )\t ·s ·B )ρs,c (Z )≤2e ?πt 2·ρs (Z )ρs,c (Z )≤2e ?πt 2

·ρs (Z )1? 1+

·ρs (Z ),where we have used Lemma 2.6for the last inequality.This completes the proof.

There are several possible methods for e?ciently sampling from D Z ,s,c (for large enough s );the easiest to describe works by the standard method of rejection sampling.Let t (n )≥ω(√log n )be some ?xed function.The algorithm SampleD works as follows:on input (s,c )and (implicitly)the security parameter n ,choose an integer x ←Z =Z ∩[c ?s ·t,c +s ·t ]uniformly at random.Then with probability ρs (x ?c ),output x ,otherwise repeat.

Lemma 3.2.For any ∈(0,1/2)and any s ≥η (Z ),SampleD runs in time polynomial in n and the size of its input (s,c ),and its output distribution is statistically close to D Z ,s,c .

Proof.First de?ne a probability distribution D on Z in which D (x )is proportional to ρs (x ?c )for every x ∈Z ,and D (x )=0otherwise.By rejection sampling,the output distribution of SampleD is identical to D .Furthermore,the D and D Z ,s,c are statistically close,by Lemma 3.1.

8By using an additional step of rejection sampling,one can e?ectively “?atten”the continuous distribution over each region that is mapped to a particular lattice point.However,the resulting algorithm is still somewhat “loose,”working for a parameter s that is a √n factor of the diameter the basis (which may be up to an n factor larger than the basis length).11

We now analyze the running time.Each iteration of SampleD picks a uniformly random integer x from Z .The probability that the chosen integer x falls in the set Z ∩[c ?s,c +s ]is at least (2s ?1)/(2s ·t )≥1/2t ,because s ≥η (Z )≥1.Once chosen,x is then output with probability ρs (x ?c )≥exp(?π),a positive constant.By a standard repetition argument,the running time is O (t (n ))with all but an exponentially small probability (which can be made zero by terminating after a certain number of iterations,without signi?cantly altering the output distribution).

3.2Sampling from Arbitrary Lattices

Overloading notation,we now describe an algorithm SampleD that samples from a discrete Gaussian over any lattice.The algorithm works exactly like Babai’s “nearest plane”algorithm,except that it chooses a plane at random with a probability given by a discrete Gaussian over the integers Z .

The SampleD algorithm takes some n -dimensional basis B ∈Z n ×k of rank k ,a su?ciently large Gaussian parameter s (related to the length B of the basis),a center c ∈R n ,and e?ciently outputs a sample from (a distribution close to)D L (B ),s,c .It proceeds as follows:on input (B ,s,c ),

1.If k =0(i.e.,if B is empty),return 0.

https://www.wendangku.net/doc/a86882816.html,pute ?b

k ,the (nonzero)component of b k orthogonal to span(b 1,...,b k ?1)https://www.wendangku.net/doc/a86882816.html,pute t ,the projection of c onto span(B ),and the scalar value t = t ,?b

k / ?b k ,?b k ∈R .4.Choose an integer z ←D Z ,s/ ?b k ,t ,using the SampleD algorithm for Z described above.(This is the only step that di?ers from the standard nearest plane algorithm.)

5.Output z b k +SampleD (B ,s,t ?z b k )via recursion,where B =[b 1,...,b k ?1].

As described,the sampler runs in time O (n 2)times the representation length (in bits)of B ,t .As an optimization,the Gram-Schmidt vectors ?b

k (and their lengths)and the scalar values t ,?b k can be pre-computed if the sampler is called multiple times on the same basis B and center t .With these optimizations,the sampler runs in linear O (n )amortized time (times the bit length of B ,t )to produce ?(n )samples.Theorem 3.3.For any lattice basis B ∈Z n ×k ,any real s ≥ B ·ω(√log n ),and any c ∈R n ,the output distribution of SampleD (B ,s,c )is within negligible statistical distance of D L (B ),s,c .The running time of SampleD is polynomial in n and the size of its input (B ,s,c ).

The main strategy for proving the theorem is to analyze the desired distribution D =D L (B ),s,c ,speci?cally,the total probability mass it assigns to the lattice points in each distinct plane.Each plane contains some translate of the same sublattice of rank k ?1(generated by B ).The smoothing parameter will guarantee that the mass assigned by D to the translated sublattice is essentially independent of the translation,and therefore only depends on the distance between the plane and the center c .Therefore it su?ces for the algorithm to choose a plane with a probability related to this distance,and proceed recursively.

Before proving Theorem 3.3,we develop some technical facts about the distribution D L (B ),s,c that make the above intuition more precise.Let B ,B ,and ?b

k =0be as in the algorithm above.De?ne b k =b k ??b k ∈span(B ),and partition L (B )into a collection of sets {H z }z ∈Z ,where

H z =z b k +L (B )=z ?b k +(L (B )+z b k

).For every w ∈L (B ),de?ne ζ(w )=z where w ∈H z .

Lemma 3.4.Adopt the notation from above,let s >0,and let t ∈span(B )be arbitrary.Let w ←D L (B ),s,t .Then for every z ∈Z ,

1.The probability that ζ(w )=z is proportional to

ρs/ ?b k ,t (z )·ρs,t ?z b k

(L (B )),where t = t ,?b

k / ?b k ,?b k and t =t ?t ?b k ∈span(B ).2.The conditional distribution of w ?z b k ,given ζ(w )=z ,is exactly D L (B ),s,t ?z b k .

Proof.We start with the ?rst claim.The probability that ζ(w )=z for any ?xed z ∈Z is simply D L (B ),s,t (H z ),which is proportional to ρs,t (H z ).Now we have

ρs,t (H z )=ρs ((z ?t )?b k +(L (B )+z b k

?t ))=ρs ((z ?t )?b k )·ρs (L (B )+z b k

?t )(3.1)=ρs/ ?b k ,t (z )·ρs,t ?z b k (L (B ))(3.2)

where (3.1)follows because because ?b k is orthogonal to span(B ),and (3.2)follows by de?nition of ρ.This establishes the ?rst claim.

For the second claim,consider the conditional distribution D of w =w ?z b k ∈L (B ),given w ∈H z .This distribution is

D (w )=ρs,t (w )

ρs,t (z b k +L (B ))=ρs,t ?z b k (w ?z b k )ρs,t ?z b k (L (B ))

=D L (B ),s,t ?z b k (w ).We now prove the main theorem.

Proof of Theorem 3.3.First recall that D L (B ),s,c and D L (B ),s,t are identical,where t is the projec-tion of c onto span(B ).Therefore it enough to prove that the algorithm samples from (a distribution close to)D L (B ),s,t .

The running time of the algorithm may be easily veri?ed.The proof of correctness proceeds by induction on the rank k of the lattice.When k =0(i.e,when B is empty),L (B )={0}and D L (B ),s,c assigns probability 1to 0.Therefore the base case is correct.

For k >0,the inductive hypothesis is that the distribution of z b k +SampleD (B ,s,t ?z b k )is statistically close to z b k +D L (B ),s,t ?z b k ,which by Lemma 3.4is the conditional distibution of a sample w ←D L (B ),s,t given ζ(w )=z .Therefore it su?ces to show that the algorithm samples from the appropriate marginal distribution on ζ(w ).

For every z ∈Z ,by Lemma 3.4the marginal probability that ζ(w )=z is proportional to

ρs/ ?b k ,t (z )·ρs,t ?z b k

(L (B )),where t ∈R and t ,b k ∈span(B )are as in the lemma.Now because s ≥ B ·ω(√log n ),there is a negligible (n )such that s ≥η (B )by Lemma 2.4.Thus,for every z ∈Z we have

ρs,t ?z b k

(L (B ))∈ 1? 1+ ,1 ·ρs (L (B ))by Lemma 2.6.Therefore the distribution of ζ(w )is statistically close to D Z ,s/ ?b k ,t .Now s/ ?b

k ≥s/ b k ≥ω(√log n )≥η (Z )for some negligible (n )and by hypothesis on s .Therefore by Lemma 3.2,the distribution of z chosen by SampleD is statistically close to D Z ,s/ ?b k ,t ,as desired.

3.3Sampling with Independent Vectors

In certain applications,we will have a short set S of linearly independent lattice vectors that do not necessarily form a basis of the lattice.While one can e?ciently convert such a set into a basis (using any basis B of arbitrary length),the resulting basis length may be up to a √n factor larger than S .Therefore,it will be more convenient to design an algorithm that can sample from the discrete Gaussian distribution,given only a basis B (of arbitrary length)and a short set S ?L (B )of the same rank as B .

Overloading notation once again,we now describe an algorithm SampleD that,given some n -dimensional basis B ∈Z n ×k of rank k ,a set S ?L (B )of rank k ,a su?ciently large Gaussian parameter s (related to S ),and a center c ∈R n ,e?ciently produces a sample from (a distribution very close to)D L (B ),s,c .It proceeds as follows:on input (B ,S ,s,c ),

1.Choose a lattice point v ∈L (B )such that v mod L (S )is distributed uniformly in L (B )/L (S ).(This can be done in time polynomial in the representation of B and S ;see [MG02].)

