A-12.5 Vandermonde Matrix with Roots of Cyclotomic Polynomial over Ring (ℤp)

Theorem A-12.4 (in §A-12.4) showed that V ⋅V T = n ⋅InR, where V is the Vandermonde matrix V = 𝑉𝑎𝑛𝑑𝑒𝑟(x0,x1,⋯,xn−1), where each xi is the primitive μ-th root of unity over X ∈ ℂ (i.e., complex number) and μ is a power of 2. In this subsection, we will show that the relation V ⋅V T = n ⋅InR holds even if each xi is the primitive μ-th root of unity over X ∈ ℤp (i.e., ring). In particular, we will prove Theorem A-12.4:

⟨Theorem A-12.5⟩ Vandermonde Matrix with Roots of (power-of-2)-th Cyclotomic Polynomial over Ring (ℤp)

The proof takes the same format as that of Theorem A-12.4 (in §A-12.4). Suppose we have an n ×n (where n is a power of 2) Vandermonde matrix comprising n distinct roots of the μ-th cyclotomic polynomial over X ∈ ℤp (ring), where μ is a power of 2 and n = μ 2. In other words, V = 𝑉𝑎𝑛𝑑𝑒𝑟(x0,x1,⋯,xn−1), where each xi is the root of Xn + 1 (i.e., the primitive (μ = 2n)-th roots of unity). Then, the following holds:

V ⋅V T = [ 0 ⋯ 0 0 n 0 ⋯ 0 n 0 0 ⋯ n 0 0 ⋮ ... ⋮ ⋮ ⋮ n 0 0 ⋯ 0 ] = n⋅InR

And V −1 = n−1 ⋅V T ⋅InR

Proof.

1.
V ⋅V T is expanded as follows:

V ⋅V T = [ 1 (ω) (ω)2 ⋯ (ω)n−1 1 (ω3) (ω3)2 ⋯ (ω3)n−1 1 (ω5) (ω5)2 ⋯ (ω5)n−1 ⋮ ⋮ ⋮ ⋱ ⋮ 1 (ω2n−1) (ω2n−1)2 ⋯ (ω2n−1)n−1 ] ⋅[ 1 1 1 ⋯ 1 (ω) (ω3) (ω5) ⋯ (ω2n−1) (ω)2 (ω3)2 (ω5)2 ⋯ (ω2n−1)2 ⋮ ⋮ ⋮ ⋱ ⋮ (ω)n−1 (ω3)n−1 (ω5)n−1 ⋯ (ω2n−1)n−1 ]

= [ ∑ ⁡ k=0n−1ω2k ∑ ⁡ k=0n−1ω4k ∑ ⁡ k=0n−1ω6k ⋯ ∑ ⁡ k=0n−1ω2𝑛𝑘 ∑ ⁡ k=0n−1ω4k ∑ ⁡ k=0n−1ω6k ∑ ⁡ k=0n−1ω8k ⋯ ∑ ⁡ k=0n−1ω2k(n+1) ∑ ⁡ k=0n−1ω6k ∑ ⁡ k=0n−1ω8k ∑ ⁡ k=0n−1ω10k ⋯ ∑ ⁡ k=0n−1ω2k(n+2) ⋮ ⋮ ⋮ ⋱ ⋮ ∑ ⁡ k=0n−1ω2𝑛𝑘 ∑ ⁡ k=0n−1ω2(n+1)k ∑ ⁡ k=0n−1ω2(n+2)k ⋯ ∑ ⁡ k=0n−1ω2(n+n−1)k ]

, where ω (i.e., the primitive (μ = 2n)-th root of unity) has the order 2n.

2.
Note that the V ⋅V T matrix’s anti-diagonal elements are ∑ ⁡ k=0n−1ω2𝑛𝑘. It can be seen that ω2n ≡1 mod p, because 𝖮𝗋𝖽p(ω) = 2n. Thus, the V ⋅V T matrix’s every anti-diagonal element is ∑ ⁡ k=0n−11 = n.

3.
Next, we will prove that the V ⋅V T matrix has 0 for all other positions than the anti-diagonal ones. In other words, we will prove the following:

∑ ⁡ k=0n−1ω2k = ∑ k=0n−1ω4k = ∑ k=0n−1ω6k = ⋯ = ∑ k=0n−1ω2(n−1)k = ∑ k=0n−1ω2(n+1)k = ⋯ = ∑ k=0n−1ω2(2n−1)k = 0

The above is true by the Geometric Sum formula (Theorem A-12.4.1). As shown in the proof step 3 of Theorem A-12.4, each element is of the form ∑ ⁡ k=0n−1(ω2m)k for some integer m (where 2m is not a multiple of 2n). Let r = ω2m. Then:

∑ ⁡ k=0n−1rk = rn −1 r −1 = (ω2m)n −1 ω2m −1 = (ωn)2m −1 ω2m −1

Since ω is a root of Xn + 1, we know ωn ≡−1 mod p. Thus:

(−1)2m −1 ω2m −1 = 1 −1 ω2m −1 = 0

Therefore, the sum is 0 for all off-anti-diagonal positions.

4.
According to step 1 and 2, the V ⋅V T matrix has n on its anti-diagonal positions and 0 for all other positions.
5.
Now we will derive the formula for V −1. Given V ⋅V T = n ⋅InR,

V −1 ⋅V ⋅V T = V −1 ⋅n ⋅InR

V T = V −1 ⋅n ⋅InR

V T ⋅InR = V −1 ⋅n ⋅InR ⋅InR

V T ⋅InR = V −1 ⋅n # since InR ⋅InR = In

Now, there is one caveat: modulo operation does not support direct number division (as explained in §A-1.4). This means that the formula V −1 = V T ⋅InR n in Theorem A-12.4 (in §A-12.4) is inapplicable in our case, because our modulo p arithmetic does not allow direct division of V T ⋅InR by n. Therefore, we instead multiply V T ⋅InR by the inverse of n (i.e., n−1). We continue as follows:

V T ⋅InR = V −1 ⋅n

V T ⋅InR ⋅n−1 = V −1 ⋅n ⋅n−1

V −1 = n−1 ⋅V T ⋅InR

□

We finally proved that V ⋅V T = n ⋅InR, and V −1 = n−1 ⋅V T ⋅InR. Later in the BFV scheme (§D-2), we will use V −1 to encode an integer vector into a vector of polynomial coefficients, and V T to decode it back to the integer vector (§D-2.2).

Condition for 𝛍: Like in CKKS, it’s worthwhile to note that the property V ⋅V T = n ⋅InR does not hold if μ (denoting the μ-th cyclotomic polynomial) is not a power of 2. In particular, step 3 of the proof does not hold anymore if μ is not a power of 2:

∑ ⁡ k=0n−1ω2k≠∑ k=0n−1ω4k≠∑ k=0n−1ω6k≠⋯≠∑ k=0n−1ω2(n−1)k≠∑ k=0n−1ω2(n+1)k≠⋯≠∑ k=0n−1ω2(2n−1)k≠0