Ring Learning With Errors: A crossroads between postquantum cryptography, machine learning and number theory

TL;DR

This survey explores the ring learning with errors problem, highlighting its significance in post-quantum cryptography, machine learning, and number theory, and discusses its connections with classical algebraic problems.

Contribution

It provides a comprehensive overview of the current state of cryptographic functionalities based on the ring learning with errors problem and their relation to algebraic number theory.

Findings

RLWE-based cryptography is a promising post-quantum candidate

Connections between RLWE and classical algebraic problems are significant

The survey summarizes recent advances and open problems in the field

Abstract

The present survey reports on the state of the art of the different cryptographic functionalities built upon the ring learning with errors problem and its interplay with several classical problems in algebraic number theory. The survey is based to a certain extent on an invited course given by the author at the Basque Center for Applied Mathematics in September 2018.

Tables

Table 1. Table 1. NIST proposals. Second Round.

Category	Number of proposals
Code-based (Hamming)	5
Code-based (rank metric)	2
Lattice-based (LWE)	1
Lattice-based (RLWE)	6
Lattice-based (PLWE)	1
Lattice-based (Other)	4
Multivariate-based	4
Hash-based	1
Supersingular isogeny-based	1
Other	1

Equations

$$D_{\lambda }(k,E_{\lambda }(k,m))=m.$$

$$pr\left[V_{\lambda }(k_p,m,S_{\lambda }(k_s,m))=1\right]=1,$$

$$E(k,m_1){\ast }_{\mathcal{C}}E(k,m_2)=E(k,m_1{\ast }_{\mathcal{M}}{m}_2).$$

$$\begin{array}[]{ccc}\rho_{1}:\mathbb{Z}[i]&\to&\mathbb{Z}^{2}\\ a+bi&\mapsto&(a,b)\end{array}$$

$$\begin{array}[]{ccc}\rho_{2}:\mathbb{Z}[i]&\to&\mathbb{Z}^{2}\\ a+bi&\mapsto&(a+b,a-b).\end{array}$$

$$\mathcal{F}(\mathcal{B})=\left\{\sum _{i=1}^n{\lambda }_i{v}_i:\text{mbox}with0\le \lambda <1\right\}.$$

$$||y-x_y||=\underset{x\in \Lambda }{\min }||x-y||.$$

$$\begin{array}[]{ccc}\mathbb{F}_{q}&\hookrightarrow&\mathbb{T}\\ a+q\mathbb{Z}&\mapsto&\frac{a}{q}+\mathbb{Z}.\end{array}$$

$$S_{\sigma ,c}={\rho }_{\sigma ,c}(\mathbb{Z})=\sum _{k=-\infty }^{\infty }{\rho }_{\sigma ,c}(k),$$

$$Pr\left[\chi =k\right]=\sum _{n\equiv k(\mathrm{mod}q)}pr\left[D_{\sigma ,0}=n\right].$$

$$z\mapsto \left[u,v\right]=\left[\sum _{i\in S}{a}_i,z\lfloor \frac{q}{2}\rfloor +\sum _{i\in S}{b}_i\right].$$

$$\sigma (x)=({\sigma }_1(x),...,{\sigma }_n(x)).$$

$${\Phi }_n(x)=\prod _{k\in {\mathbb{Z}}_n^{\ast }}(x-{\theta }_k).$$

$$N(\alpha )={\sigma }_1(\alpha )\cdots {\sigma }_n(\alpha ),$$

$$Tr(\alpha )={\sigma }_1(\alpha )+...+{\sigma }_n(\alpha ).$$

$$\left(\begin{array}[]{ccc}\sigma_{1}(\theta_{1})&...&\sigma_{n}(\theta_{1})\\ \vdots&\ddots&\vdots\\ \sigma_{1}(\theta_{n})&...&\sigma_{n}(\theta_{n})\\ \end{array}\right),$$

$${\Delta }_{K_n}=(-1{)}^{\varphi (n)/2}\frac{n^{\varphi (n)}}{{\prod }_{p\mid n}{p}^{\frac{\varphi (n)}{p-1}}}.$$

$$I={\mathfrak{p}}_1^{e_1}...{\mathfrak{p}}_r^{e{g}_r}.$$

$$n=e_1{f}_1+...+e_r{f}_r.$$

$$\begin{array}[]{ccc}\sigma:\mathcal{O}&\to&\mathbb{R}^{n}\\ \displaystyle\sum_{i=0}^{n-1}a_{i}\overline{x}^{i}&\mapsto&(a_{0},...,a_{n-1}).\end{array}$$

$${\mathcal{O}}_K^{\vee }=\{\alpha \in K:Tr(\alpha )\in \mathbb{Z}\}.$$

$$\begin{array}[]{ccc}V_{f}:\mathbb{Z}[x]/(f(x))&\to&\sigma_{1}(\mathcal{O}_{K})\times\cdots\times\sigma_{n}(\mathcal{O}_{K})\\ \displaystyle\sum_{i=0}^{n-1}a_{i}\overline{x}^{i}&\mapsto&\left(\begin{array}[]{cccc}1&\theta_{1}&\cdots&\theta_{1}^{n-1}\\ 1&\theta_{2}&\cdots&\theta_{2}^{n-1}\\ \vdots&\vdots&\ddots\vdots\\ 1&\theta_{n}&\cdots&\theta_{n}^{n-1}\end{array}\right)\left(\begin{array}[]{c}a_{0}\\ a_{1}\\ \vdots\\ a_{n-1}\end{array}\right),\end{array}$$

$$||A||:=\sqrt{Tr(A{A}^{\ast })}=\sqrt{\sum _{i,j=1}^n|a_{ij}{|}^2}.$$

$$\sum _{k=0}^{m-1}{\zeta }_i^k{\overline{{\zeta }_j}}^k=\frac{1-{\zeta }_i^m{\overline{{\zeta }_j}}^m}{1-{\zeta }_i\overline{{\zeta }_j}}.$$

$$V_{{\Phi }_n}{V}_{{\Phi }_n}^{\ast }=mId,$$

$$Cond(V_{{\Phi }_n})\le 2rad(n)n^{2^k+k+2}A(n).$$

$${\Phi }_n(x)={\Phi }_{rad(n)}(x^{\frac{n}{rad(n)}}),$$

$$|w_{ij}|\le 2rad(n)n^{2^k+k}A(n).$$

$$A(n)\le n^{2^{k-1}}.$$

$$Cond(V_{{\Phi }_n})=\mathcal{O}(n^{2^k+k+3+r}).$$

Full text

Partially supported by Science Foundation Ireland 13/IA/1914 and MTM2016-79400-P.

1. Introduction

According to MIRACL Labs, it is estimated that a quantum computer capable of breaking most of modern cryptography will be built in the next 10-15 years (20-25 years according to estimates made public in the last NIST call for the standardisation of postquantum primitives). All of cryptography is built on supposedly hard111In a sense which will be made clear in Section 2. mathematical problems, most of which, like integer factorisation or the discrete logarithm problem, become relatively easy in the context of a working quantum computer. In response to this threat there is a need to migrate from these vulnerable constructs to constructs known to remain strong even in a post-quantum world.

An example of such a hard problem is the shortest vector problem in general lattices, which is known to be NP-hard (at least for a very small approximation factor). While there already exist post-quantum solutions for much of standard cryptography, like public key encryption and digital signature, it is currently unclear how some of the more elaborate protocols, like those seeking for integrity or non-repudiation can be successfully migrated. In particular in the last 10+ years bilinear pairings on elliptic curves have opened up many new possibilities, which might likely be rendered insecure in a postquantum world. Already commercial products based on bilinear pairings have found applications in the ‘real world’, and so much work must be done to ensure that we will be able to retain this functionality into the future.

At the same time there is much fundamental work to be done on the postquantum primitives themselves. A major decision is to choose between one or various of the following technologies, for each security/integrity demand:

• a)

Code based cryptography ([31]) is built on the infeasibility of syndrome decoding for general linear error-correcting codes over finite fields.

• b)

Multivariate based cryptography ([14]) is based on the fact that solving general systems of multivariate polynomial equations over finite fields is proved to be NP-hard.

• c)

Supersingular isogeny based cryptography ([19]), is a protocol for key exchange, analogous to Diffie-Hellman, but the cyclic groups present here are attached to supersingular elliptic curves defined over finite fields.

• d)

Finally, lattice based cryptography, admits a large number of different formulations and constructions. This report focuses on one of the most promising lattice-based technologies: Ring Learning With Errors (RLWE). This scheme is based on the RLWE problem, which is based in turn on the difficulty of solving the shortest vector problem (SVP) on ideal lattices.

At the time of writing, code, lattice and multivariate-based methods seem to be the strongest contenders, as they appear to have the flexible structure needed on which to base more complex protocols. Within these three categories, the lattice-based one has by far a larger number of non-broken primitives/protocols.

Lattice-based cryptography has a relatively mature history, primarily due to the work done by the early proponents of the related NTRU cryptosystem ([24]). This was a patented technology which enjoyed some minor success, but never really gained traction, as when it was invented, a quantum computer still seemed very far off. Its patents have now expired.

RLWE first came to prominence with the paper by Lyubashevsky, Peikert and Regev ([28]). A key-exchange algorithm proposed by them has been recently optimized and implemented by Alkim, Ducas, Pöppelmann, and Schwabe ([1]). This has been implemented by Google in a well-publicised experiment ([10]). In recent times there have been many implementation improvements, see for example the recent paper by Scott ([38]). So there can be no doubting the practicality of the technology, opinions supporting this view include those of a good number of researchers in Intel Labs and MIRACL Labs.

RLWE is built on an earlier scheme: the Learning with Errors (LWE) problem, which admits a security reduction from the SVP on arbitrary lattices, but with a much larger approximation factor than the one for which SVP is proved to be NP-hard. Of course, this is not a formal hardness guarantee for LWE but it can be regarded as a clue of its strength. Moreover, no polynomial-time attack has been found against LWE yet.

The main disadvantage of LWE is a quadratic overhead in the key sizes, which is overcome in the RLWE scenario, at the cost of being backed in the SVP over just ideal lattices, which even if based on experience is widely believed to be intractable, there is no formal proof at the moment, and for no appromation factor.

In spite of that, the RLWE variant appears to be eminently practical: like most post-quantum proposals, RLWE key sizes are much larger than those of non post-quantum methods, but the required computing power is usually much smaller. For example while an elliptic curve based cryptosystem might use keys of 256 bits, an equivalent system based on RLWE might require keys of 4096 bits to grant the same security level, while running maybe 10-100 times faster ([27]). These differences might be seen as balancing each other out. Furthermore, 30% of the surviving proposals for the NIST are based on RLWE.

Our report is structured as follows:

In section 2 we provide a quick introduction to the different features of cryptography and introduce the main terms and facts on complexity as they show up in the literature. We provide several examples, elaborating on those presented in the course by the author.

In section 3 we expose the main concepts of lattice-based cryptography. We focus on the classical LWE, over which RLWE is built and discuss its advantadges and drawbacks, as well as different attacks against weak instantiations, which will be exploited in the RLWE scenario in Section 6.

Section 4 is a quick overview of a few key concepts in algebraic number theory: rings of integers, canonical embedding, and other topics. These pieces make the foundations of RLWE, but the reader who is familiar with this material can safely skip it.

Section 5 introduces the RLWE problem in its various formulations. In particular, we carefully discuss the Polynomial Learning With Errors problem (PLWE), which appeared in the literature before RLWE ([40]). We discuss the equivalence between both problems and explain some recent advances in this topic: in particular we comment on recent work by the author ([6]) which gives a partial answer in the cyclotomic case, the most interesting from a cryptographic point of view. Besides, we explain the hardness result which backs RLWE and describe in full detail the LPR crypstosystem, as presented in [28]. We close the chapter by presenting a key exchange protocol based in RLWE ([15]).

Section 6 is a summary of several attacks against the RLWE cryptosystem. They reduce to LWE or to PLWE attacks and allow to discard insecure choices of parameters. The search for secure instantiations motivates some number theoretical problems and conjectures which we also discuss.

Section 7 is for RLWE-based digital signatures and homomorphic encryption, a functionality which is gaining much interest nowadays, since it allows to solve a good number of logistic and security problems in cloud computing and storing. We close the survey by discussing in detail some (second round) NIST figures.

A couple of remarks to end this introduction: first, by a polynomial time algorithm we mean an algorithm for which there exists a polynomial $p(x)\in\mathbb{R}[x]$ and a size function on the family of the algorithm inputs $x(n)$, such that the time it takes to run the algorithm on input $n$ is $p(x(n))$. Second, we will use sometimes the $\tilde{O}$-notation: a function $f(x)$ is $\tilde{O}(g(x))$ if it is $O(g(x)log^{k}(x))$ for some $k$.

