    # Cyclic Lattices, Ideal Lattices and Bounds for the Smoothing Parameter

Cyclic lattices and ideal lattices were introduced by Micciancio in <cit.>, Lyubashevsky and Micciancio in <cit.> respectively, which play an efficient role in Ajtai's construction of a collision resistant Hash function (see <cit.> and <cit.>) and in Gentry's construction of fully homomorphic encryption (see <cit.>). Let R=Z[x]/⟨ϕ(x)⟩ be a quotient ring of the integer coefficients polynomials ring, Lyubashevsky and Micciancio regarded an ideal lattice as the correspondence of an ideal of R, but they neither explain how to extend this definition to whole Euclidean space ℝ^n, nor exhibit the relationship of cyclic lattices and ideal lattices. In this paper, we regard the cyclic lattices and ideal lattices as the correspondences of finitely generated R-modules, so that we may show that ideal lattices are actually a special subclass of cyclic lattices, namely, cyclic integer lattices. In fact, there is a one to one correspondence between cyclic lattices in ℝ^n and finitely generated R-modules (see Theorem <ref> below). On the other hand, since R is a Noether ring, each ideal of R is a finitely generated R-module, so it is natural and reasonable to regard ideal lattices as a special subclass of cyclic lattices (see corollary <ref> below). It is worth noting that we use more general rotation matrix here, so our definition and results on cyclic lattices and ideal lattices are more general forms. As application, we provide cyclic lattice with an explicit and countable upper bound for the smoothing parameter (see Theorem <ref> below). It is an open problem that is the shortest vector problem on cyclic lattice NP-hard? (see <cit.>). Our results may be viewed as a substantial progress in this direction.

## Authors

12/28/2021

### A Generalization of Cyclic Code and Applications to Public Key Cryptosystems

In this paper, we define and discuss ϕ-cyclic code, which may be regarde...
04/21/2020

### On the ideal shortest vector problem over random rational primes

Any ideal in a number field can be factored into a product of prime idea...
05/07/2021

### Subfield Algorithms for Ideal- and Module-SVP Based on the Decomposition Group

Whilst lattice-based cryptosystems are believed to be resistant to quant...
07/29/2020

### New Constructions of Optimal Cyclic (r,δ) Locally Repairable Codes from Their Zeros

An (r, δ)-locally repairable code ((r, δ)-LRC for short) was introduced ...
07/08/2020

### M-cancellation Ideals

Let R be a commutative ring with non–zero identy and let M be an R–modul...
09/02/2021

### Quaternions over Galois rings and their codes

It is shown in this paper that, if R is a Frobenius ring, then the quate...
05/15/2020

### Network Coding Based on Byte-wise Circular Shift and Integer Addition

A novel implementation of a special class of Galois ring, in which the m...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Discrete Subgroup in Rn

Let be the real numbers field, be the integers ring and be Euclidean space of which is an -dimensional linear space over with the Euclidean norm given by

 |x|=(n∑i=1x2i)12,where x′=(x1,x1,⋯,xn)∈Rn.

We use column vector notation for through out this paper, and is transpose of , which is called row vector of .

Definition 1.1 Let be a non-trivial additive subgroup, it is called a discrete subgroup if there is a positive real number such that

 minx∈L,x≠0|x|⩾λ>0. (1.1)

As usual, a ball of center with radius is defined by

 b(x0,δ)={x∈Rn ∣∣ |x−x0|⩽δ}.

If is a discrete subgroup of , then there are only finitely many vectors of lie in every ball , thus we always find a vector such that

 |α|=minx∈L,x≠0|x|=λ>0,α∈L. (1.2)

is called one of shortest vector of and is called the minimum distance of .

Let be a dimensional matrix with rank, it means that are linearly independent vectors in . The lattice generated by is defined by

 L(B)=m∑i=1xiβi={Bx | x∈Zm},∀xi∈Z. (1.3)

which is all linear combinations of over . If , is called a full-rank lattice.

It is a well-known conclusion that a discrete subgroup in is just a lattice . Firstly, we give a detail proof here by making use of the simultaneous Diophantine approximation theory in real number field (see  and ).

