1Introduction

Exact CVP Is NP-Complete for Principal Cyclotomic Ideals

Jiaqi Liu Yansong Feng Yanbin Pan

State Key Laboratory of Mathematical Sciences,

Academy of Mathematics and Systems Science, Beijing, China

{ljqi,fengyansong,panyanbin}@amss.ac.cn

We prove that exact Euclidean decision-CVP is $\mathsf{NP}$ -complete on the coefficient lattices of nonzero principal ideals in the power-of-two cyclotomic rings $R_{d}=\mathbb{Z}[y]/(y^{d}+1)$ . A deterministic reduction from Exact Cover by 3-Sets (X3C) produces an integral target and an integer squared threshold $\Delta$ such that the closest squared distance is exactly $\Delta$ in YES instances and at least $\Delta+4$ in NO instances. Moreover, the ideal elements whose squared distance from the target under the coefficient embedding is at most $\Delta$ are in bijection with the exact covers of the given X3C instance. This also gives $\mathsf{NP}$ -hardness of exact search-CVP under polynomial-time Turing reductions.

We also transfer the resulting principal-ideal CVP instances to full-rank principal ideals of the cyclic quotient ring $\mathbb{Z}[X]/(X^{D}-1)$ , where $D=2d$ . Their coefficient lattices are invariant under a cyclic rotation by one coordinate. The lift preserves principality, doubles the dimension, and scales the squared distances of corresponding elements by eight. Thus, on principal cyclic ideal lattices, exact decision-CVP is $\mathsf{NP}$ -complete and exact search-CVP is $\mathsf{NP}$ -hard.

The cyclotomic and cyclic hardness results also admit uniformly computable fixed-family forms. For each X3C universe size, one principal cyclotomic ideal and one principal cyclic ideal can be fixed before the collection of triples is known, and only the respective targets and squared thresholds depend on the collection. Thus exact decision-CVP remains $\mathsf{NP}$ -complete on both fixed families. If exact decision-CVP with preprocessing (CVPP) were solvable in polynomial time on either family, then $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$ . By the Karp–Lipton theorem, such a preprocessing scheme would collapse the polynomial hierarchy to $\Sigma_{2}^{\mathsf{P}}$ . To our knowledge, the cyclic results resolve the exact decision versions of Micciancio’s questions of whether CVP is $\mathsf{NP}$ -hard on cyclic lattices and on a fixed family of cyclic lattices, even under the stronger restriction to full-rank principal cyclic ideals.

1 Introduction

A lattice is the set of all integer combinations of linearly independent vectors. Two basic lattice problems are the shortest vector problem (SVP) and the closest vector problem (CVP). SVP asks for a shortest nonzero lattice vector. CVP asks for a lattice point closest to a given target. Both problems are central in the study of lattices and in lattice-based cryptography; see [17] for background.

Cryptographic schemes often use lattices with extra algebraic structure. An ideal in a polynomial quotient ring is closed under multiplication by every ring element, and a principal ideal is generated by a single element. In coefficient coordinates, ring multiplication becomes polynomial convolution. For example, ideals in $\mathbb{Z}[X]/(X^{D}-1)$ give lattices closed under cyclic rotation. This structure gives shorter descriptions and faster arithmetic. It is used in lattice-based cryptography, including the NTRU cryptosystem, Ring-LWE-based schemes, compact one-way functions, collision-resistant hashing, and fully homomorphic encryption [12, 16, 20, 22, 15, 9]. The same structure may also enable specialized algorithms.

For general lattices, much is known about hardness. Exact Euclidean decision-CVP is $\mathsf{NP}$ -complete [24]. CVP is also $\mathsf{NP}$ -hard to approximate within almost-polynomial factors [5]. Exact Euclidean SVP is $\mathsf{NP}$ -hard under randomized reductions [1]. Approximating Euclidean SVP within some constant factor is also $\mathsf{NP}$ -hard under randomized reductions [18]. Hair and Sahai recently proved deterministic $\mathsf{NP}$ -hardness of exact SVP in the $\ell_{p}$ -norm for every $p>2$ [11], and almost-polynomial-factor hardness for every finite $p\geq 2$ under deterministic subexponential-time reductions [10]. These reductions can build arbitrary lattice bases and need not preserve the ideal or principal ideal structure. Earlier work gave reductions between problems on ideal lattices, but these reductions do not prove the $\mathsf{NP}$ -hardness of exact CVP on principal ideals [23]. This gap matters because cyclotomic structure can lead to special algorithms. Examples include recovering short generators of some principal ideals [3] and, under number-theoretic assumptions, finding mildly short vectors in cyclotomic ideal lattices in quantum polynomial time [4].

CVP with preprocessing (CVPP) asks what happens when the lattice is known before the target. The offline step may take unlimited time, but it may keep only polynomially many bits; the online step must answer target-and-threshold queries in polynomial time. Micciancio showed that exact decision-CVPP has no polynomial-time solution on general lattices unless $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$ [19]. For approximate CVPP, constant-factor approximation is hard [7]. Stronger inapproximability factors are known under quasipolynomial-time hardness assumptions [2, 14]. Separately, Micciancio asked whether CVP is $\mathsf{NP}$ -hard on cyclic lattices and whether it remains hard for a fixed family with one cyclic lattice for each input size [21].

This leads to our main question.

Is exact Euclidean CVP $\mathsf{NP}$ -hard for ideal and cyclic lattices, even for full-rank principal ideals? Does this hardness still hold for a uniformly computable family with one ideal per input size, fixed before the target is known?

1.1 Our results

Our answer to both questions is yes. Our main result concerns principal ideals in the power-of-two cyclotomic rings

R_{d}=\mathbb{Z}[y]/(y^{d}+1),

where $d$ is a power of two.

Theorem 1.1 (Principal cyclotomic ideals, informal).

For $d$ ranging over powers of two, exact Euclidean decision-CVP is $\mathsf{NP}$ -complete on the coefficient lattices of nonzero principal ideals in $R_{d}$ . A deterministic polynomial-time many-one reduction from Exact Cover by 3-Sets (X3C) produces an integral target and an integer squared threshold $\Delta$ . The closest squared distance is exactly $\Delta$ in a YES instance and at least $\Delta+4$ in a NO instance. Moreover, the ideal elements whose squared distance from the target under the coefficient embedding is at most $\Delta$ are in bijection with the exact covers of the X3C instance.

Every nonzero ideal in $R_{d}$ has full $\mathbb{Z}$ -rank. By Lemma 2.3, the theorem also holds under the canonical embedding after multiplying all squared distances and thresholds by $d$ . This bijection also gives $\mathsf{NP}$ -hardness of exact search-CVP under polynomial-time Turing reductions.

The construction also lifts to full-rank principal ideals in $S_{D}=\mathbb{Z}[X]/(X^{D}-1)$ , where $D=2d$ , and proves $\mathsf{NP}$ -completeness of exact decision-CVP on their coefficient lattices, which are cyclic lattices. Exact search-CVP on these lattices is $\mathsf{NP}$ -hard under polynomial-time Turing reductions. Since $X^{D}-1$ is reducible, these are coefficient lattices in a cyclic quotient, not canonical ideal lattices from the ring of integers of a single number field.

For each X3C universe size $m$ , we also give one uniformly computable principal cyclotomic ideal and one principal cyclic ideal, both of dimension $\Theta(m^{7})$ . Only the target and squared threshold depend on the triple collection, while exact decision-CVP remains $\mathsf{NP}$ -complete. Unless $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$ , exact decision-CVPP has no polynomial-time solution on either family. Consequently, the polynomial hierarchy would collapse to $\Sigma_{2}^{\mathsf{P}}$ if such a solution existed [13]. To our knowledge, these cyclic results answer Micciancio’s two open questions about exact CVP.

1.2 Technical overview

The main challenge is to control every element of the ideal. In a reduction to a general lattice, we may choose the basis vectors separately. For a principal ideal $(g)\subseteq R_{d}$ generated by $g$ , however, the natural basis vectors are the negacyclic shifts

g,yg,\ldots,y^{d-1}g,

and every element of $(g)$ has the form $gq$ for some $q\in R_{d}$ . Thus we must encode Boolean vectors by suitable choices of $q$ and rule out every other $gq$ .

We achieve our goal by reducing from X3C [8]. An X3C instance consists of a universe of size $m$ and $n$ three-element subsets, called triples, and asks whether some subcollection covers every element exactly once. We write this condition as the following integer linear system with Boolean unknowns:

\mathbf{A}\boldsymbol{\xi}=\mathbf{b},\hskip 20.00003pt\mathbf{A}\in\{0,1\}^{m\times n},\hskip 10.00002pt\mathbf{b}\in\{0,1\}^{m},\hskip 10.00002pt\boldsymbol{\xi}\in\{0,1\}^{n}.

(1)

Here $\mathbf{A}$ is the incidence matrix and $\mathbf{b}=\mathbf{1}_{m}$ . A Boolean solution $\boldsymbol{\xi}$ specifies an exact cover. We encode $\boldsymbol{\xi}$ as

a_{\boldsymbol{\xi}}(x):=\sum_{k=1}^{n}\xi_{k}x^{\alpha_{k}}.

