Lattice-based cryptography is one of the most efficient alternatives for the standardisation of postquantum cryptography. Indeed, the majority of surviving proposals in the third round of the NIST public contest belongs to this category. Its strenghts are, first, the ease to implement, and second, the fact that no attack has been found (apart from some weak instances of parameters which can be avoided) which significantly outperforms brute force. Moreover, several theoretical results seem to support a provable hardness guarantee. These results consist on the reduction of several versions of the Shortest Vector Problem for lattices to two of the problems which back lattice-based cryptography: the Learning With Errors Problem (where the reduction comes from the class of general lattices) and the Ring Learning With Errors Problem (where the reduction comes from the subclass of ideal lattices). Despite the fact that the hardness of the precise lattice problems which reduce to the mentioned cryptographic problems has not been established yet, a promising number of hits has been reached, at least in the category of general lattices (, ). Other feature which makes lattice-based primitives preferable to other approaches is the required size of the secret and public keys to ensure a given security level, far below multivariate-based and code-based contenders. The reader is referred to https://www.safecrypto.eu/pqclounge/ for a detailed description of the remaining proposals and the history of the contest along all the rounds.
Within lattice-based cryptography, the Learning With Errors Problem (LWE from now on), the Ring Learning With Errors Problem (RLWE from now on) and the Polynomial Learning With Errors Problem (PLWE from now on) hold a prominent position. The first was introduced in , the second in  and the third in . In general, PLWE is more suitable for implementations due to the very efficient arithmetic algorithms available for polynomial rings while the majority of security reduction proofs have been established for RLWE. Moreover, at the time of writing and apart from  and those against sheer LWE, there are no direct attacks against RLWE, while a number of theoretical attacks have been produced against PLWE under some general assumptions (see, for instance , ). Hence, it seems natural to ask for the relation and mutual dependence of RLWE and PLWE and this is the goal of the present article, which is an extension of  and answers a question raised therein by the first author.
In , the authors develop the notion of equivalence between RLWE and PLWE in their several versions; namely, both problems are said to be equivalent if there exists an algorithm which transforms admissible RLWE-samples into admissible PLWE-samples and vice versa with a complexity of polynomial order in the rank of the lattice (i.e. the degree of the underlying number field). The word admissible means that the algorithm must make the error distribution to incur at most in a distortion which, again, is polynomial in the rank of the lattice. Moreover, the authors justify why the right measure of this distortion is the condition number of the matrix defining the lattice transformation and study the equivalence for an ad hoc family of polynomials.
The usual (and natural) lattice transformation in  is nothing else but left multiplication by a Vandarmonde matrix attached to the Galois conjugates of a primitive element of the underlying number field and Vandermonde matrices tend to be very ill-conditioned apart from some ad hoc cases. In the cyclotomic scenario, which is the most dealt with in practical cryptographic primitives, the problem is now reasonably well understood (cf. , , ).
However, a seek for more flexibility, as justified in  and in , calls for a good understanding of both problems in more general number fields. To our knowledge, the first study of RLWE/PLWE equivalence for a family of non-cyclotomic number fields apart from  is . In that work, the first author establishes the RLWE/PLWE equivalence for the maximal totally real subextension of the cyclotomic field (with arbitrary prime) and justifies why the approach based on the evaluation map at an integral primitive element is deemed to fail due to an exponential lower bound for the condition number of the Vandermonde matrix with real symmetric nodes due to Gautschi (). The main contribution of  is the replacement of the Vandermonde matrix by a quasi-Vandermonde matrix attached to the family of Tchebycheff polynomials up to degree and the roots of the -th Tchebycheff polynomials. These matrices are known to be optimally conditioned and to present a good number of amenable properties due to the orthogonality of the Tchebycheff family.
In the present article we generalize the main result of . Namely, we will prove the following result:
Let and be different odd prime numbers and let
be different odd prime numbers and let. For , and , the RLWE and the PLWE problems are equivalent for the maximal totally real subextension of the -th cyclotomic field.
