Algorithm 5 The LWE algorithm.

Input:  LWE samples $(\mathbf{A},\mathbf{c}=\mathbf{A}\mathbf{s}+e)\in {\mathbb{Z}}_q^{m\times n}\times {\mathbb{Z}}_q^m$ Output:  secret vector $\mathbf{s}\in {\mathbb{Z}}_q^n$  1:Construct a q-ary lattice ${\mathsf{\Lambda }}_q(\mathbf{A})=\{\mathbf{v}\in {\mathbb{Z}}_q^m|\exists \mathbf{x}\in {\mathbb{Z}}^n,s.t.\mathbf{v}\equiv \mathbf{A}\mathbf{x}modq\}$, whose lattice basis is equivalent to $\mathbf{B}={\left[\mathbf{A}\right|q{\mathbf{I}}_m]}^T\in {\mathbb{Z}}^{(m+n)\times m}$.  2:Perform elementary row transformations on $\mathbf{B}$ and obtain the lattice basis ${\mathbf{B}}_1=\left[\begin{array}{cc}{\mathbf{I}}_n& {\mathbf{A}}_{n\times (m-n)}^{{}^{\prime }}\\ \mathbf{0}& q{\mathbf{I}}_{m-n}\end{array}\right]\in {\mathbb{Z}}^{m\times m}$.  3:Using Kannan’s embedding technique, reduce BDD to Unique-SVP and obtain ${\mathbf{B}}_2=\left[\begin{array}{cc}{\mathbf{B}}_1& 0\\ \mathbf{c}& M\end{array}\right]\in {\mathbb{Z}}^{(m+1)\times (m+1)}$.  4:Process ${\mathbf{B}}_2$ with VQE and derive a short vector $\mathbf{e}$.  5:return$\mathbf{s}={\mathbf{A}}^{-1}(\mathbf{c}-\mathbf{e})$