1 -Cyclic Code
Let be a finite field with elements and be a power of a prime number, be the polynomial ring of with variable . Let be the -dimensional linear space over , and
be a fixed vector inwith , the associated polynomial of given by
Let be the principal ideal generated by in . There is a one to one correspondence between and the quotient ring , given by
In fact, this correspondence is also an isomorphism of Abel groups. One may extend this correspondence to subsets of and by
If is a linear subspace of of dimension , then is called a linear code in coding theory and written by as usual. Each vector is called a codeword of length . Obviously, and are two trivial codes. Another one is called constant codes, of which is almost trivial given by
According to the given polynomial
, we may define a linear transformationin ,
It is easily seen that is a linear transformation.
Definition 1.1 Let be a linear code. It is called a -cyclic code, if
In other words, a linear code is a -cyclic code, if and only if is closed under linear transformation . Clearly, if , and , then the -cyclic code is precisely the ordinary cyclic code (see Chapter 6 of ).
We first show that there is a one to one correspondence between -cyclic codes in and ideals in .
Theorem 1 Let be a subset, then is a -cyclic code, if and only if is an ideal of .
Proof: We use column notation for vector in , then linear transformation may be written as
Let be a square matrix over ,
where is the unit matrix. The matrix expression of as follows
Suppose and is an ideal of , it is clear that is a linear code of . To prove is a -cyclic code, we note that for any polynomial , then if and only if , namely, if , then
Therefore, if is an ideal of , then we have immediately that is a -cyclic code of .
Conversely, if is a -cyclic code, then for all , we have
It follows that
which implies is an ideal of . This is the proof of Theorem 1.
By Theorem 1, to find a -cyclic code, it is enough to find an ideal of . There are two trivial ideals and , the corresponding -cyclic codes are and respectively, which are called trivial -cyclic code. To find non-trivial -cyclic codes, we make use of homomorphic theorems, which is a standard technique in Algebra. Let be the natural homomorphism from to its quotient ring , ,
where is an ideal of , of which is containing . Since is a principal ideal domain, then is a principal ideal generated by a monic polynomial . It is easy to see that
It follows that all ideals satisfing (1.9) are given by
We write by mod , the image of under , it is easy to check
more precisely, which is a representative elements set of mod , by homomorphism theorem in ring theory, all ideals of given by
Let be the number of monic divisors of in , it follows immediately that
Corollary 1 The number of -cyclic code in is .
To compare the -cyclic code and ordinary cyclic code, we see a simple example.
Example 1 Constant code is always a cyclic code for , and its generated polynomial is just . But constant code in is not always a -cyclic code, it is a -cyclic code if and only if , an equivalent condition for is
Definition 1.2 Let be a -cyclic code and mod . We call is the generated polynomial of , where is monic and .
Lemma 1.1 Let be the generated polynomial of a -cyclic code , where , and , then and a generated matrix for is the following block matrix
where is the corresponding codeword of , and for .
Proof: By assumption, mod , then , we are to prove it is a basis of . First, these vectors are linearly independent. Otherwise, we have
and the corresponding polynomial is zero, namely
It follows that
Next, if , and , by (1.10), there is a polynomial such that
Thus we have the corresponding codeword of
This shows that is a basis of , and a generated matrix for is
We have lemma 1.1 at once.
To describe a parity check matrix for a -cyclic code, for any , we write
Lemma 1.2 Suppose is a -cyclic code with generated polynomial , where and . Let , where . Then a parity check matrix for is
Proof: Since , it means that in , thus we have
It follows that , where is a generated matrix for given by (1.12). Therefore, is a parity check matrix for .
A separable polynomial in Algebra means that it has no multiple roots in its splitting field. The following lemma shows that there is an unit element in any non-zero ideal of , when is a separable polynomial.
Lemma 1.3 Suppose is a separable polynomial of , and mod is an ideal of with , then there exists an element such that
Proof: Let . Since is a separable polynomial, then , and there are two polynomial and in such that
If , by (1.10), we write , it follows that
Thus we have in .
Next, we discuss maximal -cyclic code. Let mod , and be an irreducible polynomial in , we call the corresponding -cyclic code a maximal -cyclic code, because is a maximal ideal in .
Lemma 1.4 Let be a maximal -cyclic code with generated polynomial , be a root of in some extensions of , then
Proof: If , by (1.10) we have immediately. Conversely, if and , since is irreducible, thus we have , and (1.15) follows at once.