Acknowledgements: The author thanks Gary McGuire for carefully reading a preliminary version of this survey, to Mike Scott for providing most of the practical highlights on RLWE and to the Basque Center for Applied Mathematics for their invitation to give this course and to take part in the postquantum cryptography mini-symposum at ICIAM 2019. Active and insightful discussion with the audience of the course and seminar, and in particular with Sebastiá Xambó set the author to write this work.

2. Post-quantum cryptography

2.1. Cryptography features

Requirements such as confidentiality and proofs of identity are crucial in electronic financial and legal transactions, while some other features like non-repudiation or operating on encrypted data (homomorphic encryption) are gaining much traction within the last few years. We examine here most of these functionalities.

The best known cryptographic problem is confidentiality. This is attained by the use of well-designed encryption/decription schemes.

To start with, we fix a finite alphabet $\mathcal{A}$, with some mathematical structure such as an abelian group or a field (e.g. the finite field $\mathbb{F}_{q}$ for $q=p^{t}$ and $p$ prime, or an elliptic curve over this field). We consider three sets $\mathcal{K}\subset\mathcal{A}^{n}$ (keys), $\mathcal{M}\subset\mathcal{A}^{N}$ (plaintexts) and $\mathcal{C}\subset\mathcal{A}^{N}$ (ciphertexts) with $n\ll N$. Finally, we consider a set $\Lambda\subset\mathbb{N}$ which parametrizes the level of security, i.e., the larger $\lambda\in\Lambda$, the safer the scheme.

Definition 2.1** (Cipher schemes).**

A cipher over $(\mathcal{K},\mathcal{M},\mathcal{C})$ is a family of pairs of efficiently computable functions $\{(E_{\lambda},D_{\lambda})\}_{\lambda\in\Lambda}$ where for each $\lambda$, $E_{\lambda}:\mathcal{K}\times\mathcal{M}\to\mathcal{C}$ (encryption function) and $D_{\lambda}:\mathcal{K}\times\mathcal{C}\to\mathcal{M}$ (decryption function) are such that for each key $k\in\mathcal{K}$ and for each plaintext $m\in\mathcal{M}$, the following correctness property holds:

[TABLE]

That is to say, decryption undoes encryption.

Efficiently computable means that both $E_{\lambda}$ and $D_{\lambda}$ can be computed by an algorithm which is polynomial in the security parameter $\lambda$, i.e., there exist polynomials $p(x),q(x)\in\mathbb{R}[x]$ only depending on the scheme, such that for each $\lambda\in\Lambda$, $k\in\mathcal{K}$, $m\in\mathcal{M}$, and $c\in\mathcal{C}$, the number of steps to compute $E_{\lambda}(k,m)$ (resp. $D_{\lambda}(k,c)$) is upper bounded by $p(\lambda)$ (resp. $q(\lambda)$). Moreover, the algorithm for $E_{\lambda}$ can be probabilistic, while $D_{\lambda}$ should always be deterministic.

Since in our definition both the encryption and decryption parties have the same key (i.e., the scheme is symmetric), they should agree beforehand on that key somehow. For instance, they might do it physically in a secret meeting but they can also use a digital key exchange protocol. As usual, any arbitrary legitimate sender (receiver) will be called Alice (Bob), and any arbitrary eavesdropper will be called Eve.

Definition 2.2** (Key exchange protocol).**

A key exchange protocol is an efficient method for Alice and Bob to agree on a key through a (potentially non-safe) channel. One of the most famous protocols is Diffie-Hellman’s (DH)111There are more general versions of the Diffie-Hellman problem, not known to be equivalent to a discrete logarithm problem, but here we stick to its version over finite fields, which by construction is so., where Alice and Bob start by agreeing on a finite feld $\mathbb{F}_{q}$ and a primitive root $g$, namely, a generator of the cyclic multiplicative group $\mathbb{F}_{q}^{*}$. The pair $(q,g)$ is made public, and to agree on a private key, Alice selects an integer $a$ and Bob selects an integer $b$. Then, Alice sends $g^{a}$ modulo $q$ to Bob, who on receiving it, raises it to $b$ modulo $q$, getting $g^{ab}$ modulo $q$. Next, Bob sends $g^{b}$ modulo $q$ to Alice, who raises it to $a$, obtaining also $g^{ab}$ modulo $q$, the agreed private key.

Notice that without knowledge of $a$ or $b$, Eve cannot obtain $g^{ab}$ from $g^{a}$ and $g^{b}$ in an efficient manner (on a classic computer!), the main obstruction being the unfeasibility of the discrete logarithm, namely, to obtain $a$ from $g^{a}$ modulo $q$, if $g$ is known. Nowadays, a combined usage of Diffie-Hellman (or some variant) with a suitable symmetric cipher is used in most internet protocols, like TLS or TCP/IP. A variant of DH is ECDH, where the multiplicative group $\mathbb{F}_{q}^{*}$ is replaced by the additive group of an elliptic curve over $\mathbb{F}_{q}$.

Definition 2.3** (Digital signatures).**

A signature scheme is a pair $(G,D)$, where $G:\Lambda\to\mathcal{K}$ is an efficient key generating probabilistic algorithm, and $D=\{(S_{\lambda},V_{\lambda})\}_{\lambda\in\Lambda}$ is a family of pairs of efficiently computable222by polynomial-time probabilistic algorithms. functions $S_{\lambda}:\mathcal{K}\times\mathcal{M}\to\mathcal{T}\subseteq\mathcal{A}^{r}$ (space of tags) and $V_{\lambda}:\mathcal{K}\times\mathcal{M}\times\mathcal{T}\to\{0,1\}$ such that whenever $k_{s}$ (secret key) and $k_{p}$ (public key) are sampled from $G$ on security level $\lambda$, then, for every message $m\in\mathcal{M}$:

[TABLE]

For a security level $\lambda$, $S_{\lambda}$ is called the signature function and $V_{\lambda}$ the verification function, which returns 1 if the signature is valid and 0 otherwise, and the correctness of the scheme means that on a message $m$ and a secret key $k_{s}$, the signature function produces a tag $S_{\lambda}(k_{s},m)$, which is verified as valid by the verifying function with probability $1$, given the message $m$ and the public key $k_{p}$. This scheme provides a proof that the message was signed by a known signatory (authentication) and the signatory cannot deny having signed the message (non-repudiation). Classic designs of digital signature schemes include Rabin’s algorithm, Lamport schemes and Merkle trees, as well as RSA-based protocols ([7] 13.3.1).

Integrated Encryption Schemes (signcryption schemes) implement both encryption and authentication. Two of the most commonly used are ECIES, which operates with elliptic curves and DLIES, which operates over $\mathbb{F}_{q}$.

Definition 2.4** (Homomorphic encryption333From now on, to ease notation, we will omit the $\lambda$-subscripts unless it results in ambiguity. ).**

Let $(E,D)$ be a cipher over $(\mathcal{K},\mathcal{M},\mathcal{C})$ where $\mathcal{M}$ and $\mathcal{C}$ are abelian groups under the operations $*_{\mathcal{M}}$ and $*_{\mathcal{C}}$ respectively. The cipher is said to be homomorphic if for each key $k\in\mathcal{K}$ and plaintexts $m_{1},m_{2}\in\mathcal{M}$, it is

[TABLE]

Example 2.5**.**

RSA encryption is homomorphic. Indeed, for an RSA integer $N=pq>1$ and an exponent $e$ modulo $\phi(N)$ with inverse $d$, encryption goes as $x\mapsto x^{e}\pmod{N}$, which clearly commutes with the product modulo $N$, but not with the sum.

When in addition, $\mathcal{M}$ and $\mathcal{C}$ have ring structure and encryption commutes with both ring operations, the cipher is said to be fully homomorphic (FHE). Notice that RSA is not fully homomorphic.

Homomorphic encryption allows to perform operations on the plaintext by operating directly on the ciphertexts, i.e., without decrypting first. This is relevant when the operations are outsourced and performed over a non-trustable server. Applications of homomorphic encryption include encrypted database queries, cloud computing, genetic computing, health data management or outsourced generation of blockchain addresses.

2.2. P, NP, NP-hard and NP-complete

The author has often seen that the terms intractable, unfeasible, and hard, are used in the postquantum cryptography literature in a rather loose (at best!) manner and this may lead to believe that certain computational problems enjoy certain complexity guarantees that they simply have not. We make here precise the main terms that usually appear in the problems which back lattice cryptography.

Definition 2.6** (The P and NP classes).**

The P class consists of the decission problems whose solution can be found on a deterministic Turing machine in polynomial time in the input size. The NP class consists of the decission problems for which a putative solution can be checked to be a real solution or not in polynomial time on a deterministic Turing machine on the input size.

Equivalently, the NP-class consists of the decission problems such that a solution can be found in polynomial time on a non-deterministic Turing machine: indeed, assuming Definition 2.6 for the NP class, an algorithm based on a non-deterministic Turing Machine can be built in two steps; the first is a non-determininstic guess about the solution, and the second consists of a polynomial deterministic algorithm that verifies if the guess is a solution(cf. [2] pag. 283 for details). A common misconception is that the NP term stands for non-polynomial when in fact it stands for non-deterministic polynomial acceptable problems.

A note of caution: as we pointed out at the end of the introduction, the term in polynomial time means that the time it takes to solve a problem is, on input $n$, upper bounded by a polynomial in $x(n)$ where $x$ is a size function. The most used size function is the logarithm, as we can regard it, essentially as the number of digits, a true size of the input. Hence, a brute force attack on DLP for $\mathbb{F}_{p}$ takes $p-1$ powers and checks, which is polynomial in $p$ but exponential in $\log(p)$. There are classical (non-quantum) algorithms which drastically reduce the order, like the number field sieve (subexponential), but none of them is polynomial in $\log(p)$. We refer the reader to Chapter 4 of this work for a summary on number fields and their key properties and to [25] for an exposition of the number field sieve method.

Example 2.7**.**

The problem of primality testing, i.e. deciding whether a positive integer is prime or not is NP: indeed, given a natural number $n>1$ and $b\leq n$, the Euclidean algorithm can be used to check if $b\mid n$ in approximalety $\log(b)$ operations. Moreover, in a major breakthrough, Agrawal, Kayal and Saxena proved that primality testing is also a P problem.

Example 2.8**.**

The problem of factoring, namely to return a proper factorisation $n=pq$ with $1<p,q<n$ of an input $n\in\mathbb{N}$ is also NP: a pair $(p,q)\in\mathbb{N}^{2}$ can be checked to be (or not) a non trivial factorisation of $n$ by performing approximately $\log(q)^{2}$ multiplications, if $q\geq p$.

Two celebrated algorithms due to Peter Shor solve the factoring problem and the DLP in polynomial time on a quantum computer ([39]). To factor a positive integer $n$, Shor’s algorithm runs over all the integers in the range $\{1,..,n\}$. For $1<a<n$, if $a$ is a unit modulo $n$, the algorithm calls a sub-routine to compute the order of $a$ modulo $n$. With this period, the algorithm produces a non-trivial factor of $n$ with arbitrarily large probability in polynomial time. The order-finding sub-routine is run on a quantum computer, but the use of the order to produce a factor is classical.

In fairness, this does not mean that the problem of factoring is in the P-class, as a (probabilistic) quantum algorithm is not equivalent, in general, to a Turing or sequential machine.

Definition 2.9** (Reduction).**

We say that a problem A admits a reduction to a problem B if any instance of A can be transformed to an instance of B in polynomial time, namely, if solving B suffices for solving A with the same order of complexity.444By order of complexity we mean polynomial, superpolynomial, subexponential and exponential. We stick to these orders as they are enough for our analysis.

Informally, NP-hard and NP-complete problems are those at least as hard as those in the NP-class, but while NP-complete problems belong to NP, NP-hard ones need not to. More precisely:

Definition 2.10**.**

The NP-hard class consists of those problems A such that every problem in NP can be reduced to A in polynomial time. The NP-complete class consists of those NP problems which are NP-hard.

Example 2.11**.**

The prime factorisation problem, i.e. to return all the prime factors with multiplicity of an input $n\geq 1$, is clearly NP: checking if a putative solution is a prime factorisation of $n$ can be done in (deterministic) polynomial time. However it is not known if the prime factorisation is NP-hard (and hence NP-complete). It is expected, moreover, not to be in the P class.

So, a quantum computer would render insecure both RSA and Diffie-Hellman. Even more, Tate and Weil’s pairings allow to reduce ECDLP to DLP ([29]), a reduction which is even polynomial (although probabilistic) on supersingular curves, hence, the elliptic version on Diffie-Hellman should also be avoided in a post-quantum scenario. This is a reason to consider schemes which use pairing-free abelian varieties, hence other than elliptic curves. Jacobians of hyperelliptic curves are known to be good candidates but beyond genus 3, the complexity of finding explicit equations and explicit computations for the addition law render them unfeasible.

