# Can you instantiate Ring-LWE with coefficients from a prime-power field?

Generally, we instantiate Ring-LWE with the polynomial ring $$R = \mathbb{F}_q\ /\ (X^N+1)$$ for prime $$q$$ and some power-of-two $$N$$.

Can we instead do Ring-LWE over the ring $$R = \mathbb{F}_q\ /\ (X^N+1)$$, where $$q$$ can be any prime power? Basically, this would mean the coefficients of ciphertexts are elements of $$GF(q)$$.

(Also, is this an unusual choice, or covered by existing literature that I'm not aware of?)

• I think that the first sentence is to be read: Generally, we instantiate Ring-LWE with the polynomial ring $R=\mathbb F_q[X]\,/\,(X^N+1)$ for prime $q$ and some power-of-two $N$.
– fgrieu
Jul 28, 2023 at 10:24
• Yes, I edited it, thank you! Jul 28, 2023 at 16:29

• It's not called that, because the choice of $q$ doesn't impact the security of schemes except via the quantity $\log q$. Jul 28, 2023 at 16:39
• But these schemes use $\mathbb{Z}_q$, not $\mathbb{F}_q$ for prime-power q. These are different things (the first isn't even a field!) Jul 28, 2023 at 16:45
• In that case, don't you have that $\mathbb{F}_q\cong \mathbb{Z}_p[x](f(x))$ for $f = \deg e$, and $\mathbb{Z}_q[y]/(g(y))\cong \mathbb{Z}_p[x,y]/(f(x),g(y))$? I.e. it appears you are asking about the security of a bivariate form of RLWE with small modulus. Jul 28, 2023 at 17:13
• Note that if this interpretation is correct, you should be careful. Bivariate RLWE has some known security issues. In particular, you might hope that its security corresponds to univariate RLWE of degree $\deg f\cdot \deg g$. This is not always the case, see On the security of multivariate RLWE. The net effect is you might have to choose $p$ large enough that RLWE in $\mathbb{Z}_p[y]/(g(y))$ is still hard, i.e. negating the benefit of choosing the larger modulus $q = p^e$. Jul 28, 2023 at 17:20