Encoding the Boolean equations.

We choose the exponents $\alpha_{1},\ldots,\alpha_{n}$ so that all nonzero ordered differences $\alpha_{k}-\alpha_{j}$ are distinct. A classical Sidon construction provides such exponents of size $O(n^{2})$ [6]. We choose pairwise well-separated coefficient positions $\rho_{1},\ldots,\rho_{m}$ for the $m$ rows and set

h(x):=\sum_{i,j:A_{ij}=1}x^{\rho_{i}-\alpha_{j}}.

The product $x^{\rho_{i}-\alpha_{j}}x^{\alpha_{k}}$ contributes at coefficient position

\rho_{i}-\alpha_{j}+\alpha_{k}.

When $k=j$ , all contributions for row $i$ occur at $\rho_{i}$ and sum to $(\mathbf{A}\boldsymbol{\xi})_{i}$ . When $k\neq j$ , these products occupy pairwise distinct positions, all separate from the row positions $\rho_{i^{\prime}}$ .

To obtain a gap in coefficient $\ell_{2}$ -distance, we define the target polynomial $t$ by assigning coefficient $2b_{i}$ at $x^{\rho_{i}}$ and coefficient one at every position $\rho_{i}-\alpha_{j}+\alpha_{k}$ with $A_{ij}=1$ and $k\neq j$ . The positions $\rho_{i}$ contribute $4\|\mathbf{A}\boldsymbol{\xi}-\mathbf{b}\|_{2}^{2}$ . At every other specified position the difference is $2\xi_{k}-1\in\{-1,1\}$ . We denote the number of these positions by $\nu$ , so their total squared contribution is $\nu$ , independently of $\boldsymbol{\xi}$ . This gives

\|2ha_{\boldsymbol{\xi}}-t\|_{2}^{2}=\nu+4\|\mathbf{A}\boldsymbol{\xi}-\mathbf{b}\|_{2}^{2}.

Thus every Boolean vector satisfying (1) has squared distance $\nu$ , whereas every Boolean vector violating at least one constraint in (1) has squared distance at least $\nu+4$ .

Controlling every ideal element.

The identity above applies only to the polynomials $a_{\boldsymbol{\xi}}$ encoding Boolean vectors. To handle every $q\in R_{d}$ , we place the construction in the even coordinates of a larger cyclotomic ring by replacing $x$ with $y^{2}$ . The degree- $<d$ representative of $q$ then decomposes uniquely as

q(y)=a(y^{2})+yb(y^{2}).

Here $a$ and $b$ are the integer polynomials formed by the even and odd coefficients of $q$ , respectively. A mask $\boldsymbol{\mu}\in\{0,1\}^{n}$ records which coordinates of $\boldsymbol{\xi}$ may equal one, and we set $u_{\boldsymbol{\mu}}(x):=\sum_{k}\mu_{k}x^{\alpha_{k}}$ . The basic X3C reduction takes $\boldsymbol{\mu}=\mathbf{1}_{n}$ . For a sufficiently large integer $P$ , we set

	$\displaystyle g(y)$	$\displaystyle:=2h(y^{2})+2Py,$
	$\displaystyle T_{\boldsymbol{\mu}}(y)$	$\displaystyle:=t(y^{2})+Py\,u_{\boldsymbol{\mu}}(y^{2}),$
	$\displaystyle\Delta_{\boldsymbol{\mu}}$	$\displaystyle:=P^{2}\\|\boldsymbol{\mu}\\|_{0}+\nu.$

Here $\|\boldsymbol{\mu}\|_{0}$ denotes the number of nonzero coordinates of $\boldsymbol{\mu}$ . Separating $gq-T_{\boldsymbol{\mu}}$ into its even- and odd-degree coefficients gives

gq-T_{\boldsymbol{\mu}}=(2ha+2Pxb-t)(y^{2})+y(2hb+2Pa-Pu_{\boldsymbol{\mu}})(y^{2}).

The $P$ -dependent part of the two displayed components has squared norm $4P^{2}(\|b\|_{2}^{2}+\|a-u_{\boldsymbol{\mu}}/2\|_{2}^{2})$ . Over integral coefficients, this quantity is minimized exactly when $b=0$ and $a=a_{\boldsymbol{\xi}}$ for some Boolean $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ , where the inequality is coordinatewise. Every other integral pair increases this squared norm by at least $4P^{2}$ . We choose $P$ large enough that the remaining terms cannot offset this increase, making every other $q$ have squared distance greater than $\Delta_{\boldsymbol{\mu}}+4$ .

For a Boolean vector $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ , the two components give

\|ga_{\boldsymbol{\xi}}(y^{2})-T_{\boldsymbol{\mu}}\|_{2}^{2}=\Delta_{\boldsymbol{\mu}}+4\|\mathbf{A}\boldsymbol{\xi}-\mathbf{b}\|_{2}^{2}.

Thus the elements of $(g)$ at squared distance at most $\Delta_{\boldsymbol{\mu}}$ from $T_{\boldsymbol{\mu}}$ are exactly those encoding solutions, and every other element has squared distance at least $\Delta_{\boldsymbol{\mu}}+4$ . The main technical step is extending this distance separation from the Boolean encodings $a_{\boldsymbol{\xi}}(y^{2})$ to every $q\in R_{d}$ .

Full rank follows because $R_{d}$ is an integral domain and the generator is nonzero. Fourier orthogonality shows that squared distances under the canonical embedding are $d$ times those under the coefficient embedding.

Cyclic and fixed-family extensions.

For the cyclic case, we convert each constructed principal cyclotomic ideal into a principal cyclic ideal of twice the dimension, while multiplying the squared distances of corresponding elements by eight. For the fixed families, we use the matrix of all $\binom{m}{3}$ triples and place the input collection only in $\boldsymbol{\mu}$ . The resulting principal cyclotomic and cyclic ideals then depend only on $m$ . The details appear in Section 3.3 and Section 4, respectively.

Organization.

Section 2 reviews lattices and ideal lattices. Section 3 proves $\mathsf{NP}$ -completeness of exact decision-CVP on principal cyclotomic and principal cyclic ideal lattices. Section 4 proves that exact decision-CVPP has no polynomial-time solution on the resulting fixed principal-ideal families unless $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$ . Section 5 summarizes the results.

2 Preliminaries

Notation.

For $r\geq 1$ , write $[r]:=\{1,\ldots,r\}$ . We use bold lowercase Roman or Greek letters for vectors and bold uppercase letters for matrices. For a vector $\mathbf{v}$ , its $k$ -th coordinate is denoted by $v_{k}$ . For a matrix $\mathbf{A}$ , its entry in row $i$ and column $j$ is denoted by $A_{ij}$ . Vector inequalities are coordinatewise. For $1\leq p\leq\infty$ , $\|\mathbf{v}\|_{p}$ is the usual $\ell_{p}$ -norm, while $\|\mathbf{v}\|_{0}:=|\{i:v_{i}\neq 0\}|$ is the support size. We write $\mathbf{0}_{r}$ and $\mathbf{1}_{r}$ for the length- $r$ all-zero and all-ones vectors. For scalars, finite sets, and binary strings, $|\cdot|$ denotes absolute value, cardinality, and bit length, respectively.

2.1 Lattices

For integers $m\geq n\geq 1$ , let $\mathbf{B}\in\mathbb{R}^{m\times n}$ have linearly independent columns. The lattice generated by $\mathbf{B}$ is defined by

\mathcal{L}(\mathbf{B})=\mathbf{B}\mathbb{Z}^{n}=\{\mathbf{B}\mathbf{z}:\mathbf{z}\in\mathbb{Z}^{n}\}.

The columns of $\mathbf{B}$ form a basis of $\mathcal{L}(\mathbf{B})$ . If $m=n$ , then $\mathcal{L}(\mathbf{B})$ is called full rank. We write $\|\cdot\|_{2}$ for the Euclidean norm.

For a lattice $\mathcal{L}\subseteq\mathbb{R}^{m}$ and $\mathbf{t}\in\mathbb{R}^{m}$ , define

\operatorname{dist}(\mathbf{t},\mathcal{L})=\min_{\mathbf{v}\in\mathcal{L}}\|\mathbf{t}-\mathbf{v}\|_{2}.

Definition 2.1 (Exact CVP).

Given a rational lattice basis $\mathbf{B}$ , a rational target $\mathbf{t}$ , and a nonnegative rational squared threshold $\Delta$ , exact decision-CVP asks whether

\operatorname{dist}\bigl(\mathbf{t},\mathcal{L}(\mathbf{B})\bigr)^{2}\leq\Delta.

Given $\mathbf{B}$ and $\mathbf{t}$ , exact search-CVP asks for a vector $\mathbf{v}\in\mathcal{L}(\mathbf{B})$ satisfying

\|\mathbf{t}-\mathbf{v}\|_{2}=\operatorname{dist}\bigl(\mathbf{t},\mathcal{L}(\mathbf{B})\bigr).

The exact shortest vector problem (SVP) is the corresponding problem with $\mathbf{t}=\mathbf{0}_{m}$ , except that the zero lattice vector is excluded.

We use the following formulation of exact decision-CVPP, following Micciancio [19].

