Minimum distance between polynomials in ring-LWE
up vote
4
down vote
favorite
Let $R_q=mathbb{Z}_q[x]/langle f(x)rangle$ where $f(x)=x^n+1$, as in the ring-LWE problem.
Let $a(x)$ be chosen uniformly at random from $R_q$.
Question: Is there any theorem that lower bounds the distance between any two polynomials of the form $a(x)s_1(s)$ and $a(x)s_2(x)$?
In other words, what is the value of $d$ such that $$||a(x)s_1(x)-a(x)s_2(x)||geq d$$ except with negligible probability, for any two polynomials $s_1(x),s_2(x)in R_q$ and where $||cdot||$ is the usual $L_2$ norm?
lattice-crypto lwe ring-lwe
|
show 1 more comment
up vote
4
down vote
favorite
Let $R_q=mathbb{Z}_q[x]/langle f(x)rangle$ where $f(x)=x^n+1$, as in the ring-LWE problem.
Let $a(x)$ be chosen uniformly at random from $R_q$.
Question: Is there any theorem that lower bounds the distance between any two polynomials of the form $a(x)s_1(s)$ and $a(x)s_2(x)$?
In other words, what is the value of $d$ such that $$||a(x)s_1(x)-a(x)s_2(x)||geq d$$ except with negligible probability, for any two polynomials $s_1(x),s_2(x)in R_q$ and where $||cdot||$ is the usual $L_2$ norm?
lattice-crypto lwe ring-lwe
Hello. It is a good question, but the $L_2$ norm is defined over vectors and it is not clear how you are embedding the polynomials in a vector space. Are you just representing the polynomials as vectors with their coefficients? (So, for instance, $2x^3 -1$ becomes the vector $(2, 0, 0, -1)$).
– Hilder Vitor Lima Pereira
9 hours ago
Yes, I am thinking of the canonical embedding
– P.B.
9 hours ago
I found some relative concept in your question and AG codes, I suspect the minimum distance for a Goppa code is a simple answer for your question. The minimum distance for Goppa codes is $d_{min}=n-k-gamma-1$. $gamma$ is the genus of the algebraic curve. We can easily find it for RS codes that the curve is a line and the genus is equal to zero so the minimum distance for them is $d_{min}=n-k-1$.
– Mahdi Sedaghat
9 hours ago
Well, the canonical embedding is the one that uses isomorphisms to embed the polynomials. The one I've described is the coefficient embedding...
– Hilder Vitor Lima Pereira
9 hours ago
Sorry. I mean the coefficient embedding then
– P.B.
8 hours ago
|
show 1 more comment
up vote
4
down vote
favorite
up vote
4
down vote
favorite
Let $R_q=mathbb{Z}_q[x]/langle f(x)rangle$ where $f(x)=x^n+1$, as in the ring-LWE problem.
Let $a(x)$ be chosen uniformly at random from $R_q$.
Question: Is there any theorem that lower bounds the distance between any two polynomials of the form $a(x)s_1(s)$ and $a(x)s_2(x)$?
In other words, what is the value of $d$ such that $$||a(x)s_1(x)-a(x)s_2(x)||geq d$$ except with negligible probability, for any two polynomials $s_1(x),s_2(x)in R_q$ and where $||cdot||$ is the usual $L_2$ norm?
lattice-crypto lwe ring-lwe
Let $R_q=mathbb{Z}_q[x]/langle f(x)rangle$ where $f(x)=x^n+1$, as in the ring-LWE problem.
Let $a(x)$ be chosen uniformly at random from $R_q$.
Question: Is there any theorem that lower bounds the distance between any two polynomials of the form $a(x)s_1(s)$ and $a(x)s_2(x)$?
In other words, what is the value of $d$ such that $$||a(x)s_1(x)-a(x)s_2(x)||geq d$$ except with negligible probability, for any two polynomials $s_1(x),s_2(x)in R_q$ and where $||cdot||$ is the usual $L_2$ norm?
lattice-crypto lwe ring-lwe
lattice-crypto lwe ring-lwe
asked 10 hours ago
P.B.
1356
1356
Hello. It is a good question, but the $L_2$ norm is defined over vectors and it is not clear how you are embedding the polynomials in a vector space. Are you just representing the polynomials as vectors with their coefficients? (So, for instance, $2x^3 -1$ becomes the vector $(2, 0, 0, -1)$).
– Hilder Vitor Lima Pereira
9 hours ago
Yes, I am thinking of the canonical embedding
– P.B.
