The condition number associated with ideal lattices from odd prime degree cyclic number fields

1 Introduction

The Ring Learning with Errors (RLWE) problem and the Polynomial Learning with Errors (PLWE) problem are the basis for some of the most promising post-quantum cryptographic protocols [1,2]. These problems are part of lattice-based cryptography since they arise from Learning with Errors (LWE) problem, which is at least as difficult to solve as the approximate shortest independent vector problem ( α -SIVP). In turn, these problems are known to be NP-hard for certain α [3]. Although the decision version of RLWE has known security reduction for α -SVP, the advantage of PLWE is that it is more efficient and suitable for implementation. Essentially, RLWE is defined over the ring of integers of an algebraic number field K = Q ( a ) through canonical embedding, whereas PLWE is defined over a quotient of a polynomial ring F q [ x ] ⁄ ( f ( x ) ) through coefficient embedding.

In some cases, the problems RLWE and PLWE are equivalent, which occurs when there is an algorithm that transforms a solution of one of them into a solution of the other, and vice versa, in polynomial time. The theoretical problem of the relation (in particular, the equivalence) between RLWE and PLWE was first described in [4]. Especially since then, it has been shown that RLWE and PLWE are equivalent or non-equivalent in several situations (e.g., [5–9]).

To determine the equivalence (or not) between RLWE and PLWE, an important quantity is the condition number associated with a generator matrix of the ideal lattice used in the RLWE construction. If K is an algebraic number field of degree n and O K denotes its ring of integers, the canonical embedding of K consists of the map σ K : K ⟶ C n given by σ K ( x ) = ( σ 1 ( x ) , … , σ n ( x ) ) , for all x ∈ O K , where σ 1 , … , σ n are the monomorphisms from K to C . In this way, σ K ( O K ) can be seen as a lattice in an n -dimensional Euclidean space H isomorphic to R n , where the lattice is understood to be a full-rank discrete additive subgroup of H (or R n ). The lattice Λ = σ K ( O K ) is said to be an ideal lattice and is associated with an n × n matrix M such that v ∈ Λ if and only if v T = M ⋅ u T for some u ∈ Z n . The matrix M is called a generator matrix of Λ . The condition number of M (or, of K ) is defined as the quantity Cond ( M ) = ‖ M ‖ ‖ M − 1 ‖ , where ‖ A ‖ ≔ Tr ( A * A ) denotes the Frobenius norm of a matrix A (where A * denotes the conjugate transpose of the complex matrix A and Tr denotes the trace of a matrix). The condition number is important in RLWE/PLWE equivalence because it measures the distortion caused in the transformation from one to the other when the algebraic structures involved are paired [8]. In these situations, the RLWE/PLWE equivalence is established if the condition number is O ( n r ) for some constant r > 0 depending only on the field K .

Let K be a cyclic number field of odd prime degree p . Since K ⁄ Q is an Abelian field extension, there is a cyclotomic field Q ( ζ m ) containing K according to the Kronecker–Weber theorem. The minimal m with this property is called the conductor of K . It is known that p is either unramified or ramified in O K . If p is unramified in O K , then the conductor of K is given by m = ∏ i = 1 r p i , where r ≥ 1 and p 1 , … , p r are prime positive integer numbers such that p i ≡ 1 ( mod p ) for i = 1 , … , r (unramified case). In turn, if p is ramified in O K , then the conductor of K is given by m = p 2 u , where u = 1 or u = ∏ i = 1 r p i with r ≥ 1 and p 1 , … , p r are prime positive integer numbers such that p i ≡ 1 ( mod p ) (ramified case). In this context, algebraic lattices coming from Z -modules of O K through canonical embedding and their associated trace forms have recently been studied for different applications (e.g., [10–13]).

Our objective in this work is to compute the condition number of a generator matrix of the lattice σ K ( O K ) , where K is an odd prime degree cyclic number field. The unramified case is described in Section 2 – the condition number is given in Theorem 2.1. In turn, the condition number of K in the ramified case is available in Theorem 3.1, which is covered in Section 3. Finally, we conclude this work in Section 4 with suggestions for further research related to RLWE/PLWE equivalence for K .