Definition 2.2 (Exact decision-CVPP).

An exact decision-CVPP scheme consists of a preprocessing function $\mathsf{Pre}$ , a uniform polynomial-time decoder $\mathsf{Dec}$ , and a polynomial $p$ with the following properties.

•

Given a rational lattice basis $\mathbf{B}$ , the offline stage outputs a string $\pi_{\mathbf{B}}:=\mathsf{Pre}(\mathbf{B})$ satisfying $|\pi_{\mathbf{B}}|\leq p(|\langle\mathbf{B}\rangle|)$ , where $\langle\mathbf{B}\rangle$ is the standard binary encoding of $\mathbf{B}$ . No running-time bound is imposed on $\mathsf{Pre}$ .

•

Given $\pi_{\mathbf{B}}$ , a rational target $\mathbf{t}$ , and a nonnegative rational squared threshold $\Delta$ , the online stage satisfies

\mathsf{Dec}(\pi_{\mathbf{B}},\mathbf{t},\Delta)=1\hskip 10.00002pt\Longleftrightarrow\hskip 10.00002pt\operatorname{dist}(\mathbf{t},\mathcal{L}(\mathbf{B}))^{2}\leq\Delta.

Its running time is polynomial in the total length of these inputs.

We say that exact decision-CVPP is solvable in polynomial time on a lattice family with one specified basis for each lattice if a single such scheme works for all these bases.

2.2 Algebraic Number Theory and Ideal Lattices

Let $K$ be a number field of degree $n$ , and let $R:=\mathcal{O}_{K}$ be its ring of integers.

Coefficient embedding.

Fix an algebraic integer $\theta\in R$ such that $K=\mathbb{Q}(\theta)$ , and let $F(z)\in\mathbb{Z}[z]$ be the monic minimal polynomial of $\theta$ . Then $K\cong\mathbb{Q}[z]/(F(z))$ . Every element $a\in K$ has a unique representation

a=a_{0}+a_{1}\theta+\cdots+a_{n-1}\theta^{n-1},\hskip 20.00003pta_{0},\ldots,a_{n-1}\in\mathbb{Q}.

Its coefficient embedding with respect to the power basis $1,\theta,\ldots,\theta^{n-1}$ is

\operatorname{coeff}(a):=(a_{0},a_{1},\ldots,a_{n-1})^{\top}\in\mathbb{Q}^{n}.

If $I\subseteq R$ is a nonzero ideal, then

\mathcal{L}(I):=\{\operatorname{coeff}(a):a\in I\}

is a full-rank lattice in $\mathbb{R}^{n}$ . For a target $T\in K$ , its distance from $I$ under the coefficient embedding is

\operatorname{dist}\bigl(\operatorname{coeff}(T),\mathcal{L}(I)\bigr):=\min_{a\in I}\|\operatorname{coeff}(T-a)\|_{2}.

Canonical embedding.

Let $\sigma_{1},\ldots,\sigma_{n}:K\longrightarrow\mathbb{C}$ be all embeddings of $K$ into $\mathbb{C}$ . The canonical embedding is defined by

\sigma(a):=(\sigma_{1}(a),\ldots,\sigma_{n}(a))\in\mathbb{C}^{n}.

Because the complex embeddings occur in conjugate pairs, $\sigma(K)$ lies in a real subspace of $\mathbb{C}^{n}$ of dimension $n$ . If $I\subseteq R$ is a nonzero ideal, then

\sigma(I):=\{\sigma(a):a\in I\}

is a full-rank lattice in this real subspace. For $T\in K$ , its distance from $I$ under the canonical embedding is

\operatorname{dist}\bigl(\sigma(T),\sigma(I)\bigr):=\min_{a\in I}\|\sigma(T-a)\|_{2}.

In general, the coefficient and canonical embeddings induce different Euclidean lengths. We now specialize to power-of-two cyclotomic fields, for which the two lengths differ only by a fixed scaling factor.

The power-of-two cyclotomic case.

Let $d$ be a power of two and put $\zeta=e^{\pi i/d}$ , a primitive $2d$ -th root of unity. We specialize to

K=K_{d}=\mathbb{Q}(\zeta),\hskip 20.00003ptR=R_{d}=\mathcal{O}_{K_{d}}=\mathbb{Z}[\zeta]\cong\mathbb{Z}[y]/(y^{d}+1).

In a quotient by a monic polynomial of degree $r$ , we identify each element with its unique representative of degree less than $r$ . Every $f\in K_{d}$ has a unique representation

f=f_{0}+f_{1}y+\cdots+f_{d-1}y^{d-1},\hskip 20.00003ptf_{0},\ldots,f_{d-1}\in\mathbb{Q},

with coefficient vector

\operatorname{coeff}(f)=(f_{0},\ldots,f_{d-1})^{\top}.

The $d$ canonical embeddings of $K_{d}$ send $y$ to $\zeta^{2k+1}$ for $k=0,\ldots,d-1$ . Accordingly, we write

\sigma_{d}(f)=\bigl(f(\zeta),f(\zeta^{3}),\ldots,f(\zeta^{2d-1})\bigr).

For $1\leq p\leq\infty$ , we use $\|f\|_{p}:=\|\operatorname{coeff}(f)\|_{p}$ for the coefficient $\ell_{p}$ -norm of $f\in K_{d}$ .

We will use Young’s convolution inequality in the following form. For every $r\geq 1$ and $f,g\in\mathbb{R}[z]/(z^{r}+1)$ , with coefficient norms taken on their degree- $<r$ representatives,

\|fg\|_{2}\leq\|f\|_{1}\|g\|_{2}.

Indeed, multiplication by a monomial is a signed coordinate permutation, so the inequality follows from the triangle inequality.

For $g\in R_{d}$ , write $(g):=gR_{d}=\{gq:q\in R_{d}\}$ for the principal ideal generated by $g$ . We write $I\lhd R$ to mean that $I$ is an ideal of $R$ . For $0\neq g\in R_{d}$ , let

\mathbf{B}_{g}:=\bigl[\operatorname{coeff}(g)\ \operatorname{coeff}(yg)\ \cdots\ \operatorname{coeff}(y^{d-1}g)\bigr].

Since $R_{d}$ is a domain, these columns form a $\mathbb{Z}$ -basis of $\mathcal{L}((g))$ . We refer to $\mathbf{B}_{g}$ as its multiplication basis.

Lemma 2.3 (Equivalence of coefficient and canonical norms).

For every $f\in K_{d}$ ,

\|\sigma_{d}(f)\|_{2}^{2}=d\|\operatorname{coeff}(f)\|_{2}^{2}.

Consequently, for every nonzero ideal $I\subseteq R_{d}$ and every target $T\in K_{d}$ ,

\operatorname{dist}\bigl(\sigma_{d}(T),\sigma_{d}(I)\bigr)^{2}=d\operatorname{dist}\bigl(\operatorname{coeff}(T),\mathcal{L}(I)\bigr)^{2}.

Therefore, exact CVP and SVP under the two embeddings are equivalent after multiplying each squared threshold by $d$ .

Proof.

For $0\leq r,s<d$ , Fourier orthogonality gives

\sum_{k=0}^{d-1}\zeta^{(2k+1)(r-s)}=\begin{cases}d,&r=s,\\ 0,&r\neq s.\end{cases}

Expanding the squared canonical norm therefore yields

	$\displaystyle\\|\sigma_{d}(f)\\|_{2}^{2}$	$\displaystyle=\sum_{r,s=0}^{d-1}f_{r}\overline{f_{s}}\sum_{k=0}^{d-1}\zeta^{(2k+1)(r-s)}$
		$\displaystyle=d\sum_{r=0}^{d-1}\|f_{r}\|^{2}$
		$\displaystyle=d\\|\operatorname{coeff}(f)\\|_{2}^{2}.$

The remaining statements follow because the canonical embedding scales every Euclidean length in the coefficient embedding by $\sqrt{d}$ . ∎

2.3 Exact Cover by 3-Sets (X3C).

Let $\mathcal{U}=\{u_{1},\ldots,u_{m}\}$ , where $m$ is a positive multiple of $3$ , and let $\mathcal{C}=\{C_{1},\ldots,C_{n}\}$ be a collection of $3$ -element subsets of $\mathcal{U}$ (called triples). Write $n=|\mathcal{C}|$ . The incidence matrix of the instance is $\mathbf{H}\in\{0,1\}^{m\times n}$ defined by

H_{ij}=\begin{cases}1&\text{if }u_{i}\in C_{j},\\[2.0pt] 0&\text{otherwise.}\end{cases}

An exact cover is a vector $\boldsymbol{\xi}\in\{0,1\}^{n}$ satisfying the binary linear system

\mathbf{H}\boldsymbol{\xi}=\mathbf{1}_{m},

where $\mathbf{1}_{m}\in\{0,1\}^{m}$ denotes the all-ones vector. X3C asks whether such an exact cover exists. Equivalently, the selected subfamily $\mathcal{C}^{\prime}=\{C_{j}:\xi_{j}=1\}\subseteq\mathcal{C}$ must be pairwise disjoint and cover every element of $\mathcal{U}$ exactly once:

\bigcup_{C_{j}\in\mathcal{C}^{\prime}}C_{j}=\mathcal{U},\hskip 20.00003ptC_{j}\cap C_{j^{\prime}}=\varnothing\;\text{ for all distinct }C_{j},C_{j^{\prime}}\in\mathcal{C}^{\prime}.