Finally, another well-known problem is whether $P\neq NP$ or not. If equality held, all cryptographic (classic and postquantum) primitives based on NP problems would be useless. On the contrary, if, as it is widely believed, $P\neq NP$, then every NP-hard problem would be non-polynomial, hence suitable for cryptography: indeed, if $\Lambda$ is NP-hard, in case $P\neq NP$, take $B$ in $NP\setminus P$. Then $\Lambda$ cannot be polynomial (otherwise, $B$ would be so).

But for the moment, lacking a proof of $P\neq NP$, all we can say is that NP-hard problems are strongly expected to be suitable for (postquantum) cryptography.

3. Lattice based cryptography

The security of lattice-based schemes relies on two problems which are expected to be intractable on a quantum computer, as we explain next. By length, we mean Euclidean length, denoted $||\phantom{a}||$.

Definition 3.1**.**

A lattice in $\mathbb{R}^{n}$ is a pair $(\Lambda,\rho)$ where $\Lambda$ is a finitely generated and free subgroup of the additive group $(\mathbb{R}^{n},+)$ and $\rho:\Lambda\to\mathbb{Z}^{n}$ is an isomorphism. We denote by $\lambda_{1}(\Lambda)$ the minimal length among the set of non-zero elements of $\Lambda$.

Notice that our definition has implicit the feature of being of full rank. There are more general definitions but this will be enough for us.

Example 3.2**.**

In the ring of Gaussian integers $\mathbb{Z}[i]=\left\{a+bi;a,b\in\mathbb{Z}\right\}$, identifying $(\mathbb{C},+)$ with $(\mathbb{R}^{2},+)$, we can impose a lattice structure in (at least) two ways:

[TABLE]

or

[TABLE]

Definition 3.3**.**

Let $(\Lambda,\rho)$ be a lattice in $\mathbb{R}^{n}$ with basis $\mathcal{B}=\left\{v_{1},...,v_{n}\right\}$. The fundamental parallelogram of $\Lambda$ associated to $\mathcal{B}$ is:

[TABLE]

Problem 3.4** (SVP).**

The shortest vector problem (SVP) is, on input of an arbitrary lattice $\Lambda$ in $\mathbb{R}^{n}$, together with a basis, to determine a vector $x\in\Lambda$ with length $\lambda_{1}(\Lambda)$. For $\gamma>0$, the $\gamma$-approximate shortest vector problem ($\gamma$-SVP) is to determine a non-zero vector $x\in\Lambda$ with $||x||\leq\gamma\lambda_{1}(\Lambda)$.

Problem 3.5** (CVP).**

The closest vector problem (CVP) is, on input of an arbitrary lattice $\Lambda$ in $\mathbb{R}^{n}$, together with a basis and a point $y\in\mathbb{R}^{n}$, to find $x_{y}\in\Lambda$ such that

[TABLE]

In [30], it is proved that $\gamma$-SVP is NP-hard for $\gamma<\sqrt{2}$ and in [9], it is proved that CVP is NP-complete, hence if $P\neq NP$, these two problems cannot be solved in polynomial time, even with the aid of a quantum computer.

3.1. The Learning With Errors problem (LWE)

Let $q$ be a rational prime for which a suitable choice will be made later.

Definition 3.6**.**

The real torus of dimension $1$ is the quotient group $\mathbb{T}=\mathbb{R}/\mathbb{Z}$, its elements are equivalence classes of the form $x+\mathbb{Z}$ with $x\in[0,1)$.

Lemma 3.7**.**

The following map is a group monomorphism:

[TABLE]

A realization of lattice-based cryptography immune to all current quantum attacks and with a good chance of being NP-hard relies on the LWE problem, which we describe in this subsection.

Definition 3.8** (LWE-oracles).**

Let $\chi$ be a discrete random variable with values in $\mathbb{T}$. For $s\in\mathbb{F}_{q}^{n}$, chosen uniformly at random, a LWE-oracle with respect to $s$ and $\chi$ is a probabilistic algorithm $A_{s,\chi}$ which, at each execution, performs the following steps:

Samples a vector $a$ uniformly at random from $\mathbb{F}_{q}^{n}$.

• 2.

Computes the scalar product $\langle a,s\rangle$.

• 3.

Samples $e\in\mathbb{T}$ from $\chi$.

• 4.

Outputs the vector $\left[a,\frac{1}{q}\langle a,s\rangle+e\right]\in\mathbb{F}_{q}^{n}\times\mathbb{T}$.

Definition 3.9** (The LWE problem).**

Let $\chi$ be a discrete random variable with values in $\mathbb{T}$ as before. The LWE problem for $\chi$ and $q$ is defined as follows:

• a)

Search version: for an element $s\in\mathbb{F}_{q}^{n}$ chosen uniformly at random and a LWE-oracle $A_{s,\chi}$, if an adversary is given access to arbitrarily many samples of the LWE distribution, this adversary must recover $s$ with non-negligible advantage.

• a)

Decissional version: for an element $s\in\mathbb{F}_{q}^{n}$ chosen uniformly at random and a LWE oracle $A_{s,\chi}$, the adversary is asked to distinguish, with non-negligible advantage, between arbitrarily many samples from $A_{s,\chi}$ and the same number of samples $(a_{i},b_{i})\in\mathbb{F}_{q}^{n}\times\mathbb{T}$ where $a_{i}$ and $b_{i}$ are chosen independently and uniformly at random from $\mathbb{F}_{q}^{n}$ and $\mathbb{T}$.

From now on, $\chi$ will be an $\mathbb{F}_{q}$-valued Gaussian variable, which can be thought of as having values on $\mathbb{T}$ via Lemma 3.7. Such a variable is defined as follows: For $\sigma,c\in\mathbb{R}$ we set $\rho_{\sigma,c}(x)=\exp{\frac{-(x-c)^{2}}{2\sigma^{2}}}$. Write

[TABLE]

and define $D_{\sigma,c}$ to be the distribution on $\mathbb{Z}$ such that the probability of $x\in\mathbb{Z}$ is $\rho_{\sigma,c}(x)/S_{\sigma,c}$. Finally, the discrete Gaussian distribution $\chi$ with values in $\mathbb{F}_{q}$, mean [math], and parameter $\sigma$ is defined by the probability function

[TABLE]

Some words of caution: first, the variance of $\chi$ should be very close to $\sigma^{2}$, but not neccesarily must be equal: in lattice-based cryptography one speaks about discrete random variables of parameter (rather than variance) $\sigma^{2}$. Second, effective sampling from discrete Gaussian distributions is a difficult topic and in practical cases it is approached only by numerical approximation (see [17]).

We conclude here with the following result due to Regev ([35]): a polynomial time quantum reduction from the SVP problem to the LWE problem, which backs the hardness of LWE and makes it a candidate to sustain a cryptosystem from it, as we will see in the next subsection.

Theorem 3.10** (Regev, [35]).**

Let $\chi_{r}$ be a discrete Gaussian of parameter $r^{2}$, $q$ a prime and $s\in\mathbb{F}_{q}^{n}$. Assume $r\geq 2\sqrt{n}$. Then, there is a quantum polynomial time reduction from $\gamma$-SVP, with $\gamma=\tilde{O}(nq/r)$to the search LWE problem attached to the LWE oracle $A_{s,\chi_{r}}$.

3.2. Attacks against LWE

In the language of Machine Learning, due to Theorem 3.10, a training algorithm for the LWE problem can be turned, in polynomial time (on a quantum computer), into an algorithm (of the same complexity) which solves the SVP problem. If the $\gamma$-SVP problem were NP-hard for the value of $\gamma$ given in Theorem 3.10, it would follow the NP-hardness of the LWE problem. However, that value of $\gamma$ depends on $r^{2}$, the parameter of $\chi_{r}$, and the values of $r$ for which the LWE-problem for $A_{s,\chi_{r}}$ results in a correct cryptosystem is bigger than $\sqrt{2}$, the value for which SVP is NP-hard. Hence, Regev’s reduction cannot be used to prove NP-hardness of SVP. Nevertheless, this kind of result can be seen as a clue towards its security.

However, LWE has not been yet broken and there is a wide consense of the problem being intractable. Nevertheless, some ad-hoc instantiations may be insecure against very simple attacks. Given $m$ LWE samples $\{(a_{i},b_{i}=\frac{1}{q}\langle s,a_{i}\rangle+e_{i})\}_{i=1}^{m}$, we can put them in columns to obtain a matrix $A=[a_{1}|...|a_{m}]\in\mathbb{F}_{q}^{n\times m}$ and set $\textbf{b}=\frac{1}{q}A^{t}s+\textbf{e}$, where e is the column vector of errors. We analyze three vulnerable instantiations:

If $\chi$ is identically zero (errorless LWE), $s$ can be recovered via Gaussian elimination as long as the rows of A are linearly independent, which holds with high probability for $m>n$.

• 2.

If $\chi$ takes values in $z+[-1/2,1/2)$ with fixed $z\in\mathbb{R}$, we can round away each coordinate of b and subtract $z$ to reduce to errorless LWE.

• 3.

If each group of $k$ samples has an error vector drawn from some distribution $\kappa$ in $\mathbb{R}^{k}$ and some discretized error coordinate is always [math] under $\kappa$, we can ignore the samples corresponding to the other coordinates and since we have access to unlimited samples by hypothesis, we can equally reduce ourselves to errorless LWE. Analogously, we can reduce to errorless LWE if the sum (or a linear combination) of the $k$ error coordinates in each group is [math].

Remark 3.11*.*

Generalizing Case 2 in the above analysis, the error distribution $\chi$ is said not to wrap around $\mathbb{Z}$ if $Pr_{e\leftarrow\chi}\left\{e\not\in z+[\frac{1}{2},\frac{1}{2})\right\}$ is small enough for some known $z\in\mathbb{R}$. In this case, again by our unlimited access to the LWE oracle, the same attack as in Case 2 has good chance of success.

Other instantiations of LWE can be attacked by more sophisticated means. For instance, as described in [3], if all the discretized errors in our samples (i.e. seen not in the torus but in $\mathbb{F}_{q}^{n}$, after rounding to the closest integer) lie in a known set of size $d$, then search LWE can be broken in approximately $n^{d}$ time and space, using $n^{d}$ samples. If $d=O(1)$, the attack is polynomial in the dimension, while if $d=n^{1-\varepsilon}$, the attack is sub-exponential. For details cf. [32], Section 2.

What these attacks should make us learn is that the distribution $\chi$ should be very carefully chosen, to avoid falling in a low dimensional subspace of $\mathbb{F}_{q}^{n}$, in which case, reduction to errorless LWE might have a good chance of success.

3.3. The LWE cryptosystem

Based on the hardness guarantee in Theorem 3.10, and avoiding the above problematic instantiations, the LWE problem can be used to build the following cryptosystem:

Construction 3.12** (LWE cryptosystem, Regev ([35])).**

Parameters: $n,m\in\mathbb{N}$, $\alpha>0$.

• 2.

Private key: $s\in\mathbb{F}_{q}^{n}$ chosen uniformly at random.

• 3.

Public key:

• 3.1

Sample $a_{1},...,a_{m}\in\mathbb{F}_{q}^{n}$, independently and uniformly at random.

• 3.2

Sample $e_{1},...,e_{m}\in\mathbb{F}_{q}$, independently from $\chi$, which is assumed here to be a discrete Gaussian of zero mean and parameter $\frac{\alpha q}{2\pi}$.

• 3.3

Publish $\{\left[a_{i},b_{i}=\langle a_{i},s\rangle+e_{i}\right]\}_{i=1}^{m}$.

• 4.

Encryption: for a bit $z\in\mathbb{F}_{2}$, consider it as an element of $\mathbb{F}_{q}$ by mapping the [math] and $1$ of $\mathbb{F}_{2}$ to the [math] and $1$ of $\mathbb{F}_{q}$. Select a random subset $S\subseteq\{1,...,m\}$ and map

[TABLE]

• 5.

Decryption: on receiving an encrypted message $\left[u,v\right]$, compute $d:=v-\langle u,s\rangle$. This equals $z\lfloor\frac{q}{2}\rfloor+\sum_{i\in S}e_{i}$. If $z=0$, then $d$ has absolute value below $\lfloor\frac{q}{4}\rfloor$ with probability as close to $1$ as desired, depending on how we choose the parameter $\alpha$. So, if this is the case, decrypt to [math], otherwise, decrypt to $1$.

The right choice of $q$, $m$ and $\alpha$ is given in the following result, whose proof is omited since it is very similar to the cryptographic scheme presented in the next subsection, whose proof we will discuss.

Theorem 3.13**.**

If $q\in\{n^{2},...,2n^{2}\}$, $\alpha=\frac{1}{\sqrt{n}\log^{2}(n)}$ and $m$ is of the order of $n\log(q)$, then the LWE cryptosystem is correct and pseudorandom555I.e. statistically indistinguishable from a uniform distribution..