2.Choose y ←D L (S ),s,c ?v ,by calling SampleD (S ,s,c ?v )with the algorithm described above.

3.Output y +v .

Lemma 3.5.For B ,S ,and c as above,and any s ≥ S ·ω(√log n ),the output distribution

of SampleD (B ,S ,s,c )is within negligible statistical distance of D L (B ),s,c .The running time of SampleD is polynomial in n and the size of its input (B ,S ,s,c ).

Proof.The running time of the algorithm is apparent.It su?ces to show that the algorithm samples from (close to)D L (B ),s,c when y is chosen exactly according to the distribution D L (S ),s,c ?v ;it then follows by Theorem 3.3that the output distribution changes by only a negligible amount when y is chosen according to SampleD (S ,s,c ?v ).Suppose that z is chosen from D L (B ),s,c .Because s ≥ S ·ω(√log n ),by Lemma 2.4we have s ≥η (L (S ))for some negligible (n ).Therefore by Lemma 2.7,the marginal distribution of z mod L (S )is statistically close to uniform over L (B )/L (S ).

Now for any ?xed v ∈L (B ),consider the conditional distribution D of z ,given z =v mod L (S ).For each z ∈v +L (S ),this conditional distribution is

D (z )=ρs,c (z )ρs,c (v +L (S ))=ρs,c ?v (z ?v )ρs,c ?v (L (S ))

=D L (S ),s,c ?v (z ?v ).Therefore z is distributed as v +D L (S ),s,c ?v .

In summary,the algorithm samples from (close to)both the appropriate marginal and condi-tional distributions of D

L (B ),s,c ,and the claim follows.

4Trapdoors for Hard Random Lattices

In this section,we demonstrate trapdoors for certain random lattices that are,informally speaking,“as hard as”worst-case lattices.We then develop some foundational tools and primitives that our cryptographic applications will build upon.

4.1Random Modular Lattices

We start by describing two kinds of modular lattices that have appeared in recent works.A modular lattice is an integer lattice that is invariant under shifts by q in each of the coordinates,for some ?xed modulus q.In other words,whether a vector x∈Z m is an element of the lattice is determined entirely by x mod q.For all of our applications,we will need q to be prime.

More formally,let A∈Z n×m

q for some positive integers n,m,q.In prior works(as in this one),n

is the natural security parameter and all other variables are functions of n;for example,m=m(n) is typically O(n log n),and the modulus q=q(n)is some small polynomial,e.g.,O(n2).We consider two kinds of m-dimensional modular lattices de?ned by A.The?rst lattice is generated by the(transposed)rows of A,and is de?ned as

Λ(A,q)=

y∈Z m:y=A T s mod q for some s∈Z n

The second lattice consists of those integer vectors that are“orthogonal”(modulo q)to the rows of A,and is de?ned as

Λ⊥(A,q)={e∈Z m:Ae=0mod q}.

In the parlance of coding theory,A T is the“generator matrix”for the latticeΛ(A,q),and A is the“parity check”matrix for the latticeΛ⊥(A,q).When A and q are implicit from context,we sometimes omit them as arguments and just writeΛandΛ⊥.

Both lattices are modular and full-rank,because they contain the vectors q·e i for each i∈[m], where{e i}is the standard basis of Z m.It can be seen directly from their de?nitions thatΛand Λ⊥have a dual relationship;speci?cally,Λ⊥=q·Λ?andΛ=q·(Λ⊥)?.Another useful fact is that the quotient group(Z m/Λ⊥)and the set of syndromes{u=Ae mod q:e∈Z m}?Z n q are in bijective correspondence,via the mapping(e+Λ⊥)→Ae mod q.

Ajtai showed that for appropriate parameters,solving SVP on random instances ofΛ⊥(A,q) is as hard as approximately solving certain problems(e.g.,SIVP and GapSVP)on any lattice of dimension n to within poly(n)factors[Ajt96].The?rst cryptographic application of this result was a candidate collection of one-way functions;further works constructed candidate collision-resistant hash functions,and improved the approximation factors in the underlying worst-case assumptions to as small as?O(n)[GGH96,CN97,Mic04,MR07].

Regev[Reg05]proposed the learning with error(LWE)problem,which can be phrased in terms of a unique decoding problem on a random latticeΛ(A,q).Regev showed that solving LWE on the average is as hard as approximating SIVP and GapSVP on any lattice of dimension n,to within ?O(n)factors,using a quantum algorithm.He also constructed a public-key cryptosystem based on

the LWE problem.

We now state a few important facts about these random lattices that will be used throughout the rest of the paper.The?rst is a lemma on additive groups going back to[Ajt96];the tightest version we know of was proved in[Reg05].

Lemma4.1.Let q be prime and let m≥2n lg q.Then for all but an at most q?n fraction of

A∈Z n×m

q ,the subset-sums of the columns of A generate Z n q;i.e.,for every u∈Z n q there is a

e∈{0,1}m such that Ae=u.9

9In fact,the lemma is actually stronger,saying that a random subset-sum of A’s columns is statistically close to uniform over Z n q for almost all A.

The next lemma says that an integer error vector taken from an appropriate discrete Gaussian over Z m corresponds to a nearly-uniform syndrome.It also characterizes the conditional distribution of the error vector,given its syndrome.

Lemma 4.2.Assume the columns of A ∈Z n ×m q generate Z n q ,and let ∈(0,12)and s ≥η (Λ⊥(A ,q )).Then for e ←D Z m ,s ,the distribution of the syndrome u =Ae mod q is within

statistical distance 2 of uniform over Z n q .

Furthermore,?x u ∈Z n q and let t ∈Z m be an arbitrary solution to At =u mod q .Then the

conditional distribution of e ←D Z m ,s given Ae =u mod q is exactly t +D Λ⊥,s,?t .

Proof.By hypothesis,the set of all syndromes {Ae mod q :e ∈Z m }=Z n q .Now by Lemma 2.7,for e ←D Z m ,s the distribution of e mod Λ⊥is within statistical distance 2 of uniform over the quotient group (Z m /Λ⊥).Because this quotient group is isomorphic to the set of syndromes Z n q via the mapping (e +Λ⊥)→Ae mod q ,the ?rst claim follows.

For the second claim,?x u ∈Z n q and consider the distribution D of e ←D Z m ,s given Ae =u mod q .The support of D is t +Λ⊥,and the distribution is

D (e )=ρs (e )ρs (t +Λ⊥)=ρs,?t (e ?t )ρs,?t (Λ⊥)

=D Λ⊥,s,?t (e ?t ).Writing e =t +v for v =e ?t distributed as D

Λ⊥,s,?t ,the claim follows.

We now show that a random lattice Λ(A ,q )has large minimum distance (in ∞norm)with overwhelming probability;this implies that Λ⊥(A ,q )has a very small smoothing parameter.

Lemma 4.3.Let n and q be positive integers with q prime,and let m ≥2n lg q .Then for all but

an at most q ?n fraction of A ∈Z n ×m q ,we have λ∞1(Λ)≥q/4.In particular,for such A and any ω(√log m )function,we have η (Λ⊥(A ,q ))≤ω(√log m )for

some negligible function (m ).

Proof.The second claim follows by Lemma 2.5and the fact that Λ=q ·(Λ⊥)?.

For the ?rst claim,consider the open ∞“cube”C of radius q/4(hence edge length q/2).The set Z =C ∩Z m contains at most (q/2)m points.Therefore for any ?xed nonzero s ∈Z n q ,the

probability over the uniform choice of A ∈Z n ×m q that A T s =v mod q for some v ∈Z is at most (q/2)m /q m =2?m ≤q ?2n .Taking a union bound over all nonzero s ∈Z n q ,we conclude that the

probability that Λcontains any nonzero point in Z is at most q ?n .

Combining the previous lemmas,we get the following main corollary:

Corollary 4.4.Let n and q be positive integers with q prime,and let m ≥2n lg q .Then for all

but a 2q ?n fraction of all A ∈Z n ×m q and for any s ≥ω(√log m ),the distribution of the syndrome u =Ae mod q is statistically close to uniform over Z n q ,where e ←D Z m ,s .

Proof.By Lemmas 4.1and 4.3,for all but a 2q ?n fraction of all A ,the columns of A ∈Z n ×m q generate Z n q ,and s ≥η (Λ⊥(A ,q ))for some negligible function (m ).Now by Lemma 4.2,the

distribution of u =Ae mod q is statistically close to uniform over Z n

q .

4.2Hard-on-Average Problems

The hard-on-average problem ?rst proposed by Ajtai [Ajt96]is to ?nd a short nonzero integer

solution e ∈Z m to the homogeneous linear system Ae =0mod q for uniformly random A ∈Z n ×m q

.This is syntactically equivalent to ?nding some short nonzero vector in Λ⊥(A ,q ).The problem was formalized as follows in [MR07].