It is well known that X3C is $\mathsf{NP}$ -complete [8].

3 Reduction from X3C to CVP on principal ideal lattices

We use the following masked generalization of X3C. For the general masked system below, $M$ denotes the number of equations. In the X3C specialization, $M=m$ . Let $M,n\geq 1$ , and consider the masked Boolean system

\mathbf{A}\boldsymbol{\xi}=\mathbf{b},\hskip 20.00003pt\boldsymbol{\xi}\in\{0,1\}^{n},\hskip 20.00003pt\boldsymbol{\xi}\leq\boldsymbol{\mu},

(2)

where $\mathbf{A}\in\{0,1\}^{M\times n}$ , $\mathbf{b}\in\{0,1\}^{M}$ , and $\boldsymbol{\mu}\in\{0,1\}^{n}$ .

In this paper, we call $\boldsymbol{\mu}$ the mask. The constraint $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ permits $\xi_{k}=1$ only when $\mu_{k}=1$ . The feasibility problem for masked Boolean systems is $\mathsf{NP}$ -complete, since X3C is the special case obtained by setting

(\mathbf{A},\mathbf{b},\boldsymbol{\mu})=(\mathbf{H},\mathbf{1}_{m},\mathbf{1}_{n}).

We reduce this feasibility problem to exact decision-CVP on principal ideal lattices. Roughly speaking, for each Boolean vector $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ , we form a sparse polynomial $a_{\boldsymbol{\xi}}$ and construct a principal ideal $(g)$ , a target $T_{\boldsymbol{\mu}}$ , and a threshold $\Delta_{\boldsymbol{\mu}}$ with

\|ga_{\boldsymbol{\xi}}(y^{2})-T_{\boldsymbol{\mu}}\|_{2}^{2}=\Delta_{\boldsymbol{\mu}}+4\|\mathbf{A}\boldsymbol{\xi}-\mathbf{b}\|_{2}^{2}.

We then add coefficients at odd powers of $y$ so that every ideal element $gq$ for which $q$ is not of the form $a_{\boldsymbol{\xi}}(y^{2})$ for any $\boldsymbol{\xi}\in\{0,1\}^{n}$ satisfying $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ has squared distance from $T_{\boldsymbol{\mu}}$ greater than $\Delta_{\boldsymbol{\mu}}+4$ . Thus the closest squared distance is $\Delta_{\boldsymbol{\mu}}$ for a YES instance and at least $\Delta_{\boldsymbol{\mu}}+4$ for a NO instance.

3.1 Encoding the Boolean equations

We first choose coefficient positions $\alpha_{1},\ldots,\alpha_{n}$ whose nonzero ordered differences are pairwise distinct.

Lemma 3.1.

For every $n\geq 1$ , one can compute in polynomial time integers

0=\alpha_{1}<\cdots<\alpha_{n},\hskip 20.00003pt\alpha_{n}=\Theta(n^{2})\hskip 10.00002pt(n\geq 2),

whose nonzero ordered differences $\alpha_{k}-\alpha_{j}$ are pairwise distinct.

Proof.

For $n=1$ , take $\alpha_{1}=0$ . Otherwise we can always choose an odd prime $p\in[n,2n)$ by Bertrand’s postulate. Let $r_{j}$ be the least residue of $(j-1)^{2}$ modulo $p$ , and set

\alpha_{j}:=2p(j-1)+r_{j}.

This is exactly the classical Erdős–Turán Sidon construction [6], which ensures all nonzero ordered differences $\alpha_{k}-\alpha_{j}$ are pairwise distinct. The construction runs in polynomial time. Finally, $p<2n$ and $r_{n}<p$ give $\alpha_{n}=O(n^{2})$ , while $p\geq n$ gives

\alpha_{n}\geq 2p(n-1)\geq 2n(n-1).

Hence $\alpha_{n}=\Theta(n^{2})$ for $n\geq 2$ . ∎

Denote

c:=\alpha_{n},\hskip 10.00002ptL:=2c+1,\hskip 10.00002pt\rho_{i}:=c+(i-1)L\hskip 10.00002pt(i\in[M]).

We call $\rho_{i}$ the row coordinate of row $i$ . For $A_{ij}=1$ and $k\neq j$ , the position $\rho_{i}-\alpha_{j}+\alpha_{k}$ is a cross-term coordinate. Set

W:=\sum_{i\in[M]}\sum_{j\in[n]}A_{ij},\hskip 20.00003pt\nu:=(n-1)W.

Let $N$ be the least power of two greater than $\rho_{M}+c$ , and work in $R_{N}^{-}:=\mathbb{Z}[x]/(x^{N}+1)$ . We use degree- $<N$ representatives and their coefficient norms. Define

	$\displaystyle h(x)$	$\displaystyle:=\sum_{A_{ij}=1}x^{\rho_{i}-\alpha_{j}},$
	$\displaystyle t(x)$	$\displaystyle:=2\sum_{i=1}^{M}b_{i}x^{\rho_{i}}+\sum_{\begin{subarray}{c}A_{ij}=1\\ k\neq j\end{subarray}}x^{\rho_{i}-\alpha_{j}+\alpha_{k}},$
	$\displaystyle a_{\boldsymbol{\xi}}(x)$	$\displaystyle:=\sum_{k=1}^{n}\xi_{k}x^{\alpha_{k}}.$

The construction satisfies the following identity.

Lemma 3.2.

For every $\boldsymbol{\xi}\in\{0,1\}^{n}$ ,

\|2ha_{\boldsymbol{\xi}}-t\|_{2}^{2}=\nu+4\|\mathbf{A}\boldsymbol{\xi}-\mathbf{b}\|_{2}^{2}.

Proof.

Note that

2h(x)a_{\boldsymbol{\xi}}(x)=2\sum_{A_{ij}=1}\sum_{k=1}^{n}\xi_{k}x^{\rho_{i}-\alpha_{j}+\alpha_{k}}.

Splitting the inner sum according to $k=j$ and $k\neq j$ yields

2h(x)a_{\boldsymbol{\xi}}(x)=2\sum_{A_{ij}=1}\xi_{j}x^{\rho_{i}}+2\sum_{\begin{subarray}{c}A_{ij}=1\\ k\neq j\end{subarray}}\xi_{k}x^{\rho_{i}-\alpha_{j}+\alpha_{k}}.

(3)

Subtracting $t(x)$ from (3) gives

2h(x)a_{\boldsymbol{\xi}}(x)-t(x)=2\sum_{i=1}^{M}\Bigl(\sum_{j:A_{ij}=1}\xi_{j}-b_{i}\Bigr)x^{\rho_{i}}+\sum_{\begin{subarray}{c}A_{ij}=1\\ k\neq j\end{subarray}}(2\xi_{k}-1)x^{\rho_{i}-\alpha_{j}+\alpha_{k}}.

(4)

Because $(\mathbf{A}\boldsymbol{\xi})_{i}=\sum_{j:A_{ij}=1}\xi_{j}$ , the coefficient of $x^{\rho_{i}}$ in (4) is precisely $2((\mathbf{A}\boldsymbol{\xi})_{i}-b_{i})$ .

To compute the $\ell_{2}$ -norm of (4), we must verify that all its monomials have distinct exponents. The row coordinates $\rho_{i}$ are pairwise distinct because $L>0$ .

(i) Cross-term coordinates do not equal row coordinates. A row coordinate is some $\rho_{i^{\prime}}=c+(i^{\prime}-1)L$ . A cross-term coordinate is $\rho_{i}-\alpha_{j}+\alpha_{k}$ with $A_{ij}=1$ and $k\neq j$ . Equality of the two would require $\rho_{i^{\prime}}-\rho_{i}=\alpha_{k}-\alpha_{j}$ . If $i^{\prime}=i$ this forces $\alpha_{j}=\alpha_{k}$ , hence $j=k$ , contradicting $k\neq j$ . If $i^{\prime}\neq i$ then $|\rho_{i^{\prime}}-\rho_{i}|\geq L=2c+1$ , whereas $|\alpha_{k}-\alpha_{j}|\leq c$ because $0\leq\alpha_{j},\alpha_{k}\leq c$ ; thus equality is impossible.

(ii) Cross-term coordinates for a fixed row are distinct. Fix $i$ and suppose

\rho_{i}-\alpha_{j}+\alpha_{k}=\rho_{i}-\alpha_{j^{\prime}}+\alpha_{k^{\prime}}\hskip 10.00002pt\text{with }k\neq j,\;k^{\prime}\neq j^{\prime}.

Cancelling $\rho_{i}$ gives $\alpha_{k}-\alpha_{j}=\alpha_{k^{\prime}}-\alpha_{j^{\prime}}$ . By Lemma 3.1 all nonzero ordered differences $\alpha_{k}-\alpha_{j}$ are distinct, so $(j,k)=(j^{\prime},k^{\prime})$ .

