 Okay, yes, this is work with Zach Pepin at Michigan who figured out most all this stuff, and I get to tell you about it So the topic is algebraic versions of LWE These are foundation for lots of efficient lattice crypto and they go by various names ring LWE module to be polynomial order LWE middle product LWE Maybe I missed some rump session talks, so maybe there are more by now And there's a thick web of reductions that support their hardness Among the problems themselves and also from worst-case problems on algebraically structured lattices There we go So that sounds great, but these reductions are often kind of difficult to understand and use and and interpret For the following reasons one reason is sometimes you end up with several steps between the reductions Okay, so to get from ring LWE to middle product LWE you got to take a bunch of hops and they're spread out across two different papers And there's a lot of steps within each step. So There's complex complexity in there There's frequently a large blow-up and distortion of the error when going from one problem to another different metrics There's sometimes even non-uniform advice that you need So in this paper, we try to bring some order and clarity to this situation We give one parameterized problem that covers all the proposed algebraic LWE's that have been in the literature that have been defined over commutative rings and We get very unified and simplified and tighter reductions among these kinds of problems They all have nice easy to analyze effects on the error distribution Sometimes they don't change the error at all which is nice they're preserving and so a couple of example theorems that we get You can prove that ring LWE in essentially essentially any ring reduces to middle product LWE with an error growth that's the spectral norm of these powers of a certain elements in the original ring and What's nice about this is is reproving but with tighter bounds and more simple Proof a theorem which says that in order to break middle product LWE You have to be able to break ring LWE in in all rings subject to this this constraint here So that that gives a very nice strength to middle product LWE and Then there's a second theorem which relates ring LWE to module LWE. I won't go into the details of it But it's it's also there Okay, so it would be like it's very late people have been drinking and be very cruel of me to to go into the algebra Of all this stuff. So let's go into the algebra of all this stuff So I'll just to find the unified problem It's it's actually pretty pretty cute and simple so just take a number field and take any lattice in the number field that's that's full rank that you want and There's an object here, which is not terribly well known But if you dig through the the certain textbooks it will show up. There's a thing called the coefficient ring of the lattice L And it's just all the elements of the number field by which L is closed under multiplication So pretty simple definition. It can be defined as an annihilator Of L or something like that and it turns out easy to prove that it has this form for these little V's or duals so the This LLWE problem that we define is as follows it's concerned with a secret from L dual and Random a's drawn from the associated coefficient ring of L and then you get s times a with some noise and it's modded by q times L dual okay, and that's the problem and You can check that that's well defined, but basically the point is that this specializes to all those other Ring order module LLWE that you want by just assigning L appropriately Okay, and you can get other versions by taking other L's of interest Okay, so I just have a few seconds. Well, oh they gave me the old slides. Okay Too bad. So there's a couple theorems One theorem is that you can go from For any order and a suborder you can just reduce from the order to a suborder The error doesn't change nothing changes It's like a half-page proof that just uses a natural bijection between the order and the suborder mod q And and then the second theorem relates to I'll just go back to the Summary of that theorem Yeah, so notable theorem number one says that you can go from ring LWE to middle product LWE. Okay. I'm out of time. Thank you