De?nition 4.5.The small integer solution problem SIS (in the 2norm)is as follows:given an

integer q ,a matrix A ∈Z n ×m q ,and a real β,?nd a nonzero integer vector e ∈Z m such that Ae =0mod q and e 2≤β.

For functions q (n ),m (n ),and β(n ),SIS q,m,βis the ensemble over instances (q (n ),A ,β(n ))where A ∈Z n ×m (n )q is uniformly random.

We now de?ne a variant problem,which is to ?nd a short solution to a random inhomogeneous system,speci?cally,Ae =u mod q (where both A and u are uniformly random).As we will see,the di?erence between the problems is analogous to the di?erence between SVP and CVP .De?nition 4.6.The inhomogeneous small integer solution problem ISIS (in the 2norm)is as

follows:given an integer q ,a matrix A ∈Z n ×m q ,a syndrome u ∈Z n q ,and a real β,?nd an integer vector e ∈Z m such that Ae =u mod q and e 2≤β.

The average-case problem ISIS q,m,βis de?ned similarly,where A and u are uniformly random and independent.

The ISIS problem is phrased as a syndrome decoding problem,and is equivalent to the problem of decoding an arbitrary integer target point t ∈Z m to within distance βon the lattice Λ⊥=Λ⊥(A ,q ).Speci?cally,the target point’s syndrome is u =At mod q ,and solving ISIS on this syndrome yields a short error vector e ∈Z m having the same syndrome u .This error vector yields a lattice point v =t ?e ∈Λ⊥,because Av =At ?Ae =0mod q ;furthermore,v is within distance βof t .Conversely,decoding t to some v ∈Λ⊥within distance βyields an error vector e =t ?v such that Ae =u mod q .In this work it will be more convenient to work with syndrome decoding,because the lattice Λ⊥is “modded out”of the instances.In other words,an instance of ISIS refers only to a particular coset of Λ⊥,and carries no “extraneous”information (unlike target points t ∈Z m ).Of course,the SIS and ISIS problems are only meaningful if they admit valid solutions for the particular choices of q ,m ,β.For β≥√m and m ≥2n lg q (for some prime q ),Lemma 4.1implies that with overwhelming probability over the choice of A ,there is an e ∈{0,1}m such that Ae =u mod q for any u ∈Z n q .Then because e ≤√m ≤β,we see that a random instance of ISIS q,m,βhas a solution with overwhelming probability.For the same parameters,a pigeonhole argument shows that SIS always admits a nonzero solution (even for non-prime q ,though we will not need this fact).From now on,q ,m ,and βwill always implicitly satisfy the above https://www.wendangku.net/doc/a86882816.html,ing Gaussian techniques,Micciancio and Regev [MR07]showed that the SIS q,m,βproblem is as hard (on the average)as approximating certain worst-case problems on lattices to within small factors.We give a simpler and slightly tighter proof (also showing hardness for ISIS )that employs our discrete Gaussian sampling algorithm,and which works for a smaller modulus q .

Proposition 4.7.For any poly-bounded m,β=poly (n )and for any prime q ≥β·ω(√n log n ),the

average-case problems SIS q,m,βand ISIS q,m,βare as hard as approximating the problems SIVP and GapSVP (among others)in the worst case to within certain γ=β·?O

(√n )factors.1010It is possible to base the hardness of ISIS solely on the assumed hardness of SIS ,but we only know of such a

Note that Proposition 4.7gives a “sliding scale”of hardness (and modulus q )depending on the value of β.For the tightest value of β=√m ,we can take q =?O (n )and obtain approximation factors γ=?O

(n )for the worst-case problems.However,for our trapdoor functions and other cryptographic primitives,we will need to assume hardness of ISIS for larger values of β(e.g.,β≈m 1.5=?O (n 1.5)).This is because our trapdoor inversion algorithm is only able to produce preimages of length approximately √m times the length of the trapdoor for A ;the shorter the trapdoor,the smaller we may take βto be,and the weaker our underlying assumptions can be.

The proof of Proposition 4.7appears in Section 8.

4.3

Trapdoor Functions 4.3.1De?nitions

We start by de?ning some enhanced variants of trapdoor functions with preimage sampling ,which are given by a tuple of probabilistic polynomial-time algorithms (TrapGen ,SampleDom ,SamplePre ).

A collection of trapdoor one-way functions with preimage sampling satis?es the following:

1.Generating a function with trapdoor :TrapGen (1n )outputs (a,t ),where a is the description of an e?ciently-computable function f a :D n →R n (for some e?ciently-recognizable domain D n and range R n depending on n ),and t is some trapdoor information for f a .

For the remaining properties,?x some (a,t )←TrapGen (1n ).

2.Domain sampling with uniform output :SampleDom (1n )samples an x from some (possibly non-uniform)distribution over D n ,for which the distribution of f a (x )is uniform over R n .

3.Preimage sampling with trapdoor :for every y ∈R n ,SamplePre (t,y )samples from the condi-tional distribution of x ←SampleDom (1n ),given f a (x )=y .

4.One-wayness without trapdoor :for any probabilistic poly-time algorithm A ,the probability

that A (1n ,a,y )∈f ?1a (y )?D n

is negligible,where the probability is taken over the choice of a ,the target value y ←R n chosen uniformly at random,and A ’s random coins.11

Note that trapdoor permutations (with uniform distribution over the domain)satisfy this de?nition,becase the output distribution is uniform and every point has a unique inverse.

A collection of trapdoor collision-resistant hash functions with preimage sampling satis?es the above properties,plus the following:

5.Preimage min-entropy :for every y ∈R n ,the conditional min-entropy of x ←SampleDom (1n )given f a (x )=y is at least ω(log n ).

6.Collision-resistance without trapdoor :for any probabilistic poly-time algorithm A ,the prob-ability that A (1n ,a )outputs distinct x,x ∈D n such that f a (x )=f a (x )is negligible,where the probability is taken over the choice of a and A ’s random coins.

reduction for slightly looser values of β.Because ISIS is interesting on its own,and might even be harder than SIS ,we elect to treat it as a separate problem and give a direct,tight reduction from worst-case lattice problems.11This property can be easily adapted to non-uniform adversaries modelled as families of circuits.

We point out that these two additional properties together imply one-wayness (Property 4).For if not,then given a function f a one could ?nd a collision as follows:choose an x ←SampleDom (1n ),and obtain a preimage x of f a (x )from the adversarial inverter.Then because x has large min-entropy given f a (x ),we have x =x with overwhelming probability,so x,x are a collision.

It is also possible to de?ne a trapdoor variant of universal one-wayness [NY89],which is implied by collision-resistance.Because our constructions will be collision-resistant anyway,we omit a precise de?nition.

A collection of claw-free pairs of one-way/collision-resistant trapdoor functions (with preimage sampling)is de?ned similarly,with the following di?erences:TrapGen outputs a pair a,a describing functions f a ,f a :D n →R n (respectively),and their respective trapdoors t,t .The preimage sampler works the same way for both f a (given t )and f a (given t ).The hardness condition is that no PPT algorithm A ,given a,a ,can ?nd a pair x,x ∈D n such that f a (x )=f a (x ).Each function f a ,f a may itself also be collision-resistant in the usual way.

A needed relaxation.To be completely precise,the trapdoor functions we construct will actu-ally satisfy a slightly relaxed de?nition in which the properties are satis?ed only statistically .First,the properties will hold only with overwhelming probability over the choice of a .Additionally,SampleDom (1n )will output an x ∈D n only with overwhelming probability,and the distribution of f a (x )will only be statistically close to uniform.Finally,SamplePre will sample from a distribution over the preimages that is statistically close to the prescribed conditional distribution.None of these relaxations will a?ect security in our applications.

4.3.2Constructions

Before giving concrete constructions,we need to recall the result of Ajtai [Ajt99]that shows how

to sample an essentially uniform A ∈Z n ×m q

,along with a short full-rank “trapdoor”set of lattice vectors S ?Λ⊥(A ,q ).

Proposition 4.8([Ajt99]).For any prime q =poly (n )and any m ≥5n lg q ,there is a probabilistic

polynomial-time algorithm that,on input 1n ,outputs a matrix A ∈Z n ×m q and a full-rank set S ?Λ⊥(A ,q ),where the distribution of A is statistically close to uniform over Z n ×m q and the length S ≤L =m 2.5.

By optimizing the construction and its analysis,the bound L on the length S of the trapdoor can be improved to L =m 1+ for any >0;we defer the details.

We can now de?ne a collection of trapdoor functions with preimage sampling based on the average-case hardness of SIS and/or ISIS .Let q ,m ,and L be as in Proposition 4.8.The collection is parameterized by some Gaussian parameter s ≥L ·ω(√log m ).

?The function generator uses the algorithm from Proposition 4.8to choose (A ,S ),where

A ∈Z n ×m q is statistically close to uniform and S ?Λ⊥(A ,q )is a full-rank set with S ≤L .The matrix A (and implicitly q )de?nes the function f A (·),and the matrix S is its trapdoor.