(iii) Cross-term coordinates for different rows are distinct. All cross-term coordinates for row $i$ lie in $[\rho_{i}-c,\rho_{i}+c]=[(i-1)L,iL-1]$ . These intervals are disjoint for distinct rows.

Since $N$ is a power of two larger than $\rho_{M}+c$ , all exponents lie in $[0,N)$ and no wrap-around modulo $x^{N}+1$ occurs. Consequently, the two sums in (4) have disjoint supports. The second sum contains exactly $\nu=(n-1)W$ monomials, one for each triple $(i,j,k)$ with $A_{ij}=1$ and $k\neq j$ . Because $\xi_{k}\in\{0,1\}$ , each coefficient satisfies $(2\xi_{k}-1)^{2}=1$ . Therefore

	$\displaystyle\\|2ha_{\boldsymbol{\xi}}-t\\|_{2}^{2}$	$\displaystyle=\sum_{i=1}^{M}\bigl[2((\mathbf{A}\boldsymbol{\xi})_{i}-b_{i})\bigr]^{2}+\sum_{\begin{subarray}{c}A_{ij}=1\\ k\neq j\end{subarray}}(2\xi_{k}-1)^{2}$
		$\displaystyle=4\\|\mathbf{A}\boldsymbol{\xi}-\mathbf{b}\\|_{2}^{2}+\nu.$

This completes the proof. ∎

3.2 Controlling every ideal element

Lemma 3.2 applies only to the polynomials $a_{\boldsymbol{\xi}}$ encoding Boolean vectors. We now add coefficients at odd powers of $y$ so that every $q\in R_{d}$ not of the form $a_{\boldsymbol{\xi}}(y^{2})$ with $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ satisfies $\|gq-T_{\boldsymbol{\mu}}\|_{2}^{2}>\Delta_{\boldsymbol{\mu}}+4$ .

Lemma 3.3.

The polynomial $h(x)=\sum_{A_{ij}=1}x^{\rho_{i}-\alpha_{j}}$ has exactly $W$ distinct monomials. Equivalently, the exponents $\rho_{i}-\alpha_{j}$ with $A_{ij}=1$ are pairwise distinct.

Proof.

Suppose $(i,j)\neq(i^{\prime},j^{\prime})$ , $A_{ij}=A_{i^{\prime}j^{\prime}}=1$ , and

\rho_{i}-\alpha_{j}=\rho_{i^{\prime}}-\alpha_{j^{\prime}}.

Case 1: $i=i^{\prime}$ . Then $\alpha_{j}=\alpha_{j^{\prime}}$ , so strict monotonicity of the $\alpha_{j}$ ’s gives $j=j^{\prime}$ , a contradiction.

Case 2: $i\neq i^{\prime}$ . The spacing of the row coordinates gives

|\rho_{i^{\prime}}-\rho_{i}|\geq L=2c+1,\hskip 20.00003pt|\alpha_{j^{\prime}}-\alpha_{j}|\leq c,

which is incompatible with $\rho_{i^{\prime}}-\rho_{i}=\alpha_{j^{\prime}}-\alpha_{j}$ .

Finally, $0\leq\rho_{i}-\alpha_{j}\leq\rho_{M}<N$ , so no wrap-around occurs in $R_{N}^{-}$ . Hence all $W$ exponents are distinct. ∎

Since these $W$ monomials have unit coefficients, $\|h\|_{1}=W$ . Set

s:=\lceil\sqrt{n+4}\rceil,\hskip 20.00003ptP:=1+s\bigl(sW+\lceil\|t\|_{2}\rceil+\lceil\sqrt{\nu+4}\rceil\bigr).

Let $d:=2N$ and identify $R_{N}^{-}$ with the even-coordinate subring of $R_{d}=\mathbb{Z}[y]/(y^{d}+1)$ by $x=y^{2}$ . For a mask $\boldsymbol{\mu}\in\{0,1\}^{n}$ , put

u_{\boldsymbol{\mu}}(x):=\sum_{k=1}^{n}\mu_{k}x^{\alpha_{k}}

and define

$\displaystyle g(y)$	$\displaystyle:=2h(y^{2})+2Py,$	(5)
$\displaystyle T_{\boldsymbol{\mu}}(y)$	$\displaystyle:=t(y^{2})+Py\,u_{\boldsymbol{\mu}}(y^{2}),$	(6)
$\displaystyle\Delta_{\boldsymbol{\mu}}$	$\displaystyle:=P^{2}\\|\boldsymbol{\mu}\\|_{0}+\nu.$	(7)

Consider the principal ideal generated by $g$ . Every $q\in R_{d}$ has a unique form $q=a(y^{2})+yb(y^{2})$ with $a,b\in R_{N}^{-}$ . Direct multiplication gives

gq-T_{\boldsymbol{\mu}}=(2ha+2Pxb-t)(y^{2})+y(2hb+2Pa-Pu_{\boldsymbol{\mu}})(y^{2}),

(8)

where both $2ha+2Pxb-t$ and $2hb+2Pa-Pu_{\boldsymbol{\mu}}$ belong to $R_{N}^{-}$ .

Lemma 3.4.

If $\boldsymbol{\xi}\in\{0,1\}^{n}$ and $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ , then

\|ga_{\boldsymbol{\xi}}(y^{2})-T_{\boldsymbol{\mu}}\|_{2}^{2}=\Delta_{\boldsymbol{\mu}}+4\|\mathbf{A}\boldsymbol{\xi}-\mathbf{b}\|_{2}^{2}.

(9)

Every $q\in R_{d}$ not of the form $a_{\boldsymbol{\xi}}(y^{2})$ for some $\boldsymbol{\xi}\in\{0,1\}^{n}$ with $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ satisfies

\|gq-T_{\boldsymbol{\mu}}\|_{2}^{2}>\Delta_{\boldsymbol{\mu}}+4.

Proof.

Let $\omega:=\|\boldsymbol{\mu}\|_{0}$ .

Case 1: $q=a_{\boldsymbol{\xi}}(y^{2})$ for a Boolean vector $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ . Equation (8) gives

gq-T_{\boldsymbol{\mu}}=\bigl(2ha_{\boldsymbol{\xi}}-t\bigr)(y^{2})+Py\bigl(2a_{\boldsymbol{\xi}}-u_{\boldsymbol{\mu}}\bigr)(y^{2}).

The even block.

The first summand in the displayed expression for $gq-T_{\boldsymbol{\mu}}$ is $\bigl(2ha_{\boldsymbol{\xi}}-t\bigr)(y^{2})$ . Substituting $x=y^{2}$ places the coefficients of $2ha_{\boldsymbol{\xi}}-t$ in the even coordinates and does not change its coefficient $\ell_{2}$ -norm. Hence Lemma 3.2 gives

\bigl\|\bigl(2ha_{\boldsymbol{\xi}}-t\bigr)(y^{2})\bigr\|_{2}^{2}=\|2ha_{\boldsymbol{\xi}}-t\|_{2}^{2}=\nu+4\|\mathbf{A}\boldsymbol{\xi}-\mathbf{b}\|_{2}^{2}.

The odd block.

The second summand is

Py\bigl(2a_{\boldsymbol{\xi}}-u_{\boldsymbol{\mu}}\bigr)(y^{2})=P\sum_{k=1}^{n}(2\xi_{k}-\mu_{k})y^{2\alpha_{k}+1}.

For every $k$ , the conditions $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ and $\boldsymbol{\xi},\boldsymbol{\mu}\in\{0,1\}^{n}$ imply $(2\xi_{k}-\mu_{k})^{2}=\mu_{k}$ . Moreover, $2\alpha_{k}+1\leq 2c+1\leq N<d$ , so the corresponding odd-coordinate positions are distinct and do not wrap around in $R_{d}$ . Hence the second summand has squared norm

P^{2}\sum_{k=1}^{n}(2\xi_{k}-\mu_{k})^{2}=P^{2}\|\boldsymbol{\mu}\|_{0}=P^{2}\omega.

Since the even and odd coordinates are disjoint, adding the two contributions proves (9).

Case 2: all remaining $q\in R_{d}$ . Write $q=a(y^{2})+yb(y^{2})$ with $a,b\in R_{N}^{-}$ , and set

\Phi(a,b):=\|b\|_{2}^{2}+\left\|a-\frac{u_{\boldsymbol{\mu}}}{2}\right\|_{2}^{2}.

For $0\leq r<N$ , write $a_{r}$ for the coefficient of $x^{r}$ in $a$ . For each $k$ with $\mu_{k}=1$ , integrality gives $(a_{\alpha_{k}}-1/2)^{2}\geq 1/4$ , with equality exactly when $a_{\alpha_{k}}\in\{0,1\}$ . All coefficients of $a$ outside these positions and all coefficients of $b$ contribute integer squares. Consequently,

\Phi(a,b)=\frac{\omega}{4}

exactly when $b=0$ and $a=a_{\boldsymbol{\xi}}$ for some Boolean vector $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ . For every other pair, $\Phi(a,b)$ is larger by at least $1$ . Hence

\Phi(a,b)\geq\frac{\omega+4}{4}.

