Abstract
Recently, Blanco-Chacón proved the equivalence between the Ring Learning With Errors and Polynomial Learning With Errors problems for some families of cyclotomic number fields by giving some upper bounds for the condition number Cond(Vn) of the Vandermonde matrix Vn associated to the nth cyclotomic polynomial. We prove some results on the singular values of Vn and, in particular, we determine Cond(Vn) for n = 2kpℓ, where k, ℓ ≥ 0 are integers and p is an odd prime number.
1 Introduction
Ring Learning With Errors (RLWE) was introduced by Lyubashevsky, Peikert, and Regev [1] in order to speed up cryptographic constructions based on the Learning With Errors problem [2]. Before RLWE, Stehlé, Steinfeld, Tanaka, and Xagawa [3] introduced what is now known as Polynomial Ring Learning With Errors (PLWE). The equivalence between RLWE and PLWE is studied and proved for certain families of polynomials [4, 5]. Let K = ℚ(α) be a number field of degree m and let 𝒪K be its ring of integers. The definition of short elements in K plays an essential role in RLWE and PLWE. This geometric notion derives from an appropriate choice of a norm on K by embedding the number field in a vector space. On the one hand, RLWE makes use of the canonical embedding σ, which maps each x ∈ 𝒪K to (σ1(x), . . . , σm(x)), where σ1, . . . , σm are the injective homomorphisms from K to ℂ. On the other hand, PLWE uses the coefficient embedding, which maps each x ∈ 𝒪K to the vector (x0, . . . , xm−1) ∈ ℤm of its coefficients with respect to the power basis 1, α, . . . , αm−1. As a linear map, the canonical embedding σ admits a matrix representation V ∈ ℂm×m; so that, for each x ∈ 𝒪K, we have σ(x) = V · (x0, . . . , xm−1)|. For the equivalence between RLWE and PLWE, it is important to determine when, whether ‖x‖ is small, then so is ‖σ(x)‖, and vice versa. This notion is quantified by V having a small condition number
When K is the nth cyclotomic number field, V = Vn is the Vandermonde matrix associated with the nth cyclotomic polynomial, that is,
where ζ1, . . . , ζm are the primitive nth roots of unity, and m = φ(n) is the Euler’s totient function of n.
Recently, Blanco-Chacón [4] gave some upper bounds for the condition number of Vn, proving the equivalence between the RLWE and PLWE problems for some infinite families of cyclotomic number fields.
Our first result is the following.
Theorem 1.1
For every positive integer n, we have
where rad(n) denotes the product of all prime factors of n.
Our second result is a formula for the condition number of Vn when n is a prime power or a power of 2 times an odd prime power.
Theorem 1.2
If n = pk, where k is a positive integer and p is a prime number, or if n = 2kpℓ, where k, ℓ are positive integers and p is an odd prime number, then
In particular, Theorem 1.2 improves the upper bound Cond(Vn) ≤ 4(p −1)φ(n) given by Blanco-Chacón in the case in which n = pk is a prime power [4, Theorem 4.1].
Our proofs of Theorems 1.1 and 1.2 are based on the study of the Gram matrix
Theorem 1.3
For every positive integer n, the matrix
From a number-theoretic point of view, it might be of some interest trying to describe the entries of
2 Proofs
For every positive integer n, the Ramanujan’s sums modulo n are defined by
for all integers t. It is easy to check that cn(·) is an even periodic function with period n. Moreover, the following formula holds [6, Theorem 272]
where μ is the Möbius function and (n, t) denotes the greatest common divisor of n and t.
Let
In particular, Gn is a symmetric Toeplitz matrix with integer entries.
Let λ1, . . . , λs be the distinct eigenvalues of Gn, which are real and positive, since Gn is the Gram matrix of an invertible matrix, and let μ1, . . . , μs be their respective multiplicities. We have
Therefore, the study of Cond(Vn) is equivalent to the study of the eigenvalues of Gn.
The next lemma relates the characteristic polynomials of Gn and Grad(n).
Lemma 2.1
For every positive integer n, we have
where n′ := rad(n), m′ := φ(n′), and h := n/n′.
Proof
We know from(2) that Gn = (cn(i−j))0≤i,j<m, where we shifted the indices i, j to the interval [0, m) since this does not change the differences i − j and simplifies the next arguments. Write the integers i, j ∈ [0, m) in the form i = hi′ + i′′ and j = hj′ + j′′, where i′ , j′ ∈ [0, m′) and i′′ , j′′ ∈ [0, h) are integers. By (1) we have that cn(i − j) ≠ 0 if and only if h divides i − j (otherwise, n/(n, i − j) is not squarefree), which in turn happens if and only if i′′ = j′′. In such a case, we have (n, i − j) = h(n′ , i′ − j′) and, again by (1), it follows that
Therefore, we have found that Gn consists of m′ × m′ diagonal blocks of sizes h × h. Precisely,
where ⊗ denotes the Kronecker product. Consequently, the characteristic polynomial of Gn is
as claimed. □
Now we are ready to prove the first result.
