---
title: 'M-SIS: Module Short Integer Solution'
url: https://www.emergentmind.com/topics/module-short-integer-solution-m-sis
type: topic
---

# M-SIS: Module Short Integer Solution

Module Short Integer Solution (M-SIS) is the generalization of the classical SIS (Short Integer Solution) problem to module lattices defined over cyclotomic integer rings. M-SIS forms the basis of efficient, randomized constructions of symplectic lattices, which in turn yield Gottesman-Kitaev-Preskill (GKP) quantum error-correcting codes achieving optimal asymptotic distance properties, without requiring trapdoors for efficient decoding. This approach underlies recent advances in lattice-based cryptography and the theory of symplectic lattices used for fault-tolerant quantum information processing [2509.10183].

## 1. Formal Definition of the M-SIS Problem and Associated Lattice

The M-SIS problem is parameterized by:
- A cyclotomic ring $R = \mathbb{Z}[X]/(\Phi(X))$, where $\Phi(X) = X^n + 1$ for the main constructions,
- A finite ring $R_q = (\mathbb{Z}/q\mathbb{Z})[X]/(\Phi(X))$ for integer modulus $q$,
- Module rank $k \in \mathbb{N}$.

An M-SIS instance consists of a uniformly random matrix $H \in R_q^{k \times k}$ (often symmetric: $H^T = H$), with the objective to find a nonzero vector $z = (z_1, z_2) \in R^k \times R^k$ satisfying $H z_1 \equiv z_2 \pmod{qR}$ and $\|z\|$ (in the coefficient embedding $\mathbb{Z}^{2kn}$) "short," meaning $\|z\|_2 \ll q$.

- **M-SIS Lattice:** For such $H$, the lattice is
  $$
  \Lambda_H := \{\, z = (z_1, z_2) \in R^{2k} \mid H z_1 \equiv z_2 \pmod{qR}\, \}.
  $$
  Identified via the coefficient map $R \cong \mathbb{Z}^n$, $\Lambda_H$ is a full-rank lattice embedded in $\mathbb{Z}^{2kn}$.
- **Explicit $\mathbb{Z}$-basis:** The augmented matrix $A(H) = [ H \mid -I_k ] \in R_q^{k \times 2k}$ defines the lattice as the set of $v \in R^{2k}$ such that $A(H)\,v \equiv 0 \pmod{q}$. By block-circulant lifting, the integer matrix $M_H \in \mathbb{Z}^{2kn \times 2kn}$ is built using the mapping of ring multiplications to $n \times n$ (negacyclic, circulant) matrices.

## 2. Randomized Symplectic Lattice Construction from M-SIS

A constructive algorithm, SYMP-FROM-M-SIS, transforms an M-SIS lattice $\Lambda_H$ into a $q$-symplectic lattice in $2kn$ real dimensions, and thence (via scaling) into a $1$-symplectic lattice appropriate for use as a GKP code lattice.

Let $n,\,k,\,q$, and $R_q$ be as above. The steps are:
1. Build the block-circulant matrix $\rho(H) \in \mathbb{Z}_q^{kn \times kn}$ from $H$.
2. Form the integer block matrix:
   $$
   M_H = \begin{pmatrix}
   I_{kn} & \rho(H) \\
   0      & q I_{kn}
   \end{pmatrix}
   $$
3. Define $U = \sigma_n \oplus \cdots \oplus \sigma_n \oplus I_{kn}$, with $\sigma_n = \operatorname{diag}(1, -I_{n-1})$ (symmetrizing).
4. Compute $\bar{M}_H = U M_H U$, which is $q$-symplectic: $\bar{M}_H J_{2kn} \bar{M}_H^T = q J_{2kn}$.
5. Set the symplectic-basis $B = (1/\sqrt{q})\,\bar{M}_H$. The resulting symplectic lattice is $\Lambda_{\mathrm{symp}} = \mathbb{Z}^{2kn} \cdot B$.

All steps use only uniform sampling in $R_q$ and ring/matrix arithmetic mod $(X^n+1)$.

## 3. Minimal Distance and GKP Code Parameters

The minimal vector length $\lambda_1(\Lambda_{\mathrm{symp}})$ is analyzed to ensure robust error correction.

- **Distance Guarantee:** With high probability over random $H$, for parameters $r,\,q$ chosen appropriately,
  $$
  \lambda_1(\Lambda_{\mathrm{symp}}) \gtrsim (1/\sigma_{2kn})^{1/(2kn)} \approx \sqrt{kn/(\pi e)},
  $$
  where $\sigma_{2kn}$ is the volume of the $2kn$-dimensional unit ball.

A key technical argument bounds the probability that a short nonzero $z \in \mathbb{Z}^{2kn}$ lies in $\Lambda_H$ by $q^{-k d_T}$, where $d_T$ depends on the support of $z$'s projections across ring-factor blocks. Volume arguments and union bounds then show that, for $q$ at least polynomial in $nk$, the inclusion probability vanishes exponentially in $nk$, yielding high-probability optimal lattice distance.