?The function f A is de?ned as f A (e )=Ae mod q ,with domain D n ={e ∈Z m : e ≤s √m }

and range R n =Z n q .The input distribution is D Z m ,s ,which can be sampled using SampleD with the standard basis for Z m .

?The trapdoor inversion algorithm SampleISIS (A ,S ,s,u )samples from f ?1A (u )as follows:?rst,

choose via linear algebra an arbitrary t ∈Z m such that At =u mod q (such a t exists for

all but an at most q ?n fraction of A ,by Lemma 4.1).Then sample v ←D Λ⊥,s,?t using the SampleD algorithm with the trapdoor S ,and output e =t +v .

Theorem 4.9.The algorithms described above give a collection of trapdoor one-way functions with preimage sampling,if ISIS q,m,s √m is hard on the average.

Furthermore,they give a collection of trapdoor collision-resistant hash functions with preimage sampling,if SIS q,m,2s √m is hard on the average.

Proof.First we note that s ≥L ·ω(√log m )≥η (Λ⊥)for some negligible (n )by Lemma 2.4,

because L ≥ S ≥λm (Λ⊥).

We start by showing domain sampling.A sample e ←D Z m ,s lands in the domain D n (except with exponentially small probability),by Lemma 2.8.Furthermore,for all but an exponentially small fraction of A ,f A (e )is statistically close to uniform over R n ,by Corollary 4.4.We now demonstrate preimage sampling.Because s ≥ S ·ω(√log m ),Lemma 3.5implies that SampleD samples from a distribution that is statistically close to D Λ⊥,s,?t .Then by the second claim of Lemma 4.2,SampleISIS samples from the appropriate conditional distribution.

For one-wayness,inverting a random function f A on a uniform output u ∈R n =Z n q is syntac-tically equivalent to solving ISIS q,m,s √m .

The preimage min-entropy is at least m ?1;this follows immediately from the fact that preimages are distributed according to a discrete Gaussian (the second claim of Lemma 4.2),and by the min-entropy of the discrete Gaussian (Lemma 2.9).

Finally,for collision-resistance,a collision e ,e ∈D n for f A implies A (e ?e )=0mod q .Because e ?e ≤2s √m by the triangle inequality and e ?e =0because e ,e are distinct,?nding a collision in a random f

A implies solving SIS q,m,2s √m .

Claw-free pairs.Constructing a collection of claw-free pairs of trapdoor functions is very similar.The function generator produces (A ,S )as above,as well as a uniform w ∈Z n q .It outputs a pair of functions f A (e )=Ae mod q and f A ,w (e )=Ae +w mod q .The domains and input distributions are the same as above.The preimage sampler for f ?1A (u )works exactly as above,and the preimage sampler for f ?1A ,w (u )samples from the solutions to the system Ae =(u ?w )mod q .

Claw-freeness is based on the average-case hardness of ISIS q,m,2s √m .Given a claw (e ,e )∈D 2n for the pair of functions f A ,f A ,w ,we have A (e ?e )=w mod q .Because e ?e ≤2s √m by the triangle inequality,(e ?e )is a solution to the random ISIS instance (q,A ,w ,2s √m ).As above,

the functions f A and f A ,w are both collision-resistant assuming the hardness of SIS q,m,2s √m .Alternate domains.For some applications,the de?nition of the domain D n in terms of the 2norm may be inconvenient.In such a case,the domain can also be de?ned in terms of the ∞norm as D n = e : e ∞≤s ·ω(√log m ) for some arbitrary ω(√log m )function.It can be shown (e.g.,using the tail inequality in Section 3.1)that a sample from D Z m ,s falls in this new domain with overwhelming probability.(Note,though,that inputs still must be chosen from the Gaussian D Z m ,s over the integers.)

建设工程费用标准

总说明一、辽宁省建设工程计价依据《辽宁省建设工程费用标准》（以下简称费用标准）是工程量清单计价、编制招标控制价或拦标价的依据；是编制建设工程估算、设计概算、施工图预算、竣工结算的依据；是调解处理工程造价纠纷、鉴定工程造价的依据；是投标报价和衡量投标报价合理性的基础；是编制投资估算指标、概算（定额）指标的基础。二、本费用标准与2008年辽宁省建设工程计价依据《A建筑工程计价定额》、《B装饰装修工程计价定额》、《C安装工程计价定额》《D市政工程计价定额》及《E园林绿化工程计价定额》配套使用。三、本费用标准中的企业管理费、安全文明施工措施费，投标人在投标报价时，可根据企业管理水平和工程实际适当调整，但不得低于本费用标准的90%。四、本费用标准的规费，按核定的施工企业规费计取标准执行。五、工程量清单计价中的综合单价，应按本费用标准的“工程费用取费程序表”中的管理费费和利润计算方法并考虑风险组成综合单价。六、使用1996年《全国统一房屋修缮工程预算定额辽宁省单位估价表》、1993年《全国统一市政工程预算定额辽宁省单位估计表（市政维修）》、1988年《全国统一仿古建筑预算定额》的工程，可按2008年相应计价的人工、材料、机械单价进行换算，按照本费用标准相应标准计取各项费用。七、2008年辽宁省建设工程计价依据计价定额材料费中不包括材料检验试验费。招标工程由投标人人在投标报价时自行确定；非招标工程，工程结算时按实际发生计入其他项目费。八、本费用标准中的“xxx以上”，“不包括xxx本身”“xxx以下”，包括xxx本身。第一部分建设工程费用组成根据建设部、财政部建标2003206号文件《关于印发<建筑安装工程费用项目组成>的通知》精神，结合我省实际情况，确定建设工程费用项目组成如下：建设工程费用由直接费、间接费、利润和税金组成。一、直接费直接费由计价定额分部分项工程费和措施项目费组成。（一）计价定额分部分项工程费：由直接工程费和技术措施费组成。直接工程费：是指施工过程中耗费的构成工程实体的各项费用，包括人工费、材料费、施工机械使用费。 1.人工费：是指直接从事建筑安装工程施工的生产工人开支的各项费用，内容包括：（1）基本工资：是指发给生产工人的基本工资。（2）工资性津贴：是指按规定标准发放的物价补贴，煤、燃气补贴，交通补贴，住房补贴，流动施工津贴等。（3）生产工人辅助工资：是指生产工人年有效施工天数以外非作业天数的工资，包括职工学习、培训期间的工资，调动工作、探亲、休假期间的工资，因气候影响的停工工资，女工哺乳时间的工资，病假在六个月内的工资及产、婚、丧假期的工资。（4）职工福利费：是指按规定标准计提的职工福利费。（5）生产工人劳动保护费：是指按规定标准发放的劳动保护用品的购置费及修理费,徒工服装补贴，防暑降温费，在有碍身体健康环境中施工的保健费等。 2.材料费：是指施工过程中耗费的构成工程实体的原材料、辅助材料、构配件、零件、半成品的费用。内容包括：（1）材料原价（或供应价格）

经典危机公关案例分析

成功的经典公关案例分析_经典危机公关案例分析矛盾的80%来自与缺乏沟通，很多事只要能恰当的沟通都会顺利解决。当企业发生公关危急时沟通就是最必要的工作之一。首先要与企业全体员工进行沟通，让大家了解事件细节，以便配合进行危机公关活动，比如保持一直的口径，一直的行为等。而后要马上与受害者进行沟通，主动联系受害者，以平息其不满的情绪，比如开通专线电话接听相关投诉，负责人亲自慰问与会见受害人等，最好抢在媒体与当事人接触前先与当事人沟通。接下来就是与媒体进行沟通，必须第一时间向媒体提供真实的事件情况及随时提供事件发展情况，因为如果你不主动公布消息媒体和公众就会去猜测，而猜测推断出的结论往往是负面的。这个时候消费者很敏感，信心也很脆弱，看到负面的消息后很容易相信，甚至是放大这个消息的危害程度。所以，这个时候必须及时坦诚的通过媒体向大众公布信息与事件处理进展，这样可以有效填补此时舆论的“真空期”，因为这个“真空期”你不去填补它，小道消息、猜测，甚至是竞争对手恶意散布的消息会填满它。而后就是与政府及相关部门进行沟通，得到政府的支持或谅解，甚至是帮助，对控制事态发展有很大的帮助。同时也要对企业的合作伙伴如供应商、经销商等进行沟通，以免引起误解及不必要的恐慌，如前面提到的金正集团，因为缺乏与合作伙伴的沟通，导致了各方的恐慌，使事态恶化。案例：点评：及时的沟通，真诚的态度，使索尼轻松度过了这次危机，没有造成更大的负面影响，相信很多读者都没听过这个事件吧?这就证明索尼此次的危机公关处理的十分成功，也没有影响到索尼与佳能等合作伙伴的关系。全面快速的真诚沟通是此次事件圆满处理的最大功臣。