As we can see, a public key for LWE has $m$ vectors in $\mathbb{F}_{q}^{n}$, since $m$ is of the order of $n\log(n)$, it turns out that a public key has an $\mathbb{F}_{q}$-size of the order $n^{2}\log(n)$. This quadratic overhead is an unfeasible constrain from a practical point of view, in particular in settings such as hand-held digital broadcasting, mobile encryption and small devices in tentative applications of the IoT (Internet of Things), where the hardware has a relatively small memory. Moreover, in other recent scenarios where homomorphic encryption is desirable, LWE cannot fit well if the plaintext space is big enough. Such a scenario is that of electronic elections (e-voting and i-voting), which has to combine encryption with signature and authentication. For a large enough country, the size of the keys (which even if a pseudorandom generator is used, must grow with the size of the plaintext space) is certainly to be taken into account.

A variation of the LWE problem, the ring learning with errors (RLWE) problem was introduced to tackle this quadratic overhead in the key sizes. The foundations of the problem require several notions from algebraic number theory, which we present next.

4. Some basics of algebraic number theory

Here we present the notions of algebraic number theory used to build the RLWE cryptosystem. Readers who are familiar with them can safely skip this section, since all our notations are standard. Readers who are not so familiar are referred to [41], Chapter 2 for more details.

4.1. Algebraic number fields

An algebraic number field (number field, for short) is a field extension $K=\mathbb{Q}(\theta)/\mathbb{Q}$ of finite degree $n$, where $\theta$ satisfies a relation $f(\theta)=0$ for some irreducible polynomial $f(x)\in\mathbb{Q}[x]$, which is monic without loss of generality. The polynomial $f$ is called the minimal polynomial of $\theta$, and $n$ is also the degree of $f$. Notice that $K$ is in particular an $n$-dimensional $\mathbb{Q}$-vector space and the set $\{1,\theta,...,\theta^{n-1}\}$ is a $\mathbb{Q}$-basis of $K$ called a power basis. Notice that associating $\theta$ with the unknown $x$ yields a natural isomorphism between $K$ and $\mathbb{Q}[x]/f(x)$.

Let $\overline{\mathbb{Q}}$ denote an algebraic closure of $\mathbb{Q}$ fixed from now on. A number field $K=\mathbb{Q}(\theta)$ of degree $n$ has exactly $n$ field embeddings (injective field homomorphisms) $\sigma_{i}:K\to\overline{\mathbb{Q}}$ fixing $\mathbb{Q}$. Each embedding $\sigma_{i}$ is determined by $\sigma_{i}(\theta)=\theta_{i}$, where $\{\theta_{i}\}_{i=1}^{n}$ are the different roots of $f$. The number field is said to be Galois if $K$ is the splitting field of $f$.

Example 4.1**.**

Denote by $\sqrt[3]{2}$ the unique real cubic root of $2$. The number field $K=\mathbb{Q}(\sqrt[3]{2})$ is not Galois: indeed, the other two roots of the minimal polynomial, $X^{3}-2$ do not belong to $K$. To make it Galois, we need to adjoin $\omega_{3}$, a non-real cubic root of $1$.

An embedding whose image lies in $\mathbb{R}$ (corresponding to a real root of $f$) is called a real embedding; otherwise it is called a complex embedding. Since complex roots of $f$ come in conjugate pairs, so do the complex embeddings. The number of real embeddings is denoted $s_{1}$ and the number of pairs of complex embeddings is denoted $s_{2}$, so we have $n=s_{1}+2s_{2}$. If $s_{2}=0$ (resp. $s_{1}=0$) $K$ is said to be totally real (resp. totally imaginary).

Definition 4.2**.**

The canonical embedding $\sigma:K\to\mathbb{R}^{s_{1}}\times\mathbb{C}^{2s_{2}}$ is then defined as

[TABLE]

4.2. Algebraic integers

An algebraic integer is an element of $\overline{\mathbb{Q}}$ whose minimal polynomial over $\mathbb{Q}$ has integer coefficients. For a number field $K$ of degree $n$, let $\mathcal{O}_{K}\subset K$ denote the set of all algebraic integers in $K$. This set forms a ring under addition and multiplication in $K$ ([41], Theorem 2.9), called the ring of integers of $K$. It happens that $\mathcal{O}_{K}$ is a free $\mathbb{Z}$-module of rank $n$, i.e., it is the set of all $\mathbb{Z}$-linear combinations of some basis $\mathcal{B}=\{b_{1},...,b_{n}\}\subset\mathcal{O}_{K}$ of $K$ ([41], Theorem 2.16). Such a set $\mathcal{B}$ is called an integral basis.

Example 4.3**.**

Let $n>1$ be an integer. The set of primitive $n$-th roots of unity (those of the form $\theta_{k}=exp(2\pi ik/n)$, with $1\leq k\leq n$ coprime to $n$) forms a multiplicative group of order $m=\phi(n)$. The $n$-th cyclotomic polynomial is

[TABLE]

This is the minimal polynomial of $\theta_{k}$ for each $k$, so that $K=\mathbb{Q}(\theta_{k})$ is a number field of degree $m$. It can be proved ([41] Chap 3) that the ring of integers of $K$ is precisely $\mathbb{Z}[\theta]$ for each $\theta=\theta_{k}$, with $k\in\mathbb{Z}^{*}_{n}$.

Definition 4.4**.**

A number field $K$ such that $\mathcal{O}_{K}=\mathbb{Z}[\alpha]$ for some $\alpha\in\mathcal{O}_{K}$ is said to be monogenic.

Example 4.5**.**

Let $d$ be a square-free integer. Consider the number field $\mathbb{Q}(\sqrt{d})$. It can be shown that the ring of integers of $K$ is $\mathbb{Z}[\sqrt{d}]$ if $d\not\equiv 1\pmod{4}$ and $\mathbb{Z}[\frac{1+\sqrt{d}}{2}]$ otherwise.

Definition 4.6** (Norm, trace and discriminant).**

For a number field $K$ of degree $n$, given an element $\alpha\in K$, its norm is defined as the product

[TABLE]

and the trace is

[TABLE]

The discriminant of $K$, denoted $\Delta_{K}$ is the square of the determinant of the following matrix:

[TABLE]

where $\{\theta_{1},...\theta_{n}\}$ is an integral basis of $\mathcal{O}_{K}$. Notice that since lattice base-change matrices are unimodular, the definition does not depend on the choice of the basis666In most algebraic number theory texts our $\Delta_{k}$ is called the minimal discriminant, since it is possible to define such a determinant for each $K$-basis (not necessarily integral). We will only consider integral bases and minimal discriminants..

Example 4.7** ([42] Prop. 2.7).**

Let $K_{n}$ denote the $n$-th cyclotomic field. Then, the discriminant of $K$ equals

[TABLE]

Norm and trace and discriminant are rational numbers Moreover, they are integers when restricted to $\mathcal{O}_{K}$.

4.3. Ideals and ideal lattices

Recall that an ideal of a ring $R$ is an additive subgroup $I\subseteq R$ such that for each $\alpha\in R$ and each $\beta\in I$, it is $\alpha\beta\in I$. For instance, for $d\equiv 1\pmod{4}$, the subring $\mathbb{Z}[\sqrt{d}]$ is not an ideal of the ring of integers, just a subring with finite index.

Unlike $\mathbb{Z}$, in the ring of integers $\mathcal{O}_{K}$ of a number field $K$, it is not true that every element $\alpha\in\mathcal{O}_{K}$ is a unique product, up to order and units, of different irreducible elements777An element $\alpha$ of a ring $R$ is irreducible if for any $\beta,\gamma\in R$ such that $\alpha=\beta\gamma$, either $\beta$ or $\gamma$ is a unit.. For example, in $\mathbb{Z}[\sqrt{-6}]$, we have $6=2\cdot 3=\sqrt{-6}\cdot\sqrt{-6}$, where $2,3$ and $\sqrt{-6}$ are irreducible elements. However, this generalisation holds if we replace (irreducible) elements by (prime) ideals:

Theorem 4.8** ([41], Theorem 5.6).**

$\mathcal{O}_{K}$* is a Dedekind domain. In particular, for each ideal $I\subseteq\mathcal{O}_{K}$, there exist unique prime ideals $\mathfrak{p}_{1},...,\mathfrak{p}_{r}$ and unique integers $e_{1},...,e_{r}\in\mathbb{Z}_{\geq 0}$ such that*

[TABLE]

Moreover, denoting $f_{i}=|\mathcal{O}_{K}/\mathfrak{p}_{i}|$, for $i=1,...,r$, it is

[TABLE]

Example 4.9**.**

In $\mathbb{Z}[\sqrt{-17}]$, we can express the principal ideal $\langle 18\rangle$ as the product $\mathfrak{p}_{1}^{2}\mathfrak{p}_{2}^{2}\mathfrak{p}_{3}^{2}$, with $\mathfrak{p}_{1}=\langle 2,1+\sqrt{-17}\rangle$, $\mathfrak{p}_{2}=\langle 3,1+\sqrt{-17}\rangle$ and $\mathfrak{p}_{3}=\langle 3,1-\sqrt{-17}\rangle$.

Definition 4.10**.**

Let $p\in\mathbb{Z}$ be a rational prime decomposed as $(p)=\mathfrak{p}_{1}^{e_{1}}...\mathfrak{p}_{r}^{e_{r}}$ in $\mathcal{O}_{K}$ with $\mathfrak{p}_{i}$ prime ideals. The number $e_{i}$ is called the ramification index of $p$ at $\mathfrak{p}_{i}$ and if $e_{i}>1$, then $p$ is said to ramify at $\mathfrak{p}_{i}$. The number $f_{i}=|\mathcal{O}_{K}/\mathfrak{p}_{i}|$ is called inertia degree of $p$ at $\mathfrak{p}_{i}$. If $r=n$, then all the $e_{i}$ and $f_{i}$ equal $1$ and $p$ is said to be totally split.

A theorem by Minkowski states that every number field has only finitely many ramifying primes, which are precisely the rational primes dividing the discriminant. Hence, going back to Example 4.7, we see that for the $n-th$ cyclotomic field the ramifying primes are those which divide $n$.

Definition 4.11**.**

Let $R$ be a discrete ring (free and finitely generated as abelian group) and $\sigma:R\to\mathbb{R}^{n}$ an additive monomorphism. Nottice that $\sigma(R)$ is a lattice. The family of ideal lattices (for the ring $R$ and embedding $\sigma$) is the set of all lattices $\sigma(I)$ for ideals $I$ in $R$.

For instance, for $R=\mathbb{Z}[x]/f(x)$, the coefficient embedding maps any element of R to the integer vector in $\mathbb{Z}^{n}$ whose coordinates are exactly the coefficients of that element when viewed as a polynomial residue. When $R=\mathcal{O}_{K}$, the canonical embedding $\sigma$ provides in a natural way an ideal lattice for each ideal $I$ of $R$.

Notice that for the canonical embedding, multiplication and addition are preserved componentwise. On the contrary, for instance, for the ring $R=\mathbb{Z}[x]/(x^{n}+1)$, the componentwise multiplication in $\mathbb{Z}_{q}^{n}$ doesn’t correspond with multiplication in $R$: multiplying by $x$, is equivalent to shifting the coordinates and negate the independent term. This is one of the advantages of using the canonical embedding.

Moreover, one has the following connection between the fundamental parallelotope of $\sigma(\mathcal{O}_{K})$ and the discriminant $\Delta_{K}$:

Theorem 4.12** ([41], cf. Theorem 8.1).**

Assume that the number field $K$ has $s$ pairs of complex embeddings. Then, the Euclidean measure of the fundamental parallelotope of $\sigma(\mathcal{O}_{K})$ equals $2^{s}\sqrt{\Delta_{K}}$.

5. Ring learning with errors: problems, cryptosystem and key exchange

To define the ring learning with errors problem (RLWE), let $K$ be a number field of degree $n$ and ring of integers $\mathcal{O}_{K}$, regarded as a lattice in $\mathbb{R}^{n}$, by means of the canonical embedding. Closely connected with RLWE is the polynomial learning with errors problem (PLWE). Next we formally introduce both problems and explore their relation.

5.1. Statement of the problems

In the rest of this subsection $f(x)\in\mathbb{Z}[x]$ is supposed to be a monic irreducible polynomial of degree $n$ and $q$ is a rational prime which we will choose later. Define, further, $\mathcal{O}:=\mathbb{Z}[x]/(f(x))$, which can also be regarded as a lattice in $\mathbb{R}^{n}$ by means of the coordinate embedding

[TABLE]

Each root $\alpha$ of $f$ defines a number field $K_{\alpha}=\mathbb{Q}(\alpha)$. Moreover, the ring $\mathbb{Z}[\alpha]$ is a finite index suborder of the ring of integers $\mathcal{O}_{K_{\alpha}}$. The restriction of the canonical embedding to $\mathbb{Z}[\alpha]$ also provides a lattice in $\mathbb{R}^{n}$. A very common choice is $f(x)=x^{2^{k}}+1$, the $2^{k+1}$-th cyclotomic polynomial (cf. [40]).