We have structured our presentation in four sections in the following manner:
Section 2 is a summary of algebraic generalities and notations whose aim is to make our article self-contained. Section 3 recalls the RLWE and PLWE problems and the formal definition of equivalence and provides a summary of previous results on the equivalence of the R/P-LWE Problems. Subsection 3.4 points out an advantage of using the family (the totally real subextension of the -th cyclotomic field) from a cryptoanalytical point of view: we prove that this family is immune against one of the attacks described in , whereas cyclotomic fields are not (or at least not in a provable manner).
Section 4 is the core of the paper and proves Theorem 1.1. The main ingredient is the analysis of how the condition number behaves under several elementary operations performed in a quasi-Vandermonde matrix attached to the Galois-conjugates of the natural primitive element of the extension.
We thank our colleague Raúl Durán for a careful reading and discussion of our work and for providing us with Example 3.7.
2. Algebraic setup
A lattice is a pair where is a finitely generated and torsion-free abelian group and is a group monomorphism for some . When equals the rank of we will say that has full rank. All our lattices will be full rank unless stated otherwise.
2.1. Number fields and ideal lattices
For any field extension , denotes the Galois group of the extension, i.e. the group of field automorphisms of which fix .
Let be an algebraic number field of degree and let be the minimal polynomial of . In particular, is a -vector space of dimension and the set is a -basis. The evaluation-at- map is a field -isomorphism .
The field is furnished with field -embeddings , with and a fixed algebraic closure of . Each of these morphisms is fully determined by its image at , namely , where are the roots of (namely, the Galois conjugates of ).
The extension (or just the field ) is said to be Galois if is the splitting field of . This is equivalent to saying that the embeddings are indeed automorphisms of , hence .
Setting as the number of real embeddings, i.e. those whose image is contained in , and as the number of complex non-real embeddings, one has .
The canonical embedding is defined as:
The field is said to be totally real in case . When is clear form the context we will simply write instead of .
Recall that an algebraic integer is an element of whose minimal polynomial belongs to . The set of algebraic integers in is a ring: the ring of integers of .
It is also well known (see for instance ) that is a free -module of rank , thus for each ideal its image is a lattice in the space
Notice that when is totally real we have .
A lattice is said to be an ideal lattice if there exists a number field and an ideal such that .
Of great relevance in cryptography is the obvious observation that every ideal lattice is endowed with an extra ring structure inherited from that in .
The field is said to be monogenic if for some . We will assume that all our fields are monogenic.
The canonical embedding is one of the two main characters in our story, whose interplay is the object of our study. The second character is presented next:
The coordinate embedding of is
When is clear from the context we will write instead of . It is worthwhile to mention that multiplication and addition are preserved component-wise by the canonical embedding while, in general, only addition is respected by the coordinate embedding.
2.2. The cyclotomic field and its maximal totally real subextension
For an integer denote by the group of multiplicative units in the ring . The set of primitive -th roots of unity (those of the form with ) is a multiplicative group of order , where stands for Euler’s totient function. The -th cyclotomic polynomial is
This polynomial is irreducible in and setting for any , the number field is the splitting field of , hence it is Galois of degree . In this paper we study the maximal totally real subextension of , denoted , whose degree is . As , the field is Galois and monogenic (see [20, Chapter 2]), namely:
with for each . We denote by the minimal polynomial of .
3. The R/P-LWE problems and the notion of equivalence
With the same notations as before, denote , where is the minimal polynomial of an integer element . As seen in the previous section, the ring has a lattice structure in , where is the degree of , via the coordinate embedding.
Definition 3.1 (The search RLWE/PLWE problem).
Let be a prime, with , let
be a discrete Gaussian distribution (cf.[12, Section 2.2]) with values in (resp. in ). The RLWE (resp. PLWE) problem for is stated as follows:
For a secret element (resp. ) chosen uniformly at random, if an adversary for whom is unknown is given access to arbitrarily many samples of the RLWE (resp. PLWE) distribution, where for each , is uniformly chosen at random and is sampled from , this adversary is asked to guess with non-negligible advantage.