9 hours ago
I found some relative concept in your question and AG codes, I suspect the minimum distance for a Goppa code is a simple answer for your question. The minimum distance for Goppa codes is $d_{min}=n-k-gamma-1$. $gamma$ is the genus of the algebraic curve. We can easily find it for RS codes that the curve is a line and the genus is equal to zero so the minimum distance for them is $d_{min}=n-k-1$.
– Mahdi Sedaghat
9 hours ago
Well, the canonical embedding is the one that uses isomorphisms to embed the polynomials. The one I've described is the coefficient embedding...
– Hilder Vitor Lima Pereira
9 hours ago
Sorry. I mean the coefficient embedding then
– P.B.
8 hours ago
|
show 1 more comment
Hello. It is a good question, but the $L_2$ norm is defined over vectors and it is not clear how you are embedding the polynomials in a vector space. Are you just representing the polynomials as vectors with their coefficients? (So, for instance, $2x^3 -1$ becomes the vector $(2, 0, 0, -1)$).
– Hilder Vitor Lima Pereira
9 hours ago
Yes, I am thinking of the canonical embedding
– P.B.
9 hours ago
I found some relative concept in your question and AG codes, I suspect the minimum distance for a Goppa code is a simple answer for your question. The minimum distance for Goppa codes is $d_{min}=n-k-gamma-1$. $gamma$ is the genus of the algebraic curve. We can easily find it for RS codes that the curve is a line and the genus is equal to zero so the minimum distance for them is $d_{min}=n-k-1$.
– Mahdi Sedaghat
9 hours ago
Well, the canonical embedding is the one that uses isomorphisms to embed the polynomials. The one I've described is the coefficient embedding...
– Hilder Vitor Lima Pereira
9 hours ago
Sorry. I mean the coefficient embedding then
– P.B.
8 hours ago
Hello. It is a good question, but the $L_2$ norm is defined over vectors and it is not clear how you are embedding the polynomials in a vector space. Are you just representing the polynomials as vectors with their coefficients? (So, for instance, $2x^3 -1$ becomes the vector $(2, 0, 0, -1)$).
– Hilder Vitor Lima Pereira
9 hours ago
Hello. It is a good question, but the $L_2$ norm is defined over vectors and it is not clear how you are embedding the polynomials in a vector space. Are you just representing the polynomials as vectors with their coefficients? (So, for instance, $2x^3 -1$ becomes the vector $(2, 0, 0, -1)$).
– Hilder Vitor Lima Pereira
9 hours ago
Yes, I am thinking of the canonical embedding
– P.B.
9 hours ago
Yes, I am thinking of the canonical embedding
– P.B.
9 hours ago
I found some relative concept in your question and AG codes, I suspect the minimum distance for a Goppa code is a simple answer for your question. The minimum distance for Goppa codes is $d_{min}=n-k-gamma-1$. $gamma$ is the genus of the algebraic curve. We can easily find it for RS codes that the curve is a line and the genus is equal to zero so the minimum distance for them is $d_{min}=n-k-1$.
– Mahdi Sedaghat
9 hours ago
I found some relative concept in your question and AG codes, I suspect the minimum distance for a Goppa code is a simple answer for your question. The minimum distance for Goppa codes is $d_{min}=n-k-gamma-1$. $gamma$ is the genus of the algebraic curve. We can easily find it for RS codes that the curve is a line and the genus is equal to zero so the minimum distance for them is $d_{min}=n-k-1$.
– Mahdi Sedaghat
9 hours ago
Well, the canonical embedding is the one that uses isomorphisms to embed the polynomials. The one I've described is the coefficient embedding...
– Hilder Vitor Lima Pereira
9 hours ago
Well, the canonical embedding is the one that uses isomorphisms to embed the polynomials. The one I've described is the coefficient embedding...
– Hilder Vitor Lima Pereira
9 hours ago
Sorry. I mean the coefficient embedding then
– P.B.
8 hours ago
Sorry. I mean the coefficient embedding then
– P.B.
8 hours ago
|
show 1 more comment
1 Answer
1
active
oldest
votes
up vote
2
down vote
I'm assuming $n$ is a power of $2$ and that $q$ is an odd prime larger than $n$. I'm discarding the trivial case $s_1 = s_2$.
