Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Primitive-Root Determinant Densities over Prime Fields and Implications for PRIM-LWE

Vipin Singh Sehrawat

Abstract

The \textsc{prim-lwe} problem (Sehrawat, Yeo, and Desmedt, \emph{Theoret.\ Comput.\ Sci.}\ 886, 2021) is a variant of Learning with Errors requiring the secret matrix to have a primitive-root determinant. The dimension-uniform reduction constant is $c(p)=\inf_{m\ge 1}c_m(p)$, where $c_n(p)$ is the density of $n\times n$ matrices over~$\mathbb{F}_p$ with primitive-root determinant. Those authors asked whether $\inf_{p\text{ prime}}c(p)=0$, noting that an affirmative answer would follow from the conjectural infinitude of primorial primes. We resolve this unconditionally using only Dirichlet's theorem and Mertens' product formula, bypassing the primorial-prime hypothesis entirely. We establish the sharp order $\min_{p\le x}c(p)\asymp 1/\log\log x$, prove that $c(p)$ possesses a continuous purely singular limiting distribution over the primes with support exactly $[0,1/2]$, and derive explicit lower bounds on $c(q)$ for primes of cryptographic interest parameterized solely by~$ω(q{-}1)$, the number of distinct prime factors of~$q{-}1$. These bounds apply to every prime~$q$ whose predecessor has controlled factorization structure, as measured by~$ω(q{-}1)$; this includes many NTT-friendly moduli, though NTT-friendliness alone does not imply the needed bound. For the NIST-standardized moduli $q=3329$ (ML-KEM) and $q=8380417$ (ML-DSA), the dimension-uniform expected rejection-sampling overhead~$1/c(q)$ is at most $2.17$ and $3.42$, respectively. As a simple conservative bound, for any prime $q>2^{30}$ one has $1/c(q)\le 1.79\log q$. The worst-case overhead among primes $p\le x$ is $Θ(\log\log x)$, and pointwise $1/c(q)=O(\log\log q)$.

Primitive-Root Determinant Densities over Prime Fields and Implications for PRIM-LWE

Abstract

The \textsc{prim-lwe} problem (Sehrawat, Yeo, and Desmedt, \emph{Theoret.\ Comput.\ Sci.}\ 886, 2021) is a variant of Learning with Errors requiring the secret matrix to have a primitive-root determinant. The dimension-uniform reduction constant is , where is the density of matrices over~ with primitive-root determinant. Those authors asked whether , noting that an affirmative answer would follow from the conjectural infinitude of primorial primes. We resolve this unconditionally using only Dirichlet's theorem and Mertens' product formula, bypassing the primorial-prime hypothesis entirely. We establish the sharp order , prove that possesses a continuous purely singular limiting distribution over the primes with support exactly , and derive explicit lower bounds on for primes of cryptographic interest parameterized solely by~, the number of distinct prime factors of~. These bounds apply to every prime~ whose predecessor has controlled factorization structure, as measured by~; this includes many NTT-friendly moduli, though NTT-friendliness alone does not imply the needed bound. For the NIST-standardized moduli (ML-KEM) and (ML-DSA), the dimension-uniform expected rejection-sampling overhead~ is at most and , respectively. As a simple conservative bound, for any prime one has . The worst-case overhead among primes is , and pointwise .
Paper Structure (11 sections, 25 theorems, 191 equations, 1 table)

This paper contains 11 sections, 25 theorems, 191 equations, 1 table.

Table of Contents

  1. Introduction
  2. Background and the Open Question
  3. Unconditional Proof that $\inf_p c(p) = 0$
  4. Quantitative Refinements
  5. The Limiting Distribution of $c(p)$
  6. The distribution of $\varphi(p-1)/(p-1)$
  7. From $\varphi(p-1)/(p-1)$ to $c(p)$
  8. Explicit Lower Bounds for Primes of Cryptographic Interest
  9. Implications for PRIM-LWE
  10. Concluding Remarks
  11. Positive Density Near $1/2$

Key Result

Corollary 1

Let Let $q\ge 3$ be a prime modulus with $\omega(q-1)\le K$. Then, in the reduction from decision-LWE to decision-prim-lwe over $\mathbb{F}_q$, the dimension-uniform expected rejection-sampling overhead $1/c(q)$ satisfies For each fixed dimension $n$, the exact expected overhead is $1/c_n(q)\le 1/c(q)$.

Theorems & Definitions (52)

  • Corollary 1: Cryptographic consequence
  • Remark 1
  • Theorem 1: Dirichlet Dir37, 1837
  • Theorem 2: Mertens' Third Theorem Mer74, 1874
  • Lemma 1: Lower bound for the matrix-count Euler product
  • proof
  • Theorem 3: Unconditional vanishing of the infimal PRIM-LWE density
  • proof
  • Remark 2
  • Theorem 4: Least prime in an arithmetic progression; Linnik Lin44
  • ...and 42 more