= Module learning with errors
<Module learning with errors> is a structured version of <learning with errors> in which matrix entries and secret components are elements of a specified <polynomial ring>. A typical relation is
$$
t=As+e\quad\text{in }R_q^k,\qquad R_q=(\mathbb Z/q\mathbb Z)[X]/(X^n+1).
$$
Here $A$ is a public $k\times k$ <matrix> of ring elements, while $s$ and $e$ have sampled small coefficients. Multiplication combines <polynomial multiplication> with reduction by the defining polynomial and coefficient modulus.
A ring element packs $n$ coefficients, giving structured linear operations without storing an arbitrary dense matrix of all scalar coefficients. This saves space and computation, while introducing an algebraic structure that the security assumption must cover. <CRYSTALS-Kyber> uses module-LWE, and <ML-KEM> standardizes a related encapsulation construction. This is a conditional hardness basis, not a proof that every choice of ring and parameters is secure.<Kyber documentation by CRYSTALS project>[Scientific Background, polynomial rings and Module-LWE]{ref}
Back to article page