###### Lemma 1.1.

Let be a discrete subgroup, be vectors of . Then are linearly independent over , if and only if which are linearly independent over .

###### Proof.

If are linearly independent over , trivially which are linearly independent over . Suppose that are linearly independent over , we consider arbitrary linear combination over . Let

 a1α1+a2α2+⋯+amαm=0,∀ai∈R. (1.4)

We should prove (1.4) is equivalent to , which implies that are linearly independent over .

By Minkowski’s Third Theorem (see Theorem VII of ), for any sufficiently large , there are a positive integer and integers such that

 max1⩽i⩽m|qai−pi|

By (1.4), we have

 |p1α1+p2α2+⋯+pmαm|=|(qa1−p1)α1+(qa2−p2)α2+⋯+(qam−pm)αm|
 ⩽mN−1mmax1⩽i⩽m|αi|. (1.6)

Let be the minimum distance of , be any positive real number. We select such that

 N>max{(mϵ)m, (mλ)mmax1⩽i⩽m|αi|m}.

It follows that and

 mN−1mmax1⩽i⩽m|αi|<λ.

By (1.6) we have

 |p1α1+p2α2+⋯+pmαm|<λ.

Since , thus we have , and . By (1.5) we have for all , . Since is sufficiently small positive number, we must have . We complete the proof of lemma.

Suppose that is an -dimensional matrix and rank, is the transpose of . It is easy to verify

 rank(B′B)=rank(B)=m⇒ det(B′B)≠0,

which implies that is an invertible square matrix of dimension. Since

is a positive defined symmetric matrix, then there is an orthogonal matrix

such that

 P′B′BP=diag{δ1,δ2,…,δm}, (1.7)

where are the characteristic value of , and diag is the diagonal matrix of dimension.

###### Lemma 1.2.

Suppose that with rank, are characteristic values of , and is the minimum distance of lattice , then we have

 λ(L(B))=minx∈Zm, x≠0|Bx|⩾√δ, (1.8)

where .

###### Proof.

Let , by (1.7), there exists an orthogonal matrix such that

 P′AP=diag{δ1,δ2,…,δm}.

If , , we have

 |Bx|2=x′Ax=x′P(P′AP)P′x
 =(P′x)′ diag{δ1,δ2,…,δm}P′x
 ⩾δ|P′x|2=δ|x|2.

Since and , we have , it follows that

 minx∈Zm, x≠0|Bx|⩾√δ|x|⩾√δ.

We have lemma 1.2 immediately.

Another application of Lemma 1.2 is to give a countable upper bound for smoothing parameter (see Theorem 4.5 below). Combining lemma 1.1 and lemma 1.2, we show that the following assertion.

###### Theorem 1.3.

Let be a subset, then is a discrete subgroup if and only if there is an dimensional matrix with rank such that

 L=L(B)={Bx | x∈Zm}. (1.9)
###### Proof.

If is a discrete subgroup, then is a free -module. By lemma 1.1, we have . Let be a -basis of , then

 L={m∑i=1aiβi | ai∈Z}.

Writing , then the rank of matrix is , and

 L={Bx | x∈Zm}=L(B).

Conversely, let be arbitrary lattice generated by , obviously, is an additive subgroup of , by lemma 1.2, is also a discrete subgroup, we have Theorem 1.3 at once.

###### Corollary 1.4.

Let be a lattice and be an additive subgroup of , then is a lattice of .

###### Corollary 1.5.

Let be an additive subgroup, then is a lattice of . These lattices are called integer lattices.

According to above Theorem 1.3, a lattice is equivalent to a discrete subgroup of . Suppose is a lattice with generated matrix , and rank, we write rankrank, and

 d(L)=√det(B′B). (1.10)

In particular, if rank is a full-rank lattice, then as usual. A sublattice of means a discrete additive subgroup of , the quotient group is written by and the cardinality of is denoted by .

###### Lemma 1.6.

Let be a lattice and be a sublattice. If rankrank, then the quotient group is a finite group.

###### Proof.

Let rank, and , where with rank. We define a mapping from to by . Clearly, is an additive group isomorphism, is a full-rank lattice of , and . It is a well-known result that

 |Zm/σ(N)|=d(σ(N)).