From now on, by RLWE/PLWE problem we will refer to the search RLWE/PLWE problem. It is a very natural question to wonder what is the relation between the RLWE and the PLWE problems, what we discuss next.
3.1. The condition number
In , the authors define the notion of equivalence between RLWE and PLWE. In  this equivalence is proved for cyclotomic fields under the hypothesis of fixing (or upper bounding) the number of prime divisors of the conductor, and in  we have proved the equivalence for the maximal totally real subextension of the cyclotomic field , for arbitrary prime.
For a monogenic Galois number field of degree , the problems RLWE and PLWE are said to be equivalent if each one of them reduces to the other one in polynomial time and with a polynomial noise increase. This means that there exists an algorithm which transfers RLWE-samples into PLWE-samples (and vice versa) with complexity with independent of and this algorithm amplifies the noise by a factor which is also polynomial in .
As before, let denote the minimal polynomial of and the Galois conjugates of . The evaluation-at- map transforms the lattice in the lattice :
namely, is given by a Vandermonde matrix left-multiplying the vector of coordinates.
For a square matrix , the Frobenius norm of is
where stands for the trace map and is the conjugated-transpose of . The condition number of is defined as
The condition number satisfies the following properties:
For any it holds:
The condition number is invariant by scalar multiplication, namely, for each it is and .
The condition number satisfies .
The Frobenius norm and hence the condition number are submultiplicative, namely:
The condition number captures the idea of noise increase caused by the transformation between the lattices and . Indeed, as proved in , for the cyclotomic field , where the transfomation is expressed in terms of the Vandermonde matrix , the condition number is polynomial in if the number of primes dividing is fixed. However, this is not the case for , what led us to replace the map by another lattice isomorphism which we proved to be polynomially conditioned in . We will recall this second approach in Section 4.
3.2. In praise of the family
Despite the fact that both R/PLWE problems are strongly believed to be computationally intractable, several ad hoc weak instances have been found and dealt with in a number of recent papers (, , , ). As  points out, these vulnerable instantiations have not been proposed for practical applications, as they do not satisfy the hypotheses of the worst-case hardness theorems which back the R/PLWE cryptosystem proposed in . However, quoting  again, these ad hoc constructions serve to raise the following questions:
How close are these insecure instantiations to those which enjoy worst-case hardness?
Can we identify from these instantiations any feature which make some number fields more secure than others for R/P-LWE?
How can we evaluate other instantiations that may not be backed by worst-case hardness theorems?
We close this section pointing out a reason to be interested, from a cryptographic point of view, in the family , with and odd: we will show that is not vulnerable to one of the attacks described in , an attack for which cyclotomic polynomials are not immune, in principle.
The attack has several steps: it starts with a distinguisher attack on PLWE which is transferred to a distinguisher attack against RLWE if RLWE and PLWE are equivalent for the underlying number field. Then, the decissional RLWE attack is turned into a search attack if two additional hypotheses are satisfied, but we will not enter into it here.
Soon after , in  the authors gave a direct attack on RLWE without passing by PLWE, by using the statistical test. The attack works for several general cyclotomic fields of non-power-of-two degree, but it does not seem to be any way to apply this attack to our family . These attacks also justify the study of other number fields, other than cyclotomics, to instantiate R/PLWE.
The hypotheses for the attack described in  to be effective are as follows:
Let be a number field of degree where and let be an odd prime. Suppose that the pair satisfies the following conditions:
is Galoisian of degree .
The ideal is totally split in .
The transformation between the canonical embedding of and the power basis representation of
is given by a scaled orthogonal matrix.
If is the minimal polynomial of , then:
or for of small order modulo ,
or for of small residue modulo .
The prime is large enough, namely, .
Then, there is a polynomial-time attack to the search RLWE problem for .
We will not describe the attack here, but we mention that the first two conditions provide the RLWE search-to-decision reduction. The third and fourth conditions are sufficient to grant the RLWE-to-PLWE equivalence, namely, that both problems reduce to each other in polynomial time and with a polynomial error rate distortion (see [16, Section 4]). However, to grant this equivalence, as discussed in , it is enough that, when passing from the coordinate to the canonical embedding, the noise increase is polynomial in the degree of the underlying number field, and this noise increase is well accounted for by the condition number of the corresponding matrix.
