Module-LWE in Post-Quantum Cryptography

• Module-LWE is a generalization of LWE that leverages module arithmetic over cyclotomic rings to interpolate between vector and ring structures.
• It underpins secure key-encapsulation and public-key encryption protocols, exemplified by NIST’s CRYSTALS-Kyber, ensuring quantum resilience.
• Efficient implementations use number-theoretic transforms and robust reconciliation techniques, with benchmarks validating security against modern ML attacks.

Module-Learning-With-Errors (Module-LWE) is a generalization of the Learning-With-Errors (LWE) problem, which forms the hardness foundation for several post-quantum cryptographic systems, most notably NIST's standardized CRYSTALS-Kyber. The security of Module-LWE underpins both public-key encryption and key-encapsulation protocols designed to remain secure even against quantum adversaries. Module-LWE interpolates between LWE and Ring-LWE by leveraging module (as opposed to vector) structure over cyclotomic rings, balancing tight security reductions with efficient implementations.

1. Formal Definition, Algebraic Structure, and Parameterization

Let $n$ be a power of two, $q\geq 2$ an integer modulus, and $R_q = \mathbb{Z}_q[x]/(x^n + 1)$ the $n$-th cyclotomic ring modulo $q$. The module rank $k\geq 1$ and secret rank $\ell \leq k$ are chosen as parameters. In the principal instantiation, consider:

• Secrets: $s \in R_q^\ell$, typically drawn from a "small" distribution (centered binomial $\Psi_\eta$, discrete Gaussian, or sparse binary).
• Public samples: $(a_1, \dots, a_k) \in R_q^\ell$
• Error vector: $q\geq 2$0, drawn from a suitable "noise" distribution.

The $q\geq 2$1-th Module-LWE sample is

$q\geq 2$2

The Search-Module-LWE Problem $q\geq 2$3 is: given sample pairs $q\geq 2$4, with each $q\geq 2$5 and $q\geq 2$6 as above, recover $q\geq 2$7.

In coefficient embedding, stacking each sample yields a system

$q\geq 2$8

with $q\geq 2$9, $R_q = \mathbb{Z}_q[x]/(x^n + 1)$0, $R_q = \mathbb{Z}_q[x]/(x^n + 1)$1. Standard LWE is recovered at $R_q = \mathbb{Z}_q[x]/(x^n + 1)$2, $R_q = \mathbb{Z}_q[x]/(x^n + 1)$3 (with coefficient embedding), and Ring-LWE is the $R_q = \mathbb{Z}_q[x]/(x^n + 1)$4 case.

The security assumption is that, for suitable (NIST/Kyber) parameters (e.g., $R_q = \mathbb{Z}_q[x]/(x^n + 1)$5, $R_q = \mathbb{Z}_q[x]/(x^n + 1)$6, $R_q = \mathbb{Z}_q[x]/(x^n + 1)$7, centered binomial error), no polynomial-time (even quantum) adversary can efficiently recover $R_q = \mathbb{Z}_q[x]/(x^n + 1)$8 or distinguish $R_q = \mathbb{Z}_q[x]/(x^n + 1)$9 samples from uniform (Liu et al., 2024, Wenger et al., 2024).

2. Parameter Choices and Standardized Instances

NIST's CRYSTALS-Kyber utilizes Module-LWE as a core hard problem underpinning its cryptographic security (Liu et al., 2024, Wenger et al., 2024). The standardized parameters are:

Variant	$n$0	$n$1	$n$2	$n$3	$n$4 parameter	Security Level
Kyber512	256	2	3329	$n$5 (binomial)	$n$6	NIST Level 1
Kyber768	256	3	3329	$n$7 (binomial)	$n$8	NIST Level 3
Kyber1024	256	4	3329	$n$9 (binomial)	$q$0	NIST Level 5

Module-LWE's algebraic structure allows efficient use of number-theoretic transforms for multiplication and reduces the representation size compared to standard LWE at the same security level.

3. Cryptanalytic Attacks and Concrete Security Benchmarks

Multiple cryptanalytic approaches have been investigated and benchmarked against Module-LWE, both in theory and in concrete implementation (Bassotto et al., 2 Oct 2025, Wenger et al., 2024):

• Lattice Reduction (uSVP/Kannan’s Embedding): Attempts to solve the unique shortest vector problem via BKZ or similar lattice reduction. For Kyber parameters ($q$1), no successful recovery was reported within $q$2 hours.
• SALSA (ML, Transformer-based): Achieves recovery of secrets with Hamming weight $q$3 (Kyber512: $q$4, $q$5) in $q$6 hours using $q$7 CPUs, $q$8 hours using $q$9 GPUs, at a $k\geq 1$0 success rate.
• Cool & Cruel: Hybrid attack leveraging "cliff splitting" and greedy search recovers $k\geq 1$1 in comparable time to SALSA but with improved GPU recovery (0.1 hours on $k\geq 1$2 GPUs).
• Dual Hybrid Meet-in-the-Middle (Decision-LWE): Feasible for $k\geq 1$3, limited by memory scaling ($k\geq 1$4 table size).

Attacks are much more effective for sparse secrets ($k\geq 1$5). Experimental results indicate that extremely sparse secrets (e.g., $k\geq 1$6 for $k\geq 1$7) should be avoided, which is well-mitigated by the binomial/“full-weight” secrets selected in standardized schemes.