2008清单计价规范

附件2 建设工程工程量清单计价规范（GB50500-2008）计价表式一、计价表格的组成我省工程量清单及计价表格包括封面、总说明、汇总表、分部分项工程量清单表等共32张，具体如下： 1 封面 1.1 工程量清单：封－1 1.2 招标控制价：封－2 1.3 投标总价：封－3 1.4 竣工结算总价：封－4 2 总说明 3 汇总表 3.1 工程项目招标控制价汇总表表－01 3.2 单位工程招标控制价汇总表：表－02 3.3 工程项目投标报价汇总表：表－03 3.4 单位工程投标报价汇总表：表－04 3.4 工程项目竣工结算汇总表：表－05 3.5 单位工程竣工结算汇总表：表－06 4 分部分项工程量清单表 4.1 分部分项工程量清单及计价表：表－07 4.1.1 工程量清单综合单价计算表：表－07－1 4.1.2 工程量清单综合单价工料机分析表表－07－2 5 措施项目清单表 5.1 措施项目清单与计价表（一）：表－08 5.2 措施项目清单与计价表（二）：表－09 5.2.1 措施项目清单综合单价计算表：表－09－1 5.2.2 措施项目清单综合单价工料机分析表表－09－2 6 其他项目清单表

6.1 其他项目清单与计价汇总表：表－10 6.1.1 暂列金额明细表：表－10－1 6.1.2 材料暂估单价表：表－10－2 6.1.3 专业工程暂估价表：表－10－3 6.1.4 计日工表：表－10－4 6.1.5 总承包服务费计价表：表－10－5 6.2 索赔与现场签证计价汇总表：表－11 6.2.1 费用索赔申请（核准）表：表－11—1 6.2.2 现场签证表：表－11—2 7 人工、材料、机械价格表 7.1 主要工日价格表：表－12 7.2 主要材料价格表：表－13 7.3 主要机械台班价格表：表－14 8 安全防护、文明施工措施项目费分析表：表－15 9 工程款支付申请（核准）表：表－16

2008定额取费标准

建筑、安装、市政、装饰装修工程及其包工不包料工程费用标准一、建筑工程费用标准 (一)费用标准适用范围 1．一般建筑工程费用标准：适用于工业与民用的新建、改建、扩建的各类建筑物、构筑物、厂区道路等建筑工程。 2．建筑工程土石方、建筑物超高、垂直运输、特大型机械场外运输及一次安拆费用标准：适用于工业与民用建筑工程的土石方（含厂区道路土方）、建筑物超高、垂直运输、特大型机械场外运输及一次安拆等工程项目。 3．桩基础工程费用标准：适用于工业与民用建筑工程中现场灌注桩和预制桩的工程项目。 (二)建筑工程费用标准(包工包料) 1.一般建筑工程费用标准(见下表)。 2.建筑工程土石方、建筑物超高、垂直运输、特大型机械场外运输及一次安拆费用标准(见下表) 3.桩基础工程费用标准（见下表）

（三）建筑工程类别划分及说明 1.一般建筑工程类别划分（见下表） 2．桩基础工程类别划分标准。（1）现场混凝土灌注桩为桩基础一类工程。（2）预制混凝土桩为桩基础二类工程。 3．接层工程的工程类别划分：在计算檐口高度和层数时，连同原建筑物一并计算。 4．斜通廊以最高檐口高度，按单层厂房标准划分。 (四)工程类别使用说明 1．以单位工程为类别划分单位，在同一类别工程中有几个特征时，凡符合其中之一者，即为该类工程。 2．一个单位工程有几种工程类型组成时，符合其中较高工程类别指标部分的面积若不低于工程总面积的50%,该工程可全部按该指标确定工程类别;若低于50%,但该部分面积又大于1500㎡，则可按其不同工程类别分别计算。 3．高度系指从设计室外地面标高至檐口滴水的高度（有女儿墙的算至女儿墙顶面标高）。4．跨度系指结构设计定位轴线的距离，多跨建筑物按主跨的跨度划分工程类别。

可口可乐危机公关实例剖析

可口可乐危机公关典型性分析：可口可乐在灭顶之灾中的危机公关 1999年6月初，比利时和法国的一些中小学生饮用美国饮料可口可乐，发生了中毒。一周后，比利时政府颁布禁令，禁止本国销售可口可乐公司生产的各种品牌的饮料。已经拥有113年历史的可口可乐公司，遭受了历史上鲜见的重大危机。在现代传媒十分发达的今天，企业发生的危机可以在很短的时间内迅速而广泛地传播，其负面的作用是可想而知的。短时间内在全国甚至全球范围的影响，必将引起社会和公众的极大关注。稍有不慎，即对企业形象和品牌信誉造成毁灭性的打击，其无形资产在倾刻之间贬值。这对企业的生存和发展，都是致命的伤害。一、可口可乐的危机公关从一般市场角度看不具备典型性，原因是时机把握的不好，对于危机公关时间是第一因素，必须充分把握时间，让危机成本降到最底，同时将公关效果达到最好，负面影响降到最底。二、危机公关是双刃剑，危机公关处理好了，品牌度反而会提升，处理不好造成的损失是不可估量的，甚至导致企业丧命，中国的危机公关一般来说方法上还不够高明，如秦池酒标王、三株口服液等等，都是危机公关处理不好导致企业丧命，还有就是南京的冠生园，危机公关方法不够导致了企业丧命，品牌崩溃。所以危机公关应该防患于未然，前期应该做好危机公关的准备，甚至是相关模拟场景的假设，不少企业面临危机公关缩手无策，甚至成为了媒介的仇人，方法是绝对不科学的，如果采取人性化处理和科学策略应对，消除影响就是时间问题，相反品牌反而更加深入人心。如杨森是典型的表现，这种做法不仅体现了企业的态度，同时表现了企业实力，更直接的表达了企业文化的理性和人性道德，当然获得消费者的认同是肯定的，事情查清后，因为外部原因造成的，反而会获得消费者的理解和支持，同时品牌认同度会升级。当然由于企业内部原因如产品不过关，是属于违法行为，不属于危机公关是危难公关。可口可乐的危机公关方法是按一般程序走的，但在时间上滞后是第一失误、按一般程序走是第二失误、在公关推进的策略上没有创新突破性，仅仅是资本投入性运行是第三失误，从危机公关本质上讲，是资本营救了企业，方法不够高明。第三、危机公关应该是主动性公关。主动面队，并积极应对。如可口可乐设立了专线面向社会沟通，这种做法是正确的，危机公关任何非主动行为都是逃避责任的行为，所以危机公关主动面对，尽快处理是企业社会责任的表现，积极争取消费者的支持这种公关本身是需要策划的，需要有方法，就象如何消除消费者误解和获得其原谅一样，需要方法，这种方法是需要大企业，无论是国际还是国内企业都需要探讨的，如肯德基的苏丹红危机公关，虽然事情过去了，但当时并没有主动公关策略，造成了其品牌一定的损失，这中负面影响将成为一个长时期的话题，当然如果是企业内部原因，应该是危难公关事件，非危机公关事件了，消除其影响需要更长的时间和更大的投入，再有类似情况出现，其后果不堪设想了。第四、危机公关可以是广告策略，不少公司特意设立危机公关并广告到市场上，其目的是更体现自己品牌道德，产品优势，当然要把握好度，不能玩火自焚或受到同行业的攻击。我不提倡，并给予好的称呼说是反营销，反什么，反市场是不理性的，反消费者更是行不通的，反同行业更是不明智的。反向策略方法倒是可以用，但要控制好分寸，否则自己也成为反营

危机公关成功案例

危机公关案例分析-- 态度比方法更重要案例分析：两位在西雅图工作的网络顾问——汤姆?法默（Tom Farmer）和沙恩?艾奇逊（Shane Atchison）在美国休斯敦希尔顿酒店的双树旅馆（Double tree Club）预订了一个房间，并被告知预订成功。尽管他们到饭店登记的时间是在凌晨两点，实在是个比较尴尬的时间段，但他们仍然很安心，因为他们的房间已经预订好了。但在登记时，他们立刻被泼了一桶凉水，一位晚间值班的职员草率地告诉他们，酒店客房已满，他们必须另外找住处。这两位住客不仅没有得到预订的房间，而且值班人员对待他们的态度也实在难以用言语表达——有些轻蔑，让人讨厌。甚至在他们的对话过程中，这个职员还斥责了客人。

这两位网络顾问当时离开了，然后制作了一个严厉的但又不失诙谐幽默的幻灯文件，标题是“你们是个糟糕的饭店”。在这个文件里记述了整个事件，包括与那名员工之间不可思议的沟通。他们把这个幻灯文件电邮给了酒店的管理层，并复制给自己的几位朋友和同事看。这一幻灯文件立刻成为有史以来最受欢迎的电子邮件。几乎世界各地的电子邮箱都收到了这份文件，从美国休斯顿到越南河内，还有两地之间的所有地区。这份幻灯文件还被打印和复印出来，分发到美国各地的旅游区。双树旅馆很快成为服务行业内最大的笑话，成为商务旅行者和度假者避之不及的住宿地。传统媒体的评论员们也将这一消息载入新闻报道和社论中，借此讨论公司对消费者的冷漠和网络对于公众舆论的影响力。接着，法默和艾奇逊收到了3000多封邮件，大部分都是支持他们的。对此，酒店的管理层也迅速有礼而大度地作出反应。

