# What is the difference between Poly-LWE and Ring-LWE?

I am often confused by Poly-LWE and Ring-LWE, always thinking that they are different names for the same thing. In some literature, Poly-LWE is a simplified version of Ring-LWE? What is the difference?

One main difference is that in Ring-LWE, the ring $$R$$ is the full ring of integers $$\mathcal{O}_K$$ of a number field $$K$$, whereas in Poly-LWE it is of the form $$R=\mathbb{Z}[x]/f(x)$$ for some irreducible $$f(x)$$; this ring is (isomorphic to) an order of the number field $$K=\mathbb{Q}(x)/f(x)$$, but may not be the full ring of integers.
Another important difference is that in Ring-LWE, the (non-noisy) products $$a_i \cdot s \in R^\vee_q$$ belong to the dual (fractional) ideal $$R^\vee$$ of the ring (modulo $$q$$), whereas in Poly-LWE, all of $$a_i, s, a_i \cdot s$$ belong to $$R_q$$. While the latter is technically simpler, there are several advantages that come with using the dual form.
• In the power of two cyclotomic case, does the error distributions you mentioned for Ring-LWE and Poly-LWE the same, that is, do the error polynomials for $\mathbb{Z}[X]/(X^n+1)$, $n$ a power of 2, also spherical or are they still distorted? Jul 2 at 5:39