Galois Ring Isomorphism Problem (GRI)

• GRI is a computational and algebraic challenge that involves constructing explicit isomorphisms between Galois rings defined by basic-irreducible polynomials.
• It employs techniques such as Hensel lifting and lattice-reduction, ensuring polynomial-time isomorphism recovery under specific parameter settings.
• The problem's hardness supports cryptographic applications, notably fully homomorphic encryption schemes that secure operations over rings of integers modulo prime powers.

The Galois Ring Isomorphism Problem (GRI) is a computational and algebraic challenge involving the recognition and construction of explicit isomorphisms between Galois rings, generalizing the finite field isomorphism problem (FFI) and underpinning novel cryptographic constructions, particularly fully homomorphic encryption (FHE) over rings of integers modulo prime powers. The core objective is to recover the isomorphism, or its associated invariants, between two Galois rings characterized by distinct but related basic-irreducible polynomials. The GRI problem is deeply connected to the structure theory of finite commutative rings, especially Galois rings and Galois-Eisenstein (GE) rings, and has recently seen cryptographic application as a source of hardness for advanced encryption protocols (Khathuria, 2020, Tabue et al., 2015).

1. Algebraic Construction of Galois Rings

Let $p$ be a prime and $k, n \geq 1$. The Galois ring $\operatorname{GR}(p^k, n)$ is the unique (up to isomorphism) finite local ring of characteristic $p^k$, size $p^{kn}$, with maximal ideal $p\operatorname{GR}(p^k, n)$ and residue field $\operatorname{GF}(p^n)$. Concretely, $\operatorname{GR}(p^k, n)$ is realized as $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$ for some monic polynomial $f(x)$ of degree $k, n \geq 1$0 whose reduction modulo $k, n \geq 1$1 is irreducible, known as a basic-irreducible or Eisenstein-type polynomial. The canonical quotient map $k, n \geq 1$2 identifies each Galois ring with its residue field, which is fundamental for the construction and understanding of isomorphisms (Khathuria, 2020, Tabue et al., 2015).

2. Formal Statement of the Galois Ring Isomorphism Problem

Let $k, n \geq 1$3 be monic basic-irreducibles of degree $k, n \geq 1$4. Define $k, n \geq 1$5 and $k, n \geq 1$6, both isomorphic to $k, n \geq 1$7. Any isomorphism $k, n \geq 1$8 is determined by $k, n \geq 1$9 satisfying $\operatorname{GR}(p^k, n)$0. The problem admits two main computational variants:

• Computational GRI: Given $\operatorname{GR}(p^k, n)$1 via $\operatorname{GR}(p^k, n)$2, and oracle access to images $\operatorname{GR}(p^k, n)$3 under an unknown isomorphism $\operatorname{GR}(p^k, n)$4 of “short” elements $\operatorname{GR}(p^k, n)$5, recover either the source polynomial $\operatorname{GR}(p^k, n)$6, the preimages $\operatorname{GR}(p^k, n)$7, or equivalently, the isomorphism $\operatorname{GR}(p^k, n)$8 itself.
• Decisional GRI: Given $\operatorname{GR}(p^k, n)$9, $p^k$0 as above, and two challenge elements $p^k$1, where one is $p^k$2 for a random short $p^k$3, determine which is the genuine image.

Equivalently, the search version asks: for given $p^k$4 and $p^k$5, produce $p^k$6 so that $p^k$7, or declare nonexistence. The isomorphism $p^k$8 is then given by the homomorphism $p^k$9, extended $p^{kn}$0-linearly (Khathuria, 2020).

3. Hardness, Attacks, and Complexity-Theoretic Status

When $p^{kn}$1, $p^{kn}$2 and $p^{kn}$3 are finite fields of size $p^{kn}$4, and the GRI specializes to the finite field isomorphism problem (FFI) as discussed by Doröz et al. (PKC 2018); consequently, the general ring problem (CGRI) is at least as hard as CFFI. For $p^{kn}$5, isomorphisms lift from the residue fields to the Galois rings by Hensel-type Newton iteration:

• Starting with $p^{kn}$6, a root of $p^{kn}$7 in $p^{kn}$8, the lift $p^{kn}$9 is obtained recursively as $p\operatorname{GR}(p^k, n)$0 in $p\operatorname{GR}(p^k, n)$1.
• Each Newton step and finite field root finding can be completed in $p\operatorname{GR}(p^k, n)$2 bit-operations, thus polynomial time in $p\operatorname{GR}(p^k, n)$3.