2.1 Proof of Theorem 1.1
Let n′ := rad(n), m′ := φ(n′), and h := n/n′. Furthermore, let
as claimed. □
We need a couple of preliminary lemmas to the proof of Theorem 1.2.
Lemma 2.2
For every odd positive integer n, the matrices G2n and Gn have the same eigenvalues (with the same multiplicities).
Proof
It is known [6, Theorem 67] that Ramanujan’s sums are multiplicative functions respect to their moduli, that is, cab(t) = ca(t) cb(t) for all coprime positive integers a, b. Moreover, it is easy to check that c2(t) = (−1)t. Thus, (2) gives
where J is the m × m matrix alternating +1 and −1 on its diagonal and having zeros in all the other entries. Therefore, Gn and G2n are similar and consequently they have the same eigenvalues. □
Lemma 2.3
Given two complex numbers a and b, the determinant of the k × k matrix
is equal to (a − b)k−1(a + (k − 1)b).
Proof
Subtracting the last row from all the other rows, and then adding to the last column all the other columns, the matrix becomes
Laplace expansion along the last column gives the desired result. □
2.2 Proof of Theorem 1.2
First, let us consider n = pk, where k is a positive integer and p is a prime number. It follows from (1) that cp(t) = p − 1 if p divides t, while cp(t) = −1 otherwise. Hence, using Lemma 2.3, we have
so that the eigenvalues of Gp are p and 1, with respective multiplicities p − 2 and 1.
As a consequence, (3) gives
and, thanks to Theorem 1.1, we obtain
as claimed.
Now assume that n = 2kpℓ, where k, ℓ are positive integers and p is an odd prime number. From Lemma 2.2 and (3) it follows at once that Cond(V2p) = Cond(Vp). Hence, Theorem 1.1 and (4) yield
as claimed. □
The next lemma is the well known orthogonality relation between the roots of unity.
Lemma 2.4
We have
for k, h = 1, . . . , m.
2.3 Proof of Theorem 1.3
Let
for all integers i, ℓ with 1 ≤ i ≤ m and ℓ ≥ 0. On the one hand, since
Recalling that
which is an integer. □
Acknowledgement
A. J. Di Scala and C. Sanna are members of GNSAGA of INdAM and of CrypTO, the group of Cryptography and Number Theory of Politecnico di Torino. A. J. Di Scala is a member of DISMA Dipartimento di Eccellenza MIUR 2018-2022. E. Signorini is a cryptographer at Telsy S.p.A.
References
[1] V. Lyubashevsky, C. Peikert, and O. Regev, On ideal lattices and learning with errors over rings, Advances in cryptology—EUROCRYPT 2010, Lecture Notes in Comput. Sci., vol. 6110, Springer, Berlin, 2010, pp. 1–23.Search in Google Scholar
[2] O. Regev, On lattices, learning with errors, random linear codes, and cryptography, J. ACM 56 (2009), no. 6, Art. 34, 40.10.1145/1060590.1060603Search in Google Scholar
[3] D. Stehlé, R. Steinfeld, K. Tanaka, and K. Xagawa, Efficient public key encryption based on ideal lattices (extended abstract), Advances in cryptology—ASIACRYPT 2009, Lecture Notes in Comput. Sci., vol. 5912, Springer, Berlin, 2009, pp. 617–635.Search in Google Scholar
[4] I. Blanco-Chacón, On the RLWE/PLWE equivalence for cyclotomic number fields, Appl. Algebra Engrg. Comm. Comput. (accepted).10.1007/s00200-020-00433-zSearch in Google Scholar
[5] M. Rosca, D. Stehlé, and A. Wallet, On the ring-LWE and polynomial-LWE problems, Advances in cryptology—EUROCRYPT 2018. Part I, Lecture Notes in Comput. Sci., vol. 10820, Springer, Cham, 2018, pp. 146–173.Search in Google Scholar
[6] G. H. Hardy and E. M. Wright, An introduction to the theory of numbers, sixth ed., Oxford University Press, Oxford, 2008, Revised by D. R. Heath-Brown and J. H. Silverman, With a foreword by Andrew Wiles.Search in Google Scholar
© 2020 A. J. Di Scala et al., published by De Gruyter
This work is licensed under the Creative Commons Attribution 4.0 International License.