双树旅馆毫不迟疑地向他们俩道歉，并用两个人的名义向慈善机构捐献了1000美元作为双树旅馆的悔过之举。双树的管理层还承诺要重新修订旅馆的员工培训计划，以确保将此类事件再次发生的可能性降到最低。另外，双树旅馆的一位高级副总裁在直播网络上与法默和艾奇逊就此事展开讨论，以证明饭店认真对待此事。评析首先，互联网无孔不入的威力挑战着传统的口口相传的传播方式，挑战的程度在该“双树旅馆事件”中表现得再清楚不过了。互联网强大的传播能力已成不争的事实。对此我们要给予充分关注，对互联网所向披靡之势要有足够的心理准备。其次，两位客人和负责预订房间的服务生的互动，证明了酒店雇员的个人行为会严重影响到公司的声誉。这显然是个别雇员恶劣服务的丑闻成了公众舆论的关注点而引起的公关危机事件。

《建设工程工程量清单计价规范》(GB50500-2008)

附件1 《建设工程工程量清单计价规范》（GB50500-2008）浙江省补充条款一、采用工程量清单计价方式的工程建设项目，除应执行《建设工程工程量清单计价规范》GB50500-2008，还应执行本省的补充规定。二、工程造价文件的编制与核对，如由造价员承担时，应具备相应专业的造价员资格证书。建设项目各方应拒绝未按规定签字盖章的工程造价文件。三、招标人委托工程造价咨询人或招标代理机构编制工程量清单，其编制工作时间应根据工程建设项目的实际情况，在保证编制质量的前提下由双方在咨询合同中协商约定。四、工程造价咨询人或招标代理机构及其工程造价专业人员应对其编制的工程量清单（或招标控制价）质量负责，并在委托合同中约定相关责任条款。五、编制工程量清单出现附录中未包括的项目，编制人应作补充，并在所属的分部列项。六、措施项目清单编制应体现工程特点和招标要求，需补充的措施项目，清单编制人可参照省建设行政主管部门颁发的计价依据补充或自行补充。文明施工与环境保护、临时设施、安全施工是必须保证的措施项目，投标报价时应根据招标文件要求提供分析表。具体编制可参照安全防护、文明施工措施项目分析表，并结合招标工程的特点列项。建设工程检验试验费、建筑工程超高施工增加费作为措施项目，分别列入组织或技术措施项目清单。七、可以计算工程量的措施项目清单，在确定项目名称、特征描述、计量单位和工程量计算规则等时，应满足投标人按本省计价依据进行报价的需要。八、专业工程暂估价一般以“项”为单位编制。暂估价材料如遇本省计价依据中无相类似的材料时，投标人应该在投标文件中明确该暂估价材料的损耗率。九、规费项目由规费1、规费2、规费3组成，具体内容如下： 1、规费1，包括：（1）工程排污费；（2）社会保障费：包括养老保险费、失业保险费、医疗保险费；

中国十大企业危机公关案例

————————————————————————————————作者：————————————————————————————————日期：

2007中国十大企业危机公关案例来源：中国管理传播网岁末年初，如果让我们回顾2007年中国企业危机公关事件的话，就不难发现：与前几年相比，在刚刚过去的2007年，更多的企业经历了危机公关之痛。从手机、汽车、IT到食品、服饰、超市等行业，众多企业经历了各式各样的公关危机。接下来，就让我们从诸多危机公关案例事件中筛选十大具有代表意义的典型案例，以全面还原2007年中国企业的危机公关现状。（以事件发生先后为序） 1、LG翻新事件 LG翻新事件起源于2006年，在2007年上半年愈演愈烈。2007年1月，在地下翻新工厂遭曝光后，LG声称背后有人敲诈；2月份又有媒体曝光工商局封存5台LG疑似翻新空调，随后LG承认更换部分产品包装；3月，湖南省消费者张洪峰披露了湖南省质量检验协会的鉴定结果，确认“其购买的五台LG空调都是翻新机器”，5月份张洪峰通过博客再次披露了LG空调的质量问题。LG翻新事件随着全国媒体的不断报道，从LG冰箱翻新、LG空调翻新到LG彩电翻新，不断有新的猛料被曝光，LG品牌一时陷入了空前的品牌危机。点评：在系列产品的翻新事件被曝光之后，LG方面躲躲闪闪，没有承认自己的错误，未能采取有效的应对措施，再加上广大网友在网络上对LG翻新行为的声讨，其品牌形象与企业声誉大打折扣。由此我们也看出了，作为国际知名品牌的LG在危机公关方面的无知与短视。 2、摩托罗拉手机爆炸事件 2007年6月19日在甘肃金塔县发生了全国首例手机电池爆炸致死事件，作为问题手机的制造商——摩托罗拉未能在第一时间内采取积极的应对措施，在事发大约10天之后，以推卸事件责任为出发点，将这起爆炸事件的责任

2019危机公关成功案例及分析

古语有云：好事不出门，坏事传千里。在交通如此不发达的古代古人尚且能够得出此结论，更别说是现在这个信息爆炸的“地球村”互联网时代了。【危机公关】危机公关可以起到亡羊补牢降低企业公关危害的作用，有时候一个很小的产品问题或者是服务问题都有可能引发危机公关事件。企业危机公关的概念，目前并没有一个既定概念，一般认为企业危机公关指的是企业通过有计划地实行一系列相关联的行为，达到减少或者避免危机给公司带来的损害。危机公关一直是不少企业的痛处，如果危机公关不能处理好，企业危机很有可能被夸大甚至往妖魔化方向发展。危机公关可以起到亡羊补牢降低企业公关危害的作用，有时候一个很小的产品问题或者是服务问题都有可能引发危机公关事件。公关人员有效地处理公关危机对于一个企业的正常顺利发展具有十分重要的意义。危机来临时刻越能考验一个公司的抗压能力，一个成熟的的企业与其他企业之间的差别在此展现。往往一个优秀的企业越是在危机的时刻，越能显示出这个公司的综合实力和整体素质。危机公关如果处理得当，也有可能成为转机。公关人员在处理危机公关时，如果能迅速做出适当反应，采取及时的补救措施，主

动地以危机事件为契机，可以采取品牌自黑的模式，变好事为坏事，灵活运用网络语言化“危”为“机”，借题发挥的基础上在进行真诚道歉。这样而言，不但可以扩大企业的知名度和美誉度，还可以显示出公司的综合实力和整体素质。但是企业如果觉得兹事体小，而对投诉事件放任不管，危机雪球就会越滚越大，一件很小的事件就很有可能就演变成为“星星之火，可以燎原”。本文从危机公关角度分析一下2019年的危机公关事件，希望对大家的公关思维有所启发。 “村里才通网”的奔驰公关奔驰事件的爆发，对于舆论说，让舆论沸腾的点，往往就是给大品牌贴负面标签的行为。比如“奔驰漏油”、“店大欺客”、“乱收服务费”。实际上出瓜群众并不是想要看到奔驰倒下，而是抱着一种看热闹不嫌事大的八卦心理来看待奔驰事件爆发。奔驰事件之所以会有这么大的传播力，一是因为奔驰公关能力和其在汽车界的业界地位并不成正比。

2008清单计算规则

2008清单计算规则一、平整场地：建筑物场地厚度在±30cm以内的挖、填、运、找平。 1、平整场地计算规则（1）清单规则：按设计图示尺寸以建筑物首层面积计算。（2）定额规则：按设计图示尺寸以建筑物外墙外边线每边各加2米以平方米面积计算。 2、平整场地计算公式 S=（A+4）×（B+4）=S底+2L外+16 式中：S———平整场地工程量；A———建筑物长度方向外墙外边线长度；B———建筑物宽度方向外墙外边线长度；S底———建筑物底层建筑面积；L外———建筑物外墙外边线周长。该公式适用于任何由矩形组成的建筑物或构筑物的场地平整工程量计算。二、基础土方开挖计算开挖土方计算规则（1）、清单规则：挖基础土方按设计图示尺寸以基础垫层底面积乘挖土深度计算。（2）、定额规则：人工或机械挖土方的体积应按槽底面积乘以挖土深度计算。槽底面积应以槽底的长乘以槽底的宽，槽底长和宽是指基础底宽外加工作面，当需要放坡时，应将放坡的土方量合并于总土方量中。 2、开挖土方计算公式：（1）、清单计算挖土方的体积：土方体积＝挖土方的底面积×挖土深度。（2）、定额规则：基槽开挖：V=（A+2C+K×H）H×L。式中：V———基槽土方量；A———槽底宽度；C———工作面宽度；H———基槽深度；L———基槽长度。. 其中外墙基槽长度以外墙中心线计算，内墙基槽长度以内墙净长计算，交接重合出不予扣除。基坑开挖：V=1/6H[A×B+a×b+(A+a)×(B+b)+a×b]。式中：V———基坑体积；A—基坑上口长度；B———基坑上口宽度；a———基坑底面长度；b———基坑底面宽度。三、回填土工程量计算规则及公式 1、基槽、基坑回填土体积=基槽（坑）挖土体积-设计室外地坪以下建（构）筑物被埋置部分的体积。式中室外地坪以下建（构）筑物被埋置部分的体积一般包括垫层、墙基础、柱基础、以及地下建筑物、构筑物等所占体积 2、室内回填土体积=主墙间净面积×回填土厚度-各种沟道所占体积主墙间净面积=S底-（L中×墙厚+L内×墙厚）式中：底———底层建筑面积；L中———外墙中心线长度；L内———内墙净长线长度。回填土厚度指室内外高差减去地面垫层、找平层、面层的总厚度，如右图：四、运土方计算规则及公式：运土是指把开挖后的多余土运至指定地点，或是在回填土不足时从指定地点取

