Adeline Roux-Langlois

Pierre-Alain Fouque

Michel Abdalla

Shweta Agrawal

Martin R Albrecht

Stéphanie Delaune

Amin Sakzad

Ron Steinfeld

As most projects in life, this thesis is not the fruit of work of one single person, but rather the output of a three years lasting collaboration with many competent and supportive people.

First of all, I would like to thank my two supervisors,

We summarize here the notations used throughout the manuscript, listed in thematic order.

Symbol Meaning

N Natural numbers (without 0) C, i Field of complex numbers and the imaginary number i R(z), z

Real component and complex conjugate of a complex number z ∈ C R, Z Field of real numbers and ring of rational numbers Z q Quotient ring of rational integers modulo some q ∈ N [n]

The set {1, . . . , n} for some n ∈ N x Closest integer to x A Bold capital letters denote matrices A T , A †

Transpose and Hermitian transpose of A I n

The identity matrix of size n × n [A|B]

Concatenation of two matrices A and B A ⊗ B Kronecker product of two matrices A and B a Bold lowercase letters denote column vectors a • b Component-wise product of two vectors a and b rev(a)

The vector a = (a 1 , . . . , a n ) T in reverse order, i.e., rev(a) = (a n , . . . , a 1 ) T diag(a)

The diagonal matrix whose diagonal entries are given by the vector a {e j } j∈ [n] The canonical basis of C n

Z[x] Ring of integer polynomials Z[x] <n

Set of integer polynomials with degree less than n a ∞ , a 2 Infinity and Euclidean norm of a vector a a 2,∞ Hybrid norm of a vector over a number field K s 1 (A)

Largest singular value of a matrix A A 2 Spectral norm of a matrix A A max Maximum norm of a matrix A A F

Frobenius norm of a matrix A GS(A)

Gram-Schmidt orthogonalization of A from left to right K, R

A number field and its associated ring of integers R × Set of units (i.e., non-trivial invertible elements) of a ring R M, I

Modules over a number field K and ideals over its ring of integers R p = pR

The principal ideal in a ring R generated by p ∈ R R p

The quotient ring R/ p τ , σ, σ H

The coefficient and the canonical embedding (H as a complex or real vector space) σ

The discrete canonical embedding over the quotient ring Z q V, V

The standard (over C) and discrete (over Z q ) Vandermonde matrix

V Ω , V Ω c
The partial (discrete) Vandermonde matrix and its complement vii viii NOTATIONS AND ABBREVIATIONS δ j,k Kronecker symbol, which equals 1 if j = k and 0 otherwise ω, O, Θ, Ω Standard Landau asymptotic notations U (S) Uniform distribution over a set S |S| The cardinality of a set S x ← D Sampling an element x ∈ S according to a distribution D over S ∆(P; Q)

Statistical distance between two probability distributions P and Q RD 2 (P Q) Rényi divergence of order 2 between two probability distributions P and Q D s

Continuous Gaussian distribution of width s D s,Λ Discrete Gaussian distribution of width s over the lattice Λ XOR

Résumé long en français

Historiquement, l'objectif de la cryptologie était de proposer des méthodes de chiffrement permettant de garantir la confidentialité des messages échangés entre deux personnes. Depuis le développement d'internet, d'autres défis sont également devenus important, comme par exemple garantir l'authenticité d'une information en la signant numériquement, payer avec de l'argent électronique ou bien voter de manière anonyme lors d'élections électroniques. En utilisant un schéma cryptographique prouvé sûr, le fait qu'un message reste inintelligible, qu'une signature ne puisse pas être falsifiée ou qu'une vote reste anonyme est garanti par la difficulté d'un problème mathématique. Autrement dit, toute information divulguée pourrait être utilisée pour résoudre un problème mathématique réputé difficile. Cependant, la plupart des protocoles utilisés aujourd'hui sont menacés par l'arrivée d'ordinateurs quantiques de plus en plus puissants. Plus précisément, si nous avions accès à des ordinateurs qui utilisent la mécanique quantique au lieu de la mécanique classique, certains problèmes mathématiques deviendraient faciles à résoudre et, avec eux, de nombreux schémas cryptographiques actuels ne seraient plus sûrs [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF].

L'identification de protocoles cryptographiques supposés être protégés contre les algorithmes quantiques est un domaine de recherche actif appelé la cryptographie post-quantique. Dans ce contexte, l'institut américain National Institute of Standards and Technology (NIST) a lancé en 2016 un processus de normalisation post-quantique [NIS] pour les schémas de chiffrement à clé publique et les signatures numériques. Plusieurs pistes qui semblent résister aux attaques quantiques ont été proposées. Pour n'en citer que quelques-unes, il existe des hypothèses à base des réseaux euclidiens, des codes aléatoires, des fonctions de hachage ou des systèmes multivariés. Les schémas qui reposent sur des problèmes sur les réseaux euclidiens constituent une catégorie très prometteuse. Ce domaine de recherche est appelé cryptographie à base de réseaux et offre de multiples avantages, tels que l'efficacité, la versatilité et des garanties de sécurité élevées. Pour illustrer son rôle prépondérant, notons que dans le processus de normalisation en cours géré par le NIST, parmi les candidats restants au dernier tour, 3 des 4 mécanismes d'encapsulation de clés (permettant le chiffrement) et 2 signatures numériques sur 3 sont basés sur des réseaux. Toutes les contributions présentées dans ce manuscrit s'inscrivent dans le domaine de la cryptographie à base de réseaux.

Au coeur de la plupart des schémas reposant sur les réseaux euclidiens, et en particulier au centre de cette thèse, se trouve un problème de calcul, celui de l'apprentissage avec erreurs, souvent abrégé LWE (acronyme de l'anglais Learning With Errors). De manière informelle, le problème LWE demande de résoudre un système d'équations linéaires bruitées sur les entiers rationnels. Plus formellement, pour des entiers positifs n, m et q, soit A ∈ Z m×n q une matrice tirée selon la distribution uniforme sur Z q . De plus, on considère deux distributions de probabilités. La première, notée ψ e , est sur Z et utilisée pour générer un vecteur e ∈ Z m d'une norme euclidienne petite avec forte probabilité. Souvent, on choisit une distribution gaussienne pour ψ e . La deuxième distribution de probabilités, désignée par ψ s , est sur Z n q et définit un vecteur s ∈ Z n q . Nous appelons ces deux vecteurs le bruit/erreur e et le secret s. Une instance ix x RÉSUMÉ LONG EN FRANÇAIS de LWE est donnée par le couple (A, A • s + e mod q), tandis que le bruit et le secret restent cachés. La variante calculatoire de LWE demande de trouver le secret s et la version décisionnelle demande de distinguer cette instance d'une instance (A, b) où le vecteur b a été tiré de la distribution uniforme sur Z m q . Notons que sans le bruit e, il s'agirait d'un système standard d'équations linéaires qui peut être résolu en temps polynomial par élimination gaussienne. Seul le bruit supplémentaire rend la résolution du système d'équations difficile. Pour un certain facteur d'approximation qui dépend des paramètres ψ s , ψ e , m, n et q, on peut prouver que LWE est au moins aussi difficile que de trouver approximativement le vecteur le plus court dans un réseau euclidien [Reg05, Pei09, BLP + 13, PRS17a]. Ceci est un problème supposé difficile pour lequel aucun algorithme efficace n'est connu lorsque la dimension du réseau est suffisamment grande.

Malheureusement, les protocoles cryptographiques qui s'appuient sur la difficulté de LWE sont intrinsèquement inefficaces en raison de la taille des clés publiques qui contiennent généralement la matrice A ∈ Z m×n q , où n et m sont au moins aussi grands que le paramètre de sécurité. En outre, les opérations de base sont des produits matrice-vecteur sur Z q qui nécessitent un temps de calcul quadratique en la dimension n. Pour améliorer l'efficacité des protocoles, des variantes structurées de LWE ont été proposées, comme par exemple [START_REF] Stehlé | Efficient public key encryption based on ideal lattices[END_REF][START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF][START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF].

L'une d'entre elles est le problème Module Learning With Errors (M-LWE), introduit par Brakerski et al. [START_REF] Brakerski | leveled) fully homomorphic encryption without bootstrapping[END_REF] et étudié en détails par Langlois et Stehlé [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]. Au lieu de considérer des équations linéaires bruitées sur les entiers Z, les équations linéaires sont maintenant définies algébriquement sur un anneau de polynômes à coefficients dans Z. Intuitivement, l'amélioration de l'efficacité vient du fait que chaque polynôme de cet anneau définit une matrice structurée de multiplication. Ainsi, nous pouvons remplacer la matrice complètement aléatoire de LWE par une certaine matrice structurée pour M-LWE. De plus, dans ce cas le produit matrice-vecteur peut être calculé en temps quasi-linéaire. Depuis son introduction en 2012, M-LWE jouit d'une popularité croissante car il offre un compromis fin entre sécurité concrète et efficacité. Dans le cadre du processus de normalisation du NIST [NIS], plusieurs candidats au troisième tour s'appuient sur la difficulté de M-LWE, par exemple, le schéma de signature Dilithium [DKL + 18] et le mécanisme d'encapsulation des clés Kyber [BDK + 18].

Contributions

La recherche présentée dans ce manuscrit se concentre sur les variantes structurées du problème LWE et leur utilisation en cryptographie post-quantique. Dans ce qui suit, nous décrivons les contributions présentées qui peuvent être divisées en deux catégories différentes. La première partie contient des contributions liées à une meilleure compréhension des fondations théoriques de la cryptographie à base de réseaux et la deuxième partie comprend la conception de deux schémas de chiffrement efficaces, dont la sécurité est basée sur des problèmes de réseaux structurés.

Fondations théoriques

Comme nous l'avons expliqué précédemment, les schémas cryptographiques efficaces sont basés sur des variantes structurées de LWE, comme par exemple M-LWE. À de nombreux égards, le problème plus récent M-LWE ressemble à son homologue non structuré et plus étudié LWE. Néanmoins, certaines propriétés importantes qui ont été prouvées pour LWE, n'ont pas (encore) été démontrées pour M-LWE. Nous pensons qu'une étude rigoureuse du problème M-LWE est essentielle pour approfondir notre confiance dans les hypothèses de difficulté qui sont faites dans dans les schémas cryptographiques actuellement proposés pour la normalisation. Dans ce qui suit, nous présentons deux résultats qui répondent à deux de ces insuffisances concernant le problème M-LWE.

xi

Secret binaire

Comme première contribution, nous prouvons dans le Chapitre 2 que M-LWE reste difficile à résoudre, même si la distribution du secret ψ s donnant le vecteur s sur l'anneau est modifiée. Au lieu d'utiliser la distribution uniforme qui conduit à des polynômes à grands coefficients (c'està-dire dans Z q ), nous pouvons également utiliser une distribution de probabilités qui donne des polynômes à coefficients binaires (c'est-à-dire dans {0, 1}). Nous désignons ce dernier problème par bin-M-LWE. Il est particulièrement intéressant car il augmente l'efficacité des calculs, permet des techniques efficaces de changement du rang et du modulo [BLP + 13, AD17a, WW19] et est nécessaire dans les schémas de chiffrement totalement homomorphes comme dans [START_REF] Ducas | FHEW: bootstrapping homomorphic encryption in less than a second[END_REF][START_REF] Chillotti | Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds[END_REF]. Pour le cas non structuré, des réductions de LWE à bin-LWE avec une dimension et une borne d'erreur légèrement augmentées ont été montrées [GKPV10, BLP + 13, Mic18]. Cependant, tous les résultats existants sont sur les entiers Z et non sur l'anneau des entiers d'un corps de nombres. Par conséquent, comme l'indique Micciancio dans la conclusion de [START_REF] Micciancio | On the hardness of learning with errors with binary secrets[END_REF], une question ouverte importante est de savoir si des résultats similaires s'appliquent aux variantes structurées, en particulier à M-LWE. Dans cette thèse, nous progressons vers la résolution de ce problème en prouvant la difficulté de bin-M-LWE, si le rang du module est (super-)logarithmique dans le degré du corps de nombres sous-jacent. Plus précisément, nous présentons deux preuves différentes pour obtenir ce résultat, qui diffèrent légèrement dans leurs conditions, les paramètres obtenus et les variantes concrètes du problème. De plus, nous montrons que les deux réductions peuvent être généralisées à une distribution du secret plus large.

Réduction classique

Comme deuxième contribution portant sur la difficulté théorique de M-LWE, nous renforçons dans le Chapitre 3 son lien étroit avec les problèmes sur les réseaux euclidiens structurés en prouvant une réduction classique. Auparavant, seule une réduction quantique était connue [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]. Une telle réduction nécessite des ordinateurs quantiques, qui sont extrêmement puissants, coûteux à construire et pas encore disponibles à grande échelle. Pour le cas non structuré, une preuve de difficulté classique de LWE est donnée par Brakerski et al. [BLP + 13]. Sur le plan général, nous suivons la même structure que dans [BLP + 13] en adaptant de façon rigoureuse tous les résultats nécessaires au contexte des modules. Plus en détail, nous avons besoin de trois ingrédients.

tational Learning With Rounding (MP-CLWR). D'une part, MP-CLWR utilise les arrondis de manière similaire à LWR et évite ainsi l'échantillonnage de l'erreur gaussienne. D'autre part, la difficulté de MP-CLWR ne dépend pas d'un anneau spécifique, mais est garantie par la difficulté d'une variante structurée de LWE (appelée P-LWE) pour un ensemble d'anneaux exponentiellement grand. Ainsi, l'hypothèse MP-CLWR jouit des propriétés souhaitées, à la fois de l'avantage de sécurité de MP-LWE et de l'avantage de simplicité de LWR. Concernant la difficulté de ce nouveau problème, nous prouvons que MP-CLWR est au moins aussi difficile que MP-LWE, qui est lui-même basé sur la difficulté des problèmes sur les réseaux euclidiens structurés.

Problèmes liés à la matrice de Vandermonde partielle

Dans les chapitres précédents, nous avons étudié des variantes de LWE dont la difficulté est garantie par l'impossibilité présumée de résoudre des problèmes dans les pires cas sur des réseaux euclidiens structurés. Dans le Chapitre 5, nous étudions une famille différente de problèmes sur des réseaux structurés qui est liée à la transformée de Vandermonde discrète et qui permet des protocoles simples et efficaces au détriment de l'absence de connexion connue entre les pires cas et les cas moyens. L'hypothèse constituant la base de ce chapitre est qu'il n'existe ni d'algorithme classique ni quantique en temps polynomial qui récupère un polynôme de petits coefficients en ayant seulement accès à une liste partielle de sa transformée de Vandermonde discrète. Bien sûr, il est essentiel de préciser à quel point les coefficients du polynôme doivent être petits et de quelle taille est la liste partielle que nous fournissons. Par analogie avec le problème du sac à dos standard, nous appelons ce problème le problème de Partial Vandermonde Knapsack (PV-Knap). Sa version homogène est appelée Partial Vandermonde SIS (PV-SIS), et peut être vue comme une variante spécifique du problème standard Short Integer Solution.

En 2015, Hoffstein et Silverman [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF] présentent PASS Encrypt, un schéma de chiffrement à clé publique dont les briques de construction sont liées au problème PV-Knap. Leur schéma de chiffrement est très efficace et remplit des propriétés homomorphiques additives et multiplicatives, ce qui en fait un point de départ naturel pour la conception de primitives cryptographiques efficaces. Malheureusement, l'un des principaux inconvénients de PASS Encrypt est qu'aucune preuve de sécurité n'a été donnée dans [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF]. Dans ce chapitre, nous progressons dans la compréhension des hypothèses de difficulté nécessaires pour prouver la sécurité de PASS Encrypt. D'abord, nous élargissons le paysage des problèmes qui utilisent la transformation partielle de Vandermonde en définissant une nouvelle variante de LWE, appelée Partial Vandermonde Learning With Errors (PV-LWE). Par la suite, nous montrons l'équivalence de PV-Knap et de PV-LWE en exploitant la même connexion de dualité que nous connaissons pour les problèmes Knapsack et LWE standards. Comme notre principale motivation est de fournir une preuve de sécurité pour PASS Encrypt, nous définissons une variante du PV-Knap, que nous appelons le problème PASS. Ce problème sert (avec la version décisionnelle de PV-Knap) d'hypothèse de difficulté sous-jacente pour (une version légèrement modifiée de) PASS Encrypt. Nous présentons le schéma ainsi que la preuve de sécurité plus tard dans le Chapitre 7.

Constructions cryptographiques

Dans la première partie du manuscrit, nous introduisons deux nouvelles hypothèses de difficulté liées aux problèmes sur les réseaux euclidiens structurés. Afin de montrer comment se servir de ces hypothèses pour la cryptographie, nous construisons deux schémas de chiffrement à clé publique dans la deuxième partie de ce travail. Nous prouvons que les deux schémas sont corrects et sûrs en supposant des hypothèses de calcul explicitement énoncées.

xiii Chiffrement basé sur Middle-Product LWE Pour montrer l'utilité cryptographique de notre nouvelle hypothèse de difficulté MP-CLWR du Chapitre 4, nous présentons au Chapitre 6 un schéma de chiffrement dont la sécurité est basée sur MP-CLWR. Sa conception s'inspire simultanément de deux schémas existants : d'une part, du schéma de Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF] dont la sécurité est basée sur MP-LWE, et d'autre part, du chiffrement de Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF] dont la sécurité est basée sur la variante structurée de LWR. Comme pour [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF], nous utilisons un mécanisme dit de réconciliation, qui permet de déchiffrer correctement. Nous prouvons la sécurité de notre schéma en nous basant sur la difficulté de MP-CLWR. Comme c'est le cas pour les schémas qui utilisent des arrondis, pendant la génération de la clé publique, nous n'avons besoin que d'arrondir le produit médian de deux polynômes au lieu d'échantillonner l'erreur gaussienne, ce qui le rend plus facile à mettre en oeuvre que le schéma de [START_REF] Roşca | Middle-product learning with errors[END_REF]. Simultanément, tout en garantissant un niveau de sécurité égal, nous obtenons les mêmes tailles asymptotiques de clé et de chiffrements que le schéma de [START_REF] Roşca | Middle-product learning with errors[END_REF]. Enfin, nous analysons la sécurité concrète de notre schéma en examinant les meilleures attaques actuellement connues contre lui.

PASS Encrypt

Comme contribution finale, nous présentons dans le Chapitre 7 une version modifiée du schéma de chiffrement PASS Encrypt [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF] ainsi qu'une preuve de sécurité basée sur le problème PV-Knap et une variante particulière de celui-ci, que nous appelons le problème PASS, tous les deux étudiés dans le Chapitre 5. Ce dernier problème capture le fait qu'un message chiffré de PASS Encrypt consiste en plusieurs transformées de Vandermonde partielles des éléments liés. Par conséquent, un * e attaquant * e qui réussit contre PV-Knap peut être utilisé * e pour gagner le jeu de sécurité de PASS Encrypt, mais le contraire n'est pas vrai. Ce problème n'a pas été abordé auparavant dans la version originale de PASS Encrypt par Hoffstein et Silverman [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF].

Nous modifions légèrement le schéma et donnons une preuve que le déchiffrement est correct pour des paramètres bien choisis et une preuve de sécurité, en supposant la difficulté de PV-Knap et de PASS. Nous fournissons également une analyse fine de la sécurité du schéma en montrant une nouvelle attaque que nous appelons Plaintext Recovering Using Hints attack, qui prend en compte la structure de PASS Encrypt. À cette fin, nous utilisons un travail récent de Dachman-Soled et al. [START_REF] Dachman-Soled | LWE with side information: Attacks and concrete security estimation[END_REF] pour analyser les instances de LWE, où des indices supplémentaires sur le secret et/ou l'erreur sont donnés. Nos estimations de complexité pour cette attaque montrent qu'elle ne réduit pas la complexité en dessous de celle des attaques précédemment connues sur PASS, ce qui augmente notre confiance dans la sécurité revendiquée de PASS Encrypt. Nous concluons le chapitre en fournissant des exemples concrets de paramètres et nous comparons notre schéma avec deux autres schémas efficaces dont la sécurité est basée sur des problèmes de réseaux structurés.

Introduction

The word cryptography is composed of two ancient Greek words, κρνπτ oς (kryptos, secret) and γραφειν (graphein, to write), capturing the association that most people have when they hear about cryptography: exchanging messages in such a way that no one other than the recipient can read them. However, this only covers one of many different aspects of cryptography. From a general perspective, we can state three basic goals that cryptography aims to attend: confidentiality, authenticity and integrity. Whereas the first one corresponds to keeping the message secret, the second one guarantees a recipient that the message was indeed sent by the claimed sender, and the last one makes sure that the content of the message has not been altered. One can well imagine that it makes a difference to obtain a check of 1.000 Euro or 100 Euro, whereas the two numbers are only one 0 far away from each other. Modern cryptography does not only make it possible to exchange digital messages in a secure way, as for instance when sending encrypted emails via OpenPGP or using a messenger application with end-to-end encryption such as Signal. It also provides solutions to generally authenticate content on the internet, to establish secure connections between our home computer and the world wide web (e.g., the TLS protocol), to manage online banking, to do online shopping, and even gives us the possibility to securely vote online. This said, modern cryptography has become indispensable and omnipresent in the everyday life of a citizen in the 21st century.

But what exactly do we mean by modern cryptography? For a very long time, cryptography was done in a secret way, without publicly telling the rules. It was mainly used by governments and the military, who had the political and financial power to actually deploy cryptography. A now very popular example is the encryption machine Enigma used by the German military and marines during World War 2, whose breaking by the Allies is estimated to have shortened the war by several years and was kept secret a long time afterwards. 4 The area of modern cryptography was marked by the publications of Diffie and Hellman [START_REF] Diffie | New directions in cryptography[END_REF] and of Merkle [START_REF] Merkle | Secure communications over insecure channels[END_REF], introducing the concept of public key cryptography. 5 Its underlying principle is to equip everyone with a pair of cryptographic keys. The first one, referred to as the secret key, should be kept hidden. The second one is called the public key and can be made generally available. In the context of encryption, the public key allows anyone to encrypt a message, whereas only the owner of the corresponding secret key can decrypt the encrypted message. The main advantage of such a public key encryption is that the two persons who want to safely communicate with each other don't have to (physically) meet beforehand. As opposed to public key cryptography, there also exists a secret key counterpart, where both participants have to share a common secret INTRODUCTION key in order to execute the cryptographic scheme. A very popular example of a secret key encryption scheme is the AES block cipher designed by Daemen and Rijmen [START_REF] Daemen | Rijndael for AES[END_REF]. Such schemes are usually more efficient than their public key analogues, but require the exchange of secret credentials to initiate them. In practice, we generally use a public key protocol to safely exchange key material to enable an efficient secret key protocol afterwards.

Preferably, the public key encryption scheme comes with a security proof, guaranteeing that a message remains completely unintelligible as long as an explicitly formulated assumption is true. Typically, such an assumption states that some mathematical problem is difficult to solve. In other words, any disclosed information on the encrypted message could be used to solve a mathematical problem deemed unsolvable in a reasonable amount of time. One example of such a mathematical problem is the task of factoring a large number. A common conjecture is that there exists no polynomial-time algorithm that factors a number which is the product of two equally large primes. Another mathematical problem used in cryptography is the discrete logarithm problem, which asks to find the discrete logarithm with respect to a given basis in a finite group. Most of the current cryptographic schemes used in practice rely on variants of the factoring or the discrete logarithm problem, as for instance the Diffie-Hellman key exchange protocol [START_REF] Diffie | New directions in cryptography[END_REF], the RSA digital signature and encryption scheme [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] or the ElGamal encryption [START_REF] Gamal | A public key cryptosystem and a signature scheme based on discrete logarithms[END_REF].

Unfortunately, those cryptographic schemes are threatened as the underlying assumptions may become vacuous once we possess quantum computers which, as opposed to classical computers, operate with quantum mechanics and can execute quantum algorithms. More precisely, in 1994 Shor [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] designed a quantum algorithm that solves the discrete logarithm problem and the factorization problem in polynomial-time. 6 It is important to emphasize that quantum computers do not yet exist on a large scale. In 2020, Google's quantum computer Hummingbird was able to handle 65 quantum bits (qubits) and the company hopes to build a quantum computer which manages roughly 1000 qubits in 2023 [Gam]. Note that different works hint towards the need of at least 1 million qubits (in run-time or memory) to factor a 2048 bits RSA integer [START_REF] Gidney | How to factor 2048 bit rsa integers in 8 hours using 20 million noisy qubits[END_REF][START_REF] Gouzien | Factoring 2048 rsa integers in 177 days with 13436 qubits and a multimode memory[END_REF]. However, it is crucial to start today to think about alternatives for a future, where quantum computers will be widely available, as safely replacing current cryptographic protocols will take years. Furthermore, a malicious person could start collecting encrypted messages today in order to decrypt them later, once they7 possess powerful quantum computers. Identifying and constructing cryptographic schemes that are assumed to be secure against quantum algorithms is an active research area called post-quantum cryptography. Within this context, the US National Institute of Standards and Technology (NIST) has initiated in 2016 a standardization process [NIS] for public-key encryption schemes and digital signatures which can be used to replace the current standards once large-scale quantum computers are available. There have been several directions proposed to build public key cryptography based on different mathematical hard problems, that seem to withstand quantum attacks. To name a few, there are assumptions based on lattices, random codes, hash functions, isogenies between elliptic curves or multivariate systems.

One very promising category of quantum-resistant candidates are schemes that rely on the hardness of problems on Euclidean lattices. This research area is called lattice-based cryptography and emerged at the end of the 1990s through the works of two different research lines. On the one hand, there have been proposals benefiting from strong theoretical connections to presumed hard worst-case lattice problems by Ajtai and Dwork [START_REF] Ajtai | Generating hard instances of lattice problems[END_REF][START_REF] Ajtai | A public-key cryptosystem with worst-case/average-case equivalence[END_REF] and Regev [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. On the other hand, very efficient schemes basing their security on average-case structured lattice problems have been introduced, the most popular among them is the NTRU encryption scheme by Hoffstein et al. [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF]. Since then, the field attracted more and more research interest, now estimated as one of the most mature candidates to replace standard cryptographic systems in a quantum world. To illustrate its leading role, note that in the on-going standardization process run by the NIST, among the remaining candidates in the final round, 3 out of 4 key encapsulation mechanisms (enabling encryption) and 2 out of 3 digital signatures are based on lattices. 8 All contributions presented in this thesis are placed within the field of lattice-based cryptography. Lattices are mathematical objects that play an important role in many different areas such as number theory, geometry and group theory. Informally speaking, a lattice is composed of points that are arranged in a periodic structure in the n-dimensional space R n , as illustrated in Figure 1 A lattice can have many different bases, but they all frame an area of the same volume, called the fundamental domain. Another invariant of the lattice Λ, which doesn't depend on the chosen basis to represent it, is the Euclidean norm of any smallest non-zero vector in Λ, called its first minimum and denoted by λ 1 (Λ).

One of the most studied problems related to Euclidean lattices is the Shortest Vector Problem (SVP), which asks for a given lattice Λ to find a shortest non-zero vector in Λ, i.e., a vector of norm λ 1 (Λ). A relaxed version of this problem is to find a shortest non-zero vector up to some approximation factor γ ≥ 1, i.e., a vector of norm at most γ • λ 1 (Λ), denoted by SVP γ . It also possesses a promise decision variant, where we only ask, for a given parameter δ, to decide whether a given lattice is a YES instance, where λ 1 (Λ) ≤ δ, or a NO instance, where λ 1 (Λ) > γ •δ. We denote this problem by GapSVP γ and illustrate it in Figure 2 for the two-dimensional case. Another lattice problem of interest is the approximate Shortest Independent Vector Problem (SIVP γ ). , λ 1 (Λ) ≤ δ 1 and λ 1 (Λ) > γ • δ 2 for γ = 2. In other words, Λ defines a YES instance for δ 1 and a NO instance for δ 2 for the problem GapSVP 2 .

Given an n-dimensional lattice Λ, SIVP γ asks to find n linearly independent vectors of Λ that are shorter than γ • λ n (Λ). Here, λ n (Λ) denotes the n-th minimum of Λ, i.e., the smallest number such that there exist n linearly independent vectors in Λ of norm less than it. In 1982, Lenstra, Lenstra and Lovász [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] designed the now very popular LLL algorithm, that solves in polynomial time SVP γ for γ exponentially large in the lattice dimension. Later in 1987, Schnorr showed a trade-off between running time and approximation factor which can be achieved by an algorithm solving SVP γ [START_REF] Schnorr | A hierarchy of polynomial time lattice basis reduction algorithms[END_REF]. In practice, it is implemented by the BKZ algorithm by Schnorr and Euchner [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems[END_REF], which can be seen as a heuristic variant of Schnorr's algorithm. Following this trade-off, the best known algorithm to solve SVP γ with γ polynomial in the lattice dimension n has an exponential running time of 2 Õ(n) and, conversely, the best known algorithm to solve SVP γ with polynomial running-time can only achieve an exponential approximation factor γ of 2 Õ(n) .

Here, the term Õ(n) designs the big O notation which hides logarithmic factors in n. Compared to the other two lattice problems, SVP γ is no easier than SIVP γ [START_REF] Stephens-Davidowitz | Dimension-preserving reductions between lattice problems[END_REF] which is itself no easier than GapSVP γ [START_REF] Banaszczyk | New bounds in some transference theorems in the geometry of numbers[END_REF]. 9 The above leads to the following conjecture which forms the starting point of lattice-based cryptography. Note that all asymptotic statements are with respect to the lattice dimension n, unless we state it otherwise.

Conjecture 1: There is no polynomial-time classical or quantum algorithm that approximates the lattice problems SVP γ , GapSVP γ or SIVP γ to within polynomial factors γ.

Despite their assumed quantum-resistance, those problems seem unlikely to directly serve for the construction of cryptographic primitives. This is because their definition relies on arbitrary lattices, what we commonly call worst-case problems, as they are in general not hard to solve for any lattice, but assumed to be hard to solve in the worst-case. When designing cryptographic schemes, however, we usually need the hardness of random instances of some problem, what we call average-case problems. This challenge was solved with the help of intermediate lattice prob-xxi lems, namely the Short Integer Solution (SIS) [START_REF] Ajtai | Generating hard instances of lattice problems[END_REF] and Learning With Errors (LWE) [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] problems, which are formulated as average-case problems, making them suitable for cryptography. Astonishingly, these intermediate lattice problems have been shown to be at least as hard to solve as some worst-case lattice problems, such as GapSVP γ or SIVP γ , for suitable parameter choices. Thus, Conjecture 1 which states that SIVP γ and GapSVP γ are classically and quantumly intractable implies that SIS and LWE are also classically and quantumly intractable.

In the following, we focus our discussion on the Learning With Errors (LWE) problem, which was introduced by Regev [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] in his pioneering work. It is not only at the heart of most latticebased schemes, but also builds the core element of this thesis. Informally speaking, an instance of LWE is a system of noisy linear modular equations over the rational integers Z and it can be formulated either as a search or as a decision problem. Its search variant asks to find a solution to this system, whereas its decision version asks to distinguish such noisy linear modular equations from uniformly random ones. More formally, for positive integers n, m and q, let A ∈ Z m×n q be a matrix sampled uniformly at random over the quotient ring Z q . Further, we consider two probability distributions. The first one, denoted by ψ e , is over Z and provides a vector e ∈ Z m whose Euclidean norm is small with respect to q with high probability. A common choice for ψ e is a discrete Gaussian distribution. The second one, denoted by ψ s , is over Z n q and serves for sampling a vector s ∈ Z n q . In the following, you can think of ψ s as the uniform distribution. We commonly refer to s as the secret and to e as the error or noise. An instance of LWE is given by (A, As+e mod q) ∈ Z m×n q ×Z m q , where both s and e should be kept hidden. The search problem requires to find s (or equivalently e) as illustrated in Figure 3 and the decision problem asks to distinguish such an instance from (A, b), where b was sampled uniformly at random over Z m q . Note that without the error term e this would be a standard system of modular linear equations which can be solved in polynomial time by Gaussian elimination. Only the additional noise makes solving the system of equations very difficult. For some approximation factor γ depending on the parameters ψ s , ψ e , m, n and q, LWE is shown to be no easier to solve than worst-case lattice problems such as GapSVP γ or SIVP γ [Reg05, Pei09, BLP + 13, PRS17a].

The worst-to-average case reduction from SIVP γ to LWE [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] only works when the error e is sampled from a Gaussian distribution. This requirement is closely related to the nature of the reduction which reduces standard lattice problems such as SIVP γ to the problem of sampling elements from a narrow discrete Gaussian distribution. However, Gaussian sampling procedures are in general costly, difficult to implement and vulnerable to side-channel attacks, e.g., [START_REF] Du | Towards efficient discrete gaussian sampling for lattice-based cryptography[END_REF][START_REF] Bruinderink | Flush, gauss, and reload -A cache attack on the BLISS lattice-based signature scheme[END_REF][START_REF] Pessl | Analyzing the shuffling side-channel countermeasure for lattice-based signatures[END_REF][START_REF] Saarinen | Arithmetic coding and blinding countermeasures for lattice signatures -engineering a side-channel resistant post-quantum signature scheme with compact signatures[END_REF]. In 2012, Banerjee et al. [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF] introduce a deterministic variant of LWE, namely the Learning With Rounding (LWR) problem. Instead of adding a random error vector e to the matrix-vector product As over Z q , we deterministically round the product modulo some smaller integer p. Informally, the noise of LWE helps to hide the low-order bits of As, whereas the rounding simply cuts them off. It is shown, that LWR is no easier than LWE for a specific parameter setting [BPR12, AKPW13, BGM + 16, AA16].

The decision variant of LWE serves as the hardness assumption for a wide range of provably secure cryptographic primitives, from the basic ones, such as Public Key Encryption (e.g., [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF][START_REF] Micciancio | Trapdoors for lattices: Simpler, tighter, faster, smaller[END_REF]), to the most advanced ones, such as Fully Homomorphic Encryption (e.g., [BGV12, BV14, DM15]) or Non-Interactive Zero-Knowledge proof systems (e.g., [START_REF] Peikert | Noninteractive zero knowledge for NP from (plain) learning with errors[END_REF]).

Unfortunately, the cryptographic protocols relying on the hardness of LWE are inherently inefficient due to the size of the public keys which usually contain the matrix A ∈ Z m×n q , where n is at least as large as the security parameter and m is the number of samples which is usually larger than n log(n). Furthermore, the basic operations are matrix-vector products over Z q which require a computation time quadratic in the dimension n. To improve the efficiency, structured variants of LWE have been proposed, e.g., [START_REF] Stehlé | Efficient public key encryption based on ideal lattices[END_REF][START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF][START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF].

One of them is the Module Learning With Errors (M-LWE) problem, introduced by Brakerski et al. [START_REF] Brakerski | leveled) fully homomorphic encryption without bootstrapping[END_REF] and thoroughly studied by Langlois and Stehlé [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]. Instead of considering noisy linear equations over the rational integers Z, the linear equations are now defined algebraically over some ring of polynomials with coefficients in Z. Intuitively, the improvement in efficiency comes from the fact that every polynomial in this ring defines a structured matrix of multiplication. Thus, we can replace the completely random matrix of LWE by some structured matrix for M-LWE. Additionally, in this case the matrix-vector product can be computed in quasi-linear time. More formally, we now work over some number field K with its associated ring of integers R. For simplicity, we can think of K as the ring of polynomials with coefficients in Q modulo some irreducible polynomial f (x) of degree n, i.e., K = Q[x]/ f (x) . We call n the degree of K. Thus, elements of K are polynomials of degree less than n with rational coefficients. Its ring of integers can be represented (in most cases) as the polynomials of K whose coefficients are integers, i.e., R = Z[x]/ f (x) . Furthermore, we denote by R q the quotient ring R/qR, resulting in R q = Z q [x]/ f (x) . For positive integers m, d and q, let A ∈ R m×d q be a matrix sampled uniformly at random over the matrices over R q . We refer to d as the rank of the M-LWE instance. Further, we sample a vector e ∈ R m from some distribution ψ e over R which has with high probability a small norm (with respect to q) and sample a vector s from some second distribution ψ s over ∈ R d q . 10 Again, we keep both e and s secret. An instance of M-LWE is given by (A, As + e mod q) ∈ R m×d q × R m q . As for the plain LWE problem, it comes in a search variant (requiring to find s) and a decision variant (asking to distinguish such samples form uniform random ones), depicted in Figure 4.

Why is this variant more efficient than plain LWE? We can interpret the matrix A over R q as a matrix over Z. To do so, we observe that the multiplication of a ring element a ∈ R q with another ring element s ∈ R q (where both are polynomials with degree less than n) corresponds to the convolution of two polynomials modulo the defining polynomial f (x). The convolution modulo f (x) can be expressed as the matrix-vector product using the matrix of multiplication modulo f (x) of a, denoted by Rot(a) ∈ Z n×n q . In other words a • s over R q becomes Rot(a) • s over Z q . Note that the full matrix Rot(a) is determined by its first column. For simplicity, one can think of the rotation matrix as a nega-cyclic matrix, as illustrated in Figure 4. Hence, 10 For simplicity, we keep the introduction in the primal version of M-LWE, where s is a vector over R. Later, we consider the dual version, where the secret s is a vector over the dual R ∨ . Furthermore, we present the problem in its discrete form, where the noise is sampled from a distribution ψe over R. Later, we also study the continuous version, where ψe is a distribution over (an extension of) K. Every entry a jk ∈ R q of the matrix A defines a matrix of multiplication Rot(a jk ) ∈ Z n×n q , where n is the ring degree of R. For simplicity, we illustrate the rotation matrix as a nega-cyclic matrix.

the m × d matrix A = (a jk ) jk ∈ R m×d q defines an mn × dn matrix Rot(A) = (Rot(a jk )) jk over Z q . This said, an instance of M-LWE with parameters n and d can be viewed as an instance of LWE of dimension N = nd, where the public matrix Rot(A) is not fully random, but has some structure. This is why we often refer to it as a structured variant of LWE.

One interesting special case is M-LWE with rank d = 1, which is commonly referred to as the Ring Learning With Errors (R-LWE) problem, originally introduced by Lyubashevsky et al. [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF][START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF]. Recently, Peikert and Pepin [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF] showed a tight reduction from R-LWE over a number field of degree n • k to M-LWE over a number field of degree n and with rank k. The R-LWE problem is itself closely related to yet another structured variant, the so-called Polynomial Learning With Errors (P-LWE) problem [START_REF] Stehlé | Efficient public key encryption based on ideal lattices[END_REF]. For specific choices of number fields K and defining polynomials f (x) both problems are equivalent, as shown by Roşca et al. [START_REF] Roşca | On the ring-lwe and polynomial-lwe problems[END_REF]. The special case of M-LWE, where the ring has degree n = 1 and thus R = Z, is exactly the original LWE problem. This is why M-LWE can be seen as a generalization of the unstructured LWE and the structured R-LWE (and hence P-LWE) problems.

In many respects, the more recent problem M-LWE resembles its unstructured and more studied counterpart LWE. For instance, for suitable parameter choices M-LWE also enjoys worst-case to average-case connections from lattice problems such as SIVP γ or GapSVP γ [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]. Whereas the hardness results for LWE start from the lattice problem in the class of general Euclidean lattices, the set has to be restricted to module lattices in the case of M-LWE. Such module lattices correspond to modules in the ring R and we refer to the related lattice problems as Mod-SVP γ , Mod-GapSVP γ and Mod-SIVP γ , respectively. Note that we are now considering lattice problems in a specific class of lattices which have an additional algebraic structure. One may rise the question if those lattice problems are still hard when we restrict them to module lattices. In the special case of module lattices of rank 1, i.e., ideal lattices, there are indeed some weaknesses. First, the decision problem Mod-GapSVP γ becomes easy to solve for ideal lattices, as their minimum can be bounded above and below [START_REF] Peikert | Lattices that admit logarithmic worst-case to average-case connection factors[END_REF]. Second, for some classes of number fields the SVP γ problem is shown to be easier on ideal lattices than on general lattice [CDPR16, CDW17, PHS19, BR20]. However, no algorithm is known so far that solves problems over module lattices of rank strictly larger than 1 faster than on general lattices, lead-

INTRODUCTION ing to the following conjecture:

Conjecture 2: There is no polynomial-time classical or quantum algorithm that approximates the lattice problems Mod-SVP γ , Mod-GapSVP γ or Mod-SIVP γ to within polynomial factors γ for module lattices of rank at least 2.

Nevertheless, some important properties that have been proven for LWE, have not (yet) been demonstrated for M-LWE. For instance, LWE possesses a classical reduction from worst-case lattice problems as shown by Peikert [START_REF] Peikert | Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[END_REF] and later improved by Brakerski et al. [BLP + 13], which is not known for M-LWE. Furthermore, LWE doesn't become significantly easier, even if the uniform secret distribution ψ s is replaced by some narrower distribution, yielding for instance binary secrets [GKPV10, BLP + 13], again, no such result is proven for the module setting. Since its introduction in 2012, M-LWE has enjoyed more and more popularity as it offers a finegrained trade-off between concrete security and efficiency. Within the NIST standardization process [NIS], several third round candidates rely on the hardness of M-LWE, e.g., the signature scheme Dilithium [DKL + 18] and the key encapsulation mechanism Kyber [BDK + 18].

Gaining in efficiency on the positive side comes with a potential decrease in the security level guarantees on the negative side. There are concrete examples of polynomials f (x) for which P-LWE becomes computationally easy: for instance when f (x) has a linear factor over Z [START_REF] Castryck | Provably weak instances of ring-lwe revisited[END_REF]. Note that this case is excluded by restricting to irreducible polynomials. A review on the known weak instances of P-LWE and R-LWE is given by Peikert [START_REF] Peikert | How (not) to instantiate ring-lwe[END_REF]. To the best of our knowledge, it is still not fully understood how to choose a good polynomial for instantiating structured variants of LWE. Motivated by the question of how to choose a good polynomial, Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF] introduce the Middle-Product Learning With Errors (MP-LWE) problem, a variant of LWE, whose hardness does not depend on a single polynomial, but on a set of exponentially many polynomials. Informally, the middle-product of two polynomials is determined by the middle coefficients of their convolution product, and thus it is independent of some defining polynomial. As for the hardness of MP-LWE, Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF] establish a reduction from the P-LWE problem parametrized by a polynomial f (x) to the MP-LWE problem defined independently of any such f (x). Thus, as long as the P-LWE problem defined over some f (belonging to a huge family of polynomials) is hard, the MP-LWE problem is also guaranteed to be hard. A more recent result by Peikert and Pepin [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF] shows a tighter (and more direct) reduction from R-LWE to MP-LWE. As a cryptographic application, Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF] propose an encryption scheme that is proven secure under the MP-LWE hardness assumption, with keys of size Õ(λ) and running time Õ(λ), where λ is the security parameter.

Contributions

The research that is presented in this manuscript focuses on structured variants of the LWE problem and their use for quantumly secure cryptography. In the following, we outline the shown contributions which can be divided into two different categories. The first part contains contributions to the better understanding of the theoretical foundations of lattice-based cryptography. The second part includes the design of two efficient encryption schemes, whose security proofs are based on structured lattice problems. We illustrate the contributions and contextualize them with respect to existing results in Figure 5. Chapter 5

Partial Vandermonde Problems

Worst-Case Problem Average-Case Problem

Cryptographic Construction

Figure 5: Overview of the contributions presented in this thesis and their connection to existing results. The boxes in green represent worst-case problems over structured lattices, the blue ones are average-case lattice problems and the red boxes design cryptographic constructions. An arrow from one to another box denotes the existence of an efficient reduction from the first to the second problem. In the case of an arrow from a problem to a cryptographic scheme, it says that the security of the scheme is based on the corresponding problem. To ease readability, we omit the associated parameters of the problems, which may be affected by the reduction. An orange arrow means that the reduction is not classical, but quantum.

INTRODUCTION

Theoretical Foundations

As explained before, there are some important characteristics that have been proven for LWE, which have not (yet) been demonstrated for M-LWE. We think that a rigorous study of the M-LWE problem is essential to deepen our confidence in the difficulty assumptions that are made in currently proposed cryptographic schemes for standardization. In the following, we present how we fill two of such knowledge gaps concerning M-LWE.

Binary Hardness

As a first contribution, we prove in Chapter 2 that M-LWE remains difficult to solve, even if the secret distribution ψ s yielding the vector s over the ring R is changed. Instead of using the uniform distribution which leads to polynomials with large coefficients (i.e., in Z q ), we can also use a distribution which yields polynomials with binary coefficients (i.e., in {0, 1}). We denote the latter problem by bin-M-LWE. It is particularly interesting as it increases efficiency, enables efficient modulus-rank switching techniques [BLP + 13, AD17a, WW19] and is needed in Fully Homomorphic Encryption schemes as in [START_REF] Ducas | FHEW: bootstrapping homomorphic encryption in less than a second[END_REF][START_REF] Chillotti | Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds[END_REF]. For the unstructured case, reductions from LWE to LWE with a binary secret and slightly increased dimension and error bound have been shown [GKPV10, BLP + 13, Mic18]. However, all existing results work over the integers Z and not over the ring of integers R of some number field K. Hence, as stated by Micciancio in the conclusion of [START_REF] Micciancio | On the hardness of learning with errors with binary secrets[END_REF], an important open problem is whether similar results carry over to the structured variants, in particular to M-LWE. In this thesis we make progress towards solving this problem by proving the hardness of bin-M-LWE, if the module rank d is (super-)logarithmic in the degree n of the underlying number field K. More precisely, we present two different proofs to obtain this result, which slightly differ in their requirements, achieved parameters and concrete variants of the problem. Moreover, we show that both reductions can be generalized to a larger secret distribution ψ s , where the secret vector s over the ring R has coefficients in {0, . . . , η-1} for some positive integer η. Thus, bin-M-LWE corresponds to the special case of η = 2. Using secrets with larger coefficients increases the resulting error linearly in η, but weakens the rank condition by a logarithmic factor.

The results of this chapter imply the hardness of M-LWE with a small (with respect to its coefficients) secret and a moderate rank (e.g., Ω(log 2 n)), which is guaranteed even in the presence of arbitrarily many samples. For a flexible choice of parameters, current NIST candidates as Dilithium [DKL + 18] and Kyber [BDK + 18] consider M-LWE variants with a small secret and also a small rank, while restricting the number of samples to be small (e.g., linear in n) to rule out the BKW type of attacks [START_REF] Kirchner | An improved BKW algorithm for LWE with applications to cryptography and lattices[END_REF].

Reference: The content of this chapter, besides the generalization to larger secret distributions, is based on two joint works with Corentin Jeudy, Adeline Roux-Langlois and Weiqiang Wen. The first is published in the proceedings of the conference Asiacrypt 2020 [BJRW20] and the second is published in the proceedings of the conference CT-RSA 2021 [START_REF] Boudgoust | On the hardness of modulelwe with binary secret[END_REF].

Classical Hardness

As a second contribution concerning the theoretical hardness of M-LWE, we strengthen its connection to worst-case problems over structured Euclidean lattices. More precisely, we prove in Chapter 3 a classical reduction from the worst-case problem Mod-GapSVP over module lattices to M-LWE. As a result, a classical and efficient algorithm that solves M-LWE could be used to xxvii solve the decision version of the Shortest Vector Problem over module lattices, which is supposed to be intractable. Prior to this, only a quantum reduction from the related problem Mod-SIVP over module lattices was known [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF].11 Such a reduction requires quantum computers, which are extremely powerful, expensive to construct and not available on a large-scale yet. In contrast, the reduction we present in this thesis only needs standard computers. For the unstructured case, a classical hardness proof from GapSVP to LWE is given by Brakerski et al. [BLP + 13].

At a high level, we follow the same structure as in [BLP + 13] by rigorously adapting all needed results to the module setting. In more details, we need three ingredients: First, we lack a classical reduction from Mod-GapSVP to decision M-LWE with an exponential-sized modulus, which we obtain by adapting the LWE counterpart by Peikert [Pei09] that we combine with a more recent result by Peikert et al. [START_REF] Peikert | Pseudorandomness of ring-lwe for any ring and modulus[END_REF]. As a second component, we need the hardness of M-LWE using a binary secret, which we have proven in Chapter 2. Finally, a modulus reduction technique is required, where we can use the modulus-rank switching technique shown by Albrecht and Deo [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF]. By carefully putting together all three ingredients we prove a classical reduction from Mod-GapSVP with module rank at least 2 to M-LWE for any polynomial-sized modulus p and module rank d at least 3n + ω(log 2 n), where n is the degree of the underlying number field K.

Reference: This chapter can be seen as a continuation of Chapter 2 and is therefore based on the same joint work with Corentin Jeudy, Adeline Roux-Langlois and Weiqiang Wen [START_REF] Boudgoust | Towards classical hardness of module-lwe: The linear rank case[END_REF]. By using the improved results for M-LWE with a binary secret from [START_REF] Boudgoust | On the hardness of modulelwe with binary secret[END_REF], we obtain a simpler and tighter proof compared to the original version in the proceedings of the conference Asiacrypt 2020.

Middle-Product Learning With Rounding

After having studied variants of the M-LWE problem which serve as the underlying hardness assumptions of current practical encryption schemes and digital signatures, we turn in Chapter 4 our attention to a completely new structured version of LWE. The main motivation of this chapter is to combine two flavors of LWE that we have presented before, the middle-product variant MP-LWE and the rounding variant LWR, in order to define a new problem that benefits from both of their advantages. To this end, we introduce a new hardness assumption which we refer to as the Middle-Product Computational Learning With Rounding (MP-CLWR) problem. On the one hand, MP-CLWR uses rounding in a similar way to LWR and hence avoids the Gaussian error sampling. On the other hand, the hardness of MP-CLWR does not depend on a specific defining polynomial f (x), but is guaranteed by the hardness of P-LWE for an exponentially large set of defining polynomials. Thus, the MP-CLWR assumption enjoys the desired properties from both, the security advantage of MP-LWE and the simplicity advantage of LWR.

The reason why we introduce the problem in its computational form, instead of the more standard search or decision variant, is twofold: On the one hand, it is as for today unclear how to reduce the hardness of decision MP-LWR from worst-case lattice problems, while maintaining the coefficient-wise rounding and allowing for a polynomially large modulus. On the other hand, it is unclear how to construct encryption schemes directly on the search variant. The computational notion solves this issue, as we can derive an efficient reduction still allowing for a polynomially large modulus and at the same time we can use it to build an encryption scheme (which we introduce separately in Chapter 6).

Regarding the difficulty of this new problem, we prove that MP-CLWR is at least as hard

INTRODUCTION

as MP-LWE, which is itself based on the hardness of P-LWE for some defining polynomial f (x) which belongs to an exponentially large set.

Reference: The results of this chapter are based on a joint work with Shi Bai, Dipayan Das, Adeline Roux-Langlois, Weiqiang Wen and Zhenfei Zhang which is published in the proceedings of the conference Asiacrypt 2019 [BBD + 19].

Partial Vandermonde Problems

In the chapters before, we study flavors of LWE whose hardness is implied by the presumed intractability of worst-case problems over structured Euclidean lattices. We can see both, the module variants of LWE that we investigate in Chapter 2 and Chapter 3, and the middle-product version of LWR from Chapter 4, as descendants of Ajtai's [Ajt96] and Regev's [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] works. As mentioned before, at the end of the 1990s a second line of work was initiated by Hoffstein et al. [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF], better known as the NTRU encryption scheme. NTRU-derived schemes are usually characterized by their efficiency and simplicity, but lack a connection to worst-case lattice problems.12 Note that among the three lattice-based finalists of NIST's standardization process [NIS], there is also a variant of the original NTRU scheme [CDH + ].

In Chapter 5, we study another family of average-case problems on structured lattices which is related to the discrete Vandermonde transform and that, like the NTRU problem, allows for simple and efficient protocols at the expense of having no known worst-case to average-case connection. In more details, we consider a cyclotomic field K of degree n with associated ring of integers R. A cyclotomic field is a number field whose defining polynomial f (x) is a cyclotomic polynomial (having primitive roots of unity as its roots). Further, we consider a prime q such that f (x) completely splits over Z q , thus, we require f (x) to possess exactly n distinct roots in the field Z q . The discrete Vandermonde transform V • a of a polynomial a ∈ R is the evaluation of this polynomial at the n roots of f (x) over Z q . The conjecture, building the basis of this chapter, is that there is no polynomial-time classical or quantum algorithm that recovers an element of R with small coefficients by having access only to a partial list of its discrete Vandermonde transform. Of course, it is crucial to define how small the coefficients of the polynomial have to be and how large the partial list is that we provide. In analogy to the standard Knapsack problem, we call this the Partial Vandermonde Knapsack problem (PV-Knap). A related problem is Partial Vandermonde SIS (PV-SIS), where, given a subset of the roots of the defining polynomial f (x), one asks to find a ring element of small norm whose evaluation at those roots is zero in Z q . Again, PV-SIS can be seen as specific variant of the standard Short Integer Solution problem, and hence it can be formulated as a Shortest Vector Problem over a structured lattice.

