You are looking at a specific version 20190208:130828 of this paper. See the latest version.

Paper 2017/612

Large Modulus Ring-LWE $\geq$ Module-LWE

Martin R. Albrecht and Amit Deo

Abstract

We present a reduction from the module learning with errors problem (MLWE) in dimension \(d\) and with modulus \(q\) to the ring learning with errors problem (RLWE) with modulus \(q^{d}\). Our reduction increases the LWE error rate \(\alpha\) by a quadratic factor in the ring dimension \(n\) and a square root in the module rank \(d\) for power-of-two cyclotomics. Since, on the other hand, MLWE is at least as hard as RLWE, we conclude that the two problems are polynomial-time equivalent. As a corollary, we obtain that the RLWE instance described above is equivalent to solving lattice problems on \emph{module} lattices. We also present a self reduction for RLWE in power-of-two cyclotomic rings that halves the dimension and squares the modulus while increasing the error rate by a similar factor as our MLWE to RLWE reduction. Our results suggest that when discussing hardness to drop the RLWE/MLWE distinction in favour of distinguishing problems by the module rank required to solve them.

Note: Wrong approximation factor in the introduction corrected. We thank Adeline Roux-Langlois for pointing it out to us.

Metadata
Available format(s)
PDF
Category
Public-key cryptography
Publication info
A minor revision of an IACR publication in ASIACRYPT 2017
Keywords
security reductionlearning with errorslattice-based cryptography
Contact author(s)
amit deo 2015 @ rhul ac uk
History
2020-01-11: last of 6 revisions
2017-06-26: received
See all versions
Short URL
https://ia.cr/2017/612
License
Creative Commons Attribution
CC BY
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.