2008年辽宁省建设工程费用标准

2008年辽宁省建设工程费用标准总说明一、辽宁省建设工程计价依据《辽宁省建设工程费用标准》(以下简称费用标准)是工程量清单计价、编制招标控制价或拦标价的依据；是编审建设工程投资估算、设计概算、施工图预算、竣工结算的依据；是调解处理工程造价纠纷、鉴定工程造价的依据；是投标报价和衡量投标报价合理性的基础；是编制投资估算指标、概算(定额)指标的基础。二、本费用标准与2008年辽宁省建设工程计价依据《A建筑工程计价定额》、《B装饰装修工程计价定额》、《C安装工程计价定额》、《D市政工程计价定额》、《E园林绿化工程计定额》配套使用。三、本费用标准中的企业管理费、安全文明施工措施费，投标人在投标报价时，可根据本企业管理水平和工程实际适当调整，但不得低于本费用标准的90%。四、本费用标准中的规费，按核定的施工企业规费计取标准执行。五、工程量清单计价中的综合单价，应按本费用标准的“工程费用取费程序表”中的管理费和利润计算方法并考虑风险组成综合单价。六、使用1996年《全国统一房屋修缮工程预算定额辽宁省单位估价表》、1993年《全国统一市政工程预算定额辽宁省单位估价表（市政维修）》、1988年《全国统一仿古建筑预算定额》的工程，可按2008年相应计价定额的人工、材料、机械单价进行换算，按照本费用标准相应标准计取各项费用。七、2008年辽宁省建设工程计价依据计价定额材料费中不包括材料检验试验费。招投标工程由投标人在投标报价时自行确定；非招标工程，工程结算时按实际发生计入其他项目费。八、本费用标准中“×××以上”，不包括其本身，“×××以下”，包括其本身。第一部分建设工程费用组成根据建设部、财政部建标[2003]206号文件《关于印发<建筑安装工程费用项目组成>的通知》精神，结合我省实际情况，确定建设工程费用项目组成如下: 建设工程费用由直接费、间接费、利润和税金组成。一、直接费直接费由计价定额分部分项工程费和措施项目费组成。（一）、计价定额分部分项工程费：由直接工程费和技术措施费组成。直接工程费：是指施工过程中耗费的构成工程实体的各项费用。包括人工费、材料费、施工机械使用费。 1、人工费：是指直接从事建筑安装工程施工的生产工人开支的各项费用，内容包括：（1）基本工资：是指发放给生产工人的基本工资。

《建设工程工程量清单计价规范》GB50500-2008讲解

《建设工程工程量清单计价规范》GB50500-2008讲解背景提示： 2008年7月9日，建设部发布了《建设工程工程量清单计价规范》GB50500-2008（以下简称08规范），并将在2008年12月1日施行。08规范在03规范做了补充和完善，不仅较好地解决了清单计价从2003年执行以来存在的主要问题，而且对清单计价的指导思想进行了进一步的深化，在“政府宏观调控、企业自主报价、市场形成价格”的基础上提出了“加强市场监管”的思路，以进一步强化清单计价的执行。上期我们从总体上谈了GB50500-2008的主要变化（详见《数字造价》2008年第六期热点话题栏目），为了便于造价朋友深入地了解08规范，能更快地应用08规范进行计价工作，本期我们将详细介绍08规范在计价方面的变化，包括编制工程量清单，编制投标报价，编制招标控制价。一、工程量清单的组成 08规范： 3.1.4 工程量清单应由分部分项工程量清单、措施项目清单、其他项目清单、规费项目清单、税金项目清单组成。 03规范： 3.1.3 工程量清单应由分部分项工程量清单、措施项目清单、其他项目清单。主要区别：编制工程量清单时，需要提供规费项目清单、税金项目清单。二、工程量清单的要求

08规范：3.1.2 采用工程量清单方式招标，工程量清单必须作为招标文件的组成部分，其准确性和完整性由招标人负责。 03规范：3.1.2 采用工程量清单方式招标，工程量清单必须作为招标文件的组成部分。主要区别： 1、强调招标人需要对工程量清单的准确性和完整性负责，不得利用业主身份把这部分责任转嫁给投标人； 2、上升为强制性条款。三、分部分项工程量清单内容 08规范：3.2.1 分部分项工程量清单应包括项目编码、项目名称、项目特征、计量单位和工程量。 03规范：3.2.1 分部分项工程量清单应包括项目编码、项目名称、项目特征、计量单位和工程量。主要区别： 1、在原有四统一的基础上增加项目特征，变为现在的五个要件； 2、上升为强制性条款。四、分部分项工程量清单项目编码 08规范：3.2.3 分部分项工程量清单的项目编码，应采用十二位阿拉伯数字表示。一至九位应按附录的规定设置，十至十二位应根据拟建工程的工程量清单项目名称设置，同一招标工程的项目编码不得有重码。

十大企业危机公关案例

十大企业危机公关案例 The Standardization Office was revised on the afternoon of December 13, 2020

2007中国十大企业危机公关案例 2008/1/3/07:16 来源：中国管理传播网作者：未然 1、LG翻新事件 .............................................................................................. 错误!未定义书签。 2、摩托罗拉手机爆炸事件............................................................................. 错误!未定义书签。 3、戴尔断货诚信风波..................................................................................... 错误!未定义书签。 4、西门子贿赂丑闻......................................................................................... 错误!未定义书签。 5、森马广告风波............................................................................................. 错误!未定义书签。 6、家乐福群殴、踩踏事件............................................................................. 错误!未定义书签。 7、品客、乐事、依云遭遇“标准门”......................................................... 错误!未定义书签。 8、奔驰汽车安全风波..................................................................................... 错误!未定义书签。 9、华为等知名企业辞工潮............................................................................. 错误!未定义书签。 10、中石油社会责任风波............................................................................... 错误!未定义书签。岁末年初，如果让我们回顾2007年中国企业危机公关事件的话，就不难发现：与前几年相比，在刚刚过去的2007年，更多的企业经历了危机公关之痛。从手机、汽车、IT到食品、服饰、超市等行业，众多企业经历了各式各样的公关危机。接下来，就让我们从诸多危机公关案例事件中筛选十大具有代表意义的典型案例，以全面还原2007年中国企业的危机公关现状。（以事件发生先后为序） 1、LG翻新事件 LG翻新事件起源于2006年，在2007年上半年愈演愈烈。2007年1月，在地下翻新工厂遭曝光后，LG声称背后有人敲诈；2月份又有媒体曝光工商局封存5台LG疑似翻新空调，随后LG承认更换部分产品包装；3月，湖南省消费者张洪峰披露了湖南省质量检验协会的鉴定结果，确认“其购买的五台LG空调都是翻新机器”，5月份张洪峰通过博客再次披露了LG空调的质量问题。LG翻新

2008清单计算规则.