An important application of maximal -cyclic code is to constract an error-correcting code, so that we may obtain a modified McEliece-Niederriter’s cryptosystem. To do this, let , and be an extension field of of degree . Suppose , where is a primitive element of and is the simple extension containing and . Let be the minimum polynomial of , then is an irreducible polynomial of degree of . It is well-known that is a Galois extension of , so that all roots of are in . Let be all roots of , the Vandermonde matrix defined by
where and each is a vector of . For arbitrary monic polynomial , , let and be a maximal -cyclic code generated by . It is easy to verify that
Therefore, is a parity check matrix for . If we choose the primitive element , so that any columns in are linearly independent, then the minimum distance of is greater than , and is a t-error-correcting code, where .
The public key cryptosystems based on algebraic coding theory were created by R.J.McEliece  and H.Niederriter , a suitable t-error-correcting code plays a key role in their construction. The error-correcting code should satisfy the following requirements:
(i) should have a relatively large error-correcting capability so that a reasonable number of message vectors can be used;
(ii) should allow an efficient decoding algorithm so that the decryption can be carried out with a short time.
Our results supply a different way to choose an error-correcting code by selecting arbitrary irreducible polynomials of degree and roots of rather than an irreducible factor of and the roots of unit such as ordinary BCH code and Gappa code.
In fact, for any positive integer , there is at least an irreducible polynomial with degree . Let be the number of irreducible polynomials of degree in , then we have (see Theorem 3.25 of )
where is Mobis function.
Assuming one has selected two monic and irreducible polynomials and with and , let , then one may obtain -cyclic code generated by or , which is more convenient and more flexible than the ordinary methods.
2 A Generalization of NTRUEncrypt
The public key cryptosystem NTRU proposed in 1996 by Hoffstein, Pipher and Silverman, is the fastest known lattice based encryption scheme, although its description relies on arithmetic over polynomial quotient ring , it was easily observed that it could be expressed as a lattice based cryptosystem (see ). For the background materials, we refer to , , , ,  and . Our strategy in this section is to replace by more general polynomial ring and obtain a generalization of NTRUEncrypt, where is a monic polynomial of degree with integer coefficients.
In this section, we denote and by
Let be a square matrix given by
where is unit matrix. Obviously, is the characteristic polynomial of , and defines a linear transformation of by , where is real number field, is a column vector of . We may extend this transformation to and denote by
Of course, is again a linear transformation of .
According to , a -ary lattice is a lattice such that , where is a positive integer.
Definition 2.1 A -ary lattice is called convolutional modular lattice, if is in even dimension satisfying
In other words, a convolutional modular lattice is a -ary lattice in even dimension and is closed under the linear transformation .
Recalling the secret key of NTRU is a pair of polynomials of degree , we may regard and as column vectors in . To obtain a convolutional modular lattice containing , we need some help of ideal matrices. An ideal matrix generated by a vector is defined by
which is a block matrix in terms of each column . It is easily seen that is a generalization of the classical circulant matrices (see ), in fact, let , and , the ideal matrix generated by is given by
which is known as a circulant matrix. On the other hand, ideal matrix and ideal lattice play an important role in Ajtai’s construction of a collision resistant Hash function, the related materials we refer to , , , ,  and .
First, we have to establish some basic properties for an ideal matrix , most of them are known when is a circulant matrix.
Lemma 2.1 Suppose and are given by (2.2) and (2.5) respectively, then for any we have
Proof: Since is the characteristic polynomial of , by Hamilton-Cayley theorem, we have
By (2.5) we have
the lemma follows.
Lemma 2.2 For any we have
Proof: We use induction on to show this conclusion. If , it is trivial. Suppose it is true for , we consider the case of . For this purpose, we write , the column vectors of unit in , namely
where is a row vector. For any , , it is easy to check that
Let , we denote by
By the assumption of induction, we have
It follows that
We complete the proof of lamma 2.2.
We always suppose that is a separable polynomial and are complex number roots of , of which are different from each other. The Vandermonde matrix generated by is
Lemma 2.3 Let , then we have
where diag is the diagonal matrix.
Proof: By Theorem 3.2.5 of , for , we have
By lemma 2.2, it follows that
Now, we summarize some basic properties for ideal matrix as follows.
Theorem 2 Let , be two column vectors and be the ideal matrix generated by , then we have:
(iii) det .
is an invertible matrix if and only ifand are coprime, i.e. gcd .
Proof: (i) and (ii) follow from lemma 2.2 immediately, (iii) and (iv) follow from lemma 2.3. Here we only give an equivalent form of (ii). Let
then by (ii) we have
To construct a convolutional modular lattice containing vector , let , be the transpose of , and
We consider and as matrices over , i.e. , , a -ary lattice is defined by (see )
Under the above notations, we have
Theorem 3 For any column vectors and , then is a convolutional modular lattice, and .
Proof: It is known that is a -ary lattice, i.e.
We only prove that is fixed under the linear transformation given by (2.4). If , then for some