Known approaches to solve GRI include:

• Lattice-reduction attacks: The isomorphism $p\operatorname{GR}(p^k, n)$4 is $p\operatorname{GR}(p^k, n)$5-linear on a free module of rank $p\operatorname{GR}(p^k, n)$6. Recovering short preimages translates to an instance of the shortest vector problem; for $p\operatorname{GR}(p^k, n)$7–$p\operatorname{GR}(p^k, n)$8 this is beyond current capabilities of LLL/BKZ algorithms.
• Nonlinear algebraic attacks: Solving the defining relations for the image of $p\operatorname{GR}(p^k, n)$9 leads to high-degree multivariate systems in coefficients, believed exponentially hard.
• Average-case hardness: With $\operatorname{GF}(p^n)$0 chosen at random, both distinguishing and search variants of GRI are conjectured hard by information-theoretic considerations (see Observation 1 in (Khathuria, 2020)).

4. Isomorphism Problem for Galois-Eisenstein Rings

In the broader class of Galois-Eisenstein (GE) rings, which generalize Galois rings to structured chain rings of prescribed ramification index $\operatorname{GF}(p^n)$1 and nilpotency index $\operatorname{GF}(p^n)$2, the isomorphism problem becomes a question about orbits under automorphisms. A pure GE ring $\operatorname{GF}(p^n)$3 has the form $\operatorname{GF}(p^n)$4 for $\operatorname{GF}(p^n)$5.

Key structural results include:

• The set $\operatorname{GF}(p^n)$6 decomposes as $\operatorname{GF}(p^n)$7, with $\operatorname{GF}(p^n)$8, where $\operatorname{GF}(p^n)$9.
• Isomorphism classes of pure GE rings of given parameters are in bijection with orbits under the Frobenius automorphism $\operatorname{GR}(p^k, n)$0 (defined as $\operatorname{GR}(p^k, n)$1) acting on $\operatorname{GR}(p^k, n)$2.
• Explicit enumeration is possible via Burnside’s lemma: the number of non-isomorphic pure GE rings is

$\operatorname{GR}(p^k, n)$3

These results reduce the structural isomorphism problem to computations in the multiplicative group of $\operatorname{GR}(p^k, n)$4 and the action of Frobenius, making explicit enumeration and characterization tractable in many cases (Tabue et al., 2015).

5. Application: Fully Homomorphic Encryption From GRI

The GRI is used as the foundation for a fully homomorphic encryption (FHE) scheme over $\operatorname{GR}(p^k, n)$5:

• Key Generation: Select parameters $\operatorname{GR}(p^k, n)$6 for the security level, choose random basic-irreducibles $\operatorname{GR}(p^k, n)$7, compute the secret isomorphism $\operatorname{GR}(p^k, n)$8 by Hensel-lifting, sample noise elements in $\operatorname{GR}(p^k, n)$9, and compute their images in $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$0 for the public key.
• Encryption: Encodes a message $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$1 as $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$2, adds randomly weighted images from the public key to obtain the ciphertext $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$3.
• Evaluation: Arithmetic circuits evaluated directly in $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$4.
• Decryption: Applies the secret isomorphism inverse, reduces mod $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$5 to the residue field, and rounds to recover the plaintext, provided noise remains small.

Correctness holds as long as noise is bounded by $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$6, and parameters are chosen to make known attacks infeasible for realistic security levels (e.g., $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$7, small prime $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$8, large $(\mathbb{Z}/p^k\mathbb{Z})[x]/(f(x))$9). Security reductions show that an adversary who can break semantic security for this FHE can be used to solve the decisional or computational GRI, establishing a tight reduction (Khathuria, 2020).

6. Illustrative Examples and Algorithmic Procedures

Explicit examples elucidate the lifting process:

• For $f(x)$0, $f(x)$1, $f(x)$2, with $f(x)$3, $f(x)$4, lift a root modulo $f(x)$5 and then via Newton iteration in $f(x)$6 to obtain the isomorphism. “Noise” polynomials are constructed with small coefficients, and encryption/decryption follow directly from the FHE blueprint.
• Pseudocode is provided for both the isomorphism lifting (using iterative Newton steps) and FHE key generation with random short basis elements and their isomorphic images.

Parameter selection is guided by security and correctness: $f(x)$7 is small, $f(x)$8 handles accumulated noise, $f(x)$9 is large to resist lattice attacks, and $k, n \geq 1$00 is chosen such that post-evaluation noise remains within decryption bounds (Khathuria, 2020).

7. Computational and Enumerative Aspects

The isomorphism classes of pure GE rings are classified by the orbits of the Frobenius automorphism on a finite coset group $k, n \geq 1$01, and their structure is understood via explicit coset and orbit enumeration. This classification algorithmically constructs all non-isomorphic pure GE rings with fixed parameters, highlighting the interplay between ring invariants and automorphism group actions.

The analysis thus weaves together algebraic structure theory, algorithmic isomorphism testing, and post-quantum cryptographic application—the hardness of GRI and its variants providing both theoretical and practical significance across computational algebra and cryptology (Tabue et al., 2015, Khathuria, 2020).