Removing the last λ factor in the LWE-based 2-to-1 component to obtain linear-sized keys

Develop techniques or constructions that eliminate the remaining factor of λ in the size of the LWE-based approximately 2-to-1 function used in the standard-model OSS scheme, thereby reducing the overall quantum secret key length from O(λ^2) to O(λ) under the assumed LWE hardness constraints.

Background

In the standard model, the OSS construction uses an LWE-based approximately 2-to-1 function to ensure collision-resistance. Parameter settings needed for sparse triggers and security against 2λ-time attacks inflate the effective input/output sizes, which in turn constrain the achievable secret key size.

The authors manage to reduce the effective size to O(λ2) but explicitly state that they do not know how to remove the final factor of λ, which prevents achieving truly linear-sized quantum secret keys under current LWE assumptions.

References

By carefully modifying the proof we can get the "effective" size to be O(\lambda2), but we do not know how to shave off the last factor of \lambda, preventing us from obtaining linear-sized quantum secret keys.

— Unclonable Cryptography in Linear Quantum Memory (2511.04633 - Shmueli et al., 6 Nov 2025) in Standard Model Construction, discussion of LWE-based 2-to-1 functions