Moreover, as we justified in [3, Remark 2.8], to grant the RLWE-to-PLWE equivalence it is not necessary to impose that the transformation between both embeddings is the natural one given by the Vandermonde matrix, and for the setting dealt with there, we replaced it by another one, given by a quasi-Vandermonde matrix attached to a subfamily of Tchebycheff polynomials of the first kind.
Finally, the last two conditions are the key to construct the attack on PLWE. Cyclotomic fields are protected against Condition [5.1]: it is well-known that if is not a prime power then , and if with prime then . Therefore, unless for some .
Moreover, cyclotomic fields are also protected against Condition for of order , namely for . Indeed (see for instance [4, Lemma 7]) if , if , with prime and and otherwise.
It is not clear what can be said, in general, about roots of of order higher than (but still small), although some partial results have been obtained by the authors in a still ongoing work.
What about Condition for the cyclotomic setting? Let be a root of modulo . Assume that the error distribution is Gaussian, namely, with chosen in a certain way to grant the ideal-lattice-SVP-to-RLWE reduction and a certain security level (a value of is proposed in ). Denote by the event that a sample
is taken from the uniform distribution inand by the event that the sample is taken from the PLWE distribution. Denote by the event that mod belongs to the interval for some guess . In this case (see [7, p. 10]) we have:
, then, assuming that samples can be taken from the uniform distribution and from the PLWE distribution with the same probability, it follows that the probability that for some guesswe have is 3/4. This probability grants an overwhelming probability of success of the attack.
The authors justify that a condition for this to happen is that
but even if equation (3.1) does not hold, for several choices of the parameters the attack may work with probability beyond :
Examples 3.6 ().
For , and , and the authors conclude that their attack works with probability about for any irreducible polynomial (not necessarily cyclotomic) of degree with as a root modulo .
For large enough, there is not much hope for equation (3.1) to hold for , and even less for . For smaller values of , however, the inequality may work for not too large values of . The following examples have been found with the aid of Maple:
As the first author proved in , denoting by the number of different primes dividing , for every , if , the condition number of the Vandermonde matrix is polynomial in . Hence, the problems RLWE and PLWE are equivalent for the class of cyclotomic fields if is upper bounded by a fixed value. In particular, both problems are equivalent and hence RLWE is also immune to the attack for for these fields.
Now, if we replace the cyclotomic polynomial by the polynomial , at least in the case , with and odd, we can grant not only that are never roots modulo any odd prime , but also that is never a root modulo , making the family immune against Condition , against Condition for order , namely for , and against Condition for .
Since , the polynomial is even (see [1, Proposition 2.5]), and hence it is enough to check our claims for .
For , with and odd, we have
Using [1, Theorem 2.6], we have that and, if ,
where , being the -th Tchebycheff polynomial of the first kind. Since , and for all , we obtain that for all and , so if , if and . To see that and we can use the same argument, taking into account that for all (see [1, Corollary 2.4]). We can also give the following alternative proof: for each , consider the rational expression
Since , we see that is a polynomial with integer coefficients. Moreover, since , then vanishes at and hence . Since the degree of is precisely , then up to a non-zero rational scalar. Moreover, is is easy to see that this scalar factor is the leading coefficient of , which is . Hence , which is equal to 2 if and equal to 1 if . ∎
Hence, if for both RLWE and PLWE are equivalent, then also the RLWE problem will be immune against this attack based on the roots for any odd prime , while is only provably immune against the attack based on . The goal of the rest of our article is to prove the equivalence between both problems in the sense of Definition 3.2 for , and , with and arbitrary odd primes and .
4. The polynomial equivalence in the maximal totally real cyclotomic subextension
Here we establish the equivalence of the RLWE and PLWE problems for the family in the generalised framework described in  for , and . The starting point of our approach there and also here is the family of Tchebycheff polynomials of the first kind:
The family of Tchebycheff polynomials of the first kind is defined by any of the following equivalent properties:
and for .