The $n$-dimensional torus attached to $\mathcal{O}_{K}$ is $\mathbb{T}:=(K\otimes_{\mathbb{Q}}\mathbb{R})/\mathcal{O}_{K}$, and the $f$-torus is defined to be $\mathbb{T}_{f}:=\mathbb{R}_{q}[X]/(f(X))$, with $\mathbb{R}_{q}:=\mathbb{R}/\mathbb{Z}$. As in Lemma 3.7, there are embeddings $\mathcal{O}_{K}/q\mathcal{O}_{K}\hookrightarrow\mathbb{T}$ and $\mathcal{O}/q\mathcal{O}\hookrightarrow\mathbb{T}_{f}$.

Definition 5.1** (RLWE and PLWE-oracles).**

Let $\chi$ be a discrete random variable with values in $\mathcal{O}_{K}/q\mathcal{O}_{K}$ (which we regard as taking values in $\mathbb{T}$). For $s\in\mathcal{O}_{K}/q\mathcal{O}_{K}$ chosen uniformly at random, a RLWE-oracle with respect to $s$ and $\chi$ is a probabilistic algorithm $A_{s,\chi}$ which, at each execution performs the following steps:

Samples an element $a\in\mathcal{O}_{K}/q\mathcal{O}_{K}$ uniformly at random,

• 2.

Samples an element $e$ from $\chi$,

• 3.

Outputs the pair $(a,as+e)\in\mathcal{O}_{K}/q\mathcal{O}_{K}\times\mathbb{T}$.

• 2.

Let $f(x)\in\mathbb{Z}[x]$ be monic irreducible as above and $\chi$ a discrete random variable with values in $\mathcal{O}/q\mathcal{O}$ (which we regard as taking values in $\mathbb{T}_{f}$) . For $s\in\mathcal{O}/q\mathcal{O}$ chosen uniformly at random, a PLWE-oracle with respect to $s$ and $\chi$ is a probabilistic algorithm $A_{s,\chi}$ which, at each execution performs:

Samples an element $a\in\mathcal{O}/q\mathcal{O}$ uniformly at random,

• 2.

Samples an element $e$ from $\chi$,

• 3.

Outputs the pair $(a,as+e)\in\mathcal{O}/q\mathcal{O}\times\mathbb{T}_{f}$.

Definition 5.2** (The RLWE/PLWE problem).**

Let $\chi$ be a discrete random variable with values in $\mathcal{O}_{K}/q\mathcal{O}_{K}$ (in $\mathcal{O}/q\mathcal{O}$). The RLWE (PLWE) problem for $\chi$ is defined as follows:

• a)

Search version: for an element $s\in\mathcal{O}_{K}/q\mathcal{O}_{K}$ ($\mathcal{O}/q\mathcal{O}$) chosen uniformly at random and a RLWE (PLWE)-oracle $A_{s,\chi}$, if an adversary is given access to arbitrarily many samples $(a_{i},a_{i}s+e_{i})$ of the RLWE (PLWE) distribution, this adversary must recover $s$ with non-negligible advantage.

• a)

Decisional version: for an element $s\in\mathcal{O}_{K}/q\mathcal{O}_{K}$ ($\mathcal{O}/q\mathcal{O}$) chosen uniformly at random and a RLWE (PLWE)-oracle $A_{s,\chi}$, the adversary is asked to distinguish, with non-negligible advantage, between arbitrarily many samples from $A_{s,\chi}$ and the same number of samples $(a_{i},b_{i})$, taken uniformly at randon from $\mathcal{O}_{K}/q\mathcal{O}_{K}\times\mathbb{T}$ ($\mathcal{O}/q\mathcal{O}\times\mathbb{T}_{f}$).

Some words on the class of distributions we will use from now: first, notice that if $q$ is totally split, what we will frequently assume, a RLWE-sample can be seen as an $n$-tuple of coordinates with values in $\mathbb{F}_{q}$. However, such a RLWE-sample is indeed much more than $n$ LWE-samples: $\mathcal{O}_{K}/q\mathcal{O}_{K}$ is not only an $\mathbb{F}_{q}$- vector space; it also has a ring structure. The flexibility and power of RLWE comes from exploiting the ring structure instead of the sheer lattice structure. This is the reason why instead of taking $n$-independent discrete one-dimensional Gaussians, we rather use an $n$-dimensional one.

As in the $1$-dimensional case, the mean will also be supposed [math], but in the RLWE scenario, the variance-covariance matrix (or rather, the multidmensional parameter) is normallly chosen, depending on the application, a) either to be diagonal, which is referred to as saying that the distribution is elliptic888This is useful when carrying out security-reduction proofs., or b) to have the diagonal elements bounded in absolute value by $\alpha n^{1/4}$, for $\alpha$ a parameter which will be made explicit in the next theorem, which backs the security of the decisional RLWE-problem (hence of the search RLWE-problem) in the security of the SVP over ideal lattices.

Hence, from now on, we assume that $\chi_{\alpha}$ is an elliptic $n$-dimensional discrete $\mathbb{T}$-valued Gaussian of [math]-mean and the elements of the diagonal are bounded as explained. The details are delicate and can be omited in a first study, since the aforementioned bound is what really matters for most proofs, but the reader is referred to [28], p. 19 for more information.

Theorem 5.3** ([28], page 19).**

Let $K$ be the $m$-th cyclotomic number field of degree $n=\phi(m)$ and $R=\mathcal{O}_{K}$ its ring of integers. Let $\alpha<\sqrt{\log n/n}$ and let $q=q(n)\geq 2$, $q\equiv 1\pmod{m}$ be a prime bounded by a polynomial in $n$ such that $\alpha q\geq\omega(\sqrt{\log n})$999A function $f:\mathbb{N}\to\mathbb{R}$ is $\omega(g)$, for $g:\mathbb{N}\to\mathbb{R}$ (denoted as $f=\omega(g)$) if for each integer $k>0$ there exists an integer $n_{0}>0$ such that for each $n\geq n_{0}$, it is $|f(n)|\geq k|g(n)|$. The notation $f(n)\geq\omega(g(n))$ means that the asymptotic behaviour of $f$ is at least as fast as $\omega(g(n))$ .. There is a polynomial time quantum reduction from $\tilde{O}(\sqrt{n}/\alpha)$-SVP on ideal lattices of $K$ to the decisional RLWE problem for $K$ and $\chi_{\alpha}$.

The proof consists of two parts: the first is a quantum reduction from worst case approximate SVP on ideal lattices to the search version of RLWE. The reduction works in general, not for just cyclotomic number fields. It uses the iterative quantum reduction for general lattices in [35] as a black box, the main effort being the classical (non-quantum) part, which requires a careful handling of the canonical embedding and a smart use of the Chinese Remainder Theorem.

The second part shows that the RLWE distribution is pseudorandom via a classical reduction from the search version, which has been shown at least as hard as SVP for ideal lattices in the first part. It uses the fact that the cyclotomic field is Galois and the fact that $q\equiv 1\pmod{n}$, namely, that the ideal $qR$ splits totally into $n$ different prime ideals in $R$.

In [34] Theorem 6.2, the authors build on the same number-theoretical kind of arguments as in [28] to prove an analogue of Theorem 9 for non-cyclotomic Galois number fields.

5.2. Equivalence between formulations

In [28], the RLWE problem is introduced via $\mathcal{O}^{\vee}_{K}/q\mathcal{O}^{\vee}_{K}$ as sample space, instead of $\mathcal{O}_{K}/q\mathcal{O}_{K}$, where $\mathcal{O}^{\vee}_{K}$ means the dual of $\mathcal{O}_{K}$ with respect to the trace map, namely:

[TABLE]

We have avoided this formulation to spare the definition of the different ideal and, no less important, for the sake of the extension of our presentation. In any case, both formulations are equivalent ([37] Theorem 2.13). By equivalence we mean that every solution for primal-RLWE can be turned in polynomial time into a solution for dual-RLWE (and viceversa, but this is immediate, since $\mathcal{O}_{K}\subseteq\mathcal{O}^{\vee}_{K}$), incurring in a noise increase which is polynomial in the number field degree.

Before speaking about the RLWE/PLWE equivalence we need to introduce a key concept: the condition number, which measures the distortion between the lattices given by the canonical embedding and the coordinate embeding. Let’s do that.

For a monic irreducible polynomial of degree $n$, $f(x)\in\mathbb{Z}[x]$ and $\theta$ a root of $f(x)$, consider again the subring $\mathbb{Z}[x]/(f(x))\cong\mathbb{Z}[\theta]\subseteq\mathcal{O}_{K}$. As lattices, $\mathbb{Z}[x]/(f(x))$ is endowed with the coordinate embedding while $\mathbb{Z}[\theta]$ is endowed with the canonical embedding inherited from $\mathcal{O}_{K}$, and the evaluation-at-$\theta$ morphism causes a distortion between both. Explicitly, the transformation between the embeddings is given by

[TABLE]

where $\theta=\theta_{1},\theta_{2},...,\theta_{n}$ are the Galois conjugates of $\theta$. As we see, the transformation $V_{f}$ is given by a Vandermonde matrix.

For any matrix $A=(a_{ij})\in M_{n\times n}(\mathbb{C})$, denote its transposed conjugate by $A^{*}$. The Frobenius norm is defined as

[TABLE]

The noise provoked by $V_{f}$ will remain controlled whenever $||V_{f}||$ and $||V_{f}^{-1}||$ remain so, and the product $||V_{f}||||V_{f}^{-1}||$ serves as a reasonable measure of this control (cf. [37] Ch. 4).

Definition 5.4**.**

The condition number of an invertible matrix $A\in\mathrm{M}_{n}(\mathbb{C})$ is defined as Cond$(A):=||A|||A^{-1}||$.

Thus, in the monogenic case, the problem of the equivalence is the problem of showing that $Cond(V_{f})=O(n^{r})$ for some $r$ independent of $n$. The non-monogenic case needs an intermediate reduction that we will not address here.

In the above mentioned paper [37], the authors introduce the framework to study the RLWE/PLWE-equivalence in general and prove it for the following family of polynomials:

Theorem 5.5** ([37], pag. 4 and Theorem 4.7).**

There is a polynomial time reduction algorithm from RLWE over $K_{f_{n,p}}$ to PLWE for $f_{n,p}(x)$ where $K_{f_{n,p}}$ is the splitting field of $f_{n,p}(x)=x^{n}+xp(x)-r$ where $n\geq 1$, $p(x)$ runs over polynomials with $deg(p(x))<n/2$ and $r$ runs over primes such that $25||p||_{1}^{2}\leq r\leq s(n)$, with $s(x)$ a polynomial. Notice that there is a trivial reduction from PLWE to RLWE.101010For $p(x)=\displaystyle\sum_{i=0}^{n}p_{i}x^{i}\in\mathbb{R}[x]$, the $1$-norm is defined as $||p||_{1}=\displaystyle\sum_{i=0}^{n}|p_{i}|$

The argument to prove this theorem is, first, to consider the family of polynomials $\phi_{n,a}(x):=x^{n}-a$, with $a\in\mathbb{Z}\setminus\{0\}$ square-free. Denoting by $K_{\phi_{n,a}}$ the splitting field of $\phi_{n,a}(x):=x^{n}-a$, the authors check in first place the equivalence for $K_{\phi_{n,a}}$ and they show, via a careful use of Rouché theorem, that when $\phi_{n,a}(x)$ is perturbed by adding another polynomial with degree smaller than $n/2$ the roots of both polynomials are close enough.

A reason to be interested in such an equivalence is that working with polynomial rings instead of rings of integers of number fields is more amenable for computer implementations. In [8], it is shown how the arithmetic of several polynomial rings leads to very efficient cryptographic designs.

5.3. The cyclotomic case

In practice, the number fields we are the most interested in cryptography are the cyclotomic number fields: they are very well understood and enjoy very nice arithmetic guatantees, like monogeneicity, which allows an amenable and efficient use for implementations. However, until recently, very little was known regarding the equivalence, apart from the power-of-two case: the ideas in [16] can be applied to show the equivalence for cyclotomic number fields of degree $2^{k}p$ or $2^{k}pq$ with $p,q$ primes and $q<p$. Besides that, the family in Theorem 10 is somehow artificially constructed, but, some of the ideas have been used by this author to give a partial proof of the equivalence in the cyclotomic case ([6]). This proof is, to our knowledge, the first given for general cyclotomic degree (but with the caveat of imposing a condition which we comment next).

Before that, let us examine first the power-of-two degree.

Theorem 5.6**.**

Let $n=2^{k}$ and $m=\phi(n)=2^{k-1}$. Then, the map $V_{\Phi_{n}}$ is a scaled isommetry. In addition, $Cond(V_{\Phi_{n}})=m$.

Proof.

