Revisiting Lattice-Based Attacks Using Trace Map for Ring-LWE

The Ring-LWE problem is one of the mathematical problems underlying the security of lattice-based cryptography, and is defined over the rings of integers of number fields (in particular, cyclotomic fields). In IWSEC 2021, Ikematsu-Nakamura-Yasuda proposed an algorithm for solving the Ring-LWE problem over 2^k-th cyclotomic fields by using trace maps. They showed that there exist special Ring-LWE samples that enable us to reduce the Ring-LWE problem over 2^k-th cyclotomic fields to that over their maximal real subfields. However, Ikematsu et al.’s trace map attack is not practical because the probability of obtaining special Ring-LWE samples, which can be used for Ikematsu et al.’s attack, is negligible.In this paper, we revisit Ikematsu et al.’s trace map attack. We show other subfields, which can be attacked, of 2^k-th cyclotomic fields by studying the Galois groups of 2^k-th cyclotomic fields. We give the probability of obtaining a pair of special samples. Our argument about the probability is more precise than Ikematsu et al.’s argument. In addition, we propose and discuss another trace map attack. The difference between our trace map attack and Ikematsu et al.’s attack is conditions of special samples. Our attack is less practical than Ikematsu et al.’s attack but might be improved with sample deformation technique.