Set, for , . An easy induction argument shows that for each . By an iterated application of the identity for the cosine of the sum of two angles, it is easy to show the following property:
which yields the following identity:
for any .
For such that , set and denote
4.1. Main result
Assume that , with so that . In this case, is the minimal polynomial of , whose Galois conjugates are all the nodes with . Hence the matrix already provides the polynomially conditioned lattice monomorphism from to . Since the image of is a finite order sublattice of , multiplying by this index and composing with provides a polynomially conditioned monomorphism from to . This will be discussed in Theorem 4.6, which applies to the three cases under study, namely , and .
Assume that , with an odd prime number, so and . Since we are looking for a polynomially conditioned lattice isomorphism between and , we need to exclude from the rows corresponding to the values such that , i.e. the nodes of the form
and we also need to extract columns so that the remaining matrix is invertible. This is equivalent to multiplying by a suitable matrix obtaining
where is the zero matrix, is a square matrix of dimension , is an matrix and
is a square invertible matrix of sizewith entries in . If is polynomially conditioned, as we will prove, so will be .
We begin with a permutation of the rows of so that those rows corresponding to the nodes are in the first positions. For simplicity, we still denote this matrix by , which clearly has the same condition number as before.
The strategy, as in , will be to perform certain transformations on the columns of such that the upper-right submatrix of becomes the zero matrix and to control the condition number of the matrix which contains all the elementary column operations. Write , where is the -th column of . Observe that for all , so the first entries of the column are zero. We perform the following transformations: for each with , we replace the column by the sum
This transformation is equivalent to multiplying on the right by the matrix
is the identity matrix of dimension, is a matrix whose columns are zero except for the -th ones, with , all of which have one entry equal to 1 and the rest of them equal to 0, and is matrix whose -diagonals are zero except for and (where by -diagonal of a square matrix we mean the diagonal whose terms are the entries of the form ), both of which are constant and equal to 1.
By relation (4.1), after this transformation the term corresponding to the node in the new column is the value at of , so it is zero on . Regarding the condition number of , we have that
Since that matrix has only non-zero terms, all of them equal to 1, and , we have
The inverse of is given by
The matrix has -diagonal equal to zero except if , for , in which case the diagonal is constant and equal to . Therefore, the entries of are all bounded in absolute value by 2, and
which shows the bound for the condition number of . ∎
Assume that , with odd prime numbers and , so and . In this case, we need to exclude from the rows corresponding to the values such that , i.e. the nodes of the form
with odd such that and and we also need to extract columns so that the remaining matrix is invertible.
As in the previous case, we begin with a permutation of the rows of so that those rows corresponding to the nodes and are in the first positions, and we still denote this matrix by .
We will use the following fact:
Notations as before, we have that for all , and
for all such that .
The first identity is clear. For the second one, we use Lagrange trigonometric identity:
Notice that the identity remains true for any which is not an integer multiple of . Hence, taking and (which is not a multiple of since ), we have:
since and are odd. Therefore,
Write , where is the -th column of . We perform the following transformations: for each with , we replace the column by the sum
and by the sum
This transformation is equivalent to multiplying on the right by the matrix
where is the identity matrix, is a matrix and is an upper triangular matrix whose main diagonal is the identity.
By relation (4.1), after this transformation the term corresponding to the node in the new column is the value at of
in case , or
in case , so by Lemma 4.3 it is zero on and .
We have the following result for the blocks and of the matrix :
The matrix has entries in , and the matrix is a Toeplitz matrix whose -diagonal is equal to if for , is equal to if with and is equal to 0 otherwise.
The condition on the entries of is clear for the first column, whose non-zero entries are in fact , since the columns that appear in the sum (4.3) are all different. For the other columns of , observe that for all we have
Moreover, for all we have that
If then and either
If then .
To show the statement for , note that for each an index in the sum (4.4) can only be of the form if (otherwise those terms are less than ), can only be of the form if (otherwise those terms are less than ) and can only be of the form if (otherwise those terms are less that ). In this case, for all we have