2 The unramified case

Let K be a cyclic number field of prime degree p > 2 . Suppose that p is unramified in the ring of integers O K . This means that the conductor of K is given by m = p 1 … p r , where r ≥ 1 and p 1 , … , p r are prime positive integer numbers satisfying p i ≡ 1 ( mod p ) , for each i = 1 , … , r . Then, K ⊆ Q ( ζ m ) , where ζ m is an m th primitive root of unity. In this case, the Hilbert–Speiser theorem [14, Theorem 1.7] states that K has a normal integral basis: in fact, if t ≔ Tr Q ( ζ m ) ⁄ K ( ζ m ) and θ denotes a generator of the Galois group Gal ( K ⁄ Q ) , then { t , θ ( t ) , … , θ p − 1 ( t ) } is a Z -basis of O K .

Since K ⁄ Q is a Galois field extension of the odd degree, K is a totally real number field. Therefore, the monomorphisms from K to C are exactly the i -powers of θ for i = 0 , … , p − 1 and have their images contained in R . So, the canonical embedding associated with K can be defined as σ K ( x ) = ( x , θ ( x ) , … , θ p − 1 ( x ) ) ∈ R n , for all x ∈ K . Thus, a generator matrix of the lattice Λ = σ K ( O K ) is given by

Also, in [11, Theorem 2.2], it is shown that

and for i , j ∈ { 0 , 1 , … , p − 1 } with i ≠ j ,

Furthermore, in the following, we use the fact shown in [15, Lemma 2.3] that, for any a , b ∈ C ,

Finally, we are able to show the main theorem of this section:

3 The ramified case

Let K be a cyclic number field of prime degree p > 2 . In this section, we suppose that p is ramified in the ring of integers O K . In this case, the conductor of K is given by m = p 2 u , where u = 1 or u = p 1 … p r for some prime positive integer numbers p 1 , … , p r such that p i ≡ 1 ( mod p ) , i = 1 , … , r . In this case, the Leopoldt theorem [16, Theorem 2] implies that K has an integral basis given by B = { 1 , θ ( t ) , … , θ p − 1 ( t ) } , where θ is a generator of the cyclic Galois group Gal ( K ⁄ Q ) and t ≔ Tr Q ( ζ m ) ⁄ K ( ζ m ) (note that B is not a normal integral basis of K , which in fact is regarded by the Hilbert–Speiser theorem).

As commented in the previous section, the canonical embedding associated with K can be seen as σ K : K ⟶ R p defined by σ K ( x ) = ( x , θ ( x ) , … , θ p − 1 ( x ) ) , for all x ∈ K . Then, a generator matrix of the ideal lattice Λ = σ K ( O K ) is given by

Since m is not a squarefree integer, it is well known that

Additionally, in [13], it is shown that

and for i , j ∈ { 0 , … , p − 1 } , i ≠ j ,

With this setting, in the following theorem, we show the condition number of a generator matrix of σ K ( O K ) :

4 Conclusion and future research

Considering that K is an odd prime degree cyclic number field and σ K is the canonical embedding associated with it, in this work, we have shown formulas for the condition number of a generator matrix of the lattice σ K ( O K ) depending only on the degree and the conductor of K . If p not divides m , this condition number is presented in Theorem 2.1. In turn, if p divides m , the condition number is computed in Theorem 3.1.

As noted in the introduction of this work, the condition number of a generator matrix of an ideal lattice can be used in a cryptographic context related to the equivalence between the RLWE and PLWE problems. Although the quantities shown in this work indicate that RLWE and PLWE are equivalent for odd prime degree cyclic number fields, once the condition numbers computed here are of polynomial order, the non-monogenicity of these number fields (as shown in [17]) prevents the expected conclusion a priori. Thus, future research could investigate whether the RLWE and PLWE problems are equivalent in the context of odd prime degree cyclic number fields, which could lead to new studies related to RLWE/PLWE equivalence for non-monogenic number fields.