4. Modular Reduction, "Wrap-Around," and Robust Attacks

A fundamental challenge in practical attacks is the loss of information due to modular reduction, introducing the "wrap-around" effect. The pre-modular sample is $k\geq 1$8, and the observation is $k\geq 1$9. If $\ell \leq k$0, the reduction "wraps around" the modulus, making regression and ML approaches less effective.

The NoMod ML-Attack (hybrid white-box robust regression) sidesteps direct modular modeling by treating wrap-around samples as statistical outliers (Bassotto et al., 2 Oct 2025). The attack proceeds by:

1. Lattice-based reduction: Transform the system $\ell \leq k$1 via dual embedding, FLATTER, and BKZ to extract "reduced" equations.
2. Amplification/Resampling: Utilize ring automorphisms (negacyclic rotations) and negative-circulant expansion for more samples.
3. Selection and Pruning: Rank samples by estimated variance, discarding (putative) outliers.
4. Robust Regression: Fit $\ell \leq k$2 using loss functions like Tukey's Biweight, ignoring wrap-around "outlier" equations.
5. Recovery: The robust regression coefficients directly reveal $\ell \leq k$3.

Empirical results demonstrate NoMod's ability to fully recover binary and sparse (e.g., binomial) Module-LWE secrets for parameters well beyond previously claimed security margins ($\ell \leq k$4 for binary; $\ell \leq k$5 for sparse binomial; Kyber settings $\ell \leq k$6 and $\ell \leq k$7 for partial recovery) (Bassotto et al., 2 Oct 2025).

5. Key-Reconciliation, Lattice Quantizers, and Decryption Failure Rates

The reconciliation mechanism in Module-LWE-based KEMs such as Kyber is formally equivalent to quantizing an MLWE sample according to a high-dimensional lattice codebook (Liu et al., 2024). The key constructs are:

• Nested lattice chain: $\ell \leq k$8.
• Encoding: $\ell \leq k$9.
• Decoding: $s \in R_q^\ell$0.

The decryption failure rate (DFR) is tightly bounded via noncentral chi-square tail bounds: $s \in R_q^\ell$1 where $s \in R_q^\ell$2 aggregates error, secret, and quantization variance, and $s \in R_q^\ell$3 is the generalized Marcum-Q function.

Optimal lattice quantizers (e.g., BW16, Leech24) can yield significant reductions in both bandwidth (up to $s \in R_q^\ell$4) and DFR (down to $s \in R_q^\ell$5) compared to the original 1D compressor, while maintaining provable security reductions (Liu et al., 2024).

6. Algorithmic Ingredients and Implementation Considerations

Implementation of Module-LWE-based systems involves:

• Polynomial arithmetic: Number-theoretic transform (NTT) multiplication in $s \in R_q^\ell$6 with prime $s \in R_q^\ell$7 for $s \in R_q^\ell$8 complexity, supporting efficient KEM operations.
• Lattice quantizers: For fixed small $s \in R_q^\ell$9, quantization is achieved by lookup or sphere decoding, with overall complexity $\Psi_\eta$0 for $\Psi_\eta$1 blocks. Recommended quantizers are BW16 ($\Psi_\eta$2) for security/DFR, Leech24 ($\Psi_\eta$3) for bandwidth.
• Robust regression and reduction: Tukey’s Biweight (with threshold $\Psi_\eta$4 proportional to the noise standard deviation) effectively excludes modular wraparounds in NoMod attacks.
• Randomness: Use of cryptographically secure RNGs is mandatory; linear-congruential generators introduce algebraic structure that lattice/ML attacks can exploit.

Preprocessing for attacks requires dual embedding, FLATTER, and BKZ 2.0, with block sizes $\Psi_\eta$5. Dominant cost per tour: $\Psi_\eta$6 to $\Psi_\eta$7 operations for BKZ-40 (Bassotto et al., 2 Oct 2025, Wenger et al., 2024).

7. Security Implications and Best Practices

Benchmarking results and analysis indicate:

• Parameter selection: Maintaining secrets drawn from dense centered binomial distributions (e.g., $\Psi_\eta$8, Hamming weight $\Psi_\eta$9 for $(a_1, \dots, a_k) \in R_q^\ell$0) ensures a substantial safety margin; extremely sparse secrets are susceptible to both ML and robust-regression attacks (Wenger et al., 2024).
• Attack landscape: Robust-regression (NoMod) and modern ML attacks (SALSA, Cool & Cruel) outperform classical lattice attacks at the standard parameter sizes and must now be included in concrete security assessments.
• Failure rate reduction: Replacing 1D Kyber reconciliation with high-dimensional lattice quantizers delivers both bandwidth and DFR improvements without undermining security (Liu et al., 2024).
• Evolving benchmarks: Empirical attack performance significantly deviates from theory, especially at larger $(a_1, \dots, a_k) \in R_q^\ell$1, lower Hamming weights, and for modern hybrid attacks. Regular benchmarking and recalibration of cost models are essential.
• Future recommendations: Continued refinement of ML attack architectures for better wrap-around handling, further BKZ/enumeration improvements, and additional benchmarks for higher-rank MLWE (e.g., $(a_1, \dots, a_k) \in R_q^\ell$2) and structured encryption schemes.

The combination of modern attack techniques (ML, robust regression), optimized parameter selection, and reconciliation via lattice quantization forms the current state-of-the-art in both the security analysis and design of MLWE-based post-quantum cryptography.

References:

(Bassotto et al., 2 Oct 2025, Liu et al., 2024, Wenger et al., 2024)