Module Lattice Security (Part I): Unconditional Verification of Weber's Conjecture for $k \le 12$

Abstract: Weber's conjecture (1886) governs three aspects of lattice-based cryptography: the solvability of the Principal Ideal Problem, the freeness of modules over rings of integers, and the tightness of worst-case-to-average-case reductions in Ring-LWE (R-LWE) and Module-LWE (MLWE). Existing verifications for $k \ge 9$ rely on Generalized Riemann Hypothesis (GRH). In this paper, we present the first unconditional proof for $k \le 12$. Our method combines the Fukuda-Komatsu computational sieve, inductive structure of the cyclotomic $\mathbb{Z}_2$-tower, and Herbrand's theorem.

• The paper establishes an unconditional proof that the maximal real subfield of 2^k-th cyclotomic fields has class number one for k ≤ 12, confirming Weber's conjecture.
• It employs a three-step reduction strategy—combining small-prime elimination, eigenspace pruning, and Herbrand's theorem—to rigorously filter candidate primes.
• The result supports tight security reductions for Ring-LWE and Module-LWE schemes by ensuring module freeness and principal ideal properties in relevant cyclotomic fields.

Unconditional Verification of Weber's Conjecture for $k \le 12$: A Technical Overview

Introduction and Motivation

Weber’s class number conjecture, formulating that the maximal real subfield $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$ of the $2^k$-th cyclotomic field has class number $h_k^+ = 1$ for all $k \geq 1$, entails direct consequences for the algebraic underpinnings of lattice-based cryptographic constructions, especially in the context of the security of Ring-LWE and Module-LWE based schemes. For $k \geq 9$, previous verifications have fundamentally relied on the Generalized Riemann Hypothesis (GRH). This work achieves the first unconditional proof for $k \leq 12$, closing a major gap in the theoretical foundation of post-quantum cryptographic assumptions for currently standardized parameter sizes.

Mathematical Foundations and Methodological Advances

The paper’s central technical accomplishment is an unconditional verification of $h_k^+=1$ for $k\leq 12$. The proof proceeds using a three-step reduction strategy, combining advances from computational number theory, explicit class group analysis, and cyclotomic Iwasawa theory.

Stage 1: Small-Prime Elimination (“Fukuda-Komatsu Sieve”)

Leveraging the Wieferich criterion on cyclotomic units, all odd primes $\ell<10^9$ are eliminated as candidates for dividing $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$0 for $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$1. This involves modular exponentiation tests on the images of cyclotomic units, specifically $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$2, over the residue fields corresponding to each $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$3. Surviving candidate primes must satisfy $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$4, an extremely sparse congruence condition sharpening the search space.

Stage 2: Eigenspace Pruning via Cyclotomic $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$5-Tower and Steinitz Class Constraints

The class group structure is analyzed via eigenspace decomposition with respect to the action of the Galois group $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$6. An inductive argument up the cyclotomic $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$7-tower, combined with the known base case $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$8, restricts any possible $K_k^+ = \mathbb{Q}(\zeta_{2^k} + \zeta_{2^k}^{-1})$9-torsion in $2^k$0 for $2^k$1 to full-order character eigenspaces. The proof invokes the vanishing of lower-order eigenspace torsion via properties of the extension norm maps and the triviality of class groups at previous levels.

Stage 3: Finite Candidate Computation via Herbrand’s Theorem

For each remaining pair $2^k$2, Herbrand's theorem connects the presence of nontrivial eigenspace torsion to the divisibility of explicit generalized Bernoulli numbers $2^k$3. The relevant norms are bounded (second-moment bound: $2^k$4 for $2^k$5), rendering the candidate set $2^k$6 of possible divisors finite and computationally tractable, with practical computations not exceeding the range of Elliptic Curve and Number Field Sieve methods for $2^k$7.

Algorithmic Framework

The verification is formalized as an explicit two-phase algorithm:

• Phase A: Compute the norm of each relevant generalized Bernoulli number (one per conjugacy class). Factor the (bounded) integers and select primes passing the congruence filter.
• Phase B: Run the Wieferich test for each remaining candidate. This involves fast modular exponentiation in the quotient ring $2^k$8.

Optimizations include Galois orbit reduction (reducing factorization cost by a factor of $2^k$9) and application of auxiliary annihilators via Thaine’s theorem, streamlining computation by replacing integer factorization with polynomial GCDs in favorable cases.

Implications for Lattice-Based Cryptography

The main theorem ($h_k^+ = 1$0 for $h_k^+ = 1$1) underpins the algebraic hypotheses used in the NIST PQC standards, notably ML-KEM and ML-DSA, which instantiate MLWE over the ring $h_k^+ = 1$2 arising from $h_k^+ = 1$3. Specific implications include:

• Unconditional Module Freeness: Security reductions for MLWE require modules over $h_k^+ = 1$4 to be free. This is unconditional for $h_k^+ = 1$5, given $h_k^+ = 1$6.
• Provable Tightness of Reductions: The worst-case-to-average-case equivalence for Ring-LWE and Module-LWE enjoys maximal tightness and transparency in noise analysis under $h_k^+ = 1$7.
• Algorithmic Simplicity: All ideals are principal in $h_k^+ = 1$8, guaranteeing the algebraic structure used in both design and cryptanalysis is amenable to explicit analysis.

Security Against Quantum Attacks

Quantum attacks on the PIP (e.g., Biasse-Song, Peikert-Regev) are not hindered by class group anomalies at these cryptographically relevant parameters. The main theorem excludes class number-related vulnerabilities, focusing the hardness reductions on the Short Generator Problem in settings where it remains intractable in both classical and quantum models.

Theoretical Consequences and Future Directions

The unconditional verification settles Weber’s conjecture for all $h_k^+ = 1$9 in practical cryptosystem design. The method’s effectiveness suggests deep connections between cyclotomic Iwasawa theory, explicit Galois module analysis, and computational number theory. Potential future extensions include:

• Analysis for odd-prime-power cyclotomic fields $k \geq 1$0, where similar conjectures persist but technical challenges increase (e.g., higher ramification complexity and less tractable auxiliary unit structures).
• Application of the norm-coherence and eigenspace methods to non-cyclotomic totally real fields, potentially informing the security of cryptographic primitives built upon those settings.

Conclusion

This work establishes, unconditionally, that $k \geq 1$1 for all $k \geq 1$2. The result is critical for justifying the algebraic hypotheses underlying modern lattice-based cryptography and validates, from an ideal-theoretic perspective, the use of specific cyclotomic fields in PQC standards. The methods and algorithmic advances presented offer scalable approaches to related class group problems in broader settings, and they significantly strengthen the theoretical guarantees underlying post-quantum module- and ideal-lattice schemes.

Reference: "Module Lattice Security (Part I): Unconditional Verification of Weber's Conjecture for $k \geq 1$3" (2604.15858)