Embedding Integer Lattices as Ideals into Polynomial Rings

TL;DR

This paper explores the algebraic structure of ideal lattices, showing they can be embedded into infinitely many polynomial rings, and introduces an efficient algorithm to verify and identify such embeddings, improving upon previous methods.

Contribution

It presents a new algorithm for verifying ideal lattice embeddings into polynomial rings with better complexity and addresses flaws in prior algorithms.

Findings

Ideal lattices can be embedded into infinitely many polynomial rings.

The proposed algorithm has a time complexity of O(n^3 B (B + log n)).

It corrects flaws in the previous algorithm by Ding and Lindner.

Abstract

Many lattice-based crypstosystems employ ideal lattices for high efficiency. However, the additional algebraic structure of ideal lattices usually makes us worry about the security, and it is widely believed that the algebraic structure will help us solve the hard problems in ideal lattices more efficiently. In this paper, we study the additional algebraic structure of ideal lattices further and find that a given ideal lattice in a polynomial ring can be embedded as an ideal into infinitely many different polynomial rings by the coefficient embedding. We design an algorithm to verify whether a given full-rank lattice in $\mathbb{Z}^n$ is an ideal lattice and output all the polynomial rings that the given lattice can be embedded into as an ideal with time complexity $\mathcal{O}(n^3B(B+\log n)$, where $n$ is the dimension of the lattice and $B$ is the upper bound of the bit length of the entries of the input lattice basis. We would like to point out that Ding and Lindner proposed an algorithm for identifying ideal lattices and outputting a single polynomial ring that the input lattice can be embedded into with time complexity $\mathcal{O}(n^5B^2)$ in 2007. However, we find a flaw in Ding and Lindner's algorithm that causes some ideal lattices can't be identified by their algorithm.