[Paper Review] On Ring Learning with Errors over the Tensor Product of Number Fields

Alberto Pedrouzo-Ulloa, Juan Ramón Troncoso-Pastoriza+1 more|arXiv (Cornell University)|Jul 18, 2016

Coding theory and cryptography4 citations

TL;DR

This paper introduces and formalizes the Multivariate Ring Learning with Errors (m-RLWE) problem over the tensor product of number fields, generalizing standard RLWE to multidimensional algebraic structures. It establishes worst-case to average-case hardness reductions, proving m-RLWE's security relies on the hardness of lattice problems in ideal lattices, enabling more efficient cryptographic schemes for multidimensional signals with reduced cipher expansion.

ABSTRACT

The "Ring Learning with Errors" (RLWE) problem was formulated as a variant of the "Learning with Errors" (LWE) problem, with the purpose of taking advantage of an additional algebraic structure in the underlying considered lattices; this enables improvements on the efficiency and cipher expansion on those cryptographic applications which were previously based on the LWE problem. In Eurocrypt 2010, Lyubashevsky et al. introduced this hardness problem and showed its relation to some known hardness problems over lattices with a special structure. In this work, we generalize these results and the problems presented by Lyubashevsky et al. to the more general case of multivariate rings, highlighting the main differences with respect to the security proof for the RLWE counterpart. This hardness problem is denoted as "Multivariate Ring Learning with Errors" ($m$-RLWE or multivariate RLWE) and we show its relation to hardness problems over the tensor product of ideal lattices. Additionally, the $m$-RLWE problem is more adequate than its univariate version for cryptographic applications dealing with multidimensional structures.

Motivation & Objective

• To generalize the Ring Learning with Errors (RLWE) problem to multivariate polynomial rings using tensor products of number fields.
• To address the inefficiency and high cipher expansion in existing RLWE and LWE schemes when handling multidimensional signals.
• To provide a formal security reduction from worst-case lattice problems to the average-case m-RLWE problem, ensuring cryptographic soundness.
• To demonstrate that m-RLWE supports more efficient homomorphic encryption and signal packing than univariate RLWE for applications in secure signal processing.

Proposed method

• Formalizes the m-RLWE problem over the tensor product of number fields, extending the algebraic structure beyond univariate polynomials.
• Adapts worst-case to average-case reduction techniques from Lyubashevsky et al. to the multivariate setting using ideal lattices.
• Employs spherical noise and Gaussian sampling techniques to construct indistinguishability reductions, leveraging properties of dual lattices and quotient rings.
• Uses a transformation-based reduction with multiple samples to distinguish between distributions of increasing dimensionality, relying on statistical distance bounds.
• Applies Markov and concentration arguments to show non-negligible acceptance probability differences under specific noise parameters.
• Derives a key parameter condition: ξ = α(nl/log(nl))^{1/4}, ensuring the reduction’s statistical security.

Experimental results

Research questions

• RQ1 How can the RLWE problem be generalized to support multidimensional algebraic structures using tensor products of number fields?
• RQ2 What are the security implications of extending RLWE to multivariate rings, and how does it compare to univariate RLWE in terms of hardness assumptions?
• RQ3 Can worst-case lattice problems be reduced to the average-case m-RLWE problem in the multivariate setting, ensuring cryptographic security?
• RQ4 What parameter choices ensure the statistical indistinguishability of m-RLWE samples from uniform distributions in the multivariate ring setting?

Key findings

• The m-RLWE problem is shown to be as hard as solving worst-case lattice problems in the ideal lattices of the tensor product of number fields.
• A worst-case to average-case reduction is established for m-RLWE, proving that solving m-RLWE is as hard as solving the corresponding worst-case problem.
• The security reduction relies on a parameter condition ξ = α(nl/log(nl))^{1/4}, which ensures the statistical distance between distributions remains bounded.
• The m-RLWE framework supports efficient packing of multiple signals into a single ciphertext, reducing cipher expansion in multidimensional signal processing applications.
• The proposed framework enables more efficient homomorphic encryption schemes for secure signal processing, outperforming both univariate RLWE and Paillier in terms of key and ciphertext size.
• No known attacks on m-RLWE currently exploit the multivariate structure more effectively than those on standard RLWE, supporting its security assumption.