Identify a polynomial in $R_{d}$ with the ordered pair of its even- and odd-degree coefficient blocks, equipped with the product Euclidean norm. Equation (8) becomes

gq-T_{\boldsymbol{\mu}}=2P\bigl((xb,a)-(0,u_{\boldsymbol{\mu}}/2)\bigr)+2(ha,hb)-(t,0).

Multiplication by $x$ is an isometry in $R_{N}^{-}$ , so $\|xb\|_{2}=\|b\|_{2}$ . Young’s inequality and $\|h\|_{1}=W$ give the first bound below, while the triangle inequality gives the second:

\|(ha,hb)\|_{2}\leq W\|(a,b)\|_{2},\hskip 20.00003pt\|(a,b)\|_{2}\leq\sqrt{\Phi(a,b)}+\frac{\sqrt{\omega}}{2}.

The reverse triangle inequality therefore yields

\|gq-T_{\boldsymbol{\mu}}\|_{2}\geq 2(P-W)\sqrt{\Phi(a,b)}-W\sqrt{\omega}-\|t\|_{2}.

Since $P\geq 1+s^{2}W>W$ , the lower bound on $\Phi(a,b)$ gives

\|gq-T_{\boldsymbol{\mu}}\|_{2}\geq P\sqrt{\omega+4}-W\bigl(\sqrt{\omega+4}+\sqrt{\omega}\bigr)-\|t\|_{2}.

Because $0\leq\omega\leq n$ and $s=\lceil\sqrt{n+4}\rceil$ ,

\sqrt{\omega+4}-\sqrt{\omega}\geq\frac{2}{s},\hskip 20.00003pt\sqrt{\omega+4}+\sqrt{\omega}\leq 2s.

The definition of $P$ also gives the strict inequality

\frac{2P}{s}=\frac{2}{s}+2sW+2\lceil\|t\|_{2}\rceil+2\lceil\sqrt{\nu+4}\rceil>2sW+\|t\|_{2}+\sqrt{\nu+4}.

Combining these estimates gives

	$\displaystyle\\|gq-T_{\boldsymbol{\mu}}\\|_{2}-P\sqrt{\omega}$	$\displaystyle\geq P\bigl(\sqrt{\omega+4}-\sqrt{\omega}\bigr)-W\bigl(\sqrt{\omega+4}+\sqrt{\omega}\bigr)-\\|t\\|_{2}$
		$\displaystyle>\sqrt{\nu+4}.$

Squaring and discarding the nonnegative cross term now gives

\|gq-T_{\boldsymbol{\mu}}\|_{2}^{2}>\bigl(P\sqrt{\omega}+\sqrt{\nu+4}\bigr)^{2}\geq P^{2}\omega+\nu+4=\Delta_{\boldsymbol{\mu}}+4.

This proves the second assertion. ∎

The preceding lemma yields the reduction for masked Boolean systems. Its X3C specialization gives the main hardness result, while the fact that the ideal is independent of the mask will be used for the fixed-family construction in Section 4. For a full-rank principal ideal $I=(g)\lhd R_{d}$ , we use $(I,T,\Delta)$ as shorthand for the standard CVP input $(\mathbf{B}_{g},\operatorname{coeff}(T),\Delta)$ .

Theorem 3.5.

There is a polynomial-time reduction from the masked Boolean system (2) to exact decision-CVP that maps $(\mathbf{A},\mathbf{b},\boldsymbol{\mu})$ to $(I,T_{\boldsymbol{\mu}},\Delta_{\boldsymbol{\mu}})$ , where $I=(g)\lhd R_{d}$ is a full-rank principal ideal with a multiplication basis depending only on $(\mathbf{A},\mathbf{b})$ . Here $d=O((M+1)n^{2})$ is a power of two, and $T_{\boldsymbol{\mu}}$ and $\Delta_{\boldsymbol{\mu}}$ are integral.

Proof.

Equation (9), together with the integrality of $\mathbf{A}\boldsymbol{\xi}-\mathbf{b}$ , shows that the element $ga_{\boldsymbol{\xi}}(y^{2})$ associated with a Boolean vector $\boldsymbol{\xi}\leq\boldsymbol{\mu}$ has squared distance $\Delta_{\boldsymbol{\mu}}$ from $T_{\boldsymbol{\mu}}$ exactly when it is a solution and at least $\Delta_{\boldsymbol{\mu}}+4$ otherwise. The second assertion of Lemma 3.4 gives the same lower bound for every remaining $q\in R_{d}$ . Consequently,

	$\displaystyle\min_{q\in R_{d}}\\|gq-T_{\boldsymbol{\mu}}\\|_{2}^{2}$	$\displaystyle=\Delta_{\boldsymbol{\mu}}$		$\displaystyle\text{in a YES instance},$
	$\displaystyle\min_{q\in R_{d}}\\|gq-T_{\boldsymbol{\mu}}\\|_{2}^{2}$	$\displaystyle\geq\Delta_{\boldsymbol{\mu}}+4$		$\displaystyle\text{in a NO instance}.$

Since the coefficient of $y$ in $g$ is $2P\neq 0$ and $R_{d}$ is an integral domain, multiplication by $g$ is injective, so $(g)$ has full $\mathbb{Z}$ -rank. Moreover, the elements $v\in(g)$ satisfying $\|v-T_{\boldsymbol{\mu}}\|_{2}^{2}\leq\Delta_{\boldsymbol{\mu}}$ are in bijection with the solutions of (2).

Finally, $c=O(n^{2})$ and $\rho_{M}+c=O((M+1)n^{2})$ , giving the bound on $d$ . Moreover, $W\leq Mn$ , $\nu\leq Mn^{2}$ , and $\|t\|_{2}^{2}=4\|\mathbf{b}\|_{0}+\nu$ , so all quantities in the construction have polynomial encoding length and are computable in polynomial time. The generator $g$ and its multiplication basis depend only on $(\mathbf{A},\mathbf{b})$ , whereas $T_{\boldsymbol{\mu}}$ and $\Delta_{\boldsymbol{\mu}}$ also depend on the mask $\boldsymbol{\mu}$ . ∎

We now apply the theorem with $(\mathbf{A},\mathbf{b},\boldsymbol{\mu})=(\mathbf{H},\mathbf{1}_{m},\mathbf{1}_{n})$ .

Theorem 3.6.

Exact decision-CVP is $\mathsf{NP}$ -complete on the coefficient lattices of full-rank principal ideals in the power-of-two cyclotomic rings $R_{d}$ . The hard instances have squared-distance gap $\Delta$ versus $\Delta+4$ .

Proof.

Theorem 3.5 gives a deterministic reduction from X3C and the claimed gap. For membership in $\mathsf{NP}$ , a YES certificate is $\operatorname{coeff}(v)$ for an element $v\in(g)$ satisfying $\|v-T\|_{2}^{2}\leq\Delta$ . Write $\operatorname{coeff}(v)=(v_{0},\ldots,v_{d-1})^{\top}$ and $\operatorname{coeff}(T)=(T_{0},\ldots,T_{d-1})^{\top}$ . Each coefficient satisfies $|v_{r}|\leq|T_{r}|+\lceil\sqrt{\Delta}\rceil$ , and membership in $(g)$ is verified by solving the nonsingular multiplication system $\mathbf{B}_{g}\mathbf{z}=\operatorname{coeff}(v)$ and checking $\mathbf{z}\in\mathbb{Z}^{d}$ . The verifier also checks $\|v-T\|_{2}^{2}\leq\Delta$ .

∎

The same characterization of the elements satisfying the distance threshold shows that exact search-CVP on these ideals is $\mathsf{NP}$ -hard under polynomial-time Turing reductions. Indeed, one call to an exact search-CVP oracle returns a closest lattice vector $\operatorname{coeff}(v)$ for some $v\in(g)$ . If $\|v-T\|_{2}^{2}\leq\Delta$ , solving $\mathbf{B}_{g}\mathbf{z}=\operatorname{coeff}(v)$ recovers $q$ through $\mathbf{z}=\operatorname{coeff}(q)$ . The coefficients of $q$ at $y^{2\alpha_{k}}$ give the exact cover. Otherwise the X3C instance is negative.

By Lemma 2.3, both results hold under the canonical embedding. Squared thresholds and gaps are multiplied by $d$ , and the closest elements are unchanged.

3.3 Cyclic extension

We next lift these principal-ideal instances to principal cyclic ideals. Let $S_{D}:=\mathbb{Z}[X]/(X^{D}-1)$ , identified with $\mathbb{Z}^{D}$ by coefficient vectors. Multiplication by $X$ rotates the coordinates, so every full-rank ideal of $S_{D}$ is a cyclic lattice.

The following lemma lifts a principal ideal in $R_{d}$ to a principal cyclic ideal in $S_{2d}$ . Under the lift, squared distances are multiplied by $8$ , and points of $I$ within squared distance $H$ of $T$ correspond bijectively to points of the lifted ideal within squared distance $8H$ of the lifted target.

Lemma 3.7.

Let $d$ be a power of two, $I=(g)\lhd R_{d}$ with $g\neq 0$ , and $T\in R_{d}$ . Fix $H\geq 0$ , choose an integer $B$ with $B^{2}>4H$ , and set $D:=2d$ . Let $\iota_{d}:R_{d}\to S_{D}$ copy the degree- $<d$ representative, and define

G:=(1-X^{d})\iota_{d}(g)+B(1+X^{d}),\hskip 20.00003pt\widehat{T}:=2(1-X^{d})\iota_{d}(T).