It follows that

 |L/N|=|Zm/σ(N)|=d(σ(N)).

Lemma 1.6 follows.

Suppose that , are two lattices of , we define . Obviously, is an additive subgroup of , but generally speaking, is not a lattice of again.

###### Lemma 1.7.

Let , be two lattices of . If rankrank or rankrank, then is again a lattice of .

###### Proof.

To prove is a lattice of , by Theorem 1.3, it is sufficient to prove is a discrete subgroup of . Suppose that rankrank, for any , we define a distance function by

 ρ(x)=inf{|x−y| ∣∣ y≠x, y∈L2}.

Since there are only finitely many vectors in , where is any a ball of center with radius . Therefore, we have

 ρ(x)=min{|x−y| ∣∣ y≠x, y∈L2}=λx>0. (1.11)

On the other hand, if , and , then there is such that , and we have . It means that is defined over the quotient group . Because we have the following group isomorphic theorem

 L1+L2/L2≅L1/L1∩L2.

By lemma 1.6, it follows that

 |L1+L2/L2|=|L1/L1∩L2|<∞.

In other words, is also a finite group. Let be the representative elements of , we have

 minx∈L1,y∈L2,x≠y|x−y|=min1⩽i⩽kρ(xi)⩾min{λx1,λx2,…,λxk}>0.

Therefore, is a discrete subgroup of , thus it is a lattice of by Theorem 1.3.

###### Remark 1.8.

The condition rankrank or rankrank in lemma 1.7 seems to be necessary. As a counterexample, we see the real line , let and , then is not a discrete subgroup of , thus is not a lattice in . Because is dense in by Dirichlet’s Theorem (see Theorem I of ).

As a direct consequence, we have the following generalized form of lemma 1.7.

###### Corollary 1.9.

Let be lattices of and

 rank(L1∩L2∩⋯∩Lm)=rank(Lj) for% some 1⩽j⩽m.

Then is a lattice of .

###### Proof.

Without loss of generality, we assume that

 rank(L1∩L2∩⋯∩Lm)=rank(Lm).

Let , then

 L′+Lm/L′≅Lm/L′∩Lm.

Since rankrank, by lemma 1.7, we have is a lattice of and the corollary follows.

## 2 Ideal Matrices

Let and be the polynomials rings over and with variable respectively. Suppose that

 ϕ(x)=xn−ϕn−1xn−1−⋯−ϕ1x−ϕ0∈Z[x], ϕ0≠0, (2.1)

is a polynomial with integer coefficients of which has no multiple roots in complex numbers field . Let be the different roots of in , the Vandermonde matrix is defined by

 Vϕ=⎛⎜ ⎜ ⎜ ⎜ ⎜⎝11⋯1w1w2⋯wn⋮⋮⋮wn−11wn−12⋯wn−1n⎞⎟ ⎟ ⎟ ⎟ ⎟⎠,\ and\ \ \ % det(Vϕ)≠0. (2.2)

According to the given polynomial , we define a rotation matrix by

 H=Hϕ=⎛⎜ ⎜ ⎜ ⎜ ⎜⎝0⋯0ϕ0ϕ1In−1⋮ϕn−1⎞⎟ ⎟ ⎟ ⎟ ⎟⎠n×n∈Zn×n, (2.3)

where is the unit matrix. Obviously, the characteristic polynomial of is just .

We use column notation for vectors in , for any , the ideal matrix generated by vector is defined by

 H∗(f)=[f,Hf,H2f,…,Hn−1f]n×n∈Rn×n, (2.4)

which is a block matrix in terms of each column . Sometimes, is called an input vector. It is easily seen that is a more general form of the classical circulant matrix (see ) and -circulant matrix (see  and ). In fact, if , then is the ordinary circulant matrix generated by . If , then is the -circulant matrix.

By (2.4), it follows immediately that

 H∗(f+g)=H∗(f)+H∗(g), and H∗(λf)=λH∗(f), ∀λ∈R. (2.5)

Moreover,

is a zero matrix if and only if

is a zero vector, thus one has if and only if . Let be the set of all ideal matrices, namely

 M∗={H∗(f) | f∈Rn}. (2.6)

We may regard as a mapping from to of which is a one to one correspondence.