In 2014, Hoffstein et al. [HPS + 14] proposed a digital signature scheme called PASS Sign, whose provable security is based on the difficulty of solving PV-Knap and PV-SIS [START_REF] Lu | Practical signatures from the partial fourier recovery problem revisited: A provably-secure and gaussian-distributed construction[END_REF]. Shortly afterwards, Hoffstein and Silverman [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF] introduce PASS Encrypt, a Public Key Encryption (PKE) scheme whose computational building blocks are closely related to the ones of PASS Sign. Their encryption scheme is very efficient and fulfills additive and multiplicative homomorphic properties, which make it a natural starting point for the design of efficient cryptographic primitives. For example, such properties are recently exploited in the context of PASS Sign to construct compact aggregate signature schemes [START_REF] Doröz | MMSAT: A scheme for multimessage multiuser signature aggregation[END_REF], and it is plausible that combining PASS Encrypt with PASS Sign may form the basis for various compact and efficient privacy-preserving primitives such as group signatures. Unfortunately, a main drawback of PASS Encrypt to date is that xxix no proof of security was given in [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF] with respect to the hardness of explicit computational problems. In this chapter, we make progress towards understanding the hardness assumptions needed to prove the security of PASS Encrypt. First, we emphasize its connection to average-case ideal lattices, even though we can't show a worst-case to average-case reduction as we have for structured variants of LWE. Second, we enlarge the landscape of problems that use the partial Vandermonde transform by defining a new variant of LWE, called Partial Vandermonde Learning With Errors (PV-LWE). Later, we show the equivalence of PV-Knap and PV-LWE by exploiting the same duality connection as we have for standard Knapsack problems and LWE. As our main motivation is to provide a security proof for PASS Encrypt, we define a variant of PV-Knap, that we call the PASS problem. This problem serves (together with the decision version of PV-Knap) as the underlying hardness assumption for (a slightly modified version of) PASS Encrypt. We present the scheme together with the security proof later in Chapter 7. We conclude the chapter by showing that for a special choice of the partial Vandermonde transform, one can accelerate computations when working with PV-Knap and PV-LWE.

Reference: The contributions presented in this chapter are based on a joint work with Amin Sakzad and Ron Steinfeld, which was initiated during a research stay at the Monash University in Melbourne from October to December 2019. The results haven't been published before and are publicly presented for the first time in this thesis.

Cryptographic Constructions

In the first part of the manuscript, we introduce two new hardness assumptions related to problems over structured Euclidean lattices. In order to provide insights in how to use them for cryptography, we construct two Public Key Encryption (PKE) schemes in the second part of this work. Both are proven to be correct and secure assuming explicitly stated computational assumptions. To this end, we use for both schemes the standard notion of IND-CPA security. Informally speaking, this security notion captures that no efficient adversary can distinguish between the ciphertext of two messages, where we allow the adversary to choose the messages by themselves.

Encryption Based on Middle-Product LWR

To show the cryptographic usefulness of our newly defined hardness assumption MP-CLWR from Chapter 4, we present in Chapter 6 a PKE scheme whose hardness is implied by MP-CLWR. Its design is simultaneously inspired by two existing PKE schemes: On the one hand, the PKE scheme from Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF] whose security is based on MP-LWE, and on the other hand, the PKE scheme from Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF] whose security is based on the hardness of the computational variant of LWR over rings. As for [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF], we make use of a so-called reconciliation mechanism, which guarantees the correctness of our scheme. We prove our scheme's correctness and security based on the hardness of MP-CLWR in the idealized Random Oracle Model. As typical for LWRbased schemes, during public key generation we only need to round the middle-product of two polynomials instead of sampling Gaussian error, making it easier to implement than the scheme in [START_REF] Roşca | Middle-product learning with errors[END_REF]. Simultaneously, while guaranteeing an equal level of security, we obtain the same asymptotic key and ciphertext sizes as the PKE scheme of [START_REF] Roşca | Middle-product learning with errors[END_REF]. Furthermore, we save in bandwidth, as the second part of the public key is modulo p and not modulo q, where p q by some order of magnitude. Finally, we analyze the concrete security of our scheme by looking at the currently best known attacks against it.

INTRODUCTION

Reference: This chapter can be seen as the continuation of Chapter 4 and is therefore based on the same joint work with Shi Bai, Dipayan Das, Adeline Roux-Langlois, Weiqiang Wen and Zhenfei Zhang [BBD + 19].

PASS Encrypt

As our final contribution, we present in Chapter 7 a modified version of PASS Encrypt together with a security proof based on the decision PV-Knap problem and a leaky variant of it, that we call the PASS problem, both studied in Chapter 5. The latter problem captures the fact that a ciphertext of PASS Encrypt consists of several partial Vandermonde transforms of related elements. Hence, a successful attacker against PV-Knap can be used to win the IND-CPA security game of PASS Encrypt, but a successful attacker against the IND-CPA security may not be powerful enough to solve PV-Knap. This issue was not addressed before in the original version of PASS Encrypt by Hoffstein and Silverman [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF]. Furthermore, in the original version, the scheme is deterministic and thus cannot be IND-CPA secure. To solve this issue, we make the scheme probabilistic by adding randomness to the message. We then give a proof of correctness for well-chosen parameters and a proof of security, assuming the hardness of decision PV-Knap and PASS. We also provide a refined analysis of the scheme's security, where we show a novel attack that we call Plaintext Recovering Using Hints attack, which takes the structure of PASS Encrypt into account. To this end, we make use of a recent work by Dachman-Soled et al. [START_REF] Dachman-Soled | LWE with side information: Attacks and concrete security estimation[END_REF] to analyze instances of LWE, where additional hints on the secret and/or error are given. Our complexity estimates for this attack show that it does not reduce the attack complexity below that of previously known lattice attacks on PASS, which increases our confidence in the claimed security of PASS Encrypt against best known lattice attacks. We conclude the chapter by providing concrete sample parameters and compare our scheme with two other efficient schemes whose security proofs are based on structured lattice problems.

Reference: This chapter can be seen as the continuation of Chapter 5 and is therefore based on the same joint work with Amin Sakzad and Ron Steinfeld, which was initiated during a research stay at the Monash University in Melbourne from October to December 2019.

Chapter 1

Preliminaries

In this chapter, we recall the mathematical and cryptographic notions needed within this thesis. This encompasses the presentation of the necessary objects of algebraic number theory, lattice theory and probability theory. We further introduce the Learning With Errors problem in its various flavors and conclude with the cryptographic definitions used within this work. Within this thesis, we use the standard Landau notations (e.g., ω(•), Ω(•), O(•) and Θ(•)) and we call a function ε negligible in n if ε(n) = n -ω(1) , i.e., it decreases faster towards 0 than the inverse of any polynomial function. Sometimes, we simply write negl(n) to denote a negligible function in n. The abbreviation PPT stands for probabilistic polynomial-time.

Throughout the manuscript, N denotes the set of natural numbers without 0. For any q ∈ N, we denote by Z q the integers modulo q. For simplicity, we denote by [n] the set {1, . . . , n} for any n ∈ N. We denote the Kronecker symbol by δ j,k which equals 1 if j = k and 0 otherwise. Column vectors are written in bold lowercase letters a and matrices in bold uppercase letters A. The transpose and Hermitian operators over matrices are denoted by A T and A † . The concatenation of two matrices A and B is denoted by [A|B] and their Kronecker product by A ⊗ B. The canonical basis of C n is given by {e j } j∈ [n] , where e j has 1 as its j-th coefficient and else only 0's. For a vector a ∈ C n , we define the matrix diag(a) to be the diagonal matrix whose diagonal entries are the entries of a. For any vector a = (a 1 , . . . , a n ) T , we denote by rev(a) = (a n , . . . , a 1 ) T the vector in reverse order. The identity matrix of size n × n is denoted by I n . For any a ∈ C n , we define the Euclidean norm as a 2 = j∈[n] a j 2 and the infinity norm as a ∞ = max j∈[n] a j . We also define the spectral norm of any matrix

A = (a jk ) j∈[n],k∈[m] ∈ C n×m as A 2 = max x∈C m \{0} Ax 2 /
x 2 , and the max norm as

A max = max j∈[n],k∈[m] a j,k .
The Gram-Schmidt orthogonalization of a matrix A from left to right is denoted by GS(A).

For a complex number z, we denote by R(z) its real component and z its complex conjugate. The singular values of a matrix A are the square roots of the non-negative eigenvalues of A † A and we denote its largest singular value by s 1 (A). In particular, the singular values of a diagonal matrix are given by the absolute values of its diagonal entries. It can be shown that the spectral norm A 2 of a matrix corresponds to its largest singular value.

Algebraic Number Theory

In this section, we give a brief review of the number-theoretic notions that are used in the context of lattice-based cryptography. For further details, we refer to the works of Lyubashevsky et al. [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF][START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF] and the short note of Conrad [Con].

An algebraic number ζ ∈ C is a complex root of a polynomial over Q. Its minimal polynomial f (x) ∈ Q[x] is the unique irreducible monic polynomial of minimal degree such that ζ is one of its roots. Sometimes, we also call it the defining polynomial. An algebraic number is called an algebraic integer if its minimal polynomial has only integer coefficients, i.e., f (x) ∈ Z[x]. A number field K = Q(ζ) of degree n is a finite extension of the rational number field Q obtained by adjoining an algebraic number ζ. The degree n of K is given by the degree of the minimal polynomial of ζ. We define the tensor field K R = K ⊗ Q R which can be seen as the finite field extension of the reals by adjoining ζ. The set of all algebraic integers of K defines a ring, called the ring of integers, which we denote by R. It is always true that Z[ζ] ⊆ R, where this inclusion can be strict. Some results of this thesis are restricted to the class of number fields, where the equality R = Z[ζ] holds. This is the case for some quadratic extensions (i.e., when ζ = √ d with d square-free and d = 1 mod 4), cyclotomic fields (i.e., when ζ is a primitive root of unity) and number fields with a defining polynomial f (x) of square-free discriminant ∆ f . The class of cyclotomic number fields plays an important role in this manuscript. For ν ∈ N let ζ ∈ C be a ν-th root of unity, i.e., ζ ν = 1. Then, the ν-th cyclotomic number field K = Q(ζ) has degree n = ϕ(ν), where ϕ is Euler's totient function. In this case, the minimal polynomial is f (x) = j∈[n] (x -α j ), where the α j are the distinct primitive ν-th roots of unity.

Example 1.1 (Power-of-2 Cyclotomic Fields) One particularly interesting subclass of cyclotomic fields, from a theoretical and practical point of view, is given by cyclotomic fields where ν is a power of 2, i.e., ν = 2 +1 for some ∈ N. In this case, it yields n = ϕ(ν) = 2 and f (x) = x n + 1. In the following, we take this as our running example to illustrate properties and constructions defined in this section. Furthermore, several results of this thesis are restricted to this special class of number fields, as for instance Section 3.4.2, Section 5.3 and Section 5.4.

Space H

Let K = Q(ζ) be a number field of degree n. By t 1 we denote the number of real roots of the minimal polynomial of ζ, and by t 2 the number of pairs of complex conjugate roots, such that n = t 1 + 2t 2 . We introduce the space H ⊆ R t1 × C 2t2 as

H = x = (x 1 , . . . , x n ) T ∈ R t1 × C 2t2 : x t1+t2+j = x t1+j , ∀j ∈ [t 2 ] .
For j ∈ [t 1 ], we set h j = e j , and for j ∈ {t 1 + 1, . . . , t 1 + t 2 }, we set h j = 1 √ 2 (e j + e j+t2 ) and

h j+t2 = i √ 2
(e j -e j+t2 ), where i denotes the complex imaginary number i = √ -1. The set {h j } j∈[n] forms an orthonormal basis of H as a real vector space, showing that H is isomorphic to R n . The change of basis is given by the unitary matrix

H =    I t1 0 0 0 1 √ 2 I t2 i √ 2 I t2 0 1 √ 2 I t2 -i √ 2 I t2    ,
where I n denotes the n × n identity matrix.

Canonical Embedding, Trace and Norm

Any number field K = Q(ζ) of degree n has exactly n field embeddings (i.e., injective field homomorphisms) σ j : K → C fixing each element of Q, where j ∈ [n]. Let σ 1 , . . . , σ t1 be the real embeddings (i.e., the embeddings whose image lies in R) and σ t1+1 , . . . , σ t1+2t2 the complex embeddings (i.e., the embeddings whose image lies in C). The complex ones come in conjugate pairs, thus σ j = σ j+t2 for j ∈ {t 1 + 1, . . . , t 1 + t 2 }. In the case of cyclotomic fields, all n embeddings are complex, thus t 1 = 0 and t 2 = n 2 . The canonical embedding σ is the map σ : K → H , defined by σ(x) = (σ j (x)) j∈

(σ(x k )) k∈[d] ∈ H d ⊆ C nd .
We can represent σ(x) ∈ H via the real vector σ H (x) ∈ R n through the change of basis described above, i.e., σ H (x) = H † • σ(x). Note that, as opposed to σ, multiplication is not component-wise for σ H . More concretely, in the basis {e j } j∈[n] , multiplication by x ∈ K can be described as the left multiplication by the diagonal matrix X = diag(σ(x)). Hence, changing to the basis {h j } j∈[n] leads to the corresponding matrix of multiplication X H = H † •X•H, having the same singular values as X, given by σ j (x) for j ∈ [n].

We use the canonical embedding σ to define two different norms on vectors over K. The first can be seen as the standard infinity norm, after having applied the canonical embedding. The second is a mixture between the Euclidean norm (with respect to the different coefficients of the vector over K) and the infinity norm (with respect to the canonical embedding). For an ele-

ment x ∈ K d , we define x ∞ = max j∈[n],k∈[d] σ j (x k ) , and x 2,∞ = max j∈[n] k∈[d] σ j (x k ) 2 .
The trace Tr : K → Q and the norm N : K → Q are defined as the sum and product, respectively, of the embeddings, i.e., for any x ∈ K, we have Tr(x) = j∈[n] σ j (x). and N(x) = j∈[n] σ j (x).

Coefficient Embedding and Rotation Matrix

Every number field K = Q(ζ) of degree n defines an n-dimensional vector space over Q with basis {1, ζ, . . . , ζ n-1 }. Thus, every element x ∈ K can be written as x = n-1 j=0 x j ζ j , where x j ∈ Q. The coefficient embedding τ : K → Q n is the isomorphism that sends every element x ∈ K to its coefficient vector τ (x) = (x 0 , . . . , x n-1 ) T . We also extend the coefficient embedding to K R , which yields an isomorphism between K R and R n . Multiplication by x in the coefficient embedding can be represented by a matrix multiplication, where we denote the corresponding matrix by Rot(x) ∈ R n×n . More concretely, for any x, y, z ∈ K with x = yz, it yields τ (x) = Rot(y) • τ (z). Note that the matrix Rot(x) is invertible in K for every x = 0 and that its concrete form depends on the field K.

As both embeddings play an important role in this thesis, we recall how to go from one to the other. For any x ∈ K, the embeddings σ(x) and τ (x) are linked through the Vandermonde matrix V of the roots of the defining polynomial f (x). For j ∈ [n], we let α j = σ j (ζ) be the j-th root of f (x). Then, σ(x) = V • τ (x), where

V =      1 α 1 • • • α n-1 1 1 α 2 • • • α n-1 2 . . . . . . . . . 1 α n • • • α n-1 n      ∈ C n×n .
Example 1.2 (Power-of-2 Cyclotomic Fields)

Looking at the example where K = Q(ζ) is the ν-th cyclotomic field with ν a power of 2 and thus K ∼ = Q[x]/ x n + 1 with n = ν/2, the matrix of multiplication is nega-circulant. More precisely,

Rot(x) =       x 0 -x n-1 • • • -x 1 x 1 x 0 . . . . . . . . . . . . . . . -x n-1 x n-1 x n-2 • • • x 0       ∈ R n×n .
Using the above, the product of two elements a, b ∈ K with respect to the coefficient embedding

τ fulfills τ (a • b) ∞ = Rot(a) • τ (b) ∞ ≤ τ (a) 1 • τ (b) ∞ .
Furthermore, the Vandermonde matrix fulfills V † V = n • I n , thus the singular values of V all equal √ n and hence multiplying by V is an isometry with scaling factor √ n. This is not true for more general power-of-prime cyclotomic fields, where the singular values of V are well known, but are in general not all the same (see [YXW17, Lem. 14]) and thus multiplying by V is not a scaled isometry. This transformation is not necessarily structure preserving, e.g., a vector of small norm in the coefficient embedding doesn't need to be of small norm in the canonical embedding as well. This is captured by the inequalities

V -1 -1 2 τ (x) 2 ≤ σ(x) 2 ≤ V 2 τ (x) 2 . (1.1)
Hence, the spectral norm of V and its inverse V -1 help approximating the distortion between both embeddings. Roşca et al. [START_REF] Roşca | On the ring-lwe and polynomial-lwe problems[END_REF] give additional insight on this distortion for specific number fields. Later in Chapter 2, we need for some positive integer η a bound on the parameter B = max x∈Rη σ(x) ∞ , where R η denotes the set of ring elements with a coefficient vector in {0, . . . , η -1} n . This parameter is inherent to the ring and intervenes in the proof of Lemma 2.2, Lemma 2.3 and Lemma 2.5. Here, we provide an upper-bound on B with respect to the maximum norm of V, that is further simplified for cyclotomic number fields.

Lemma 1.1 (Upper Bound on B)

For n ∈ N, let K be a number field of degree n with R its ring of integers. For η ∈ N, we define the set R η = {x ∈ R : τ (x) ∈ {0, . . . , η -1} n } and let V be the associated Vandermonde matrix. Then, B := max x∈Rη σ(x) ∞ ≤ n(η -1) V max . In particular, for cyclotomic fields, it yields B ≤ n(η -1).

Proof: We can express x ∈ R η as x = n-1 j=0 b j ζ j , with b j ∈ {0, . . . , η -1} for all 0 ≤ j ≤ n -1. Then, for k ∈ [n], we obtain

|σ k (x)| ≤ n-1 j=0 b j |σ k (ζ)| j = n-1 j=0 b j |α k | j ≤ V max n-1 j=0 b j ≤ n(η -1) V max .
Taking the maximum over all k ∈ [n] yields B ≤ n(η -1) V max . In the case of cyclotomic fields, the α k are roots of unity and therefore, all the entries of V have magnitude 1. Hence V max = 1 which yields B ≤ n(η -1) in this case.

Discrete Vandermonde Matrix

In the case of cyclotomic number fields, we can easily control the splitting behavior of the minimal polynomial over the finite field Z q , for q prime. More precisely, let K = Q[x]/ f (x) be the ν-th cyclotomic field with minimal polynomial f (x) of degree ϕ(ν) = n and let q be prime. If q = 1 mod ν, then f (x) completely splits in Z q [x], i.e., f (x) = j∈[n] (x -ω j ) mod q, where every ω j is a distinct primitive ν-th root of unity in Z q . Simultaneously, the ideal generated by q over the ring of integers R = Z[x]/ f (x) has exactly n prime ideal factors defined by the ω j , i.e., q = j∈[n] q, x -ω j . In this case, the ν-th cyclotomic number field K = Q(ζ) with ζ a complex primitive ν-th root of unity, possesses exactly n field homomorphisms σ j : K → Z q for j ∈ [n], that map ζ to each of the distinct primitive roots ω j over Z q . The discrete canonical embedding 1 σ is the field homomorphism from K to Z n q , defined as σ(a) = (σ j (a)) j∈ [n] . As for the canonical embedding σ over the complex numbers, as introduced in Section 1.1.2, the addition and multiplication are component-wise with respect to σ. Hence, σ(a+b) = σ(a)+σ(b) and σ(a•b) = σ(a)•σ(b) for a, b ∈ K. Furthermore, we can again link the coefficient embedding τ and the discrete canonical embedding σ via the Vandermonde matrix of the roots of f (x) in Z q . To distinguish this Vandermonde matrix from the one over C that we defined above, we denote the discrete one over Z q by V = (ω k-1 j ) j,k∈[n] ∈ Z n×n q .

1.1.5 Modules, Ideals and Units

Let K be a number field with R its ring of integers and

d ∈ N. A subset M ⊆ K d is an R-module of rank d if
I = uR = u . An ideal p = R of R is prime if for all a, b ∈ R, a • b ∈ p implies that a or b is in p.
We define the norm of an ideal N (I) as the index of I as an additive subgroup of R, which corresponds to N (I) = |R/I|.

We define the dual of an ideal I by I ∨ = {x ∈ K : Tr(xy) ∈ Z ∀y ∈ I} and the dual of a module M ⊆ K d by M ∨ = {x ∈ K d : Tr( x, y ) ∈ Z ∀y ∈ M}. Note that R trivially defines an ideal and thus we can define its dual R ∨ . In the case of

R = Z[ζ], it yields R ∨ = 1 f (ζ) R, where f (x) is the defining polynomial of K. To facilitate notations, we set λ = f (ζ), such that λ • R ∨ = R Example 1.3 (Power-of-2 Cyclotomic Fields)
For the ν-th cyclotomic field K, where ν is a power of two and n = ν/2, it holds R ∨ = 1 n R. In other words, R ∨ is just a scaling of R.

In the construction of Lemma 2.2 in Chapter 2, we need a condition for elements of R η for some η ∈ N, i.e., elements of R with a coefficient vector in {0, . . . , η -1} n , to be invertible in R q for a specific prime q. Recall that non-trivial invertible elements in a ring are called units. To do so, we rely on the small norm condition for cyclotomic fields proven by Lyubashevsky and Seiler [START_REF] Lyubashevsky | Short, invertible elements in partially splitting cyclotomic rings and applications to lattice-based zero-knowledge proofs[END_REF]. Lemma 1.2 (Invertibility [LS18, Thm. 1.1]) For ν ∈ N, let K be the ν-th cyclotomic field and let ν = j p ej j be its prime-power factorization, with e j ≥ 1. We denote by R the ring of integers of K. Also, let µ = j p fj j for some f j ∈ [e j ]. Let q be a prime such that q = 1 mod µ, and ord ν (q) = ν/µ, where ord ν is the multiplicative order modulo ν. Then, any element y of R q satisfying 0 < τ (y) ∞ < q 1/ϕ(µ) /s 1 (µ) is a unit in R q , where s 1 (µ) denotes the largest singular value of the Vandermonde matrix of the µ-th cyclotomic field.

If ν is a prime power, then so is µ and then [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF] states that s 1 (µ) = √ µ if µ is odd, and s 1 (µ) = √ µ/2 otherwise. For more general cases, we refer to the discussions of Lyubashevsky and Seiler [LS18, Conj. 2.6]. We also refer to [LS18, Thm. 2.5] that establishes the density of such primes q for specific values of ν and µ. For the ν-th cyclotomic field K, where ν is a power of 2 and n = ν/2, Lemma 1.2 specifies to the following statement. For any power of two κ ≤ n such that the prime q fulfills q = 2κ + 1 mod 4κ, the invertibility condition for y ∈ R q becomes 0 < τ (y) ∞ < q 1/κ / √ κ.

We further recall a result from Wang and Wang [START_REF] Wang | Module-lwe versus ring-lwe, revisited[END_REF] that we need in the proof of Lemma 2.1 in Chapter 2 to construct an invertible matrix over R q . We say that for ∈ [k], the vectors a 1 , . . . , a ∈ R k q are R q -linearly independent if for all x 1 , . . . , x ∈ R q , j∈[ ] x j a j = 0 mod qR implies x 1 = . . . = x = 0. Further, a matrix A ∈ R k×k q is invertible modulo qR if there exists a matrix

A -1 ∈ R k×k q such that A • A -1 = A -1 • A = I k mod qR.
Lemma 1.3 (Independence and Invertibility [WW19, Lem. 9+18])

Let K be the ν-th cyclotomic field of degree n = ϕ(ν), and R its ring of integers. Let q, k ∈ N such that q is a prime that verifies q ≥ n and q ν. Then for any j ∈ [k -1] and R q -linearly independent vectors a 1 , . . . , a j ∈ R k q , the probability of sampling a vector b ← U (R k q ) such that a 1 , . . . , a j , b are R q -linearly independent is at least 1 -n q . Let A = [a 1 , . . . , a k ] ∈ R k×k q . Then, A is invertible modulo qR if and only if a 1 , . . . , a k are R q -linearly independent.

Lattice Theory

In this section, we briefly present the definition of Euclidean and structured lattices together with some of their important properties. For a more detailed introduction of lattices for their use in lattice-based cryptography we refer for instance to [START_REF] Micciancio | Lattice-based cryptography[END_REF] and [START_REF] Peikert | A decade of lattice cryptography[END_REF].

Euclidean Lattices

An Euclidean lattice Λ is a discrete subgroup of R n . Since the space H as introduced in Section 1.1.1 is isomorphic to R n , we sometimes consider lattices that are discrete subgroups of H . Each lattice can be represented by a basis matrix B = (b j ) j∈[r] ∈ R n×r for some r ≤ n ∈ N, as the set of all integer linear combinations of the basis elements, i.e., Λ = j∈[r] Z • b j . The dimension of the lattice is n and the rank is r. In this thesis, we only consider full-rank lattices, namely lattices for which r = n.

The origin-centered fundamental parallelepiped P(B) of the lattice Λ generated by the basis B = (b j ) j∈[n] is defined by

P(B) = j∈[n] z j b j : z j ∈ -1 2 , 1 2 , ∀j ∈ [n] .
For any w ∈ R n , we write x = w mod B or x = w + Λ to denote the unique point x ∈ P(B) such that wx ∈ Λ. The volume of P(B) is called the determinant of Λ and denoted by det(Λ). The determinant is independent of the choice of the basis B and thus an invariant of the lattice. For any basis B of a full-rank lattice Λ it yields det(Λ) = |det(B)|.

We define the dual lattice of a lattice Λ by Λ * = {x ∈ Span(Λ) : ∀y ∈ Λ, x,y ∈ Z}. If B is a basis of Λ, then B * = (B T ) -1 is a basis of Λ * . The first minimum λ 1 (Λ) of a lattice Λ is the Euclidean norm of any of its shortest non-zero vectors. The first minimum with respect to the infinity norm is denoted by λ ∞ 1 (Λ). We further define the second minimum λ 2 (Λ) as the norm of any second shortest non-zero vector, which we require to be linearly independent of all shortest vectors. Using Minkowski's theorem, we can upper bound the norm of a shortest non-zero vector in arbitrary lattices. More concretely, for a lattice Λ of dimension n and determinant det(Λ), it yields λ 1 (Λ) ≤ √ n det(Λ) 1/n . Heuristically, one can estimate the expected norm of a shortest nonzero vector in randomly chosen lattices by using the Gaussian heuristic, which slightly improves the Minkowski bound. It says that for an n-dimensional lattice Λ with determinant det(Λ), we expect

λ 1 (Λ) ≈ n 2πe • det(Λ) 1/n . (1.2)
There is a special class of lattices which plays an important role in lattice-based cryptography. Given a matrix A ∈ Z n×m q for some integers n, m, q ∈ N, we can define two lattices Λ q (A) = {y ∈ Z m : y = A T s mod q for some s ∈ Z n } and

Λ ⊥ q (A) = {y ∈ Z m : Ay = 0 mod q}.
Both lattices are of dimension m. The first is generated by the rows of A, whereas the second contains all vectors that are orthogonal to the rows of A. Furthermore, they are connected via lattice duality, i.e., Λ ⊥ q (A) = q • Λ q (A) * and Λ q (A) = q • Λ ⊥ q (A) * .

Structured Lattices

We now define two types of structured lattices. Let K be number field with ring of integers R.

To define the first class of structured lattices, we observe that any ideal I over R embeds into a lattice σ(I) in H , and a lattice σ H (I) in R n , which we call ideal lattices. The ideal lattice inherits the algebraic structure of the corresponding ideal, i.e., multiplying a lattice vector by any ring element maps it again to a lattice vector. This is not true for general Euclidean lattice.

Regarding the second class of structured lattices, we remark that for an R-module M ⊆ K d , the set (σ, . . . , σ)(M) is a lattice in H d and (σ H , . . . , σ H )(M) is a lattice in R nd , both of which are called module lattices. The positive integer d is the module rank and module lattices of rank 1 are in fact ideal lattices. Again, the module lattice inherits the algebraic structure of the underlying module, making it closed with respect to scalar multiplication by ring elements.

To ease readability, we simply use I (resp. M) to denote the ideal lattice (resp. the module lattice). Note that the ideal lattice σ(I ∨ ) corresponding to the ideal I and the module lattice σ(M ∨ ) corresponding to the module M are the same as the respective dual lattices up to complex conjugation, i.e., σ(I ∨ ) = σ(I) * and σ(M ∨ ) = σ(M) * .

Recall that for arbitrary lattices Minkowski's theorem provides an upper bound on their first minimum. For ideal (but not module) lattices, we can use the geometric-arithmetic mean inequality to additionally give a lower bound for their minimum. Here, we state the result with respect to the infinity norm, but it can be shown for any p -norm. Lemma 1.4 (Lower Bound on Minima [PR07, Lem. 6.2]) For any ideal I over a number field K with ring of integers R of degree n, it yields

λ ∞ 1 (σ H (I)) ≥ N (I) 1/n .
We also note that for the infinity norm, the first minimum of the module lattice I d = I ×. . .×I is the same as the first minimum of the ideal lattice I, i.e., λ ∞ 1 (I d ) = λ ∞ 1 (I).

Computational Problems

One of the most studied lattice problems is the Shortest Vector Problem (SVP). It exists in both search and decision versions, which we define in their approximate variants in the following. The GapSVP γ restricted to module lattices is denoted by Mod-GapSVP γ . Whereas the problem GapSVP γ is conjectured to be hard to solve for γ polynomial in the lattice dimension, the problem Mod-GapSVP γ becomes easy in the special case of modules of rank 1 (i.e., ideals) as the minimum of ideal lattices can be bounded above and below, see Lemma 1.4. However, it is still conjectured that Mod-GapSVP γ is hard to solve for γ polynomial in the module lattice dimension if the module has rank at least 2.

Another lattice problem is the Unique Shortest Vector Problem (u-SVP), where we need to find a shortest vector, having the additional promise that there is a gap between the first and second minimum of the lattice. Definition 1.3 (Unique Shortest Vector Problem): Let δ ≥ 1. An input to the Unique Shortest Vector Problem u-SVP δ is given by a basis B of an n-dimensional lattice Λ such that λ 2 (Λ) ≥ δ • λ 1 (Λ). The goal is to find a vector x ∈ Λ of norm λ 1 (Λ).

If δ = 1, this problem becomes the exact SVP problem from above (i.e., Def. 1.1 with γ = 1). Note that the problem becomes easier for increasing δ.

Within this thesis, we further need two intermediate lattice problems, presented in the following. The first comes in two flavors, one for general Euclidean lattices, and one for module lattices. For technical reasons, we we state the first one with respect to the infinity norm, whereas in the second one we use the (2, ∞)-norm as defined in Section 1.1.2. Definition 1.4 (Bounded Distance Decoding): Let B be a basis of an n-dimensional lattice Λ(B) and δ be a positive real. An input to the Bounded Distance Decoding problem BDD δ is a point y ∈ R n of the form y = x + e, where x ∈ Λ(B) and e ∞ ≤ δ. The problem asks to find x (or equivalently e).

If δ < λ 1 (Λ(B))/2, then the solution to BDD δ is unique. Definition 1.5 (Module Bounded Distance Decoding): Let K be a number field with R its ring of integers of degree n and M ⊆ K d be a module of R of rank d. Further, let δ be a positive real number. An input to the Module Bounded Distance Decoding problem BDD M,δ is a point y ∈ K d of the form y = x + e, where x ∈ M and e 2,∞ ≤ δ. The problem asks to find x (or equivalently e).

By D g we denote the continuous Gaussian distribution of width g over K d R , which we define properly in Section 1.3.2. As we only need the following problem for module lattices, we directly define it in this setting. Definition 1.6 (Gaussian Decoding Problem): Let K be a number field with R its ring of integers of degree n and M ⊆ K d be a module of R of rank d. Further, let g > 0 be a Gaussian parameter. An input to the Gaussian Decoding Problem GDP M,g is a coset e+M, where e ← D g . The goal is to find e.

Every GDP M,g instance defines a BDD M,δ instance with δ = g • √ d • ω( log 2 n).
Note that all computational problems can also be defined with regard to other norms. We finally recall (for the module setting) the well-known result that the LLL algorithm together with Babai's round-off algorithm solves BDD for an exponentially large δ.

Lemma 1.5 (The LLL Algorithm [LLL82, Bab85])
Let K be a number field with R its ring of integers of degree n and M ⊆ K d be a module of R of rank d. There exists a polynomial-time algorithm that finds a vector of norm at most 2 N 2 • λ 1 (M) and solves BDD M,δ for δ = 2 -N 2 • λ 1 (M), where N = nd.

Probability Theory

In this section, we introduce the notions of probability theory needed within this manuscript. First, we recall the definitions and some properties of Gaussian measures and how to define them over number fields. Then, we define two measures of distance for probability distributions that are commonly used in cryptography. We conclude this section by providing two flavors of the so-called Leftover Hash Lemma. For a finite set S, we denote its cardinality by |S| and the uniform distribution over S by U (S). The operation of sampling an element x ∈ S according to a distribution D over S is denoted by x ← D, where the set S is implicit.

Gaussian Measures

For a positive definite matrix Σ ∈ R n×n , a vector c ∈ R n , we define the Gaussian function by ρ c, √ Σ (x) = exp(-π(xc) T Σ -1 (x -c)) for all x ∈ R n . We extend this definition to the degenerate case, i.e., positive semi-definite, by considering the generalized Moore-Penrose inverse. For convenience, we use the same notation as the standard inverse. We then define the continuous Gaussian probability distribution by its density D c,

√ Σ (x) = (det(Σ)) -1/2 ρ c, √ Σ (x)
. By abuse of notation, we call Σ the covariance matrix, even if in theory the covariance matrix of D c, onal with diagonal vector r 2 ∈ (R + ) n , we simply write D c,r , and if c = 0, we omit it. When Σ = s 2 I n for some positive real s, we simplify further to D c,s . We then define the discrete Gaussian distribution over a lattice Λ by conditioning x to be in Λ, i.e., D Λ,c,

√ Σ is Σ/(2π). If Σ is diag-
√ Σ (x) = D c, √ Σ (x)/D c, √ Σ (Λ) for all x ∈ Λ, where D c, √ Σ (Λ) = y∈Λ D c, √ Σ (y).
For the simple one-dimensional case, we sketch their corresponding probability and mass functions in Figure 1.1. An important property of continuous and discrete Gaussians is that they allow for concrete tail bounds. In this thesis, we only need the tail bound for the discrete case, as stated in the following.

Lemma 1.6 (Discrete Gaussian Tail Bound [Ban93, Lem. 1.5]) For any lattice Λ ⊆ R n , vector c ∈ R n and parameter s > 0, it yields Pr x←D Λ,c,s x -c 2 ≤ s √ n ≥ 1 -2 -Ω(n) .
The smoothing parameter of a lattice Λ, denoted by η ε (Λ) for some ε > 0 and introduced by Micciancio and Regev [START_REF] Micciancio | Worst-case to average-case reductions based on gaussian measures[END_REF], is the smallest s > 0 such that ρ 1/s (Λ * \ {0}) ≤ ε. It represents the smallest Gaussian parameter s > 0 such that the discrete Gaussian D Λ,c,s behaves in many respects like a continuous Gaussian distribution. We recall the following bounds and properties of the smoothing parameter that we need throughout this thesis.

Lemma 1.7 ([Pei08, Lem. 3.5])

For an n-dimensional lattice Λ and ε > 0, we have

η ε (Λ) ≤ ln(2n(1 + 1/ε))/π/λ ∞ 1 (Λ * ).
Whereas the first bound uses the minimum with respect to the infinity norm, the next uses the minimum with respect to the Euclidean norm.

= exp(-n), it holds √ n √ πλ 1 (Λ * ) ≤ η ε (Λ) ≤ √ n λ 1 (Λ * ) .
Lemma 1.9 ([MR07, Lem. 4.1])

Let Λ be an n-dimensional lattice, ε > 0, and s > η ε (Λ). Then the distribution of the coset e + Λ, where e ← D s , is within statistical distance ε/2 of the uniform distribution over the cosets of Λ.

Recall that continuous Gaussian distributions are linear and in particular the sum of two Gaussians D c1,

√ Σ1 and D c2, √ Σ2 follows the Gaussian distribution D c1+c2, √ Σ , where Σ = Σ 1 + Σ 2 .
To obtain similar results for the discrete case, we need the smoothing parameter. In the following, we consider the special case of the sum of a continuous Gaussian and a discrete one. In particular, the lemma generalizes known results to elliptical Gaussians, which we use in the proof of Lemma 1.16.

Lemma 1.10 (Adapted from [LS15, Lem. 2.8] & [Reg09, Claim 3.9])
Let Λ be an n-dimensional lattice, a ∈ R n , R, S two positive semi-definite matrices of R n×n , and T = R + S. We also define U = R -1 + S -1 -1 , and we assume that Proof: The density function of the distribution Y is given by

ρ √ U -1 (Λ * \ {0}) ≤ ε for some ε ∈ (0, 1/2). Consider the distribution Y over R n obtained
Y (x) = y∈Λ+a D Λ+a, √ R (y)D √ S (x -y) = 1 ρ -a, √ R (Λ) √ det S y∈Λ+a ρ √ R (y)ρ √ S (x -y) = 1 ρ -a, √ R (Λ) √ det S y∈Λ+a ρ √ T (x)ρ RT -1 x, √ U (y) [Pei10, Fact 2.1]. = ρ √ T (x) √ det T • √ det Tρ RT -1 x, √ U (Λ) √ det Tρ -a, √ R (Λ) = D √ T (x) • ( √ det R √ det S/ √ det T) -1 ρ x , √ U (Λ * ) ( √ det R) -1 ρ -a, √ R (Λ * )
, where x = RT -1 x, and f denotes the Fourier transform of f . First notice that

(det R • det S)/ det T = 1/ det(R -1 TS -1 ) = 1/ det U -1 . Moreover, recalling that ρ c, √ Σ (w) = √ det Σe -2iπ c, w ρ √ Σ -1 (w), we get 1 -( √ det U) -1 ρ x , √ U (Λ * ) ≤ ρ √ U -1 (Λ * \ {0}) ≤ ε.
For the denominator, we first notice that for two positive semi-definite matrices A and B, if

A -B is positive semi-definite, then ρ √ A (w) ≥ ρ √ B (w) for all w ∈ R n . Since U -1 -R -1 = S -1 is positive semi-definite, it yields ρ √ R -1 (Λ * \ {0}) ≤ ρ √ U -1 (Λ * \ {0}) ≤ ε. Therefore, using
the same method as above, we get

1 -( √ det R) -1 ρ -a, √ R (Λ * ) ≤ ρ √ R -1 (Λ * \ {0}) ≤ ε.
which leads to

( √ det R √ det S/ √ det T) -1 ρ x , √ U (Λ * ) ( √ det R) -1 ρ -a, √ R (Λ * ) ∈ 1 -ε 1 + ε , 1 + ε 1 -ε ⊆ [1 -2ε, 1 + 4ε],
assuming that ε < 1/2. We thus end up with

Y (x) -D √ T (x) ≤ 4εD √ T (x).
Integration and factor 1/2 of the statistical distance yield the lemma.

Lemma 1.11 ([BLP + 13, Lem. 2.10] & [Pei10, Thm. 3.1])
Let Λ be an n-dimensional lattice, ε ∈ (0, 1/2], and β, r > 0 such that r ≥ η ε (Λ). Then the distribution of x + y, obtained by first sampling x from D β , and then sampling

y from D Λ,x,r , is within statistical distance 8ε of D Λ, √ β 2 +r 2 .
Note that in Lemma 1.11 the parameter of the discrete Gaussian distribution of y depends on the vector x, sampled from a continuous Gaussian beforehand. This is not the case in Lemma 1.10.

Finally, in Chapter 3 we need an exact sampler of discrete Gaussians over lattices.

Gaussians over Number Fields

In this section, we introduce Gaussian distributions over K d R , where K = Q(ζ) is a number field, R its ring of integers, and

K R = K ⊗ Q R. 2
We further prove some of their properties needed in the rest of this thesis. Gaussian distributions over K R have been introduced alongside the R-LWE problem [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF], and then generalized and used in most papers dealing with structured variants of LWE. 3 Let n denote the degree of the number field K and let d ∈ N. Further, recall the definition of the canonical embedding σ H as introduced in Section 1.1.2. We define general Gaussian distributions over K d R through their canonical embedding σ H to R nd , namely sampling y (H ) ∈ R nd according to D √ Σ for some positive semi-definite matrix Σ in R nd×nd and then mapping it back to K d R by y = σ -1 H (y (H ) ). To ease readability, we denote the described distribution of y ∈ K d R by D √ Σ . As for the Gaussians over R, we write D r if Σ is a diagonal matrix with diagonal vector r 2 ∈ (R + ) nd . For 0 ≤ α < α , we define Ψ [α,α ] to be the set of Gaussian distributions D r with α < r ∞ ≤ α . If α = 0, we simply write Ψ ≤α .

Sometimes, it is more convenient to consider a Gaussian distribution D √ Σ over K R and extend it for d ∈ N to a Gaussian distribution over K d R by simply drawing all d coefficients independently over K R . In this case, we write (D √ Σ ) d . Further, for any positive real α, we define the specific distribution Υ α over distributions on H as done by Peikert et al. [START_REF] Peikert | Pseudorandomness of ring-lwe for any ring and modulus[END_REF]. Let n = t 1 + 2t 2 be the decomposition in real and complex embeddings and fix an arbitrary function g(n) = ω( log 2 n). A distribution sampled from Υ α is an elliptical Gaussian D r , where r is sampled as follows:

For j ∈ [t 1 ], sample x j ← D 1 and set r 2 j = α 2 (x 2 j + g 2 (n))/2. For j ∈ {t 1 + 1, . . . , t 1 + t 2 }, sample x j , y j ← D 1/ √ 2 and set r 2 j = r 2 j+t2 = α 2 (x 2 j + y 2 j + g 2 (n))/2.
We need this distribution for the classical reduction in Chapter 3. In the proof of Lemma 2.3, we need to identify the distribution of y = Ue for an arbitrary matrix U and a Gaussian vector e ∈ K d R for which the components are independent of each other. To do so, we define for m, d ∈ N the ring homomorphism θ :

K m×d R → C nm×nd given by θ(A) =    D 1,1 • • • D 1,d . . . . . . . . . D m,1 • • • D m,d    , with A = (a jk ) j∈[m],k∈[d] and D j,k = diag(σ(a jk )) ∈ C n×n . Lemma 1.13
Let d, n ∈ N, such that K is a number field of degree n. Let S ∈ R nd×nd be a positive semi-definite matrix, and

U ∈ K d×d R . We define Σ = H † θ(U)H S H † θ(U)H † ∈ R nd×nd ,
where H = diag(H, . . . , H) ∈ C nd×nd , with H the matrix form of the basis of the space H , defined in Section 1.1.1. Then, the distribution of y = Ue, where e ∈ K d R is distributed according to D √ S , is exactly D √ Σ .

Proof: Let e = (e j ) j∈d ∈ K d R be a Gaussian vector distributed according to D √ S . Further, let U = (u jk ) j,k∈ [d] . Our goal is to characterize the distribution of the vector y = (y j ) j∈ [d] , which is given as the product of U and e. For all j ∈ [d], we have . . .

y j = k∈[d] u jk e k and thus σ(y j ) = k∈[d] σ(u jk ) • σ(e k ),
σ(y d )    = θ(U)σ(e),
where θ(U) is the block matrix diag(σ(u jk )) j,k∈[d] ∈ C nd×nd . As we have seen before, we can decompose σ in the basis of H and get σ(y j ) = Hy By using the block matrix product, we end up with

σ(y) =    H . . . H        y (H ) 1 . . . y (H ) d     = Hy (H ) .
Thus Hy (H ) = θ(U)He (H ) , which leads to y (H ) = H † θ(U)He (H ) . Now notice that the blocks of H † θ(U)H are the H † diag(σ(u jk ))H which correspond to the matrix form of the multiplication by u jk in the basis of the space H and thus is in

R n×n . Hence H † θ(U)H ∈ R nd×nd . By definition, e (H ) is distributed according to D √ S . Thus y (H ) is also distributed along a 0- centered Gaussian over R nd , but with covariance matrix Σ = H † θ(U)H S H † θ(U)H † .
In particular, when the matrix S is of the form S = diag(r 2 1 , . . . , r 2 1 , . . . , r 2 d , . . . , r 2 d ) for some positive reals r 1 , . . . , r d , then √ S commutes with H and the covariance simplifies to

Σ = H † U U † H, with U = (diag(σ(r k u jk ))) j,k∈[d] .
To apply the noise flooding argument in the proof of the hardness of M-LWE using a binary secret in Section 2.2, we need the following bound on the norm of the product of some discrete Gaussian matrix (in the canonical embedding σ) and a vector of small norm in the dual ring (in the coefficient embedding τ ). The result is restricted to cyclotomic number fields, i.e., K = Q(ζ), where ζ is a primitive root of unity. As stated in Section 1.1.5, for every number field

K = Q(ζ) with ring of integers R = Z[ζ], there exists a λ such that λ • R ∨ = R. This implies λ • (R ∨ η ) d = (R η ) d for every η, d ∈ N. Lemma 1.14 (Noise Flooding Bound) Let K = Q(ζ) be a cyclotomic field with R = Z[ζ]
its ring of integers of degree n and its dual R ∨ . Let d, m, q, η ∈ N and α ∈ (0, 1). Sample Z ← (D R ∨ ,αq ) m×d and s ← U ((R ∨ η ) d ). We set s = λs ∈ R d η . Then, with overwhelming probability Zs 2 ≤ αqn 2 d(η -1) √ m. In particular, the Euclidean norm of each coefficient (Zs) j for j ∈ [m] is bounded above by αqn 2 d(η -1).

Proof: Using the same reasoning as in the proof of Lemma 1.13, we obtain σ(Zs) = θ(Z)σ(s) and thus σ(Zs) 2 ≤ θ(Z) 2 • σ(s) 2 . Using Equation 1.1, i.e., the Vandermonde matrix V to switch from the coefficient embedding τ to the canonical embedding σ, we obtain σ(s

) 2 ≤ V 2 • τ (s) 2 ≤ n • (η -1)
√ nd, where we use that for cyclotomic number fields it yields

V 2 ≤ V F = j,k∈[n] |α k-1 j | 2 1/2
≤ n (as all α j are units) and that τ (s) is a vector of dimension nd with coefficients in {0, . . . , η -1}. Further, for each j ∈

[m] and k ∈ [d] it holds σ(z jk ) 2 ≤ αq √ n with probability 1 -2 -Ω(n)
, using the Gaussian tali bound Lemma 1.6. Hence,

θ(Z) 2 ≤ θ(Z) F = j∈[m] k∈[d] ∈[n] |σ (z jk )| 2 = j∈[m] k∈[d] σ(z jk ) 2 2 ≤ αq √ nd √ m.
Combining both bounds proves the claim.

We also need two other lemmata related to the inner product over K d R between a Gaussian vector and an arbitrary one. In particular, we use Lemma 1.16 in the proof of Lemma 2.5 (reducing extended M-LWE to binary secret M-LWE) in order to decompose a Gaussian noise into an inner product.

Lemma 1.15 ([LS15, Lem. 2.13]) Let r ∈ (R + ) n ∩ H , z ∈ K d fixed and e ∈ K d R sampled from D √ Σ ,
where

√ Σ = [δ j,k diag(r)] j,k∈[d] ∈ R nd×nd . Then z , e = j∈[d] z j e j is distributed according to D r with r j = r j k∈[d] σ j (z k ) 2 for j ∈ [n]. Lemma 1.16 (Adapted from [Reg09, Cor. 3.10])
Let M ⊂ K d be an R-module (yielding a module lattice), let u, z ∈ K d be fixed, and let β, γ > 0. Assume that

(1/β 2 + z 2 2,∞ /γ 2 ) -1/2 ≥ η ε (M) for some ε ∈ (0, 1/2). Then the distribution of z , v + e where v is sampled from D M+u,β and e ∈ K R is sampled from D γ , is within statistical distance at most 2ε from the elliptical Gaussian D r over K R , where r j = β 2 k∈[d] σ j (z k ) 2 + γ 2 for j ∈ [n]. Proof: Consider h ∈ (K R ) d distributed according to D r ,...,r
, where r is given by

r j = γ/ k∈[d] σ j (z k ) 2 for j ∈ [n]. Then by Lemma 1.15, z,h is distributed as D γ and there- fore ∆( z,v + e, D r ) = ∆( z,v + h , D r ). Now, we denote t such that t j = β 2 + (r j ) 2 for j ∈ [n].
Note that by assumption min

j∈[n] βr j /t j = (1/β 2 + max j∈[n] k∈[d] σ j (z k ) 2 /γ 2 ) -1/2 = (1/β 2 + z 2 2,∞ /γ 2 ) -1/2 ≥ η ε (M).
Lemma 1.10 therefore applies and yields that v + h is distributed as D t,...,t , within statistical distance at most 2ε. By applying once more Lemma 1.15 and noticing that the statistical distance does not increase when applying a function (here the scalar product with z), then we get that z,v + h is distributed as D r within statistical distance at most 2ε, where r j =

t j k∈[d] σ j (z k ) 2 = β 2 k∈[d] σ j (z k ) 2 + γ 2 for j ∈ [n].

Statistical Distance

The statistical distance is an important measure of distance used in cryptography. We now recall its definition and some useful properties. Let P and Q be two discrete probability distributions over a discrete domain E. Their statistical distance is defined as

∆(P; Q) = 1 2 x∈E |P(x) -Q(X )|.
The statistical distance fulfills the probability preservation property.

Lemma 1.17 (Probability Preservation of the Statistical Distance)

Let P, Q be two probability distributions with Supp(P ) ⊆ Supp(Q ) and E ⊆ Supp(Q ) be an arbitrary event. Then, P(E) ≤ ∆(P;

Q) + Q(E).
Within the thesis, we need the following two results about the statistical distance of two Gaussian distributions.

Rényi Divergence

The Rényi divergence [R 61, vEH14] defines another measure of distribution closeness and was first used in cryptography as a powerful alternative for the statistical distance measure by Bai et al. [BLL + 15, BLR + 18]. In this thesis, it suffices to use the Rényi divergence of order 2. As in [BLR + 18], we use the exponential of the standard definition. Let P and Q be two discrete probability distributions such that Supp (P ) ⊂ Supp (Q ). The Rényi divergence of order 2 is defined as

RD 2 (P Q) = x∈Supp(P ) P(x) 2 Q(x) = E x←P Pr[P = x] Pr[Q = x] .
From its definition, it directly follows for Q the uniform distribution over Supp(P ) that RD 2 (P Q) = |Supp(P )| • x∈Supp(P ) P(x) 2 , where x∈Supp(P ) P(x) 2 is the collision probability of P. The Rényi divergence admits the following properties, proved in [START_REF] Van Erven | Rényi divergence and kullback-leibler divergence[END_REF].

Lemma 1.20 (Properties of the Rényi Divergence)

Let P, Q be two discrete probability distributions with Supp (P ) ⊆ Supp (Q ). Further, let (P j ) j , (Q j ) j be two families of independent discrete probability distributions with Supp P j ⊂ Supp Q j for all j. Then, the following properties are fulfilled:

Data Processing Inequality: RD 2 (P g Q g ) ≤ RD 2 (P Q) for any function g, where P g (resp. Q g ) denotes the distribution of g(y) induced by sampling y ← P (resp. y ← Q),

Multiplicativity: RD 2 j P j j Q j = j RD 2 (P j Q j ),
Probability Preservation: Let E ⊂ Supp(Q ) be an arbitrary event, then

Q(E) • RD 2 (P Q) ≥ P(E) 2 .
In Chapter 2, we need the Rényi divergence of two shifted discrete Gaussians. By comparing the conditions of the lemma below for the Rényi divergence with the ones of Lemma 1.18 for the statistical distance, we can see that the first is a stronger measurement than the second. More precisely, a small Rényi divergence of two shifted Gaussians implies a small statistical distance.

Lemma 1.21 (Adapted from [LSS14, Lem. 4.2])
Let s and ε be positive real numbers with ε ∈ (0, 1), c be a vector of R n and Λ be a full-rank lattice in R n . We assume that s ≥ η ε (Λ). Then,

RD 2 (D Λ,s,c D Λ,s ) ≤ 1 + ε 1 -ε 2 • exp 2π c 2 2 s 2 .

Leftover Hash Lemma

The Leftover Hash Lemma (LHL) [START_REF] Håstad | A pseudorandom generator from any one-way function[END_REF] is a standard tool in cryptography used for security proofs. Within this thesis, we use two different flavors of it. The first one is a generalized version of the LHL in terms of universal hash functions, which we need when proving the security of our PKE scheme from Chapter 6. First, we recall the definition of a universal family of hash functions.

Definition 1.7 (Universal Family of Hash Functions): A (finite) family H of hash functions h :

X → Y is called universal if Pr h←U (H ) [h(x 1 ) = h(x 2 )] = 1 |Y | , for all x 1 = x 2 ∈ X .
We now recall the variant of the Leftover Hash Lemma as stated in [START_REF] Roşca | Middle-product learning with errors[END_REF].