If you consider everything $mod q$, then it is most likely over the choice of $a$ that there exists $s_1 neq s_2$ such that $|a s_1 - a s_2| = sqrt{n}$. Indeed, $a$ is invertible in $R_q$ with probability about $1 - n/q$. Take $s_2 = s_1 - a^{-1}$, then you have $a s_1 - a s_2 = 1 mod q$ and the embedding norm of $1$ is $sqrt{n}$.
If you do not consider this $mod q$, i.e. you work in $R=mathbb Z[x]/⟨f(x)⟩$, then you are precisely asking for the minimal distance $lambda_1(mathfrak I)$ of the ideal lattice $mathfrak I$ generated by $a$. For such an ideal lattice, we can estimate rather precisely this minimal distance. A simple lower bound is
$lambda_1(mathfrak I) geq Delta_K^{1/2n} cdot N(a)^{1/n}$, where $N$ denotes the algebraic norm of $a$ (that is, the product of all its embeddings), and $Delta_K$ is the discriminant of field $K = mathbb Q(x)/(x^n+1)$. The reason is that the minimal vector $x$ must generate a subideal of $mathfrak I$, so $N(x) geq N(a)$, and $|x|^n geq Delta_K^{1/2} N(x)$. An upper bound is also given by Minkowski's theorem.
Shouldn't the embedding norm of 1 be 1?
– P.B.
2 hours ago
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
2
down vote
I'm assuming $n$ is a power of $2$ and that $q$ is an odd prime larger than $n$. I'm discarding the trivial case $s_1 = s_2$.
If you consider everything $mod q$, then it is most likely over the choice of $a$ that there exists $s_1 neq s_2$ such that $|a s_1 - a s_2| = sqrt{n}$. Indeed, $a$ is invertible in $R_q$ with probability about $1 - n/q$. Take $s_2 = s_1 - a^{-1}$, then you have $a s_1 - a s_2 = 1 mod q$ and the embedding norm of $1$ is $sqrt{n}$.
If you do not consider this $mod q$, i.e. you work in $R=mathbb Z[x]/⟨f(x)⟩$, then you are precisely asking for the minimal distance $lambda_1(mathfrak I)$ of the ideal lattice $mathfrak I$ generated by $a$. For such an ideal lattice, we can estimate rather precisely this minimal distance. A simple lower bound is
$lambda_1(mathfrak I) geq Delta_K^{1/2n} cdot N(a)^{1/n}$, where $N$ denotes the algebraic norm of $a$ (that is, the product of all its embeddings), and $Delta_K$ is the discriminant of field $K = mathbb Q(x)/(x^n+1)$. The reason is that the minimal vector $x$ must generate a subideal of $mathfrak I$, so $N(x) geq N(a)$, and $|x|^n geq Delta_K^{1/2} N(x)$. An upper bound is also given by Minkowski's theorem.
Shouldn't the embedding norm of 1 be 1?
– P.B.
2 hours ago
add a comment |
up vote
2
down vote
I'm assuming $n$ is a power of $2$ and that $q$ is an odd prime larger than $n$. I'm discarding the trivial case $s_1 = s_2$.
If you consider everything $mod q$, then it is most likely over the choice of $a$ that there exists $s_1 neq s_2$ such that $|a s_1 - a s_2| = sqrt{n}$. Indeed, $a$ is invertible in $R_q$ with probability about $1 - n/q$. Take $s_2 = s_1 - a^{-1}$, then you have $a s_1 - a s_2 = 1 mod q$ and the embedding norm of $1$ is $sqrt{n}$.
If you do not consider this $mod q$, i.e. you work in $R=mathbb Z[x]/⟨f(x)⟩$, then you are precisely asking for the minimal distance $lambda_1(mathfrak I)$ of the ideal lattice $mathfrak I$ generated by $a$. For such an ideal lattice, we can estimate rather precisely this minimal distance. A simple lower bound is
$lambda_1(mathfrak I) geq Delta_K^{1/2n} cdot N(a)^{1/n}$, where $N$ denotes the algebraic norm of $a$ (that is, the product of all its embeddings), and $Delta_K$ is the discriminant of field $K = mathbb Q(x)/(x^n+1)$. The reason is that the minimal vector $x$ must generate a subideal of $mathfrak I$, so $N(x) geq N(a)$, and $|x|^n geq Delta_K^{1/2} N(x)$. An upper bound is also given by Minkowski's theorem.
Shouldn't the embedding norm of 1 be 1?
– P.B.
2 hours ago
add a comment |
up vote
2
down vote
up vote
2
down vote
I'm assuming $n$ is a power of $2$ and that $q$ is an odd prime larger than $n$. I'm discarding the trivial case $s_1 = s_2$.
