A-11.5 Vandermonde Matrix with Roots of Cyclotomic Polynomial over Ring (p)

Theorem A-11.4 (in §A-11.4) showed that V ⋅V T = n ⋅InR, where V is the Vandermonde matrix V = 𝑉𝑎𝑛𝑑𝑒𝑟(x0,x1,⋯,xn−1), where each xi is the primitive μ-th root of unity over X ∈ ℂ (i.e., complex number) and μ is a power of 2. In this subsection, we will show that the relation V ⋅V T = n ⋅InR holds even if each xi is the primitive μ-th root of unity over X ∈ p (i.e., ring). In particular, we will prove Theorem A-11.4:

Theorem A-11.5 Vandermonde Matrix with Roots of (power-of-2)-th Cyclotomic Polynomial over Ring (p)

The proof takes the same format as that of Theorem A-11.4 (in §A-11.4). Suppose we have an n ×n (where n is a power of 2) Vandermonde matrix comprised of n distinct roots of the μ-th cyclotomic polynomial over X ∈ p (ring), where μ is a power of 2 and n = μ 2. In other words, V = 𝑉𝑎𝑛𝑑𝑒𝑟(x0,x1,⋯,xn−1), where each xi is the root of Xn + 1 (i.e., the primitive (μ = 2n)-th roots of unity). Then, the following holds:

V ⋅V T = [ 0 0 0 n 0 0 n 0 0 n 0 0 ... n 0 0 0 ] = n⋅InR

And V −1 = n−1V T InR

Proof.

1.
V ⋅V T is expanded as follows:

V ⋅V T = [ 1 (ω) (ω)2 (ω)n−1 1 (ω3) (ω3)2 (ω3)n−1 1 (ω5) (ω5)2 (ω5)n−1 1 (ω2n−1) (ω2n−1)2 (ω2n−1)n−1 ][ 1 1 1 1 (ω) (ω3) (ω5) (ω2n−1) (ω)2 (ω3)2 (ω5)2 (ω2n−1)2 (ω)n−1 (ω3)n−1 (ω5)n−1 (ω2n−1)n−1 ]

= [ k=0n−1ω2k k=0n−1ω4k k=0n−1ω6k k=0n−1ω2nk k=0n−1ω4k k=0n−1ω6k k=0n−1ω8k k=0n−1ω2k(n+1) k=0n−1ω6k k=0n−1ω8k k=0n−1ω10k k=0n−1ω2k(n+2) k=0n−1ω2nk k=0n−1ω2(n+1)k k=0n−1ω2(n+2)k k=0n−1ω2(n+n−1)k ]

, where ω (i.e., the primitive (μ = 2n)-th root of unity) has the order 2n.

2.
Note that the V ⋅V T matrix’s anti-diagonal elements are k=0n−1ω2nk. It can be seen that ω2n ≡1 mod p, because 𝖮𝗋𝖽p(ω) = 2n. Thus, the V ⋅V T matrix’s every anti-diagonal element is k=0n−11 = n.

3.
Next, we will prove that the V ⋅V T matrix has 0 for all other positions than the anti-diagonal ones. In other words, we will prove the following:

k=0n−1ω2k =k=0n−1ω4k =k=0n−1ω6k = ⋯ =k=0n−1ω2(n−1)k =k=0n−1ω2(n+1)k = ⋯ =k=0n−1ω2(2n−1)k = 0

The above is true by the Geometric Sum formula (Theorem A-11.4.1). As shown in the proof step 3 of Theorem A-11.4, each element is of the form k=0n−1(ω2m)k for some integer m (where 2m is not a multiple of 2n). Let r = ω2m. Then:

k=0n−1rk = rn −1 r −1 = (ω2m)n −1 ω2m −1 = (ωn)2m −1 ω2m −1

Since ω is a root of Xn + 1, we know ωn ≡−1 mod p. Thus:

(−1)2m −1 ω2m −1 = 1 −1 ω2m −1 = 0

Therefore, the sum is 0 for all off-anti-diagonal positions.

4.
According to step 1 and 2, the V ⋅V T matrix has n on its anti-diagonal positions and 0 for all other positions.
5.
Now we will derive the formula for V −1. Given V ⋅V T = n ⋅InR,

V −1 ⋅V ⋅V T = V −1 ⋅n ⋅InR

V T = V −1 ⋅n ⋅InR

V T InR = V −1 ⋅n ⋅InRInR

V T InR = V −1 ⋅n # since InRInR = In

Now, there is one caveat: modulo operation does not support direct number division (as explained in §A-1.4). This means that the formula V −1 = V T InR n in Theorem A-11.4 (in §A-11.4) is inapplicable in our case, because our modulo p arithmetic does not allow direct division of V T InR by n. Therefore, we instead multiply V T InR by the inverse of n (i.e., n−1). We continue as follows:

V T InR = V −1 ⋅n

V T InRn−1 = V −1 ⋅n ⋅n−1

V −1 = n−1V T InR

We finally proved that V ⋅V T = n ⋅InR, and V −1 = n−1V T InR. Later in the BFV scheme (§D-2), we will use V −1 to encode an integer vector into a vector of polynomial coefficients, and V T to decode it back to the integer vector (§D-2.2).

Condition for 𝛍: Like in CKKS, it’s worthwhile to note that the property V ⋅V T = n ⋅InR does not hold if μ (denoting the μ-th cyclotomic polynomial) is not a power of 2. In particular, step 3 of the proof does not hold anymore if μ is not a power of 2:

k=0n−1ω2kk=0n−1ω4kk=0n−1ω6k≠⋯≠k=0n−1ω2(n−1)kk=0n−1ω2(n+1)k≠⋯≠k=0n−1ω2(2n−1)k≠0