关于执行《建设工程工程量清单计价规范》(GB50500-2008)若干意见的通知

关于执行《建设工程工程量清单计价规范》（GB50500-2008）若干意见的通知日期： 2009年4月 30日【文字大小：大中小】【打印】【关闭】通知京造定〔2009〕7号各有关单位：为了促进建筑市场各方主体贯彻执行国家标准《建设工程工程量清单计价规范》（GB50500-2008）（以下简称计价规范），规范我市建设工程工程量清单计价行为，根据《关于贯彻实施<建设工程工程量清单计价规范>（GB50500-2008）的通知》（京建市〔2009〕24号）。现结合我市工程造价管理的有关规定及2001年《北京市建设工程预算定额》（以下简称预算定额），将执行计价规范中若干意见的通知发给你们，请遵照执行。一、规费发包方在编制招标文件以及发承包双方签订施工合同时，不得将规费作为竞争性费用。招标人在编制招标控制价时，应按照“关于调整2001年《北京市建设工程预算定额》规费计算方法的有关规定”（京造定〔2009〕6号）中的相关规定计算。

投标人在投标报价时，应根据有关文件规定结合本企业缴费情况自行确定。二、漏项及新增项目综合单价确定的原则漏项是指在合同承包范围内的工作内容，且计价规范中有单独列项的要求，或按计价规范要求应当单独列项，但工程量清单中没有单独列项的项目。对于漏项及新增项目等需要重新确定的综合单价（合同中没有适用或类似的综合单价），发、承包双方必须在合同中对以下内容进行约定：消耗量确定的依据；人工、材料、机械单价的确定原则；综合单价中管理费、利润、风险费的取费标准等作出明确约定。若合同中未作约定时，漏项或新增项目综合单价按以下原则确定： 1.消耗量：可依据现行定额相关项目及有关规定的消耗量确定。 2.人工、材料、机械价格：按发、承包双方确认的市场价格或参照施工期《北京工程造价信息》中的价格确定。 3.综合单价中各项取费标准：按相应项目原投标费率确定。三、综合单价中一定范围内风险及幅度的约定 1.风险范围和幅度的确定。采用工程量清单计价的工程，应在招标文件或合同中明确风险内容及其范围、幅度，不得采用无限风险、所有风险或类似语句规定风险范围及幅度。主要材料以及人工和机械风险幅度在±3%～±6%区间内考虑。 2.风险幅度变化确定原则。变化幅度应以《北京工程造价信息》中的市场信息价格（以下简称造价信息价格）为依据，造价信息价格中有上、下限的，以下限为准，造价信息价格中没有的，按发、承包人共同确认的市场价格为准。施工期市场价格以发、承包人共同确认的价格（以下简称确认价格）为准。若发、承包人未能就共同确认价格达成一致，可以参考造价信息价格。

2008清单计价规范解释

2008清单计价规范解释建设部标准定额研究所关于《建设工程工程量清单计价规范》有关问题解释答疑专题建设部标准定额研究所关于《建设工程工程量清单计价规范》有关问题解释答疑 1、总承包服务费具体包括什么费用？答：按《计价规范》2.0.6条及参阅"宣贯辅导教材"第3.4.1条。 2、对于预留金，若发生的工程量变更超过预留金额，是否调整？答：预留金属于招标人预留工程变更的费用，与投标人无关。参阅"宣贯辅导教材"4.0.6条。 3、计价规范中，将模板费用列入措施项目费中。宣贯资料第三部分案例一中第361页把模板费用列入分部分项的综合单价中。答：以《计价规范》的正文为准。 4、在工程量清单中，3.4.2"为了准确的计价，零星工作项目表中应详细列出人工、材料、机械名称和相应数量"，这怎么实现？答：招标人视工程情况在零星工作项目计价表中列出有关内容，并标明暂定数量，这是招标人对未来可能发生的工程量清单项目以外的零星工作项目的预测。投标人根据表中内容响应报

价，这里的"单价"是综合单价的概念，应考虑管理费、利润、风险等；招标人没有列出，而实际工作中出现了工程量清单项目以外的零星工作项目，可按合同规定或按规范4.0.9条工程量变更进行调整。 5、在工程量清单报价中，措施费以项做为计量单位，以元计价。请问：当实际工程量发生变化后，结算时措施费用是否可跟着进行调整？还是有个幅度的限制？例：如砼工程量发生变化，则模板、脚手架及至规范、税金都随变动。如可调，则原先措施报价失去意义，变成了暂定价。（因为工程量清单是固定单价，而这种变化是每个工程都不可避免的。）如不可调则与实际情况不符。答：按合同约定。 6、投标人未填报单价的项目，工程量变更减少或实际工程量与发布量不同时，如何调整？填表须知第3条与本问题的关系？答：投标人未填报单价的项目，视为其费用已包含在其他项目中，与填表须知第3条相同。若工程量变更增减或实际量与招标清单量不同时，按《计价规范》4.0.9条规定或按合同约定处理。 7、什么是规费？规费一般有哪些？答：规费是指国家及地方政府规定必须交纳的费用，包括工程排污费、工程定额测定费等。

《关于建设工程质量检验试验费计价规定的通知》浙江省建设厅建建发〔2008〕22号

关于建设工程质量检验试验费计价规定的通知建建发〔2008〕22号各市建委（建设局）、绍兴市建管局、宁波市发改委、温州市政园林局、义乌市建设局：为规范建设工程质量检测市场秩序，确保建设工程质量，合理确定建设工程质量检验试验费计价标准，根据《建设工程质量检测管理办法》（建设部令第141号）、《浙江省建设工程质量检测管理实施办法》（浙建法〔2006〕47号）、《浙江省建设工程其他费用定额》和《浙江省建设工程施工取费定额》（2003版）的规定，现就建设工程质量检验试验费计价规定如下：一、建设工程质量检验试验费是指对建筑材料、构件和建筑安装物进行一般鉴定、检查所发生的费用。包括建设工程质量见证取样检测费、建筑施工企业配合检测及自设试验室进行试验所耗用的材料和化学药品等费用。不包括新结构、新材料的试验费和建设单位对具有出厂合格证明的材料进行检验(规范另有要求的除外)，不包括对构件做破坏性试验及其他有特殊要求需检验试验的费用。其费用计入建设工程造价。二、建设工程质量专项检测费按照《浙江省建设工程其他费用定额》研究试验费项目列项，其费用由建设单位与检测单位根据工程质量检测的内容和要求在合同中约定，列入工程建设其他费用。三、建设工程质量检验试验费按《浙江省建设工程施工取费定额》施工组织措施费项目列项。检验试验费的内容及费率详见附表。

四、各级招投标监管机构应按照本通知要求，在工程招投标中确保建设工程质量检验试验费用的计取。施工企业在投标报价时，不得以低于本费率的下限竞价。其他有关计算规定按《浙江省建设工程施工取费定额》规定执行。五、本规定自发文之日起执行。各市在执行过程中遇有问题请及时与浙江省建设工程造价管理总站联系。附表：《建设工程检验试验费用费率》二○○八年一月二十五日附表：建设工程检验试验费用费率（1）建筑工程检验试验费用费率定额编号项目名称计算基础费率（%） A1-9 检验试验费人工费+机械费 1.1～1.7 （2）安装工程检验试验费用费率定额编号项目名称计算基础费率（%） C1-9 检验试验费人工费0.8～1.3 （3）市政工程检验试验费用费率定额编号项目名称计算基础费率（%） D1-19 检验试验费人工费+机械费2.2～3.4 注：市政工程中的安装工程按C1-9规定计算。

十大危机公关案例

十大危机公关案例时间：2004-04-01 00:00 文字选择：大中小在2003年里，我们的国家和民族经历着诸多考验和危机，比如SARS、洪水。而作为社会重要的经济体——企业也不能例外，从年头至年尾，公关危机持续不断。面对公关危机，有的企业积极应对体现出大家风范，有的则遮遮掩掩欲盖弥彰。其实，危机既包含“危险”也蕴涵着“机遇”。引用著名企业危机管理与公关专家奥古斯丁先生的一句话：“每一次危机的本身既包含导致失败的根源，也孕育着成功的种子。发现、培育以便收获这个潜在的成功机会就是危机公关的精髓。” 鉴于长期浸淫于“危机公关”课题的跟踪和研究，笔者以为很有必要对2003年发生在中国市场上的包括跨国公司和内资企业具有代表意义的危机公关案例加以汇集和总结。我们试图通过企业与媒体、政府、社区、供应商、经销商、投资者、消费者等因素提炼和分析，并给予评价分值，故而形成本“十大案例”专题。 2003年度十大企业危机公关案例案例一：CECT手机：“中国种的狗”事件 2003年2月，南京的个别消费者发现自己购买的中电通信CECT928手机屏幕上竟出现一句问候语“Hello Chow”，翻译意思是“你好，中国种的狗”，消费者随即向新闻媒体反映。此事经媒体一曝光，立刻掀起轩然大波，许多人都认为这是对民族尊严的伤害，是对中国人的侮辱，众多此手机的用户准备向厂家讨个说法。事件发生当日，中电通信市场总监飞赴南京解决此事，并与首先发现问题的用户取得联系。随即，中电通信公司发表公开声明：1、我公司(中电通信)作为国内重要的手机供应商之一，一直以发展民族企业为己任，公司本着“用户至上的原则”，绝无伤害国内用户民族尊严的想法与行为；2、CECT 928是我公司2002年8月推出的产品，以优异的产品质量、强大的功能、时尚的外观、精湛的工艺、合理的价格而赢得了广大消费者的喜爱。“Hello Chow”是该手机产品的问候语，意为“你好，可爱的宠物狗”，是该手机人性化的开机界面；3、本着对国内购买者负责的原则，购机用户如不喜欢该界面，CECT可提供免费软件升级，并公布了售后服务中心的地址和电话。公关得分：40分理由及点评： CECT手机“HELLO CHOW”事件出来以后，中电通信市场总监飞赴南京调节此事，并在第一时间与首先发现问题的用户取得联系，这一点表现了中电通信对这个公关危机的重视程度和反应及时性。包括中电通信所发表的公开声明，都具有积极的意义。但是，一则非常简单的声明是很难解决问题并令人信服的，由此可见中电通信对这起公关危机的处理是不到位不成功的。笔者认为，中电通信这