To see that $V_{\Phi_{n}}$ is a scaled isometry, observe that when we multiply $V_{\Phi_{n}}$ by its conjugate transposed, the elements over the diagonal in the product matrix are identically $m$, and outside the diagonal, the element in position $(i,j)$ in the product matrix equals

[TABLE]

But since $\zeta_{i}$ are $n$-primitive roots (and so are $\overline{\zeta_{i}}$), then $\zeta_{i}^{m}=-1$ and the sum vanishes. Hence, we have that

[TABLE]

and $m^{-1/2}V_{\Phi_{n}}$ is an isometry. For the condition number, we write $V_{\Phi_{n}}^{-1}=m^{-1}V_{\Phi_{n}}^{*}$, hence $||V_{\Phi_{n}}^{-1}||=1$. By Lemma 5.3, the result follows. ∎

The main result in [6] is a polynomial bound on the condition number for cyclotomic number fields which only depends on a) the number of different primes dividing the conductor and b) the degree of the number field, and what is more important, the dependence on the degree is polynomial once the number of different prime divisors has been fixed. Let us see how.

For $n\geq 1$, denote by $rad(n)$ the product of all the different primes dividing $n$ (without exponents). For the $n$-th cyclotomic polynomial $\Phi_{n}(x)$, denote by $A(n)$ the maximum of all the coefficients in absolute value. For instance, for $n=p^{r}$, prime, $A(n)=1$, and for $n=pq$, with $p,q$ prime, all the coefficients are $0,\pm 1$, due to a classical result by Migotti, hence $A(n)=1$. Our result is as follows:

Theorem 5.7** ([6] Thm. 3.10).**

Let $n\geq 1$ and $m=\phi(n)$. If $rad(n)=p_{1}...p_{k}$, then:

[TABLE]

Proof.

First, from the very definition, one has $||V_{\Phi_{n}}||=m$. Second, we use the following identity, a proof of which can be found, for instance, in [42] Ch. 1:

[TABLE]

which yields $A(n)=A(rad(n))$. The technical core of the result is a series of upper bounds for the entries $w_{ij}$ of the inverse matrix $V_{\Phi_{n}}^{-1}$, of which the most important is:

[TABLE]

∎

Now, to obtain the polynomial bound, we need to bound $A(rad(n))$, which we do with the aid of a classical result due to Bateman:

Theorem 5.8** (Bateman, [5]).**

Let $n=p_{1}...p_{k}$ with $p_{1}<...<p_{k}$. Then

[TABLE]

We can now derive the polynomial bound:

Corollary 5.9** ([6] Cor. 3.11).**

Let $k\geq 1$ be fixed. If $n$ is the product of at most $k$ different primes, then $Cond(V_{\Phi_{n}})$ is polynomial in $n$. More in general, let $\mathcal{F}_{k}$ be a family of cyclotomic polynomials whose degree is divisible by at most $k$ different primes. Assume that $A(n)=\mathcal{O}(n^{r})$ for polynomials in $\mathcal{F}_{k}$. Then,

[TABLE]

In [6], we also give a subexponential upperbound for the condition number if we do not fix the number of primes as well as more precise upper bounds for conductor divisible up to three primes. Namely:

Theorem 5.10**.**

For $n\geq 1$ and $m=\phi(n)$, the following bounds hold for the condition number of cyclotomic polynomial $\Phi_{n}(x)$:

• a)

(**[6]** Thm. 4.1) If $n=p^{k}$ then

[TABLE]

• b)

(**[6]** Thm. 4.3) If $n=n=p^{r}q^{l}$ then

[TABLE]

• c)

(**[6]** Thm. 4.6) If $n=p^{l}q^{s}r^{t}$ then

[TABLE]

In our proofs, apart from some of the ideas from [37], and some properties from cyclotomic polynomials from [42], we have used results from analytic number theory like the aforementioned Theorem 5.8 due to Bateman and for the case of two and three primes, results by Migotti and Bang ([4]). This should highlight the strong link between ring lattice-based cryptography and number theory.

5.4. The LPR (Lyubashevsky, Peikert and Regev) RLWE-cryptosystem

Both RLWE and PLWE problems can be turned into public key cryptosystems, as we show next. We will focus in the PLWE version here. So, let $f(x)\in\mathbb{Z}[x]$ be a monic irreducible polynomial, $q$ a prime and set $\mathcal{O}=\mathbb{Z}[x]/f(x)$. Let $\chi_{\alpha}$ be an $\mathcal{O}/q\mathcal{O}$-valued discrete Gaussian (seen as taking values on $\mathbb{T}_{f}$) and as explained in the former subsection, we assume the parameter of $\chi_{\alpha}$ upper bounded entry-wise by $\alpha n^{1/4}$ with $\alpha\leq\sqrt{log(n)/n}$ and $q=q(n)$ as in 9. Take $n$ big enough so that $6\sqrt{log(n)/\sqrt{n}}<\frac{q}{4}$ (this will be used to grant the correctness of the cryptosystem).

Construction 5.11** (The PLWE cryptosystem).**

Key generation: choose $a\in\mathcal{O}/q\mathcal{O}$ uniformly at random and choose $s,e$ sampled from $\chi_{\alpha}$. The secret key will be $s$ and the public key will be the pair $(a,b=as+e)$.

• 2.

Encryption: take a plaintext $z$ consisting of a stream of bits and regard it as a polynomial in $\mathcal{O}/q\mathcal{O}$, mapping each bit to a coefficient. Choose $r,e_{1},e_{2}$ sampled from $\chi_{\alpha}$. Set $u=ar+e_{1}$ and $v=br+e_{2}+\lfloor\frac{q}{2}\rfloor z$. The cyphertext is $(u,v)$.

• 3.

Decryption: On cyphertext $(u,v)$, perform $v-us=er+e_{2}-e_{1}s+\lfloor\frac{q}{2}\rfloor z$ and round each coefficient either to zero or to $\lfloor\frac{q}{2}\rfloor$, whichever is closest mod $q$.

Proposition 5.12**.**

The PLWE cryptosystem is correct (i.e. decryption undoes encryption) and pseudorandom.

Proof.

For correctness, notice that for the chosen values of $\alpha$, $q$ and $n$, with arbitrarily large probability, the absolute values of the coefficients of $er+e_{2}-e_{1}s$ will be below $6\sqrt{log(n)/\sqrt{n}}<q/4$, so each bit of $z$ can be recovered by checking if its position in $v-us$ is less than $\lfloor q/4\rfloor$, in which case, we decrypt it as [math], and otherwise as $1$, as in the LWE scheme.

For pseudorandomness, first note that RLWE samples are pseudorandom even when $s$ is sampled from $\chi_{\alpha}$, by a transformation to the Hermite normal form. Therefore, public keys $(a,b)$ are pseudorandom and we can replace them by a uniform pair in $\mathcal{O}\times\mathbb{T}_{f}$. The observations of a passive adversary are $(a,u)$ and $(b,v)$ which are also pseudorandom, since $r$ is also sampled from $\chi_{\alpha}$. ∎

Example 5.13**.**

For around 100 bits security, current implementations use a parameter set with number field degree $n=256$, a 13-bit prime modulus $q$ and a narrow discrete Gaussian distribution with diagonal entries upper-bounded by 4.5.

5.5. A RLWE-based key exchange protocol

Next we present a key exchange protocol based on RLWE and due to Ding ([15]). Earlier protocols for key transport were proposed by Peikert ([33]) in 2012 and by Zhang in 2014. This protocol takes place between two devices typically called initiator and respondent, which we will call Alice and Bob respectively, for the sake of tradition, both of which have access to a discrete Gaussian of parameter $\alpha$ and both of which know $m=\phi(n)$, a prime $q$, the $n$-th cyclotomic polynomial $\Phi_{n}(x)$, hence the rings $\mathcal{O}=\mathbb{Z}[x]/(\Phi_{x}(x))$ and $\mathcal{O}/q\mathcal{O}$, and another polynomial $a(x)\in\mathcal{O}/q\mathcal{O}$. These data can and must be assumed to be publically known. The algorithm uses the following two functions:

Definition 5.14** (Signalling and binary deletion functions).**

Let $E:=\{-\lfloor\frac{q}{4}\rfloor,...,0,...,\lfloor\frac{q}{4}\rfloor\}$. The signalling function, denoted $Sig$, is the characteristic function of $\mathbb{F}_{q}\setminus E$, namely $Sig(v)=0$ if and only if $v\in E$, otherwise $Sig(v)=1$. The binary deletion function is defined as

[TABLE]

The signalling function signals the elements of $E$ as small, returning [math], while the binary deletion function returns [math] on pairs $(v,w=Sig(v))$ corresponding to error bits, which belong to $E$ (i.e. $w=0$ and $v=2k$). The steps of the protocol are as follows:

Alice initiates:

• 1.1

Generates two polynomials $s_{A}$ and $e_{A}$ from the discrete Gaussian distribution $\chi_{\alpha}$.

• 1.2.

Computes $p_{A}=as_{A}+2e_{A}$.

• 1.3.

Sends Bob the polynomial $p_{A}$.

• 2.

Bob responds:

• 2.1

Generates two polynomials $s_{B}$ and $e_{B}$ from the discrete Gaussian distribution $\chi_{\alpha}$.

• 2.2.

Computes $p_{B}=as_{B}+2e_{B}$.

• 2.3.

Generates $e^{\prime}_{B}$ from $\chi_{\alpha}$ and computes

[TABLE]

• 2.4.

Uses the signalling function to find $w=Sig(k_{B})$ (applying $Sig$ coefficientwise to $k_{B}$)

• 2.5

Performs $sk_{B}=Mod_{2}(k_{B},w)$

• 2. 6

Sends Alice $(p_{B},w)$.

• 3.

Alice finishes:

• 3.1

Generates $e^{\prime}_{A}$ from $\chi_{\alpha}$.

• 3.2.

Computes

[TABLE]

• 3.3.

Alice performs $sk_{A}=Mod_{2}(k_{A},w)$.

Notice that the elements $k_{A}$ and $k_{B}$ are only approximately equal, up to even errors, which allows the fuction $Mod_{2}$ to detect them. The $Sig$ function indicates the region in which each coefficient of a polynomial lies and helps to make sure that the error terms in $k_{A}$ and $k_{B}$ do not result in different mod $q$ operations.

With a carefull choice of the parameter $\alpha$, it will be $sk_{A}=sk_{B}$ with overwhelming probability. The difficulty of breaking this scheme is that from $p_{A}$ and/or $p_{B}$, which is the only thing which a passive adversary is supposed to see, to recover $s_{A}$ and $s_{B}$, the adversary must break PLWE.

Remark 5.15*.*

In November 2015, Alkim, Ducas, Pöpplemann, and Schwabe recommended the parameters $n=1024$ and $q=12289$ (see [1]). This represents a significant reduction in public key size over previous schemes, and was submitted to NIST with the name of NewHope. At the time of writing, NewHope has passed unbroken to the second round (see Section 7.3).

6. Attacks on RLWE

Detailed reports on the state of the art of attacks on the RLWE cryptosystem can be found in [18] and [32]. In [18] the authors discuss a list of open questions in algebraic number theory motivated by several attacks on RLWE. This interplay between cryptography and number theory constitutes a fruitful link which is expected to motivate a flow of results from each direction to the other.

On the other hand, in [32], a comprehensive review of the known attacks and vulnerable instantiations is carried out from a geometric viewpoint. We present, at our introductory level, only a few of these attacks and questions, working out some details. Within this subsection, we assume as usual that $K$ is a number field of degree $n$, and in the PLWE setting, that the defining polynomial $f(x)$ splits totally over $\mathbb{F}_{q}[x]$. This is unnecessary but it will simplify the exposition, while keeping the essential facts.

6.1. Reduction to LWE

Let $\mathcal{B}$ be a $\mathbb{Z}$-basis of $\mathcal{O}$ such that its reduction modulo $q$, $\overline{\mathcal{B}}$, is an $\mathbb{F}_{q}$-basis of $\mathcal{O}/q\mathcal{O}$. Given $a\in\mathcal{O}/q\mathcal{O}$, multiplication by $a$ is an $\mathbb{F}_{q}$-linear map described by a matrix $A_{a}\in\mathbb{F}_{q}^{n\times n}$ with respect to $\overline{\mathcal{B}}$. Hence, a public key $(a,b=as+e)$ has attached the pair $(A_{a},\textbf{b}=A_{a}\textbf{s}+\textbf{e})$, where s and e are, respectively, the coordinates of $s$ and $e$ with respect to $\overline{\mathcal{B}}$, which implies that one RLWE sample carries $n$ LWE samples. A first attack is based on Case 2 in Section 3.2: if the $j$-th error coordinate with respect to $\overline{\mathcal{B}}$ does not wrap around $\mathbb{Z}$, namely, if $Pr_{e_{j}\leftarrow\chi}\left\{e_{j}\not\in[\frac{1}{2},\frac{1}{2})\right\}$ is small enough, we have errorless LWE in the $j$-th row of $A_{a}$, and with enough samples we can recover $s$ with high probability.