If you consider everything $mod q$, then it is most likely over the choice of $a$ that there exists $s_1 neq s_2$ such that $|a s_1 - a s_2| = sqrt{n}$. Indeed, $a$ is invertible in $R_q$ with probability about $1 - n/q$. Take $s_2 = s_1 - a^{-1}$, then you have $a s_1 - a s_2 = 1 mod q$ and the embedding norm of $1$ is $sqrt{n}$.
If you do not consider this $mod q$, i.e. you work in $R=mathbb Z[x]/⟨f(x)⟩$, then you are precisely asking for the minimal distance $lambda_1(mathfrak I)$ of the ideal lattice $mathfrak I$ generated by $a$. For such an ideal lattice, we can estimate rather precisely this minimal distance. A simple lower bound is
$lambda_1(mathfrak I) geq Delta_K^{1/2n} cdot N(a)^{1/n}$, where $N$ denotes the algebraic norm of $a$ (that is, the product of all its embeddings), and $Delta_K$ is the discriminant of field $K = mathbb Q(x)/(x^n+1)$. The reason is that the minimal vector $x$ must generate a subideal of $mathfrak I$, so $N(x) geq N(a)$, and $|x|^n geq Delta_K^{1/2} N(x)$. An upper bound is also given by Minkowski's theorem.
I'm assuming $n$ is a power of $2$ and that $q$ is an odd prime larger than $n$. I'm discarding the trivial case $s_1 = s_2$.
If you consider everything $mod q$, then it is most likely over the choice of $a$ that there exists $s_1 neq s_2$ such that $|a s_1 - a s_2| = sqrt{n}$. Indeed, $a$ is invertible in $R_q$ with probability about $1 - n/q$. Take $s_2 = s_1 - a^{-1}$, then you have $a s_1 - a s_2 = 1 mod q$ and the embedding norm of $1$ is $sqrt{n}$.
If you do not consider this $mod q$, i.e. you work in $R=mathbb Z[x]/⟨f(x)⟩$, then you are precisely asking for the minimal distance $lambda_1(mathfrak I)$ of the ideal lattice $mathfrak I$ generated by $a$. For such an ideal lattice, we can estimate rather precisely this minimal distance. A simple lower bound is
$lambda_1(mathfrak I) geq Delta_K^{1/2n} cdot N(a)^{1/n}$, where $N$ denotes the algebraic norm of $a$ (that is, the product of all its embeddings), and $Delta_K$ is the discriminant of field $K = mathbb Q(x)/(x^n+1)$. The reason is that the minimal vector $x$ must generate a subideal of $mathfrak I$, so $N(x) geq N(a)$, and $|x|^n geq Delta_K^{1/2} N(x)$. An upper bound is also given by Minkowski's theorem.
edited 4 hours ago
Ella Rose
14.3k43775
14.3k43775
answered 5 hours ago
LeoDucas
31515
31515
Shouldn't the embedding norm of 1 be 1?
– P.B.
2 hours ago
add a comment |
Shouldn't the embedding norm of 1 be 1?
– P.B.
2 hours ago
Shouldn't the embedding norm of 1 be 1?
– P.B.
2 hours ago
Shouldn't the embedding norm of 1 be 1?
– P.B.
2 hours ago
add a comment |
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f64299%2fminimum-distance-between-polynomials-in-ring-lwe%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Hello. It is a good question, but the $L_2$ norm is defined over vectors and it is not clear how you are embedding the polynomials in a vector space. Are you just representing the polynomials as vectors with their coefficients? (So, for instance, $2x^3 -1$ becomes the vector $(2, 0, 0, -1)$).
– Hilder Vitor Lima Pereira
9 hours ago
Yes, I am thinking of the canonical embedding
– P.B.
9 hours ago
I found some relative concept in your question and AG codes, I suspect the minimum distance for a Goppa code is a simple answer for your question. The minimum distance for Goppa codes is $d_{min}=n-k-gamma-1$. $gamma$ is the genus of the algebraic curve. We can easily find it for RS codes that the curve is a line and the genus is equal to zero so the minimum distance for them is $d_{min}=n-k-1$.
– Mahdi Sedaghat
9 hours ago
Well, the canonical embedding is the one that uses isomorphisms to embed the polynomials. The one I've described is the coefficient embedding...
– Hilder Vitor Lima Pereira
9 hours ago
Sorry. I mean the coefficient embedding then
– P.B.
8 hours ago