In , we have shown that some basic properties for ideal matrix, most of them may be summarized as the following theorem.

###### Theorem 2.1.

Suppose that is a fixed polynomial with no multiple roots in , then for any two column vectors and in , we have

(i) ;

(ii) and ;

(iii) ;

(iv) det ;

(v)

is an invertible matrix if and only if

in .

where is the Vandermonde matrix given by (2.2), are all roots of in , and diag is the diagonal matrix.

###### Proof.

See Theorem 2 of . ∎

Let be unit vectors of , that is

 e1=⎛⎜ ⎜ ⎜ ⎜⎝10⋮0⎞⎟ ⎟ ⎟ ⎟⎠,e2=⎛⎜ ⎜ ⎜ ⎜⎝01⋮0⎞⎟ ⎟ ⎟ ⎟⎠,⋯,en=⎛⎜ ⎜ ⎜ ⎜⎝00⋮1⎞⎟ ⎟ ⎟ ⎟⎠.

It is easy to verify that

 H∗(e1)=In, and H∗(ek)=Hk−1, 1⩽k⩽n. (2.7)

This means that the unit matrix and rotation matrices are all the ideal matrices.

Let and be the principal ideals generated by in and respectively, we denote the quotient rings and by

 R=Z[x]/ϕ(x)Z[x], and ¯¯¯¯R=R[x]/ϕ(x)R[x]. (2.8)

There is a one to one correspondence between and given by

 f(x)=f0+f1x+⋯+fn−1xn−1∈¯¯¯¯Rt−−−−→f=⎛⎜ ⎜ ⎜ ⎜⎝f0f1⋮fn−1⎞⎟ ⎟ ⎟ ⎟⎠∈Rn.

We denote this correspondence by , that is

 t(f(x))=f and t−1(f)=f(x), ∀f(x)∈¯¯¯¯R, % and f∈Rn. (2.9)

If we restrict in the quotient ring , then which gives a one to one correspondence between and . First, we show that is also a ring isomorphism.

###### Definition 2.2.

For any two column vectors and in , we define the -convolutional product by .

By Theorem 2.1, it is easy to see that

 f∗g=g∗f, and H∗(f∗g)=H∗(f)H∗(g). (2.10)
###### Lemma 2.3.

For any two polynomials and in , we have

 t(f(x)g(x))=H∗(f)g=f∗g.
###### Proof.

Let , then

 xg(x)=ϕ0gn−1+(g0+ϕ1gn−1)x+⋯+(gn−2+ϕn−1gn−1)xn−1.

It follows that

 t(xg(x))=Ht(g(x))=Hg. (2.11)

Hence, for any , we have

 t(xkg(x))=Hkt(g(x))=Hkg, 0⩽k⩽n−1. (2.12)

Let , by (i) of Theorem 2.1, we have

 t(f(x)g(x))=n−1∑i=0fit(xig(x))=n−1∑i=0fiHig=H∗(f)g.

The lemma follows.

###### Theorem 2.4.

Under -convolutional product, is a commutative ring with identity element and is its subring. Moreover, we have the following ring isomorphisms

 ¯¯¯¯R≅Rn≅M∗, and R≅Zn≅M∗Z,

where is the set of all ideal matrices given by (2.6), and is the set of all integer ideal matrices.

###### Proof.

Let and , then

 t(f(x)+g(x))=f+g=t(f(x))+t(g(x)),

and

 t(f(x)g(x))=H∗(f)g=f∗g=t(f(x))∗t(g(x)).

This means that is a ring isomorphism. Since and , then is a commutative ring with as the identity elements. Noting is an integer matrix if and only if is an integer vector, the isomorphism of subrings follows immediately.

According to property (v) of Theorem 2.1, is an invertible matrix whenever in , we show that the inverse of an ideal matrix is again an ideal matrix.

###### Lemma 2.5.

Let and in , then

 (H∗(f))−1=H∗(u).

where is the unique polynomial such that (mod ).

###### Proof.

By lemma 2.3, we have , it follows that

 H∗(u)H∗(f)=H∗(e1)=In.