Let now $\mathfrak{q}\subseteq\mathcal{O}_{K}$ a prime ideal above $q$ of norm $N(\mathfrak{q})=|\mathcal{O}_{K}/\mathfrak{q}|$ and let $\chi$ be a Gaussian distribution over $K_{\mathbb{R}}=K\otimes\mathbb{R}$. Given RLWE samples $(a,b=as+e)$ where $a\in\mathcal{O}_{K}/q\mathcal{O}_{K}$ and $e$ taken from $\chi$, we can reduce them modulo $\mathfrak{q}$ to obtain samples $(a^{\prime}=a\pmod{\mathfrak{q}},b^{\prime}=b\pmod{\mathfrak{q}})$, with $b^{\prime}=s^{\prime}a^{\prime}+e\pmod{\mathfrak{q}}$ with $s^{\prime}=s\pmod{\mathfrak{q}}$, hence the secret now lies in a set of size $N(\mathfrak{q})$. The following analysis is due to Peikert (cf. [32] Section 3.2) and yields a potentially successful attack when $N(\mathfrak{q})$ is not too large:

Since reduction modulo $\mathfrak{q}$ takes uniform samples onto uniform samples, if $\chi$ modulo $\mathfrak{q}$ is detectably non-uniform, we have an attack against decission RLWE.

• 2.

If $\chi$ has one or more coefficients that do not wrap around $\mathbb{Z}$, then we can attack search RLWE by reducing to errorless LWE and try arbitrarily many samples.

In all cases (both in LWE and RLWE), the insecurity of an instantiation is due to the fact that the error distribution is insufficiently well spread relative to the ring geometry, so, as in Section 3.2, the main lesson to learn here is that the error distribution should be taken with parameters as close as possible to those for which the the hardness theorem works (Theorem 9).

6.2. Reduction and attack to PLWE

A first fact to mention is that at the time of writing, there is no direct attack against RLWE, i.e., without a reduction to an attack on PLWE or LWE, as described in the previous subsection. So, all the attacks presented here attemp at breaking PLWE first and then to reduce RLWE to PLWE.

Theorem 6.1** (Elias et al. [18]).**

If $K$ satisfies the following six conditions, there is a polynomial time attack to the search version of the associated RLWE scheme:

$K=\mathbb{Q}(\beta)$* is Galois of degree $n$.*

• 2.

The ideal $(q)$ splits totally in $\mathcal{O}_{K}$.

• 3.

$K$* is monogenic, i.e, $\mathcal{O}_{K}=\mathbb{Z}[\beta]$.*

• 4.

The transformation between the canonical embedding of $K$ and the power basis representation of $K$ is given by a scaled orthogonal matrix.

• 5.

If $f$ is the minimal polynomial of $\beta$, then $f(1)\equiv 0\pmod{q}$ .

• 6.

The prime $q$ can be chosen suitably large.

The first two conditions are sufficient for the RLWE search-to-decision reduction in the case where $q\nmid\left[\mathcal{O}_{K}:\mathbb{Z}[\beta]\right]$, which is implied by the third condition. The third and fourth conditions are sufficient for the RLWE-to-PLWE reduction; indeed, the fourth condition can be relaxed to require that the condition number of the matrix describing the transformation between the embeddings is at most polynomial in $n$, as we discussed in the previous section.

Finally, the last two conditions are sufficient for the attack on PLWE. Unfortunately (for the attacker’s point of view), it is difficult to construct number fields satisfying all six conditions simultaneously. Next, we explain the attack on PLWE if 5 and 6 hold.

Setting a s usual $\mathcal{O}=\mathbb{Z}[x]/(f(x))$, fix a public key $(a(x),b(x))\in\mathcal{O}/q\mathcal{O}\times\mathbb{T}_{f}$ and a secret key $s(x)\in\mathcal{O}/q\mathcal{O}$, i.e $b(x)=a(x)s(x)+e(x)$ with $e(x)$ sampled from the discrete Gaussian $\chi$.

For each root $\theta\in\mathbb{F}_{q}$ of $f(x)$, consider the projection $\pi_{\theta}:\mathcal{O}/q\mathcal{O}\to\mathbb{F}_{q}$ given by $p(x)\mapsto p(\theta)$. By short vector in $\mathcal{O}/q\mathcal{O}$ we refer to those with small coefficients, which in practice means that these are upper bounded, in absolute value, by $q/4$. For suitable parameter, these short vectors lie inside a prescribed region with non-negligible probability and are easy to recognise. However, for a pair $(a(x),b(x))$, it is difficult to check if it exists $r(x)$ and a short vector $e(x)$ such that $b(x)=a(x)r(x)+e(x)$, in which case the attacker would guess that $s(x)=r(x)$. The reason is that there are $q^{n}$ possibilities for $s(x)$ to test, which is prohibitive.

By contrast, in a small ring like $\mathbb{F}_{q}$, it is easy to examine the possibilities for $s(\theta)$ exhaustively: we can loop through the possibilities for $s(\theta)$, obtaining for each guess $s_{\theta}$, the putative value $e(\theta)=b(\theta)-a(\theta)s_{\theta}$. The Decision Problem for PLWE, then, is solved as soon as we can recognize the set of $e(\theta)$ that arise from the Gaussian with high probability.

Again, this is difficult in general, but if 5 holds, i.e., if $\theta=1$ is a root of $f(x)$, the attacker has a chance:

Let us denote by $\mathcal{S}\subseteq\mathcal{O}/q\mathcal{O}$ the subset of polynomials that are produced by the Gaussian with non-negligible probability. This is a small set, due to the parameter choice. However, $\mathbb{F}_{q}$ is also a much smaller set than $\mathcal{O}/q\mathcal{O}$ and one expects that generically, $\pi_{\theta}(\mathcal{S})=\mathbb{F}_{q}$ or something very close. One says that in this case $\mathcal{S}$ smears across all of $\mathbb{F}_{q}$.

But we are supposing that $\theta=1$. The polynomials $g(x)\in\mathcal{S}$ have small coefficients, and hence have small images $g(1)\in\mathbb{F}_{q}$. This is simply because $n$ is much smaller than $q$, due to 6, so that the sum of $n$ small coefficients is still small modulo $q$. These ideas can be turned into the following algorithm:

Algorithm 6.2**.**

Suppose $f(1)\equiv 0\pmod{q}$. The input is a collection of pairs $\left\{(a_{i}(x),b_{i}(x))\in\mathcal{O}/q\mathcal{O}\times\mathbb{T}_{f}\right\}_{i=1}^{m}$, where each sample is drawn either uniformly at random or from the PLWE distribution . The output is to decide, for each sample, from which distribution is taken, with non-negligible probability. The algorithm is as follows:

• 1

For $i=1$ to $m$ do

• Set $S=\mathbb{F}_{q}$. This is the first guess for $\pi_{1}(\mathcal{S})$, which will be updated after each iteration.

• 2

For each $s\in S$ do

• 2.1

Compute $e_{i}:=b_{i}(1)-sa_{i}(1)$;

• 2.2

If $e_{i}$ is not small in absolute value modulo q, then conclude that the sample cannot be valid for $s$ with nonnegligible probability, and update $S=S\setminus\left\{s\right\}$;

• Next $s$;
• 3

If $S=\emptyset$, conclude that the sample was random, otherwise declare the sample as valid;

• Next i;

Remark 6.3*.*

Notice that in the inner loop, if the sample is valid, then $e_{i}=e_{i}(1)=\displaystyle\sum_{j=1}^{n}e_{ij}$, and if $\sigma$ is the variance of $\chi$ (which is spherical with respect to our embedding, fixed beforehand), then, $e_{i}$ is sampled from a discrete Gaussian distribution of zero mean and parameter $\sqrt{n}\sigma$. The region of non-negligible probability for this Gaussian, can be taken to be

[TABLE]

Notice that the cyclotomic cases are protected against this attack: $\theta=1$ is never a root modulo $q$ of a cyclotomic polynomial of degree greater than 1 when $q$ is sufficiently large. However, with minor modifications, it is possible to extend the former attack to the case where $\theta$ has small order modulo $q$. Indeed, denote by $r$ the order of $\theta$ modulo $q$. For an unknown polynomial $e(x)$, to decide from a known value $e(\theta)$ if $e(x)$ is sampled from a Gaussian distribution in a similar fashion as in Remark 6.3 is more complicated. However, one can still take advantage of a small $r$, as we explain next.

For $e(x)=\displaystyle\sum_{i=0}^{n}e_{i}x^{i}$, set $n=rM+l$ with $0\leq l\leq r-1$. Define $e_{Mr+k}=0$ for $0\leq k\neq l\leq r-1$ and write

[TABLE]

If $e(x)$ is sampled from a multivariate Gaussian with variance very close to $\sigma^{2}$, then each term $\sum_{j=0}^{M}e_{jr+i}$ is sampled from a 1-dimensional Gaussian of variance very close to $(M+1)\sigma^{2}$. This defines a smallness region , which can be pre-stored as a look-up table

[TABLE]

to look at, in order to guess tentative values of $e(\theta)$. With this observation, we can derive the following algorithm:

Algorithm 6.4**.**

Suppose $f(\theta)\equiv 0\pmod{q}$. The input is a collection of pairs $\left\{(a_{i}(x),b_{i}(x))\in\mathcal{O}/q\mathcal{O}\times\mathbb{T}_{f}\right\}_{i=1}^{m}$, where each sample is drawn either uniformly at random or from the PLWE distribution . The output is to decide, for each sample, from which distribution is taken, with non-negligible probability. The algorithm is as follows:

• 1

For $i=1$ to $m$ do

• Set $S=\mathbb{F}_{q}$;

• 2

For each $s\in S$ do

• 2.1

Compute $e_{i}:=b_{i}(\theta)-sa_{i}(\theta)$;

• 2.2

If $e_{i}\not\in\Lambda$, then conclude that the sample cannot be valid for $s$ with nonnegligible probability, and update $S=S\setminus\left\{s\right\}$;

• Next $s$;
• 3

If $S=\emptyset$, conclude that the sample was random, otherwise declare the sample as valid;

• Next i;

Remark 6.5*.*

The third attack described in [18] is based on the size of the residue of $e_{i}(\theta)$ modulo $q$. Although here the errors may take on all values in $\mathbb{F}_{q}$, it may still be possible to notice if the distribution of samples is not uniform. The attacking algorithm is built on a delicate probability bound in the case that $\theta\neq\pm 1$ and the order of $\theta$ modulo $q$ is not small. For example, this third attack is successful for any irreducible polynomial of degree $n=2^{6}$, with $q$ of the order of $2^{50}$, $\sigma=8$ and $\theta=2$.

6.3. Some number theoretical open questions motivated by attacks on PLWE

As seen before, being simultaneously Galois and monogenic, having $\theta=1$ as a root of the minimal polynomial modulo $q$ (or some other root of small order) and the non-smearing under the evaluation map $\pi_{\alpha}$ of the set of small vectors in $\mathcal{O}/q\mathcal{O}$ can be regarded as weakness conditions to build a RLWE-based cryptosystem. We give next a list of number theoretical problems which are motivated by the search of security in RLWE-based primitives and are still open, up to date.

Question 6.6**.**

Are there any fields of cryptographic size (i.e. $n\geq 2^{10}$) which are Galois and monogenic, other than the cyclotomic number fields and their maximal real subfields? How can one construct such fields explicitly? Is it possible to test algorithmically both features?

Notice that for fields of cryptographic size, the discriminant is too big to test whether or not it is square free, hence to decide if it is monogenic. An algorithmic approach which circumvects this testing is not available at the time of writing. Although for fields of small degree, a complete characterisation may be feasible (sufficient and necessary conditions for a cubic number field have been found by Gras and Archinard), the situation is much different for large degree fields. For instance, cyclic extensions tend to be non-monogenic:

Theorem 6.7**.**

Any cyclic extension $K$ of prime degree $n\geq 5$ is non-monogenic except for the maximal real subfield of the $(2l+1)$-th cyclotomic field.

Another result in this direction is as follows:

Theorem 6.8**.**

Let $n\geq$5 be relatively prime to $2,3$. There are only finitely many abelian number fields of degree $n$ that are monogenic.

Question 6.9**.**

Let $\theta$ be a root of $f(x)$ modulo $q$. For which subsets $\mathcal{S}\subseteq R_{q}$ it is $\pi_{\theta}(\mathcal{S})=\mathbb{F}_{q}$? Or, at least, can one determine the conditions for non-smearing, like in the case when $\theta=1$ and $\mathcal{S}$ is a set of small vectors in $\mathcal{O}/q\mathcal{O}$?

Finally, as seen before, polynomials with roots of small order modulo $q$ should be avoided. Again, cyclotomic polynomials are safe for attacks built on small order roots, as their roots have maximal order. The problem here is as follows:

Question 6.10**.**

For random polynomials $f(x)$ and random primes $q$ for which $f(x)$ has a root $\alpha$ modulo $q$, what can one say about the order of $\alpha$ modulo $q$?