Lemma 1.22 (Generalized Leftover Hash Lemma [RSSS17, Lem. 2.1])

Let X , Y and Z be finite sets, H be a universal family of hash functions h : X → Y and g : X → Z be an arbitrary function. Then, for any random variable T taking values in X we have

∆ ((h, h(T ), g(T )); (h, U (Y ), g(T ))) ≤ 1 2 • γ(T ) • |Y | • |Z|, where γ(T ) = max t∈X Pr [T = t].
The second variant of the LHL that we use within this work is an adaptation of the one by Micciancio [START_REF] Micciancio | Generalized compact knapsacks, cyclic lattices, and efficient one-way functions[END_REF], which, instead of working with vectors over the finite field Z q , operates over principal ideal domains. Given a number field K = Q(ζ), where the corresponding ring of integers has the form R = Z[ζ], and a prime q, then R q = R/qR is a principal ideal domain, allowing for a unique prime-ideal factorization. The result can easily be generalized to any number field

K = Q(ζ) with ring of integers R with Z[ζ] ⊂ R, as long as q is coprime with the index [R : Z[ζ]].
In this case, as demonstrated in [PP19, Lem. 2.14], there exists a bijection between Z[ζ] and R. 4 The only difference between the original statement and the one below is that the original proof uses the special number field K ∼ = Q[x]/ x n -1 . Further, we state the LHL for a matrix-vector product instead of a vector-vector product and provide not only a bound on the statistical distance, but also on the Rényi divergence. Let n, k, d, q, η ∈ N such that q is prime. Further, let K = Q(ζ) be a number field with associated ring of integers R such that q is coprime with the index [R :

Z[ζ]]. We set R q = R/qR and R η = R/ηR. Then, ∆ ((C, Cz); (C, s)) ≤ 1 2 1 + q k η d n -1, and RD 2 ((C, Cz) (C, s)) ≤ 1 + q k η d n , where C ← U ((R q ) k×d ), z ← U ((R η ) d ) and s ← U ((R q ) k ).

Learning With Errors

At the heart of most lattice-based schemes, and in particular at the core of this thesis, lies one computational problem, the Learning With Errors (LWE) problem. In this section, we introduce the problem, together with different structured variants of it, which are used in efficient schemes nowadays. We start with varying the underlying mathematical structure: First, we introduce the LWE problem over rational integers as it was originally presented by Regev [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. Then, we define LWE over rings of polynomials and finally over modules. Later in this section, we present two other versions of LWE, a first variant using the middle-product and a second one using deterministic rounding.

Learning With Errors (LWE)

The LWE problem, introduced by Regev [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] in his pioneering work, serves as a fundamental computational problem in lattice-based cryptography. Informally speaking, an instance of the LWE problem is a system of noisy linear modular equations over the rational integers. Its search variant asks to find a solution to this system, whereas its decision version asks to distinguish such noisy linear modular equations from uniformly random ones. We now present the formal definitions of the LWE distribution and the LWE problem, in both its search and decision versions. Let T = R/Z denote the segment [0, 1) with addition modulo 1.

Definition 1.8 (LWE Distribution): Let q, n ∈ N such that q ≥ 2. Further, let ψ denote a distribution over T and fix a vector s ∈ Z n q . We set A s,ψ as the distribution over Z n q × T obtained by choosing a vector a ← U (Z n q ), an element e ← ψ and returning (a, 1 q a, s + e mod Z). Definition 1.9 (LWE): The search version SLWE n,q,ψ of the Learning With Errors problem is as follows: let s ∈ Z n q be secret; given arbitrarily many samples from A s,ψ , the goal is to find s. Its decision version LWE n,q,ψ is as follows: choose s ← U (Z n q ); the goal is to distinguish between arbitrarily many independent samples from A s,ψ and the same number of independent samples from U (Z n q × T).

Sometimes, it is convenient to interpret LWE in terms of matrices. Let m ∈ N be the number of requested samples of the LWE distribution A s,ψ , i.e., we are given (a j , 1 q a j , s + e j mod Z) for j ∈ [m]. Then, we consider the matrix A ∈ Z m×n q whose rows are the a j 's and we set e = (e 1 , . . . , e m ) T . We obtain the matrix representation (A, 1 q A • s + e), where s ∈ Z n q . Note that LWE with respect to the matrix A defines an instance of the computational problem BDD over the lattice Λ q (A T ), as defined in Section 1.2.1. The promise bound needed for BDD is characterized by the error distribution ψ.

As an attractive property for cryptography, LWE enjoys quantum [Reg05, Reg09, PRS17a] and classical [Pei09, BLP + 13] worst-case to average-case reductions for suitable parameter choices, from well-studied problems such as finding a set of short independent vectors (SIVP) or the decision variant of finding short vectors (GapSVP, Def 1.2) in Euclidean lattices. The term average-case is used to stress that LWE is defined over the randomness of A, s and e. In other words, an algorithm that efficiently solves LWE can be used to classically (or quantumly) solve the problems SIVP or GapSVP in any Euclidean lattice. By classical algorithm we denote algorithms that use classical mechanics, whereas quantum algorithms operate with quantum mechanics. In order to perform a quantum algorithm, a so-called quantum computer is needed. A standard conjecture is to assume that there is no polynomial-time algorithm that solves these lattice problems and their approximated versions, even on quantum computers (see Conjecture 1 from the introduction). Thus, any solver of the average-case problem LWE can be transformed into a solver for any instance of the corresponding worst-case problem, which is presumed to be difficult.

For efficiency reasons, we are interested in variants of LWE, where the underlying secret has small norm. A relatively simple, but quite elegant reduction allows the secret to follow the same distribution as the noise [START_REF] Applebaum | Fast cryptographic primitives and circular-secure encryption based on hard learning problems[END_REF]. This variant is commonly called the Hermite Normal Form (HNF) of LWE. By re-randomizing the secret we also obtain the reduction in the opposite direction, making both problems equally hard. Due to its widespread use in cryptographic constructions, and the equivalence of LWE and LWE in HNF, they are sometimes presented as the same problem.

Polynomial Learning With Errors (P-LWE)

The cryptographic protocols relying on the hardness of LWE are inherently inefficient due to the size of the public keys which usually contain the matrix A ∈ Z m×n q , where n is at least as large as the security parameter and m is the number of samples which is usually larger than n log(n). To improve the efficiency, structured variants of LWE have been proposed [SSTX09, LPR10, LS15]. One prominent variant is the Polynomial Learning With Errors (P-LWE) problem, introduced by Stehlé et al. [START_REF] Stehlé | Efficient public key encryption based on ideal lattices[END_REF]. Instead of considering noisy linear equations over the rational integers Z, the linear equations are now defined algebraically over some ring over polynomials with coefficients in Z. As we only need the decision version throughout this work, we focus on it in the following, omitting the search variant. Definition 1.10 (Decision P-LWE): Let q, m ∈ N such that q ≥ 2. Let f (x) be a monic and irreducible polynomial in Z[x] of degree m and ψ be a distribution over R[x]/ f (x) . The decision P-LWE f q,ψ problem asks to distinguish arbitrarily many samples of the form (a j , b j = a j • s + e j mod q), where e j ← ψ and a j ← U (Z q [x]/ f (x) ), from the same number of samples chosen uniformly over

Z q [x]/ f (x) × R q [x]/ f (x) with non-negligible success probability over the choices of s ← U (Z q [x]/ f (x) ).
As for LWE, the P-LWE problem also admits worst-case to average-case quantum reductions from well-studied lattice problems [START_REF] Stehlé | Efficient public key encryption based on ideal lattices[END_REF]. Whereas the hardness reductions for LWE start from lattice problems in the class of general Euclidean lattices, the class has to be restricted to ideal lattices in the case of P-LWE. As explained in Section 1.2.2, these ideal lattices correspond to the ideals in the polynomial ring Z[x]/ f (x) .

Module Learning With Errors (M-LWE)

The module variant of LWE was first defined by Brakerski et al. [START_REF] Brakerski | leveled) fully homomorphic encryption without bootstrapping[END_REF] and thoroughly studied by Langlois and Stehlé [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]. Instead of working over a ring of polynomials as for P-LWE, the module variant is defined over the ring of integers of some number field K. Since its introduction, the M-LWE problem has enjoyed more and more popularity as it offers a fine-grained trade-off between concrete security and efficiency. Within the NIST standardization process, several third round candidates rely on the hardness of M-LWE, e.g., the signature scheme Dilithium [DKL + 18] and the key encapsulation mechanism Kyber [BDK + 18]. We now present the formal definitions of the M-LWE distribution and the M-LWE problem, in both its search and decision versions. By T R ∨ we denote the torus K R /R ∨ , where

K R = K ⊗ Q R.
Definition 1.11 (M-LWE Distribution): Let K be a number field of degree n and R its ring of integers with dual R ∨ . Further, let d ∈ N denote the rank, let ψ be a distribution over K R and let s ∈ (R ∨ q ) d be a vector. We let A M s,ψ denote the distribution over (R q ) d × T R ∨ obtained by choosing a vector a ← U ((R q ) d ), an element e ← ψ and returning (a, 1 q a, s + e mod R ∨ ).

The inner product of the vectors s = (s 1 , . . . , s d ) T and a = (a 1 , . . . , a d ) T is defined in the natural way, i.e., a, s = j∈[d] a j • s j , using the addition and multiplication of the field K.

Definition 1.12 (M-LWE): Let q, d ∈ N such that q ≥ 2. Let Ψ be a family of distributions over K R . The search version M-SLWE n,d,q,Ψ of the Module Learning With Errors problem is as follows: let s ∈ (R ∨ q ) d be secret and ψ ∈ Ψ; given arbitrarily many samples from A M s,ψ , the goal is to find s. Let Υ be a distribution on a family of distributions over K R . Its decision version M-LWE n,d,q,Υ is as follows: choose s ← U ((R ∨ q ) d ) and ψ ← Υ; the goal is to distinguish between arbitrarily many independent samples from A M s,ψ and the same number of independent samples from U ((R q ) d × T R ∨ ).

Module LWE as a Generalization

Historically, the M-LWE problem was introduced after another important variant of LWE, namely the Ring Learning With Errors (R-LWE) problem, as defined by Lyubashevsky et al. [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF]. The latter one can be seen as a special case of the first by specifying d = 1. The R-LWE problem coincides with the P-LWE problem from Section 1.4.2 for the class of cyclotomic fields (where ζ is a primitive root of the unity). Roşca et al. [START_REF] Roşca | On the ring-lwe and polynomial-lwe problems[END_REF] show that P-LWE and R-LWE are equivalent (with some parameter losses) for a larger class of polynomials. In a more recent work, the hardness connection between M-LWE and R-LWE is further investigated. More precisely, Peikert and Pepin [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF] show a tight reduction from R-LWE over a number field of degree n•k to M-LWE over a number field of degree n and with rank k. Furthermore, the special case of M-LWE, where the ring has degree n = 1 and thus R = Z, is exactly the original LWE problem from Section 1.4.1. Thus, M-LWE can be seen as a generalization, encompassing both the unstructured LWE and the fully structured R-LWE (and hence P-LWE) problems.

Primal versus Dual

Note that we use the definition of M-LWE in its so-called dual form as the secret vector is taken over the dual R ∨ . There exists also a flavor of M-LWE where the secret vector is chosen over the ring R directly, referred to as M-LWE in its primal version. Roşca et al. [START_REF] Roşca | On the ring-lwe and polynomial-lwe problems[END_REF] show for R-LWE that both variants are equivalent up to some polynomial losses in the error and their results can easily be adapted to the module setting. The reason to work with the dual is that it naturally arises in the worst-to-average case reduction and thus leads to tighter security proofs [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF]Sec. 3.3]. Furthermore, it allows for optimal lattice decoding algorithms as explained in [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF].

Worst-Case Reductions

Similar to its unstructured counterpart, M-LWE also enjoys worst-case to average-case connections for suitable parameter choices from lattice problems such as SIVP γ [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]. Whereas the hardness results for LWE start from lattice problems in the class of general Euclidean lattices, the set has to be restricted to module lattices in the case of M-LWE. As introduced in Section 1.2.2, these module lattices correspond to modules in the ring R and we refer to the related lattice problem as Mod-SIVP γ and Mod-GapSVP γ (Def. 1.2), respectively. As an additional feature, a converse reduction from M-LWE to Mod-SIVP γ is proven for the special case of power-of-2 cyclotomics [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] and improved by Wang and Wang [START_REF] Wang | Module-lwe versus ring-lwe, revisited[END_REF] for all cyclotomic fields.

Matrix Representation

As for LWE, we can interpret the M-LWE distribution in terms of matrices. Let m ∈ N be the number of requested samples of the M-LWE distribution A M s,ψ , given by (a j , 1 q a j , s + e j ) for j ∈ [m]. Then, we consider the matrix A ∈ R m×d q whose rows are the a j 's and we set e = (e 1 , . . . , e m ) T . We obtain the representation (A, 1 q A • s + e), where s ∈ (R ∨ q ) d . By adding the parameter m as a superscript suffix, we denote this problem by M-LWE m n,d,q,Υ . Furthermore, we can interpret the matrix A ∈ R m×d q as an nm × nd matrix over Z, where n is the ring degree of R. As explained in Section 1.1.3, the multiplication of a ring element a ∈ R q with another ring element s ∈ R q (with respect to their coefficient embeddings) can be expressed as the matrix-vector product using the matrix Rot(a) ∈ Z n×n q . Thus, the m × d matrix A = (a jk ) jk over R q defines an nm × nd matrix Rot(A) = (Rot(a jk )) jk over Z q . In other words, an instance of the M-LWE distribution can be viewed as an instance of the LWE distribution, where the public matrix Rot(A) is not fully random, but has some structure. This is why we often refer to it as a structured variant of LWE, see Figure 4 from the introduction for an illustration.

Multiple Secrets

Another variant of M-LWE is the multiple secrets M-LWE problem. Let k, m ∈ N, where m denotes the number of requested samples of A M s,ψ and k stands for the number of independent secrets. In the multiple secrets version, the secret vector s ∈ (R ∨ q ) d is replaced by a secret matrix S ∈ (R ∨ q ) d×k and the error vector e ← ψ m by an error matrix E ← ψ m×k . There is a simple polynomial-time reduction from M-LWE using a secret vector to M-LWE using a secret matrix for any k polynomially large in the module rank d via a hybrid argument, as given for instance in [Mic18, Lem. 2.9]. By adding the parameter k as a superscript suffix, we denote the corresponding problem by M-LWE m,k n,d,q,Υ .

Small Secrets

Another possibility is to choose a small secret. As for LWE, we can define the Hermite Normal Form (HNF) of M-LWE, where the secret follows the same distribution as the noise, and show that both problems are equally hard by adapting the proof for LWE [START_REF] Applebaum | Fast cryptographic primitives and circular-secure encryption based on hard learning problems[END_REF]. The HNF of M-LWE is often used in cryptographic constructions to improve efficiency, as for instance in signature schemes like Dilithium [DKL + 18]. Alternatively, we can define a variant of M-LWE, where the coefficients of the secret vector are within a ball of small radius. More precisely, for some positive integer η we select uniformly at random the coefficients of the secret vector over the set R ∨ η , where

R η = {x ∈ R : τ (x) ∈ {0, . . . , η -1} n }.
We denote the corresponding problem by η-M-LWE. In Chapter 2, we are interested in the special case of η-M-LWE, where the secret vector s is a binary vector, thus chosen over the set R ∨ 2 (i.e., η = 2). As this variant plays an important role within this thesis, we separately denote it by bin-M-LWE. As we argue later in Section 2.5, the set R ∨ η is defined with respect to the coefficient embedding τ .

Discrete Variant

As pointed out by Lyubashevsky et al. [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF], sometimes it can be convenient to work with a discrete variant, where the second component b of each sample (a, b) is taken from a finite set, and not from the continuous domain T R ∨ . Indeed, for the case of M-LWE, if the rounding function

• : K R → R ∨ is
a, s + e) ∈ (R q ) d × T R ∨ of the distribution A M s,ψ can be transformed to (a, q • b ) = (a, a, s + q • e mod qR ∨ ) ∈ (R q ) d × R ∨ q .
For technical reasons, we use the latter representation in Section 2.2.

Middle-Product Learning With Errors (MP-LWE)

We now present another variant of LWE which can be seen as a modification of P-LWE, where the standard product of two polynomials is replaced by their so-called middle-product. The use of the middle-product in lattice-based cryptography was introduced by Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF] in the form of Middle-Product Learning With Errors (MP-LWE). We first recall the definition of the middle-product of two polynomials of bounded degree. We denote by Z <n q [x] the set of polynomials in Z q [x] with degree less than n.

Definition 1.13 (Middle-Product): Let d a , d b , d, k ∈ N such that d a + d b -1 = d + 2k. The middle-product of a ∈ Z <da [x] and b ∈ Z <d b [x] of length d is defined as a d b = a • b mod x k+d x k ,
where the floor rounding in this case means removing all terms with negative exponents on x.

The middle-product fulfills additivity if one of its inputs is fixed. Associativity is generally not achieved, instead only the following weaker associativity property is guaranteed.

Lemma 1.24 (Weak Associativity Property [RSSS17, Lem. 3.3]) Let d, k, n ∈ N. For all r ∈ Z <k+1 [x], a ∈ Z <n [x] and s ∈ Z <n+d+k-1 [x], we have r d (a d+k s) = (r • a) d s.
The middle-product can be represented in form of a special matrix-vector product. We first define those product matrices and show that they also arise in the context of standard products of two polynomials. Definition 1.14 (Product Matrix T): Let d, n ∈ N and a ∈ Z <n [x]. We denote by T d,n (a) the matrix in Z d×n+d-1 whose j-th row is given by the coefficients of the polynomial x j-1 a for j ∈ [d]. More precisely,

T d,n (a) =      a 0 a 1 a 2 . . . a n-1 a 0 a 1 a 2 . . . a n-1 . . . . . . . . . . . . a 0 a 1 a 2 . . . a n-1     
, where all empty entries of the matrix are filled with a 0.

By the definition of T d,n , it can be used to represent the product of two polynomials. More precisely, let

d, n ∈ N such that r ∈ Z <d [x] and a ∈ Z <n [x]. Their product b = r • a ∈ Z <n+d-1 [x] is given by b T = r T • T d,n (a)
, where b and r are the coefficient vectors of b and r, respectively. If the product matrix T d,n is applied from the left, and not from the right, it defines the middleproduct of two polynomials. Later in Section 4.2, we study another type of matrices, so-called Hankel matrices, which allow an alternative representation of the middle-product.

Lemma 1.25 ([RSSS17, Lem. 3.2]) Let d, n ∈ N such that d ≤ n. Let a ∈ Z <n q [x] and s ∈ Z <n+d-1 q [x], defining the middle- product b = a d s. It yields rev(b) = T d,n (a) • rev(s),
where rev(b) and rev(s) denote the coefficient vectors of b and s in reverse order.

We now formally define the Middle-Product Learning With Errors (MP-LWE) problem. As we only need the decision version throughout this work, we focus on it in the following. Definition 1.15 (Decision MP-LWE): Let q, d, n ∈ N such that q ≥ 2 and 0 < d ≤ n. Further, let ψ be a distribution over R <d [x]. The decision MP-LWE q,n,d,ψ problem asks to distinguish arbitrary many samples of the form (a j , b j = a j d s + e j mod q), where e j ← ψ and a j ← U (Z <n q [x]), from the same number of samples chosen uniformly over

Z <n q [x] × R <d q [x] with non-negligible success probability over the choices of s ← U (Z <n+d-1 q [x]).
Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF] show that MP-LWE is at least as hard as P-LWE (Def. 1.10) for many polynomials f (x) ∈ Z q [x]. The noise parameter of the MP-LWE problem can be set to handle an exponentially large class of polynomials f (x). A more recent result by Peikert and Pepin [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF] shows a tighter (and more direct) reduction from R-LWE to MP-LWE. In both settings, the definition of MP-LWE is independent of some particular defining polynomial f (x) and at the same time its hardness is for suitable parameters still implied by worst-case problems over ideal lattices.

Learning With Rounding (LWR)

In 2012, Banerjee et al. [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF] introduce a deterministic variant of LWE, namely the Learning With Rounding (LWR) problem. Originally, it is used to construct efficient pseudorandom functions [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF], lossy trapdoor functions and deterministic encryption schemes [START_REF] Alwen | Learning with rounding, revisitednew reduction, properties and applications[END_REF]. Structured variants of LWR also serve as the underlying hardness assumption for efficient public key encryption schemes [DKRV18, BBF + 19], currently considered for standardization, and efficient pseudorandom functions [START_REF] Chuengsatiansup | Towards practical ggm-based PRF from (module-)learning-with-rounding[END_REF].

Before we formally present this deterministic variant of LWE, we need to define a method to round elements from Z q to Z p , where p ≤ q.

Definition 1.16 (Rounding): Let p, q ∈ N such that 2 ≤ p ≤ q. The modular rounding function • p : Z q → Z p is defined as x p = p q • x mod p, where • is the standard rounding function, mapping every y ∈ R to its closest integer y ∈ Z.

The modular rounding function extends component-wise to vectors over Z q and coefficientwise to polynomials in Z q [x]. Note that we use the same notation as Banerjee et al. [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF] for the purpose of coherence. It is also possible to use the floor rounding function • , where each element is rounded down to the next smaller integer, as for instance done by Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF].

In order to lift rounded elements from Z p back to Z q , we define a probabilistic lifting function li (•) : Z p → Z q that takes x ∈ Z p as input and chooses uniformly at random an element u from the set {v ∈ Z q : v p = x}. Again, li (•) can be extended coefficient-wise to vectors over Z q and polynomials in Z q [x]. This lifting function becomes important in the encryption scheme in Chapter 6. There, we use li (•) to lift rounded polynomials in Z p [x] back to Z q [x] such that li ( a p ) p = a p . Note that li ( a p ) = a + e with e ∞ ≤ q p . Alternatively, one can deterministically lift any element from Z p to Z q by mapping y ∈ Z p to q/p • y ∈ Z q . This induces a rounding error whose norm is bounded above by q/p, as before with the probabilistic lifting function li (•).

We now define the Learning With Rounding problem. Again, we focus on its decision version throughout the thesis. Definition 1.17 (Decision LWR): Let q, p, n ∈ N such that 2 ≤ p ≤ q. The decision Learning With Rounding (LWR) problem ask to distinguish arbitrary many samples of the form (a j , b j = a j , s p ), where a j ← U (Z n q ), from the same number of samples chosen uniformly over Z n q × Z q with non-negligible success probability over the choices of s ← U (Z n q ).

Hardness of LWR

When first introducing the problem LWR, Banerjee et al. [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF] show a reduction from LWE to LWR with arbitrarily many samples. Unfortunately, the reduction requires q/p to be larger than the error size B (where B bounds the magnitude of the LWE error with high probability) by a super-polynomial factor, thus leading to a large modulus paired with a small error bound. This in turn implies that the underlying worst-case lattice problems are assumed to be hard with super-polynomial approximation factors, which stands for a stronger assumption. In practice, this also leads to inefficient protocols. Subsequent studies propose new reductions that work for a larger range of parameters. Alwen et al. [START_REF] Alwen | Learning with rounding, revisitednew reduction, properties and applications[END_REF] give a reduction that allows a polynomial modulus and modulus-to-error ratio. However, the modulus q in the reduction depends on the number of LWR samples, thus the number of samples needs to be fixed a priori. Further, the reduction imposes certain number theoretical restrictions on the modulus q. For example, power-of-2 moduli are not covered. In a more recent work, Bogdanov et ] further improve the parameter sets for the reduction. In particular, the reduction is dimension-preserving for any polynomial-sized modulus.

Structured Variants of LWR

As for LWE, the definition of LWR can be adapted to the ring setting, defining the module variant M-LWR and the ring variant R-LWR. When defining M-LWR and R-LWR, one has to decide how to round vectors over R q . One possibility is to consider an element of R q via its coefficient embedding as a vector over Z q and simply round each coefficient to Z p . This is the way chosen by most works considering structured variants of LWR, as for instance [BPR12, BGM + 16, AA16, CZZ18]. In contrast, a more recent work by Liu and Wang [START_REF] Liu | Rounding in the rings[END_REF] studies a variant of R-LWR where the rounding is done with respect to so-called normal integral bases.

Concerning the hardness of R-LWR, in the full version of their paper, published on the IACR eprint server, Banerjee et al. [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF] show that their reduction with arbitrarily many samples also works for the ring counterpart. However, as for LWR, this reduction similarly imposes a super-polynomial modulus. The improved reduction of Bogdanov et al. [BGM + 16] also applies to the search variant of R-LWR, but not to the decision variant (as they use the Rényi divergence). In the same manner, some parts of the reduction of Alperin-Sheriff and Apon [AA16] also apply to R-LWR. All those works above leave it as an open problem to prove the hardness of R-LWR (or M-LWE) in its decision variant, which is usually needed to construct provably secure encryption schemes. To overcome this issue, Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF] propose a new (non-standard) assumption, called the Computational Learning With Rounding Over Rings (R-CLWR) problem. They show an efficient reduction from decision R-LWE to R-CLWR, and construct an practical encryption scheme based on the hardness of R-CLWR. Recently, Liu and Wan [START_REF] Liu | Rounding in the rings[END_REF] address the remaining open problem by providing a search-to-decision reduction for R-LWR. In order to do so, they need to define a new way of rounding with respect to normal integral bases.

Practical Hardness of Learning With Errors

In this thesis, we are mainly studying the theoretical hardness of LWE (and its variants) by providing efficient reductions from a well studied problem and thus preserving the worst-case to average-case connections that make LWE so interesting to use in cryptography. However, if one constructs a cryptographic scheme whose security is based on LWE (or some of its variants), deriving concrete parameters from those reductions would lead to rather inefficient schemes. This is why in practice, it is common to derive the concrete parameters for LWE-based schemes by looking at the cost of the best known algorithms solving LWE. We call this the practical hardness of LWE.

Fortunately, there are handy tools that allow to estimate the practical hardness of LWE, depending on its different parameters. Using for instance the LWE Estimator by Albrecht et al. [START_REF] Albrecht | On the concrete hardness of learning with errors[END_REF] publicly available at https://bitbucket.org/malb/lwe-estimator/src, one can measure the practical hardness of LWE. The more recent Leaky Estimator by Dachman-Soled et al. [START_REF] Dachman-Soled | LWE with side information: Attacks and concrete security estimation[END_REF] publicly available at https://github.com/lducas/leaky-LWE-Estimator also allows to integrate different types of hints on the LWE secret and/or noise. The latter is of important use to refine the security analysis of the encryption scheme presented in Chapter 7.

Cryptographic Notions

In this section, we introduce the notion of Public Key Encryption schemes. For a gentle introduction to modern cryptography we refer to the standard book of Katz and Lindell [START_REF] Katz | Introduction to Modern Cryptography[END_REF].

Public Key Encryption

A Public-Key Encryption (PKE) scheme permits two parties to confidentially exchange messages without sharing a common secret key beforehand. In the following, we provide formal definitions of PKE schemes, their correctness and IND-CPA security properties. where the probability is taken over the key pair (sk, pk) ← KGen(1 λ ) and the randomness used by the encryption and decryption algorithms. If δ = 0, we say that Π is perfectly correct.

Informally speaking, the security notion IND-CPA captures that no efficient adversary can distinguish between the ciphertext of two messages, where the adversary has even the right to choose the messages by themselves. The acronym stands for indistinguishable against chosenplaintext attacks.

Definition 1.20 (IND-CPA Security): We say that the PKE scheme Π = (KGen, Enc, Dec) is

IND-CPA secure, if for all PPT adversaries A, there is a negligible function negl(•) such that Pr[IND-CPA A Π = 1] < 1 2 + negl(λ) ,
where IND-CPA A Π is the security game from Protocol 1.1.

Protocol 1.1: The IND-CPA security game.

IND-CPA A Π 1 : b ← U ({0, 1}) 2 : (pk, sk) ← KGen(1 λ ) 3 : (m 0 , m 1 ) ← A(1 λ , pk) 4 : c ← Enc(pk, m b ) 5 : b ← A(1 λ , pk, c) 6 : return b = b 1.5.

Random Oracle Model

Within this thesis, we make use of the Random Oracle Model (ROM). This is an idealized framework, where we assume the existance of perfectly random functions, realized by oracles. More precisely, for n, k ∈ N, a random oracle H : {0, 1} k → {0, 1} n , queried on some input bit string x of length k outputs a truly random bit string H (x) of length n. Everyone can interact with the random oracle, but how it internally works stays unknown to everybody. We require the random oracle to be consistent, i.e., if it already has been queried on some input x, its answer is consistent with the previous one. It can be useful to imagine that the random oracle maintains a list, which is initially empty and where input-output pairs are added on-the-fly. A useful property for security proofs is that we can only guess the answer of H on a given input x as long as we don't query it. We say that a security proof is in the ROM if it makes use of random oracles. The main advantage of such proofs is that they offer provably secure cryptographic schemes that are in most cases more efficient than their analogues proven in the standard model. As we don't know any realization of random oracles in the real work, when implementing such schemes, the random oracles are instantiated by concrete cryptographic hash functions. Even as there is no theoretical evidence that a security proof in the ROM implies the security of a scheme when the random oracle is replaced by a specific cryptographic hash function, it still increases our confidence in the scheme's security and can be seen as a compromise between efficient schemes without security proof and impractical schemes with security proof. For a more detailed discussion we refer to the introduction of Katz and Lindell [START_REF] Katz | Introduction to Modern Cryptography[END_REF].

Chapter 2

Binary Hardness of Module LWE

The content of this chapter is based on two joint works with Corentin Jeudy, Adeline Roux-Langlois and Weiqiang Wen. The first is published in the proceedings of the conference Asiacrypt 2020 [BJRW20] and the second is published in the proceedings of the conference CT-RSA 2021 [START_REF] Boudgoust | On the hardness of modulelwe with binary secret[END_REF]. For the latter, a presentation of 20 minutes given by one of the co-authors has been recorded for the conference, illustrating the high level techniques of the paper. Furthermore, modulus-rank switching techniques [BLP + 13, AD17a, WW19] rely on using small secrets as they keep the noise blowup to a minimum. The binary secret variant also happens to be essential for some Fully Homomorphic Encryption (FHE) schemes as in [START_REF] Ducas | FHEW: bootstrapping homomorphic encryption in less than a second[END_REF][START_REF] Chillotti | Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds[END_REF], as it helps to control the noise growth during computations on encrypted data.

A first study of bin-LWE is provided by Goldwasser et al. [START_REF] Goldwasser | Robustness of the learning with errors assumption[END_REF] in the context of leakageresilient cryptography. Whereas their proof structure has the advantage of being easy to follow, their result suffers from a huge error increase. Informally, they show a reduction from LWE k,q,Dα to bin-LWE n,q,D β , where α β = negl(n) and n ≥ k log 2 q + ω(log 2 n). Recall, that D α denotes the continuous Gaussian distribution of width α. Later, Brakerski et al. [BLP + 13] improve the state of the art in order to show the classical hardness of LWE with a polynomial-sized modulus. Micciancio [START_REF] Micciancio | On the hardness of learning with errors with binary secrets[END_REF] provides another reduction from LWE to its binary version. Whereas the two reduction techniques differ, both paper achieve similar results. The dimension is still increased roughly by a factor log 2 q, but the error only by a factor of √ n, where n is the resulting LWE dimension. More concretely, in [BLP + 13] a reduction from LWE k,q,Dα to bin-LWE n,q,D β is shown, where

α β ≤ 1 √ 10n
and n ≥ (k + 1) log 2 q + ω(log 2 n). And Micciancio [START_REF] Micciancio | On the hardness of learning with errors with binary secrets[END_REF] proves a reduction from LWE k,q,Dα to bin-LWE n,q,D β , where

α β ≤ 1 2 √ n+1
and n ≥ (k + 1) log 2 q + ω(log 2 n). The increase in dimension from k to roughly k log 2 q is reasonable, as it essentially preserves the number of possible secrets. However, all of the proofs mentioned above work over the integers Z and not over the ring of integers R of some number field. Hence, as stated by Micciancio in the conclusion of [START_REF] Micciancio | On the hardness of learning with errors with binary secrets[END_REF], an important open problem is whether similar results carry over to the structured variants, in particular to M-LWE, as practical schemes are based rather on M-LWE than on LWE for efficiency reasons.

Our Contributions

In this chapter, we prove the hardness of the binary secret version of M-LWE, if the module rank d is (super-)logarithmic in the degree n of the underlying number field. To the best of our knowledge, this is the first result on the hardness of structured LWE with binary secrets.

More precisely, we present two different proofs to obtain this result. The first proof, presented in Section 2.2, can be seen as a warm-up for the second one, subsequently presented in Section 2.3. Whereas the latter obtains better noise parameters than the first, it is also more complex and requires the introduction of several intermediate problems, such as extended M-LWE and first-iserrorless M-LWE. From a high level perspective, the first more simple proof follows the techniques of [START_REF] Goldwasser | Robustness of the learning with errors assumption[END_REF], while improving the noise rate significantly by using the Rényi divergence (RD) instead of the statistical distance. The second more involved proof can be seen as a module version of [BLP + 13], where moving to the module setting of LWE imposes some technical difficulties that we need to address carefully. We summarize the different characteristics of both reductions in Table 2.1. The most remarkable difference between them is that the simple reduction, represented in the left column, allows for a rank d that is logarithmic in the ring degree n (i.e., Ω(log 2 n)), whereas the improved reduction, stated in the right column, only allows for a rank d that is super-logarithmic in n (i.e., ω(log 2 n)). In contrast, the latter improves the noise ratio of the first one by roughly a factor of √ md, where m denotes the number of given samples. A general issue for both reductions that arises when moving from the unstructured to the module setting is that we have two different possibilities to define what a binary secret exactly means. Recall that a secret underlying an M-LWE instance is a vector over the dual R ∨ . Thus, when interpreting it as a vector over the integers Z to define a binary notion, we can either use the coefficient embedding τ or the canonical embedding σ, both introduced in Section 1.1. We argue in Section 2.5 for the case of power-of-2 cyclotomics, that using the canonical embedding for binary secrets requires the rank d to be larger by a factor n than when using the coefficient embedding. This makes the definition via the canonical embedding impractical and we thus use the coefficient embedding to define a binary secret. Additionally, the coefficient embedding is also the favorite choice once a bin-M-LWE-based scheme is used in practice and thus needs to be implemented. When manipulating Gaussians for theoretical results, however, the canonical embedding is much more suitable. This requires to switch between both embeddings, which in turn has an impact on the parameters overall. The main challenge of the improved reduction from Section 2.3 is the use of matrices over the ring of integers R, as opposed to matrices over Z for LWE. The proof in [BLP + 13, Lem. 4.7] requires the construction of unimodular matrices, which is not straightforward to adapt in the module setting because units of the quotient ring R q = R/qR are much harder to describe than the units of Z q = Z/qZ. This is the reason why we need to control the splitting structure of the cyclotomic polynomial modulo q. Lemma 1.2 [LS18, Thm. 1.1] solves this issue but requires q to satisfy certain number-theoretic properties and to be sufficiently large so that all the non-zero binary ring elements are units of R q .

Both reductions are modulus and ring degree preserving, but so far limited to cyclotomic fields. This restriction stems from the difficulty to capture the invertibility of elements and matrices in more general number fields (needed in Lemma 2.1 and Lemma 2.2) and to bound the norm of the Vandermonde matrix when switching from the coefficient to the canonical embedding (used in Theorem 2.1). Another weaker restriction comes from the LHL (Lemma 1.23) which is used in both reductions and only shown for number fields K = Q(ζ) such that the modulus q is coprime with the index [R :

Z[ζ]],
where R is the associated ring of integers of K. This class contains all cyclotomic number fields as in this case R = Z [ζ]. All other results are proven for general number fields.

The simple reduction from Section 2.2 uses the Rényi divergence (RD) as a measure of distance of two probability distributions, which requires to fix the number of samples beforehand and restricts the results to the corresponding search versions. As the improved reduction only uses the statistical distance, and not the Rényi divergence, both constraints are not needed there.

As an additional contribution, which did not appear in the two original publications [BJRW20, BJRW21], we show that both reductions generalize to larger secret distributions. More precisely, we show in Section 2.4 that the problem η-M-LWE, a variant of M-LWE where the secret's coefficients are sampled uniformly at random over R ∨ η with R η = {x ∈ R : τ (x) ∈ {0, . . . , η -1} n }, is at least as hard as standard M-LWE. The problem bin-M-LWE is the special case of η-M-LWE with η = 2. In both reductions, a larger η leads to a weaker requirement on the module rank d, allowing smaller ranks by a factor of roughly 1/ log 2 η. However, a larger η increases the noise ratio by a factor (η-1)/ log 2 η in the warm-up reduction from Section 2.2 and by a factor (η-1) 2 /( log 2 η) in the improved reduction from Section 2.3.

Related Work

Extended M-LWE In Section 2.3, we introduce an intermediate problem, which we call extended M-LWE. In this variant, for an instance of M-LWE given by (A, A • s + e), additional information on the noise vector e in form of an inner-product e, z with some known hint vector z is given. In the work of Alperin-Sheriff and Apon [START_REF] Alperin-Sheriff | Dimension-preserving reductions from LWE to LWR[END_REF] for their reduction from M-LWE to the deterministic variant Module Learning With Rounding, a variant of M-LWE that is also called extended M-LWE is introduced. In contrast to the full inner product as in our definition, the extended version in [START_REF] Alperin-Sheriff | Dimension-preserving reductions from LWE to LWR[END_REF] gives the trace of the inner product Tr( e,z ) to the attacker. This variant is not suited for our reduction as the field trace does not provide enough information for our lossy argument in Lemma 2.5. We discuss further differences in Section 2.3.1 and Section 2.3.2. A very recent work by Lyubashevksy et al. [START_REF] Lyubashevsky | Shorter lattice-based zero-knowledge proofs via one-time commitments[END_REF] defines yet another variant of M-LWE in the context of lattice-based zero-knowledge proofs that is called extended M-LWE. Instead of the full inner product as in our definition, they provide only the sign of the inner product as an additional hint for the attacker. Again, this is not sufficient for our lossy argument in Lemma 2.5.

Entropic Secrets

Another line of research which studies secret distributions that are not uniform over Z n q , is the one on LWE using so-called entropic secrets [GKPV10, [START_REF] Alwen | Learning with rounding, revisitednew reduction, properties and applications[END_REF][START_REF] Brakerski | Hardness of LWE on general entropic distributions[END_REF]. This variant encompasses not only secrets within a ball of small radius, but also more general secret distributions other than the uniform distribution, studying it from an entropic point of view. This allows to take into account possible leakage on the secret, even though it may come from a distribution yielding vectors of large norms. Recently, the entropic secret setting has also been investigated for R-LWE [START_REF] Brakerski | Lossiness and entropic hardness for ring-lwe[END_REF] and M-LWE [START_REF] Lin | Hardness of module-lwe and ring-lwe on general entropic distributions[END_REF]. As an independent contribution, Lin et al. [START_REF] Lin | Hardness of module-lwe and ring-lwe on general entropic distributions[END_REF] provide an alternative LHL over rings. The LHL we use in our proof (Lemma 1.23) with respect to the statistical distance is an adaptation of [Mic07, Thm. 4.2] to the ring setting and requires the rank to be increased by a super-logarithmic factor log 2 q + ω(log 2 n). In the LHL by Lin et al. [LWW20, Thm. 1], the rank only needs to be larger by a logarithmic factor 2 log 2 q. However, they require the defining polynomial of the underlying number field to be irreducible modulo q, which adds strong restrictions on the modulus q. For example, for the ν-th cyclotomic number field, where ν is a power of 2, the defining polynomial is reducible for every positive integer q and thus there is no such q that fulfills the restrictions.

Binary Noise

Instead of choosing a binary secret for LWE, one can also look at the variant of LWE, where the noise is sampled over the set of binary vectors. For instance, this problem is studied in the context of efficient encryption schemes for constrained devices. It was introduced by Micciancio and Peikert [START_REF] Micciancio | Hardness of SIS and LWE with small parameters[END_REF] together with a reduction from worst-case lattice problems as long as the number of samples is only slightly larger than the LWE dimension n. Further work is needed to investigate if this reduction can be adapted to structured variants. There is a sequence of works showing that binary error LWE (and more generally LWE with small errors) becomes easy to solve via lattice algorithms or algebraic algorithms if sufficiently many samples are available [AG11, MP13, ACF + 15, KF15, BGPW16, STA20]. More concretely, there is a polynomial-time algorithm solving LWE with a binary noise if the number of provided samples is quadratic in the dimension n [START_REF] Arora | New algorithms for learning in presence of errors[END_REF]. In this thesis, we are not studying this variant.

Practical Hardness

In this chapter, we are studying the theoretical hardness of M-LWE with binary secrets by providing a reduction from M-LWE with uniform secrets, which thus connects it via [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] to worst-case problems over module lattices. As often the case for lattice-based cryptography, there is a gap between the theoretical hardness (supported by reductions as in this chapter) and the practical hardness of the problem. By practical hardness we mean the concrete difficulty to solve the problem using the best known algorithms.

As the concrete difficulty also serves to select sample parameters for schemes that rely on the hardness of LWE, there are handy tools that allow to estimate the practical hardness of LWE, depending on its different parameters. Using for instance the LWE Estimator by Albrecht et al. [START_REF] Albrecht | On the concrete hardness of learning with errors[END_REF] publicly available at https://bitbucket.org/malb/lwe-estimator/src, one can measure the practical hardness of LWE with a binary secret. As there are no algorithms that exploit the structure of M-LWE, the following reasoning holds for bin-M-LWE as well.

More concretely, using the computation model of Alkim et al. [START_REF] Alkim | Post-quantum key exchange -A new hope[END_REF] with respect to the core SVP model, we see in Figure 2.1 that in order to keep the same estimated security level for bin-LWE as for LWE, it suffices to increase the LWE dimension n and the Gaussian width α by a multiplicative factor even less than 2. Here, we use the parameters recommended by Regev's reduction [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] for n = 1024, i.e., the modulus q = n 2 and the Gaussian width α = 1/( √ n log 2 (n) 2 ). In the first estimates we set secret_distribution = uniform and in the second estimates we set secret_distribution = (0, 1), which sets it to randomly chosen binary secrets. We see that in the first run, the best algorithm is the one that solves the associated u-SVP problem, guaranteeing 379 bits of security. In the second run, the best algorithm is again the one that solves the associated u-SVP problem, guaranteeing even 492 bits of security. The only difference to both executions of the estimator is that we increased n by a factor 1.8 and α by a factor 1.8. This is much smaller than the (super-)logarithmic factor for the dimension and the √ n factor for the Gaussian width that Brakerski et al. [BLP + 13] obtain for LWE and that we obtain for M-LWE. Kirchner and Fouque [START_REF] Kirchner | An improved BKW algorithm for LWE with applications to cryptography and lattices[END_REF] improve the so-called BKW algorithm to solve the LWE problem and, in particular, run some experiments on the binary secret variant, assuming that enough samples are provided. Chen et al. [START_REF] Chen | On the concrete security of LWE with small secret[END_REF] systematically run experiments on binary secret LWE with dimensions at most 200 to better understand the concrete behavior of lattice algorithms such as BKZ for this special variant. However, their range of parameters does not cover the ones used by cryptographic constructions (where the LWE dimension is usually starting from 500).

Roadmap

The chapter is structured as follows. In Section 2.2, we prove the first reduction for the hardness of M-LWE with a binary secret, which we call the warm-up reduction. In Section 2.3, we provide an improved reduction to show the hardness of M-LWE with a binary secret, which needs two new intermediate problems, called rst-is-errorless M-LWE and ext-M-LWE. Furthermore, we generalize both reductions in Section 2.4 to secrets of bounded norm, not necessarily binary secrets. We conclude the chapter by arguing in Section 2.5 that the coefficient embedding is the suited choice in the setting of binary secrets.

Warm-up: A Simple Reduction

In the following, we show a first reduction for the hardness of M-LWE with a binary secret. Our proof follows the original proof structure of Goldwasser et al. [START_REF] Goldwasser | Robustness of the learning with errors assumption[END_REF] in the case of LWE, while achieving much better noise parameters by using the Rényi divergence instead of the statistical distance. The improvement on the noise rate compared to [START_REF] Goldwasser | Robustness of the learning with errors assumption[END_REF] stems from the fact that the Rényi divergence only needs to be constant for the reduction to work and not necessarily negligibly close to 1 (compared to negligibly close to 0 for the statistical distance). A similar effect arises with respect to the rank condition in comparison with the second proof for bin-M-LWE that we prove in the next section. More precisely, as we use the LHL with respect to the Rényi divergence, and not the statistical distance, we can have a rank that is logarithmic in the ring degree n, instead of super-logarithmic. Note that we only recently found out that using the LHL with respect to the Rényi divergence decreases the rank condition from super-logarithmic down to logarithmic. 2 This is why this didn't appear in the original publication [BJRW20, Thm. 1] and can be seen as an improvement achieved afterwards. However, using the Rényi divergence as a tool for distance measurement requires to move to the search variants of M-LWE (denoted by M-SLWE) and its binary version, respectively. Additionally, it asks to fix the number of samples a priori. 2 We would like to thank Thomas Prest for pointing out to us the connection between the collision probability and the Rényi divergence.

To facilitate the understanding of this section, we start by illustrating the high level idea of the proof in Figure 2.2 (where the Latex/tikz credits go to my co-author Corentin Jeudy). Given an instance of bin-M-LWE by (A, A • s + e), our goal is to transform it to a related instance of M-LWE defined by (B, B • s + e ). Note that the secret s is modulo 2 and the secret s is modulo q. At the core of the hardness proof of bin-M-LWE lies a lossy argument, where the public matrix A is replaced by a lossy matrix B • C + Z, which corresponds to the second part of some multiple-secrets M-LWE sample. Note that the rank of the matrix B is smaller than the one of the matrix A, motivating the description lossy. Here, we can see that this argument does not work for R-LWE (which corresponds to M-LWE of rank 1) as there is no possibility to replace the public matrix consisting of one column by a matrix of smaller rank. To argue that an adversary cannot distinguish between the two cases, we need the hardness of the decision M-LWE problem as well. In a second step, the term Z • s + e is replaced by the new noise e , where the Rényi divergence of both expressions can be bounded by a constant using the properties of the Rényi divergences of Gaussian distributions. This step is commonly called noise flooding. Finally in the third step, the product C • s is replaced by the uniform secret s , where the Rényi divergence of both elements can be bounded by a constant using a variant of the Leftover Hash Lemma (LHL). The use of the LHL is also the reason why our reduction only works for module ranks larger than log 2 (q) + Ω(log 2 n). Informally speaking, it requires the ratio between the number of rows of C and its number of columns to be logarithmic in order to bound the Rényi divergence. As providing the full information of B, C and Z only makes the problem easier, we end up with some standard M-LWE instance.

We now formally prove the hardness of M-SLWE with a binary secret. Overall, our results are restricted to cyclotomic number fields. As in Section 1.1.5, we denote by λ the scaling factor to map elements from R ∨ to R. We study the M-LWE problem in its discrete version, as presented in Section 1.4.3. The theorem uses the discrete Gaussian distribution ψ = D R ∨ ,αq for some positive real α and the smoothing parameter η ε , as defined in Section 1.3.1. Theorem 2.1 (Binary Hardness of M-LWE -Warm-up)

Let K be a cyclotomic number field of degree n with R its ring of integers. Let k, d, m, q ∈ N such that q is prime and m polynomial in n. Further, let α and β be positive real numbers

such that β ≥ √ m • n 2 d • α. Let ε ∈ R ∩ [0, 1/2) such that βq ≥ η ε (R ∨ ) and ε = O( 1 m ). Then, for any d ≥ k • log 2 q + Ω(log 2 n), there is a probabilistic polynomial-time reduction from M-SLWE m n,k,q,D R ∨ ,βq and M-LWE m,d n,k,q,D R ∨ ,αq to bin-M-SLWE m n,d,q,D R ∨ ,βq .
The degree n of the number field K, the modulus q and the number of samples m are preserved. The reduction increases the rank of the module from k to k • log 2 q + Ω(log 2 n) and the Gaussian width from αq to αq

• √ m•n 2 d. Further, M-LWE m n,k,q,D R ∨ ,αq trivially reduces to M-SLWE m n,k,q,D R ∨ ,βq , as β ≥ α. Proof: Given a bin-M-SLWE m n,d,q,D R ∨ ,βq sample (A, A • s + e) ∈ (R q ) m×d × (R ∨ q ) m , with s ∈ (R ∨ 2 )
d and e ← (D R ∨ ,βq ) m , the search problem asks to find s and e. In order to prove the statement, we define different hybrid distributions: • H 4 : (B, C, Z, Bs + e ), where s ← U ((R ∨ q ) k ) and B, C, Z, e as in H 3 .

• H 0 : (A, A • s + e), as in bin-M-SLWE m n,d,q,D R ∨ ,βq , • H 1 : (A = λ(BC + Z), A • s + e), where B ← U ((R q ) m×k ), C ← U ((R ∨ q ) k×d ),
For j ∈ {0, . . . , 4}, we denote by P j the problem of finding the secret s (resp. s in H 4 ), given a sample of the distribution H j . We say that problem P j is hard if for any probabilistic polynomial-time attacker A the advantage of solving

P j is negligible, thus Adv Pj [A(H j ) = s] ≤ n -ω(1)
, where n is the degree of K. The overall idea is to show that if P 4 is hard, then P 0 is hard as well.

Problem P 4 is hard. By the hardness assumption of M-SLWE m n,k,q,D R ∨ ,βq , it yields Adv P4 [A(H 4 ) = s ] ≤ n -ω(1)
.

From P 4 to P 3 . By the probability preservation property of the Rényi divergence (Lemma 1.20), we have

Adv P3 [A(H 3 ) = s] 2 ≤ Adv P4 [A(H 4 ) = s ] • RD 2 (H 3 H 4 ).
The only difference between the distributions H 3 and H 4 is that the element λCs in H 3 is replaced by a uniform s ∈ (R ∨ q ) k in H 4 . Our aim is to show that their Rényi divergence can be bounded above by a constant. We set C = λC ∈ (R q ) k×d and s = λs ∈ (R 2 ) d . By the Ring Leftover Hash Lemma stated in Lemma 1.23 with η = 2, the Rényi divergence between the distribution ( C, Cs) and the distribution ( C, s ) is bounded above by (1 + q k /2 d ) n . Note that for cyclotomic fields, it yields R = Z[ζ] and thus the index [R : Z[ζ]] = 1 is always coprime to q. Dividing the first and the second part of both distributions by λ preserves the Rényi divergence. As we require d ≥ k log 2 q +Ω(log 2 n), we obtain RD 2 (H 3 H 4 ) ≤ (1+O(1/n)) n , which can be asymptotically bounded by a constant.

From P 3 to P 2 . Again, by the probability preservation property of the Rényi divergence (Lemma 1.20), we obtain

Adv P2 [A(H 2 ) = s] 2 ≤ Adv P3 [A(H 3 ) = s] • RD 2 (H 2 H 3 ).
In order to compute the Rényi divergence of H 2 and H 3 , we need to compute the Rényi divergence of Z(λs) + e and e . Using the noise flooding bound of Lemma 1.14 with η = 2, we know that each of the m coefficients of Z(λs) is bounded above by αqdn 2 with probability 1 -2 -Ω(n) . Thus, it suffices to compute the Rényi divergence of (D R ∨ ,βq,c ) m and (D R ∨ ,βq ) m , where c ∈ R ∨ with norm bounded above by αqdn 2 . Using that βq ≥ η ε (R ∨ ), the multiplicativity of the Rényi divergence (Lemma 1.20) and the result of Lemma 1.21 about the Rényi divergence of shifted discrete Gaussians, we deduce

RD 2 (D R ∨ ,βq,c ) m (D R ∨ ,βq ) m = RD 2 D R ∨ ,βq,c D R ∨ ,βq m ≤ 1 + ε 1 -ε 2m • exp 2π c 2 (βq) 2 m ≤ 1 + ε 1 -ε 2m • exp(2π).
The last inequality comes from the restriction

α β ≤ 1 √ m•n 2 d which leads to 2π c 2 (βq) 2 ≤ 2π m .
Here, we simply use that the function exp is increasing for increasing input.

For the Rényi divergence to be bounded by a constant, we also need

ε = O( 1 m ). Indeed, we have 1+ε 1-ε 2 = 1 + 4ε/1-ε 2 2 < exp 4ε 1-ε as 1 + x y y
< exp(x) for any x, y > 0. As we require ε < 1 2 , it yields 1 1-ε < 2 and thus, we get 1+ε 1-ε 2m < exp(8mε) and therefore ε = O( 1 m ) suffices.

