Module cyclotomic 

Power-of-two cyclotomic ring R = ℤ[X]/(Xⁿ + 1), n = 2ᵏ

When n is a power of two, Xⁿ + 1 = Φ_{2n}(X) is the 2n-th cyclotomic polynomial, so R is the ring of integers 𝒪_K of the cyclotomic field K = ℚ(ζ_{2n}) (ζ_{2n} a primitive 2n-th root of unity, played by X). This is the algebraic substrate of Module-LWE — ML-KEM/Kyber live over R_q with n = 256. Multiplication is negacyclic (Xⁿ ≡ −1).

The field’s Galois group is Gal(K/ℚ) ≅ (ℤ/2n)^× — the ring automorphisms σ_t : X ↦ X^t for odd t, of which there are exactly φ(2n) = n. This rigid, fully-known symmetry group is precisely what structure-exploiting cryptanalysis (the log-unit lattice, the Principal Ideal Problem) rides on: two generators of an ideal differ by a unit, and the units are governed by these automorphisms. It is the lattice analogue of the Aut(E₀)-orbit collapse in the isogeny keyspace — symmetry = compression.

This module builds the ring and its Galois action honestly. It does not break Module-LWE: it is the substrate on which the (short-generator) attacks that do work are expressed, and the lens that measures where they stop.

Structs

Cyclo

An element of R = ℤ[X]/(Xⁿ + 1): the coefficient vector [a₀, …, a_{n−1}] of Σ aᵢ Xⁱ, with n a power of two.

LogUnitAudit

An audit of the log-unit lattice geometry Λ = Log(units) that governs CDPR recovery — the decoding scale of the symmetry-quotient.

Functions

approximation_scale

The upstream wall, measured. The approximation scale of the log-unit collapse at dimension n: the covering radius μ(Λ) against the shortest basis log-length — a proxy for the factor by which a log-unit-decoded generator can exceed the true shortest vector. To threaten Module-LWE this factor would have to stay polynomial; instead it grows super-polynomially with n (asymptotically 2^{Õ(√n)}, Cramer–Ducas–Wesolowski 2017). This is the real wall — not the symmetry-collapse rung (which is cheap, as recovery_margin shows) but the quality of what the collapse can decode as the field grows.

audit_log_unit

Measure the log-unit lattice geometry for R = ℤ[X]/(Xⁿ+1).

cyclotomic_units

The cyclotomic units b_j = 1 + X + ⋯ + X^{j−1} = (Xʲ−1)/(X−1) for j an odd residue in [3, n−1]. These are n/2 − 1 independent units — a basis of a finite-index subgroup of the unit group, and the basis of the log-unit lattice used by CDPR.

galois_group

The n = φ(2n) Galois automorphisms of R = ℤ[X]/(Xⁿ+1), as the odd residues mod 2n that index them.

recover_short_generator

CDPR short-generator recovery. Given a generator h of a principal ideal that has an unusually short generator g (so h = g·u for a unit u), recover a short generator: project Log(h) onto the log-unit lattice against the cyclotomic-unit basis to strip the unit, divide it out exactly (via the Galois-conjugate inverse), and pick the exact generator of smallest coefficient-norm over a local search around the rounded lattice point. Returns g up to a root of unity ±Xᵐ. This is the genuine break on schemes that expose a short principal-ideal generator (Soliloquy, Smart–Vercauteren); it does not touch Module-LWE, where the secret is not such a generator.

recovery_margin

The CDPR recovery margin of a candidate generator g: ‖proj_{span Λ} Log(g)‖ / μ(Λ). A generator whose log projects to well within the covering radius (margin < 1) is decodable by stripping the unit; margin ≫ 1 is beyond the decoding region. This measures where the short-generator wall is — and, honestly, it is small even for short (ML-KEM-shaped) secrets, showing the log-unit collapse is not where Module-LWE’s hardness lives: that sits upstream (no principal-ideal-generator to hand the attacker, module rank ≥ 2, and the 2^Õ(√n) Ideal-SVP approximation gap).