Thus we have . It is worth to note that if is an invertible integer matrix, then is not an integer matrix in general.

Sometimes, the following lemma may be useful, especially, when we consider an integer matrix.

###### Lemma 2.6.

Let and in , then we have in .

###### Proof.

Let be the rational number field. Since in , then in . We know that is a principal ideal domain, thus there are two polynomials and in such that

 a(x)f(x)+b(x)ϕ(x)=1.

This means that in .

## 3 Cyclic Lattices and Ideal Lattices

As we known that cyclic code play a central role in algebraic coding theorem (see Chapter 6 of ). In , we extended ordinary cyclic code to more general forms, namely -cyclic codes. To obtain an analogous concept of -cyclic code in , we note that every rotation matrix

defines a linear transformation of

by .

###### Definition 3.1.

A linear subspace is called a -cyclic subspace if . A lattice is called a -cyclic lattice if .

In other words, a -cyclic subspace is a linear subspace of , of which is closed under linear transformation . A -cyclic lattice is a lattice of of which is closed under . If , then is the classical circulant matrix and the corresponding cyclic lattice was first appeared in Micciancio , but he do not discuss the further property for these lattices. To obtain the explicit algebraic construction of -cyclic lattice, we first show that there is a one to one correspondence between -cyclic subspaces of and the ideals of .

###### Lemma 3.2.

Let be the correspondence between and given by (2.9), then a subset is a -cyclic subspace of , if and only if is an ideal.

###### Proof.

We extend the correspondence to subsets of and by

 C(x)⊂¯¯¯¯Rt−−−−→C={c|c(x)∈C(x)}⊂Rn. (3.1)

Let be an ideal, it is clear that is a linear subspace of . To prove is a -cyclic subspace, we note that if , then by (2.11)

 xc(x)∈C(x)⇔Ht(c(x))=Hc∈C.

Therefore, if is an ideal of , then is a -cyclic subspace of . Conversely, if is a -cyclic subspace, then for any , we have whenever , it implies

 ∀c(x)∈C(x)⇒xkc(x)∈C(x), 0⩽k⩽n−1,

which means that is an ideal of . We complete the proof.

By above lemma, to find a -cyclic subspace in , it is enough to find an ideal of . There are two trivial ideals and , the corresponding -cyclic subspace are and . To find non-trivial -cyclic subspaces, we make use of the homomorphism theorems, which is a standard technique in algebra. Let be the natural homomorphism from to , ker. We write by . Let be an ideal of satisfying

 <ϕ(x)>⊂N⊂R[x]π−−−−→¯¯¯¯R=R[x]/<ϕ(x)>. (3.2)

Since is a principal ideal domain, then is a principal ideal generated by a monic polynomial . It is easy to see that

 <ϕ(x)>⊂⇔g(x)|ϕ(x) in R[x].

It follows that all ideals satisfying (3.2) are given by

 {∣∣ g(x)∈R[x] is monic and g(x)|ϕ(x)}.

We write by mod , the image of under , i.e.

  mod ϕ(x)=π()

It is easy to check

  mod ϕ(x)={a(x)g(x) | a(x)∈R[x]\ and deg% a(x)+degg(x)

more precisely, which is a representative elements set of mod . By homomorphism theorem in ring theory, all ideals of given by

 {\ mod\ ϕ(x) ∣∣ g(x)∈R[x]\ is monic % and\ g(x)|ϕ(x)}. (3.4)

Let be the number of monic divisors of in , we have

###### Corollary 3.3.

The number of -cyclic subspace of is .

Next, we discuss -cyclic lattice, which is the geometric analogy of cyclic code. The -cyclic subspace of maybe regarded as the algebraic analogy of cyclic code. Let the quotient rings and given by (2.8). A -module is an Abel group such that there is an operator for all and , satisfying and . It is easy to see that is a -module, if and is a -module, then is called a -submodule of . All -modules we discuss here are -submodule of . On the other hand, if , then is an ideal of , if and only if is a -module. Let , the cyclic -module generated by be defined by

 Rα={λα | λ∈R}. (3.5)

If there are finitely many polynomials in