Then $J:=(G)$ is full rank, and

\|2(1-X^{d})\iota_{d}(v)-\widehat{T}\|_{2}^{2}=8\|v-T\|_{2}^{2}\hskip 20.00003pt(v\in I).

Every $w\in J$ satisfying $\|w-\widehat{T}\|_{2}^{2}\leq 8H$ arises uniquely in this way.

Proof.

For an arbitrary $Q\in S_{D}$ , write $Q=p+X^{d}q$ , where $p,q\in\mathbb{Z}[X]$ have degree less than $d$ , and put $r:=p+q$ and $z:=p-q$ . We view these degree- $<d$ polynomials as elements of $R_{d}$ in products with $g$ . If $F:=GQ-\widehat{T}=F_{0}+X^{d}F_{1}$ , direct expansion in $R_{d}$ gives

\begin{gathered}F_{0}=Br+gz-2T,\qquad F_{1}=Br-(gz-2T),\\ \|F\|_{2}^{2}=\|F_{0}\|_{2}^{2}+\|F_{1}\|_{2}^{2}=2\|gz-2T\|_{2}^{2}+2B^{2}\|r\|_{2}^{2}.\end{gathered}

(10)

If $r\neq 0$ , then its integer coefficient vector has squared norm at least one, so (10) is at least $2B^{2}>8H$ . Hence $\|GQ-\widehat{T}\|_{2}^{2}\leq 8H$ implies $r=0$ and therefore $Q=(1-X^{d})p$ . Using $(1-X^{d})(1+X^{d})=0$ , $(1-X^{d})^{2}=2(1-X^{d})$ , and reducing $\iota_{d}(g)p$ modulo $X^{d}+1$ , we obtain

GQ=2(1-X^{d})\iota_{d}(gp),\hskip 20.00003pt\|GQ-\widehat{T}\|_{2}^{2}=8\|gp-T\|_{2}^{2}.

Thus $v=gp$ maps to $2(1-X^{d})\iota_{d}(v)$ . The coefficients of degrees $0,\ldots,d-1$ in this image equal those of $2v$ , so $v$ is uniquely determined.

Over $\mathbb{Q}$ , the Chinese remainder theorem gives

S_{D}\otimes_{\mathbb{Z}}\mathbb{Q}\cong\mathbb{Q}[X]/(X^{d}-1)\times\mathbb{Q}[X]/(X^{d}+1),\hskip 20.00003ptG\longmapsto(2B,2g).

Both components are units: $2B$ is a nonzero scalar and $2g\neq 0$ in the field $\mathbb{Q}[X]/(X^{d}+1)$ . Hence multiplication by $G$ is invertible over $\mathbb{Q}$ , and $J$ has full rank. ∎

Theorem 3.8.

Exact decision-CVP for tuples $(D,G,\widehat{T},\widehat{\Delta})$ , where $D$ is a power of two, $(G)\lhd S_{D}$ is full rank, and $\widehat{\Delta}\geq 0$ , is $\mathsf{NP}$ -complete. The lattice basis is computed from the $D$ cyclic shifts of $G$ . The reduction has squared-distance gap $\widehat{\Delta}$ versus $\widehat{\Delta}+32$ .

Proof.

Apply Lemma 3.7 to the instance from Theorem 3.6 with

H:=\Delta+4,\hskip 20.00003ptB:=2\lceil\sqrt{H}\rceil+1,\hskip 20.00003pt\widehat{\Delta}:=8\Delta.

The closest squared distance equals $\widehat{\Delta}$ in a YES instance and is at least $\widehat{\Delta}+32$ in a NO instance. All lifted data have polynomial encoding length. Membership in $\mathsf{NP}$ follows as in Theorem 3.6, using the cyclic shifts of $G$ as a basis. ∎

Remark 3.9.

Theorem 3.8 settles one of Micciancio’s open questions: exact Euclidean decision-CVP is $\mathsf{NP}$ -hard on cyclic lattices [21]. The lift also gives $\mathsf{NP}$ -hardness of exact search-CVP on the same cyclic ideals under polynomial-time Turing reductions. Given a closest $\widehat{v}\in J$ , if $\|\widehat{v}-\widehat{T}\|_{2}^{2}>\widehat{\Delta}$ , the X3C instance is negative. Otherwise, Lemma 3.7 applies, and halving the coefficients of degrees $0,\ldots,d-1$ recovers $\operatorname{coeff}(v)$ . Solving $\mathbf{B}_{g}\mathbf{z}=\operatorname{coeff}(v)$ then yields $\mathbf{z}=\operatorname{coeff}(q)$ , whose coefficients at $y^{2\alpha_{k}}$ give the exact cover.

4 Fixed principal-ideal families and preprocessing

The closest vector problem with preprocessing (CVPP) [19] allows all lattice-dependent work to be performed before the target is known. We show that exact decision-CVPP on the fixed principal-ideal family below has no polynomial-time solution unless $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$ .

For a fixed lattice, the preprocessing string is common to all target queries and can serve as a nonuniform advice string depending only on the input length. We therefore encode every X3C instance of a given size using only the target and threshold.

The all-triples X3C system.

For $m\geq 3$ , let $k_{m}:=\binom{m}{3}$ , and let $\mathbf{U}_{m}\in\{0,1\}^{m\times k_{m}}$ be the matrix whose columns are the incidence vectors of all three-element subsets of $[m]$ , listed in lexicographic order. A mask $\boldsymbol{\mu}\in\{0,1\}^{k_{m}}$ specifies which of these triples belong to the input collection. The collection has an exact cover precisely when

\mathbf{U}_{m}\boldsymbol{\xi}=\mathbf{1}_{m}\hskip 10.00002pt\text{for some}\hskip 10.00002pt\boldsymbol{\xi}\in\{0,1\}^{k_{m}}\text{ with }\boldsymbol{\xi}\leq\boldsymbol{\mu}.

Thus $(\mathbf{U}_{m},\mathbf{1}_{m})$ depends only on $m$ , while the collection appears only through the mask.

Theorem 4.1.

There exists a polynomial-time reduction from X3C to exact decision-CVP such that every X3C instance on a universe of size $m$ is mapped to an instance $(I_{m},T_{\boldsymbol{\mu}},\Delta_{\boldsymbol{\mu}})$ , where $I_{m}=(g_{m})\lhd R_{d_{m}}$ is a full-rank principal ideal and its multiplication basis $\mathbf{B}_{g_{m}}$ depends only on $m$ .

Proof.

Apply Theorem 3.5 to the fixed system $(\mathbf{U}_{m},\mathbf{1}_{m})$ . It produces $I_{m}=(g_{m})\lhd R_{d_{m}}$ and its multiplication basis independently of the mask, while the target and threshold encode the collection. With the notation of Section 3, $M=m$ and $n=k_{m}$ . Thus $k_{m}=\Theta(m^{3})$ , and the explicit Sidon construction gives $c=\alpha_{k_{m}}=\Theta(k_{m}^{2})$ . Since $\rho_{m}+c=\Theta(mc)$ , rounding up to a power of two gives $d_{m}=\Theta(mk_{m}^{2})=\Theta(m^{7})$ . The closest squared distance is $\Delta_{\boldsymbol{\mu}}$ for a YES instance and at least $\Delta_{\boldsymbol{\mu}}+4$ for a NO instance. ∎

Together with the certificate argument of Theorem 3.6, the theorem shows that exact decision-CVP on this fixed family is $\mathsf{NP}$ -complete. Its main consequence is the following preprocessing lower bound.

Corollary 4.2.

If exact decision-CVPP is solvable in polynomial time on the family $\{\mathcal{L}(I_{m})\}_{m\geq 3}$ , each of which is represented by the corresponding multiplication basis from Theorem 4.1, then

\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}.

Proof.

Fix a scheme $(\mathsf{Pre},\mathsf{Dec},p)$ satisfying the premise of the corollary. For every $m\geq 3$ , let the length- $k_{m}$ strings of $L_{\rm mask}$ be precisely the masks $\boldsymbol{\mu}\in\{0,1\}^{k_{m}}$ whose selected triples admit an exact cover. The standard collection and mask encodings of X3C can be converted into each other in polynomial time, so $L_{\rm mask}$ is $\mathsf{NP}$ -complete. Since $k_{m}=\binom{m}{3}$ is strictly increasing, the input length determines $m$ . Other lengths are rejected. For length $k_{m}$ , use as advice $\pi_{m}:=\mathsf{Pre}(\mathbf{B}_{g_{m}})$ . The basis has encoding length $m^{O(1)}$ , hence $k_{m}^{O(1)}$ , and Definition 2.2 gives the same advice bound. Given $\boldsymbol{\mu}$ , Theorem 4.1 computes the target and threshold in polynomial time, and the online decoder uses the advice to decide whether $\boldsymbol{\mu}\in L_{\rm mask}$ . Therefore $L_{\rm mask}\in\mathsf{P}/\mathrm{poly}$ , implying $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$ . ∎

By the Karp–Lipton theorem [13], such a preprocessing scheme would collapse the polynomial hierarchy to $\Sigma_{2}^{\mathsf{P}}$ .

