RLWE and PLWE over cyclotomic fields are not equivalent

TL;DR

This paper demonstrates that RLWE and PLWE problems over cyclotomic fields are fundamentally different by showing that reducing one to the other significantly amplifies noise, with implications for cryptographic security.

Contribution

It proves the non-equivalence of RLWE and PLWE over cyclotomic fields and establishes a lower bound on the condition number of related Vandermonde matrices.

Findings

RLWE and PLWE are not equivalent over cyclotomic fields

Reducing one problem to the other increases noise super-polynomially

Lower bound on Vandermonde matrix condition number for infinitely many n

Abstract

We prove that the Ring Learning With Errors (RLWE) and the Polynomial Learning With Errors (PLWE) problems over the cyclotomic field $\mathbb{Q}(\zeta_n)$ are not equivalent. Precisely, we show that reducing one problem to the other increases the noise by a factor that is more than polynomial in $n$. We do so by providing a lower bound, holding for infinitely many positive integers $n$, for the condition number of the Vandermonde matrix of the $n$th cyclotomic polynomial.