- **GKP Code Parameters:** Given a symplectic lattice $\Lambda \subset \mathbb{R}^{2n'}$, a GKP code encoding $n'$ logical qubits has code distance $\Delta_{\mathrm{GKP}} = \lambda_1(\Lambda)$. For scaled lattices $(\sqrt{\lambda} \Lambda_{\mathrm{symp}})$, the distance obeys
  $$
  \Delta \geq \sqrt{kn / (\pi e \lambda)}
  $$
  when encoding $kn \log \lambda$ qubits in $kn$ modes.

## 4. Efficient Bounded-Distance Decoding Algorithm

The decoding algorithm operates by Babai-style rounding in the coefficient embedding. For $t = (t_1, t_2) \in \mathbb{R}^{2kn}$, and with symplectic lattice basis derived from $(M_H, q, \lambda)$, the algorithm proceeds:

1. For $i=1$ to $kn$, set $c_i := \mathrm{round}(\sqrt{\lambda q}\,t_i)$.
2. Compute $t' = (t_{kn+1}, \ldots, t_{2kn})$.
3. Compute $w = t' - (1/\sqrt{q}) \cdot (c_1, \ldots, c_{kn}) \cdot \rho(H)$ (ring-multiplication in $R^k$).
4. For $i=kn+1$ to $2kn$, set $c_i := \mathrm{round}(\sqrt{\lambda / q}\,w_{i-kn})$.
5. Output $c = (c_1, \ldots, c_{2kn})$.

For $t$ within distance $1/(2\sqrt{\lambda q})$ of $\Lambda_{\mathrm{symp}}$, the algorithm returns the closest lattice point. The naive computational cost is $O((kn)^2)$, as $\rho(H)$ multiplication dominates. For $R = \mathbb{Z}[X]/(X^n+1)$ with $n$ power of 2, each ring-multiplication admits $O(n\log n)$ via FFT, yielding overall decoding in $O(k^2 n \log n)$: near-linear in the real dimension $2kn$ when $k$ is constant.

## 5. Parameter Regimes for Code Construction

Concrete regimes realize optimal or near-optimal GKP code distances with high probability:

- **Case A ($n$ power of 2, $k \geq 1$, $q \equiv 5 \bmod 8$):**
  - If $q \geq (\pi e (nk)^2)/2$, then $\lambda_1(\Lambda_{\mathrm{symp}}) \geq \sqrt{nk/(\pi e)}$ with probability at least $1 - O(1/\sqrt{nk})$.
  - For $q \geq 2\pi e (nk)^{3/2}$, the guarantee strengthens: $\lambda_1 \geq (1 - (nk)^{-3/4})\sqrt{nk/(\pi e)}$.

- **Case B ($n = 2^e p_1 p_2$, $p_1,p_2$ odd primes, $\gcd(p_1-1,p_2-1)=2$, $q$ primitive-$\lambda$ root of $2n$):**
  - If $k > (\log (n/2))/4$ and $q \geq 32\pi e k^2/(\log(n/2))^2$: $\lambda_1 \geq (1 - (\log(n/2))/(4k))\sqrt{nk/(\pi e)}$.
  - If $4k > n^{1/4}$ and $q \geq 32\pi e k^2/\sqrt{n}$: $\lambda_1 \geq (1 - n^{1/4}/(4k))\sqrt{nk/(\pi e)}$.

- **Case C ($n = 2^e p$, $e \geq 2$, $p$ prime):** See [2509.10183], Theorem 4.7 for analogous $q$-bounds.

Scaling yields $[[kn \log \lambda,\, kn]]$ GKP codes with distance as above. For $k=1$ (R-SIS case), decoding is $O(n \log n)$. For larger $k$, arbitrary $n$ is supported at $O(k^2 n \log n)$.

## 6. Applications and Significance

The M-SIS to symplectic lattice pipeline supplies the first efficient randomized construction of multi-mode GKP codes from standard lattice-cryptographic assumptions, using only uniform sampling without secret trapdoors.

Notably:
- The code distances match (up to constants) the information-theoretic optimum $\sqrt{n / (\pi e)}$.
- The decoding algorithm is both trapdoor-free and near-linear time, enabled for $X^n+1$ by efficient FFT-based ring arithmetic.
- Useful parameter regimes correspond to cases where $\Phi(X)$ splits into a small number of large factors over $\mathbb{F}_q$ (e.g., $n$ a power of two).

A plausible implication is that such cryptographic-lattice-based constructions can serve as practical, scalable GKP code sources for extended quantum computation and error correction, bridging cryptography and quantum information [2509.10183].

Source: https://www.emergentmind.com/topics/module-short-integer-solution-m-sis