Remark 4.3.

Analogues of Theorem 4.1 and Corollary 4.2 hold after lifting the fixed family to principal cyclic ideal lattices. Let $P_{m},\nu_{m}$ be the values from Section 3 for $(\mathbf{U}_{m},\mathbf{1}_{m})$ , and set $H_{m}:=P_{m}^{2}k_{m}+\nu_{m}+4$ and $B_{m}:=2\lceil\sqrt{H_{m}}\rceil+1$ . Since $\Delta_{\boldsymbol{\mu}}+4\leq H_{m}$ , applying Lemma 3.7 with $H=H_{m}$ and $B=B_{m}$ yields, for each $m$ , one principal cyclic ideal whose basis consists of the cyclic shifts of its generator. Only the lifted target and threshold depend on the mask. The threshold is $8\Delta_{\boldsymbol{\mu}}$ , and the squared-distance gap is $32$ .

A polynomial-time solution to exact decision-CVPP on this fixed cyclic family would imply $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$ . Exact decision-CVP on the same family remains $\mathsf{NP}$ -complete, thereby answering the exact decision version of Micciancio’s question of whether CVP is $\mathsf{NP}$ -hard even for a fixed family of cyclic lattices [21].

5 Conclusion

In this work, we prove that exact Euclidean decision-CVP is $\mathsf{NP}$ -complete on the coefficient lattices of nonzero principal ideals in power-of-two cyclotomic rings. The construction also yields $\mathsf{NP}$ -hardness for exact search-CVP. We extend both results to full-rank principal cyclic ideal lattices using a lift that scales squared distances exactly. We also construct uniformly computable fixed cyclotomic and cyclic principal-ideal families on which exact decision-CVP remains $\mathsf{NP}$ -complete. A polynomial-time solution to exact decision-CVPP on either family would imply $\mathsf{NP}\subseteq\mathsf{P}/\mathrm{poly}$ .

Use of generative AI.

The authors used GPT-5.6-sol (Codex) to assist with language editing, presentation, and preliminary verification of mathematical arguments during the early drafting stage. All mathematical claims and proofs in this manuscript were checked by the authors, who take full responsibility for the content of the paper.

References

[AJT98] M. Ajtai (1998) The shortest vector problem in $L_{2}$ is NP-hard for randomized reductions (extended abstract). In Proceedings of the 30th Annual ACM Symposium on Theory of Computing (STOC), pp. 10–19. External Links: Document Cited by: §1.
[AKK+05] M. Alekhnovich, S. A. Khot, G. Kindler, and N. K. Vishnoi (2005) Hardness of approximating the closest vector problem with pre-processing. In Proceedings of the 46th Annual IEEE Symposium on Foundations of Computer Science (FOCS), pp. 216–225. External Links: Document Cited by: §1.
[CDP+16] R. Cramer, L. Ducas, C. Peikert, and O. Regev (2016) Recovering short generators of principal ideals in cyclotomic rings. In Advances in Cryptology—EUROCRYPT 2016, Part II, Lecture Notes in Computer Science, Vol. 9666, pp. 559–585. External Links: Document Cited by: §1.
[CDW21] R. Cramer, L. Ducas, and B. Wesolowski (2021) Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time. Journal of the ACM 68 (2), pp. 1–26. External Links: Document Cited by: §1.
[DKS98] I. Dinur, G. Kindler, and S. Safra (1998) Approximating-CVP to within almost-polynomial factors is NP-hard. In Proceedings of the 39th Annual IEEE Symposium on Foundations of Computer Science (FOCS), pp. 99–111. External Links: Document Cited by: §1.
[ET41] P. Erdős and P. Turán (1941) On a problem of Sidon in additive number theory, and on some related problems. Journal of the London Mathematical Society 16 (4), pp. 212–215. External Links: Document Cited by: §1.2, §3.1.
[FM04] U. Feige and D. Micciancio (2004) The inapproximability of lattice and coding problems with preprocessing. Journal of Computer and System Sciences 69 (1), pp. 45–67. External Links: Document Cited by: §1.
[GJ79] M. R. Garey and D. S. Johnson (1979) Computers and intractability: a guide to the theory of np-completeness. W. H. Freeman, San Francisco. Cited by: §1.2, §2.3.
[GEN09] C. Gentry (2009) Fully homomorphic encryption using ideal lattices. In Proceedings of the 41st Annual ACM Symposium on Theory of Computing (STOC), pp. 169–178. External Links: Document Cited by: §1.
[HS26a] I. M. Hair and A. Sahai (2026) Deterministic hardness of approximation for SVP in all finite $\ell_{p}$ norms. In Proceedings of the 67th Annual IEEE Symposium on Foundations of Computer Science (FOCS), Note: To appear External Links: 2604.01451 Cited by: §1.
[HS26b] I. M. Hair and A. Sahai (2026) $\mathrm{SVP}_{p}$ Is Deterministically NP-Hard for All $p>2$ , Even to Approximate within a Factor of $2^{\log^{1-\varepsilon}n}$ . In Proceedings of the 58th Annual ACM Symposium on Theory of Computing (STOC), pp. 1716–1727. External Links: Document, 2511.04125 Cited by: §1.
[HPS98] J. Hoffstein, J. Pipher, and J. H. Silverman (1998) NTRU: a ring-based public key cryptosystem. In Algorithmic Number Theory, Lecture Notes in Computer Science, Vol. 1423, pp. 267–288. External Links: Document Cited by: §1.
[KL80] R. M. Karp and R. J. Lipton (1980) Some connections between nonuniform and uniform complexity classes. In Proceedings of the 12th Annual ACM Symposium on Theory of Computing (STOC), pp. 302–309. External Links: Document Cited by: §1.1, §4.
[KPV12] S. A. Khot, P. Popat, and N. K. Vishnoi (2012) $2^{\log^{1-\varepsilon}n}$ hardness for the closest vector problem with preprocessing. In Proceedings of the 44th Annual ACM Symposium on Theory of Computing (STOC), pp. 277–288. External Links: Document Cited by: §1.
[LM06] V. Lyubashevsky and D. Micciancio (2006) Generalized compact knapsacks are collision resistant. In Automata, Languages and Programming, Part II, Lecture Notes in Computer Science, Vol. 4052, pp. 144–155. External Links: Document Cited by: §1.
[LPR10] V. Lyubashevsky, C. Peikert, and O. Regev (2010) On ideal lattices and learning with errors over rings. In Advances in Cryptology—EUROCRYPT 2010, Lecture Notes in Computer Science, Vol. 6110, pp. 1–23. External Links: Document Cited by: §1.
[MG02] D. Micciancio and S. Goldwasser (2002) Complexity of lattice problems: a cryptographic perspective. The Kluwer International Series in Engineering and Computer Science, Vol. 671, Kluwer Academic Publishers, Boston, MA. External Links: Document Cited by: §1.
[MIC98] D. Micciancio (1998) The shortest vector in a lattice is hard to approximate to within some constant. In Proceedings of the 39th Annual IEEE Symposium on Foundations of Computer Science (FOCS), pp. 92–98. External Links: Document Cited by: §1.
[MIC01] D. Micciancio (2001) The hardness of the closest vector problem with preprocessing. IEEE Transactions on Information Theory 47 (3), pp. 1212–1215. External Links: Document Cited by: §1, §2.1, §4.
[MIC02] D. Micciancio (2002) Generalized compact knapsacks, cyclic lattices, and efficient one-way functions from worst-case complexity assumptions. In Proceedings of the 43rd Annual IEEE Symposium on Foundations of Computer Science (FOCS), pp. 356–365. External Links: Document Cited by: §1.
[MIC07] D. Micciancio (2007) Generalized compact knapsacks, cyclic lattices, and efficient one-way functions. Computational Complexity 16 (4), pp. 365–411. External Links: Document Cited by: §1, Remark 3.9, Remark 4.3.
[PR06] C. Peikert and A. Rosen (2006) Efficient collision-resistant hashing from worst-case assumptions on cyclic lattices. In Theory of Cryptography, Lecture Notes in Computer Science, Vol. 3876, pp. 145–166. External Links: Document Cited by: §1.
[PR07] C. Peikert and A. Rosen (2007) Lattices that admit logarithmic worst-case to average-case connection factors. In Proceedings of the 39th Annual ACM Symposium on Theory of Computing (STOC), pp. 478–487. External Links: Document Cited by: §1.
[VAN81] P. van Emde Boas (1981) Another NP-complete partition problem and the complexity of computing short vectors in a lattice. Technical report Technical Report 81-04, Mathematisch Instituut, Universiteit van Amsterdam. Cited by: §1.

	$\displaystyle\\|\sigma_{d}(f)\\|_{2}^{2}$	$\displaystyle=\sum_{r,s=0}^{d-1}f_{r}\overline{f_{s}}\sum_{k=0}^{d-1}\zeta^{(2k+1)(r-s)}$
		$\displaystyle=d\sum_{r=0}^{d-1}\|f_{r}\|^{2}$
		$\displaystyle=d\\|\operatorname{coeff}(f)\\|_{2}^{2}.$