Principal ideal problem and ideal shortest vector over rational primes in power-of-two cyclotomic fields

TL;DR

This work studies the shortest-vector problem for prime ideals in power-of-two cyclotomic fields ${\mathbb Z}[\zeta_{2^{n+1}}]$, focusing on primes with $p \equiv 7,9 \pmod{16}$. By combining the principal ideal problem approach with decomposition-subfield methods, it proves a positive shortest-generator–shortest-vector (SVSG) correspondence for rings ${\mathbb Z}[\sqrt{2}]$, ${\mathbb Z}[i]$, ${\mathbb Z}[\zeta_8]$, and ${\mathbb Z}[\zeta_{16}+\zeta_{16}^7]$, and derives the exact length $\lambda_1(\Sigma_{\mathbb Q(\zeta_{2^{n+1}})}(\mathfrak p)) = \sqrt{2^n a_p}$ where $a_p$ is the minimal solution to $a_p^2 - 2 b_p^2 = p$. It also provides a tighter upper bound $\lambda_1(\Sigma_{\mathbb Q(\zeta_{2^{n+1}})}(\mathfrak p)) < \sqrt[4]{2^{2n+1} p}$ than Minkowski’s bound, and reduces higher-dimensional SVP in many cases to lower-dimensional or generator-based computations. Together, these results illuminate the structure of ideal SVP in these cryptographically relevant fields and offer algorithmic pathways to compute key Pell-type parameters $a_p$ efficiently.

Abstract

The shortest vector problem (SVP) over ideal lattices is closely related to the Ring-LWE problem, which is widely used to build post-quantum cryptosystems. Power-of-two cyclotomic fields are frequently adopted to instantiate Ring-LWE. Pan et al. (EUROCRYPT~2021) explored the SVP over ideal lattices via the decomposition fields and, in particular determined the length of ideal lattices over rational primes $p\equiv3,5\pmod{8}$ in power-of-two cyclotomic fields via explicit construction of reduced lattice bases. In this work, we first provide a new method (different from analyzing lattice bases) to analyze the length of the shortest vector in prime ideals in $\mathbb{Z}[ζ_{2^{n+1}}]$ when $p\equiv3,5\pmod{8}$. Then we precisely characterize the length of the shortest vector on the cases of $p\equiv7,9\pmod{16}$. Furthermore, we derive a new upper bound for this length, which is tighter than the bound obtained from Minkowski's theorem. Our key technique is to investigate whether a generator of a principal ideal can achieve the shortest length after embedding as a vector. If this holds for the ideal, finding the shortest vector in this ideal can be reduced to finding its shortest generator.

Figures (3)

• Figure 1: Decomposition of prime ideals when $p\equiv9\pmod{16}$
• Figure 2: Decomposition of prime ideals for $p=89$
• Figure 3: Decomposition of prime ideals when $p\equiv 7\pmod {16}$

Theorems & Definitions (29)

• theorem 3
• theorem 4
• proof
• lemma 1
• proof
• theorem 5
• proof
• theorem 6
• proof
• theorem 7