From P 2 to P 1 . Since more information is given in distribution H 2 than in distribution H 1 , the problem P 1 is harder than P 2 and hence

Adv P1 [A(H 1 ) = s] ≤ Adv P2 [A(H 2 ) = s].
From P 1 to P 0 . By the hardness assumption of M-LWE m,d n,k,q,D R ∨ ,αq , the distributions H 0 and H 1 are computationally indistinguishable. More concretely,

Adv P0 [A(H 0 ) = s] ≤ Adv P1 [A(H 1 ) = s] + d • Adv M-LWE ≤ Adv P1 [A(H 1 ) = s] + d • n -ω(1) ,
where d is the number of secret vectors, represented as the columns of the matrix C. Putting all equations from above together, we obtain

Adv P0 [A(H 0 ) = s] ≤ Adv P1 [A(H 1 ) = s] + d • Adv M-LWE ≤ Adv P2 [A(H 2 ) = s] + d • Adv M-LWE ≤ Adv P3 [A(H 3 ) = s] • RD 2 (H 2 H 3 ) + d • Adv M-LWE ≤ Adv P4 [A(H 4 ) = s ] • RD 2 (H 3 H 4 ) • RD 2 (H 2 H 3 ) + d • Adv M-LWE ≤ n -ω(1) .
As the problem

P 0 is exactly bin-M-SLWE m n,d,q,D R ∨ ,βq
, this concludes the proof.

An Improved Reduction

In this section, we improve the hardness result of the section above for M-LWE with binary secrets for cyclotomic fields. Our proof follows the same idea as in [BLP + 13] that we adapt over modules. More precisely, we show a reduction from M-LWE with rank k to bin-M-LWE with rank d satisfying d ≥ (k + 1) log 2 q + ω(log 2 n). The reduction preserves the modulus q, that needs to be prime satisfying number-theoretic restrictions (as detailed in Theorem 2.2), the ring degree n and the number of samples m, but the noise is increased by a factor of n √ 2d √ 4n 2 + 1. The noise ratio is polynomial in n, but smaller than the ratio n 2 d √ m that we obtained with the first proof from Section 2.2. Thus, we improve the noise parameters by a factor of √ dm, which is advantageous as the typical choice for m in theoretical reductions is m = Θ(n log 2 n). For the reduction, m also needs to be larger than the target module rank d, and at most polynomial in n because of the hybrid argument used in Lemma 2.4. As the reduction does not need the Rényi divergence as a measure for distance, the results hold for the decision versions of M-LWE and bin-M-LWE, as opposed to the reduction from the section above. On the other hand, the improved noise parameters come at the cost of a larger rank condition (super-logarithmic instead of logarithmic) and a more complex proof, involving several intermediate problems. Theorem 2.2 holds for all cyclotomic fields, whereas most results even apply for all number fields K = Q(ζ) such that the ring of integers is R = Z[ζ], the bottleneck being the construction in Lemma 2.2.

We now state our main result of this section, first for general cyclotomic number fields and then specialized to power-of-2 cyclotomics. We illustrate the sequence of reductions needed to prove Theorem 2.2 and Corollary 2.1 in Figure 2.3. The formal definitions of the extended and first-is-errorless variants of M-LWE are given in Section 2.3.1 and Section 2.3.2 below. We refer to Section 1.3.2 for the formal definitions of the different Gaussian distributions over a number field K that arise in this section, as for instance D α , D R,α or Ψ ≤α .

Theorem 2.2 (Binary Hardness of M-LWE)

Let ν ∈ N with prime-power factorization ν = j p ej j . Further, let K be the ν-th cyclotomic field of degree n = ϕ(ν), and R its ring of integers. Set µ = j p j and let q be a prime number such that q = 1 mod µ, ord ν (q) = ν/µ and q > max(2n, s 1 (µ) ϕ(µ) ), where s 1 (µ) denotes the largest singular value of the Vandermonde matrix of the µ-th cyclotomic field. Further, let k, d, m ∈ N such that d ≥ (k + 1) log 2 q + ω(log 2 n), and d ≤ m ≤ poly (n).

Let α ≥ q -1 √ ln(2nd(1 + 1/ε))/π and β ≥ α • n √ 2d √ 4n 2 + 1.
Then there is a reduction from M-LWE m n,k,q,Dα to bin-M-LWE m n,d,q,Ψ ≤β , such that if A solves the latter with advantage Adv[A], then there exists an algorithm B that solves the former with advantage

Adv[B] ≥ 1 3m   Adv[A] - 1 2 1 + q k+1 2 d n -1   - 37ε 2 .
As mentioned before, the noise ratio β/α is given by the term n √ 2d √ 4n 2 + 1, which is composed of three different parts. The factor n encapsulates the norm distortion between the coefficient embedding τ and the canonical embedding σ, as well as the actual length of the binary vectors. The second term √ 2d stems from the masking of z when introduced in the first hybrid in the proof of Lemma 2.5. The last factor √ 4n 2 + 1 solely represents the impact of giving information on the error in the ext-M-LWE problem. Let ν ∈ N be a power of 2 and K be the ν-th cyclotomic field of degree n = ν/2, and R its ring of integers. Let q ∈ N be prime such that q = 5 mod 8. Further, let k, d, m N such

M-LWE m n,k,q,Dα M-LWE d n,k,q,Dα rst-is-errorless M-LWE d n,k+1,q,Dα ext-M-LWE d n,k+1,q,ψ,(R ∨ 2 ) d ψ = D q -1 (R ∨ ) m ,α √ 4B 2 +1 ext-M-LWE d,m n,k+1,q,ψ,(R ∨ 2 ) d ψ = D q -1 (R ∨ ) m ,α √ 4B 2 +1 M-LWE m n,k+1,q,D αB √ d √ 4B 2 +1 bin-M-LWE m n,d,q,Ψ ≤αB √ 2d √ 4B 2 +1 m ≥ d Lemma 2.1, q ≥ 2n, prime
Lemma 2.3, q prime and fulfilling numbertheoretic requirements Lemma 2.4, m ≤ poly(n)

α ≤ αB √ d √ 4B 2 + 1
Lemma 2.5, q prime d ≥ (k + 1) log 2 q + ω(log 2 n) Figure 2.3: Overview of the proof of Theorem 2.2, starting from M-LWE with uniform secrets via rst-is-errorless M-LWE and ext-M-LWE to M-LWE with binary secrets. The bound B is defined as B = max x∈R2 σ(x) ∞ , where σ is the canonical embedding. In cyclotomic fields, we have B ≤ n. Note that Lemma 2.5 uses d samples from ext-M-LWE, where d is the module rank in bin-M-LWE. The number-theoretic assumptions on q concern the splitting behavior of the cyclotomic polynomial in Z q [x], and are discussed in Section 2.3.2.

that d ≥ (k+1) log 2 q+ω(log 2 n), and d ≤ m ≤ poly(n). Let α ≥ q -1 √ ln(2nd(1 + 1/ε))/π and β ≥ α • n √ 2d √ 4n 2 + 1.
Then there is a reduction from M-LWE m n,k,q,Dα to bin-M-LWE m n,d,q,Ψ ≤β , such that if A solves the latter with advantage Adv[A], then there exists an algorithm B that solves the former with advantage

Adv[B] ≥ 1 3m   Adv[A] - 1 2 1 + q k+1 2 d n -1   - 37ε 2 .

First-is-errorless M-LWE

We follow the same idea as Brakerski et al. [BLP + 13] by gradually giving more information to the adversary while proving that this additional information does not increase the advantage too much. We define the module version of first-is-errorless LWE, from [BLP + 13], where the first equation is given without error. A similar definition and reduction from M-LWE are given in [START_REF] Alperin-Sheriff | Dimension-preserving reductions from LWE to LWR[END_REF]. The only difference between the two reductions comes from the pre-processing step, which is simplified in our case due to the further restrictions on q of our overall reduction. For a number field K of degree n and with ring of integers R, we set

R q = R/qR, K R = K ⊗ Q R, and T R ∨ = K R /R ∨ as usual. Further, recall the definition of the M-LWE distribution A M s,ψ from Section 1.4.3. Definition 2.1 (First-is-errorless M-LWE): Let n, k, q ∈ N
and K be a number field of degree n and R its ring of integers. Let Υ be a distribution over a family of distributions over K R . The rst-is-errorless M-LWE n,k,q,Υ problem is to distinguish between the following cases. On the one hand, the first sample is uniform over (R q ) k × q -1 R ∨ /R ∨ and the rest are uniform over (R q ) k × T R ∨ . On the other hand, there is some unknown s ← U ((R ∨ q ) k ) and ψ ← Υ such that the first sample is from A M s,{0} and the rest are distributed as A M s,ψ , where {0} is the distribution that is deterministically 0.

If the number m ∈ N of samples is fixed, we write rst-is-errorless M-LWE m n,k,q,Υ . The following lemma shows for cyclotomic fields that rst-is-errorless M-LWE with rank k is at least as hard as the standard M-LWE problem with rank k -1.

Lemma 2.1 (M-LWE to rst-is-errorless M-LWE, adapted from [BLP + 13, Lem. 4.3])

Let K be the ν-th cyclotomic field of degree n = ϕ(ν), and R its ring of integers. Let q ≥ 2n be a prime integer such that q ν, k a positive integer, and Υ a distribution over a family of distributions over K R . There is PPT reduction from M-LWE n,k-1,q,Υ to rst-is-errorless M-LWE n,k,q,Υ .

Proof: Pre-processing: The reduction first chooses a ← U ((R q ) k ) and then b 2 , . . . , b k independently from U ((R q ) k ) such that a , b 2 , . . . , b k are R q -linearly independent. Each time we draw a uniformly random column, the probability that the new column is R q -linearly independent with the previous ones is at least 1n/q for q ≥ n by Lemma 1.3. Since we require q ≥ 2n, this probability is at least 1/2. Therefore, we only need a polynomial number of uniformly sampled columns in R k q to construct a matrix of R k×k q invertible modulo qR. The preprocessing step results in a matrix U = [a , b 2 , . . . , b k ] ∈ (R q ) k×k that is invertible modulo qR according to Lemma 1.3.

Reduction: Then, sample s 0 uniformly in R ∨ q . The reduction is as follows. For the first sample, it outputs (a , q -1 •s 0 mod R ∨ ) ∈ (R q ) k ×q -1 R ∨ /R ∨ . The other samples are produced by taking (a, b) ∈ (R q ) k-1 ×T R ∨ from the M-LWE challenger, picking a fresh randomly chosen a ∈ R q , and outputting (U(a |a), b+q -1 (s 0 •a ) mod R ∨ ) ∈ (R q ) k ×T R ∨ , with the vertical bar denoting concatenation. We now analyze correctness.

First note that the first component is uniform over (R q ) k . Indeed, a is uniform over (R q ) k for the first sample, and since a is uniform over (R q ) k-1 , a is uniform over R q , and U is invertible in (R q ) k×k , then U(a |a) is uniform over (R q ) k as well.

If b is uniform, the first sample yields q -1 s 0 mod R ∨ uniform over q -1 R ∨ /R ∨ . For the other samples, b + q -1 (s 0 • a ) mod R ∨ is uniform over T R ∨ and independent of U(a |a) but also independent from the first sample because b masks q -1 (s 0 • a ).

If b = q -1 a , s + e mod R ∨ for some uniform s ∈ (R ∨ q ) k-1 and e ← ψ for some ψ ← Υ, then q -1 s 0 = q -1 e 1 ,(s 0 |s) = q -1 Ue 1 ,U -T (s 0 |s) = q -1 a ,U -T (s 0 |s) , where e 1 = [1, 0, . . . , 0] T . For the other samples, we have

b + q -1 (s 0 • a ) mod R ∨ = q -1 a,s + q -1 (s 0 • a ) + e mod R ∨ = q -1 (a |a),(s 0 |s) + e mod R ∨ = q -1 U(a |a),U -T (s 0 |s) + e mod R ∨ . Note that (s 0 |s) is uniform over (R ∨ q ) k so U -T (s 0 |s) is also uniform over (R ∨ q ) k be- cause U -T is invertible in R q .
Therefore the reduction outputs samples according to rst-is-errorless M-LWE with secret s = U -T (s 0 |s).

Extended M-LWE

We now define the module version of the extended variant of LWE introduced in [BLP + 13], where the adversary is allowed a hint on the errors. As opposed to [START_REF] Alperin-Sheriff | Dimension-preserving reductions from LWE to LWR[END_REF], who also define such a module version, we allow for multiple secrets and one single hint vector z, as required by our final reduction of Lemma 2.5. Definition 2.2 (Extended M-LWE): Let m, q, k, t, n ∈ N and K be a number field of degree n with R its ring of integers. Let Z ⊆ (R ∨ ) m and ψ be a discrete distribution over q -1 (R ∨ ) m . The ext-M-LWE m,t n,k,q,ψ,Z problem is as follows: A PPT adversary first chooses z ∈ Z and then receives a tuple

(A, (b j ) j∈[t] , ( e j ,z ) j∈[t] ) ∈ (R q ) k×m × (q -1 R ∨ /R ∨ ) m t × (q -1 R ∨ ) t .
Their goal is to distinguish between the following cases. On one side, A is sampled uniformly over (R q ) k×m , and for all j ∈ [t], e j ∈ q -1 (R ∨ ) m are independent and identically distributed from ψ, and define b j = q -1 A T s j + e j mod R ∨ for some uniformly cho-sen s j ∈ (R ∨ q ) k . On the other side, everything is identical except that the b j are sampled uniformly over (q -1 R ∨ /R ∨ ) m , independently from A and the error vectors.

The parameter n defines the ring degree, q the modulus, k the module rank (i.e., the number of columns of the matrix A), m the number of samples (i.e., the number of rows of the matrix A) and t defines the number of given hints on independent noise vectors.

The set Z represents the set of hints that can be given on the noise vector. The t hints are given in form of the inner-product of such a fixed hint vector z ∈ Z and the corresponding noise vector e j for j ∈ [t]. Later, we are interested in the special set of vectors with coefficients in {0, . . . , η -1} for some η ∈ N, thus in the case Z = (R ∨ η ) m . Especially the case of binary vectors (i.e., η = 2) is of interest in the improved reduction for bin-M-LWE.

For simplicity in what follows, for a matrix A ∈ R m×m , we denote by A ⊥ ∈ R m×(m-1) the submatrix of A obtained by removing the leftmost column. Our reduction from the problem rst-is-errorless M-LWE to ext-M-LWE in Lemma 2.3 requires the construction of a matrix U z ∈ R m×m , for all hint vectors z ∈ Z = (R ∨ η ) m , satisfying several properties. This matrix allows us to transform samples from a rst-is-errorless M-LWE challenger into samples that we can give to an oracle for ext-M-LWE. The largest singular value of its submatrix U ⊥ z (when embedded with θ as defined in Section 1.3.2), controls the increase in the Gaussian parameter. We propose a construction for which we bound the largest singular value above by a quantity independent on z, as needed in the reduction. Lemma 2.2 (Construction of Matrix U z for Hint Vector z)

Let ν ∈ N with prime-power factorization ν = j p ej j . Further, let K be the ν-th cyclotomic field of degree n = ϕ(ν), and R its ring of integers. Let η ∈ N and let µ = j p j and q be a prime number such that q = 1 mod µ, ord ν (q) = ν/µ and q > ((η-1)s 1 (µ)) ϕ (µ) , where s 1 (µ) denotes the largest singular value of the Vandermonde matrix of the µ-th cyclotomic field. Finally, let m be a positive integer, and Z = (R ∨ η ) m , and we recall the ring parameter B = max x∈Rη σ(x) ∞ . For all z ∈ Z, there is an efficiently computable matrix U z ∈ R m×m that is invertible modulo qR and that verifies the following: z is orthogonal to the columns of U ⊥ z , and the largest singular value of θ(U ⊥ z ) ∈ C mn×(m-1)n is at most 2B.

Proof: Recall from Section 1.1.5 that for any cyclotomic number field, there exists an element λ such that λR

∨ η = R η . Let z ∈ Z and denote (z j ) j∈[m] = z = λz ∈ R m η .
First, we construct U z in the case where all the z j are non-zero. To do so, we define U z = A + B via the intermediate matrices A and B of R m×m , all unspecified entries being zeros:

              1 z1 -z2 -zm zm-1 U ⊥ z U z = =               1 z1 zm-1 A ⊥ +               0 -z2 -zm 0 B ⊥
The matrix U z is invertible modulo qR only if all the z j (except z m ) are in R × q . Yet, since they are all non-zero elements of R η , we have that for all j ∈ [m], τ ( z j ) ∞ ≤ η -1, where τ is the coefficient embedding. By Lemma 1.2, since q verifies the algebraic conditions taking all f j = 1 and q 1/ϕ(µ) /s 1 (µ) > (η -1), all the z j are in R × q . By construction, the last m-1 columns of U z are orthogonal to z. Let U ⊥ z be the submatrix of U z obtained by removing the leftmost column as shown above. Since θ is a ring homomorphism, we have θ(U ⊥ z ) = θ(A ⊥ ) + θ(B ⊥ ). We now need to bound the spectral norms (which equal their largest singular values) of these two matrices, and use the triangle inequality to conclude. For any vector x ∈ C (m-1)n , we have that

θ(A ⊥ )x 2 = j∈[m-1] k∈[n] σ k ( z j ) 2 x k+n(j-1) 2 ≤ B x 2 , because each z k is in R η . This yields θ(A ⊥ ) 2 ≤ B. A similar calculation on B ⊥ leads to θ(B ⊥ ) 2 ≤ B, thus resulting in θ(U ⊥ z ) 2 ≤ 2B
. Now assume that z j0 , . . . , z m are zeros for some j 0 in [m]. If the zeros do not appear last in the vector z, we can replace z with S z, where S ∈ R m×m swaps the coordinates of z so that the zeros appear last. Since S is unitary, it preserves the singular values as well as invertibility. Then, the construction remains the same except that the z j0 , . . . , z m on the diagonal are replaced by 1. The orthogonality is preserved, and θ(U ⊥ z ) 2 can still be bounded above by 2B.

Notice that when the ring is of degree 1 and η = 2 (binary hint vectors), the constructions in the different cases match the ones from [BLP + 13, Claim 4.6]. So do the singular values as B ≤ (η -1)n = 1 by Lemma 1.1. Also, the construction differs from the notion of quality in [START_REF] Alperin-Sheriff | Dimension-preserving reductions from LWE to LWR[END_REF] due to the discrepancies between the two definitions of ext-M-LWE. The following lemma shows that the extended variant of M-LWE with one hint (t = 1) is at least as hard as the first-is-errorless variant of M-LWE, for appropriate parameters. Given η ∈ N and let ν ∈ N with prime-power-factorization ν = j p ej j . Further, let K be the ν-th cyclotomic field of degree n = ϕ(ν), and R its ring of integers. Let µ = j p j and q be a prime such that q = 1 mod µ, ord ν (q) = ν/µ and q > ((η -1)s 1 (µ)) ϕ(µ) , where s 1 (µ) denotes the largest singular value of the Vandermonde matrix of the µ-th cyclotomic field. Let m, k positive integers,

Z = (R ∨ η ) m , ε ∈ (0, 1/2) and α ≥ q -1 √ ln(2mn(1 + 1/ε))/π. Then, there is a PPT reduction from rst-is-errorless M-LWE m n,k,q,ψ to ext-M-LWE m n,k,q,ψ ,Z , where ψ = D α and ψ = D q -1 (R ∨ ) m ,α √ 4B 2 +1
, where B = max x∈Rη σ(x) ∞ The reduction reduces the advantage by at most 33ε/2. Proof: We begin with showing that the Gaussian width α is at least as large as the smoothing parameter of q -1 (R ∨ ) m . Using Lemma 1.4, we have λ ∞ 1 (R) ≥ N (R) 1/n = 1. So, using the fact that (qΛ) * = q -1 Λ * , we have

λ ∞ 1 ((q -1 (R ∨ ) m ) * ) = λ ∞ 1 (q((R ∨ ) m ) * ) = qλ ∞ 1 (((R ∨ ) m ) * ) = qλ ∞ 1 (R) ≥ q,
which together with Lemma 1.7 yields α ≥ q -1 √ ln(2mn(1

+ 1/ε))/π ≥ η ε (q -1 (R ∨ ) m
). Now, we show the reduction. Assume we have access to an oracle O for ext-M-LWE m n,k,q,ψ ,Z , where ψ = D q -1 (R ∨ ) m ,α √ 4B 2 +1 . We request m samples from the first-is-errorless challenger, resulting in

(A, b) ∈ (R q ) k×m × ((q -1 R ∨ /R ∨ ) × T m-1 R ∨ ).
Assume we need to provide samples to O for some z ∈ Z. By Lemma 2.2 we can efficiently compute a matrix U z ∈ R m×m that is invertible modulo qR, such that its submatrix U ⊥ z is orthogonal to z, and that θ(U ⊥ z ) has largest singular value less than 2B. The reduction first samples f ∈ K m R from the continuous Gaussian distribution of covariance matrix α 2 (4B 2 I mn -

H † θ(U ⊥ z )θ(U ⊥ z ) † H) ∈ R mn×mn
, where H is defined as in Section 1.3.2. Note that H is unitary and therefore preserves the largest singular value. The reduction then computes b = U z b + f and samples c from D q -1 (R ∨ ) m -b ,α , and finally gives the following to O

(A = AU T z , b + c mod R ∨ , z,f + c ).
Note that this tuple is in (R q ) k×m × (q -1 R ∨ /R ∨ ) m × q -1 R ∨ , as required.

We now prove correctness. First, consider the case where A is uniformly random over R k×m q and b = q -1 A T s + e mod R ∨ for some uniform s ∈ (R ∨ q ) k , and e sampled from {0} × D m-1 α where {0} denotes the distribution that is deterministically 0. Since U z is invertible modulo qR, A = AU T z is also uniform over (R q ) k×m as required. From now on we condition on an arbitrary A and analyze the distribution of the remaining components. We have

b = q -1 U z A T s + U z e + f = q -1 (A ) T s + U z e + f.
Since the first coefficient of e is deterministically 0 the first column is ignored in the covariance matrix, and then U z e is distributed as the Gaussian over

K m R of covariance ma- trix α 2 H † θ(U ⊥ z )θ(U ⊥ z ) † H by Lemma 1.13. Hence the vector U z e + f is distributed as the Gaussian over K m R of covariance matrix α 2 H † θ(U ⊥ z )θ(U ⊥ z ) † H + α 2 ((2B) 2 I mn -H † θ(U ⊥ z )θ(U ⊥ z ) † H) which is identical to D m α2B . Since q -1 (A ) T s ∈ q -1 (R ∨ ) m , the coset q -1 (R ∨ ) m -b is the same as q -1 (R ∨ ) m -(U z e+f)
, which yields that c can be seen as being sampled from D q -1 (R ∨ ) m -(Uze+f),α . By the remark made at the beginning of the proof, we have α ≥ η ε (q -1 (R ∨ ) m ), so by Lemma 1.11, the distribution of U z e+f+c is within statistical distance 8ε of D q -1 (R ∨ ) m ,α √ 4B 2 +1 , which shows that the second component is correctly distributed up to 8ε. Note that U z e = i∈[m] e i • u i is in the space spanned by the columns of U ⊥ z because e 1 = 0. This yields z , U z e = 0 as z is orthogonal to the columns of U ⊥ z . This proves that the third component equals z,U z e + f + c and is thus correctly distributed. Now consider the case where both A and b are uniform. First, observe that α ≥ η ε (q -1 (R ∨ ) m ) and therefore by Lemma 1.9, the distribution of (A, b) is within statistical distance ε/2 of the distribution of (A, e + e) where e ∈ (q -1 R ∨ /R ∨ ) m is uniform and e is distributed from {0} × D m-1 α . So we can assume our input is (A, e + e). A is uniform as before, and clearly independent of the other two components. Moreover, since b = U z e +U z e+f and U z e ∈ q -1 (R ∨ ) m , then the coset q -1 (R ∨ ) mb is identical to q -1 (R ∨ ) m -(U z e + f). For the same reasons as above, U z e + f + c is distributed as D q -1 (R ∨ ) m ,α √ 4B 2 +1 within statistical distance of at most 8ε, and in particular independent of e . So the third component is correctly distributed because once again z , U z e = 0. Finally, since e is independent of the first and third components, and that U z e is uniform over (q -1 R ∨ /R ∨ ) m as U z is invertible modulo qR, it yields that the second component is uniform and independent of the other ones as required.

Example 2.1 (Instantiation in Power-of-2 Cyclotomics)

The condition on the modulus q in Lemma 2.2 and Lemma 2.3 stems from the invertibility result from Lyubashevsky and Seiler [START_REF] Lyubashevsky | Short, invertible elements in partially splitting cyclotomic rings and applications to lattice-based zero-knowledge proofs[END_REF], as stated in Lemma 1.2. It can be simplified in the power-of-2 case , see Example 1.4, where it is conditioned on the number κ > 1 of splitting factors of the defining polynomial x n + 1 in Z q [x]. Choosing κ as a power of two less than n = 2 k , implies that q has to be a prime congruent to 2κ + 1 modulo 4κ. The invertibility condition then becomes 0 < τ (y) ∞ < q 1/κ / √ κ for any y in R q . The upper bound is decreasing with κ so the smaller κ, the more invertible elements. The smallest choice for κ is κ = 2, which leads to choosing a prime q = 5 mod 8. In our context, having q 1/2 / √ 2 > (η -1) is sufficient as our elements have coefficients at most η -1. For the special case of η = 2, this leads to q > 2 which is subsumed by q = 5 mod 8.

Finally, we use a standard hybrid argument to show that ext-M-LWE with t hints is at least as hard as ext-M-LWE with 1 hint, at the expense of reducing the advantage by a multiplicative factor of t.

Lemma 2.4 (Adapted from [BLP + 13, Lem. 4.8])

Let n, k, m, q, t ∈ N such that t ≤ poly(n) and K be a number field of degree n with R its ring of integers. Let ψ be a discrete distribution over q -1 (R ∨ ) m , and Z ⊆ (R ∨ ) m . There is a reduction from ext-M-LWE m n,k,q,ψ,Z to ext-M-LWE m,t n,k,q,ψ,Z that reduces the advantage by a multiplicative factor of t.

Proof: Let O be an oracle for ext-M-LWE m,t n,k,q,ψ,Z . For each k ∈ {0, . . . , t}, we denote by H i the hybrid distribution defined as

(A, (b 1 , . . . , b k , u k+1 , . . . , u t ), ( e j ,z ) j∈[t] ),
where A ← U (R k×m q ), the u j ← U ((q -1 R ∨ /R ∨ ) m ), the e j ← ψ, and b j = q -1 A T s j + e j mod R ∨ for s j ← U ((R ∨ q ) k ) for every j ∈ 1. Sample z uniformly from Z and get (A, b, y = e,z ) as input of ext-M-LWE m n,k,q,ψ,Z . 2. Sample k * uniformly from [t]. This defines where to embed the challenge. 3. Sample s 1 , . . . , s k * -1 uniformly from (R ∨ q ) k , e 1 , . . . , e k * -1 , e k * +1 , . . . , e t from ψ and fi-nally u k * +1 , . . . , u t uniformly from (q -1 R ∨ /R ∨ ) m . 4. Compute b j = q -1 A T s j + e j mod R ∨ for all j ∈ [k * -1], and y j = e j ,z for all j ∈ [t] \ {k * }. 5. Define (b j ) j∈[t] as (b 1 , . . . , b k * -1 , b, u k * +1 , . . . , u t ). Then call the oracle O on input A, (b j ) j∈[t] , (y 1 , . . . , y k * -1 , y, y k * +1 , . . . , y t ) , and return the same output as O.

If b is uniform, then the distribution in 5. is exactly H k * -1 whereas if b is M-LWE, then the distribution is H k * . By a standard hybrid argument, the oracle can distinguish between the two for some k * if it can distinguish between H 0 and H t . So the output is correct over the randomness of k * . Since k * is uniformly chosen we have

Adv[A] = |Pr(A(b M-LWE)) -Pr(A(b uniform))| = k * ∈[t] 1 t Pr(A(H k * )) - k * ∈[t] 1 t Pr(A(H k * -1 )) = 1 t Adv[O]

Reduction to Binary M-LWE

We now provide the final step of the overall reduction, by reducing to the binary secret version of M-LWE using a sequence of hybrids. The idea is to use the set Z of the ext-M-LWE problem as our set of secrets. To facilitate understanding, we start by illustrating the high level idea of the proof of Lemma 2.5 in Figure 2.4 (where the Latex/tikz credits go to my co-author Corentin Jeudy). Given an instance of bin-M-LWE by (A, A • z + e), our goal is to show that it is computationally indistinguishable from (A, b), where b is a uniform random vector. To do so, we first decompose the error vector e into -N • z + e, by using properties of Gaussian distributions. We then make use of a similar lossy argument as for the simple reduction of Section 2.2 by replacing the random matrix A by the lossy matrix A = B • C + N. As opposed to the proof from Section 2.2, we can't simply argue with the hardness of multiple-secrets M-LWE as the second part of the sample depends on the noise matrix N. This is the motivation of the introduction of the extended variant of M-LWE, where we allow for additional information with respect to the noise. We then use the same Leftover Hash Lemma as before to replace the product C • z by a uniform random vector s. Assuming the hardness of M-LWE, the product B • s + e is computationally indistinguishable from a uniform vector b. We conclude the proof by re-replacing the lossy matrix A by the original uniform matrix A.

Lemma 2.5 (ext-M-LWE to bin-M-LWE, adapted from [BLP + 13, Lem. 4.9]) Let K = Q(ζ) be a number field of degree n with R = Z[ζ] its ring of integers. Let q be a prime modulus and let k, m, d be positive integers such that d ≥ k log 2 q + ω(log 2 n). Further, let ε ∈ (0, 1/2) and α, γ, β, δ be positive reals such that α ≥ q -1 √ 2 ln(2nd(1

+ 1/ε))/π, γ = αB √ d, β = αB √ 2d, where B = max x∈R2 σ(x) ∞ , and δ = 1 2 (1 + q k /2 d ) n -1. Then there is a reduction from ext-M-LWE d,m n,k,q,ψ,(R ∨ 2 ) d , M-LWE m n,k,q,Dγ and ext-M-LWE d,m n,k,q,ψ,{0} d with ψ = D q -1 (R ∨ ) m ,α to bin-M-LWE m n,d,q,Ψ ≤β
, such that if B 1 , B 2 and B 3 are the algorithms obtained by applying these hybrids to an algorithm A, then

Adv[A] ≤ Adv[B 1 ] + Adv[B 2 ] + Adv[B 3 ] + 2mε + δ. The problem ext-M-LWE d,m
n,k,q,ψ,{0} d with ψ = D q -1 (R ∨ ) m ,α mentioned in the lemma statement is trivially harder than ext-M-LWE d,m n,k,q,ψ,(R ∨ 2 ) d , that is also why it is not specified in Figure 2.3. Proof: For x ∈ R ∨ , we denote x = λx ∈ R as before, where λ induces a mapping from R ∨ to R as described in Section 1.1.5. We extend this notation to vectors and matrices in the obvious way. Given a bin-M-LWE m n,d,q,Ψ ≤β

sample (A, b = q -1 A T z + e mod R ∨ ), with A ← U ((R q ) d×m ), z ← U ((R ∨ 2 ) d
) and e ∈ K m R sampled from the continuous Gaussian D m r with parameter vector r with r 2 j = γ 2 +α 2 i σ j ( z i )

2 . Yet, we have

r ∞ = γ 2 + α 2 z 2 2,∞ , as well as z 2 2,∞ ≤ i∈[d] σ( z i ) 2 ∞ .
Recalling for the parameter B = max x∈R2 σ(x) ∞ , that can be bounded above by n for cyclotomics by Lemma 1.1 (for η = 2), we get r ∞ ≤ γ 2 + B 2 dα 2 = B √ 2dα = β. Our goal is to show that (A, b) is computationally indistinguishable from uniform. To do so, we define different hybrid distributions:

• H 0 : (A, b) as in bin-M-LWE m n,d,q,Ψ ≤β , • H 1 : (A, q -1 A T z -λN T z + e mod R ∨ ), where N ← D d×m q -1 R ∨ ,α and e ← D m γ , • H 2 : ( A, q -1 A T z -λN T z + e mod R ∨ ) = ( A, q -1 (λB) T Cz + e mod R ∨ ) where B is uniformly sampled over (R ∨ q ) k×m , C uniformly sampled over R k×d q and A = λq(q -1 C T B + N mod R ∨ ),
• H 3 : ( A, q -1 B T s + e mod R ∨ ), with A, e and B as above and where B = λB ∈ R k×m q , and s is uniform over (R ∨ q ) k ,

• H 4 : ( A, u), with A as above and u ← U (T m R ∨ ),

• H 5 : (A, b) ← U ((R q ) d×m × T m R ∨ ).
From H 0 to H 1 . By looking at each component of the vectors we claim that ∆([-N T z + e] i , e i ) ≤ 2ε. Indeed, (1/α 2 + z 2 2,∞ /γ 2 ) -1/2 ≥ α/ √ 2 and α/ √ 2 ≥ η ε (q -1 (R ∨ ) d ) as explained for Lemma 2.3. If n i ∈ q -1 (R ∨ ) d denotes the i-th column of N, Lemma 1.16 yields the claim as [-N T z + e] i = n i ,-z + e i , thus giving ∆(-N T z + e, e) ≤ 2mε. We can thus deduce

|Pr(A(H 0 )) -Pr(A(H 1 ))| ≤ 2mε.
(2.1)

From H 1 to H 2 . We argue that a distinguisher between H 1 and H 2 can be used to derive an adversary B 1 for ext-M-LWE d,m n,k,q,ψ,(R ∨ 2 ) d , where ψ = D q -1 (R ∨ ) m ,α , with the same advantage. To do so, B 1 transforms the samples from the challenger of the ext-M-LWE problem to samples defined in H 1 or the ones in H 2 depending on whether or not the received samples are uniform. In the uniform case, (C, (λq) -1 A, N T z) can be efficiently transformed into a sample from H 1 . Note that (λq) -1 A indeed corresponds to the uniform case of ext-M-LWE, because A is uniform over R q and (λq) -1 R q can be seen as q -1 R ∨ /R ∨ . In the other case, if we apply the same transformation to the ext-M-LWE sample (C, q -1 C T B + N mod R ∨ , N T z), it leads to a sample from H 2 . Hence, B 1 is a distinguisher for ext-M-LWE d,m n,k,q,ψ,(R ∨ 2 ) d , and

|Pr(A(H 1 )) -Pr(A(H 2 ))| = Adv[B 1 ].
(2.2)

From H 2 to H 3 . By the Ring Leftover Hash Lemma stated in Lemma 1.23 (for η = 2), we have that (C, C z) is within statistical distance at most δ from (C, s). Note that for cyclotomic fields, it yields R = Z[ζ] and thus the index [R : Z[ζ]] = 1 is always coprime to q. By multiplying by λ -1 and using the fact that a function does not increase the statistical distance, we have that ∆((C, Cz), (C, s)) ≤ δ. Note that the condition d ≥ k log 2 q + ω(log 2 n) implies δ ≤ n -ω(1) . This yields |Pr(A(H 2 )) -Pr(A(H 3 ))| ≤ δ.

(2.3)

From H 3 to H 4 . A distinguisher between H 3 and H 4 can be used to derive an adversary B 2 for M-LWE m n,k,q,Dγ . For that, B 2 applies the the efficient transformation to the samples from the M-LWE challenger, which turns ( B, u) into a sample from H 4 in the uniform case, and ( B, q -1 B T s + e mod R ∨ ) into a sample from H 3 in the M-LWE case. Therefore, B 2 is a distinguisher for M-LWE m n,k,m,q,Dγ such that

|Pr(A(H 3 )) -Pr(A(H 4 ))| = Adv[B 2 ].
(2.4)

From H 4 to H 5 . In the last hybrid, we change A back to uniform. With the same argument as for the second hybrid, we can construct an adversary B 3 for ext-M-LWE d,m n,k,q,ψ,{0} d with ψ = D q -1 (R ∨ ) m ,α (which corresponds to multiple-secret M-LWE without additional information on the error) based on a distinguisher between H 4 and H 5 . It transforms (C, (λq) -1 A, N T 0) into a sample from H 4 (M-LWE case) and (C, (λq) -1 A, N T 0) into a sample from H 5 (uniform case). We then get |Pr(A(H 4 )) -Pr(A(H 5 ))| = Adv[B 3 ].

(2.5) Putting Equations 2.1, 2.2, 2.3, 2.4 and 2.5 altogether yields the result.

Generalization to Larger Secrets

An interesting question to ask is if the results of this chapter generalize to other secret distributions, in particular distributions where the secret's coefficients are not necessarily chosen uniformly at random over {0, 1} but over a slightly larger set {0, . . . , η -1} for some positive integer η q. We denote the corresponding problem by η-M-LWE. Surprisingly, both reductions that we have seen in this chapter can be easily adapted to this case, as we explain in the following.

Generalization for Warm-up Reduction

For the warm-up reduction from Section 2.2, recall that the distribution of the binary secret s intervenes twice in the proof of Theorem 2.1. First, when we apply the LHL over rings to replace the term Cs by some uniform secret s and second, when we use the noise flooding technique to replace the term Zs + e with a fresh error vector e .

Fortunately, the LHL (Lemma 1.23) is already general enough to apply in the case where the secret s is sampled uniformly at random over R η = R/ηR. To ease readability, we keep the following discussion over the ring R, assuming that we already applied the scalar λ to go from R ∨ to R. As we are considering the search variants of M-LWE and η-M-LWE, we can apply the LHL with respect to the Rényi divergence. In this case, the Rényi divergence between (C, Cs) and (C, s ), where C ← U ((R q ) k×d ), s ← U ((R η ) d ) and s ← U ((R q ) k ), is bounded above by (1 + q k /η d ) n . Thus, in order to obtain a constant Rényi divergence between the hybrid distributions H 3 and H 4 in the proof of Theorem 2.1, we have to require

d ≥ k • log 2 q log 2 η + O log 2 n log 2 η .
Concerning the noise flooding technique, used to bound the Rényi divergence between the hybrid distributions H 2 and H 3 in the proof of Theorem 2.1, it suffices to apply Lemma 1.14, which is already proven for general secret distributions. It implies a resulting error of β ≥ αn 2 • d(η -1) √ m. This leads to the following generalization of Theorem 2.1.

Theorem 2.3 (Hardness of M-LWE With Small Secret)

Let K be a cyclotomic number field of degree n with R its ring of integers. Let k, d, m, q, η ∈ N such that q is prime and m polynomial in n. Further, let α and β be positive real numbers such that β ≥ (η -1)

√ m • n 2 d • α. Let ε ∈ R ∩ [0, 1/2) such that βq ≥ η ε (R ∨ ) and ε = O( 1 m ). Then, for any d ≥ k • (log 2 q/ log 2 η) + Ω(log 2 n/ log 2 η), there is a probabilistic polynomial-time reduction from M-SLWE m n,k,q,D R ∨ ,βq and M-LWE m,d n,k,q,D R ∨ ,αq to η-M-SLWE m n,d,q,D R ∨ ,βq .
To summarize, we can see a direct link between the required rank, secret distribution and error growth with respect to the parameter η. If η gets close to 2, the error growth (determined by β) gets smaller, but the requirement on rank d must be slightly larger. On the other hand, when η grows, the error ratio grows with it, but allows for a slightly smaller rank d. Note that since d also appears in the noise growth, the increase factor of considering η instead of 2 is roughly (η -1)/ log 2 η.

Generalization for Improved Reduction

For the improved reduction from Section 2.3, we recall that the binary secret z intervenes twice in the proof of Lemma 2.5. As before, it appears when we apply the LHL over rings to replace the term Cz by some uniform secret s. Additionally, the binary secret determines the hints that we give as an additional information in the extended version of M-LWE.

As explained above, the LHL (Lemma 1.23) is already general enough to apply for more general secrets z, which are sampled uniformly at random over R η = R/ηR. In contrast to the discussion above, we are now considering the decision variants of M-LWE and η-M-LWE, and thus we have to apply the LHL with respect to the statistical distance. More concretely, the statistical distance between (C, Cz) and (C, s), where C ← U ((R q ) k×d ), z ← U ((R η ) d ) and s ← U ((R q ) k ), is bounded above by 1 2 (1 + q k /η d ) n -1. Thus, in order to obtain a negligibly small statistical distance between the hybrid distributions H 2 and H 3 in the proof of Lemma 2.5, we require

d ≥ k • log 2 q log 2 η + ω log 2 n log 2 η .
Concerning the impact of z on the extended variant of M-LWE, we need to consider ext-M-LWE with a set of hints given by Z

= (R ∨ η ) m (instead of Z = (R ∨ 2 ) m ).
Fortunately, Lemma 2.2 and Lemma 2.3 are already proven for this set of hints. The impact of allowing for a larger hint is reflected in the bound B from Lemma 1.1, which is given by (η-1)n for cyclotomic fields, and in the invertibility condition from Lemma 1.2, which now requires a q larger by some factor (η -1) ϕ(µ) . Overall, we obtain a resulting error of β ≥ α • n(η -1) √ 2d 4n 2 (η -1) 2 + 1. This leads to the following generalization of Theorem 2.2. Theorem 2.4 (Improved Hardness of M-LWE With Small Secret) Let ν ∈ N with prime-power factorization ν = j p ej j . Further, let K be the ν-th cyclotomic field of degree n = ϕ(ν), and R its ring of integers. Set µ = j p j , let η ∈ N and let q be a prime number such that q = 1 mod µ, ord ν (q) = ν/µ and q > max(2n, ((η -1)s 1 (µ)) ϕ(µ) ), where s 1 (µ) denotes the largest singular value of the Vandermonde matrix of the µ-th cyclotomic field. Further, let k, d, m N such that d ≥ (k+1)(log 2 q/ log 2 η)+ω(log 2 n/ log 2 η), and d ≤ m ≤ poly(n). Let α ≥ q -1 √ ln(2nd(1 + 1/ε))/π and β ≥ α • n(η -1) √ 2d 4n 2 (η -1) 2 + 1. Then there is a reduction from M-LWE m n,k,q,Dα to η-M-LWE m n,d,q,Ψ ≤β , such that if A solves the latter with advantage Adv[A], then there exists an algorithm B that solves the former with advantage

Adv[B] ≥ 1 3m   Adv[A] - 1 2 1 + q k+1 2 d n -1   - 37ε 2 .
As before, we can see a direct link between the required rank, secret distribution and error growth with respect to the parameter η. For increasing η, we can allow for a slightly smaller rank d, but obtain a larger noise ratio. Note that since d also appears in the noise growth, the increase factor of considering η instead of 2 is roughly (η -1) 2 / log 2 η.

Choice of Embedding for Binary Secrets

As mentioned in the introduction, the variant of M-LWE using a binary secret requires the choice of an embedding in which the secret is binary. As praised in [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF][START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF], the canonical embedding has nice algebraic and geometric properties that make it a good choice of embedding. However, in this section, we justify our choice of the coefficient embedding, by analyzing the set of secrets that are binary in the canonical embedding in the case of power-of-2 cyclotomics.

The conjugation symmetry of the canonical embedding first restricts the choice of secrets to (σ -1 ({0, 1} n ∩ H )) d , where n denotes the ring degree, d the module rank and H the range of σ, see Section 1.1.1. In addition, the tightest worst-case to average-case reductions for M-LWE require s to be taken from the dual (R ∨ q ) d . However, σ -1 maps H to K R but not necessarily to R or to R ∨ . We thus have to further restrict the set of secrets to

Z = (R ∨ q ∩ σ -1 ({0, λ -1 } n ∩ H )) d ,
where λ is such that R ∨ = λ -1 R, see Section 1.1.5. In the case of power-of-2 cyclotomics, it yields λ = n and therefore λZ = (R q ∩ σ -1 ({0, 1} n ∩ H )) d .

Lagrange Basis

As opposed to R 2 which corresponds to binary vectors in the coefficient embedding, the power basis is not adapted to describe the set λZ. We thus introduce the Lagrange basis. Let n = t 1 +2t 2 . For j ∈ [n], we denote by α j = σ j (ζ) the j-th root of the defining polynomial f . Recall that we assume that α j is real for j ∈ [t 1 ], and that we have

α t1+j = α t1+t2+j ∈ C for j ∈ [t 2 ].
Applying σ j to an element r = n-1 k=0 r k ζ k ∈ K R comes down to evaluating the polynomial p r = n-1 k=0 r k x k at α j . We use this polynomial interpretation to define elements of K R that form a basis of σ -1 ({0, 1} n ∩H ). Lagrange interpolation defines polynomials that map a set of distinct elements to 0 and 1. Since the α j are distinct as f is irreducible, we can apply a similar method and define

L k = j∈[n]\{k} x -α j α k -α j , for k ∈ [t 1 ]
, which is real due to the conjugation symmetry of the roots. For k ∈ {t 1 +1, . . . , t 1 +t 2 }, we define

L k = j∈[n]\{k} x -α j α k -α j + j∈[n]\{k+t2} x -α j α k+t2 -α j = 2R   j∈[n]\{k} x -α j α k -α j   ,
where R(z) denotes the real component of a complex number z.

Hence the polynomials lie in R[x] and we have

L k (α j ) = δ k,j for (k, j) ∈ [t 1 ] × [n], and L k (α j ) = δ k,j + δ k+t2,j for (k, j) ∈ {t 1 + 1, . . . , t 1 + t 2 } × [n]
. Therefore, by defining the Lagrange basis l with the corresponding

l k ∼ = L k (ζ) ∈ K R , we have linear independence and σ -1 ({0, 1} n ∩ H ) = k∈[t1+t2] {0, 1} • l k , because σ(l k ) = e k if k ∈ [t 1 ] and σ(l k ) = e k + e k+t2 if k ∈ {t 1 + 1, . . . , t 1 + t 2 }.
As far as we are aware, this is the first time that the Lagrange basis is used in the setting of structured lattice-based cryptography. We now need to determine which of these combinations lie in R q in order to properly define the set of secrets.

Lagrange Basis for Power-of-2 Cyclotomics

We now look at the Lagrange basis in the specific case where n is a power of 2.

Lemma 2.6 (Set of Binary Secrets for Power-of-2 Cyclotomics) Let R be the cyclotomic ring of integers of degree n = 2 for ∈ N. Then, for any q ∈ N, the set R q ∩ σ -1 ({0, 1} n ∩ H ) contains only 0 and 1.

Proof: Recall that in cyclotomic fields, we have t 1 = 0 and t 2 = n/2, see Section 1.1.2. We know that for power-of-2 cyclotomics the defining polynomial is given by x n + 1 and therefore we can re-index the roots as α j = exp(i(2j + 1)π/n), j now ranging from 0 to n -1. We can therefore study the complex product. We look at the constant coefficient of L k , i.e., A k = L k (0) = 2R 0≤j<n,j =k -αj α k -αj . To ease notation, we write j = k instead of j ∈ {0, . . . , n-1}\{k} for the product indexes. We first look at the product for a fixed k ∈ {0, . . . , n/2 -1}.

j =k (α k -α j ) = α n-1 k j =k (1 -α j /α k ) = -α -1 k j =k (1 -e i2π(j-k)/n ) = -α -1 k n-1 l=1
(1e i2πl/n ), using the fact that α n k + 1 = 0 and the circularity of the complex exponential. Yet, we also have n-1 l=0 (xe i2πl/n ) = x n -1 = (x -1) n-1 l=0 x l . By simplifying both sides by x -1 and then evaluating at 1, we have n-1 l=1 (1e i2πl/n ) = n-1 l=0 1 l = n. The product of the numerators in the definition of A k is (-1) n-1 α k because we can pair all of the roots α j with their conjugates, which gives α j α j = α j 2 = 1, except for α k . Hence, A k = 2R(-α k /(-n/α k )) because n is even, which yields A k = 2 n . Now we take a subset S ⊆ {0, . . . , n/2 -1} and we study k∈S L k . Note that the case of S = {0, . . . , n/2 -1} corresponds to adding all the Lagrange basis elements which results in 1, and the case S = ∅ results in 0 by convention. So we now assume that 0 < |S| < n/2. The constant coefficient of k∈S L k is 2 |S| /n ∈ (0, 1) and is therefore not an integer. Hence, k∈S L k / ∈ Z[x] which means that the element k∈S l k is not in R nor R q for any q ≥ 1. It proves that the only binary combination of the Lagrange basis that are in R are 0 and 1, and the same conclusion is valid for R q for any q ≥ 1.

Hence to preserve the complexity of a brute force attack when comparing the two embeddings, the module rank would have to be increased by a factor n in the case where we take the canonical embedding to represent binary secrets. In this case, the (dual of the) secrets are from {0, 1} d and therefore discard most of the available ring structure as opposed to R d 2 . We remark that this issue hasn't been addressed by [START_REF] Lin | Hardness of module-lwe and ring-lwe on general entropic distributions[END_REF]. It seems that for too narrow bounds on the entropic secret distribution, the number of available secrets is much smaller in the canonical embedding compared to the number with regard to the coefficient embedding.

Chapter 3

Classical Hardness of Module LWE

This chapter can be seen as a continuation of Chapter 2 and is therefore based on the same joint work with Corentin Jeudy, Adeline Roux-Langlois and Weiqiang Wen which is published in the proceedings of the conference Asiacrypt 2020 [START_REF] Boudgoust | Towards classical hardness of module-lwe: The linear rank case[END_REF]. A presentation of 20 minutes has been recorded for the conference, illustrating the contributions and high level techniques of the paper.1

Introduction

In the following, we continue to study the module variant of LWE, denoted by M-LWE. The major advantage of LWE over other cryptographic hardness assumptions is its worst-case to average-case connection to well-studied problems over Euclidean lattices, for suitable parameter choices. In the seminal work of Regev [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF][START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF], it is shown that any efficient solver for the average-case problem LWE can be transformed into an efficient solver for any instance of some worst-case lattice problem, such as finding a set of short independent vectors (SIVP) or the decision variant of finding short vectors (GapSVP). A standard relaxation of those two problems consists in solving them only up to an approximation factor γ, denoted by SIVP γ and GapSVP γ , respectively. One drawback of Regev's reduction is that it is quantum, and thus an efficient solver for LWE only leads to an efficient quantum solver for SIVP γ or GapSVP γ , which needs to operate on a quantum computer. A classical hardness proof for LWE starting from GapSVP γ is shown by Peikert [START_REF] Peikert | Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[END_REF], at the expense of requiring an exponentially large modulus q for the resulting LWE instance. However, such a modulus makes LWE rather impractical. Later, Brakerski et al. [BLP + 13] use Peikert's result and a modulus reduction for LWE to show a classical hardness proof for LWE while now allowing for a polynomially large modulus. When Langlois and Stehlé [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] originally introduce and study the module variant of LWE, they prove an analogue of Regev's reduction for M-LWE. In other words, they show for suitable parameters a worst-case to average-case quantum reduction from the SIVP γ problem over module lattices to M-LWE. As for [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF], this reduction is quantum. In their introduction, Langlois and Stehlé [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] claim that Peikert's dequantization [START_REF] Peikert | Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[END_REF] carries over to the module case, making it plausible that a classical hardness proof should also be feasible for M-LWE. However, a formal proof for the classical hardness of M-LWE was left as an open problem.

Our Contributions

In this chapter, we make progress towards proving the classical hardness of M-LWE. Our main contribution is a classical reduction from the module variant of GapSVP γ , which we denote by Mod-GapSVP γ , with module rank at least 2 to M-LWE for any polynomial-sized modulus p and module rank d at least 3n + ω(log 2 n), where n is the degree of the underlying number field.

At a high level, we follow the structure of the classical hardness proof of LWE from Brakerski et al. [BLP + 13]. To do so, we need three ingredients: First, a classical reduction for M-LWE with an exponential-sized modulus. As a second component, we need the hardness of M-LWE using a binary secret, and finally, a modulus reduction technique.

Classical Reduction: Regarding the first ingredient, we prove in Section 3.2 with Theorem 3.2 that Peikert's dequantization [START_REF] Peikert | Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[END_REF] carries over to the module case. The proof idea is the same as the one from Peikert, but with two novelties. First, we look at the structured variants of the corresponding problems, Mod-GapSVP γ and M-LWE, where the underlying ring R is the ring of integers of a number field K. Recall that the problem Mod-GapSVP γ becomes easy in the special case of modules of rank 1 (i.e., ideals) as the minimum of ideal lattices can be bounded above and below, see Lemma 1.4. This is why we restrict our results to modules of rank at least 2. Second, we replace the main component, a reduction from the Bounded Distance Decoding (BDD) problem to the search version of LWE, by the reduction from the Gaussian Decoding Problem (GDP) over modules to the decision version of M-LWE (Lemma 3.3, adapted from [START_REF] Peikert | Pseudorandomness of ring-lwe for any ring and modulus[END_REF]). As a side contribution, we thus generalize the hardness of the decision variant of M-LWE to all number fields K, not only cyclotomic fields as in [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]. This is interesting, as we mainly use decision problems (and not their search variants) as the underlying hardness assumptions for cryptographic constructions.

Binary Secret: For the second ingredient, we can use our results from the previous chapter on the hardness of bin-M-LWE. More precisely, we make use of the improved reduction proven in Theorem 2.2. Recall that Corollary 2.1 is the instantiation of this theorem for power-of-2 cyclotomics. Note that in the original paper published at Asiacrypt 2020 [START_REF] Boudgoust | Towards classical hardness of module-lwe: The linear rank case[END_REF], the improved reduction didn't yet exist and we thus used the simple reduction of Theorem 2.1. However, this makes the overall classical hardness proof more involved, as we have to handle different transitions from the search to the decision variants and from discrete to continuous Gaussian error distributions. Hence, the reduction as shown in this thesis is not only better in parameters, but also requires less intermediate steps, as compared to the original paper [START_REF] Boudgoust | Towards classical hardness of module-lwe: The linear rank case[END_REF].

Modulus Reduction: Finally, we provide a modulus reduction technique, the last required ingredient, where the rank of the underlying module is preserved. This corresponds to the modulus reduction for LWE shown by Brakerski et al. [BLP + 13, Cor. 3.2]. Prior to this paper, Albrecht and Deo [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF] adapted the more general result from [BLP + 13, Thm. 3.1], from which the necessary Corollary 3.2 is deduced. Thus, in Section 3.4, we first recall their general result [AD17a, Thm. 1] and then derive Corollary 3.2, that we need for our purposes, from it. The quality of the latter depends on the underlying ring structure and how the binary secret distribution behaves. For the case of power-of-2 cyclotomics, we provide a concrete instantiation in Corollary 3.3. This involves the computation of upper bounds of the singular values of the rotation matrix. Note that Langlois and Stehlé [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] prove a modulus switching result for M-LWE from modulus q to modulus p, but the error increases at least by a multiplicative factor q p , which is exponential if q is exponentially and p only polynomially large. Further, the reason why we need to go through the binary variant of M-LWE is because we want to keep the noise amplification during the modulus switching part as small as possible.

We now explain how to complete the proof of the classical hardness of decision M-LWE for any polynomial-sized modulus p and module rank d at least 3n + ω(log 2 n), as stated in Theorem 3.1. We further instantiate it for power-of-2 cyclotomics in Corollary 3.1. We refer to Figure 3.1 for an overview of the full proof.

In a first step, we classically reduce Mod-GapSVP γ to M-LWE in Theorem 3.2, requiring the resulting modulus q to be exponentially large in the ring degree n, i.e., q ≥ 2 n (as k ≥ 2). Further, the error distribution of M-LWE is given by Υ α for some parameter α. This is a distribution over a particular set of elliptical Gaussian distributions in the canonical embedding, which we formally defined in Section 1.3.2. Then, we show in Lemma 3.4 how to move from Υ α to the set of spherical Gaussians Ψ ≤α , where α = α • ω(log 2 n). In a next step, we use the binary secret result Theorem 2.2 of Chapter 2 to reduce M-LWE to bin-M-LWE, where the resulting rank d has to be at least 3 • log 2 (q) + ω(log 2 n). As q is exponentially large in n, this leads to a rank d that is linear in n. Note that the prime number q has to fulfill some number-theoretic constraints which simplify to q = 5 mod 8 in the case of power-of-2 cyclotomics (Corollary 2.1). Then, using Corollary 3.2, we show a reduction from bin-M-LWE with modulus q and Gaussian parameter bound β to bin-M-LWE with modulus p and Gaussian parameter bound β , where q ≥ p ≥ 1 and (β ) 2 ≥ ( √ 2β) 2 + ∆. The parameter ∆ is determined by the underlying ring R and is poly(n) for the case of power-of-2 cyclotomics, as shown in Corollary 3.3. To conclude the classical hardness result of decision M-LWE with polynomial-sized modulus p, we trivially reduce bin-M-LWE to M-LWE by re-randomizing the secret.

The main contribution of this chapter is summarized in the following theorem. Theorem 3.1 (Classical Hardness of M-LWE for Cyclotomic Fields) Let ν ∈ N with prime-power factorization ν = j p ej j . Further, let K be the ν-th cyclotomic field of degree n = ϕ(ν), and R its ring of integers. Set µ = j p j and let q be a prime number such that q = 1 mod µ, ord ν (q) = ν/µ and q > max(2n, s 1 (µ) ϕ(µ) ), where s 1 (µ) denotes the largest singular value of the Vandermonde matrix of the µ-th cyclotomic field. Let d, p ∈ N and β , γ ∈ R + . There is a classical PPT reduction from Mod-GapSVP γ to M-LWE n,d,p,Ψ ≤β , where d ≥ 3n + ω(log 2 n), p = poly(n) and

β = Θ n 5 2 γ .
In the special case of power-of-2 cyclotomic fields, the theorem implies the following corollary.

Mod-GapSVP γ

Cyclotomic Fields Theorem 3.1

Power-of-2 Cyclotomics Corollary 3.1

M-LWE n,k,q,Υα M-LWE n,k,q,Ψ ≤α bin-M-LWE n,d,q,Ψ ≤β bin-M-LWE n,d,p,Ψ ≤β M-LWE n,d,p,Ψ ≤β Theorem 3.2 k ≥ 2, q ≥ 2 nk 2 , γα ≥ nk √ k Lemma 3.4 α = α • ω(log 2 n) Theorem 2.2 β ≥ α n √ 2d √ 4n 2 + 1 d ≥ 3n + ω(log 2 n) q number-theoretic constraints Corolarry 3.2 (β ) 2 ≥ 2β 2 + ∆ M-LWE n,k,q,Ψ ≤α bin-M-LWE n,d,q,Ψ ≤β bin-M-LWE n,d,p,Ψ ≤β M-LWE n,d,p,Ψ ≤β Corollary 2.1 β ≥ α n √ 2d √ 4n 2 + 1 d ≥ 3n + ω(log 2 n) q = 5 mod 8 Corollary 3.3 (β ) 2 ≥ 2β 2 + poly(n)
Needed Ingredient 1) Classical Reduction Section 3.2

2) Binary Hardness Section 2.3

3) Modulus Reduction Section 3.4 Let ν ∈ N be a power of two, K be the ν-th cyclotomic field of degree n = ν/2, and R its ring of integers. Let q ∈ N be prime such that q = 5 mod 8. Further, let d, p ∈ N and β , γ ∈ R + . There is a classical PPT reduction from Mod-GapSVP γ to M-LWE n,d,p,Ψ ≤β , where d ≥ 3n + ω(log 2 n) and

β = Θ n 5 2 γ .
Using the advanced binary hardness proof from Section 2.3 instead of the simple reduction from Section 2.2 improves the β from our original result [BJRW20, Thm. 2] by a factor of √ m•n 11 4 , where m denotes the number of given samples. On the other hand, it increases the rank condition by an additive term of n.

Related Work Classical Hardness of Ring LWE

As our overall classical reduction with polynomially large modulus is restricted to modules of rank linear in the ring degree, it doesn't apply to R-LWE, which is the special case of M-LWE where the rank d equals 1. Furthermore, the classical reduction with exponentially large modulus of Section 3.2 is meaningless for rank 1 modules, as Mod-GapSVP γ is easy to solve in this case. However, as we discuss in the following, there are two different ways to obtain the classical hardness of R-LWE with an exponentially sized modulus.

The first is informally mentioned in [BLP + 13] and can be achieved in two steps. First, by a dimension-modulus switching as in [BLP + 13], we can reduce LWE in dimension d and with modulus q to LWE in dimension 1 and with modulus q d with a slightly increased error rate. Then, by a ring switching technique as in [START_REF] Gentry | Ring switching in bgv-style homomorphic encryption[END_REF], n samples of the latter one can be reduced to one sample of R-LWE over a ring of degree n and modulus q d , while keeping the same error rate. For more details on the second step, we refer to [AD17a, App. B].

On the other hand, as a direct application of our classical hardness result of M-LWE, we can provide an alternative classical hardness result for R-LWE with exponential-sized modulus. The idea is that, using a rank-modulus switching as in [AD17a, WW19], we can instead reduce from M-LWE over d-rank modules of n-degree ring and modulus q, to R-LWE with n-degree ring and modulus q d (and rank equals 1), with a slightly increased error rate. However, we remark that the underlying worst-case lattice problems are different for these two results. Suppose that we consider the classical hardness of R-LWE over n-degree ring and q d modulus where d = O(n). Then, the underlying problem is the standard GapSVP over all Euclidean lattices of dimension O( √ n) for the first result, while it is Mod-GapSVP over rank-2 module lattices of some O(n)-degree ring for the second one.

Algebraically Structured LWE

A recent result from Peikert and Pepin [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF] tightly proves the hardness of M-LWE over a number field K of degree n and with rank d assuming the hardness of R-LWE over any one of a class of number field extensions K /K with extension degree d = [K : K]. Instead of showing a modulus-rank trade-off as in [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF], they provide a degree-rank trade-off, where the underlying ring structure is changed, while preserving the modulus q. As pointed out by the authors themselves, this result is from a different nature than the original hardness result of M-LWE, Mod-GapSVP γ

Cyclotomic Fields

Theorem 3.1

Power-of-2 Cyclotomics Corollary M-LWE n,k,q,Υα Theorem 3.2 k ≥ 2, q ≥ 2 nk 2 , γα ≥ nk √ k
Needed Ingredient 1) Classical Reduction Section 3.2

Figure 3.2: The first ingredient required for the complete classical hardness proof of decision M-LWE, as stated in Theorem 3.1 for K the ν-th cyclotomic number field of degree n.

given by Langlois and Stehlé [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]. The latter one established a reduction from worst-case problems over module lattices, whereas the reduction in [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF] starts from an average-case problem over rings. The main intention of their paper is to unify the landscape of different algebraically structured variants of LWE.

Roadmap

The rest of the chapter is structured as follows. In Section 3.2, we prove a classical reduction for M-LWE with an exponentially large modulus. To this end, we first prove a reduction from the Gaussian Decoding Problem to M-LWE, which is afterwards used as a main building block for the classical proof. In Section 3.3, we explain how to use the binary hardness result from the previous chapter and how to adapt the error distribution. Finally, in Section 3.4 we provide a modulus-reduction first for the case of general number fields with general secret distributions and then for the special case of power-of-2 cyclotomics with secrets of small norm.

Classical Reduction for Exponentially Large Moduli

The goal of this section is to provide Theorem 3.2, which is the first ingredient needed to prove the classical hardness of M-LWE, as illustrated in Figure 3.2. To do so, we adapt the classical hardness reduction of LWE for exponentially large moduli from Peikert [Pei09, Thm. 3.1] to the module setting. In their introduction, Langlois and Stehlé [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] claim that Peikert's dequantization [START_REF] Peikert | Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[END_REF] carries over to the module case and we prove this claim in the following. By using the more recent results of Peikert et al. [START_REF] Peikert | Pseudorandomness of ring-lwe for any ring and modulus[END_REF], our reduction directly reduces Mod-GapSVP to the decision variant M-LWE and holds for any number field K.

Step 1: From Gaussian Decoding Problem to M-LWE

As a first step, we prove a reduction from the Gaussian Decoding Problem (GDP) over module lattices (Definition 1.6) to M-LWE, which we then use later in Step 2 for the classical hardness proof. Informally speaking, GDP is a computational problem over lattices that, given a point y in the Euclidean space with the promise that it is close to a given lattice, asks to recover the closest lattice point x, or equivalently their difference e = yx. The particularity of GDP is that the difference e follows a Gaussian distribution. To obtain the required result, we prove the following Lemma 3.3, which is an adaptation of [PRS17a, Lem. 6.6] from ideals to modules.

To do so, we essentially need to adapt two components from the original proof. The first is a transformation from an instance of the Bounded Distance Decoding (BDD) problem over some ideal lattice to samples of R-LWE. Fortunately, there is already in [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF] an adaptation of it to the module setting which transforms an instance of BDD over some module lattice (Definition 1.4) to a sample of M-LWE using some Gaussians over the module lattice. Recall, that BDD is closely related to GDP, with the only difference that the vector e doesn't have to follow a Gaussian distribution, but only needs to be of bounded norm. The second component which is important in the proof of [PRS17a, Lem. 6.6] is the Oracle Hidden Center Problem (OHCP, Definition 3.1) together with an efficient solver for it. This tool is independent of the underlying lattice and thus can still be used in the case of module lattices. As our proof is a direct adaptation of the original one, we strongly recommend to read the original paper with a more detailed introduction to the OHCP problem. We now recall the results for both tools.

Throughout this section, let K be a number field of degree n with R its ring of integers. As explained in Section 1.2.2, any R-module M ⊆ K k of rank k ≥ 2 can be identified with a module lattice of dimension N = nk. By M ∨ we denote its dual lattice as defined in Section 1.1.5. Recall from Section 1.1.2 that any vector e ∈ K k is equipped with the (2, ∞)-norm defined by e 2,∞ = max j∈[n] ( ∈[k] |σ j (e )| 2 ) 1/2 . We further refer to Section 1.3.2 for the formal definitions of the different Gaussian distributions that arise in this section (as for instance the continuous Gaussian D r , the discrete Gaussian distribution D M,r and the distribution over elliptical Gaussians Υ α ). Further, recall the definition of the M-LWE distribution A M s,ψ from Section 1.4.3. Let K be a number field of degree n with ring of integers R and k ∈ N. There exists a PPT algorithm that takes as input an integer q ≥ 2 with known factorization, a module M ⊆ K k , a coset e + M ∨ and bound δ ≥ e 2,∞ , a parameter r ≥ √ 2q • η ε (M), and Gaussian samples from D M,r for some r ≥ r. It outputs samples that are within negligible statistical distance of the M-LWE distribution A M s,ψ , for a uniformly random s ∈ (R ∨ q ) k and ψ = D r , where the coefficients of r are given for every j ∈ [n] by

(r j ) 2 = rδ q 2 + r 2 j ∈[k] |σ j (e )| 2 q 2 .
We now formally define the Oracle Hidden Center Problem. Note that we use the wording of the problem as in the updated version from June 2020 of [START_REF] Peikert | Pseudorandomness of ring-lwe for any ring and modulus[END_REF], accessible via the IACR eprint server [START_REF] Peikert | Pseudorandomness of ring-lwe for any ring and modulus[END_REF]. The modifications from this updated version have, however, no impact on our proof of Lemma 3.3. the (ε,δ,β)-OHCP is an approximate search problem defined as follows. Given access to an oracle O : R k × R + → {0, 1}, such that its acceptance probability p(z, t) for any input (z, t) with zz * 2 ≤ βd depends only on exp(t)

Definition 3.1 (Oracle Hidden Center Problem

): Let k ∈ N, d ∈ R + , β ≥ 1 and ε, δ ∈ [0, 1) ∩ R,
• z -z * 2 for some hidden center z * ∈ R k with δd ≤ z * 2 ≤ d, the goal is to output z ∈ R k such that z -z * 2 ≤ ε • d. Lemma 3.2 (Solver for OHCP [PRS17a, Prop. 4.4])
There is a PPT algorithm that takes as input a confidence parameter κ ≥ 20 log 2 (k + 1), the scale parameter d, and solves (exp(-κ), exp(-κ), 1 + 1/κ)-OHCP in dimension k except with probability exp(-κ), provided that exists a p(∞) ∈ [0, 1] such that 1. p(0, t * )p(∞) ≥ 1/κ for some t * ∈ R + ;

2. |p(0, t)p(∞)| ≤ 2 exp(-t/κ) for any t ∈ R + ; and 3. p(z, t) is κ-Lipschitz in t for any z ∈ R k .

Let n = t 1 + 2t 2 the decomposition of the degree n into the number of real and complex embeddings. As in [START_REF] Peikert | Pseudorandomness of ring-lwe for any ring and modulus[END_REF], for any r > 0, ζ > 0, and T ≥ 1, we define the set of non-spherical parameter vectors W r,ζ,T as the set of cardinality (t 1 + t 2 ) • (T + 1), containing for each ∈ [t 1 + t 2 ] and j ∈ {0, . . . , T } the vector r j which is equal to r in all coordinates except in the -th (and the ( + t 2 )-th if > t 1 ), where it is equal to r • (1 + ζ) j . We are now ready to state and prove the reduction from GDP to M-LWE.

Lemma 3.3 (Adapted from [PRS17a, Lem. 6.6])

Let K be a number field of degree n with ring of integers R and k ∈ N. There exists a PPT algorithm that, given an oracle that solves M-LWE q,Υα , for a real α ∈ (0, 1) and an integer q ≥ 2 together with its factorization, a rank k module M ⊆ K k , a parameter r ≥ √ 2q • η ε (M) for ε = exp(-kn), and polynomially many samples from the discrete Gaussian distribution D M,r for each r ∈ W r,ζ,T (for some ζ = 1/poly(n) and T = poly(n)), solves GDP M ∨ ,g , for g = αq/( √ 2kr).

Note that if we sample a coset e + M ∨ as in GDP M ∨ ,g with g = αq/ √ 2kr its (2, ∞)-norm is bounded above by δ

= √ k • g • G(n) = αqG(n)/ √ 2r, for some fixed G(n) = ω( log 2 n).
If we then apply the lemma above with δ and r j = r, the distribution of the resulting error rate r is exactly Υ α .

Overall, it suffices to carefully adapt the definition of the BDD instances to get M-LWE instances. Then we can use the oracle for M-LWE to simulate some oracles O j such that O j has hidden center σ j (e) for every j ∈ [n]. An approximation of σ j (e) can then be used with Babai's algorithm to reconstruct e. Still, the proof maintains to be quite technical.

Proof: Assumption on α: Fix q, α, k, r, g as in the statement of the lemma. By G(n) we denote a function in ω( log 2 n). Recall that any R-module M ⊆ K k of rank k corresponds to a module lattice of dimension N = nk. Assume α ≤ exp(-N ). Using Lemma 1.8 with ε = exp(-N ), it yields with high probability

σ(e) 2 ≤ √ N g ≤ αq √ N √ 2kr ≤ α 2 √ k • √ N η ε (M) ≤ α √ π 2 √ k • λ 1 (M ∨ ) ≤ 2 -N λ 1 (M ∨ ).
Thus, the LLL algorithm (Lemma 1.5) would solve the GDP instance efficiently and without loss of generality we may assume in the following that α > exp(-N ).

The high level idea of the reduction: Define κ = poly(N ) with κ ≥ 100N 2 m, such that the advantage of the oracle for M-LWE q,Υα is at least 2/κ, when it receives m input samples. Let e + M ∨ denote the input to the GDP M ∨ ,g problem, where e = (e 1 , . . . , e k ) with e ← D g for every ∈ [k]. The goal is to recover e.

The reduction uses the M-LWE oracle to simulate t 1 + t 2 different oracles O j , such that the acceptance probability of O j on input (z, t) only depends on exp(t) • zσ j (e) 2 , where σ denotes the canonical embedding. In other words, O j has a hidden center σ j (e), defining an instance of the OHCP as in Definition 3.1. More concretely, we define for the t 1 real embeddings the oracles O j : R k × R + → {0, 1} (for j ∈ [t 1 ]) and for the t 2 complex embeddings the oracles O j : C k × R + → {0, 1} (for t 1 + 1 ≤ j ≤ t 1 + t 2 ). The reduction can thus use the efficient solver of Lemma 3.2 to find a good approximation of σ j (e) for every j ∈ [t 1 + t 2 ]. Note that σ t1+t2+j (e) is the complex conjugate of σ t1+j (e), so it suffices to have t 2 oracles for the complex embeddings.

The oracles: In order to define the oracle O j we define the following functions. For the real embeddings with j ∈ [t 1 ], we set

k j : R k → (K R ) k with k j (z) = σ -1 (z 1 • e j , . . . , z k • e j ) T .
For the complex embeddings with t 1 + 1 ≤ j ≤ t 1 + t 2 , we set k j :

C k → (K R ) k with k j (z) = σ -1 (z 1 • e j + z 1 • e j+t2 , . . . , z k • e j + z k • e j+t2 ) T
. Recall that z denotes the complex conjugate of the complex number z ∈ C and that e j denotes the j-th unit vector. On input (z, t), the oracle O j chooses samples from D M,ri,j , where the index i is defined by t as (1 + ζ) i = exp(t). It then runs the transformation from Lemma 3.1 on these Gaussian samples, the coset ek j (z) + M ∨ , parameter r and distribution bound δ

= αqG(n) √ 2r = √ k • g • G(n).
Note that ek j (z) 2,∞ ≤ e 2,∞ + z 2 ≤ δ + z 2 and that we mostly only care about the behavior of the oracle when z = 0. Let A M j,z,t be the resulting M-LWE samples. The oracle O j then calls the oracle for M-LWE on these samples and finally outputs 1 if the latter one accepts. In a next step, the reduction uses the efficient solver for the OHCP (Lemma 3.2) with confidence parameter κ, distance bound δ and receives some approximation z j to the oracle's hidden center σ j (e). Finally, it runs the LLL algorithm on the coset eσ -1 (z 1 , . . . , z n ) T + M ∨ , receives as output ê and returns ê + σ -1 (z 1 , . . . , z n ) T as solution to the GDP instance.

Proof of the claims: We now prove that this reduction works as claimed. First, we assume that the z j are valid solutions to the (exp(-κ), exp(-κ), 1 + 1/κ)-OHCP with hidden center σ j (e) for every j ∈ [t 1 + t 2 ] and show that the reduction outputs the correct answer. Since z j is a valid solution, by definition and Lemma 1.8 we have

σ j (e) -z j 2 ≤ exp(-κ)δ = exp(-κ) αqG(n) √ 2r ≤ exp(-κ) G(n) η ε (M) ≤ 2 -N λ 1 (M ∨ ) √ N .
Having σ j (e) for all j ∈ [t 1 + t 2 ], we construct the full vector σ(e) and compute σ(e) -(z 1 , . . . ,

z n ) T 2 ≤ ( j∈[n] σ j (e) -z j 2 2 ) 1/2 ≤ 2 -N λ 1 (M ∨ ),
and finally eσ -1 (z 1 , . . . , z n ) T 2 ≤ 2 -N λ 1 (M ∨ ). Thus, the LLL algorithm (Lemma 1.5) succeeds and outputs the correct element ê = eσ -1 (z 1 , . . . , z n ) T and thus ê + σ -1 (z 1 , . . . , z n ) T is a correct solution to the GDP instance.

Second, we show that for every j ∈ [t 1 + t 2 ] the oracle O j represents a valid instance of (exp(-κ), exp(-κ), 1 + 1/κ)-OHCP with hidden center σ j (e). Lemma 3.1 with r j = r exp(t) implies that the distribution of A M j,z,t only depends on exp(t) • zσ(e) 2 . As κ = poly(N ) and every coefficient e of e is sampled from D g , it yields for δ = √ k • g • G(n) that exp(-κ)δ ≤ σ j (e) 2 ≤ δ, for every j ∈ [t 1 + t 2 ] except with negligible probability. Thus, O j , κ and δ correspond indeed to a valid instance of OHCP.

Efficient solver for OHCP: To conclude the proof, we show that for every j ∈ [t 1 + t 2 ] the oracle O j satisfies the requirements to apply Lemma 3.2, which provides an efficient solver for OHCP. Let p j (z, t) denote the probability that O j outputs 1 on input (z, t) and p(∞) the probability that the M-LWE oracle outputs 1 on uniformly random input. Further, it yields p j (0, 0) = p (0, 0) for all j, ∈ [t 1 + t 2 ]. Also note that p j (0, 0)p(∞) corresponds to the advantage of the M-LWE oracle, where the error rate that we obtain from Lemma 3.1 on input e + M ∨ is exactly Υ α (as k j (z) = 0 and exp(t) = 1). As we assume that this advantage is bounded below by 2/κ, it yields E e←Dg [p j (0, 0)p(∞)] ≥ 2/κ. For the first item of Lemma 3.2, we have to show that p j (0, t * )-p(∞) ≥ 1/κ for some t * ∈ R + . Setting t * = 0 and using a Markov argument, we get that Pr e←Dg [p j (0, 0)p(∞) ≥ 1/κ] ≥ 1/(κ -1), which is non-negligible. For the second item of Lemma 3.2, we have to show that |p j (0, t)p(∞)| ≤ 2 exp(-t/κ) for any t ∈ R + . It suffices to show that the distribution of A M j,0,t is within statistical distance 2 exp(-t/κ) of the uniform distribution for any t ∈ R + . Let t ≥ ln(2)κ. Using [PRS17a, Lem. 6.9], the statistical distance for m samples is bounded above by

m • ε = m • exp(-c 2 n) = m • exp(-n ∈[n] (r ) 2/n ) ≤ m • exp   -n/q 2 ∈[n] (r ) 2/n ∈[n] ( σ (e) 2 ) 2/n   = m • exp   -n/q 2 exp(2t/n)r 2 ∈[n] ( σ (e) 2 ) 2/n   .
Here, we use that (r ) 2 ≥ ((r ) 2 σ (e) 2

2 )/q 2 for all ∈ [n] and r = r for all = j and r j = r exp(t). We deduce for every

∈ [n] that σ (e) 2 ≥ exp(-N ) • δ = exp(-N ) • αqG(n) √ 2r > exp(-2N -1)q/r.
We plug this equation into the one above to obtain

m • ε ≤ m • exp   -n/q 2 exp(2t/n)r 2 ∈[n] ( σ (e) 2 ) 2/n   ≤ m • exp (-n exp(2t/n -4N -2)) < m • exp((-n(t/κn + log 2 (m/2)/n)) = 2 exp(-t/κ),
where we used in the third step the loose equation exp

(2t/n -4N -2) > exp(t/n) > t/κn + log 2 (m/2)/n, as we required t ≥ ln(2)κ ≥ κ/10 ≥ 10N 2 m.
And finally, for the last item of Lemma 3.2, we have to show the Lipschitz property, i.e., that |p j (z, t 1 )p j (z, t 2 )| ≤ κ|t 1t 2 | for any t 1 , t 2 ∈ R + . As mentioned before, the distribution of A M j,z,t only depends on exp(t) zσ j (e) 2 . Thus, by Lemma 1.19, the distributions of A M j,z,t1

and A M j,z,t2 are within statistical distance min{1, 10m(exp(|t 1 -

t 2 |) -1)} ≤ κ|t 1 -t 2 |, Here, we use that if |t 1 -t 2 | > 1/κ, then the bound κ|t 1 -t 2 | is trivial. On the other hand, if |t 1 -t 2 | ≤ 1/κ 1/100, then exp(|t 1 -t 2 |) -1 10|t 1 -t 2 |, so 10m(exp(|t 1 -t 2 |) -1) ≤ κ|t 1 -t 2 |, which completes the proof.

Step 2: Classical Hardness for Exponentially Large Modulus

Using the results from above, we are able to adapt the classical hardness result of LWE from Peikert [START_REF] Peikert | Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[END_REF]Thm. 3.1] to modules, yielding for suitable parameters a reduction from GapSVP over module lattices in the worst-case to the M-LWE problem.

Theorem 3.2 (Classical Hardness of M-LWE)

Let α, γ ∈ R + such that α ∈ (0, 1) and let n, k, q ∈ N, defining N = nk. We consider a number field K of degree n with R its ring of integers. Further, assume that

k ≥ 2, q ≥ 2 N 2 and γ ≥ N √ k α . Let M ⊆ K k be a rank-k module.
There exists a PPT reduction from solving Mod-GapSVP γ in the worst-case to solving the problem M-LWE n,k,q,Υα , using poly(N ) samples.

The proof idea is the same as the one from Peikert, but with two modifications. First, we look at the module variants of the corresponding problems, i.e., Mod-GapSVP over module lattices and M-LWE, where the underlying ring R is the ring of integers of a number field K. Second, we replace the main component, a reduction from the BDD problem to the search version of LWE ([Pei09, Prop. 3.4], originally from [Reg05, Lem. 3.4]), by the reduction proven above from the GDP problem over modules to the decision version of M-LWE (Lemma 3.3). As Lemma 3.3 requires access to polynomially many samples from some discrete Gaussian distribution over a lattice, we make use of the Gaussian sampler from Lemma 1.12.

Proof: Let M ⊆ K k be a rank-k module over R, such that the corresponding module lattice of dimension N has basis B = (b j ) j∈ [N ] . Further, let δ be a positive real. The Mod-GapSVP γ problem as stated in Definition 1.2 asks to decide whether λ 1 (M) ≤ δ (YES instance) or λ 1 (M) > γδ (NO instance). Without loss of generality, we assume that the basis B is LLL-reduced (Lemma 1.5) and appropriately scaled, thus the following three conditions hold:

C1) λ 1 (M) ≤ 2 N 2 , C2) min j∈[N ] GS(b j ) 2 ≥ 1, C3) 1 ≤ δ ≤ 2 N 2 /γ.
Recall that we denote by GS(B) = (GS(b j )) j∈[N ] the Gram-Schmidt orthogonalization of B from left to right. Note for C3, that Mod-GapSVP γ becomes trivial if δ lies outside this range: If δ < 1, using C2, we know that λ 1 (M) ≥ 1 and thus it is definitely not a YES instance. If δ > 2 N 2 /γ, using C1, we know that δγ > 2 N 2 ≥ λ 1 (M) and thus it is definitely not a NO instance.

The reduction: The reduction executes the following procedure poly(N ) many times:

• Choose w ← D g with g = δ 2 • √ N , • Compute w + M,
• Run the GDP g oracle from Lemma 3.3 with w + M, r =

q √ 2N γδ , g = αq √ 2kr
, and using the Gaussian sampler from Lemma 1.12,

• Compare the output of the oracle with w.

If the oracle's answer is always correct, output NO, otherwise YES.

Gaussian sampler: First, we show that the Gaussian sampler from Lemma 1.12 always succeeds to provide polynomially many samples from the discrete Gaussian distribution D M ∨ ,r for each r ∈ W r,ζ,T (for some ζ = 1/poly(n) and T = poly(n)), needed in Lemma 3.3. Note that for every r = (r j ) j∈[n] ∈ W r,ζ,T it yields r j ≥ r for every j ∈ [n]. As the task of sampling Gaussians becomes easier with increasing parameter, it suffices to show that the Gaussian sampler succeeds for r. By Section 1.2.1, D = (B -1 ) T defines a basis of the dual M ∨ , where we denote by d j its column vectors for j ∈ [N ]. It yields for the Euclidean norm that GS(D) 2 = GS(B) -1 2 . As we require in condition C2 that min j∈

[N ] GS(b j ) 2 ≥ 1, it follows max j∈[N ] GS(d j ) 2 ≤ 1. Using the condition C3 and that q ≥ 2 N 2 , it yields r = q √ 2N γδ ≥ √ 2N ≥ 1 • ln(2N + 4)/π ≥ max j∈[N ] GS(d j ) 2 • ln(2N + 4)/π,
and thus the Gaussian sampler from Lemma 1.12 always succeeds.

Case 1 (NO instance): Now, we assume that the reduction is given a NO instance, i.e., λ 1 (M) > γδ. We claim that in this case, all requirements from Lemma 3.3 are fulfilled and thus the oracle always successfully decodes the GDP instance and hence always outputs the correct answer. Using Lemma 1.8 it yields η ε (M ∨ ) ≤ √ N /λ 1 (M) for ε = exp(-N ). Thus,

r = q √ 2N γδ > q √ 2N λ 1 (M) ≥ √ 2q • η ε (M ∨ ).
Further, w is sampled from D g with

g = δ 2 • √ N ≤ αγδ 2 √ nk = αq √ 2kr = g,
where we use the definitions of g and r and the condition on αγ from the theorem statement, i.e., αγ ≥ N √ k. Additionally, w is the unique solution to this problem as with high probability

2 • w 2 ≤ 2 • g √ nk = 2 • δ 2 • √ N • √ nk ≤ αγδ √ k < γδ < λ 1 (M).
Thus, the difference ww of two different solutions w = w to the problem would lead to a non-zero lattice point in M of norm smaller than the minimum, which is a contradiction of the definition of the minimum λ 1 (M).

Case 2 (YES instance): If, on the other hand, the reduction is given a YES instance, i.e., λ 1 (M) ≤ δ, we can consider the following alternate experiment. Let z be a shortest vector in M with z 2 = λ 1 (M) ≤ δ. Now, we replace w by w = w + z in the second step of the reduction and thus hand in w + M to the GDP oracle. Using the probability preservation property of the statistical distance (Lemma 1.17) of w and w , it yields

Pr[R(w + M) = w] ≤ ∆(w; w ) + Pr[R(w + M) = w ] ≤ ∆(w; w ) + 1 -Pr[R(w + M) = w],
where R denotes the GDP oracle. Note that w + M = w + M, so in the real experiment we

M-LWE n,k,q,Υα M-LWE n,k,q,Ψ ≤α bin-M-LWE n,d,q,Ψ ≤β Cyclotomic Fields Theorem 3.1 Power-of-2 Cyclotomics Corollary 3.1 Lemma 3.4 α = α • ω(log 2 n) Theorem 2.2 β ≥ α n √ 2d √ 4n 2 + 1 d ≥ 3n + ω(log 2 n) q number-theoretic constraints M-LWE n,k,q,Ψ ≤α bin-M-LWE n,d,q,Ψ ≤β Corollary 2.1 β ≥ α n √ 2d √ 4n 2 + 1 d ≥ 3n + ω(log 2 n) q = 5 mod 8

Needed Ingredient

2) Binary Hardness Section 2.3 Using the statistical distance of two Gaussian distributions with the same width but different means, Lemma 1.18, we obtain

∆(w; w ) ≤ √ 2π z 2 g ≤ √ 2πδ g ≤ 2 √ 2π √ N ,
where we use that g = δ √ N /2 and thus Pr[R(w

+ M) = w] ≤ 1 2 + √ 2π √ N
. For sufficiently many iterations, the oracle gives a wrong answer in at least one iteration and the reduction outputs YES.

Binary Hardness and Adapted Error Distribution

As the second ingredient for our classical hardness result for M-LWE, as depicted in Figure 3.3, we need the binary hardness of M-LWE. Fortunately, Chapter 2 provides a detailed study of this problem. Concretely, we use Theorem 2.2 from Section 2.3 as it directly proves the hardness of the decision version of bin-M-LWE. The instantiation for power-of-2 cyclotomics is provided in Corollary 2.1. To complete the proof of Theorem 3.1, we need to connect the first and second ingredient by adapting the error distribution after the classical reduction and before the binary secret proof. More precisely, we have to move from the distribution Υ α over elliptical Gaussian distributions, as used within Section 3.2 and defined in Section 1.3.2, to the set of continuous Gaussian distributions Ψ ≤α , as used in Section 2.3. To achieve this, we use similar techniques as in [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF]Sec. 4.4]. Note that their definition of Υ is slightly different than ours, positively influencing the bound we obtain.

Lemma 3.4

Let n, k, q be positive integers and α be a positive real. There exists a PPT reduction from M-LWE n,k,q,Υα to M-LWE n,k,q,Ψ ≤α , where α = α • ω(log 2 n).

Proof: Our goal is to reduce M-LWE n,k,q,Υα to M-LWE n,k,q,Ψ ≤α , where α is given by α • ω(log 2 n). Let K be a number field of degree n and let n = t 1 + 2t 2 be the decomposition of n in real and complex embeddings. Recall, that Υ α is a distribution over elliptical Gaussian distributions D r , where r 2 j is distributed as a shifted chi-squared distribution for the real embeddings (i.e., j ∈ [t 1 ]) and as a shifted chi-squared distribution with two degrees of freedom for complex embeddings (i.e., j ∈ {t 1 + 1, . . . , t 1 + t 2 }). Using properties about chisquared distributions (see for instance [LM00, Lem. 1]), it yields that r j ≤ α √ 2

• ω(log 2 n) ≤ α • ω(log 2 n) = α with probability negligible close to 1. Thus, M-LWE n,k,q,Ψ ≤α is not easier than M-LWE n,k,q,Υα .

Modulus Reduction

Recall from Figure 3.1 that we need three ingredients to prove the classical hardness of M-LWE.

In Section 3.2, we provided the first ingredient. For the second ingredient, the hardness of M-LWE with binary secrets, we can use our contributions from Chapter 2. The goal of this section is to present the last ingredient required to complete the classical hardness proof. To this end, we show a modulus reduction for bin-M-LWE, where the rank of the underlying module is preserved, as illustrated in Figure 3.4. This corresponds to the modulus reduction for LWE shown by . If q is exponential-sized and p only polynomial-sized, this factor is exponentially large and thus not suitable for our intentions.

Prior to this thesis, Albrecht and Deo [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF] adapt the more general result from Brakerski et al. [BLP + 13, Thm. 3.1], from which Corollary 3.2 is deduced. Thus, we first recall their general result [AD17a, Thm. 1] and then derive the corollary we need from it. We use their more recent and simplified version as updated on the IACR eprint server [AD17b, Thm. 1]. The theorem provides a transformation that maps M-LWE samples for the modulus q and rank d with a Gaussian noise distribution of parameter β to M-LWE samples for a different modulus p, rank d and Gaussian noise distribution of parameter β . The secret s of the first sample is related to the secret of the second sample via some matrix G. Simultaneously, it maps the uniform distribution to the uniform distribution over the corresponding sets. Let K be a number field of degree n with R its ring of integers. Let d, d , q, p ∈ N, ε ∈ (0, 1 2 ) and G ∈ R d ×d . Fix a vector s = (s 1 , . . . , s d ) T ∈ (R ∨ q ) d . Further, let Λ be the lattice given by Λ = 1 p G T H R d + R d with known basis B Λ in the canonical embedding, let B R be some known basis of R in H and let r be a real number such that

r ≥ max GS(B Λ ) 2 , 1 q GS(B R ) 2 • 2 ln(2nd(1 + 1/ε))/π,
where GS(•) denotes the Gram-Schmidt orthogonalization from left to right. There exists an efficient mapping

F : (R q ) d × T R ∨ → (R p ) d × T R ∨ such that: 1. The output distribution F(U ((R q ) d × T R ∨ )) given uniform input is within statistical distance 4ε of the uniform distribution over (R p ) d × T R ∨ . 2. The output distribution F(A M s,D β ) is within statistical distance (2d +6)ε of A M Gs,D β
, where

(β k ) 2 = β 2 + r 2 (γ 2 + j∈[d] σ k (s j ) 2 ), for k ∈ [n] and γ satisfying γ 2 ≥ B 2 d with B = s ∞ .

The General Case

Whereas Albrecht and Deo [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF] derive from the theorem above a rank-modulus trade-off, defining a map from M-LWE with module rank d and modulus q to M-LWE with rank d/k and modulus q k for any divisor k of d, we are interested in another particular instance of Theorem 3.3 where the rank of the module is preserved. The following corollary specializes the general result to the case of G = I d ∈ R d×d and its proof is very similar to the one of [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF]. Overall, we obtain a modulus reduction, where the rank d is preserved.

Corollary 3.2 (Modulus Reduction for General Number Fields)

Let d, q, p ∈ N with q ≥ p and ε, β ∈ R + with ε ∈ (0, 1 2 ) and

G = I d ∈ R d×d . Let ψ be a distribution over R ∨ q satisfying Pr s←ψ max k∈[n] |σ k (s)| > B ≤ δ
for some non-negative real numbers B and δ. By ψ d we denote the distribution over (R ∨ q ) d , where every coefficient is sampled from ψ independently. Let B R be some known basis of R in H and r be a real number such that

r ≥ 1 p GS(B R ) 2 • 2 ln(2nd(1 + 1/ε))/π.
Then, there is a polynomial-time reduction from M-LWE m n,d,q,Ψ ≤β

B Λ = ( 1 p I d ⊗ I n ) • (I d ⊗ B R ) = 1 p I d ⊗ B R ,
using the mixed product property of the Kronecker product. Orthogonalizing from left to right gives GS(B Λ ) 2 = 1 p GS(B R ) 2 . As q ≥ p, we have 1 q GS(B R ) 2 ≤ 1 p GS(B R ) 2 = GS(B Λ ) 2 and thus r satisfies the condition of Theorem 3.3. The loss in advantage is the result of a simple probability calculus. The event that max k∈[n] |σ k (s)| ≤ B happens with probability greater than 1 -δ. As the secret vector s = (s 1 , . . . , s d ) T ∈ (R ∨ q ) d is chosen by drawing d times independently from ψ, we have to add the advantage loss of 1 -(1 -δ) d to the one coming from Theorem 3.3.

The Case of Power-of-2 Cyclotomics

The quality of Corollary 3.2 depends on the term ∆ = 2r 2 B 2 d, that we have to add to the error width β 2 in order to obtain the resulting error parameter (β ) 2 . This factor is determined by the rank d, the first bound B on the secret distribution ψ and the number r, which itself is quantified by the field degree n, the starting modulus q, the reduced modulus p and the norm GS(B R ) 2 .

In the following, we give a concrete calculation example for those parameters in the case of power-of-2 cyclotomic rings for the secret distribution ψ given by the uniform distribution over R ∨ 2 . Let ν be a power of two, defining the ring of integers of the ν-th cyclotomic field, given by R

= Z[ζ] ∼ = Z[x]/ f (x)
, where f (x) = x n + 1 and n = ν/2.

Corollary 3.3 (Modulus Reduction for Power-of-2 Cyclotomics and Binary Secrets)

Let R be a cyclotomic ring of degree n, where n is a power of 2. Let d, q, p ∈ N with q ≥ p and ε, β ∈ R + with ε ∈ (0, 1 2 ) and G = I d ∈ R d×d . Let further be r a real number such that

r ≥ 1 p √ n • 2 ln(2nd(1 + 1/ε))/π. For (β ) 2 ≥ β 2 + 2dr 2 , there is a polynomial-time reduction from the problem M-LWE m n,d,q,Ψ ≤β with secret distribution U ((R ∨ 2 ) d ) to M-LWE m n,d,p,Ψ ≤β with the same secret distribu- tion U ((R ∨ 2 ) d ).
This reduction reduces the advantage by at most (2d + 6)εm.

In order to guarantee a negligible loss in advantage, we require m and d to be polynomial in the security parameter and ε negligibly small. For p polynomial in n and fulfilling p ≥

√ 2dn• √ 2 ln(2nd(1+1/ε))/π β , we can make sure that r = β √ 2d
is a valid choice, implying that β ≥ √ 2β. Hence, the noise is only increased by a constant multiplicative factor.

Proof: To prove the claim it suffices to show a first condition on the norm of B R , i.e., that GS(B R ) 2 = √ n and as a second condition that the uniform distribution over R ∨ 2 satisfies the requirement of Corollary 3.2 for the parameters δ = 0 and B = 1.

First Condition: Let R be a cyclotomic ring of degree n, where n is a power of 2. As explained in Example 1.3, its dual R ∨ is just a scaling of the ring R itself, given by R ∨ = 1 n R. Further, following Example 1.2, the Vandermonde matrix that maps the vector of an element in R defined by its canonical embedding to the vector corresponding to the coefficient embedding is a scaled isometry with scaling factor 1 √ n . A basis B R for R in H is given by √ n•U, where U is unitary and thus, GS(B R ) 2 = √ n. Second Condition: For any element s ∈ R, let S H be the matrix of multiplication by s in the canonical embedding written in the basis {h j } j∈[n] of H . Let Rot(s) be the matrix of multiplication by s in the coefficient embedding. As mentioned above, going from the coefficient embedding to the canonical embedding is a scaled isometry of scaling factor √ n. Thus,

S H = (B R ) -1 • Rot(s) • B R = 1 √ n • U † • Rot(s) • √ n • U = U † • Rot(s) • U,
where U is unitary. As explained in Section 1.1.2, the singular values of S H are given by σ j (s)

for j ∈ [n]. It yields (S H ) † S H = (U † • Rot(s) • U) † (U † • Rot(s) • U) = U -1 • Rot(s) T • Rot(s) • U.
As a conclusion, the singular values of Rot(s) are exactly the same as the one of S H , given by σ j (s) for j ∈ [n]. The largest singular value of Rot(s) thus determines the maximum of the set { σ j (s) } j∈ [n] . We use this observation to compute the bound B of Corollary 3.2 for the case where ψ equals U ((R ∨ 2 ) d ). Note that we provide new bounds, as the ones calculated by Albrecht and Deo [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF] hold for a Gaussian, and not a binary secret distribution. Using the identity R ∨ 2 = 1 n R 2 , we can write Rot(s) = 1 n Rot(s), where s ∈ R 2 and Rot(s) only has entries from the set {0, 1}. Here we use the special form of the rotation matrix for powerof-2 cyclotomics as explained in Example 1.2. Let Rot(s) = U • Σ • V † be the singular value decomposition of Rot(s), where U and V are unitary matrices over R and Σ is a diagonal matrix with the singular values of Rot(s) on its diagonal. The singular value decomposition of Rot(s) is thus given by Rot(s) = U • 1 n Σ • V † and we can deduce that the singular values of Rot(s) are just the singular values of Rot(s), shrank by a factor of 1 n . The largest singular value s 1 (Rot(s)) of Rot(s) is bounded above by its Frobenius norm Rot(s) F and hence

s 1 (Rot(s)) ≤ Rot(s) F =   i,j∈[n] Rot(s) ij 2   1/2 ≤ n.
It follows s 1 (Rot(s)) ≤ 1. We can thus set B = 1 with δ = 0.

Generalization to Larger Secrets

One may wonder if it is possible to generalize this modulus reduction to larger secret distributions, as we did for both binary hardness proofs of Chapter 2, see Section 2.4. More concretely, we consider the case where the secret's coefficients are not necessarily chosen uniformly at random over {0, 1}, but over a slightly larger set {0, . . . , η -1} for some positive integer η q. As the only thing to adapt in the proof of Corollary 3.3 is the second condition, defining the bounds B and δ, we can positively answer this question, on the expense of a larger noise increase.

In the case where ψ equals the uniform distribution over (R ∨ η ) d (instead of (R ∨ 2 ) d as before) the same reasoning holds with respect to the largest singular value of the rotation matrix, leading to B = η -1 and δ = 0 and implying the following corollary. Corollary 3.4 (Modulus Reduction for Power-of-2 Cyclotomics and Small Secrets) Let R be a cyclotomic ring of degree n, where n is a power of 2. Let d, q, p, η ∈ N with q ≥ p and ε, β ∈ R + with ε ∈ (0, 1 2 ) and G = I d ∈ R d×d . Let further be r a real number such that

r ≥ 1 p √ n • 2 ln(2nd(1 + 1/ε))/π. For (β ) 2 ≥ β 2 + 2dr 2 (η -1) 2 , there is a polynomial-time reduction from the prob- lem M-LWE m n,d,q,Ψ ≤β with secret distribution U ((R ∨ η ) d ) to M-LWE m n,d,p,Ψ ≤β with the same secret distribution U ((R ∨ η ) d ).
This reduction reduces the advantage by at most (2d + 6)εm.

For p polynomial in n and fulfilling p ≥ √ 2dn

• (η -1) • √ 2 ln(2nd(1 + 1ε))/π/β, we can make sure that r = β/( √ 2d(η -1)) is a valid choice, implying that β ≥ √ 2β.
particular, the reduction is dimension-preserving with a polynomial-sized modulus. However, a reduction from decision R-LWE to decision R-LWR with a polynomial-sized modulus was longtime an open problem, see Section 4.1.2 on related work for more details. Nevertheless, due to the simplicity and efficiency of R-LWR, several encryption schemes as SABER [DKRV18] (third round) and Round5 [BBF + 19] (second round) participating in the NIST standardization process are basing their hardness on (decision) R-LWR. To overcome the lack of provable hardness for decision R-LWR with practical parameters, Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF] propose a new assumption, called the Computational Learning With Rounding Over Rings (R-CLWR) problem. They show a reduction from decision R-LWE to R-CLWR, where the secret in the R-LWE sample is drawn uniformly at random from the set of all invertible ring elements whose coefficients are small. They also show that one can construct an efficient PKE scheme based on the hardness of R-CLWR in the random oracle model.

Our Contributions

The main motivation of this work is to combine both variants MP-LWE and R-LWR in order to define a new problem that benefits from both of their advantages. To this end, we introduce a new hardness assumption which we refer to as the Middle Product Computational Learning With Rounding (MP-CLWR) problem. On the one hand, MP-CLWR uses rounding in a similar way to R-LWR and hence avoids the Gaussian error sampling. On the other hand, the hardness of MP-CLWR does not depend on a specific defining polynomial. Thus, the MP-CLWR assumption enjoys the security advantage of MP-LWE and the simplicity advantage of LWR.

The reason why we introduce the problem in its computational form, instead of the more standard search or decision variant, is twofold. On the one hand, it is as for today unclear how to reduce the hardness of decision MP-LWR from worst-case lattice problems, while maintaining the coefficient-wise rounding and allowing for a polynomially large modulus. On the other hand, it is unclear how to construct encryption schemes directly on the search variant. The computational variant gives a solution to this dilemma, as we can derive an efficient reduction still allowing for a polynomially large modulus and at the same time we can use it to build an encryption scheme (which we introduce separately in Chapter 6).

In the following, we give a brief overview of the MP-CLWR problem and our proof for its hardness. An MP-CLWR sample is given by (a, b = a d s p ), where a is sampled from the uniform distribution over Z <n q [x] and s is a fixed element in Z <n+d-1 q [x]. Recall that Z <n q [x] denotes the set of polynomials in Z q [x] with degree less than n and that a d s denotes the middle-product of length d of the polynomials a and b, as introduced in Section 1.4.4. Further, note that • p denotes the modular rounding function from Section 1.4.5. We define the MP-CLWR problem as the following game, where we embed MP-CLWR samples into two experiments. In both experiments, three different parties appear: a challenger C, an adversary A and a source S. The source S 1 of the first experiment provides t different MP-CLWR samples (a j , a j d s p ) j∈[t] and the source S 2 of the second experiment provides t rounded uniform samples (a j , b j p ) j∈ [t] , where all a j and b j are independently sampled from the corresponding uniform distribution. The challenger C now uses these samples to compute an Input and a Target. They send the Input to the adversary A who themselves compute an Output. The adversary wins the experiment if Target = Output. The important point in this setting is that the challenger C and the adversary A are in both experiments the same. The MP-CLWR assumption captures that an adversary has no more advantage to compute the correct output if they receive an input derived from rounded middleproduct samples (Experiment 1) than if they get an input derived from rounded uniform samples (Experiment 2). We informally illustrate the experiment setting in In order to show in Theorem 4.1 that the hardness of MP-CLWR is guaranteed by the hardness of MP-LWE, we take an instance (a, b) of the latter and round the second component b. This leads us to an instance of the so-called rounded MP-LWE problem (see Section 4.3) We can then use the Rényi divergence to measure the distance between instances of this rounded MP-LWE problem and instances from MP-LWR. It is easy to go from the decision version to the computational one, as the distinguishing game can be seen as a special case of the computational game (when setting the target as the bit to decide which distribution is used). The Hankel matrix plays an important role in the sequence of reductions as it can be used to represent the middle-product of two polynomials and thus it helps to analyze when the middle-product of a uniform random element is again uniform random.

Related Work

As stated before, a reduction from decision R-LWE to decision R-LWR with polynomial-sized modulus was longtime an open problem, motivating the introduction of intermediate problems such as the computational variant of R-LWR and similarly our newly defined MP-CLWR problem. After our results have been published, Liu and Wang [START_REF] Liu | Rounding in the rings[END_REF] addressed this open problem by providing a search-to-decision reduction for R-LWR. In order to do so, they need to define a new way of rounding. Whereas in our work (and in all other works before) we round an element of the ring Z q [x]/ f (x) coefficient-wise, they now round elements with respect to so-called normal integral bases. They further provide a reduction from R-LWR to MP-LWR for the search and decision variants. Putting both results together, we obtain the hardness of decision MP-LWR. However, the authors didn't provide an analysis how the different rounding notions are related to each other. This is why we think that it would be interesting to further study the relation of the different ways of rounding in future works.

Roadmap

The rest of the chapter is structured as follows. In Section 4.2, we first prove some new results on random Hankel matrices which we need in the hardness reduction and might be of independent interest. We give a formal definition of the MP-CLWR problem in Section 4.3 and show that it is at least as hard as decision MP-LWE in Section 4.4.

Random Hankel Matrices

In this section, we show new results on the distribution of random Hankel matrices. First, we recall the definition of Hankel and Toeplitz matrices for a given polynomial, which we interpret as usual as a vector. We prove a lower bound for the probability that the Hankel matrix of a polynomial which is chosen uniformly at random has full rank. Finally, this result leads to a uniformity property of the middle-product which plays a crucial part in the hardness reduction of the new middle-product learning with rounding assumption in Section 4.4.

Hankel and Toeplitz matrices are not only used in the context of the middle-product of two polynomials. More generally, as pointed out by Kaltofen and Lobo [START_REF] Kaltofen | On rank properties of toeplitz matrices over finite fields[END_REF], Toeplitz matrices are used as pre-conditioners in the process of solving linear systems of equations having unstructured coefficient matrices. The attractiveness of these structured matrices is twofold: First, it suffices to store the first column and first row, in order to rebuild the whole matrix. Second, the product of a Toeplitz matrix and a vector is in fact a convolution and can be computed in quasi-linear time using the Fast Fourier Transformation.

Other than that, large-dimensional random matrices with additional algebraic structure, as Hankel and Toeplitz matrices, play an important role in statistics, in particular in multivariate analysis. More concretely, Hankel matrices arise in polynomial regressions and Toeplitz matrices appear as covariance of stationary processes. In particular, the spectral distribution for their eigenvalues is important and was studied by Bryc et al. [START_REF] Bryc | Spectral measure of large random Hankel, Markov and Toeplitz matrices[END_REF].

We start by recalling the definitions of Hankel and Toeplitz matrices. The Hankel matrix is fully determined by its first row and its last column. Its rank is at most d. If it has full rank d we write rank(Hank(a)) = d. Definition 4.2 (Toeplitz Matrix): Let q, n, d ∈ N such that d ≤ n and a ∈ Z <n+d-1 q [x] with coefficient vector a = (a 0 , . . . , a n+d-2 ) T . The Toeplitz matrix of a of order d + n -1 is given by

Toep(a) =      a 0 a 1 . . . a d-1 . . . a n-1 a n a 0 . . . a d-2 . . . a n-2 . . . . . . . . . . . . . . . a n+d-2 a n+d-3 . . . a 0 . . . a n-d      ∈ Z d×n q .
The Toeplitz matrix is fully determined by its first row and its first column. There exists a special relation between Toeplitz matrices and the Hankel matrices. Let J n be the reflection matrix of order n defined as

J n =        0 • • • 0 0 1 0 • • • 0 1 0 0 • • • 1 0 0 . . . . . . . . . . . . . . . 1 • • • 0 0 0        ∈ Z n×n q .
Then, for any polynomial a ∈ Z <n+d-1 q [x] with coefficient vector a = (a , a ) in Z n q × Z d-1 q it yields Toep(a) • J n = Hank(ã), where ã is the polynomial given by the coefficient vector ã = (rev(a ), a ) with rev(a ) denoting the vector a in reverse order. Thus, we can use the result of Kaltofen and Lobo [START_REF] Kaltofen | On rank properties of toeplitz matrices over finite fields[END_REF] about random Toeplitz matrices to calculate the probability of a random Hankel matrix to have full rank. Lemma 4.1 (Rank of Random Hankel Matrices) Let q ∈ N with unique prime power factorization given by q = j∈[ ] p αj j , where p j are primes and α j > 0 for some

∈ N. Let d, n ∈ N such that d ≤ n and sample b ← U (Z <n+d-1 q [x]). Then, Pr [rank(Hank(b)) = d] ≥ j∈[ ] 1 - 1 p j .
Proof: Case 1. Assume that q is prime. Any Hankel matrix of order d + n -1 can be represented as the matrix product of the corresponding Toeplitz matrix of order d + n -1 times the non-singular reflection matrix J n of order n whose anti-diagonal elements are 1's and all other entries are 0's. Thus, the rank of a given Hankel matrix is the same as the one of the corresponding Toeplitz matrix. For the case d = n, it follows from [KL96, Thm. 4] that the total number of Hankel matrices of full rank d is exactly (q -1)q 2d-2 . If we choose b ← U (Z <n+d-1

q [x]), then Pr [rank(Hank(b)) = d] = (q -1)q 2d-2 q 2d-1 = 1 - 1 q .
For d < n, the d × n Hankel matrix has full rank d if at least the left d × d submatrix, which is naturally a d × d Hankel matrix as well, has rank d. This happens with probability at least 1 -1 q . Case 2. Assume that q = p α for some p prime and α > 0. Initially, consider the case d = n. Any Hankel matrix A can be represented as A = pQ + R, where both R and Q are Hankel matrices with coefficients in Z p and Z p α-1 , respectively. This formula follows from integer division by p with remainder, i.e., Euclidean division. Any element from Z p α , when divided by p, has a reminder in Z p and quotient in Z p α-1 . This representation is unique, thus preserves the structure of the matrix A. Since A is a Hankel matrix, so are Q and R. The matrix A has full rank in Z p α if and only if R has full rank in Z p . Hence, we can deduce from the previous case that the number of Hankel matrices of full rank equals (p -1)p (α-1)(2d-1)+(2d-2) .

If we sample b

← U (Z <n+d-1 q [x]), then Pr [rank(Hank(b)) = d] = (p -1)p (α-1)(2d-1)+(2d-2) p α(2d-1) = 1 - 1 p .
For d < n, using the same argument as before, the probability is at least 1 -1 p . Case 3. Let q ∈ N with unique prime power factorization given by q = j∈[ ] p αj j , where p j are primes and α j > 0 for some ∈ N. For the case d = n, it follows from the Chinese Remainder Theorem that the number of Hankel matrices of full rank d modulo q equals the product of the number of Hankel matrices of full rank d modulo p αj j which is given by

j∈[ ] (p j -1)p (αj-1)(2d-1)+(2d-2) j . Thus, if we sample b ← U (Z <n+d-1 q [x]), then Pr [rank(Hank(b)) = d] = j∈[ ] 1 -1 pj . Simi- larly as before, for d < n and b ← U (Z <n+d-1 q [x]), then Pr [rank(Hank(b)) = d] ≥ j∈[ ] 1 - 1 p j .
We denote by (Z <n+d-1

q [x]) × the set of polynomials of Z <n+d-1 q [x]
with full rank Hankel matrix. As said earlier, Hankel matrices play an important role in the middle-product setting, as they can be used to represent the middle-product of two polynomials. More precisely, for a ∈ Z <n q [x] and b ∈ Z <n+d-1 q [x], their middle-product can be written as a matrix-vector product

a d b = Hank(b) • rev(a),
where rev(a) denotes the coefficient vector of a in reverse order. We write MP-LWE × to denote the problem MP-LWE restricted to secrets from the set (Z <n+d-1

q [x]) × . Lemma 4.2 (Uniformity of the Middle-Product) Let d, n ∈ N such that d ≤ n and let b be a fixed element of Z <n+d-1 q [x] × . If we sample a ← U (Z <n q [x]), then a d b is uniformly random in Z <d q [x].
Proof: We can write a d b = Hank(b) • rev(a). For any d ≤ n and full rank matrix A ∈ Z d×n q , the mapping from Z n q to Z d q given by multiplication with A is surjective. As a is chosen uniformly at random and the Hankel matrix of b has full rank d, their middle-product is also uniformly distributed.

tion from [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF] to the middle-product setting. As an analog of the notion of units in the original paper, we define (Z <n+d-1 q [x]) × as the set of all polynomials over Z q having degree less than n + d -1 and a Hankel matrix of order d × n of full rank d. Such unit elements are needed to map a uniform random element again to a uniform random element. Lemma 4.2 shows that the same property holds for elements with a full rank Hankel matrix.

The integers d and n define the parameters of the middle-product, q defines the general and p the rounding modulus. The number of samples has to be fixed beforehand and is given by t. For any distribution X , we denote by X t the distribution that is defined by t copies of it. Thus, an instance of the latter is composed of t independent instances of X . Definition 4.3 (MP-CLWR Assumption): Let d, n, p, q, t ∈ N such that d ≤ n and q ≥ p ≥ 2. Sample s ← U ((Z <n+d-1 q [x]) × ). Denote by X s the distribution of (a, a d s p ), where a ← U (Z <n q [x]), and denote by U the distribution of (a, b p ), where a ← U (Z <n q [x]) and b ← U (Z <d q [x]). For j ∈ {1, 2} define the input for the source S j as (var j , con), where var 1 denotes the distribution X t s , and var 2 the distribution U t , and con is an arbitrary distribution over {0, 1} * which is independent from var 1 and var 2 . For a fixed challenger C let P C,A be the probability for an adversary A to win Exp 1 (C, A, S 1 ), while Q C,A be that for A to win Exp 2 (C, A, S 2 ). The MP-CLWR p,q,n,d,t assumption states that for any challenger C if Q C,A is negligible for any adversary A, so is P C,A . We call the difference P C,A -Q C,A the advantage of the adversary A.

Correspondingly, we also define the Middle-Product Computational Rounded Learning With Errors (MP-CRLWE) assumption which is important in the hardness reduction in Section 4.4. Definition 4.4 (MP-CRLWE Assumption): Let d, n, p, q, t ∈ N such that d ≤ n and q ≥ p ≥ 2. Sample s ← U ((Z <n+d-1 q [x]) × ). Let ψ be an error distribution over R <d [x]. Denote by Y s,ψ the distribution of (a, a d s + e p ), where a ← U (Z <n q [x]) and e ← ψ and denote by U the distribution of (a, b p ), where a ← U (Z <n q [x]) and b ← U (Z <d q [x]). For j ∈ {1, 2} define the input for S j as (var j , con), where var 1 denotes the distribution Y t s,ψ , and var 2 the distribution U t , and con is an arbitrary distribution over {0, 1} * which is independent from var 1 and var 2 . For a fixed challenger C let P C,A (ψ) be the probability for an adversary A to win Exp 1 (C, A, S 1 ), while Q C,A be that for A to win Exp 2 (C, A, S 2 ). The MP-CRLWE p,q,n,d,t,ψ assumption related to the error distribution ψ states that for any challenger C if Q C,A is negligible for any adversary A, so is P C,A (ψ). We call the difference P C,A (ψ) -Q C,A the advantage of the adversary A.

Hardness of Computational MP-LWR

We now prove the hardness of MP-CLWR with the help of a reduction from the decision MP-LWE problem to the MP-CLWR problem. The decision version of MP-LWE itself can be reduced from decision P-LWE for an exponentially large class of defining polynomials [START_REF] Roşca | Middle-product learning with errors[END_REF]. As P-LWE benefits from worst-case to average-case reductions from lattice problems, our new MP-CLWR assumption also enjoys worst-case hardness.

In the following we need the notion of B-bounded and balanced distributions. More precisely, are uniform samples, then are (a j , b j ) j also uniformly distributed. Hence, Pr[B((x j , y j )

j ) = 1] = Q C,A .
Note that the (Input, Target) pair can be seen as a function in the input X . The maximal information on X it can contain, is if B sets Input = X (and as a target the require to distinguish the used distribution). Assuming the hardness of decision MP-LWE, we have P C,A (ψ) -Q C,A < ε, for negligible ε and for any PPT adversary A. In particular, the MP-CRLWE assumption holds: If Q C,A is negligible, so is P C,A for the same challenger C and adversary A using the equation above.

The third and last reduction is an adaption of Lemma 8 and Lemma 9 in [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF], based on the results of [BGM + 16], together with our results about random Hankel matrices of Section 4.2.

Lemma 4.5 (MP-CRLWE to MP-CLWR)

Let d, n, q, p, t ∈ N such that d ≤ n and q ≥ p ≥ 2. Further, sample s ← U ((Z <n+d-1 q [x]) × ), and let X s and Y s denote the random variables of a single MP-CLWR sample (a, a d s p ) and a single MP-CRLWE sample (a, a d s + e p ), respectively. Further, let ψ be an error distribution over R <d [x] which is balanced and B-bounded with probability at least δ, where q > 2pBdt and δ ≥ 1 -1 td . Then we have

(P C,A ) 2 ≤ P C,A (ψ) • e 2 ,
where e is the Euler's number. Hence, there is a reduction from MP-CRLWE p,q,n,d,t,ψ to MP-CLWR p,q,n,d,t .

Proof: Let s ← U ((Z <n+d-1 q [x]) × ) be fixed throughout the proof. Using the multiplicativity and probability preservation properties of the Rényi divergence, see Lemma 1.20, we have

(P C,A ) 2 ≤ P C,A (ψ) • RD 2 (X s Y s ) t .
In the following we show that the Rényi divergence of X s and Y s can be bounded above by

RD 2 (X s Y s ) ≤ (1 + 2pB/q) d δ d .
Following the definition of the Rényi divergence it yields

RD 2 (X s Y s ) = E a←U (Z <n q [x]) Pr X s = (a, a d s p ) Pr Y s = (a, a d s p ) = E a←U (Z <n q [x]) 1
Pr e←ψ a d s + e p = a d s p

, where we use that the expected value over x ← X s is equivalently defined by the expected value over a ← U (Z <n q [x]). First, we define the border elements in Z q with respect to B and p by Bor p,q (B) = x ∈ Z q : x + B p = x p .

These are the elements in Z q which are close to the rounding boundary. It yields |Bor p,q (B)| ≤ 2Bp. For 0 ≤ t ≤ d we define

Bad s,t = a ∈ Z <n q [x] : {j ∈ [d] : (a d s) j ∈ Bor p,q (B)} = t ,
where (a d s) j denotes the j-th coefficient of a d s. a In other words, Bad s,t defines for a given polynomial s and number of coefficients t, the set of polynomials a in Z <n q [x] such that the middle-product a d s has exactly t coefficients close to the rounding boundary. Now we fix t and assume a ∈ Bad s,t . For any j ∈ [d] with (a d s) j / ∈ Bor p,q (B), it yields

Pr

(e k ) k =e←ψ (a d s) j + e j p = (a d s) j p ≥ δ,
as e j is the j-th coefficient of e, where e is sampled from the distribution ψ which is B-bounded with probability at least δ. If (a d s) j ∈ Bor p,q (B), then

Pr

(e k ) k =e←ψ (a d s) j + e j p = (a d s) j p ≥ 1 2 ,
because e j is the j-th coefficient of e, where e is sampled from a balanced distribution. Thus, the probabilities of e j ∈ [-B, 0] or in [0, B] are each greater or equal to 1 2 and (a d s) j + e j p = (a d s) j p happens in exactly one of the two cases. Since each coefficient of e is independently distributed and a d s has exactly t coefficients in Bor p,q (B), it yields

Pr e←ψ a d s + e p = a d s p ≥ 1 2 t • δ d-t ≥ 1 2 t • δ d .
By Lemma 4.2, we know that if a is uniform in

Z <n q [x], so is a d s ∈ Z <d q [x] (for s ∈ (Z <n+d-1 q [x]) × ). Thus, it yields Pr a ∈ Bad s,t ≤ d t 1 - |Bor p,q (B)| q d-t |Bor p,q (B)| q t . Hence, RD 2 (X s Y s ) ≤ δ -d t∈[d] 2 t • Pr a ∈ Bad s,t = δ -d t∈[d] d t 1 - |Bor p,q (B)| q d-t 2 • |Bor p,q (B)| q t = δ -d 1 + |Bor p,q (B)| q d ≤ δ -d 1 + 2pB q d ,
where we used in the third equation the standard binomial theorem. From the results above, we can derive

RD 2 (X s Y s ) t ≤ (1 + 2pB/q) td δ td ≤ (1 + 1/td) td (1 -1/td) td ≈ e 2 ,
where δ ≥ 1 -1 td and q > 2pBdt.

a By abuse of notation we write j ∈ [d], even though strictly speaking the coefficients run from 0 to d -1, and not from 1 to d.

Introduction

As elaborated in the introduction of this manuscript, lattice-based cryptography is a relatively young research field of public key cryptography that was initiated at the end of the 1990s by two different branches. On the one had, there have been proposals benefiting from strong theoretical connections to presumed hard worst-case lattice problems [Ajt96, AD97], leading to the development of public key cryptography based on the SIS and LWE problems, see for instance the survey by Peikert [START_REF] Peikert | A decade of lattice cryptography[END_REF]. Both, the module variant of LWE that we study in Chapter 2 and Chapter 3, and the middle-product variant of LWR from Chapter 4, can be seen as descendants of Ajtai's work, still benefiting from worst-case to average-case reductions to well-studied problems on (structured) lattices. On the other hand, however, very efficient schemes basing their security on average-case structured lattice problems have been introduced, the most popular among them is the NTRU encryption scheme by Hoffstein et al. [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF]. In this chapter, we study a problem which can be seen as the offspring of the second line of works.

Following the latter approach, Hoffstein et al. [HPS + 14] propose a digital signature scheme called PASS Sign, whose security is based on the difficulty of recovering a polynomial of small 89 norm having access only to a partial list of its discrete Fourier transform. Later, Lu et al. [START_REF] Lu | Practical signatures from the partial fourier recovery problem revisited: A provably-secure and gaussian-distributed construction[END_REF] complement the proposal by moving from the partial Fourier transform (evaluation at all roots of unity) to the partial Vandermonde transform (evaluation only at the primitive roots of unity) and by giving a rigorous proof of security.

The problem that underlies PASS Sign, as given in [START_REF] Lu | Practical signatures from the partial fourier recovery problem revisited: A provably-secure and gaussian-distributed construction[END_REF], can be presented as follows. Let q be a prime, R = Z[x]/ f (x) denote the ring of integers of the ν-th cyclotomic number field of degree deg(f (x)) = n, such that f (x) splits into linear factors mod q. More precisely, f (x) = j∈[n] (x -ω j ) mod q, where {ω j } j∈[n] are the ν-th primitive roots of unity in Z q . Let V = (ω k-1 j ) j,k∈[n] ∈ Z n×n q denote the discrete Vandermonde matrix for {ω j } j∈[n] , as introduced in Section 1.1.4. We denote by V Ω ∈ Z t×n q the partial Vandermonde matrix consisting of t ≤ n subrows of V specified by a random subset of t roots Ω ⊆ {ω j } j∈ [n] . Let f be a ring element of small norm, sampled from some distribution ψ. Given V Ω • f mod q, the problem asks to find f. We call this the Partial Vandermonde Knapsack problem (PV-Knap). 1 A related problem is Partial Vandermonde SIS (PV-SIS), where given V Ω one asks to find a ring element f of small norm such that V Ω • f = 0 mod q. This can be formulated as a Shortest Vector Problem (SVP) over a structured lattice.

Shortly afterwards, Hoffstein and Silverman [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF] introduce PASS Encrypt, a Public Key Encryption (PKE) scheme whose computational building blocks are closely related to the ones of PASS Sign. It is very efficient and fulfills additive and multiplicative homomorphic properties. The algebraic structure and homomorphic properties of PASS Encrypt and the underlying partial Vandermonde problems, make them a natural starting point for the design of efficient cryptographic primitives. For example, such properties are recently exploited in the context of PASS Sign to construct compact aggregate signature schemes [START_REF] Doröz | MMSAT: A scheme for multimessage multiuser signature aggregation[END_REF], and it is plausible that combining PASS Encrypt with PASS Sign may form the basis for various compact and efficient privacy-preserving primitives such as group signatures. Unfortunately, a main problem with PASS Encrypt to date is that its security is not well understood, no proof of security was given in [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF] with respect to the hardness of explicit computational problems, and the scheme is deterministic and hence does not satisfy the standard notion of IND-CPA security.

Our Contributions

In this chapter, we make progress towards understanding the hardness assumptions needed to prove the security of PASS Encrypt. We first present the Partial Vandermonde Knapsack problem (PV-Knap) in its search and decision variant, as studied by Lu et al. [START_REF] Lu | Practical signatures from the partial fourier recovery problem revisited: A provably-secure and gaussian-distributed construction[END_REF] in the context of PASS Sign. 2 It makes use of the partial discrete Vandermonde matrix over Z q , where q is a prime. We emphasize its connection to (average-case) ideal lattices, even though we can't show a worst-case to average-case reduction as for structured variants of LWE. We enlarge the landscape of problems that use the partial Vandermonde matrix by defining a new variant of LWE, called Partial Vandermonde Learning With Errors (PV-LWE). Later, we show the equivalence of PV-Knap and PV-LWE by exploiting the same duality connection as we have for standard Knapsack problems and LWE. As explained in the introduction of this chapter, our main motivation is to provide a security proof for PASS Encrypt. To this end, we define a variant of PV-Knap, that we call the PASS problem. This problem serves (together with the decision version of PV-Knap) as the underlying hardness assumption for (a slightly modified version of) PASS Encrypt. We present the scheme together with the security proof in Chapter 7. We conclude the chapter by showing that for a special choice of the partial Vandermonde matrix, one can accelerate computations when working with PV-Knap and PV-LWE.

Definition of Partial Vandermonde Problems

We now define the problems Partial Vandermonde Knapsack, Partial Vandermonde SIS, Partial Vandermonde LWE and a leaky variant of Partial Vandermonde Knapsack, called PASS.

Partial Vandermonde Knapsack Problem (PV-Knap)

The Partial Vandermonde Knapsack problem (PV-Knap) was first introduced by Hoffstein et al. [HPS + 14]. 3 We start this section by defining the notion of a partial Vandermonde matrix, where we consider the discrete Vandermonde matrix V as presented in Section 1.1.4. Informally speaking, the partial Vandermonde matrix is composed of a subset of rows of the full matrix V.

We now state the formal definition. For ν ∈ N, let K = Q[x]/ f (x) be the ν-th cyclotomic number field of degree deg(f (x)) = ϕ(ν) = n and let R = Z[x]/ f (x) be its ring of integers. Further, let q ∈ N be a prime such that q = 1 mod ν. In this case, f (x) completely splits in Z q [x], i.e., f (x) = j∈[n] (x -ω j ), where every ω j is a distinctive primitive ν-th root of unity in Z q . Furthermore, the ideal generated by q in R can be written as q = j∈[n] q, x -ω j . To ease readability, we represent in this chapter a ring element a ∈ R directly by its coefficient vector a ∈ Z n and implicitly assume that this coefficient vector is obtained by applying the coefficient embedding τ as introduced in Section 1.1.3. Definition 5.1 (The partial Vandermonde transform): For ν, n, q as above, let {ω j } j∈[n] be the set of primitive ν-th roots of unity in Z q . We divide the set {ω j } j∈[n] into two disjoint subsets Ω and Ω c of size |Ω| = t and |Ω c | = nt. The partial Vandermonde transformation matrix V Ω ∈ Z t×n q and its complement V Ω c ∈ Z (n-t)×n q are given by

V Ω =    1 ω i1 • • • ω n-1 i1 . . . . . . . . . 1 ω it • • • ω n-1 it    , and V Ω c =    1 ω it+1 • • • ω n-1 it+1 . . . . . . . . . 1 ω in • • • ω n-1 in    ,
where

ω ij ∈ Ω for j ∈ [t] and ω i t+k ∈ Ω c for k ∈ [n -t].
By rearranging and merging the rows of the two matrices V Ω and V Ω c , we obtain the full discrete Vandermonde matrix V. In order to get more familiar with the concept of the partial Vandermonde transform, we now provide a concrete example in small dimension.

Example 5.1 (Partial Vandermonde Matrix in Small Dimension) Let ν = 16, defining the 16-th cyclotomic field K = Q[x]/ x n + 1 of degree n = 8. Further, let q = 17 be a prime fulfilling the condition q = 1 mod ν. The set of all primitive ν-th roots of unity is given by {3, 5, 6, 7, 10, 11, 12, 14}. We can set Ω = {3, 5, 14, 12} and Ω c = {10, 11, 7, 6}, defining

V Ω =    
1 3 9 10 13 5 15 11 1 5 8 6 13 14 2 10 1 14 9 7 13 12 15 6 1 12 8 11 13 3 2 7

    , V Ω c =    
1 10 15 14 4 6 9 5 1 11 2 5 4 10 8 3 1 7 15 3 4 11 9 12 1 6 2 12 4 7 8 14

    .
As all primitive roots are distinct, the matrices V Ω and V Ω c have maximal row rank t and n-t, respectively. Multiplying the coefficient vector of an element a ∈ R by V Ω (resp. V Ω c ) corresponds to the evaluation of a at the points ω ij for j ∈ [t] (resp. at the points ω i t+k for k ∈ [nt]). To ease notations, we omit the product syntax • and simply write V Ω a for the matrix-vector product.

Furthermore, V Ω a is a partial discrete canonical embedding vector of a, as introduced in Section 1.1.4. Knowing V Ω a and V Ω c a gives the complete discrete canonical embedding vector σ(a) = Va ∈ Z n q and thus uniquely identifies it modulo q. The matrix V Ω defines a ring homomorphism from R to Z t q , where the latter is equipped with component-wise addition and multiplication, denoted by + and •. Thus, V Ω (a 1 + a 2 ) = (V Ω a 1 ) + (V Ω a 2 ) and V Ω (a 1 • a 2 ) = (V Ω a 1 ) • (V Ω a 2 ). In Section 5.4, we show how V Ω a can be efficiently computed using the Number Theoretic Transform (NTT) in dimension t for the case of power-of-2 cyclotomics and special choices of Ω.

We now present the Partial Vandermonde Knapsack problem in its search and its decision version. We define the set P t = {Ω ⊆ {ω j } j∈[n] : |Ω| = t} of all subsets of primitive ν-th roots of unity in Z q of size t. The corresponding set Ω for an instance of Partial Vandermonde Knapsack is chosen uniformly at random over P t . Definition 5.2 (Partial Vandermonde Knapsack): Let ψ be a distribution over Z n . The Search Partial Vandermonde Knapsack problem PV-Knap ψ is the following: let a ← ψ and Ω ← U (P t ); given b = V Ω a mod q, find the solution a. The Decision Partial Vandermonde Knapsack problem dec-PV-Knap ψ asks to distinguish for a given tuple (V Ω , b) ∈ Z t×n q × Z t q , where Ω ← U (P t ), if the vector b was sampled from the uniform distribution over Z t q , or if the tuple is given as an PV-Knap ψ instance.

The problem is assumed to be hard to solve if the distribution ψ provides elements of Z n with small norms, where smallness is with respect to q. The choice of ψ regarding the other parameters also defines whether the solution to this problem is unique or not. We further define a homogeneous variant of PV-Knap with respect to the Euclidean norm. Definition 5.3 (Partial Vandermonde SIS): Let β ∈ N. The Partial Vandermonde SIS problem PV-SIS β consists in finding a ∈ R for a given Ω ← U (P t ) such that V Ω a = 0 mod q and a 2 ≤ β.

Similar to previous works [HPS + 14, LZA18, DHSS20], we call this problem Partial Vandermonde SIS in analogy to the standard Short Integer Solution (SIS) problem, as introduced by Ajtai [START_REF] Ajtai | Generating hard instances of lattice problems[END_REF]. Here, the fully random matrix over Z q is replaced by a random structured one, the partial Vandermonde transform V Ω . Note that an instance of PV-SIS corresponds to an instance of Id-SVP (Def. 1.1) in the special class of ideal lattices

I Ω,q := Λ ⊥ q (V Ω ) = {a ∈ R : V Ω a = 0 mod q},
as presented in Section 1.2.1. Using the definition of V Ω , the ideal lattice I Ω,q can also be presented as the product of half of the factors of the ideal q , i.e., I Ω,q = ωj∈Ω q, x -ω j . The determinant of the ideal lattice equals the norm of the ideal I Ω,q , given by q t . Thus, for a given ring element a of small norm, the partial Vandermonde transform V Ω a mod q is a way to specify the coset a+I Ω,q . Further, the complement partial Vandermonde transform V Ω c a mod q specifies the coset a + I Ω,q , where I Ω,q := q I -1 Ω,q . Given a + I Ω,q and a + I Ω,q uniquely defines a + q . We remark that this class of Id-SVP instances is considered for attacks by Pan et al. [START_REF] Pan | On the ideal shortest vector problem over random rational primes[END_REF]. However, we are in the fully splitting case (q = 1 mod ν) and thus their algorithm essentially needs an oracle of SVP of dimension 2 n , which makes the attack vacuous.

In the following, we show that knowing b = V Ω a mod q (but not explicitly a) suffices to compute B = V Ω Rot(a) mod q, where Rot(a) is the matrix of multiplication as presented in Section 1.1.3. In other words, knowing B does not reveal more information than knowing b. The other direction is trivial, as the first column of B equals b.

Lemma 5.1 Given n, t, q, Ω as above, defining

V Ω = (ω k-1 ij ) j∈[t],k∈[n] . Let b = V Ω a mod q ∈ Z t q for some ring element a ∈ R. Then, for k ∈ [n], the k-th column of the matrix B = V Ω Rot(a) is given by b • (ω k-1 i1 , . . . , ω k-1 it ) T .
Proof: Let a(x) denote the polynomial that corresponds to a ∈ R = Z[x]/ f (x) , i.e., τ (a) = a. For k ∈ [n], the k-th column of Rot(a) is given by the coefficient vector of a(x) • x k-1 mod f (x).

For ∈ [t], the -th coefficient of b corresponds to the evaluation of a(x) at ω i ∈ Ω. We know that B = (b k ) ∈[t],k∈[n] is given by b k = (a(x)

• x k-1 )(ω i ) = a(ω i ) • ω k-1 i .
The homomorphic properties of V Ω complete the proof.

Partial Vandermonde Learning With Errors (PV-LWE)

Similar to the standard Knapsack problem, we can define a dual problem, called Partial Vandermonde Learning With Errors (PV-LWE). Whereas the Partial Vandermonde Knapsack problem is defined with respect to the matrix V Ω , its transpose V T Ω is used for Partial Vandermonde Learning With Errors. We note that this problem is not needed in the security proof of PASS Encrypt (see Chapter 7) but we think that the duality between PV-Knap and PV-LWE (as we show in the next section) deepens our understanding of PV-Knap (which is used for the security of PASS Encrypt). Furthermore, we think that PV-LWE is an interesting problem in its own, as it may be the starting point of other cryptographic schemes and thus we hope to stimulate further research in this direction. In the following, we use the same notation as in Section 5.2.1. Definition 5.4 (Partial Vandermonde Learning With Errors): Given n, t, q as above defining the set P t . Let ψ be a distribution over Z n and fix s ∈ Z t q . Let B s,ψ denote the Partial Vandermonde Learning With Errors distribution over Z t×n q ×Z n q , obtained by sampling Ω ← U (P t ), e ← ψ and returning (V Ω , b = V T Ω •s+e mod q). Partial Vandermonde Learning With Errors comes in two variants:

PV-SLWE V Ω ,ψ : Sample s ← U (Z t q )
. Given a sample of B s,ψ , find s.

PV-LWE V Ω ,ψ : Sample s ← U (Z t q ). Distinguish between a sample from B s,ψ and a sample of the form (V Ω , b), where b ← U (Z n q ).

An instance of PV-SLWE defines an instance of BDD (Def. 1.4) in the ideal lattice

Λ q (V Ω ) = {a ∈ R : a = V T Ω • s mod q for some s ∈ Z t q },
i.e., the lattice generated by the rows of V Ω (see Section 1.2.1). Lemma 5.2 below shows that it is not only closed with regard to addition, but also closed with regard to multiplication by any ring element, making it indeed an ideal lattice in R.

Lemma 5.2

Let a ∈ Λ q (V Ω ) and r ∈ R. Then, r • a ∈ Λ q (V Ω ).

Proof: Let a ∈ Λ q (V Ω ), i.e., a = V T Ω • s mod q for some vector s ∈ Z t q . Note that the multiplication r • a is done in R = Z[x]/ f (x) . Let Rot(r) = (r k ) ,k∈[n] ∈ Z n×n denote the matrix of multiplication of r in R with respect to the coefficient embedding, as defined in Section 1.1.3. Then, it yields for

∈ [n] that (r • a) = (Rot(r) • a) = k∈[n] r k • a k . Using that a = V T Ω • s = ( j∈[t] s j • ω k-1 ij ) k∈[n] gives for ∈ [n] that (r • a) = k∈[n] r k   j∈[t] s j • ω k-1 ij   = j∈[t]   k∈[n] s j r k ω k- ij   ω -1 ij = j∈[t] s j ω -1 ij ,
where

s j = k∈[n] s j r k ω k- ij ∈ Z q . Thus, r • a = V T Ω • s , where s = (s j ) j∈[t] and finally r • a ∈ Λ q (V Ω ).
In contrast to the standard LWE problem, we do not define a variant of the PV-LWE problem in the so-called Hermite Normal Form, where the secret follows the same distribution as the error, since this variant is easy to solve. More precisely, let b = V T Ω • s + e. As the first column of V Ω is the vector that only contains 1's, the first coefficient of b is simply the sum of the coefficients of s plus the first coefficient of e. If s and e are small, so is the first coefficient of b, making it trivially distinguishable from uniform.

PASS Problem

We now present a leaky variant of dec-PV-Knap that we call the PASS problem, as it is used as the underlying hard problem of PASS Encrypt (from Chapter 7). As opposed to the problems before, it does not only make use of the partial Vandermonde transform V Ω , but simultaneously also uses its complement V Ω c . Definition 5.5 (PASS Problem): Given n, t, q as above defining the set P t . Let ψ f , ψ r and ψ s be distributions over Z n . The problem PASS ψ f ,ψr ,ψs asks to distinguish the following two cases, when given

(V Ω f, b, V Ω c r, V Ω c s) ∈ Z t q 2 × Z n-t q 2 .
In the first case Ω ← U (P t ), f ← ψ f , r ← ψ r , s ← ψ s and b = V Ω (f • r + s). In the second case, the only difference is that b ← U (Z t q ).

Let ψ denote the distribution of a = f • r + s. Intuitively, the vector a can be seen as the secret of an instance (V Ω , b) of dec-PV-Knap ψ , where we are given additional information in the form of V Ω f, V Ω c r and V Ω c s, which we interpret as some leakage on the secret a. It is clear that this problem is easier than the standard dec-PV-Knap. In Chapter 7 in Section 7.3.3 we provide some refined analysis on the concrete hardness of PASS.

Equivalence of PV-Knap and PV-LWE

We now show the equivalence of the problems PV-Knap and PV-LWE for the special case of powerof-2 cyclotomics. Let ν be a power of two, n = ν/2 and t = n/2. As before, q is set to be a prime such that q = 1 mod ν. Further, let ω be a primitive ν-th root of unity modulo q and γ = ω 2 be a primitive n-th root of unity modulo q. We sample Ω ← U (P t ), and as ν is a power of two, the set Ω only contains odd powers of ω. We denote by Ω c := {ω j : j ∈ Z × ν } \ Ω the complement set, which also only contains odd powers of ω. Additionally, we define inv(V Ω ) ∈ Z t×n q as the matrix whose (j, )-th element is the inverse in Z q of the (j, )-th element of V Ω for j ∈ [t] and ∈ [n]. Since inv(V Ω ) is just V inv(Ω) , where inv(Ω) is the set of inverses of the elements of Ω, we write V inv(Ω) instead of inv(V Ω ) in the following. Given n, q, Ω as above, defining V Ω and V Ω c . It yields

V Ω • V T inv(Ω c ) = V Ω c • V T inv(Ω) = 0 ∈ Z t×t q .
Proof: We show the first part, the second follows in an analogue manner. For j, ∈ [t], the entry of the j-th row and the -th column of the matrix product

V Ω • V T inv(Ω c ) is given by k∈[n] ω j • ω -1 k-1 = k∈[n] ω ij • ω -i k-1 = k∈[n] ω u k-1 = k∈[n] (γ v ) k-1 ,
where ω j = ω ij ∈ Ω and ω = ω i ∈ Ω c and thus 0 = i ji = u, with u = 0 mod 2. We can thus write u = 2v for some non-zero integer v and deduce that ω u = γ v . The last geometric sum

T := k∈[n] (γ v ) k-1 satisfies (1 -γ v ) • T = 1 -(γ v ) n .
As γ is a primitive n-th root of unity and 0 < v < n, we have that γ v is an n-th root of unity and γ v = 1, so the last sum T = 0.

choice of s) and error a sampled from ψ, as required. In the random case b ← U (Z t q ), b is uniformly random in Z n q since v is in the uniformly random coset of Λ ⊥ q (V Ω ) defined by b, and b is also uniformly random in this coset thanks to the uniformly random s . Therefore, the advantage of B is the same as that of A.

Lemma 5.5 (From PV-LWE to PV-Knap)

Let n be a power of two and t = n/2. Further, let ψ denote a distribution over Z n . There is a PPT reduction from the problem PV-LWE ψ to dec-PV-Knap ψ .

Proof: Given an efficient algorithm A for dec-PV-Knap ψ , we build an efficient algorithm B for PV-LWE ψ , that is given an instance (V Ω , b) with either b = V T Ω • s + e mod q or b ← U (Z n q ), where Ω ← U (P t ), s ← U (Z t q ) and e ← ψ. With the same argumentation as above, we define

V Ω = V inv(Ω c ) fulfilling V Ω • V
T Ω = 0 mod q and following the uniform distribution over P t . The algorithm B then computes b = V Ω • b and runs A on input (V Ω , b ), returning whatever A returns. We now argue that in the real case b = V T Ω • s + e mod q, then (V Ω , b ) is a valid real case instance of dec-PV-Knap ψ . Indeed, using Lemma 5.3, we have b =

V Ω (V T Ω • s + e) = V Ω • e, with e ← ψ. In the random case b ← U (Z n q ), b is uniformly random in Z t
q , as the matrix V Ω has full rank t. Hence, B has the same advantage as A.

Efficient Computation of Partial Vandermonde Transform

In Chapter 7, we introduce an encryption scheme whose security is based on the hardness of dec-PV-Knap and PASS. This is why it works with polynomials in the finite ring R q = Z q [x]/ x n + 1 , where n is a power of 2. In order to implement this scheme efficiently, it is crucial to select a well-suited encoding for those mathematical objects. As former works on structured variants of SIS and LWE (e.g. [START_REF] Alkim | Post-quantum key exchange -A new hope[END_REF]), we choose the Number Theoretic Transformation (NTT) to encode those in quasi-logarithmic time.

In this section, we argue that the NTT can also be used for the partial Vandermonde transform. More precisely, we show that the multiplication of the partial Vandermonde transformation matrix V Ω ∈ Z t×n q by an element f ∈ R can be done efficiently by using a t-point NTT in the special case where K = Q(ζ) is a power-of-2 cyclotomic field and where V Ω and V Ω c are set as the odd and even rows of V, respectively. Thus, t becomes the important asymptotic parameter. This corresponds to our observations about the concrete security presented later in Section 7.3.

We remark that in this case, we fix the matrix V Ω instead of choosing it at random. A designer of a public key encryption scheme may prefer to increase the entropy of their scheme via the randomness over the choice of V Ω by selecting at random a subset Ω of size t. By doing so, they have to accept the higher costs of computing a (partial) n-point NTT instead of a t-point NTT.

In the following, we briefly recall the basic definition of the NTT. For more details on the NTT and the description of fast software implementations in quasi-logarithmic time we refer to [START_REF] Güneysu | Software speed records for lattice-based signatures[END_REF]. Let f be a polynomial in R q = Z q [x]/ x n + 1 and let γ be a n-th primitive root of unity modulo q. For k ∈ {0, . . . , n -1}, the k-th coefficient of the n-point NTT of f is defined as NTT(f) k = n-1 j=0 f j γ kj . 4 In an analogue manner, for t = n/2 and ξ = γ 2 a t-th primitive root of unity modulo q, and g ∈ Z q [x]/ x t + 1 , the k-th coefficient of the t-point NTT of g is defined as NTT(g) k = t-1 j=0 g j ξ kj , where k ∈ {0, . . . , t -1}.

Computation of the Partial Vandermonde Transformation

Let ν be a power of 2, n = ϕ(ν) = ν/2 and t = n/2. Further, let q ∈ Z be a prime such that q = 1 mod ν, thus the ν-th cyclotomic polynomial x n + 1 totally splits over Z q . Let ζ = exp(-2πi/ν) be a complex primitive ν-th root of unity defining the ν-th cyclotomic number field

K = Q(ζ) ∼ = Q[x]/ x n + 1 with its ring of integers given by R = Z[ζ] ∼ = Z[x]/ x n + 1 .
We further pick a primitive ν-th root of unity modulo q and denote it by ω. We also set γ = ω 2 as a primitive n-th root of unity modulo q and ξ = γ 2 = ω 4 as a primitive t-th root of unity modulo q.

We define Ω = {ω j : j = 4k + 1, k ∈ {0, . . . , t -1}} and Ω c = {ω j : j = 4k + 3, k ∈ {0, . . . , t -1}}, both sets of size t and disjoint. The union Ω ∪ Ω c is the set of size n of all primitive ν-th roots of unities modulo q. Thus, V Ω and V Ω c are composed by the odd and even rows of V, respectively. For every k ∈ {0, . . . , t -1} it yields

V Ω • f k = n-1 j=0 ω (4k+1)j f j = t-1 j=0 ω j f j ω 4kj + t-1 j=0 ω j+t f j+t ω 4k(j+t) = t-1 j=0 ω j f j + ω j+t f j+t ξ kj ,
where we use that ω 4kt = (ξ t ) k = 1 for all k ∈ {0, . . . , t -1}, as ξ is a primitive t-th root of unity modulo q. This corresponds to the k-th coefficient of the t-point NTT of g with g j = ω j f j + ω j+t f j+t , where we coefficient-wise multiply f j with powers of ω in a pre-processing step. The pre-processing step requires 2t = n multiplications and t additions. In an analogue manner, we can see that for every k ∈ {0, . . . , t -1}

V Ω c • f k = n-1 j=0 ω (4k+3)j f j = t-1 j=0 ω 3j f j ω 4kj + t-1 j=0 ω 3j+t f j+t ω 4k(j+t) = t-1 j=0 ω 3j f j + ω j+t f j+t ξ kj .

Computation of the Transposed Partial Vandermonde Transformation

In this section we show that the multiplication of the transposed partial Vandermonde transformation matrix V T Ω ∈ Z n×t q with an element s ∈ Z t q can also be done efficiently by using the NTT of s. Again, we assume that V Ω and V Ω c are composed of the odd and even rows of V, respectively. More precisely for every k ∈ {0, . . . , n}

V T Ω • s k = t-1 j=0 s j ω k(4j+1) = ω k t-1 j=0 s j ξ kj .
For k ∈ {0, . . . , t -1}, this obviously corresponds to a t-point NTT, were we do an additional multiplication by ω k for every coefficient. For k ∈ {t, . . . , n -1}, we use again that ξ t = 1 to see that (V

T Ω •s) k = ω t •(V T Ω •s) k-t .
Thus, with the help of t further multiplications, we obtain the last t 4 The difference of the NTT transform (NTT(f) k ) k∈{0,...,n-1} ∈ Z n q and the discrete Vandermonde transform V • f ∈ Z n q is quite subtle. In the first case we sum over the powers γ 0 , . . . , γ n-1 , where γ is a n-th primitive root of unity, and in the second case we sum over the powers ω 0 , . . . , ω n-1 , where ω is a 2n-th primitive root of unity.

Our Contributions

In order to show the usefulness of our newly defined hardness assumption MP-CLWR for cryptography, we present in the following a Public Key Encryption (PKE) scheme whose hardness is implied by MP-CLWR. Its design is simultaneously inspired by two existing PKE schemes: on the one hand, the PKE scheme from Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF] whose security is based on MP-LWE; and on the other hand, the PKE scheme from Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF] whose security is based on the hardness of Computational Learning With Rounding Over Rings.

The attractiveness of our encryption scheme stems from the fact that we only have to round the middle-product of two polynomials instead of sampling Gaussian error during public key generation while guaranteeing the same security and having the same asymptotic key and ciphertext sizes as the PKE scheme of [START_REF] Roşca | Middle-product learning with errors[END_REF]. Furthermore, we save in bandwidth, as the second part of the public key is modulo p and not modulo q, where p ≤ q by some order of magnitude. In Section 6.4.1, we provide a more detailed comparison between both PKE schemes. Furthermore, we provide in Section 6.4.2 a study of the concrete security of our scheme by looking at the currently best known attacks against it.

Related Work

Since its introduction in 2017, MP-LWE served as the underlying hardness assumption for several cryptographic primitives: from basic encryption [START_REF] Roşca | Middle-product learning with errors[END_REF] and signature schemes [BDH + 20] to lattice trapdoors and identity-based encryption [START_REF] Lombardi | Lattice trapdoors and IBE from middle-product LWE[END_REF] and more advanced hierarchical identity-based encryption [START_REF] Le | Trapdoor delegation and HIBE from middle-product LWE in standard model[END_REF] and ring signatures [START_REF] Das | Ring signatures based on middle-product learning with errors problems[END_REF]. The public key encryption scheme Titanium [START_REF] Steinfeld | Titanium: Proposal for a nist postquantum public-key encryption and kem standard[END_REF], which was submitted to the NIST standardization process, is basing its hardness on MP-LWE. Sakzad et al. [START_REF] Steinfeld | Practical mp-lwe-based encryption balancing security-risk versus efficiency[END_REF] further improved practical aspects of PKE schemes based on the MP-LWE problem by providing a tighter security reduction and a more accurate cryptanalysis. It can be seen as an optimization of the originally proposed scheme by Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF]. To the best of our knowledge, we are the first and only ones who constructed an encryption scheme whose security is based on the Middle-Product Learning With Rounding variant. Regarding the standard Learning With Rounding problem, due to its simplicity and efficiency, several encryption schemes such as SABER [START_REF] D'anvers | Saber: Modulelwr based key exchange, cpa-secure encryption and cca-secure KEM[END_REF] (third round) and Round5 [BBF + 19] (second round) participating in the NIST standardization process are basing their hardness on (structured variants of) decision LWR.

Roadmap

The rest of the chapter is structured as follows. We start with recalling a reconciliation mechanism in Section 6.2, which serves to obtain correctness of our encryption scheme. In Section 6.3, we define the scheme, then prove its correctness in Section 6.3.1 and prove its security based on the hardness of MP-CLWR in the ROM in Section 6.3.2. Finally, in Section 6.4 we provide asymptotic parameters and explain how to analyze the best known attacks against our scheme, which can be used to derive concrete parameters.

Reconciliation

Reconciliation is a method used by two parties to agree on a secret bit, when they only share a common value up to an approximation factor. As for the PKE scheme of Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF], we need a reconciliation mechanism in order to guarantee the correctness of our scheme. Lemma 6.3 (Correctness) Let t, k, p ∈ N be part of the public parameters of the encryption scheme from above. Assume that p > 8t(k + 1). For every plaintext m ∈ M and key pair (pk, sk) ← KGen(1 λ ), we have Pr[Dec(sk, Enc(pk, m)) = m] = 1.

Proof: In order to prove the correctness of the scheme, we need to guarantee that the reconciliation mechanism succeeds. Actually, this step is independent of the message. Following Lemma 6.1 (and for q odd Lemma 6.2) it suffices to show that wv ∞ < q/8. It yields

v = j∈[t] r j d li (b j ) = j∈[t] r j d (a j d+k s + e j ) = j∈[t] (r j a j ) d s + j∈[t] r j d e j = c 1 d s + j∈[t] r j d e j = w + j∈[t]
r j d e j , where for j ∈ [t] the error term e j with e j ∞ < q/p is determined by the lifting function li (•).

In the third equation we used the associativity law of the middle-product Lemma 1.24. Thus it suffices to have

j∈[t]
r j d e j ∞ < q/8. For j ∈ [t] each coefficient of r j d e j can be seen as the inner product u, v of a binary vector u of dimension k + 1 and a vector v also of dimension k + 1, where each coefficient has magnitude ≤ q/p. Notice that we have

| u, v | ≤ u 2 • v 2 ≤ √ k + 1 • (k + 1) • q 2 /p 2 = (k + 1)q/p.
Hence, it yields

j∈[t] r j d e j ∞ ≤ j∈[t]
r j d e j ∞ ≤ t(k + 1)q/p.

As p > 8t(k + 1), we have t(k + 1)q/p < q/8 which guarantees that the reconciliation mechanism succeeds.

Security

In this section, we prove the security of the PKE scheme defined above based on the hardness of MP-CLWR in the ROM. We use the standard notion of IND-CPA security whose proper definition we recall in Definition 1.20. The high level idea of the security proof is the following. We first define a game, which we call REC-COMP, where the adversary has to compute the output of the reconciliation mechanism by only having access to some related information. We then embed the IND-CPA security game into the REC-COMP game. In other words, the adversary of the latter is at the same time the challenger of the first. To this end, we use that a message is encrypted by evaluating a random oracle H on exactly this value and bit-wise XOR-ing it with the message. An adversary who can distinguish the two encrypted messages from the IND-CPA game has to query the random oracle H on the corresponding input at some point. And thus, the challenger of the IND-CPA game, who also simulates the random oracle, can use this query to solve the REC-COMP challenge. That is to say, the random oracle helps to transform a distinguishing game (the IND-CPA security game) into a computational game (the REC-COMP game).

Before stating and proving the security of our scheme, we prove that the following hash function family using the middle-product is universal. Recall the Definition 1.7 of universal families of hash functions in Section 1.3.5. Further recall that li (•) denotes the probabilistic lifting function from Z p [x] to Z q [x] for two integers p and q with 2 ≤ p ≤ q (see Section 1.4.5). Lemma 6.4 (Universal Family of Hash Functions)

Let q, k, d, p, t ∈ N such that k, d ≥ 2 and 2 ≤ p ≤ q. For (b j ) j∈[t] ∈ (Z <d+k p [x]) t , we define h (bj)j : {0, 1} <k+1 [x] t → Z <d q [x], where (r j ) j → j∈[t]
li (b j ) d r j .

The hash function family (h (bj)j ) (bj)j is universal.

Proof: The proof is very similar to the one of [RSSS17, Lemma 4.2]. We simply replace b j by li (b j ), using the same argument to show that Pr

(bj)j←U (Z <d+k p [x]) t   j∈[t] li (b j ) d r j = j∈[t] li (b j ) d r j   = 1 q d ,
with (r j ) j = (r j ) j .

We can now prove the security of our scheme. Lemma 6.5 (Security)

Let λ be the security parameter and k, d, n, p, q, t ∈ N such that d + k ≤ n and q ≥ p ≥ 2. Assume that t ≥ (2 • λ + (k + d + n) • log 2 q)/(k + 1). The PKE scheme above is IND-CPA secure in the ROM under the MP-CLWR p,q,n,d+k,t hardness assumption. If the random oracle H was not queried on the value of v 2 ∈ {0, 1} d during the game, the adversary A can only guess the randomly chosen bit b with success probability 1/2. Thus, we can assume that a successful adversary (with success probability non-negligibly larger than 1/2) has queried H on this spe-cific value. Subsequently, we can use a successful adversary A of the IND-CPA security game to construct a successful adversary A which outputs v 2 , given the first two parts (c 1 , c 2 ) of any ciphertext c = (c 1 , c 2 , c 3 ). These first two parts are independent of the message to encrypt. We call this the REC-COMP game, as it yields c 2 = v 2 and thus c 1 and c 2 are connected via the reconciliation mechanism REC. In Protocol 6.2 we illustrate how the IND-CPA security game is nested into the REC-COMP game. The adversary A in the latter plays simultaneously the role of the challenger in the former. Note that the REC-COMP game asks the adversary to compute something, whereas the IND-CPA game asks the adversary to distinguish something. By using the random oracle H (simulated by A ) to encrypt a message, we can use a successful distinguisher in order to obtain a successful computer.

During the IND-CPA game, A answers the random oracle queries of A by maintaining an input-output table for H . For each query, A first checks if H was already programmed on the queried input. If yes, they output the corresponding hash value, otherwise they choose a fresh random value and set H accordingly. Assuming A has non-negligible advantage to win the IND-CPA security game, it must have queried H on v 2 , hence A can look up the pair ( v 2 , r) with r = H ( v 2 ) in the random oracle table.

Game-based proof. As a next step, we show that the probability of A to win is negligible under the MP-CLWR assumption, which in turns implies the IND-CPA security of our encryption scheme. We consider the following sequence of games, where in all games a j ← U (Z <n q [x]) for j ∈ [t] and the secret s is chosen via s ← U (Z <n+d+k-1

q [x]) × .
Further, we sample r j ← U ({0, 1} <k+1 [x]) for j ∈ [t] and set the first part of the ciphertext as c 1 = j∈[t] r j a j mod q.

The adversary A receives in each game the tuple (1 λ , pk, c 1 , c 2 ) and its target is to compute v 2 , where v is specified by each game separately.

Game 1: Set b j = a j d+k s p , pk = (a j , b j ) j , v = j li (b j ) d r j mod q, and c 2 = v 2 , Game 2: Set b j ← U (Z <d+k q [x]) p , pk = (a j , b j ) j , v = j li (b j ) d r j mod q, and c 2 = v 2 ,

Game 3: Set b j ← U (Z <d+k q [x]) p , pk = (a j , b j ) j , v ← U (Z <d q [x]
), and c 2 = v 2 .

Third game. Note that in the last game, c 1 and c 2 are independent and hence the probability that A outputs v 2 ∈ {0, 1} d is exactly 1/2 d , using Lemma 6.1 (and Lemma 6.2 for q odd).

From third to second game. Furthermore, the second and third game are within exponentially small statistical distance, using the Generalized Leftover Hash Lemma from Section 1.3.5. In more details, the statistical distance of the two distributions of ((a j , b j ) j , c 1 , v) in Game 2 and Game 3 is given by

∆     (a j , b j ) j , j∈[t] r j a j , j∈[t] r j d li (b j )   ,   (a j , b j ) j , j∈[t] r j a j , v     ≤ 2 -λ ,
where for all j ∈ [t] the polynomials a j , b j , r j and v are chosen uniformly at random

in Z <n q [x], Z <d+k q [x]
p , {0, 1} <k+1 [x] and Z <d q [x], respectively. Note that the randomness of the family of hash functions (h (bj)j ) (bj)j comes from the randomness of (b j ) j and since Lemma 6.4

shows that (h (bj)j ) (bj)j is universal we can use Lemma 1.22. Thus, using the assumptions made on the parameters, the statistical distance is bounded above by

1 2 • 2 -(k+1)t • q k+n+d ≤ 2 -λ .
From second to first game. The first and second game differ only in the way how the b j are computed. In the first game, b j is a rounded middle-product sample and in the latter one, it is a rounded uniform sample. We can interpret this situation as two different experiments, see Protocol 6.3.

Recall from Definition 4.3 that X t s denotes the distribution of (a j , a j d s p ) j∈[t] , where we choose the a j ← U (Z <n q [x]) independently and sample a fixed secret element s ← U (Z <n+d+k-1 q [x]) × . Further, we denote by U t the distribution of (a j , b j p ) j∈[t] , where we choose the a j ← U (Z <n q [x]) and the b j ← U (Z <d+k q [x]) independently. In addition, con is an arbitrary distribution over {0, 1} * which is independent from X t s and U t . The Input 1 of the first experiment Exp 1 (C, A, S 1 ) is given by (1 λ , pk, c 1 , v 2 ), where v = j li (b j ) d r j with b j = a j d+k s p . On the other hand, the Input 2 of the second experiment Exp 2 (C, A, S 2 ) is defined by (1 λ , pk, c 1 , v 2 ), where we still have v = j li (b j ) d r j but this time with b j ←

U (Z <d+k q [x])
p . The Target is in both cases the same, namely v 2 .

According to the MP-CLWR assumption, if the success probability for any A to output the requested v 2 is negligible when b

j ← U (Z <d+k q [x]) p , it is also negligible when b j is an MP-LWR instance.
First game. Note that Game 1 corresponds to the REC-COMP game above. Combining the arguments above shows that the success probability of A is negligible under the MP-CLWR assumption, completing the security proof of our PKE scheme. Protocol 6.2: Nesting the IND-CPA security game into the REC-COMP game

C REC-COMP A REC-COMP /C IND-CPA A IND-CPA (pk, sk) ← KGen(1 λ ) (c 1 , c 2 , * ) ← Enc(pk, * ) 1 λ ,pk,c1,c2 -----------→ 1 λ ,pk ------→ m 0 , m 1 ← {0, 1} k b ← {0, 1} m0,m1 ← ------- r ← {0, 1} k c=(c1,c2,r⊕m b ) ---------------→ look up v 2 in H b ← -- v 2 ← ----- such that H ( v 2 ) = r
n ≥ λ ≥ λ c > 0 > 0 k n/2 n/2 d n/2 n/2 t Θ(log 2 (n)) Θ(log 2 (n)) q Θ(n 2.5+c log 2 (n)) Θ(n 4+c log 2 (n) 2 ) log 2 (q) Θ(log 2 (n)) Θ(log 2 (n)) α Θ 1 n √ log 2 (n) - p - Θ(n log 2 (n)) B - O(n 2+c ) Key size sk (n + d + k -1) • log 2 (q) (n + d + k -1) • log 2 (q) pk t • ((n + d + k) log 2 (q)) t • (n log 2 (q) + (d + k) log 2 (p)) Ciphertext size c 1 (n + k) log 2 (q) (n + k) log 2 (q) c 2 d log 2 (q) d c 3 - k
However, the PKE scheme of [START_REF] Roşca | Middle-product learning with errors[END_REF] is provably secure in the standard model, whereas our proof is in the ROM.

Concrete Security

Unfortunately, neither the security proof in Lemma 6.5 nor the asymptotic parameters from above give guidance on the choice of concrete parameters and on the concrete security they provide for the encryption scheme. Parameter derivation is indeed an active research topic for latticebased cryptography, for both the construction of cryptographic protocols and cryptanalysis, e.g., [APS15, ADPS16, ACD + 18]. As explained in Section 1.4.6, in practice it is common to derive the concrete parameters for LWE-based schemes by looking at the cost of the best known attacks, such as BKZ with quantum sieving, in the so-called core SVP model, see for instance [START_REF] Alkim | Post-quantum key exchange -A new hope[END_REF]. Note that those derived parameters don't necessarily fulfill the conditions of the security proof of Lemma 6.5.

In the following, we highlight two approaches for our PKE scheme. The first one interprets the public key as an instance of LWE by proceeding as follows: The public key of our scheme provides an instance of MP-LWR, which is in a first step interpreted as an instance of MP-LWE and in a second step analyzed as an instance of LWE. The second approach is a dual lattice attack on the public key, that uses the weak associativity law of the middle-product.

Public Key as LWE Instance

Step 1: From MP-LWR to MP-LWE. In our scheme from Section 6.3, the public key is given as pk = (a j , b j ) j∈ [t] , where b j = a j d+k s p for a j ← U (Z <n q [x]) and s ← U ((Z <n+d+k-1 q [x]) × ) for j ∈ [t]. In order to interpret this MP-LWR instance as an MP-LWE instance, it suffices to lift the second part from Z <d+k p [x] to R <d+k q [x] by multiplying it with q/p. This introduces a socalled rounding noise, as explained in Section 1.4.5. Hence, the public key defines the following equation q/p • b j = a j d+k s + e j , (6.1) where e j is an element of R <d+k q

[x] with e j ∞ ≤ q/p.

Step 2: From MP-LWE to LWE. We analyze the hardness of solving an MP-LWE instance by interpreting it as an LWE instance, as for today, the best known attacks don't make use of the underlying structure. This is also true for other structured variants such as P-LWE, R-LWE or M-LWE.

In Section 1.4.4, we saw that the middle-product of two polynomials can be expressed in terms of a matrix-vector product using special product matrices T, see Definition 1.14 and Lemma 1.25. Thus, given Equation 6.1 from above, it yields

q/p • rev(b j ) = T d+k,n (a j ) • rev(s) + e j , (6.2)
where rev(b j ) and rev(s) are the coefficient vectors of b j and s in reverse order. By ignoring the structure of T d+k,n and interpreting it as random matrix A j ∈ Z (d+k)×(n+d+k-1) q this gives the final LWE equation bj

= A j • s + e j , (6.3)
where bj = q/p • rev(b j ) and s = rev(s). Globally speaking, to analyze an instance of LWE, there are two type of attacks: The primal and the dual attack. The high level idea of the primal attack is to recover the LWE secret, exploiting that it is part of an unusually short vector in a given lattice specified by the LWE instance. In contrast, the attacker can use the dual attack to first find a short vector in the dual lattice and then use this short vector to decide whether a given instance is an LWE instance or drawn from the uniform distribution.

To conclude on the concrete security estimations, one can use the LWE Estimator [APS15] or the more recent Leaky LWE Estimator [START_REF] Dachman-Soled | LWE with side information: Attacks and concrete security estimation[END_REF] by plugging in some concrete values for q, n, d, k, p and t and gradually adapt them to obtain the aimed security level. Note that the requirements of Lemma 6.3 should be met in order to guarantee the correctness of the scheme.

Dual Attack against Public Key

As opposed to the previous approach, where the attacker tries to recover the secret key from the public key via interpreting it as an instance of LWE, the attacker can directly use the dual attack to first find a short vector in the dual lattice and then use this short vector to decide whether a given instance is an MP-LWR instance or drawn from the uniform distribution. Note that this technique attacks the decision problem, which is not directly used in our scheme. However, in order to deepen our understanding of the scheme's security, it is interesting to study this attack as well.

Recall that the public key a j , b j j∈[t] defines the Equation 6.1. Now, we consider the following lattice

Λ q (a 1 , . . . , a t ) =    (x 1 , x 2 , . . . , x t ) T ∈ Z <k+1 [x] t : j∈[t] x j • a j = 0 mod q    .
If the adversary is able to find a short lattice vector x = (x 1 , . . . , x t ) T in Λ q (a 1 , . . . , a t ), they can use it to distinguish uniform samples from MP-LWR samples by computing the sum

j∈[t] x j d (q/p • b j ) = j∈[t] x j d a j d+k s + e j = j∈[t] x j • a j d s + j∈[t]
x j d e j = j∈[t]

x j d e j .

In the second equation we use the weak associativity of the middle-product from Lemma 1.24. As the x j and the e j are all polynomials with small coefficients, the sum of their product j x j d e j has (relatively) small coefficients as well. On the other hand, if b j are uniform elements, the sum j x j d e j is a polynomial with uniform coefficients, and thus the adversary can distinguish the public key from uniform samples. We refer to [START_REF] Micciancio | Lattice-based cryptography[END_REF] for the details of the concrete parameter setting for which this attack works.

Concrete Parameters

In the original paper published in the proceedings of Asiacrypt 2019 [BBD + 19], we also provide concrete sample parameters for our scheme (and for the scheme of Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF]). As this part of the research was mainly done by the co-author Zhenfei Zhang, we refer to the given parameters there. We would like to notice that those parameters may have become outdated as the work by Sakzad et al. [START_REF] Steinfeld | Practical mp-lwe-based encryption balancing security-risk versus efficiency[END_REF] provides tighter cryptanalysis for schemes based on MP-LWE which most certainly carries over to the rounding setting. As already stated in the original article, we leave a more efficient instantiation and dedicated cryptanalysis to future work.

the positive side, the algebraic structure of the Vandermonde matrix equips PASS Encrypt with additive and multiplicative homomorphic properties. On the negative side, the scheme comes without a security proof with respect to the hardness of explicit computational problems, and the scheme is deterministic and thus cannot satisfy the standard notion of IND-CPA security. In our slightly modified version of PASS Encrypt, we first move from the Fourier to the Vandermonde transform, as done for PASS Sign by Lu et al. [START_REF] Lu | Practical signatures from the partial fourier recovery problem revisited: A provably-secure and gaussian-distributed construction[END_REF]. The Fourier transform is defined by the powers of all roots of unity, whereas the Vandermonde transform only by the powers of all primitive roots of unity. This change is motivated by the fact that the discrete Fourier transform always maps the all-1 vector to zero and thus partial Fourier SIS3 is trivially easy. In contrast, our setting does not allow the same trivial solution to partial Vandermonde SIS. For completeness, we explain how to solve partial Fourier SIS in Section 7.3.4. Second, we make the scheme probabilistic by adding randomness to the message. We then give a proof of correctness (Lemma 7.1) for well-chosen parameters and a proof of security (Lemma 7.2), assuming the hardness of dec-PV-Knap and PASS. A refined analysis of the security of PASS Encrypt is provided in Section 7.3. In particular, we show a novel attack that we call Plaintext Recovering Using Hints attack, which takes the structure of PASS Encrypt into account. It is inspired by the recent work of Dachman-Soled et al. [START_REF] Dachman-Soled | LWE with side information: Attacks and concrete security estimation[END_REF] on exploiting hints that are given on a LWE secret or noise. Our complexity estimates for this attack show that it does not reduce the attack complexity below that of previously known lattice algorithms on PASS Encrypt, which increases our confidence in its claimed security against best known lattice attacks. We conclude the chapter by providing concrete sample parameters and compare our version of PASS Encrypt with two other efficient schemes whose security proofs are based on structured lattice problems.

Related Work

To the best of our knowledge, PASS Encrypt is the only encryption scheme that uses the partial Vandermonde transformation matrix V Ω and its complement V Ω c . As we mention in Chapter 5, PASS Encrypt is inspired by a signature scheme, called PASS Sign, which also uses the partial Vandermonde matrix V Ω . It was originally introduced by Hoffstein et al. [HPS + 14] and equipped with a rigorous security proof by Lu et al. [START_REF] Lu | Practical signatures from the partial fourier recovery problem revisited: A provably-secure and gaussian-distributed construction[END_REF]. From a high level perspective, PASS Sign is an adaptation of Lyubashevsky's Fiat-Shamir with aborts signature [START_REF] Lyubashevsky | Fiat-shamir with aborts: Applications to lattice and factoringbased signatures[END_REF][START_REF] Lyubashevsky | Lattice signatures without trapdoors[END_REF] to the partial Vandermonde setting. In contrast to PASS Encrypt, the signature scheme does not make use of the complement partial Vandermonde matrix V Ω c and hence the novel attack that we present in this chapter does not apply to it. Nevertheless, it still benefits from the homomorphic properties of V Ω which are used in a more recent work by Doröz et al. [START_REF] Doröz | MMSAT: A scheme for multimessage multiuser signature aggregation[END_REF] to build a compact lattice-based aggregate signature scheme.

Roadmap

The rest of the chapter is structured as follows. We start in Section 7.2 with presenting the slightly modified version of PASS Encrypt, then prove its correctness and its security based on the hardness of decision PV-Knap and PASS. Furthermore, we demonstrate its additive and multiplicative homomorphic properties. Later, in Section 7.3 we provide an analysis of its security against known attacks before giving concrete sample parameters in Section 7.4 and a comparison with two other lattice-based encryption schemes.

PASS Encrypt

In the following, we use the same notation as in Chapter 5, that we quickly recall here. For simplicity, we focus on power-of-2 cyclotomics. Let ν be a power of 2 and q be a prime such that q = 1 mod ν. Further, we set n = ν/2 and t = n/2. There are exactly n primitive ν-th roots of unity over Z q and for the key generation of our scheme we need to choose at random t (i.e., half) of them. To this end, we denote by P t the set of all subsets Ω of size t of all primitive ν-th roots of unity over Z q . Every Ω defines the corresponding partial Vandermonde matrix V Ω and its complement V Ω c . Let ψ f , ψ r , ψ s be distributions over Z n . Recall that we denote by + and • component-wise addition and multiplication of vectors over Z q . The message space M is given by {0, 1} n , and we select a message m ∈ M. Finally, let p be a small prime which is coprime to q and let λ denote the security parameter. Protocol 7.1: Our slightly modified version of PASS Encrypt.

KGen(1 λ ).

Sample f ← ψ f and Ω ← U (P t ),

return sk = f ∈ Z n , pk = (Ω, V Ω f) ∈ Z t q × Z t q . Enc(pk, m). Sample r ← ψ r , s ← ψ s , set r = pr and m = ps + m, set e = (V Ω r • pk) + V Ω m set e = V Ω c r , set e = V Ω c m , return c = (e, e , e ) ∈ Z t q × Z n-t q × Z n-t q . Dec(sk, c).
Compute c = e • V Ω c sk + e ∈ Z n-t q , using knowledge of Ω and Ω c combine e and c to obtain c as a vector over Z n q , return V -1 c mod p.

We now describe our slightly modified version of PASS Encrypt, as summarized in Protocol 7.1. During key generation, we sample f from the distribution ψ f , defining the secret key sk = f ∈ Z n . Then, we sample Ω ∈ Z t q uniformly at random over the set P t , which determines the public key pk = (Ω, V Ω f) ∈ Z t q × Z t q , where the second part is the partial Vandermonde transform of f evaluated at the roots given by Ω. In order to encrypt a message m ∈ M, we sample two random vectors r ← ψ r and s ← ψ s , which define r = pr and m = ps + m. This randomizes the message vector and thus converts PASS Encrypt from a deterministic in a randomized scheme. The ciphertext c is then given by three elements. The first is e = (V Ω r • pk) + V Ω m ∈ Z t q , using the partial Vandermonde matrix V Ω . And the other two are given by e = V Ω c r ∈ Z n-t q and e = V Ω c m ∈ Z n-t q , using the complementary partial Vandermonde matrix V Ω c . In order to decrypt a ciphertext c, we use the secret key sk to first compute c = (e • V Ω c sk) + e ∈ Z n-t q . Now, using the knowledge of Ω and Ω c , we can combine e and c to obtain a full vector c over Z n q . The decryption algorithm then returns V -1 c mod p. We give some sample parameters for PASS Encrypt in Section 7.4 in Table 7.1.

Our version of PASS Encrypt differs in two aspects from the original version as presented in [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF]Sec. 4]. First, they use the partial Fourier transform (that they denote by F S ) instead of the partial Vandermonde transform V Ω , and second, in their case it always yields s = 0 and thus m = m. This makes the third part e of their ciphertext only dependent on m and hence the scheme deterministic. Additionally, the modifications also apply to the second version of the original proposed scheme, see [HS15, Sec. 6].

Correctness

We now show that the PKE scheme defined above is perfectly correct under a proper choice of parameters. See Definition 1.19 for the formal statement of the correctness property of a PKE scheme. Lemma 7.1 (Correctness) Let P t , p and ψ f , ψ r , ψ s be the public parameters of PASS Encrypt. Assume that there exist α, β > 0 such that for f ← ψ f , r ← ψ r and s ← ψ s it yields with probability 1 that f ∞ ≤ 1, r 1 ≤ α and s ∞ ≤ β. Further, we require p(α + β) + 1 < q/2. For every key pair (sk, pk) ← KGen(1 λ ) and message m ∈ M, it holds Pr [Dec(sk, Enc(pk, m)) = m] = 1.

Proof: The decryption oracle first computes c = (e • V Ω c sk) + e ∈ Z n-t q and then combines it with e ∈ Z t q in order to obtain a full vector c ∈ Z n q . To guarantee correctness, we need to make sure that V -1 c = m mod p. Using the definition of sk, e and e it yields

c = V Ω c r • V Ω c f + V Ω c m = V Ω c (r • f + m ).
Simultaneously, using the definition of pk and e it yields

e = (V Ω r • V Ω f) + V Ω m = V Ω (r • f + m ).
In both cases we use the multiplicative and homomorphic properties of V Ω and V Ω c as presented in Section 5.2.1. Thus, combining both c and e provides c = V(r

• f + m ) and thus V -1 c = r • f + m = pr • f + ps + m mod q. Hence, V -1 c mod p = m mod p if pr • f + ps + m ∞ < q/2.
Using the properties of power-of-2 cyclotomics to bound the infinity norm of the product of two elements as presented in Example 1.2 and that m ∈ M = {0, 1} n , it yields

pr • f + ps + m ∞ ≤ p r • f ∞ + p s ∞ + m ∞ ≤ p • f ∞ • r 1 + p s ∞ + m ∞ ≤ pα + pβ + 1.
As we require p(α+β)+1 < q/2, the decryption algorithm decrypts correctly with probability 1.

Security

In this section, we prove the security of PASS Encrypt as defined above based on the hardness of PASS and dec-PV-Knap, both problems are defined in Section 5.2. We use the standard notion of IND-CPA security whose proper definition we recall in Definition 1.20. In order to show the IND-CPA security of PASS Encrypt, we use a common game-hopping argument, as summarized in Protocol 7.2. Game 1 corresponds to the proposed PASS Encrypt.

In Game 2 we change the definition of e, in Game 3 the one of e and last in Game 4 the one of e . Note that in Game 2, 3 and 4 the decryption algorithm does in general not succeed as the ciphertext parts e, e or/and e , when chosen uniformly at random, do in general not possess a small preimage under V Ω or V Ω c , respectively. For the proof of IND-CPA security, however, this does not pose any problem. Protocol 7.2: Game hopping for IND-CPA security of PASS Encrypt.

Game 1

Game 2 KGen: sk

= f ← ψ f , Ω ← U (P t ) sk = f ← ψ f , Ω ← U (P t ) pk = (Ω, V Ω f mod q) pk = (Ω, V Ω f mod q) Enc: r ← ψ r , s ← ψ s r ← ψ r , s ← ψ s r = pr, m = ps + m r = pr, m = ps + m e = (V Ω r • pk) + V Ω m e ← U (Z t q ) e = V Ω c r e = V Ω c r e = V Ω c m e = V Ω c m Game 3 Game 4 KGen: sk = f ← ψ f , Ω ← U (P t ) sk = f ← ψ f , Ω ← U (P t ) pk = (Ω, V Ω f mod q) pk = (Ω, V Ω f mod q) Enc: r ← ψ r , s ← ψ s r ← ψ r , s ← ψ s r = pr, m = ps + m r = pr, m = ps + m e ← U (Z t q ) e ← U (Z t q ) e ← U (Z n-t q ) e ← U (Z n-t q ) e = V Ω c m e ← U (Z n-t q )
Lemma 7.2 (Security) Let P t , p and ψ f , ψ r , ψ s be the public parameters of PASS Encrypt and the message m ∈ M.

Assuming the hardness dec-PV-Knap ψ1 , dec-PV-Knap ψ2 and PASS ψ f ,ψ1,ψ2 , where ψ 1 = p • ψ r and ψ 2 = p • ψ s + m, the encryption scheme as summarized in Protocol 7.1 is IND-CPA secure.

Proof: Note that Game 1 corresponds to the proposed PASS Encrypt. The only difference between Game 1 and Game 2 is the way how e is defined. In the first game, it is a partial Vandermonde transform, given by (V Ω r • pk) + V Ω m = V Ω (r • f + m ), and in the second game it is sampled uniformly at random over Z t q . Notice that pk, e and e are not independent from e, but assuming the hardness of PASS ψ f ,ψ1,ψ2 , with ψ 1 = p • ψ r and ψ 2 = p • ψ s + m, an adversary cannot distinguish between the two games. Now, we are studying the difference between Game 2 and Game 3. Here, the second ciphertext part e is replaced by a uniform element over Z n-t q . We remark, that e is independent from the other two ciphertext parts e and e and also independent from the secret key. Thus, assuming the hardness of dec-PV-Knap ψ1 , an adversary cannot distinguish Game 2 from Game 3.

The only difference between Game 3 and Game 4 is the definition of e . With the same argument, they cannot distinguish Game 3 from Game 4, assuming the hardness of dec-PV-Knap ψ2 .

In the last Game 4, the ciphertext c = (e, e , e ) is independent of the message m and the key pair (sk, pk). Thus, the adversary has no chance to distinguish two ciphertexts in the IND-CPA security game better than to guess.

We would like to emphasize the following connection of PASS Encrypt to ideal lattices. As elaborated in Section 5.2.1, the public key of PASS Encrypt given by the partial Vandermonde transform pk = V Ω f can be seen as a way to specify the coset f+I, where I = ωj∈Ω q, x -ω j is an ideal lattice. Simultaneously, the complement partial Vandermonde transforms V Ω c r and V Ω c m (i.e., the second and third part of the ciphertext of PASS Encrypt) can be seen as a way to specify the cosets r +I and m +I , where I •I = q . In other words, PASS Encrypt allows a formulation directly in the language of ideal lattices.

Homomorphic Properties

In the following, we show that our slight modifications on PASS Encrypt preserve its additive and multiplicative homomorphic properties, as originally demonstrated by Hoffstein and Silverman [HS15, Sec. 5].

Additive Homomorphic

For addition, we can simply sum the different parts of two given ciphertexts to obtain the encryption of the sum of the original messages. To decrypt the sum, we can use the same decryption algorithm as for a single ciphertext.

More precisely, given for a fixed key pair (sk, pk) two ciphertexts c 1 = (e 1 , e 1 , e 1 ) and c 2 = (e 2 , e 2 , e 2 ) on two messages m 1 and m 2 , where during encryption the random ring elements r 1 , s 1 and r 2 , s 2 were used. Then, the element c = (e 1 + e 2 , e 1 + e 2 , e 1 + e 2 ) defines the ciphertext of the message m = m 1 + m 2 with encryption randomness r = r 1 + r 2 and s = s 1 + s 2 . Here, we only use the linearity of matrix-vector products.

Multiplicative Homomorphic

The situation is slightly more complex for multiplication, where an additional cross term has to be provided in the ciphertext in order to enable the decryption of the product of two ciphertexts.

In more details, assume that we are given for a fixed key pair (sk, pk) two ciphertexts c 1 = (e 1 , e 1 , e 1 ) and c 2 = (e 2 , e 2 , e 2 ) on two messages m 1 and m 2 , where during encryption the random elements r 1 , s 1 and r 2 , s 2 were used. In order to provide enough information to recover the product message m 1 •m 2 mod p, we need to transmit in the ciphertext the respective products e = e 1 • e 2 , e = e 1 • e 2 and e = e 1 • e 2 , and additionally a cross term E = e 1 • e 2 + e 2 • e 1 . To decrypt, we use e, e , e , E and the secret key sk to compute

c = e • (V Ω c sk) 2 + E • V Ω c sk + e = V Ω c r 1 • V Ω c r 2 • (V Ω c f) 2 + V Ω c r 1 • V Ω c m 2 • V Ω c f + V Ω c r 2 • V Ω c m 1 • V Ω c f + V Ω c m 1 • V Ω c m 2 = V Ω c (r 1 r 2 f 2 ) + (r 1 m 2 f) + (r 2 m 1 f) + (m 1 m 2 ) .
On the other hand, it yields

e = e 1 • e 2 = (V Ω r 1 • pk) + V Ω m 1 • (V Ω r 2 • pk) + V Ω m 2 = V Ω (r 1 f + m 1 ) • V Ω (r 2 f + m 2 ) = V Ω (r 1 r 2 f 2 ) + (r 1 m 2 f) + (r 2 m 1 f) + (m 1 m 2 ) .
Combining c and e gives the full Vandermonde transform and by applying V

-1 , we obtain c = (r 1 r 2 f 2 )+(r 1 m 2 f)+(r 2 m 1 f)+(m 1 m 2 ) mod q. If c ∞ < q/2, we can compute c mod p = m 1 m 2 mod p = m 1 m 2 mod p.
Here, we use that r j = pr j and m j = ps j + m j for j ∈ {1, 2}.

Security Analysis

We start this section by investigating the concrete security of PASS Encrypt against best known attacks. We present three attacks that we call the Key Recovery (Section Essentially, recovering the secret key sk (resp. the randomness r ) used in the encryption algorithm (see Protocol 7.1) corresponds to solve an instance of PV-Knap with regard to the partial Vandermonde matrix V Ω (resp. the complement partial Vandermonde matrix V Ω c ). However, no attack that aims at recovering the secret vector of the PASS instance given by a ciphertext has been studied so far. This leads us to the third attack, that we call the Plaintext Recovery Using Hints Attack in the following. This novel attack takes the design of PASS Encrypt into account and thus improves our understanding of its security. We then argue why we move from the Fourier to the Vandermonde transform in Section 7.3.4. Furthermore, we show how to interpret the partial Vandermonde LWE and SIS problems in terms of error-correcting codes in Section 7.3.5.

Finally, we give concrete sample parameters and security estimates in Section 7.4 and compare PASS Encrypt with two other efficient lattice-based PKE schemes in Section 7.4.2.

Key Recovery Attack

We now describe the first attack against PASS Encrypt, as already considered in the original proposal [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF]Sec. 7]. We restate it for completeness and rephrase it in the attack framework of LWE as done by Alkim et al. [START_REF] Alkim | Post-quantum key exchange -A new hope[END_REF], using the BKZ algorithm with quantum sieving to solve the associated Unique Shortest Vector Problem (u-SVP, Def. 1.3). The second component of the public key pk of PASS Encrypt is a vector g ∈ Z t q defined as g = V Ω f mod q, where f ← ψ f . We can write V Ω = [A|B] ∈ Z t×n q with A ∈ Z t×(n-t) q and B ∈ Z t×t q , where B has full rank t and thus by multiplying V Ω by the inverse of B, it takes the form [ Ã|I t ] ∈ Z t×n q , for some matrix à ∈ Z t×(n-t) q and I t the identity matrix of order t. Hence, we can transform the equation above to

g = Ã • f 1 + f 2 mod q, (7.1)
where g = B -1 g and f = (f 1 , f 2 ) T with f 1 ∈ Z n-t and f 2 ∈ Z t . Equation 7.1 can be seen as an instance of LWE in its Hermite Normal Form (HNF), as defined in Section 1.4.1, with public matrix à of LWE dimension nt and with t denoting the number of given samples. In doing so, we ignore the known structure of the matrix à and treat it as a uniform random matrix. This is a common approach used in structured lattice-based cryptography as no cryptanalytic technique making use of the algebraic structure is known, for a more elaborated discussion see [ACD + 18]. We proceed as we usually do for LWE (see [START_REF] Alkim | Post-quantum key exchange -A new hope[END_REF] for more details) and rewrite the equation above as à • f 1 + f 2 -g = 0 mod q. This defines an instance of u-SVP in the lattice Λ = Λ( Ã, g) given by Λ

= {(x, y, w) T ∈ Z t × Z n-t × Z : x + Ã • y -wg = 0 mod q}.
A basis of this lattice is given by the column vectors of

C =   qI t -Ã g 0 (n-t)×t I n-t 0 (n-t)×1 0 1×t 0 1×(n-t) 1   ∈ Z (n+1)×(n+1) ,
where for n, m ∈ N, we denote by 0 n×m the n × m matrix composed of zeros. The lattice Λ has full rank n + 1 as it is has an upper triangular form. Further, its determinant is q t , corresponding to the determinant of C. It is easy to see that the vector (f 2 , f 1 , 1) T ∈ Z n+1 lies in Λ, where its norm depends on the distribution ψ f . Assuming that ψ f = U ({-1, 0, 1}), we expect its Euclidean norm to be ≈ 2n 3 . When estimating the expected length of a shortest vector, one can use the Gaussian heuristic, as explained in Section 1.2. More precisely, the Gaussian heuristic for the given lattice Λ with determinant q t and of dimension n + 1 (see Equation 1.2) states that the shortest vector in Λ has Euclidean norm approximately n+1 2πe • q t (n+1) ≈ √ q • n, for t = n/2. This is much larger than the norm of (f 2 , f 1 , 1) T . In other words, we assume that (f 2 , f 1 , 1) T is the unique shortest vector and the second shortest vector has the norm following the Gaussian heuristic. This is an instance of u-SVP, as presented in Definition 1.3. If we assume that q is linear in n, then the ratio of the shortest and the second shortest vector (also called the SVP gap) is approximately 1 √ n . The u-SVP instance can be solved by the BKZ algorithm and its running time depends on the used blocksize within BKZ. We use the publicly accessible 4 Leaky LWE Estimator [DDGR20] to estimate the necessary blocksize for the BKZ algorithm, denoted as bikz. The algorithm BKZ itself uses an SVP oracle in dimension bikz. As in [ADPS16], we evaluate the running time of BKZ using the core SVP hardness, thus considering only the cost of one call to an SVP oracle in dimension bikz.

As the best known heuristic quantum algorithm to solve SVP in dimension bikz [Laa15] runs in time 2 0.265•bikz , we give the number of quantum security bits by 0.265 • bikz. We give concrete sample parameters and values for this attack against PASS Encrypt in Section 7.4 in Table 7.1.

Randomness Recovery Attack

We now describe the second attack against PASS Encrypt, which aims at recovering the underlying randomness r used during encryption. The second component of the ciphertext c of PASS Encrypt is given by a vector e ∈ Z n-t q satisfying e = V Ω c r mod q, with r = pr for r ← ψ r . As p is publicly known and coprime to q, we can divide the above by p to obtain g := e /p = V Ω c r mod q. As for the Key Recovery Attack from above, we can interpret this as an instance of LWE. More precisely, we write

V Ω c = [C|D] ∈ Z (n-t)×n q with C ∈ Z (n-t)×t q and D ∈ Z (n-t)×(n-t) q
, where D has full rank nt. We multiply the equation above by the inverse of D to obtain

g = C • r 1 + r 2 mod q, (7.2)
where [ C|I n-t ] = [C|D]•D -1 , g = D -1 g and r = (r 1 , r 2 ) T with r 1 ∈ Z t and r 2 ∈ Z n-t . In other words, Equation 7.2 describes an instance of LWE in Hermite Normal Form with public matrix C of dimension t, where nt samples are given. Note that the roles of the dimension and the number of samples are exactly the reversed roles as in the Key Recovery Attack. However, for t = n/2, the dimension and number of samples of the LWE instances are in both attacks the same. Further, for ψ r = ψ f , as we do in the sample parameters in Table 7.1, both attacks are equally hard.

In order to recover the plaintext m from the ciphertext c = (e, e , e ), an attacker can use the same approach as in the Key Recovery Attack to solve the associated LWE instance (obtaining r) and to compute r = pr. They can then use r to compute V Ω m = e -(V Ω r • pk). By combining V Ω m and e = V Ω c m to the full discrete Vandermonde transform Vm , one can multiply it by V -1 to obtain m = ps + m mod q. Finally, the plaintext message m mod p can be recovered by computing m mod p.

Plaintext Recovery Using Hints Attack

In the following we present a new attack against PASS Encrypt, which is inspired by the recent work of Dachman-Soled et al. [START_REF] Dachman-Soled | LWE with side information: Attacks and concrete security estimation[END_REF] on exploiting hints that are given on the LWE secret or noise. The first part of the ciphertext c of PASS Encrypt is given by e = (V Ω r • pk) + V Ω m , where r = pr, pk = V Ω f and m = ps+m with f ← ψ f , r ← ψ r and s ← ψ s . Using the homomorphic properties of V Ω as presented in Section 5.2.1, we can rewrite e as e = V Ω • (f • r + m ). Recall that Rot(f) denotes the matrix describing the multiplication by f in the coefficient embedding, see Section 1.1.3. In matrix form this gives

e = V Ω • (Rot(f) • r + I n • m ) = [A|V Ω ] • r m mod q, where A = V Ω • Rot(f) ∈ Z t×n q .
Note that we can compute A by knowing the roots ω i ∈ Ω for ∈ [t] and the public key pk, and not necessarily the secret key sk = f, as explained in Lemma 5.1. As V Ω has full rank t, we can use Gauss elimination to transform this equation into , r containing r and the first nt coefficients of m and m containing the last t coefficients of m . This corresponds to an instance of LWE of dimension 2nt and t the number of given samples, with B the public matrix.

At first sight, one can see that the LWE instance is of much larger dimension than in the two previous attacks, and thus one may wonder why this attack should provide tighter security estimates. As we will see now, this is because of the additional information provided by the rest of the ciphertext. The second and third part of the ciphertext e and e can be viewed as hints on r and m . To be more precise, e = V Ω c • r and e = V Ω c • m . This can be rewritten as e = [V Ω c |0 (n-t)×n ] • r m mod q, e = [0 (n-t)×n |V Ω c ] • r m mod q.

Note that the vector (r , m ) T is simply a re-labeling of the vector (r , m ) T . In the language of Dachman-Soled et al. [START_REF] Dachman-Soled | LWE with side information: Attacks and concrete security estimation[END_REF] this corresponds to 2(nt) modular hints.

For simplicity, we assume that m = 0 and thus m = ps. As p is a public parameter we can assume that the secret r and the noise m of the corresponding LWE sample are drawn from the distributions ψ r and ψ s , respectively.

As in the Key Recovery Attack, the number of security bits claims that a quantum algorithm would need at least a running time of 2 0.265•bikz , where bikz is the blocksize resulting from the Leaky LWE Estimator [DDGR20].

Choice of Ring

In the original description of PASS Encrypt [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF], the partial Fourier transform is used, and not as we propose the partial Vandermonde transform. The main difference between the original and our version is that the latter works over the ring of integers of some cyclotomic number field, whereas the first one works over the cyclic ring Z[x]/ x n -1 , for some prime n. The setting in [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF] is the following. Let n and q be primes satisfying q = 1 mod n and let ω be a primitive nth root of unity in Z q . Further, let S be a subset of [n] of size t and let Ω = {ω k-1 : k ∈ S} and Ω c = {ω k-1 : k ∈ [n] \ S}. The (discrete) partial Fourier transformation matrix F Ω is defined as F Ω := (ω k-1 j ) j∈[t],k∈ [n] , where ω j ∈ Ω for j ∈ [t]. In an analogue manner to Section 5.2.1, where we define Partial Vandermonde SIS (Definition 5.3), we can define Partial Fourier SIS, denoted by PF-SIS. More concretely, for a given parameter β > 0, PF-SIS β asks to find an element a ∈ Z[x]/ x n -1 of norm a 2 ≤ β satisfying F Ω • a = 0 mod q.

Lemma 7.3 (Solution to Partial Fourier SIS)

The problem PF-SIS β is easy to solve for any β ≥ √ n.

Proof: Let 1 denote the element in Z[x]/ x n -1 whose coefficient vector is given by (1, . . . , 1) T ∈ Z n . The polynomial x n -1 can be factorized in the product x n -1 = (x-1)(x n-1 +• • •+x+1). As for any j ∈ [t] the element ω j is a solution to the equation x n -1 mod q, we also know that k∈[n] ω k-1 j = 0 mod q and thus F Ω 1 = 0 mod q with 1 2 = √ n ≤ β.

This generic solution only holds for the homogeneous problem PF-SIS, and not for the inhomogeneous Knapsack counterpart. However, we prefer to move to the ring R = Z[x]/ x n + 1 , where n is a power of two. For this ring, the so-called evaluation-at-1 attack does not work. Note that the evaluating-at-1 approach already led to successful attacks against NTRU.

Code-Based Attack

We now explain how the partial Vandermonde transform can be interpreted in terms of errorcorrecting codes. For a gentle introduction to coding theory, we refer to the book of Roth [START_REF] Roth | Introduction to coding theory[END_REF].

More formally, the partial Vandermonde transformation matrix V Ω ∈ Z t×n q , as defined in Section 5.2.1, describes the check matrix of an [n, t, d] Reed-Solomon code, with d = nt + 1 its minimum distance. Using the duality connection between PV-Knap and PV-LWE from Section 5.3, the PV-LWE matrix V T inv(Ω c ) ∈ Z n×(n-t) q corresponds to the generating matrix of the same code. More concretely, it is a punctured Reed-Solomon code fulfilling the optimal singleton-bound. Thus, it is a maximum distance separable code with correction capability (d -1)/2 = (nt)/2 . Our typical choice of t is t = n/2 , and thus the correction capability is bounded above by n/4 . It is further a unit-derived code and the theory of error-decoding pairs provides efficient decoder, see for instance the work by Hurley and Hurley [START_REF] Hurley | Coding theory: the unit-derived methodology[END_REF].

In order to prevent coding-based attacks, we need to choose distributions for the secret in PV-Knap and for the noise in PV-LWE such that the expected Hamming weight is not near the correction capability bound. For example, setting the distribution ψ as the uniform distribution over {-1, 0, 1} n and sampling e ← ψ, we expect the Hamming weight of e to be 2n/3, which is much larger than the error-correcting capacity, which is at most n/4 . So this would be a choice that does not allow for code-based attacks. If, however, we set the distribution ψ as a sparse distribution over {-1, 0, 1} n , where an element e ← ψ has only very few non-zero coefficients, let's say about n/4 non-zero coefficients, then the efficient decoder from [START_REF] Hurley | Coding theory: the unit-derived methodology[END_REF] would apply.

Concrete Parameters

We propose the following sample parameters for PASS Encrypt, under which the scheme as presented in Protocol 7.1 is correct (Lemma 7.1). We consider the case where K is the ν-th cyclotomic number field with ν a power of 2. By n = ν/2 we denote its degree and the number of rows of the partial Vandermonde matrix t is given by n/2. In Section 7.4.1 below we argue why this is the optimal choice for t. The parameter q denotes the modulus over which the partial Vandermonde transformation matrix V Ω is taken. We require q = 1 mod ν such that the defining polynomial of K, given by x n + 1, fully splits modulo q. Concretely, we provide two parameter sets, as summarized in Table 7.1. In the first, we choose ν = 2048 and q = 12289, and in the second, we keep the same q and set ν = 4096. Note that the relevant parameter for security is t.

We set the distributions ψ f , ψ r and ψ s as U (T n (d)), the uniform distribution over ternary polynomials with exactly d coefficients that equal 1, and d coefficients that equal -1, and n -2d coefficients that equal 0, where d = n/3 . Thus, for every element f ← ψ f (resp. r ← ψ r and s ← ψ s ) it yields f ∞ ≤ 1 (resp. r 1 ≤ 2n/3 and s ∞ ≤ 1) with probability 1. Hence, we can set the parameter α to 2n/3 and β to 1. Fixing the number of coefficients that equal -1 and 1 makes it possible to set α = 2n/3 (in order to keep perfect correctness for the given q), but adds a structural hint, as exploited by Dachman-Soled et al. [START_REF] Dachman-Soled | LWE with side information: Attacks and concrete security estimation[END_REF]Sec. 6.3]. This structural hint roughly decreases the estimated bikz by 1. Further, we set p as 2.

We then provide the needed block sizes of the BKZ algorithm in order to perform the three attacks on PASS Encrypt for both parameter sets, as presented in Section 7.3. All estimations are computed with SageMath using the Leaky LWE Estimator [DDGR20]. With the first sample set, we achieve a quantum bit security of 79 and with the second one, we achieve a quantum bit security of 188. We made the SageMath code of our experiments publicly available.5

Choice of the Number of Rows

We now discuss the influence of the parameters t, i.e., the number of rows of the Vandermonde matrix chosen to construct V Ω , on the security of our scheme. This observation also applies to the the original proposal in [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF].

Increasing t leads to an easier Key Recovery Attack against PASS Encrypt, as the underlying LWE dimension n-t decreases. On the other hand, decreasing t leads to an easier Randomness Recovery Attack against PASS Encrypt, as the underlying LWE dimension t decreases. Hence, choosing t = n/2 is the optimal choice, as it balances the hardness of both attacks. Our experiments with t = n/3 (Set A), t = n/2 (Set B) and t = 2n/3 (Set C) validate those observations and are summarized in Table 7.2. In both variations (Set A and Set C) the quantum security of PASS Encrypt decreases from 79 to 45.

We emphasize that the observations made above do not apply to the sequence of works on PASS Sign. In the recent publication on the aggregate variant of PASS Sign by Doröz et al. [START_REF] Doröz | MMSAT: A scheme for multimessage multiuser signature aggregation[END_REF], the parameter t is set to n/3 . Note that there is only the partial Fourier SIS problem with the matrix F Ω ∈ Z t×n q arising in the design of the signature scheme, and not the complement matrix F Ω c . Hence, decreasing t only makes the corresponding dimension of the LWE instance, that is defined by an instance of partial Fourier SIS, larger and thus the problem harder.

Comparison

Finally, we provide a comparison between the asymptotic parameters of PASS Encrypt with two other efficient lattice-based PKE schemes. We therefore compute the asymptotic parameters in bits for the secret key sk, the public key pk and the ciphertext c.

Recall from Section 7.3 that t is the important parameter defining the asymptotic security of PASS Encrypt, motivating our choice to state all parameters with regard to t. In PASS Encrypt the secret key is a ring element sampled from the uniform distribution over T n ( n/3 ). Further, we assume that n = 2t, which is the optimal choice as argued in Section 7.4.1. Thus, the bit size of the secret key is 2t • log 2 3. The public key is given by pk = (Ω, V Ω sk) and lies in Z t q × Z t q , requiring 2t • log 2 q bits to transmit it. 6 Finally, the ciphertext is an element of Z t q × Z n-t q × Z n-t q , with nt = t, requiring 3t • log 2 q bits to send it. We now compare our scheme with two other efficient lattice-based PKE schemes, as illustrated in Table 7.3. The first is the Regev-like PKE scheme based on P-LWE, as presented in [START_REF] Lindner | Better key sizes (and attacks) for lwe-based encryption[END_REF], and the second is the NTRU scheme, as presented in [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF]. In [START_REF] Lindner | Better key sizes (and attacks) for lwe-based encryption[END_REF], the secret key and the public key are both ring elements of the ring R = Z[x]/ x t + 1 , where t is a power of two and the parameter that is determining the asymptotic security. For a better comparison, we assume that the secret is, as in PASS Encrypt, sampled uniformly over T t ( n/3 ). The ciphertext is composed of two ring elements, allowing to encrypt a t-bit message. In [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF], the ring R = Z[x]/ x t -1 is used. The secret key is a ring element of small norm. Again, for better comparison, we use the same distribution as in PASS Encrypt. The public key and the ciphertext are elements of R and the schemes allows to encrypt a t-bit message. We note that for simplicity we consider non-optimized versions of the three schemes.

An important characteristic of an PKE scheme is the ratio between the sum of the bit size of its public key and ciphertext and the bit size of the encrypted message. Table 7.3 shows that this ratio is 2.5 log 2 q for PASS Encrypt and thus placing it in between the one of NTRU [HPS98] and the one of the P-LWE-based Regev scheme [START_REF] Lindner | Better key sizes (and attacks) for lwe-based encryption[END_REF]. However, we believe that the algebraic structure of the partial Vandermonde transform V Ω used within PASS Encrypt may lead to interesting constructions such as homomorphic commitments or zero-knowledge proofs.

Conclusion and Perspectives

It is now time to conclude the presented contributions of this manuscript and to highlight some short-term and long-term perspectives for future works.

Hardness of Module LWE

In Chapter 2 and Chapter 3, we studied the hardness of Module Learning With Errors (M-LWE). First, we proved in two different ways that its binary secret variant (bin-M-LWE) doesn't become significantly easier as long as we increase the module rank and the noise width accordingly. We were able to generalize this result to any secret whose coefficients lie in a ball of small radius.

Those results were then used, among other technical tools, to give a classical worst-case to average-case reduction for M-LWE in Chapter 3. The main drawback of the classical proof is that the rank has to be increased by a factor of at least log 2 q (inherited from the binary secret reduction before), where the starting modulus q is exponentially large in the ring degree n. This results in a rank that has to be linear in n. In practical schemes, however, small constant ranks are used. The log 2 q factor essentially comes from the used Leftover Hash Lemma (LHL), which is a direct generalization of Micciancio's LHL [START_REF] Micciancio | Generalized compact knapsacks, cyclic lattices, and efficient one-way functions[END_REF] from the ring to the module setting. One short-term perspective to prove the hardness of bin-M-LWE for smaller ranks (and thus to obtain a classical reduction for ranks below n) is to improve the LHL. For instance, Lin et al. [START_REF] Lin | Hardness of module-lwe and ring-lwe on general entropic distributions[END_REF] introduced a LHL over rings that doesn't work with a concrete secret distribution, but only depends on its min-entropy. However, it adds a strong condition on the modulus q as it requires it to be inert in the underlying number field. In the popular case of power-of-2 cyclotomics, no such integer q exists. Another LHL over rings is proven by Liu and Wang [START_REF] Liu | Rounding in the rings[END_REF], also working with the min-entropy of the secret distribution. They observed that a modulus q which is splitting only in few prime ideals over the number field is more suitable for randomness extraction. As the LHL is an important and widely used tool in cryptography, we think that it is worth investigating all known results to see if we can obtain a general version of it that encompasses all existing algebraic LHL. This would possibly lead to a trade-off between the choice of the modulus q, the secret distribution and the underlying number field, which may finally lead to an improvement of our results as well.

An alternative approach is to avoid the exponentially large modulus q all together, which in turn requires to improve Peikert's classical reduction [START_REF] Peikert | Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[END_REF], a seemingly difficult task. Furthermore, the current modulus switching of Section 3.4 heavily depends on the size of the secret. To reduce M-LWE with an exponentially large modulus q to M-LWE with a polynomially large modulus p, we made use of the results of Albrecht and Deo [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF]. To be more concrete, we were able to guarantee a polynomial increase in the noise width while restricting the secrets to be binary. In contrast, when using a discrete Gaussian distribution (which depends on q) it is not possible to maintain a polynomial error increase, but only an exponential one. A very interesting question is whether it is possible to improve the results of [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF] by making use of the general 129 algebraic frame-work and the related tight reductions of Peikert and Pepin [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF]. If we could get, for instance, interesting results already for Gaussian secret distributions, this would leverage the rank condition for the classical reduction.

From a more general perspective, recent works such as [BD20b, LWW20], including our binary reductions from Chapter 2, have made progress towards understanding the impact that changing the secret distribution has on structured variants of LWE. However, very few research focused on changing the noise distribution of structured variants of LWE. For instance, it is unclear if the reduction from LWE to LWE with binary noise by Micciancio and Peikert [START_REF] Micciancio | Hardness of SIS and LWE with small parameters[END_REF] generalizes to structured variants. Furthermore, it would be interesting to introduce a notion of entropic noise LWE and to study its hardness with respect to the min-entropy provided by the noise distribution, for structured and unstructured flavors of LWE. Such investigation would deepen our understanding of the behavior of structured variants of LWE, such as M-LWE. As those variants are used as hardness assumptions in current lattice-based schemes, we think that this is of utmost importance.

Regarding remaining gaps between properties that have been shown for the unstructured LWE case, but not (yet) for the structured M-LWE case, it may be interesting to look at the samplepreserving search-to-decision reduction by Micciancio and Mol [MM11]. This, however, requires to find a suitable way of using the Fourier transform over number fields, which seems to be a challenging research question.

And finally, as for instance observed in the introduction of Chapter 2, there is a large gap between the parameters resulting from theoretic reductions and the ones obtained by looking at the best known attacks to solve the problem. In practice, one selects the parameters for an (M)LWE-based cryptographic scheme using the latter approach. It is very important to further improve the existing reductions (or the existing attacks) in order to obtain tighter results and hence close (or at least narrow) the gap between theoretical and practical hardness of variants of (M)LWE.

Middle-Product Learning With Rounding

In Chapter 4, we introduced a new hardness assumption, that we named the Middle Product Computational Learning With Rounding (MP-CLWR) problem. It is a combination of two known variants of LWE, the Middle-Product Learning With Errors (MP-LWE) and the Learning With Rounding (LWR) problem, inheriting the security advantage of the first and the simplicity advantage of the latter. We proved that this new assumption is under suitable parameter choices at least as hard as MP-LWE, whose hardness is itself guaranteed by worst-case problems over ideal lattices. We defined the problem in its computational variant as for today we don't know how to reduce the hardness of decision MP-LWR from worst-case lattice problems, while maintaining the coefficient-wise rounding and allowing for a polynomially large modulus. As mentioned in the related work section of Chapter 4, Liu and Wang [START_REF] Liu | Rounding in the rings[END_REF] addressed this problem for the ring variant of LWR by providing a search-to-decision reduction. However, in order to do so, they defined a new way of rounding. For a short-term perspective, we think that it is important to better understand the relation between their way of rounding and the more standard and widely used coefficient-wise rounding (also used in this thesis). To this end, one has to understand the impact that going from the power basis (defining the coefficient-wise rounding) to some normal integral basis (defining the rounding in [START_REF] Liu | Rounding in the rings[END_REF]) has on the reduction parameters. Alternatively, it could be interesting to study if the search-to-decision reduction shown for Ring Learning With Errors (R-LWE) by Roşca et al. [START_REF] Roşca | On the ring-lwe and polynomial-lwe problems[END_REF] can be adapted to the setting of deterministic rounding.

More generally speaking, there are still some interesting open questions with respect to the middle-product variant of LWE. As pointed out by Roşca [START_REF] Roşca | On algebraic variants of Learning With Errors[END_REF] in the conclusion of her Ph.D thesis, it would be very intriguing to prove a reduction from MP-LWE back to P-LWE or to M-LWE and hence essentially show their equivalence. As no such equivalence is shown by today, we may assume that MP-LWE is indeed harder than M-LWE.

Furthermore, it would be interesting to see more cryptographic applications for our newly introduced problem. For now, we showed in Chapter 6 how to build a basic encryption scheme whose security is based on MP-CLWR. Intuitively, it seems reasonable to assume that existing cryptographic constructions based on (structured) LWR, such as pseudorandom functions [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF][START_REF] Chuengsatiansup | Towards practical ggm-based PRF from (module-)learning-with-rounding[END_REF], can be adapted to the middle-product setting. Hence, those schemes would gain with respect to the underlying security assumption (on the expense of a certain loss in efficiency). On the other hand, one could consider existing constructions for MP-LWE such as the identity-based encryption scheme by Lombardi et al. [START_REF] Lombardi | Lattice trapdoors and IBE from middle-product LWE[END_REF] and try to adapt them to the deterministic rounding setting. However, as it is up to today unclear how to construct lattice trapdoors for the LWR setting, this seems to be a difficult task.

Partial Vandermonde Problems and PASS Encrypt

In Chapter 5, we studied several problems related to the partial Vandermonde matrix. More precisely, we looked at the Partial Vandermonde Knapsack problem (PV-Knap) and introduced its dual variant, called Partial Vandermonde Learning With Errors (PV-LWE). We showed that both problems are equivalent to each other. Furthermore, we introduced a leaky variant of PV-Knap that we termed the PASS problem. Its name is motivated by the fact that it serves, together with the decision variant of PV-Knap, as the underlying hardness assumption for an encryption scheme, called PASS Encrypt. This scheme was originally introduced by Hoffstein and Silverman [START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF], but without a security proof. In Chapter 7, we slightly modified PASS Encrypt in order to provide a thorough proof of security assuming the intractability of explicitly stated computational problems. Moreover, we proposed a refined analysis of its practical security and concrete sample parameters. By providing additional information on the underlying secret of a PV-Knap instance, the PASS problem seems to be easier than the original PV-Knap. As a shortterm perspective, it would be interesting to see if we can build an encryption scheme whose security is based only on PV-Knap (or equivalently PV-LWE). In this direction, in an ongoing work with Amin Sakzad and Ron Steinfeld, we define an encryption scheme using PV-LWE in the spirit of Regev's encryption scheme for LWE [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. The homomorphic structure of PV-Knap, that comes naturally with the partial Vandermonde matrix, may allow for more efficient and/or more functional constructions. Furthermore, it may be useful to design more advanced schemes, like zero-knowledge proofs for valid commitment openings or for group signatures.

More generally, it is important to continue investigating the hardness of partial Vandermonde problems. As it is a very recent source of hardness assumptions, it is crucial to deepen our understanding how difficult it is to solve those problems. The amount of resources spent to attack a cryptographic system and to solve the underlying hardness assumption is an important characteristic to gain confidence in the proposed scheme.

One possibility is to connect the problems PV-Knap or PV-LWE with worst-case lattice problems, as this is the case for standard Knapsack and LWE [START_REF] Ajtai | Generating hard instances of lattice problems[END_REF][START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF]. However, the fact that decision PV-LWE becomes easy to solve if the underlying secret is small, could be seen as a warning.

Alternatively, one could try to connect the NTRU problem with the partial Vandermonde problems. Even though, the standard search variant of NTRU does up to today not possess a connection to worst-case (structured) lattice problems, it has been studied for more than 20 years now and seems to be a reasonable hardness assumption in practice.

To tackle the question from another starting point, one could try to design attacks that take into account the algebraic structure of the Vandermonde matrix to show that the partial Vandermonde problems are possibly easier than standard LWE or SIS problems. A hint towards this reasoning is that the homogeneous variant of PV-Knap, that we called PV-SIS, essentially defines average-case instances of the Ideal Shortest Vector Problem (Id-SVP), which has shown to be an easier problem than the more general Module Shortest Vector Problem (Mod-SVP) for modules of rank at least 2 [CDW17, PHS19, BR20]. Additionally, the attacks by Pan et al. [START_REF] Pan | On the ideal shortest vector problem over random rational primes[END_REF] apply to the specific setting of PV-SIS and thus add restrictions on the modulus q, as it has to be fully splitting in the underlying number field.

General Perspectives for Structured Variants of LWE

In the last 10 years, plenty of different structured variants of LWE have been introduced. The overall goal of this Ph.D thesis was to investigate different choices of structured variants of LWE in order to obtain scientific criteria which concrete flavor to choose for cryptographic schemes.

In this work we covered the variants over rings of polynomials (P-LWE), over rings of integers (R-LWE), over modules (M-LWE), using the middle-product (MP-LWE) or deterministic rounding (R-LWR, MP-LWR). Every problem possesses a formulation as a search or a decision problem, but not in every case they are connected via a search-to-decision reduction. Furthermore, we can vary the space of the secret, leading to the problem in the dual or the primal version, or modify the secret and noise distribution, independently. All this has an impact on the hardness of the problem. So, which problem to choose for designing a lattice-based cryptographic scheme? The honest but maybe frustrating answer is that it depends on the concrete scheme, the required security guarantees and the available resources. Regarding the different variants, Peikert and Pepin [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF] were able to generalize all existing structured variants and show tight reductions starting from R-LWE. In particular, they tightly reduce the problem R-LWE over a number field of degree nd to the problem M-LWE over a number field of degree n and rank d.

The authors commented their results as follows [PP19, Abstract]:

A main message of our work is that it is straightforward to use the hardness of the original R-LWE problem as a foundation for the hardness of all other algebraic LWE problems defined over number fields, via simple and rather tight reductions.

Another way to interpret their work is to see M-LWE as the more reliable hardness assumption as it generalizes R-LWE but is at the same time tightly connected to it. In the status report of the NIST's standardization process, they phrased it in the following way [AASA + 20, Sec. 3.2]:

Recent theoretical work has placed M-LWE on stronger footing by providing a very tight reduction from R-LWE to M-LWE [START_REF] Peikert | Algebraically structured lwe, revisited[END_REF].

As there are (non-tight) reductions in the opposite direction, showing that M-LWE reduces to R-LWE [START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF], both problems are essentially equivalent. Using the (non-tight) equivalence between M-LWE and SIVP over module lattices [START_REF] Langlois | Worst-case to average-case reductions for module lattices[END_REF], we can deduce that all three problems are more or less equally hard. For R-LWE, we only know a worst-case to average-case reduction from SIVP over ideal lattices [START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF], but not in the other direction. At the same time, there are algorithms that can solve SVP over ideal lattices in sub-exponential time [CDW17, PHS19, BR20], which is up to date not known for SVP over modules (of rank larger than 1). So it seems that there is a difficulty gap between the set of problems {Id-SVP, Id-SIVP} and the set of problems {Mod-SIVP, M-LWE, R-LWE}. Better understanding this potential difficulty gap is one of the major open tasks for the theoretical foundations of lattice-based cryptography for the near future.

More generally, it is possible that Conjecture 2 from the introduction is much stronger than Conjecture 1 in the sense that lattice problems over module lattices may be easier than over general Euclidean lattices. Here again, we still need to invest more research resources to better understand their relation. One very interesting open problem is to tightly connect both sets of problems, which may be even impossible.

From a global perspective, we have no doubt that structured lattice problems will play an important role in public key cryptography after the advent of quantum computers and agree with NIST's statement [AASA + 20, Sec. 2.3]:

In NIST's current view, these structured lattice schemes appear to be the most promising general-purpose algorithms for public-key encryption/KEM and digital signature schemes.

Nonetheless, it will be interesting to see which structured variants will make the race in the future. Probably, it will mostly depend on their suitability for building concrete and advanced cryptographic schemes.

Titre : Difficulté théorique des variantes algébriques du problème Learning With Errors

Mots-clés : cryptographie à base de réseaux, apprentissage avec erreurs, variantes structurées, secret binaire, difficulté classique, produit intermédiaire, matrice de Vandermonde Résumé : Cette thèse de doctorat porte principalement sur le problème d'apprentissage avec erreurs, appelé Learning With Errors (LWE). Il s'agit d'une composante essentielle de la cryptographie à base de réseaux, qui fait partie des candidats les plus prometteurs pour remplacer les protocoles cryptographiques actuels lorsque des ordinateurs quantiques à grande échelle seront disponibles.

Dans cette thèse, nous étudions la difficulté théoriques des variantes algébriquement structurées de LWE qui sont utilisées dans des protocoles efficaces. D'abord, nous prouvons que le problème Module Learning With Errors (M-LWE) ne devient pas significativement plus facile à résoudre, même si le secret sous-jacent est remplacé par un vecteur binaire. Ensuite, nous présentons une réduction classique au problème M-LWE, ce qui renforce notre confiance dans sa valeur pour la cryptographie. De plus, nous définissons une nouvelle hypo-thèse de difficulté, le problème MP-CLWR (Middle-Product Computational Learning With Rounding), qui hérite des avantages de deux variantes existantes de LWE. Enfin, nous étudions des problèmes liés à la matrice partielle de Vandermonde. Il s'agit d'une source récente d'hypothèses de difficulté pour la cryptographie à base de réseaux et son étude rigoureuse est primordiale pour gagner en fiabilité. Finalement, nous montrons que les nouvelles hypothèses de difficulté introduites auparavant servent à la construction de schémas de chiffrement à clé publique efficaces. D'une part, nous concevons un nouveau schéma de chiffrement, dont la sécurité est assurée par la difficulté du problème MP-CLWR. D'autre part, nous modifions un schéma de chiffrement existant pour lui fournir une preuve de sécurité basée sur deux problèmes de Vandermonde partiels explicitement énoncés.

Title: Theoretical Hardness of Algebraically Structured Learning With Errors

Keywords: lattice-based cryptography, learning with errors, structured variants, binary secrets, classical hardness, middle-product, Vandermonde matrix Abstract: The main focus of this Ph.D thesis lies on the computational problem Learning With Errors (LWE). It is a core building block of lattice-based cryptography, which itself is among the most promising candidates to replace current cryptographic protocols once large-scale quantum computers may be available.

The contributions of the present work are separated into two different parts. First, we study the hardness of structured variants of LWE. To this end, we show that under suitable parameter choices the Module Learning With Errors (M-LWE) problem doesn't become significantly easier to solve even if the underlying secret is replaced by a binary vector. Furthermore, we provide a classical hardness reduction for M-LWE, which further strengthens our confidence in its suitability for cryptography. Ad-ditionally, we define a new hardness assumption, the Middle-Product Computational Learning With Rounding (MP-CLWR) problem, which inherits the advantages of two existing LWE variants. Finally, we study problems related to the partial Vandermonde matrix. This is a recent source of hardness assumptions for lattice-based cryptography and its rigorous study is important to gain trust in it. In the second part of this manuscript, we show that the new hardness assumptions we introduced before serve for the construction of efficient public-key encryption. On the one hand, we design a new encryption scheme, whose security is provably based on the MP-CLWR problem. On the other hand, we modify an existing encryption scheme, called PASS Encrypt, to provide it with a security proof based on two explicitly stated partial Vandermonde problems.

  Number Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.1 Space H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.2 Canonical Embedding, Trace and Norm . . . . . . . . . . . . . . . . . . . 1.1.3 Coefficient Embedding and Rotation Matrix . . . . . . . . . . . . . . . . . 1.1.4 Discrete Vandermonde Matrix . . . . . . . . . . . . . . . . . . . . . . . . 1.1.5 Modules, Ideals and Units . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Lattice Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.1 Euclidean Lattices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.2 Structured Lattices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.3 Computational Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Probability Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.1 Gaussian Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.2 Gaussians over Number Fields . . . . . . . . . . . . . . . . . . . . . . . . 1.3.3 Statistical Distance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.4 Rényi Divergence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.5 Leftover Hash Lemma . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.4 Learning With Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.4.1 Learning With Errors (LWE) . . . . . . . . . . . . . . . . . . . . . . . . . 1.4.2 Polynomial Learning With Errors (P-LWE) . . . . . . . . . . . . . . . . . 1.4.3 Module Learning With Errors (M-LWE) . . . . . . . . . . . . . . . . . . . 1.4.4 Middle-Product Learning With Errors (MP-LWE) . . . . . . . . . . . . . 1.4.5 Learning With Rounding (LWR) . . . . . . . . . . . . . . . . . . . . . . . 1.4.6 Practical Hardness of Learning With Errors . . . . . . . . . . . . . . . . . 1.5 Cryptographic Notions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5.1 Public Key Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5.2 Random Oracle Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

ΛFigure 1 :

 1 Figure 1: A lattice Λ in the 2-dimensional space R 2 with basis B = (b 1 , b 2 ) and B = ( b 1 , b 2 ), where the volume of the area framed by both bases (colored in light orange and light gray) is the same. The minimum of the lattice is given by λ 1 (Λ) = b 1 2 = b 2 2 .

  . More formally, a set of n linear independent vectors B = (b 1 , . . . , b n ) ∈ R n×n (called a basis) defines a lattice Λ given by Λ =

ΛFigure 2 :

 2 Figure 2: Given a lattice Λ with basis B = (b 1 , b 2 ) and two positive reals δ 1 and δ 2 . It yields λ 1(Λ) = b 1 2 , λ 1 (Λ) ≤ δ 1 and λ 1 (Λ) > γ • δ 2 for γ = 2.In other words, Λ defines a YES instance for δ 1 and a NO instance for δ 2 for the problem GapSVP 2 .

Figure 3 :

 3 Figure 3: The LWE problem in its search variant. The number of rows m of A can be seen as the number of LWE samples and the number of columns n of A defines the dimension of the LWE problem.

Figure 4 :

 4 Figure 4: An instance of the M-LWE problem in its search variant. The number of rows m of A represents the number of given M-LWE samples and the number of columns d of A defines the rank of the M-LWE instance.Every entry a jk ∈ R q of the matrix A defines a matrix of multiplication Rot(a jk ) ∈ Z n×n q , where n is the ring degree of R. For simplicity, we illustrate the rotation matrix as a nega-cyclic matrix.

  [n] . It describes a field homomorphism, where multiplication and addition in H are component-wise. Hence, σ(a + b) = σ(a) + σ(b) and σ(a • b) = σ(a) • σ(b) for a, b ∈ K, where • denotes the componentwise product. By abuse of notation, for d ∈ N and a vector x ∈ K d , we write σ(x) to denote the vector

  Example 1.4 (Power-of-2 Cyclotomic Fields [LS18, Cor. 1.2])

Figure 1 . 1 :

 11 Figure 1.1: Graph of the probability density function of a continuous Gaussian in dimension n = 1 and of the probability mass function of a discrete Gaussian over the lattice Λ = Z.

  Lemma 1.8 ([Ban93, Lem. 1.5] and [Reg05, Claim 2.13])Let Λ be an n-dimensional lattice and ε

  by adding a discrete sample from D Λ+a, √ R and a continuous sample from D √ S . Then we have ∆(Y , D √ T ) ≤ 2ε.

  For a basis B = (b j ) j∈[n] of an n-dimensional lattice, we denote by GS(B) = (GS(b j )) j∈[n] the Gram-Schmidt orthogonalization of B from left to right. Lemma 1.12 (Gaussian Sampler [GPV08, Thm. 4.1] & [BLP + 13, Lem. 2.3]) Let n ∈ N. There exists a PPT algorithm D that, given a basis B = (b j ) j∈[n] of an n-dimensional lattice Λ, a parameter r ≥ max j∈[n] GS(b j ) 2 • √ ln(2n + 4)/π and a center c ∈ R n , outputs a sample whose distribution is D Λ,r,c .

  where • denotes the component-wise product. The component-wise product a • b of two vectors a and b can also be expressed as the matrixvector product diag(a) • b. It results in σ

j

  ) for all j ∈ [d].

  Lemma 1.18 ([DMR18, Thm. 1.2]) Let D g denote the continuous Gaussian distribution over K R and let z ∈ K. The statistical distance between D g and D g,z is bounded above by √ 2π z 2 g . Lemma 1.19 ([Reg05, Claim 2.2]) Let α and β be positive reals such that α < β. The statistical distance between D α and D β is bounded above by 10 • β α -1 .

  Lemma 1.23 (LHL over Rings adapted from [Mic07, Thm. 4.2])

  Definition 1.18 (Public Key Encryption): A Public Key Encryption (PKE) scheme Π = (KGen, Enc, Dec) for a message space M and a ciphertext space C is composed of three PPT algorithms, specified as follows: KGen: The key generation algorithm KGen takes as input a security parameter λ and returns a key pair (sk, pk), called the secret key sk and the public key pk. Enc: The encryption algorithm Enc takes as input the public key pk and a message m ∈ M and returns the ciphertext c ← Enc(pk, m) ∈ C. Dec: The decryption algorithm Dec takes as input the secret key sk and a ciphertext c ∈ C and returns Dec(sk, c) ∈ M ∪ {⊥}, where ⊥ denotes the failure symbol. Definition 1.19 (Correctness): We call the PKE scheme Π = (KGen, Enc, Dec) correct with correctness error δ ∈ [0, 1) if for any message m ∈ M it yields Pr[Dec(sk, Enc(pk, m)) = m] ≥ 1 -δ,

Figure 2 . 1 :

 21 Figure 2.1: Screenshot of running the LWE Estimator [APS15] with SageMath on my laptop.

Figure 2 . 2 :

 22 Figure 2.2: Overview of the proof of Theorem 2.1.

  and Z ← (D R ∨ ,αq ) m×d and s, e as in H 0 , • H 2 : (B, C, Z, B(λCs) + Z(λs) + e), where B, C, Z, s, e as in H 1 , • H 3 : (B, C, Z, B(λCs) + e ), where e ← (D R ∨ ,βq ) m and B, C, Z, s as in H 2 ,

  Corollary 2.1 (Binary Hardness of M-LWE for Power-of-2 Cyclotomics)

  Lemma 2.3 ( rst-is-errorless M-LWE to ext-M-LWE, adapted from [BLP + 13, Lem. 4.7])

  [t]. By definition, we have Adv[O] = |Pr(O(H t )) -Pr(O(H 0 ))|.The reduction A works as follows.

Figure 2 . 4 :

 24 Figure 2.4: Overview of the proof of Lemma 2.5.

Contents 3 . 1

 31 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 3.1.1 Our Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 3.1.2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 3.1.3 Roadmap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 3.2 Classical Reduction for Exponentially Large Moduli . . . . . . . . . . . . . . . . 62 3.2.1 Step 1: From Gaussian Decoding Problem to M-LWE . . . . . . . . . 62 3.2.2 Step 2: Classical Hardness for Exponentially Large Modulus . . . . . 67 3.3 Binary Hardness and Adapted Error Distribution . . . . . . . . . . . . . . . . . 69 3.4 Modulus Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 3.4.1 The General Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3.4.2 The Case of Power-of-2 Cyclotomics . . . . . . . . . . . . . . . . . . . 72

Figure 3 . 1 :

 31 Figure3.1: Overview of the complete classical hardness proof of decision M-LWE for linear rank d and polynomially large modulus p, as stated in Theorem 3.1 for K the ν-th cyclotomic number field of degree n. The right side shows the concrete instantiation for power-of-2 cyclotomics, as stated in Corollary 3.1. The parameter ∆ is determined by the underlying ring R and is poly(n) for the case of power-of-2 cyclotomics. For the reduction from M-LWE to its binary variant, we use the improved reduction from Chapter 2.

  Lemma 3.1 (Adapted from [LS15, Lem. 4.14])

Figure 3 . 3 :

 33 Figure3.3: The second ingredient required for the complete classical hardness proof of decision M-LWE, as stated in Theorem 3.1 for K the ν-th cyclotomic number field of degree n. The right side shows the concrete instantiation for power-of-2 cyclotomics, as stated in Corollary 3.1. For the reduction from M-LWE to its binary variant, we use the improved reduction from Chapter 2.

Figure 3 . 4 :

 34 Figure3.4: The third (and last) ingredient required for the complete classical hardness proof of decision M-LWE, as stated in Theorem 3.1 for K the ν-th cyclotomic number field of degree n. The right side shows the concrete instantiation for power-of-2 cyclotomics, as stated in Corollary 3.1. The parameter ∆ is determined by the underlying ring R and is poly(n) for the case of power-of-2 cyclotomics.

  with secret distribution ψ d to the problem M-LWE m n,d,p,Ψ ≤β with secret distribution ψ d for (β ) 2 ≥ β 2 + 2r 2 B 2 d. This reduction reduces the advantage by at most 1 -(1 -δ) d + (2d + 6)εm. Proof: We use the transformation from Theorem 3.3 by taking γ 2 = B 2 d and replacing j∈[d] σ k (s j ) 2 for every k ∈ [n] by B 2 d. We can write G in the coefficient embedding as Ĝ = I d ⊗ I n = I dn , where ⊗ denotes the Kronecker product of two matrices. This defines the corresponding lattice Λ = 1 p ĜT Z dn + Z dn with basis B Λ = 1 p I dn . To move from the coefficient embedding to the canonical embedding, we can simply multiply the basis by the matrix B R d = I d ⊗ B R . The basis for Λ = 1 p G T H R d + R d given in the canonical embedding is thus given by

Figure

  a j n s p j∈[t] a j , b j p j∈[t]

Figure 4 . 1 :

 41 Figure 4.1: The experiment setting of the computational assumption (informal)

  Definition 4.1 (Hankel Matrix): Let q, n, d ∈ N such that d ≤ n and a ∈ Z <n+d-1 q [x] with coefficient vector a = (a 0 , . . . , a n+d-2 ) T . We define the Hankel matrix of a of order d + n -1 a d . . . a 2d-2 . . . a n+d-2

  Lemma 5.3 (Duality of Partial Vandermonde Matrices)

Proof:

  Setup. Recall that the IND-CPA security game (Protocol 1.1) is the following: A challenger C generates a key pair (pk, sk), samples a random bit b and sends the public key pk to the adversary A. The adversary chooses two messages m 0 , m 1 and sends them to the challenger C, which in turn encrypts m b and sends the corresponding ciphertext c back to A. The adversary outputs a bit b as a guess of b and wins the game if b = b . Let c = (c 1 , c 2 , c 3 ) be the ciphertext of the message m b ∈ M. The only part that depends on the message m b is the last one, where c 3 = H ( v 2 ) ⊕ m b .

ẽ

  = [B|I t ] • r m = B • r + m mod q, with B ∈ Z t×(2n-t) q

  Contents 1.1 Algebraic Number Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.1 Space H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.2 Canonical Embedding, Trace and Norm . . . . . . . . . . . . . . . . . 1.1.3 Coefficient Embedding and Rotation Matrix . . . . . . . . . . . . . . . 1.1.4 Discrete Vandermonde Matrix . . . . . . . . . . . . . . . . . . . . . . . 1.1.5 Modules, Ideals and Units . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Lattice Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	1.2.1 Euclidean Lattices . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.2.2 Structured Lattices . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.2.3 Computational Problems . . . . . . . . . . . . . . . . . . . . . . . . .
	1.3 Probability Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.3.1 Gaussian Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.3.2 Gaussians over Number Fields . . . . . . . . . . . . . . . . . . . . . .
	1.3.3 Statistical Distance . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.3.4 Rényi Divergence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.3.5 Leftover Hash Lemma . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.4 Learning With Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.4.1 Learning With Errors (LWE) . . . . . . . . . . . . . . . . . . . . . . .
	1.4.2 Polynomial Learning With Errors (P-LWE) . . . . . . . . . . . . . . .
	1.4.3 Module Learning With Errors (M-LWE) . . . . . . . . . . . . . . . . .
	1.4.4 Middle-Product Learning With Errors (MP-LWE) . . . . . . . . . . .
	1.4.5 Learning With Rounding (LWR) . . . . . . . . . . . . . . . . . . . . .
	1.4.6 Practical Hardness of Learning With Errors . . . . . . . . . . . . . . .
	1.5 Cryptographic Notions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.5.1 Public Key Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . .
	1.5.2 Random Oracle Model . . . . . . . . . . . . . . . . . . . . . . . . . . .

  it is closed under addition by elements of M and under multiplication by elements of R. It is a finitely generated module if there exists a finite family{b k } k of vectors in K d such that M = k R • b k . An ideal I ⊆ R is a non-zero additive subgroup of R that is closed under multiplication by R.In other words, ideals are modules of rank d = 1. An ideal I is principal if it is generated by a single element u, meaning

  An input to the search Shortest Vector Problem SVP γ is a basis B of an ndimensional lattice Λ. The goal is to find a vector z = 0 such that z 2 ≤ γ • λ 1 (Λ).The SVP restricted to ideal lattice is denoted by Id-SVP γ and to module lattices by Mod-SVP γ .

	Definition 1.1 (Search Shortest Vector Problem): Let γ = γ(n) ≥ 1 be a function in the
	dimension n. Definition 1.2 (Decision Shortest Vector Problem): Let γ = γ(n) ≥ 1 be a function in the
	dimension n. An input to the decision Shortest Vector Problem GapSVP γ is a pair (B, δ),
	where B is a basis of an n-dimensional lattice Λ and δ > 0 is a real number. It is a
	YES instance if λ 1 (Λ) ≤ δ, and it is a NO instance if λ 1 (Λ) > γ • δ. The problem asks
	to distinguish whether a given instance is a YES or a NO instance. If λ 1 (Λ) falls in the
	interval (δ, γ • δ], any answer is correct.

  Generalization to Larger Secrets . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 2.5 Choice of Embedding for Binary Secrets . . . . . . . . . . . . . . . . . . . . . . 55The Learning With Errors (LWE) problem, as introduced in Section 1.4, is one of the fundamental problems used in lattice-based cryptography. Since its introduction in 2005 by Regev[START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF], several variants of it have been studied. One line of research investigates the hardness of LWE when the underlying secret is of small norm. A relatively simple, but elegant reduction allows the secret to follow the same distribution as the noise[START_REF] Applebaum | Fast cryptographic primitives and circular-secure encryption based on hard learning problems[END_REF]. This variant is commonly called the Hermite Normal Form of LWE. Another, more extreme case is to choose the secret as a binary vector, resulting in an LWE sample, where s ∈ {0, 1} n instead of s ∈ Z n q . We call this the binary secret LWE problem, denoted by bin-LWE. It is particularly interesting as it increases efficiency.

1 Contents 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 2.1.1 Our Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 2.1.2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 2.1.3 Roadmap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.2 Warm-up: A Simple Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.3 An Improved Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 2.3.1 First-is-errorless M-LWE . . . . . . . . . . . . . . . . . . . . . . . . . . 44 2.3.2 Extended M-LWE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 2.3.3 Reduction to Binary M-LWE . . . . . . . . . . . . . . . . . . . . . . . 50 2.4 2.5.1 Lagrange Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 2.5.2 Lagrange Basis for Power-of-2 Cyclotomics . . . . . . . . . . . . . . . 56 2.1 Introduction

Table 2 .

 2 1: Comparison between both reductions, where n denotes the ring degree, q the modulus, m the number of samples and d the module rank

	Property	Simple (Section 2.2)	Improved (Section 2.3)
	LWE analogue	[GKPV10] using RD	[BLP + 13]
	minimal rank d noise ratio	log 2 q + Ω(log 2 n) O( √ mn 2 d)	2 log 2 q + ω(log 2 n) O(n 2 √ d)
	class of number fields	cyclotomics	cyclotomics
	sample dependency	dependent	independent
	modulus preserving	yes	yes
	ring degree preserving	yes	yes
	conditions on modulus q	prime	number-theoretic restrictions
	decision/search variant	search	decision
	complexity of proof	simple	involved

Table 6

 6

	.1: Comparison of asymptotic parameters, key sizes and ciphertext sizes
	Parameter	[RSSS17]	Our work [BBD + 19]

  In this chapter, we present a modification of PASS Encrypt together with a security proof based on the decision PV-Knap problem and a leaky variant of it, that we call the PASS problem, both studied in Chapter 5. The latter problem captures the fact that a ciphertext of PASS Encrypt consists of several partial Vandermonde transforms of related elements. In other words, a successful attacker against PV-Knap can be used to win the IND-CPA security game, but a successful attacker against the IND-CPA security of PASS Encrypt may not be powerful enough to solve PV-Knap. This issue was not addressed before in the original version of PASS Encrypt[START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF]. Furthermore, the original scheme is deterministic and thus cannot be IND-CPA secure. Additionally, it uses the Fourier transform similar to older versions of PASS Sign. 2

	1
	7.1.1 Our Contributions

  7.3.1), the Randomness Recovery (Section 7.3.2) and the Plaintext Recovery Using Hints Attacks (Section 7.3.3). The first two attacks are already considered in the original PASS Encrypt proposal by Hoffstein and Silverman[START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF]. We restate them for completeness and rephrase them in the primal attack framework of LWE as done by Alkim et al.[START_REF] Alkim | Post-quantum key exchange -A new hope[END_REF]. Further,[START_REF] Hoffstein | Pass-encrypt: a public key cryptosystem based on partial evaluation of polynomials[END_REF] use the less common notion of MIPS-years, where one MIPS-year equals the number of instructions executed during one year of computing at one million instructions per second. Note that in the parallel line of work concerning PASS Sign, the same type of attacks is studied as well ([HPS + 14, LZA18, DHSS20]).

Table 7 .

 7 1: Sample parameters and security estimations for PASS Encrypt. The number of quantum security bits is computed as 0.265 • min j∈[3] (bikz j ) .

	Parameter	Set 1	Set 2
	ν	2048	4096
	n	1024	2048
	t	512	1024
	q	12289	12289
	p	2	2
	α	2n/3	2n/3
	β	1	1
	ψ f = ψ r = ψ s	U (T n ( n/3 )) U (T n ( n/3 ))
	key recovery (bikz 1 )	298.87	710.11
	randomness recovery (bikz 2 )	298.87	710.11
	plaintext recovery using hints (bikz 3 ) 298.14	712.95
	quantum security (bits)	79	188

Table 7 .

 7 2: Security estimations with different number of rows t for PASS Encrypt. The number of quantum security bits is computed as 0.265 • min j∈[3] (bikz j ) .

	Parameter	Set A Set B Set C
	ν	2048	2048	2048
	n	1024	1024	1024
	t	341	512	682
	q	12289 12289 12289
	key recovery (bikz 1 )	474.89 298.87 171.82
	randomness recovery (bikz 2 )	171.09 298.87 473.45
	plaintext recovery using hints (bikz 3 ) 202.87 298.14 430.49
	quantum security (bits)	45	79	45

Table 7 .

 7 3: Asymptotic parameters in bits for PASS Encrypt, the Regev-like PKE over P-LWE and the NTRU encrpytion scheme.

	Parameter	PASS Encrypt Regev-like [LP11] NTRU [HPS98]
	|sk|	2t • log 2 3	t • log 2 3	t • log 2 3
	|pk|	2t • log 2 q	t • log 2 q	t • log 2 q
	|c|	3t • log 2 q	2t • log 2 q	t • log 2 q
	|m|	2t	t	t
	(|pk| + |c|)/ |m|	2.5 • log 2 q	3 • log 2 q	2 • log 2 q

Premièrement, il nous faut une réduction classique d'un problème sur les réseaux modules au problème M-LWE avec un modulo de taille exponentielle, que nous obtenons en adaptant le pendant de LWE de Peikert[START_REF] Peikert | Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[END_REF] que nous combinons avec un résultat plus récent de Peikert et al.[START_REF] Peikert | Pseudorandomness of ring-lwe for any ring and modulus[END_REF]. Comme deuxième composant, nous avons besoin de la difficulté de M-LWE en utilisant un secret binaire, que nous prouvons dans le Chapitre 2. Enfin, une technique de réduction du paramètre de modulo est nécessaire, où nous pouvons utiliser la technique de changement du rang et du modulo montrée par Albrecht et Deo[START_REF] Albrecht | Large modulus ring-lwe ≥ module-lwe[END_REF]. En assemblant soigneusement ces trois ingrédients, nous obtenons finalement la réduction classique.Middle-Product Learning With RoundingAprès avoir étudié le problème M-LWE qui sert d'hypothèse de difficulté sous-jacente aux schémas de chiffrement et aux signatures numériques pratiques, nous nous intéressons dans le Chapitre 4 à une toute nouvelle version structurée de LWE. La motivation principale de ce chapitre est de combiner deux variantes existantes de LWE, la variante Middle-Product Learning With Errors (MP-LWE)[START_REF] Roşca | Middle-product learning with errors[END_REF] et la variante Learning With Rounding (LWR)[START_REF] Banerjee | Pseudorandom functions and lattices[END_REF], afin de définir un nouveau problème qui bénéficie de leurs avantages respectifs. À cette fin, nous introduisons une nouvelle hypothèse de difficulté que nous appelons le problème Middle-Product Compu-

As a first and accessible approach to the topic, we recommend the film The Imitation Game by Morten Tyldum (2014). Also very interesting is the role many women, called code girls, played during World War 2 (but already before) to decrypt messages sent by the enemy, here the book Code Girls by Liza Mundy (2017) gives many interesting insights for the US and the UK.

Roughly at the same time, employees of the UK Government Communications Headquarters (GCHQ) made similar discoveries which where, however, only declassified in 1997 and thus not accessible for public research at that time.xvii

The impact of quantum computers on secret key cryptography, for instance AES, is so far limited to quadratic speed-ups using Grover's algorithm[START_REF] Grover | Quantum computers can search arbitrarily large databases by a single query[END_REF]. This effect can easily be mitigated by doubling the key sizes.

Throughout the thesis, the neutral singular pronouns they/their are used in order to keep the language as inclusive as possible. See also https://www.acm.org/diversity-inclusion/words-matter

Note that the approximation factors are not preserved through the reductions. In the reduction from GapSVP γ to SIVPγ it is mapped from γ to nγ, where n is the lattice dimension. And in the reduction from SIVPγ to SVPγ it is mapped from γ to √ nγ.

As illustrated in Figure5, Mod-SIVP is at least as hard as Mod-GapSVP using Banaszczyk's transference theorem[START_REF] Banaszczyk | New bounds in some transference theorems in the geometry of numbers[END_REF].

There are variants of NTRU with security proofs from worst-case problems over structured Euclidean lattices [SS11, SS13, YXW17], but they are rarely used in practice for efficiency reasons.

As the map is not injective, it is not an embedding in its strict sense. We think, however, that its close resemblance to the canonical embedding justifies the word embedding here. In other works, this is also called the Number Theoretic Transform (NTT).

We need to consider the real tensor field K R as the canonical embedding is an isomorphism between K R and H but not between R and H , nor K and H .

We refer to Section 1.4 for a proper introduction of LWE and its structured variants.

As we only became aware of this bijection recently, the original results[START_REF] Boudgoust | Towards classical hardness of module-lwe: The linear rank case[END_REF][START_REF] Boudgoust | On the hardness of modulelwe with binary secret[END_REF] restrict the LHL to number fields K, where Rq is a principal ideal domain. Furthermore, we state a more general version allowing the secret to have larger coefficients.

https://www.youtube.com/watch?v=AfDskDKEzwg starting from

min 35 sec.

https://www.youtube.com/watch?v=zDdvV52FBMo

We remark that V Ω • f mod q is the vector of evaluations (f(ωj)) ω j ∈Ω mod q of the polynomial f at the roots in Ω; the full vector of evaluations (f(ωj)) j∈[n] is also known as the Number Theoretic Transform (NTT) of f and f(ωj) is sometimes referred to as the j-th NTT slot or NTT coefficient of f.

Note that the name of the problem varies in the former literature between Partial Fourier Recovery problem, Vandermonde (I)SIS and Fourier (I)SIS. We think, that it's most related to the Knapsack problem and thus call it that way.

Even though they originally called it the Partial Fourier Recovery problem.

A deterministic PKE scheme cannot be IND-CPA secure as an adversary can simply encrypt both messages using the public key and decide which one is used in the challenge ciphertext.

We briefly introduce the digital signature scheme PASS Sign in the introduction to Chapter 5. It uses mathematical concepts which are very similar to the ones of PASS Encrypt.

 3 In Fourier SIS, the partial Fourier matrix, instead of the partial Vandermonde matrix, is used.

https://github.com/lducas/leaky-LWE-Estimator

https://github.com/KatinkaBou/SecurityAnalysisPASSEncrypt

We could further save in storage and bandwidth by only transmitting an index vector in {0, 1} n (instead of the full vector Ω) indicating which row of V is used for the public key.

Acknowledgments

Part I Theoretical Foundations

Chapter 4

Middle-Product Learning With Rounding

The content of this chapter is based on a joint work with Shi Bai, Dipayan Das, Adeline Roux-Langlois, Weiqiang Wen and Zhenfei Zhang which is published in the proceedings of the conference Asiacrypt 2019 [BBD + 19].

Introduction

In Section 1.4, we defined the Middle-Product Learning With Errors (MP-LWE, Def. 1.15) problem, as introduced by Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF]. Recall that the hardness of MP-LWE is guaranteed as long as the Polynomial Learning With Errors (P-LWE, Def. 1.10) problem defined over some polynomial f (x), belonging to an exponentially large family of polynomials, is hard. This makes the hardness of MP-LWE independent of a concrete choice of such a defining polynomial.

Additionally, we defined a deterministic variant of LWE, the Learning With Rounding (LWR, Def. 1.17) problem, as introduced by Banerjee et al. [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF]. It only requires sampling elements uniformly at random over finite sets, and doesn't need to sample from discrete Gaussian distributions. Gaussian distributions play a crucial role in the worst-case to average-case reduction of LWE [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] and P-LWE [START_REF] Stehlé | Efficient public key encryption based on ideal lattices[END_REF] and are in general costly, difficult to implement and vulnerable to side-channel attacks, e.g., [START_REF] Du | Towards efficient discrete gaussian sampling for lattice-based cryptography[END_REF][START_REF] Bruinderink | Flush, gauss, and reload -A cache attack on the BLISS lattice-based signature scheme[END_REF][START_REF] Pessl | Analyzing the shuffling side-channel countermeasure for lattice-based signatures[END_REF][START_REF] Saarinen | Arithmetic coding and blinding countermeasures for lattice signatures -engineering a side-channel resistant post-quantum signature scheme with compact signatures[END_REF]. As for LWE, the LWR variant possesses a structured analogue over rings, called Ring Learning With Rounding (R-LWR).

In 2016, Bogdanov et al. [BGM + 16] use the Rényi divergence to show a sample preserving reduction from the search variant of R-LWE to the search variant of R-LWR. In another work, Alperin-Sheriff and Apon [START_REF] Alperin-Sheriff | Dimension-preserving reductions from LWE to LWR[END_REF] further improve the parameter sets for the reduction. In

Middle-Product Learning With Rounding (MP-LWR)

In the following, we define a new hardness assumption that we call Middle-Product Computational Learning With Rounding (MP-CLWR) and which is an adaption of the Ring Computational Learning With Rounding (R-CLWR) assumption by Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF] to the middle-product setting. As explained before, the motivation to introduce the problem in its computational form stems from the fact that it possesses an efficient reduction from decision MP-LWE with a polynomially large modulus and at the same time we can use it to build a provably secure encryption scheme (see Chapter 6). For a detailed introduction and motivation of the computational notion, see [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF]Section 3].

In order to define this computational assumption, we need to introduce our experiment setting, illustrated in Protocol 4.1. Within the experiment, three different parties in form of algorithms appear: A challenger C interacting with an adversary A who is receiving their samples from a source S. All three algorithms are restricted to be probabilistic and polynomial-time (PPT). As a first step, the source S generates a sample (X , aux) using two sets called var and con. They then send this sample to the challenger C, who computes, with the help of this sample, a tuple (Input, Target). The adversary only receives the Input part of the tuple to compute the Output. The adversary wins the experiment if Output equals Target.

Protocol 4.1: The general experiment setting

The idea of the computational assumption is to consider two different experiments with the same challenger C and adversary A but with different sources S 1 and S 2 , which differ in the distribution var but have the same distribution con, motivating the notation var for variable and con for constant. The new notion guarantees that if A cannot compute Target from X 1 generated by S 1 , then they are not able to compute Target from X 2 generated by S 2 either.

We illustrate the new notion in Protocol 4.2 below. Recall that we already illustrated it in a more informal way in Figure 4.1. Let C be an arbitrary challenger. If the success probability of any adversary A outputting the correct answer in Exp 1 (C, A, S 1 ) is negligible, then it is in Exp 2 (C, A, S 2 ) as well.

Protocol 4.2: The experiment setting of the computational assumption Exp 1 (C, A, S 1 ) Let d, n, p, q, t ∈ N such that d ≤ n and q ≥ p ≥ 2. Further, let q = j∈[ ] p αj j be the prime power factorization of q with some ∈ N, where p j is prime and α j > 0 for all j ∈ [ ]. Let ψ be an error distribution over R <d [x] which is balanced and B-bounded with probability at least δ, fulfilling q > 2pBdt and δ ≥ 1 -1 td . There is a reduction from decision MP-LWE q,n,d,ψ to MP-CLWR p,q,n,d,t , with t the number of samples fixed beforehand.

Assume that the advantage of an MP-CLWR solver is ε. Then, there exists a solver for MP-LWE with advantage at least

where e denotes the Euler's number and Q C,A is as in Definition 4.3.

Our reduction from MP-LWE to MP-CLWR preserves the dimension and the modulus, working for any polynomial-sized modulus q. To prove Theorem 4.1, we need the following sequence of reductions, as illustrated in Figure 4.2. The first part of this sequence, Lemma 4.3, is a standard reduction from decision MP-LWE to decision MP-LWE × , where the latter one denotes the MP-LWE problem with secrets sampled uniformly at random from the set of elements having a full rank Hankel matrix. Lemma 4.4 maps instances of MP-LWE × to instances of MP-CRLWE by simply rounding the second part of any instance. Our results on random Hankel matrices from Section 4.2 are used in Lemma 4.5, where we show a reduction from the rounded middle-product LWE problem to the middle-product LWR problem, for their computational versions. Note that this reduction uses the Rényi divergence and thus asks for fixing the requested number of samples t a priori. This is a necessary requirement which is also imposed in previous works [BGM +

MP-LWE

Further, let q = j∈[ ] p αj j be the prime power factorization of q with some ∈ N, where p j is prime and α j > 0 for all j ∈ [ ]. If there is a PPT algorithm solving MP-LWE × q,n,d,ψ with non-negligible advantage ε, then there is a PPT algorithm solving MP-LWE q,n,d,ψ with nonnegligible advantage at least

, where the instances either come from the uniform distribution over

) and e k ← ψ for all k. A solver can take the samples (a j , b j ) j and query an oracle of MP-LWE × q,n,d,ψ on it. If the instances come from the uniform distribution, the oracle succeeds as usual. If the instances come from the real MP-LWE distribution, the oracle surely succeeds only if the Hankel matrix of s has full rank d. As shown in Lemma 4.1, the probability that the Hankel matrix of s has full rank d is at least j∈[ ] 1 -1 pj . Assuming that the oracle succeeds with non-negligible probability ε in general, it now succeeds with probability at least ε • j∈[ ] 1 -1 pj , which completes the proof.

The second lemma is an adaption of [CZZ18, Lem. 12] to our context. Lemma 4.4 (MP-LWE × to MP-CRLWE) Let d, n, q, p, t ∈ N such that d ≤ n and q ≥ p ≥ 2. Let ψ be an error distribution over R <d [x]. Assume that the advantage of any PPT algorithm to solve the decision MP-LWE × q,n,d,ψ problem is less than ε, then we have

for any PPT adversary A and PPT challenger C. Thus, there is a reduction from MP-LWE × q,n,d,ψ

to MP-CRLWE p,q,n,d,t,ψ , with t the number of samples fixed beforehand.

Proof: In order to show this reduction, we construct an adversary B to solve the decision MP-LWE × q,n,d,ψ problem. This adversary B plays at the same time the role of the challenger C in the MP-CRLWE experiment. At the beginning, B receives a tuple of samples (x j , y j ) j∈ [t] . They set a j = x j and b j = y j p for all j ∈ [t] and X = (a j , b j ) j∈ [t] . As a challenger of the experiment, B can compute the corresponding Input and Target. They send the input to some adversary A and verify if the Output of A equals the Target. If this is the case, B outputs 1, otherwise 0.

If (x j , y j ) j∈[t] are MP-LWE samples, then are (a j , b j ) j∈[t] samples from Y s,ψ , used in the MP-CRLWE assumption. Thus, Pr[B((x j , y j ) j ) = 1] = P C,A (ψ). On the other hand, if (x j , y j ) j

The proof of Lemma 5.3 uses the special shape of Ω in the case of power-of-2 cyclotomic fields. It is, however, not true for general cyclotomic fields, as illustrated in the following counter example.

Example 5.2 (Counter Example for Prime Cyclotomics)

We consider the case, where ν and q are prime integers with q = 1 mod ν. In this case, the minimal polynomial is given by f (x) = x ν-1 + • • • + x + 1 (i.e. of degree ϕ(ν) = ν -1). For concreteness, we choose ν = 5. Thus, the 5-th cyclotomic ring is given by R = Z q [x]/ f (x) , with f (x) = x 4 + x 3 + x 2 + x + 1. Let ω denote a primitive 5-th root of unity in Z q , fulfilling ω 5 = 1 mod q and ω 4 + ω 3 + ω 2 + ω + 1 = 0 mod q. A possible choice could be ω = 3 for q = 11.

Let Ω = {ω, ω 2 } ⊂ {ω j : 1 ≤ j ≤ 4} and thus Ω c = {ω 3 , ω 4 }. Then, the partial Vandermonde matrix V Ω ∈ Z 2×4 q and its complement V Ω c ∈ Z 2×4 q are given by

However, it yields

We now show the equivalence of dec-PV-Knap and PV-LWE, both in their decision variant. The equivalence of their search versions follows in an analogue manner. The proof is essentially the same as for standard Knapsack and LWE, see for instance [MM11, Sec. 4.2], combined with the duality Lemma 5.3. In Chapter 7 in Section 7.3.5, we show how to interpret their equivalence in terms of error-correcting codes.

Lemma 5.4 (From PV-Knap to PV-LWE)

Let n be a power of two and t = n/2. Further, let ψ denote a distribution over Z n . There is a PPT reduction from the problem dec-PV-Knap ψ to PV-LWE ψ .

Proof: Given an efficient algorithm A for PV-LWE ψ , we build an efficient algorithm B for dec-PV-Knap ψ that is given an instance (V Ω , b) with b = V Ω a mod q or b ← U (Z t q ), where a ← ψ and Ω ← U (P t ). Set V Ω = V inv(Ω c ) and note that if Ω ← U (P t ), then inv(Ω c ) also follows the uniform distribution over P t , where inv(Ω c ) = {ω -j = ω ν-j : ω j ∈ Ω c } ⊆ {ω k : k ∈ Z × ν }. Thus, V Ω defines a valid matrix for PV-LWE. The algorithm B for dec-PV-Knap samples s ← U (Z t q ) and picks an arbitrary preimage v ∈ R of b under V Ω , i.e., V Ω v = b mod q (such preimage exists since V Ω is of full rank t over Z q ). The algorithm B then sets b = V T Ω • s + v and runs A on input (V Ω , b ), returning whatever A returns. We now argue that in the real case b = V Ω • a mod q, then (V Ω , b ) is a valid real case instance of PV-LWE ψ . Indeed, we know that v = v + a for some v ∈ R with V Ω • v = 0 mod q. Using Lemma 5.3, we have V Ω • V T Ω = 0 mod q and thus, v has to be in the image of V T Ω and hence v = V T Ω • s , for some s ∈ Z t q and finally b = V

T Ω • (s + s ) + a, so b has the correct real case PV-LWE distribution with secret s := s + s uniformly random in Z t q (thanks to the uniformly random coefficients of V T Ω • s. Again, this also holds for the complement transposed partial Vandermonde transformation matrix V T Ω c , as for every k ∈ {0, . . . , n -1} it yields

Introduction

In Chapter 4, we introduce a new hardness assumption, the problem Middle-Product Computational Learning With Rounding (MP-CLWR, Def. 4.3). It simultaneously benefits from the simplicity of Learning With Rounding (LWR, Def. 1.17) and the security guarantees of Middle-Product Learning With Errors (MP-LWE, Def. 1.15). The computational notion, as opposed to the more standard search and decision notions, was introduced by Chen et al. [START_REF] Chen | On the hardness of the computational ringlwr problem and its applications[END_REF], together with an efficient construction of a PKE scheme with security proof in the Random Oracle Model (ROM). We recall the definition of the ROM in Section 1.5.2. The random oracle is needed to transform the decision problem defined by the IND-CPA security game (Def. 1.20) into a computational problem. To this end, they make use of a reconciliation mechanism, that helps to correctly decrypt a ciphertext.

A first reconciliation mechanism is given by Ding et al. [START_REF] Ding | A simple provably secure key exchange scheme based on the learning with errors problem[END_REF] followed by other proposals (e.g., [START_REF] Peikert | Lattice cryptography for the internet[END_REF][START_REF] Alkim | Post-quantum key exchange -A new hope[END_REF]). We use the notation of Peikert and exert the nearest integer rounding. For this purpose, we need the modular rounding function • 2 : Z q → Z 2 for q ∈ N (see Definition 1.16 for p = 2) and define the reconciliation cross-rounding function • 2 : Z q → Z 2 as

For q even, the reconciliation algorithm REC takes as input two values y ∈ Z q and b ∈ {0, 1} and outputs x 2 , where x is the closest element to y such that x 2 = b. A concrete definition of REC is given as follows. Define two disjoint intervals I 0 = 0, . . . , q 4 -1 and I 1 = -q 4 , . . . , -1 . Let E be the set given byq 8 , q 8 ∩ Z. Further, let y be an element of Z q and b be a bit. Then,

We recall the following results about the cross-rounding function and the reconciliation mechanism from Peikert [START_REF] Peikert | Lattice cryptography for the internet[END_REF].

Lemma 6.1 (Claim 3.1 and 3.2 [Pei14])

Let q ∈ N be even. If x ∈ Z q follows the uniform distribution over Z q , then does x 2 follow the uniform distribution over Z 2 , given

However, if q is odd, then the output bit of the reconciliation method is biased. In order to mitigate the bias, Peikert [START_REF] Peikert | Lattice cryptography for the internet[END_REF] introduces a randomized doubling function. Definition 6.1: Let q ∈ N be odd. The doubling function DBL : Z q → Z 2q is defined as DBL(x) = 2xe, where e ← {-1, 0, 1} with probabilities Pr[e = -1] = Pr[e = 1] = 1 4 and Pr[e = 0] = 1 2 . Now, analogue results also hold for an odd modulus q.

Lemma 6.2 (Claim 3.3 [START_REF] Peikert | Lattice cryptography for the internet[END_REF])

Let q ∈ N be odd. If x ∈ Z q follows the uniform distribution over Z q , then does x 2 with x ← DBL(x) follow the uniform distribution over Z 2 , given

We extend all functions • 2 , • 2 and DBL(•) component-wise to vectors over Z q and coefficientwise to polynomials in Z q [x], as well as the mechanism REC to vectors over Z q × {0, 1} and to polynomials in

Public Key Encryption Based on MP-LWR

In the following, we define the PKE scheme. We use the rounding functions • 2 , • 2 and the reconciliation method REC(•, •) from Section 6.2. Without loss of generality, we assume that the modulus q is even. For q odd, we simply need to use the randomized doubling function DBL(•) as in Section 6.2 to mitigate the bias in the reconciliation mechanism. Further recall from Section 1.4.5 the probabilistic lifting function li (•) from Z p [x] to Z q [x] for two integers p and q with 2 ≤ p ≤ q. It lifts rounded polynomials in Z p [x] to Z q [x] such that li ( a p ) p = a p .

Note that li ( a p ) = a + e with e ∞ ≤ q/p, and we say that lifting introduces a rounding error.

Let k, d, n, p, q and t be positive integers with d + k ≤ n and q ≥ p ≥ 2. Further, let H denote a random oracle H : {0, 1} d → {0, 1} k . The message space is M = {0, 1} k and the security parameter is λ. By ⊕ we denote the bit-wise XOR operation of bit strings. Protocol 6.1: The Public Key Encryption Scheme

) and compute b j = a j d+k s p , return pk = (a j , b j ) j∈[t] and sk = s. Enc(pk, m). For j ∈ [t], sample r j ← U ({0, 1} <k+1 [x])

and set c 1 = j∈[t] r j a j mod q, compute v = j∈[t] r j d li (b j ) mod q and set c 2 = v 2 and c 3 = H ( v 2 ) ⊕ m, return c = (c 1 , c 2 , c 3 ). Dec(sk, c).

Compute w = c 1 d s and return m = c 3 ⊕ H (REC(w, c 2 )).

The encryption scheme, illustrated in Protocol 6.1, works as follows. During key generation, we sample s uniformly at random over (Z <n+d+k-1 q [x]) × such that Hank(s) has full rank, defining the secret key sk = s. This can be done by sampling s uniformly at random and rejecting it if its Hankel matrix is not full rank. Lemma 4.1 quantifies the proportion of random s that fulfill this condition. For j ∈ [t], we sample polynomials a j ∈ Z <n q [x] uniformly at random and compute the rounded middle-product b j = a j d+k s p , defining the public key pk = (a j , b j ) j∈ [t] . In order to encrypt a message m ∈ {0, 1} k = M, we sample for j ∈ [t] a polynomial r j ∈ {0, 1} <k+1 [x] uniformly at random and set c 1 = j∈[t] r j a j mod q, defining the first part of the ciphertext. Here we use within the sum the standard convolution product of two polynomials. Then, we compute an intermediate value v = j∈[t] r j d li (b j ) mod q, which is used to compute the second and third ciphertext part as follows: set c 2 = v 2 and c 3 = H ( v 2 ) ⊕ m. Note, that this time we use within the sum the middle-product of two polynomials. Finally, output the ciphertext c

In order to decrypt a ciphertext c for a secret key s we first compute the intermediate value w = c 1 d s and then return m = c 3 ⊕ H (REC(w, c 2 )).

Correctness

We now show that the PKE scheme defined above is perfectly correct under a proper choice of parameters. See Definition 1.19 for the formal statement of the correctness property of a PKE scheme. Protocol 6.3: Experiment setting of the security proof Exp 1 (C, A, S 1 ) 1 : ((a j , a j d s p ) j , aux) ← (X t s , con)

Parameters and Security

In this section, we first provide some asymptotic parameters and compare them with the ones of the PKE scheme from Roşca et al. [START_REF] Roşca | Middle-product learning with errors[END_REF]. Then, we explain how to analyze the best known attacks against our scheme, which can be used to derive concrete parameters.

Asymptotic Parameters

In the following, we present asymptotic parameters for our PKE scheme from Section 6.3 for a given security parameter λ. Reasonable values for λ are for instance 128 or 256. Our PKE scheme is defined by the parameters k, d, n, p, q and t. We set the dimension n ≥ λ, the middleproduct parameters as k = d = n/2, the number of samples as t = Θ(log 2 (n)), the general modulus as q = Θ(n 4+c log 2 (n) 2 ) and the rounding modulus as p = Θ(n log 2 (n)), where c ∈ R is an arbitrary positive constant. Here, the symbols O, Ω and Θ denote the standard asymptotic notions of bounded above, below and from both directions, respectively. Using these parameters, the scheme is perfectly correct (Lemma 6.3) and secure under the MP-CLWR p,q,n,d+k,t assumption (Lemma 6.5). Using Theorem 4.1, this allows us to rely on the MP-LWE q,n,d+k,ψ problem, where the error distribution ψ is B-bounded with B = O(n 2+c ). The distribution ψ is set to be a discrete Gaussian distribution D αq with α = Θ(1/(n log 2 (n))).

Using the P-LWE f q,D βq to MP-LWE q,n,d+k,Dαq reduction from [START_REF] Roşca | Middle-product learning with errors[END_REF], this in turn prevents attack as [START_REF] Arora | New algorithms for learning in presence of errors[END_REF], where β = Ω( √ n/q) for any f (x) ∈ Z[x] monic of degree n with constant coefficient coprime with q and expansion factor at least n c .

We now compare the asymptotic parameters of our encryption scheme with the ones given in [START_REF] Roşca | Middle-product learning with errors[END_REF]. Table 6.1 shows the asymptotic parameters, key sizes and ciphertext sizes for both schemes. The most important parameter is the value log 2 (q) as it dominates the key and ciphertext sizes of both schemes. Asymptotically, in both cases this value is Θ(log 2 (n)), even though the q is asymptotically larger in our scheme.

In general, the sampling cost is one of the intense operations of an encryption scheme. In the encryption scheme of [RSSS17], we need 2 • t + 1 sampling subroutines, including t from a rounded Gaussian distribution, during key generation and t sampling subroutines during encryption. In contrast, in our case we only need t + 1 sampling subroutine during key generation and t sampling subroutines during encryption. Additionally, in our case all sampling is performed over some uniform distribution which is simpler than Gaussian type sampling.

Further, in our encryption scheme we don't need to restrict the modulus q to be prime. Unlike [START_REF] Roşca | Middle-product learning with errors[END_REF], it works for all integer moduli which are sufficiently large. This gives an advantage on the choice of parameters.