R-LWE instantiation with non-power of 2 polynomial

Question

In almost all RLWE papers, the polynomials are chosen from a ring $\mathbb{Z}[x]/f(x)$ where $f(x)$ is a polynomial of the form $f(x)=x^{2^n}+1$. That leaves us the choice of polynomials like $x^{256}+1$, $x^{512}+1$ or $x^{1024}+1$ etc. Apart from irreducibility, I understand that using this polynomial has few other advantages like fast polynomial multiplication. One disadvantage of this is that it makes the sizes of keys or ciphertexts or signatures bigger. Just for example in the NewHope key-exchange scheme, their proposed parameter uses a polynomial of degree $1024$ which provides much more than $128$ bit security, whereas the less secure version (JARJAR) uses a polynomial of degree $512$ but provides security less than $128$ bits. Evidently, the former version sends much more data over the wire than the latter one. But, what if I want to use a polynomial of degree that is between the above two, for example, $768$, it will provide sufficient security and will use a lesser amount of data.

Now my questions are

1. Can I use cyclotomic polynomial $\phi_{3*768}= x^{768} - x^{384} + 1$ as a modulus?

2. If yes, does the error distribution change? By what degree? (I understand there are some issues described in this paper (How (Not) to Instantiate Ring-LWE) but it is little difficult for me)

Thank you for your help.

Answer 1

On the IACR eprint archive there is a paper entitled "Even More Practical Key Exchanges for the Internet using Lattice Cryptography" by Singh and Chopra that discusses using other cyclotomic fields which provide the same security guarantees as the power of 2 cyclotomic case.

One reason why these other cyclotomics are not as popular is that the speed of the Nunber Theoretic Transform in these other cyclotomics is not as computationally efficient. Nevertheless as you point out there is a legitimate tradeoff between parameter sizes and computation.