A special instance of this question is this well-known open problem:

Conjecture 6.11** (Artin).**

Each $a\in\mathbb{Z}$ is a primitive root modulo infinitely many primes $q$ such that $a$ is not a perfect square or $-1$ modulo $4$. In fact the set of primes for which $a$ is a primitive root has density

[TABLE]

7. Ring Learning With Errors signatures, homomorphic encryption and some NIST figures

7.1. RLWE Digital Signatures

We present here a 2012 scheme by Gunyesu, Lyubashevsky and Poppelman (GLP [21]). It has some advantages over more recent efficient post-quantum digital signature proposals such as BLISS and Ring-TESLA, but although not broken, GLP as originally proposed is no longer considered to offer strong levels of security. Building on GLP, A. Chopra presented GLYPH in 2017 another RLWE digital signature schemes: a special instantiation of GLP together with certain modification in the compressing and hash functions,. It is described in [13], where a throughout analysis on its resistance to signature forgery, key-recovery, exhaustive and meet-in-the middle attacks is carried out. However, the main ideas on how to use RLWE for secure signature is already contained in GLP, hence as a first contact with the topic we have chosen this scheme.

We use the same terminology and notions as in Definition 2.3 and subsequent discussion, to which we refer the reader. This scheme uses PLWE in the cyclotomic ring $R_{q}=\mathbb{F}_{q}[x]/(\Phi_{n}(x))$ with $q$ an odd prime congruent to $1$ mod $4$ or a power of $2$.

A first difference to mention here is that instead of discrete Gaussians, the coefficients of small polynomials are sampled uniformly from $\left\{-1,0,1\right\}$ modulo $q$. This version of RLWE, is called the Compact Knapsack Problem over ideal lattices, whose decisional version backs GLP. Secondly, the lengths of signatures must not exceed a prescribed parameter $n$, regardless of the size of the message to sign. To attain this, the scheme uses a) a hash function $H$111111A hash function is $H:\cup_{r\geq 1}\mathbb{F}_{2}^{r}\to\mathbb{F}_{2}^{\kappa}$ with fixed $\kappa$. In GLP/GLYPH, a common choice for $H$ is the function SHA256., which accepts bit strings of arbitrary length and returns bit strings of bounded length, and b) a function $F$ from the target of $H$ to the set of polynomials of degree $m=\phi(n)$ with exactly $k$ of their coefficients having absolute in $\pm 1$ and the rest being zero such that the probability of mapping two hash outputs to the same sparse element is less than $1/2^{\lambda}$, where $\lambda$ is a security parameter.

Hence, the procedure has a sampling rejection step, which ensures that the output signature is not exploitably correlated with the signer’s secret key values: if the infinity norm of a signature polynomial exceeds a fixed bound, $\beta$, that polynomial will be discarded and the signing process starts again. This process will be repeated until the infinity norm of the signature polynomial is less than or equal $\beta=k-1$, where $k$ is the number of non-zero coefficients allowed in acceptable polynomials.

Third, it is necessary to fix an injective map $I:R_{q}\to\mathbb{F}_{2}^{N}$, with $N\gg 1$. Last, the maximum degree of the signature polynomials will be $m-1$ so that there are $m$ coefficients. Typical values for $m$ are 512, and 1024. For $m=1024$, GLYPH sets $q=59393$, $b=16383$ and $k=16$. The scheme is as follows:

Key generation:

• 1.1

Generate, uniformly, two small polynomials $s(x)$ and $e(x)$. The pair $(s(x),e(x))$ is the private key.

• 1.2

Compute $t(x)=a(x)s(x)+e(x)$, with $a(x)$ chosen uniformly at random. The public key is $(a(x),t(x))$.

• 2.

Signature generation:

• 2.1

Input: a message $m(x)\in R_{q}$ and $(a(x),e(x),s(x))$

• 2.2

Generate two small polynomials $y_{1}(x)$ and $y_{2}(x)$.

• 2.3

Compute $w(x)=a(x)y_{1}(x)+y_{2}(x)$.

• 2.4

Set $\omega=I(w(x))$ and $\mu=I(m(x))$.

• 2.5

Compute $c(x)=F(H(\omega||\mu))$. The symbol $||$ denotes concatenation of strings.

• 2.6

Compute $z_{1}(x)=s(x)c(x)+y_{1}(x)$ and $z_{2}(x)=e(x)c(x)+y_{2}(x)$.

• 2.7

While the infinity norms of $z_{1}(x)$ or $z_{2}(x)$ is greater than $\beta$ go to step 2.1.

• 2.8

Output: $(c(x),z_{1}(x),z_{2}(x))$. Transmit the signature along with the message $m(x)$. Notice that we are not discussing here signatures of encrypted messages, which is a more sophisticated cryptographic functionality.

• 3.

Signature verification:

• 3.1

Input: $(c(x),z_{1}(x),z_{2}(x),m(x))$.

• 3.2

Verify that the infinity norms of $z_{1}(x)$ and $z_{2}(x)$ do not exceed $\beta$. If not, reject the signature.

• 3.3

Compute $w^{\prime}(x)=a(x)z_{1}(x)+z_{2}(x)-t(x)c(x)$.

• 3.4

Set $\omega^{\prime}=I(w^{\prime}(x))$ and $\mu=I(m(x))$.

• 3.5

Compute $c^{\prime}(x)=F(H(\omega^{\prime}||\mu))$.

• 3.6

Output: If $c^{\prime}(x)\neq c(x)$ reject the signature, otherwise accept the signature as valid.

Notice that $a(x)z_{1}(x)+z_{2}(x)-t(x)c(x)=w(x)$, hence $c^{\prime}(x)=c(x)$ if the signature is not tampered, hence the scheme is correct.

Remark 7.1*.*

The private key $(s(x),e(x))$ can be represented in $2n\log_{2}(3)$ bits of memory, and the public key $a(x)s(x)+e(x)$ can be represented in $n\log_{2}(q)$ bits, which makes GLP feasible for practical implementations.

Remark 7.2*.*

Both in [13] and in the earlier [21], the application of the hash function $H$ may result unclear for a non experienced reader. The reason is that in what we have labeled steps 2.5 and 3.4, both schemes apply $H$, defined over a binary domain, to inputs which are not binary. This point is probably not taken very seriously by the experts, for all what matters is that $H$ is a collision resistant function and, more important, that when it comes to comparing $H(\omega||\mu)$ with $H(\omega^{\prime}||\mu)$, they can only be equal with overwhelming probability if and only if $\omega=\omega^{\prime}$. But of course one needs to make binary the arguments $w(x)$ and $m(x)$ of $H$, and this is why we have fixed the innaccuracy by resourcing to a function $I$ which injectively outputs binary strings on polynomial inputs and defined $\omega=I(w(x))$ and $\mu=I(m(x))$. In [21] page 6 it is discussed how forging a signature implies finding a collision on $H$.

7.2. RLWE Homomorphic encryption

Homomorphic encryption was first introduced by Rivest, Adleman and Dertouzos back in the 70’s ([36]), where they raised the problem of constructing a fully homomorphic scheme (a privacy homomorphism, using their phraseology). This problem was solved by Craig Gentry in 2009 in its seminal paper [20], by using ideal lattices and (essentially) a modified version of PLWE. The possibility of cheap cloud computing and distributed storage has drastically changed how business and individuals process their data and although traditional encryption like AES are very fast, to perform even simple analytics on encrypted data requires either the cloud server to access the secret keys, leading to security concerns or to download the data, decrypt and operate, which is costly. Homomorphic encryption is the solution to this challenge.

Areas where homomorphic encryption has applications include e-voting systems ([12]) and processing or computing on encrypted health, financial or other kinds of sensitive data on external servers like cloud or distributed devices.

Homomorphic and fully homomorphic encryption(FHE) has already been introduced here in Definition 2.5, and Example 2.6 provides an example of a homomorphic but not non-fully homomorphic encryption scheme.

Examples 7.3**.**

Another example of homomorphic encryption is the LWE cryptosystem. To avoid entering into technicalities, choose an odd prime $q$, so that $2$ is invertible in $\mathbb{F}_{q}$. We observe that a LWE-oracle is essentially homomorphic: given a private key $s\in\mathbb{F}_{q}^{n}$, two uniformly sampled vectors $a_{1},a_{2}\in\mathbb{F}_{q}^{n}$ and two errors $e_{1},e_{2}$ taken from a $\mathbb{T}$-valued random variable $\chi$, of [math]-mean and variance $\sigma^{2}$, we se that

[TABLE]

Essentially means that the sum $e_{1}+e_{2}$ is taken from the variable $2\chi$, which has also [math]-mean but variance $2\sigma^{2}$. This easy observation allows to define a homomorphic cryptosystem, which is a minor modification of Regev’s scheme presented in Section 3. However, if we keep adding encryption of data, this results in amplifying the error of the final encrypted data, and when this error passes a certain threshold, decryption becomes impossible. This implies that the length of the arithmetic circuit must be known beforehand and the parameters must be set to meet this feature.

An analogous analysis as in the previous example shows that RLWE oracles are also essentially homomorphic both in the additive and multiplicative structure, where, again, essentially means that the error of the sum/product is an amplification of the individual errors of the encrypted data, hence, RLWE provides a FHE scheme, as we see next.

Definition 7.4** (The BGV cryptosystem ([11], Section 3.4)).**

Denote $R=\mathbb{Z}[x]/(\Phi_{n}(x))$, with $\Phi_{n}(x)$ the $n$-th cyclotomic polynomial and set $R_{N}:=R/NR$. Consider as the space of plaintexts the ring $R_{p^{r}}$, for fixed $r$ and prime $p$. The scheme is parametrized by a sequence of decreasing moduli $q_{L}>q_{L-1}>...>q_{0}$ such that $q_{i}\leq\min\left\{\sqrt{q_{i+1}},\frac{q_{i+1}}{2}\right\}$ and an $i$-th level ciphertext is a vector $(v,w)\in R_{q_{i}}^{2}$.

Key generation: Chose $s\in R$ by sampling from a discrete Gaussian such that the probability of the set $\left\{0,\pm 1\right\}^{\phi(n)}$ is close enough to $1$.

• 2.

Encryption/Decryption: A plaintext $\alpha\in R_{p^{r}}$ is encrypted to $E(s,\alpha)=(p_{0},p_{1})\in R_{q_{i}}^{2}$ if and only if $p_{0}+sp_{1}$ modulo $q_{i}$ equals $\alpha+p^{r}\epsilon$ in $R$ with $||\epsilon||<q_{i}/p^{r}$ for some $i\in\{0,...,L\}$.

Observe that adding or multiplying two i-level ciphertexts results in an $i+1$-level ciphertext, so computations over level $L$-ciphertexts are not allowed, as they cannot be decrypted. Several recent refinements to this scheme have been proposed ([22]) and the topic is still under research.

A number of open-source implementations of homomorphic encryption are available. For instance, HELib, a widely used library from IBM that implements the BGV cryptosystem, SEAL, a Microsoft version, $\Lambda O\lambda$ (pronounced LOL), a Haskell library for ring-based lattice cryptography that supports FHE or PALISADE, a general lattice encryption library. it is possible to add new implementations after public review by contacting contact@HomomorphicEncryption.org. In sum, homomorphic encryption is already ripe for mainstream use but the lack of standardisation makes difficult to decide on which implementation to use.

7.3. NIST figures

In 2017, the American National Institute of Standards and Technology (NIST), launched an open call (https://csrc.nist.gov/Projects/Post-Quantum-Cryptography) to evaluate and standardize one or more quantum-resistant public-key cryptographic algorithms. In their own words:

The question of when a large-scale quantum computer will be built is a complicated one. While in the past it was less clear that large quantum computers are a physical possibility, many scientists now believe it to be merely a significant engineering challenge. Some engineers even predict that within the next twenty or so years sufficiently large quantum computers will be built to break essentially all public key schemes currently in use. Historically, it has taken almost two decades to deploy our modern public key cryptography infrastructure. Therefore, regardless of whether we can estimate the exact time of the arrival of the quantum computing era, we must begin now to prepare our information security systems to be able to resist quantum computing.

The deadline for submission was November 30, 2017. The total number of submissions (for encryption, key exchange and signatures) was 71. In the first round, 14 submissions were attacked or withdrawn. Of the remaining 57, some of the proposals (mainly code-based ones) did merge. Taking this into account, 50 proposals remained unbroken. Some of them were found to have non-fatal attacks, which can be avoided with a right choice of parameters, also in the first round.

Of these 50 proposals: 9 were code-based, 21 lattice-based, 2 hash-based , 9 multivariate-based, 1 supersingular isogeny Diffie-Hellman (SIDH) key-exchange protocol. The remaining 8 submissions were hybrid or based on problems such as random walks (1), braids (2), Chebychev polynomials (1) or hypercomplex numbers (1).

In January 2019, a second round started and taking into account the attacks and feedback to the surviving proposals of the first round, 26 proposals have passed this new sieve. The numbers of remaining proposals (at the time of writing) within each category are listed in the following table, constructed out of data from https://www.safecrypto.eu/pqclounge/: