A Survey of Lattice-Based Physical-Layer Security for Wireless Systems with p-Modular Lattice Constructions ^†

Abstract

Physical-layer security (PLS) provides an information-theoretic framework for securing wireless communications by exploiting channel and signal-structure asymmetries, thereby avoiding reliance on computational hardness assumptions. Within this setting, lattice codes and their algebraic constructions play a central role in achieving secrecy over Gaussian and fading wiretap channels. This article offers a comprehensive survey of lattice-based wiretap coding, covering foundational concepts in algebraic number theory, Construction A over number fields, and the structure of modular and unimodular lattice families. We review key secrecy metrics, including secrecy gain, flatness factor, and equivocation, and consolidate classical and recent results to provide a unified perspective that links wireless-channel models with their underlying algebraic lattice structures. In addition, we review a newly proposed family of p-modular lattices in Khodaiemehr, H., 2018 constructed from cyclotomic fields $\mathbb{Q}\left({\zeta }_p\right)$ for primes $p\equiv 1\left(\mathrm{mod}4\right)$ via a generalized Construction A framework. We characterize their algebraic and geometric properties and establish a non-existence theorem showing that such constructions cannot be extended to prime-power cyclotomic fields $\mathbb{Q}\left({\zeta }_{p^n}\right)$ with $n>1$. Finally, motivated by the fact that these p-modular lattices naturally yield mixed-signature structures for which classical theta series diverge, we integrate recent advances on indefinite theta series and modular completions. Drawing on Vignéras’ differential framework and generalized error functions, we outline how modularly completed indefinite theta series provide a principled analytic foundation for defining secrecy-relevant quantities in the indefinite setting. Overall, this work serves both as a survey of algebraic lattice techniques for PLS and as a source of new design insights for secure wireless communication systems.

1. Introduction

The relentless evolution of wireless communication systems, characterized by increasing demands for spectral efficiency, data rates, and robust connectivity, necessitates a parallel advancement in security paradigms. Traditional cryptographic methods, while foundational for secure communication, often confront inherent limitations in dynamic wireless environments. These include significant computational overhead, complex key management protocols, and susceptibility to sophisticated attacks such as the man-in-the-middle exploit [1,2]. Consequently, there has been a surge in interest towards physical-layer security, an approach that leverages the intrinsic physical properties of the wireless channel itself to establish security guarantees. PLS operates at the physical layer, providing a complementary layer of defense rooted in information theory, distinct from algorithmic cryptography [3,4].

Historically, algebraic techniques have proven to be unexpectedly powerful tools in various facets of communication system design. Initially, elementary number theory laid the groundwork for error-correcting codes, while finite fields became the mathematical engine for designing powerful binary and non-binary codes. As digital receiver processing capabilities advanced, attention shifted to signal-space codes, where the theory of Euclidean lattices emerged as a cornerstone for constructing dense signal constellations. These lattices facilitated efficient transmission over additive white Gaussian noise (AWGN) channels, with their efficiency often quantified by the volume-to-noise ratio (VNR). The pursuit of capacity-achieving and sphere-bound-achieving lattices spurred significant research efforts [5,6,7]. This led to the development of various practically decodable lattice families, characterized by sparse parity-check matrices that enabled high-dimensional decoding [8,9,10,11,12,13]. Other notable constructions include low-density lattice codes (LDLC) [14], integer low-density lattices based on Construction A (LDA) [15], and polar lattices [16]. Beyond core communication, algebraic methods, such as Gröbner bases, have also found applications in generalized lattice forms and algebraic decoding algorithms [17,18].

The application of algebraic structures extended further with the advent of wireless communication over fading channels. New code design criteria, focused on improving performance in bandwidth-limited scenarios, emerged. Algebraic number theory proved instrumental in this context, facilitating the design of robust coding schemes. These often manifested as multi-dimensional lattice signal constellations, achieving high coding gain through modulation diversity (or signal space diversity) [19]. This involved designing intrinsic high-diversity algebraic lattices via canonical embeddings of number fields or applying specific rotations to quadrature amplitude modulation (QAM) constellations. Furthermore, the theoretical exploration of multi-antenna wireless communication in the late 1990s revealed the critical role of division algebras in space–time coding. Once performance criteria for space–time codes were cast as matrix design problems, division algebras, including number fields and cyclic algebras, naturally emerged as optimal solutions, satisfying various performance metrics [20,21,22,23,24,25,26,27]. Other advanced algebraic structures, such as Clifford algebras [28] and crossed product algebras [29], have also been investigated.

Building upon this rich foundation, the focus has more recently shifted to leveraging these advanced algebraic techniques for physical-layer security. The open nature of wireless mediums, the decentralized nature of many networks, and the dynamic topology of mobile systems render traditional cryptographic approaches challenging for secure communication. This context underscores the significance of the information-theoretic approach, initiated by Wyner [3] and Csiszár and Körner [4], which conceptualizes the wiretap channel as a scenario where a legitimate receiver (Bob) has a superior channel to an eavesdropper (Eve). This framework demonstrates that reliable and confidential communication is achievable by exploiting physical channel differences without reliance on cryptographic keys. Extensive research has since characterized secrecy capacity across various wiretap channel models, including Gaussian point-to-point and relay networks [1,30].

Within the domain of Gaussian wiretap channels, where secrecy capacity is well-established [31], lattice codes have emerged as a powerful paradigm. Early designs focused on binary inputs [32,33], but a more sophisticated approach introduced by Belfiore and Oggier [34] proposed lattice codes optimized via novel invariants like secrecy gain and flatness factor. These metrics precisely quantify the eavesdropper’s confusion and the code’s ability to obscure information. A vanishing flatness factor (or equivalently, an infinitely large secrecy gain) is directly linked to robust semantic security [35]. The investigation of these metrics for ℓ-modular lattices, particularly unimodular lattices, has been a key research thrust [36,37]. The Belfiore–Solé conjecture on weak secrecy gain sparked rigorous methods for its verification [38,39], with studies extending to the asymptotic behavior, achievable bounds, and specific classifications of unimodular and modular lattices in various dimensions [30,37,40,41,42,43,44,45].

A versatile methodology for constructing lattices with desired properties is Construction A [46]. Its efficacy was amplified through generalization to number fields, initially proposed by Ebeling using cyclotomic fields [47], and subsequently extended to complex multiplication (CM) fields and totally real number fields [48,49]. This generalization provided a framework for lattice coset encoding in wireless channels, including wiretap scenarios [19,49,50], and facilitated the design of lattices with inherent properties like modularity and large shortest vectors, crucial for coding applications and physical network coding [51]. Extensive secrecy gain analysis for ℓ-modular lattices from quadratic extensions further underscores the utility of this approach [52,53].

This paper investigates the advanced application of algebraic number theory for constructing cyclotomic modular lattices, specifically designed for improving physical-layer security in next-generation wireless systems. Our structured investigation begins by detailing the Gaussian wiretap channel model in Section 2. This section provides a technical exposition on lattice properties critical for secure communication, including rigorous definitions of secrecy gain and flatness factor. Section 3 introduces the foundational mathematical prerequisites in algebraic number theory. We explore cyclotomic number fields, a class of monogenic fields with predictable algebraic structures, and describe their role in cryptographic and information security contexts. We subsequently examine the Construction A framework, focusing on its application for lattices over general number fields in Section 4. In Section 5, we address the application of cyclotomic number fields in the construction of modular lattices. A central contribution of this work lies in the rigorous construction and characterization of families of p-modular lattices derived from cyclotomic number fields. In Section 6, we present explicit construction methodologies utilizing the generalized Construction A framework and review recent theoretical results that precisely determine the conditions under which such modular lattices can exist. These results are not merely of theoretical interest; they yield concrete engineering design rules that provide a clear roadmap for system architects. For example, based on these results, one can demonstrate that constructing modular lattices via Construction A over cyclotomic fields of prime-power order $p^n$ is generally infeasible when $n>1$, while simultaneously proving feasibility and strong structural guarantees for fields of prime order p with $p\equiv 1\left(\mathrm{mod}4\right)$. These insights illuminate both promising future directions and fundamental limitations in algebraic lattice construction for secure communications. Interestingly, these p-modular constructions naturally give rise to lattices of mixed signature, for which classical secrecy metrics such as secrecy gain and flatness factor, which are well understood in the positive-definite setting, are no longer directly applicable, as the associated theta series diverges. This challenge motivates a deeper examination of recent advances in the theory of indefinite theta series and their modular completions, particularly the framework introduced by Vignéras and extended through generalized error functions [54]. These developments provide a principled analytic foundation for studying secrecy properties of indefinite lattices and open new future pathways for defining secrecy-relevant quantities beyond the positive-definite regime. To bridge these mathematical advances with physical-layer security, this paper outlines the role of modular completions, Vignéras’ operator, and generalized error functions in enabling meaningful analysis of mixed-signature lattice codes [55,56].

Finally, we transition from theoretical exposition to practical relevance by linking these advanced algebraic constructions to the cutting-edge landscape of modern wireless systems in Section 7. We explore how the unique algebraic structure and inherent properties of our cyclotomic modular lattices—their specific modularity, predictable behavior, and intrinsic potential for optimized secrecy—render them highly suitable for deployment in next-generation security solutions. This includes a detailed discussion of their integration into sophisticated multiple-input multiple-output (MIMO) systems, their synergistic potential with reconfigurable intelligent surfaces (RIS) for dynamic channel shaping, and their role within machine learning (ML)-assisted communication paradigms. This section identifies concrete design benefits, illustrates how our theoretical properties translate into tangible performance gains, and illuminates crucial future research directions for leveraging these robust algebraic constructions in the context of wireless systems. Section 8 offers our concluding remarks and summarizes the broader implications of this work.

2. Wireless Wiretap Channels and Secrecy Metrics

This section establishes the fundamental models and performance metrics essential for understanding PLS in wireless communication systems. We begin by reviewing the canonical wireless wiretap channel models, from basic AWGN scenarios to more complex fading environments. Subsequently, we delve into the information-theoretic foundations of secrecy, defining key concepts such as secrecy capacity and equivocation. The section then introduces entropy-based metrics, specifically secrecy gain and flatness factor, which are crucial for quantifying the security performance of lattice codes. Finally, we discuss lattice coset coding as a practical technique for simultaneously achieving reliability and secrecy. This framework will serve as the unifying basis for the subsequent algebraic constructions and analyses presented in this paper.

2.1. Wireless Wiretap Models: AWGN and Quasi-Static Fading

Effective PLS design requires a precise understanding of the underlying wireless channel characteristics. The simplest yet fundamental model is the Gaussian wiretap channel, where a legitimate receiver (Bob) and an eavesdropper (Eve) experience independent additive white Gaussian noise. In this scenario, Alice transmits a signal x, which is received by Bob as y and by Eve as z. This model is represented as

$$\begin{array}{c}y=x+v_b,\hfill \\ z=x+v_e,\hfill \end{array}$$

(1)

where x is the transmitted signal, $v_b$ and $v_e$ denote the Gaussian noise at Bob and Eve’s side, respectively, both with zero mean, and respective variances ${\sigma }_b^2$ and ${\sigma }_e^2$ (see Figure 1).

A more realistic scenario for wireless communications involves fading channels, where the channel gain fluctuates over time and space. We primarily consider quasi-static fading models, where the channel coefficients remain constant over a coherence interval but vary across different intervals. This distinction is critical as fading can be either exploited or mitigated for secrecy purposes. For the quasi-static fading channel, Alice transmits a signal x, which is received by Bob and Eve via channel gains $h_B$ and $h_E$, respectively, further corrupted by AWGN. The fading channel is modeled as

$$\begin{array}{c}y=h_{B}x+v_b,\hfill \\ z=h_{E}x+v_e,\hfill \end{array}$$

(2)

where $h_B$ and $h_E$ are the constant (within a coherence interval) channel gains for Bob and Eve, respectively, and $v_b$, $v_e$ are zero-mean AWGN with variances ${\sigma }_b^2$ and ${\sigma }_e^2$.

In both AWGN and fading contexts, the fundamental assumption for PLS is usually that Bob possesses a superior channel quality compared to Eve. Specifically, we assume that Alice knows Bob’s channel, that is ${\sigma }_b$; however, Eve’s channel, ${\sigma }_e$, can be known or unknown [37] to Alice. The goal is to achieve reliable communication between Alice and Bob, but also confidentiality despite the presence of Eve. As usual in information security, we assume that Bob has a good SNR (signal to noise ratio) but Eve has a poor SNR, in particular with respect to Bob; that is ${\sigma }_e^2\ll {\sigma }_b^2$.

Alice’s encoder maps l bits $s_1,\dots ,s_l$ from $\mathcal{S}=\left\{0,1\right\}$ to a codeword $\mathbf{x}=(x_1,\dots ,x_n)\in {\mathbb{R}}^n$. Over a transmission of n symbols, we get

$$\begin{array}{c}\mathbf{y}=\mathbf{x}+{\mathbf{v}}_b,\hfill \\ \mathbf{z}=\mathbf{x}+{\mathbf{v}}_e.\hfill \end{array}$$

(3)

2.2. Information-Theoretic Secrecy: Capacity, Equivocation, Mutual Information

The ultimate goal of PLS is to achieve information-theoretic secrecy, ensuring that the legitimate recipient can reliably decode the message while the eavesdropper gains negligible information. This is formally quantified through several key metrics. The information theoretic approach to achieving secure communication was initiated by Wyner [3] and Csiszár and Körner [4], introducing the wiretap channel model. Secrecy capacity represents the maximum rate at which information can be transmitted reliably and confidentially. For a wiretap channel, it is defined as the difference between the legitimate channel capacity and the eavesdropper’s channel capacity. Extensive research has since characterized secrecy capacity across various wiretap channel models, including Gaussian point-to-point and relay networks [1,40]. The secrecy capacity of Gaussian wiretap channels was established in [31].

To measure how efficient wiretap coding is in providing confidentiality, the information leaked to the eavesdropper is measured in terms of equivocation (conditional entropy), that is $H\left(S^l\right|Z^n)$, where S and Z denote random variables corresponding, respectively, to Alice’s data and the message received by Eve. The best possible secrecy is achieved when $H\left(S^l\right|Z^n)=H\left(S^l\right)$, or equivalently when $I(S^l;Z^n)=H\left(S^l\right)-H\left(S^l\right|Z^n)=0$. It was shown in [35], Theorem 5, for the Gaussian wiretap channel that

$$I(S^l;Z^n)\le {ϵ}_n(nR-\log {ϵ}_n),$$

(4)

where

$${ϵ}_n={\displaystyle \frac{\mathrm{vol}\left({\Lambda }_e\right){\Theta }_{{\Lambda }_e}(1/2\pi {\sigma }_e^2)}{{\left(\sqrt{2\pi {\sigma }_e^2}\right)}^n}}-1;$$

(5)

in which $\mathrm{vol}$ and $\Theta$ are defined in (8) and (14), respectively. For more details about ${ϵ}_n$ and its properties, the reader may consult [35].

2.3. Entropy-Based Metrics: Secrecy Gain and Flatness Factor

While secrecy capacity and equivocation provide fundamental bounds, specific metrics are needed for the practical design and analysis of lattice codes. For lattice-based systems, two critical entropy-based metrics are used to quantify the confusion at the eavesdropper. A different approach was adopted in [34], where lattice codes were proposed using as design criterion a new lattice invariant called secrecy gain defined as the maximum of its secrecy function; it was shown that it characterizes the confusion at the eavesdropper. In [35], the result concerning semantic security was generalized to continuous channels, and a new lattice design criterion, designated as the flatness factor, was proposed. This study established that a vanishing flatness factor (or equivalently an infinitely large secrecy gain) implies semantic security. This suggests the study of the secrecy gain of lattices as a way to understand how to design good Gaussian lattice wiretap codes.

These metrics are defined formally based on the lattice’s theta series. Before formally defining the theta series, let us establish the fundamental definitions of a lattice and its associated geometric properties.

Definition 1.

A lattice Λ is a discrete additive subgroup of the m-dimensional real space ${\mathbb{R}}^m$. It can be generated by a basis $\mathcal{B}=\{{\mathbf{b}}_1,\dots ,{\mathbf{b}}_n\}\subseteq {\mathbb{R}}^m$, where $n\le m$. Any vector $\mathbf{x}\in \Lambda$ can be represented as an integer linear combination of the basis vectors. The $n\times m$ matrix $\mathbf{M}$ with ${\mathbf{b}}_1,\dots ,{\mathbf{b}}_n$ as rows is a generator matrix for the lattice. The rank of the lattice is n and its dimension is m. If $n=m$, the lattice is a full-rank lattice. A lattice Λ can be formally described as

$$\Lambda =\left\{\mathbf{x}=\mathbf{uM}|\mathbf{u}\in {\mathbb{Z}}^n\right\}.$$

(6)

For any lattice point $\mathbf{p}$ of a lattice $\Lambda \subset {\mathbb{R}}^m$, its Voronoi cell is defined by

$${\mathcal{V}}_{\Lambda }\left(\mathbf{p}\right)=\left\{\mathbf{x}\in {\mathbb{R}}^m,d(\mathbf{x},\mathbf{p})\le d(\mathbf{x},\mathbf{q})\mathrm{for}\mathrm{all}\mathbf{q}\in \Lambda \right\}.$$

(7)

All Voronoi cells are congruent; thus, ${\mathcal{V}}_{\Lambda }\left(\mathbf{p}\right)={\mathcal{V}}_{\Lambda }\left(\mathbf{0}\right)\triangleq \mathcal{V}(\Lambda )$. The Gram matrix of a lattice is given by $\mathbf{G}=\mathbf{M}{\mathbf{M}}^t$.

Definition 2.

The volume of a lattice Λ, denoted $\mathrm{vol}(\Lambda )$, is the volume of its fundamental Voronoi cell. It is mathematically defined as the square root of the determinant of its Gram matrix:

$$\mathrm{vol}(\Lambda )=\mathrm{vol}\left(\mathcal{V}(\Lambda )\right)=\sqrt{\det \left(\mathbf{G}\right)}.$$

(8)

A lattice $\Lambda$ in ${\mathbb{R}}^m$ is an integral lattice if its Gram matrix has coefficients in $\mathbb{Z}$. This means that the inner product $〈\mathbf{x},\mathbf{y}〉\in \mathbb{Z}$ for all $\mathbf{x},\mathbf{y}\in \Lambda$. The set of all vectors in ${\mathbb{R}}^m$ whose inner product with all vectors of $\Lambda$ is in $\mathbb{Z}$ forms the dual lattice of $\Lambda$, denoted by ${\Lambda }^{*}$.

The minimum non-zero squared Euclidean norm of a lattice, denoted $d_{\min }^2(\Lambda )$, and its associated Hermite parameter, ${\gamma }_H(\Lambda )$, are critical for coding performance:

$${\gamma }_H(\Lambda )={\left({\displaystyle \frac{d_{\min }(\Lambda )}{\sqrt[n]{\mathrm{vol}(\Lambda )}}}\right)}^2={\displaystyle \frac{d_{\min }^2(\Lambda )}{\sqrt[n]{\det \left(\mathbf{G}\right)}}}.$$

(9)

The Hermite parameter quantifies the density of the lattice packing. The number of vectors in $\Lambda$ with squared norm equal to $d_{\min }^2(\Lambda )$ is the kissing number $\tau (\Lambda )$. These definitions are fundamental to understanding the subsequent formulation of the theta series, which provides a comprehensive spectral representation of the lattice’s structure.

Building on the preceding definitions, the secrecy function ${\Xi }_{\Lambda }\left(\tau \right)$ of an n-dimensional lattice $\Lambda$ is given by

$${\Xi }_{\Lambda }\left(\tau \right)={\displaystyle \frac{{\Theta }_{\sqrt[n]{\mathrm{vol}(\Lambda )}{\mathbb{Z}}^n}\left(\tau \right)}{{\Theta }_{\Lambda }\left(\tau \right)}},\tau =yi,y>0.$$

(10)

The strong secrecy gain ${\chi }_{\Lambda ,\mathrm{strong}}$ of an n-dimensional lattice $\Lambda$ is defined by

$${\chi }_{\Lambda ,\mathrm{strong}}=\underset{y>0}{\sup }{\Xi }_{\Lambda }\left(yi\right).$$

(11)

Since the above maximum value is not easy to calculate for a general lattice, a weaker definition of secrecy gain has been introduced [37]. A multiplicative symmetry point is a point $y_0$ such that ${\Xi }_{\Lambda }(y_0·y)={\Xi }_{\Lambda }(y_0/y)$ for all $y>0$. The weak secrecy gain ${\chi }_{\Lambda }$ of a lattice $\Lambda$ is then given by

$${\chi }_{\Lambda }={\Xi }_{\Lambda }\left(y_0\right)={\displaystyle \frac{{\Theta }_{\sqrt[n]{\mathrm{vol}(\Lambda )}{\mathbb{Z}}^n}\left(y_{0}i\right)}{{\Theta }_{\Lambda }\left(y_{0}i\right)}}.$$

(12)

For an n-dimensional d-modular lattice, the weak secrecy gain ${\chi }_{\Lambda }$ is given by [37]:

$${\chi }_{\Lambda }={\displaystyle \frac{{\Theta }_{\sqrt[4]{d}{\mathbb{Z}}^n}\left(\tau \right)}{{\Theta }_{\Lambda }\left(\tau \right)}},\tau ={\displaystyle \frac{i}{\sqrt{d}}},$$

(13)

noting that the volume of a d-modular lattice is $\mathrm{vol}(\Lambda )=d^{{\displaystyle \frac{n}{4}}}$. The secrecy gain characterizes the amount of confusion that a wiretap lattice code brings [37]. The weak secrecy gain ${\chi }_{\Lambda }$ is conjectured to be the secrecy gain itself. To the best of our knowledge, this conjecture is still open [53], but for large classes of unimodular lattices, it is known to be true [38,43]. The relationship between d and ${\chi }_{\Lambda }$ for d-modular lattices has been investigated in [30,40,52,53].

The theta series of a lattice $\Lambda$, denoted ${\Theta }_{\Lambda }\left(\tau \right)$, is a fundamental tool for analyzing its properties. For $\mathcal{H}=\{a+ib\in \mathbb{C}|b>0\}$ (the upper half-plane) and $q=e^{\pi i\tau }$, $\tau \in \mathcal{H}$, the theta series is defined by

$${\Theta }_{\Lambda }\left(\tau \right)=\sum _{\mathbf{t}\in \Lambda }{q}^{{\parallel \mathbf{t}\parallel }^2},$$

(14)

where ${\parallel \mathbf{t}\parallel }^2=〈\mathbf{t},\mathbf{t}〉$ is the squared Euclidean norm of a lattice vector, in which $〈,〉:\Lambda \times \Lambda \to \mathbb{R}$ is the bilinear form that $\Lambda$ is defined based on it. If $\Lambda \subset {\mathbb{R}}^n$, we can consider ${\parallel \mathbf{t}\parallel }^2={\sum }_{i=1}^n{t}_i^2$, for $\mathbf{t}=(t_1,\dots ,t_n)\in \Lambda$. If we consider $\Lambda$ to be integral, the theta series of $\Lambda$ can be written as ${\sum }_{m\in \mathbb{Z}}{A}_m{q}^m$, where $A_m=\left|\right\{\mathbf{x}\in {\Lambda :\parallel \mathbf{x}\parallel }^2=m\left\}\right|$. For an integral lattice $\Lambda$, the coefficient of the second term of ${\Theta }_{\Lambda }={\sum }_{m\in \mathbb{Z}}{A}_m{q}^m$, which is $A_{\mu }{q}^{\mu }$ with

$$\mu ={\mu }_{\Lambda }=\min \left\{{\parallel \mathbf{x}\parallel }^2:\mathbf{x}\in \Lambda ,\mathbf{x}\ne \mathbf{0}\right\},$$

(15)

is the kissing number of $\Lambda$, and the power of q in the second term gives the minimum, or minimal norm of $\Lambda$. The theta series helps in determining bounds for the minimum [57] as well as classifying lattices [58]. It has also been used recently to define the notion of secrecy gain. Exceptional lattices have theta series that can be expressed as functions of the Jacobi theta functions ${\vartheta }_i\left(q\right)$, $q=e^{\pi i\tau }$, $\Im \left(\tau \right)>0$, $i=2,3,4$, themselves defined by

$$\begin{array}{ccc}\hfill {\vartheta }_2\left(q\right)& =& \sum _{k=-\infty }^{+\infty }{q}^{{\left(k+{\displaystyle \frac{1}{2}}\right)}^2},\hfill \end{array}$$

(16)

$$\begin{array}{ccc}\hfill {\vartheta }_3\left(q\right)& =& \sum _{k=-\infty }^{+\infty }{q}^{k^2},\hfill \end{array}$$

(17)

$$\begin{array}{ccc}\hfill {\vartheta }_4\left(q\right)& =& \sum _{k=-\infty }^{+\infty }{(-1)}^k{q}^{k^2}.\hfill \end{array}$$

(18)

A few examples of theta series of exceptional lattices are given in

Table 1. Theta series of some exceptional lattices.

Lattice $\mathsf{\Lambda }$	Theta Series ${\mathsf{\Theta }}_{\mathsf{\Lambda }}$
Cubic lattice ${\mathbb{Z}}^n$	${\vartheta }_3^n$
Checkerboard lattice $D_n$	${\displaystyle \frac{1}{2}}({\vartheta }_3^n+{\vartheta }_4^n)$
Gosset lattice $E_8$	${\displaystyle \frac{1}{2}}({\vartheta }_2^8+{\vartheta }_3^8+{\vartheta }_4^8)$
Leech lattice ${\Lambda }_{24}$	${\displaystyle \frac{1}{8}}{({\vartheta }_2^8+{\vartheta }_3^8+{\vartheta }_4^8)}^3-{\displaystyle \frac{45}{16}}{({\vartheta }_2·{\vartheta }_3·{\vartheta }_4)}^8$

[37,46].

2.4. Lattice Coset Coding: Reliability and Secrecy Analysis

Lattice coset coding is a powerful technique for simultaneously achieving high reliability for the legitimate receiver and strong secrecy for the eavesdropper. This method, originally proposed in [3,59], involves mapping an information vector $s_d\in {\{0,1\}}^k$ to a coset of a nested lattice structure, rather than a single lattice point. Alice, the transmitter, chooses a point $\mathbf{x}$ from the selected coset ${\Lambda }_e+{\mathbf{c}}_j\left(s_d\right)$ by adding a random vector $\mathbf{r}\in {\Lambda }_e$ to the coset representative ${\mathbf{c}}_j\left(s_d\right)$. The transmitted signal is thus $\mathbf{x}=\mathbf{r}+{\mathbf{c}}_j\left(s_d\right)\in {\Lambda }_e+{\mathbf{c}}_j\left(s_d\right)$.

The underlying principle involves partitioning a dense lattice ${\Lambda }_b$ (intended for Bob) into a union of disjoint cosets of a coarser sublattice ${\Lambda }_e$, such that ${\Lambda }_b={\bigcup }_{j=1}^{2^k}({\Lambda }_e+{\mathbf{c}}_j)$. The number of such cosets, $2^k$, is determined by the ratio of volumes:

$$\left|{\displaystyle \frac{{\Lambda }_b}{{\Lambda }_e}}\right|=2^k={\displaystyle \frac{\mathrm{vol}\left(\mathcal{V}\left({\Lambda }_e\right)\right)}{\mathrm{vol}\left(\mathcal{V}\left({\Lambda }_b\right)\right)}}.$$

(19)

Once the mapping $s_d\mapsto {\Lambda }_e+{\mathbf{c}}_{j\left(s_d\right)}$ is done, Alice randomly chooses a point $\mathbf{x}\in {\Lambda }_e+{\mathbf{c}}_{j\left(s_d\right)}$ and sends it over the wiretap channel. The coset encoding means that a random vector $\mathbf{r}\in {\Lambda }_e$ is chosen and the transmitted lattice point $\mathbf{x}\in {\Lambda }_b$ is finally of the form

$$\mathbf{x}=\mathbf{r}+{\mathbf{c}}_{j\left({\mathbf{s}}_d\right)}\in {\Lambda }_e+{\mathbf{c}}_{j\left({\mathbf{s}}_d\right)}.$$

(20)

The subscript of the sublattice ${\Lambda }_e$ is chosen since it encodes the random bits that are there to increase Eve’s confusion, and so is the lattice intended for Eve [37]. The total rate R is then

$$R=R_s+R_e,$$

(21)

where $R_s={\displaystyle \frac{2k}{n}}$ is the information bits rate intended to Bob, and $R_e={\displaystyle \frac{2r}{n}}$, with r the number of random bits, is the random bit rate, all per (complex) channel use [37].

Example 1.

Based on [34], Example 1, take ${\Lambda }_b={\mathbb{Z}}^2$ and ${\Lambda }_e=2{\mathbb{Z}}^2$, for which we have

$${\mathbb{Z}}^2=2{\mathbb{Z}}^2\cup (2{\mathbb{Z}}^2+(0,1))\cup (2{\mathbb{Z}}^2+(1,0))\cup (2{\mathbb{Z}}^2+(1,1)).$$

The lattice ${\mathbb{Z}}^2$ is thus partitioned into $2^k=4$ cosets, allowing to transmit $k=2$ bits of information. Alice can label any of the above 4 cosets by their representatives. To transmit the two bits 01, she then randomly picks a point in the coset $2{\mathbb{Z}}^2+(0,1)$, say $\mathbf{x}=(2,3)=2(1,1)+(0,1)$ and sends this point over the wiretap channel.

Using lattice coset encoding, two lattices play a role:

• the lattice ${\Lambda }_b$, that Alice uses to communicate reliably with Bob, and 
• the lattice ${\Lambda }_e$, which is a sublattice of ${\Lambda }_b$, that appears in the process of coset coding for encoding random bits.

In the rest of this section, we present the properties of these two lattices which are related to the design of good wiretap codes. Suppose that the lattice point ${\mathbf{x}}_k={\mathbf{r}}_k+{\mathbf{c}}_k\in {\Lambda }_b$ has been transmitted over the unconstrained AWGN channel and ${\mathbf{y}}_k={\mathbf{x}}_k+\mathbf{v}$ has been received, where $\mathbf{v}=(v_1,\dots ,v_n)$ is the error term with components independently and identically distributed (i.i.d.) with $\mathcal{N}(0,{\sigma }^2)$. The probability $P_c$ of finding the correct coset is [34]

$$P_c={\displaystyle \frac{1}{{\left(\sigma \sqrt{2\pi }\right)}^n}}\sum _{\mathbf{r}\in {\Lambda }_e}{\int }_{\mathcal{V}\left({\Lambda }_b\right)+\mathbf{r}}{e}^{-{\parallel \mathbf{u}\parallel }^2/2{\sigma }^2}d\mathbf{u}.$$

(22)

Considering the wiretap channel where Alice transmits lattice codewords from an n-dimensional lattice ${\Lambda }_b$, we get that the probabilities $P_{c,b}$ and $P_{c,e}$, which are the correct decision probabilities for Bob and Eve, respectively, can be obtained from (22) by replacing $\sigma ={\sigma }_b$ and ${\sigma }_e$, respectively. Since by assumption Bob has a good SNR, its received vector $\mathbf{y}$ is most likely to lie in the Voronoi region around the origin, and thus the terms corresponding to $\mathbf{r}\ne \mathbf{0}$ in (22) are negligible, which yields [34]

$$P_{c,b}\approx {\displaystyle \frac{1}{{\left({\sigma }_b\sqrt{2\pi }\right)}^n}}{\int }_{\mathcal{V}\left({\Lambda }_b\right)}{e}^{-{\parallel \mathbf{u}\parallel }^2/2{\sigma }_b^2}d\mathbf{u}.$$

(23)

This is now the familiar case of transmitting lattice points over the Gaussian channel, for which it is known that ${\Lambda }_b$ should have a good Hermite parameter to get a good coding gain [46]. We know how to design good codes for Bob’s channel, and have his probability of making a correct decision arbitrarily close to 1 (see, e.g., [7,8,14,60,61]).

On the contrary under a low SNR assumption for Eve, namely ${\sigma }_e$ is large, by using a Taylor expansion, the probability of making a correct decision for Eve is given by [34]

$$P_{c,e}\approx {\displaystyle \frac{1}{{\left({\sigma }_e\sqrt{2\pi }\right)}^n}}\mathrm{vol}\left(\mathcal{V}\left({\Lambda }_b\right)\right)\sum _{\mathbf{r}\in {\Lambda }_e}{e}^{-{\parallel \mathbf{u}\parallel }^2/2{\sigma }_e^2}.$$

(24)

In order to minimize the probability $P_{c,e}$ of Eve making a correct decision, while keeping $P_{c,b}$ unchanged, we should find a lattice ${\Lambda }_b$ which is as good as possible for the Gaussian channel, its sublattice ${\Lambda }_e$ minimizes ${\sum }_{\mathbf{r}\in {\Lambda }_e}{e}^{-{\parallel \mathbf{u}\parallel }^2/2{\sigma }_e^2}$ and ${\log }_2|{\Lambda }_b/{\Lambda }_e|=k$; see [34]. The constraint on the cardinality of cosets (or rate) is equivalent to set the fundamental volume of ${\Lambda }_e$ equal to a constant. Two lattice design criteria have been proposed to characterize the confusion created by ${\Lambda }_e$: the secrecy gain [37], and the flatness factor [35,62]. The secrecy gain originally captures the loss in Eve’s probability of correctly decoding when ${\Lambda }_e$ is used instead of ${\mathbb{Z}}^n$ [37]. Both the flatness factor and the secrecy gain involve the theta series of ${\Lambda }_e$ at a particular point, which turns out to give an upper bound on Eve’s knowledge of the secret message (when it is expressed in terms of mutual information) [35]. This concludes our survey of wireless wiretap channels and secrecy metrics, setting the stage for the algebraic construction methods that follow.

3. Mathematical Background on Algebraic Number Theory

To systematically engineer lattice codes with tailored properties for wireless communication security, we leverage the powerful tools of algebraic number theory. This section lays out the fundamental definitions and theorems necessary to understand the construction of lattices from number fields. These algebraic structures provide the blueprint for generating lattices with specific characteristics, such as integrality, modularity, and prescribed embedding properties, which are critical for optimizing secrecy metrics.

3.1. Number Fields, Dedekind Domains, and Discriminants

We begin with the fundamental definitions concerning number fields, which are finite extensions of the field of rational numbers $\mathbb{Q}$. These fields provide the algebraic setting for constructing advanced lattice codes.

Let K and L be two fields. If $K\subset L$, L is a field extension of K denoted by $L/K$. The dimension of L as a vector space over K is the degree of L over K, denoted by $[L:K]$. Any finite extension of $\mathbb{Q}$ is a number field.

An element $\alpha \in L$ is algebraic over K if it is a root of a non-zero irreducible monic polynomial $p\in K\left[x\right]$. The polynomial of least degree with this property is known as the minimal polynomial of $\alpha$ over K. If all elements of L are algebraic over K, then L is an algebraic extension of K.

Definition 3

(Algebraic Integer). Let K be an algebraic number field of degree n. If $\alpha \in K$ is a root of a monic polynomial with coefficients in $\mathbb{Z}$, then α is an algebraic integer. The set of algebraic integers of K is the ring of integers of K, denoted by ${\mathcal{O}}_K$. The ring ${\mathcal{O}}_K$ is also called the maximal order of K.

If K is a number field, then $K=\mathbb{Q}\left(\theta \right)$ for an algebraic integer $\theta \in {\mathcal{O}}_K$ [63], p. 49. For a number field K of degree n, the ring of integers ${\mathcal{O}}_K$ forms a free $\mathbb{Z}$-module of rank n.

Definition 4

(Integral Basis). Let $\left\{{\omega }_1,\dots ,{\omega }_n\right\}$ be a basis of the $\mathbb{Z}$-module ${\mathcal{O}}_K$, so that we can uniquely write any element of ${\mathcal{O}}_K$ as ${\sum }_{i=1}^n{a}_i{\omega }_i$ with $a_i\in \mathbb{Z}$ for all i. Then, $\left\{{\omega }_1,\dots ,{\omega }_n\right\}$ is an integral basis for K.

Theorem 1

([63], p. 41). Let $K=\mathbb{Q}\left(\theta \right)$ be a number field of degree n over $\mathbb{Q}$. There are exactly n embeddings ${\sigma }_1,\dots ,{\sigma }_n$ of K into $\mathbb{C}$ defined by ${\sigma }_i\left(\theta \right)={\theta }_i$, for $i=1,\dots ,n$, where ${\theta }_i$’s are the distinct zeros in $\mathbb{C}$ of the minimum polynomial of θ over $\mathbb{Q}$.

For any $x\in K$, the images ${\sigma }_1\left(x\right),\dots ,{\sigma }_n\left(x\right)$ are the conjugates of x. These conjugates are fundamental for defining two important field-theoretic operations: the norm and the trace.

Definition 5

(Norm and Trace). Let K be a number field of degree n and $x\in K$. The norm of x over $\mathbb{Q}$ is defined as $N_{K/\mathbb{Q}}\left(x\right)={\prod }_{i=1}^n{\sigma }_i\left(x\right)$, and the trace of x over $\mathbb{Q}$ is defined as ${\mathrm{Tr}}_{K/\mathbb{Q}}\left(x\right)={\sum }_{i=1}^n{\sigma }_i\left(x\right)$. For any $x\in K$, $N_{K/\mathbb{Q}}\left(x\right)$ and ${\mathrm{Tr}}_{K/\mathbb{Q}}\left(x\right)$ belong to $\mathbb{Q}$. If $x\in {\mathcal{O}}_K$, these values are integers, i.e., $N_{K/\mathbb{Q}}\left(x\right)\in \mathbb{Z}$ and ${\mathrm{Tr}}_{K/\mathbb{Q}}\left(x\right)\in \mathbb{Z}$.

Definition 6

(Discriminant). Let $\left\{{\omega }_1,\dots ,{\omega }_n\right\}$ be an integral basis for a number field K. The discriminant of K, denoted $d_K$, is defined as $d_K={\left(\det \left[{\left({\sigma }_j\left({\omega }_i\right)\right)}_{i,j=1}^n\right]\right)}^2$. The discriminant $d_K$ of a number field belongs to $\mathbb{Z}$ and is independent of the choice of basis.

Definition 7

(Integrally Closed Ring). A ring A is integrally closed in a field L if every element of L which is integral over A lies in A. An integral domain is integrally closed if it is integrally closed in its quotient field.

Theorem 2

([64], p. 18). Let D be a ring which is Noetherian, integrally closed, and such that every non-zero prime ideal is maximal. Then, every ideal of D can be uniquely factored into prime ideals.

A ring satisfying the properties of Theorem 2 is a Dedekind ring. Crucially, the ring of algebraic integers ${\mathcal{O}}_K$ in any number field K is a Dedekind ring.

3.2. Cyclotomic Fields: Monogenicity and Galois Structure

Monogenic number fields simplify arithmetic within their rings of integers, making them particularly attractive for lattice constructions. Among these, cyclotomic fields hold a prominent place due to their well-understood structure and Abelian Galois groups.

Definition 8

(Monogenic Number Field). Let K be a number field of degree n and ${\mathcal{O}}_K$ its ring of integers. Then, considering ${\mathcal{O}}_K$ as a $\mathbb{Z}$-module, if it has a basis of the form $\left\{1,\alpha ,\dots ,{\alpha }^{n-1}\right\}$, for some $\alpha \in {\mathcal{O}}_K$, α is a power generator, this basis is a power basis and K is monogenic.

The problem of identifying monogenic number fields is classical. Quadratic and cyclotomic number fields are known to be monogenic, though this is not a general property for all number fields. For instance, Dedekind [65], p. 64, provided an example of a non-monogenic cubic field. Monogenicity significantly simplifies arithmetic tasks like factoring prime ideals.

Cyclotomic number fields are among the most important monogenic number fields. For any field K, an extension of the form $K\left(\zeta \right)$, where $\zeta$ is a root of unity, is a cyclotomic extension of K. A key algebraic property is that cyclotomic extensions always possess an Abelian Galois group. This makes them essentially the only direct construction method for Abelian extensions over arbitrary base fields [66].

Let ${\mu }_n$ denote the group of n different nth roots of unity. A primitive nth root of unity, denoted ${\zeta }_n$, is an nth root of unity that has order n.

Lemma 1

([66], Lemma 2.1). For $\sigma \in \mathrm{Gal}(K\left({\zeta }_n\right)/K)$ there is an integer $a_{\sigma }$ that is relatively prime to n such that $\sigma \left(\omega \right)={\omega }^{a_{\sigma }}$ for all $\omega \in {\mu }_n$.

Based on Lemma 1, for any field K, the mapping $\tau :\mathrm{Gal}(K\left({\zeta }_n\right)/K)\to {(\mathbb{Z}/n\mathbb{Z})}^{\times }$, $\sigma \mapsto a_{\sigma }$, is an injective group homomorphism. When $K=\mathbb{Q}$, this embedding is an isomorphism. For $n>2$, $K=\mathbb{Q}\left({\zeta }_n\right)$ is a totally imaginary field. It is proved in [67], Theorem 2.6, that $\mathbb{Z}\left[{\zeta }_n\right]$ is the ring of algebraic integers of $\mathbb{Q}\left({\zeta }_n\right)$, confirming its monogenicity.

The discriminant of cyclotomic fields can be computed via the following theorem:

Theorem 3

([67], Proposition 2.7). Let $K=\mathbb{Q}\left({\zeta }_n\right)$, then the discriminant $d_K$ is given by

$$d_K={(-1)}^{\varphi \left(n\right)/2}{\displaystyle \frac{n^{\varphi \left(n\right)}}{{\prod }_{p|n}{p}^{\varphi \left(n\right)/(p-1)}}}.$$

(25)

For the specific case where $n=p^k$ (for p a prime number), the discriminant of $K=\mathbb{Q}\left({\zeta }_{p^k}\right)$ is

$$d_K=\pm p^{p^{k-1}(pk-k-1)},$$

(26)

where the sign depends on $p^k\left(\mathrm{mod}4\right)$ [67], Proposition 2.1. For $n=2^r$ with $r>2$, $d_{\mathbb{Q}\left({\zeta }_{2^r}\right)}=2^{2^{r-1}(r-1)}$ and for $r=2$, $d_K=-4$ [68].

Differences exist between the prime-power case and the general n case. For n with at least two distinct prime factors, $1-{\zeta }_n$ is a unit of $\mathbb{Z}\left[{\zeta }_n\right]$ [67], Proposition 2.8. If n is prime, however, $1-{\zeta }_n$ is not a unit, and $\mathfrak{P}=(1-{\zeta }_n)$ forms a prime ideal of ${\mathcal{O}}_K=\mathbb{Z}\left[{\zeta }_n\right]$, with $n{\mathcal{O}}_K={\mathfrak{P}}^{n-1}$ signifying total ramification in $\mathbb{Q}\left({\zeta }_n\right)$ [67], Lemma 1.4.

The nth cyclotomic polynomial, ${\Phi }_n\left(X\right)$, is irreducible over $\mathbb{Z}$ and defined as

$${\Phi }_n\left(X\right)=\prod _{(j,n)=1}\left(X-{\zeta }_n^j\right).$$

(27)

It factors $X^n-1={\prod }_{d|n}{\Phi }_d\left(X\right)$. The factorization of ${\Phi }_n\left(X\right)$ modulo p (for p not dividing n) yields distinct monic irreducible factors, each with degree equal to the order of $p\left(\mathrm{mod}n\right)$ [66], Theorem 5.4.

Proposition 1

([66], Corollary 5.7). The reduction ${\overline{\Phi }}_n$ is irreducible in ${\mathbb{F}}_p\left[X\right]$ if and only if $(p,n)=1$ and $p\left(\mathrm{mod}n\right)$ is a generator of ${(\mathbb{Z}/\left(n\right))}^{\times }$.

3.3. Ideals, Embeddings, and Minkowski Space

The theory of ideals within number fields is fundamental for constructing lattices, particularly through Construction A, as it governs the structure of the resulting lattice and its properties.

Definition 9

(Signature). Let $\left\{{\sigma }_1,\dots ,{\sigma }_n\right\}$ be the n embeddings of K into $\mathbb{C}$. Let $r_1$ be the number of embeddings whose images lie in $\mathbb{R}$ (real embeddings), and $2r_2$ be the number of embeddings whose images lie in $\mathbb{C}\setminus \mathbb{R}$ (complex embeddings). These values satisfy $r_1+2r_2=n$. The pair $(r_1,r_2)$ is called the signature of K.

• If $r_2=0$, K is a totally real algebraic number field.
• If $r_1=0$, K is a totally complex algebraic number field.

The canonical embedding, also known as the Minkowski embedding, is a crucial mapping that translates the algebraic structure of a number field into a concrete geometric representation, laying the foundation for lattice constructions.

We order the embeddings ${\sigma }_j$ such that ${\sigma }_j\left(x\right)\in \mathbb{R}$ for $1\le j\le r_1$, and ${\sigma }_{j+r_2}\left(x\right)=\overline{{\sigma }_j\left(x\right)}$ for $r_1+1\le j\le r_1+r_2$.

Definition 10

(Canonical Embedding). The canonical embedding $\sigma :K\to {\mathbb{R}}^{r_1}\times {\mathbb{C}}^{r_2}$ is the homomorphism defined by

$$\sigma \left(x\right)=({\sigma }_1\left(x\right),\dots ,{\sigma }_{r_1}\left(x\right),{\sigma }_{r_1+1}\left(x\right),\dots ,{\sigma }_{r_1+r_2}\left(x\right)).$$

(28)

By identifying ${\mathbb{R}}^{r_1}\times {\mathbb{C}}^{r_2}$ with ${\mathbb{R}}^n$, the canonical embedding can be rewritten as $\sigma :K\to {\mathbb{R}}^n$

$$\begin{array}{ccc}\hfill \sigma \left(x\right)& =& ({\sigma }_1\left(x\right),\dots ,{\sigma }_{r_1}\left(x\right),\Re {\sigma }_{r_1+1}\left(x\right),\Im {\sigma }_{r_1+1}\left(x\right),\hfill \\ & & \dots ,\Re {\sigma }_{r_1+r_2}\left(x\right),\Im {\sigma }_{r_1+r_2}\left(x\right)),\hfill \end{array}$$

(29)

where $\Re {\sigma }_j$ denotes the real part of ${\sigma }_j$ and $\Im {\sigma }_j$ the imaginary part of ${\sigma }_j$, for $j=r_1+1,\dots ,r_1+r_2$.

This embedding transforms algebraic integers into lattice points in Euclidean space, allowing us to leverage their geometric properties for coding.

In applications of number fields to lattice construction, understanding the factorization of prime ideals is essential. This process involves selecting an integer $\alpha \in {\mathcal{O}}_L$ such that $L=K\left(\alpha \right)$, and examining the factorization of its minimal polynomial modulo $\mathfrak{p}$.

Let A be a Dedekind ring, K its quotient field, L a finite separable extension of K, and B the integral closure of A in L. If $\mathfrak{p}$ is a prime ideal of A, then the ideal $\mathfrak{p}B$ in B can be factored uniquely into prime ideals:

$$\mathfrak{p}B={\mathfrak{P}}_1^{e_1}\dots {\mathfrak{P}}_g^{e_g},$$

where ${\mathfrak{P}}_i$ are distinct prime ideals of B lying above $\mathfrak{p}$.

• $e_i\ge 1$ is the ramification index of ${\mathfrak{P}}_i$ over $\mathfrak{p}$, denoted $e({\mathfrak{P}}_i/\mathfrak{p})$.
• $f_i=[B/{\mathfrak{P}}_i:A/\mathfrak{p}]$ is the residue class degree (or inertia degree) of ${\mathfrak{P}}_i$ over $\mathfrak{p}$.

Theorem 4

([64], p. 24). Let A be a Dedekind ring, K its quotient field, L a finite separable extension of K, and B the integral closure of A in L. Let $\mathfrak{p}$ be a prime of A. Then, the fundamental identity holds as follows:

$$[L:K]=\sum _{\mathfrak{P}|\mathfrak{p}}e(\mathfrak{P}/\mathfrak{p})f(\mathfrak{P}/\mathfrak{p}).$$

(30)

For a Galois extension $L/K$ of degree n, this simplifies to $n=efg$, where g is the number of primes $\mathfrak{P}$ of B above $\mathfrak{p}$, and $e=e(\mathfrak{P}/\mathfrak{p})$ and $f=f(\mathfrak{P}/\mathfrak{p})$ are constant for all $\mathfrak{P}$.

• $\mathfrak{p}$ is unramified in L if all $e_i=1$.
• $\mathfrak{p}$ is ramified if any $e_i>1$.
• $\mathfrak{P}$ is totally ramified over $\mathfrak{p}$ if $e(\mathfrak{P}/\mathfrak{p})=[L:K]$ (implying $g=1,f=1$).
• $\mathfrak{p}$ splits completely in L if $e_i=1,f_i=1$ for all i, so $g=[L:K]$.

These concepts are crucial for understanding the properties of lattices constructed from ideals, particularly in Construction A where the choice of prime ideal $\mathfrak{p}$ significantly influences the modularity and other characteristics of the resulting lattice.

Proposition 2

([64], p. 27). Let A be a Dedekind ring with quotient field K and let E be a finite separable extension of K. Let B be the integral closure of A in E and assume that $B=A\left[\alpha \right]$ for some element α. Let f be the irreducible polynomial of α over K, $\mathfrak{p}$ be a prime of A and $\overline{f}$ be the reduction in f $\mathrm{mod}\mathfrak{p}$. Consider

$$\overline{f}\left(X\right)=\overline{P_1}{\left(X\right)}^{e_1}\dots \overline{P_r}{\left(X\right)}^{e_r},$$

(31)

to be the factorization of $\overline{f}$ into powers of irreducible factors over $\overline{A}=A/\mathfrak{p}$, with leading coefficients 1. Then

$$\mathfrak{p}B={\mathfrak{P}}_1^{e_1}\dots {\mathfrak{P}}_r^{e_r},$$

(32)

is the factorization of $\mathfrak{p}$ in B, so that $e_i$ is the ramification index of ${\mathfrak{P}}_i$ over $\mathfrak{p}$. We also have

$${\mathfrak{P}}_i=\mathfrak{p}B+P_i\left(\alpha \right)B,$$

(33)

where $P_i\in A\left[X\right]$ is a polynomial with leading coefficient 1 whose reduction $\mathrm{mod}\mathfrak{p}$ is $\overline{P_i}$. For each i, ${\mathfrak{P}}_i$ has residue class degree $[B/{\mathfrak{P}}_i:A/\mathfrak{p}]=d_i$, where $d_i=deg\left(\overline{P_i}\right)$.

In our cases, $A=\mathbb{Z}$, $K=\mathbb{Q}$, $E=\mathbb{Q}\left(\alpha \right)$, $B={\mathcal{O}}_E=\mathbb{Z}\left[\alpha \right]$ and $\mathfrak{p}=p\mathbb{Z}$, for a prime number p. Proposition 2 shows the importance of monogenic number fields. Indeed, the task of factoring $p{\mathcal{O}}_K$, for a prime number p, into prime ideals over ${\mathcal{O}}_K$ which is a difficult task in general, reduces to factoring the minimal polynomial of $\alpha$ over ${\mathbb{F}}_q$, which is significantly easier. Thus, we present other useful results about monogenic number fields.

Theorem 5

([67], Proposition 2.16). $\mathbb{Z}[{\zeta }_n+{\zeta }_n^{-1}]$ is the ring of integers of $\mathbb{Q}{\left({\zeta }_n\right)}^{+}$.

If $n=p^r$, the degree of $K=\mathbb{Q}\left({\zeta }_{p^r}\right)$ over $\mathbb{Q}$ is $p^{r-1}(p-1)$ and the prime p totally ramifies in K as $p{\mathcal{O}}_K={\mathfrak{P}}^{p^{r-1}(p-1)}$, where $\mathfrak{P}$ is a prime principal ideal with generator $1-{\zeta }_{p^r}$ and residue field ${\mathcal{O}}_K/\mathfrak{P}\cong {\mathbb{F}}_p$. The degree of $K^{+}=\mathbb{Q}({\zeta }_{p^r}+{\zeta }_{p^r}^{-1})$ over $\mathbb{Q}$ is ${\displaystyle \frac{p^{r-1}(p-1)}{2}}$ and it can be proved that the prime p also totally ramifies in $K^{+}$ as $p{\mathcal{O}}_{K^{+}}={\mathfrak{p}}^{{\displaystyle \frac{p^{r-1}(p-1)}{2}}}$, with $\mathfrak{p}=\mathfrak{P}\cap {\mathcal{O}}_{K^{+}}=(2-{\zeta }_{p^r}-{\zeta }_{p^r}^{-1}){\mathcal{O}}_{K^{+}}$ [49]. By using the Hasse Theorem that states the conductor-discriminant relation, a formula has been obtained to compute the discriminant of any subfield of $\mathbb{Q}\left({\zeta }_{p^r}\right)$ where p is an odd prime and r is a positive integer [69]. Let p be an odd prime number, r a positive integer, and $L=\mathbb{Q}\left({\zeta }_{p^r}\right)$. Since L is a Galois extension of $\mathbb{Q}$ and its Galois group is a cyclic group isomorphic to ${(\mathbb{Z}/p^r\mathbb{Z})}^{\times }$, there is a one-to-one correspondence between the subfields of L and the divisors of $[L:\mathbb{Q}]=(p-1)p^{r-1}$. The discriminant of any subfield K of L can be obtained as a function of p and its degree only. Since the degree of K is a divisor of $(p-1)p^{r-1}$, we write $[K:\mathbb{Q}]=u{p}^j$, where u is a divisor of $p-1$ and $j\le r-1$.

Theorem 6

([69], Theorem 4.1). Let K be a subfield of $\mathbb{Q}\left({\zeta }_{p^r}\right)$ with $[K:\mathbb{Q}]=u{p}^j$, where $p\nmid u$. Then, $d_K=p^{u\left[(j+2)p^j-{\displaystyle \frac{p^{j+1}-1}{p-1}}\right]-1}$.

Another formula for computing the discriminant of any number field $K\subset \mathbb{Q}\left({\zeta }_{2^r}\right)$, with $r\ge 3$, is derived in [68]. In this case the Galois group is ${(\mathbb{Z}/2^r\mathbb{Z})}^{\times }=〈\overline{-1},\overline{5}〉=\left\{{\left(\overline{-1}\right)}^a{\overline{5}}^b|a=1,2\mathrm{and}b=1,2,\dots ,2^{r-2}\right\}$, which is not cyclic.

Theorem 7

([68], Theorem 3.2). Let K be a subfield of $\mathbb{Q}\left({\zeta }_{2^r}\right)$ of degree $2^{(m-1)}$. Then, if $K=\mathbb{Q}\left({\zeta }_{2^m}\right)$, $d_K=2^{2^{m-1}(m-1)}$ and if $K\ne \mathbb{Q}\left({\zeta }_{2^m}\right)$, $d_K=2^{m{2}^{m-1}-1}$.

4. Lattices from Number Fields and Construction A

This section details the construction of lattices using algebraic number theory, particularly focusing on the widely used Construction A. This methodology translates algebraic structures into concrete lattice geometries, enabling the design of codes with desired properties for physical-layer security.

4.1. Lattices and Modularity

A fundamental understanding of lattices and their modular properties is essential for their application in coding theory and physical-layer security. The definitions of a lattice, its volume, Voronoi cell, Gram matrix, integral lattice, dual lattice, Hermite parameter, and kissing number have been comprehensively established in Section 2.3, which discusses entropy-based secrecy metrics. Readers are directed there for the detailed mathematical definitions essential for understanding lattice properties. Here, we build upon those foundational concepts to introduce the specialized notions of unimodular and modular lattices, which are particularly relevant for algebraic constructions in physical-layer security. First, we present the definition of some lattices that arise from algebraic number theory.

Definition 11.

An integral lattice Γ is a free $\mathbb{Z}$-module of finite rank together with a positive definite symmetric bilinear form $〈,〉:\Gamma \times \Gamma \to \mathbb{Z}$.

Definition 12.

The discriminant of a lattice Γ, denoted $disc(\Gamma )$, is the determinant of $M{M}^t$ where M is a generator matrix for Γ. The volume $\mathrm{vol}({\mathbb{R}}^n/\Gamma )$ of a lattice Γ is defined to be $\left|\det \right(M\left)\right|$.

Thus, the discriminant is related to the volume of a lattice by

$$\mathrm{vol}({\mathbb{R}}^n/\Gamma )=\sqrt{\mathrm{disc}(\Gamma )}.$$

(34)

Moreover, when $\Gamma$ is integral, we have $\mathrm{disc}(\Gamma )=|{\Gamma }^{*}/\Gamma |$, where ${\Gamma }^{*}$ is the dual of the lattice defined by

$${\Gamma }^{*}=\left\{y\in {\mathbb{R}}^m|y·x\in \mathbb{Z}\forall x\in \Gamma \right\}.$$

(35)

Definition 13

(Unimodular and Modular Lattices). When $\Gamma ={\Gamma }^{*}$, the lattice Γ is unimodular. If $(L,b)$ is integral and $(L,b)\cong (L^{*},db)$ for some positive integer d, it is d-modular (or modular of level d). An integral lattice $(\Lambda ,b)$ is called even if $b(\mathbf{x},\mathbf{x})\in 2\mathbb{Z}$ for all $\mathbf{x}\in \Lambda$ and odd otherwise.

The canonical embedding (29) gives a geometrical representation of a number field and makes the connection between algebraic number fields and lattices.

Theorem 8

([63], p. 155). Let $\left\{{\omega }_1,{\omega }_2,\dots ,{\omega }_n\right\}$ be an integral basis for a number field K. The n vectors ${\mathbf{v}}_i=\sigma \left({\omega }_i\right)\in {\mathbb{R}}^n$, $i=1,\dots ,n$ are linearly independent, so they define a full rank lattice $\Lambda =\Lambda \left({\mathcal{O}}_K\right)=\sigma \left({\mathcal{O}}_K\right)$.

Theorem 9

([70]). Let $d_K$ be the discriminant of a number field K. The volume of the fundamental parallelotope of $\Lambda \left({\mathcal{O}}_K\right)$ is given by

$$\mathrm{vol}(\Lambda \left({\mathcal{O}}_K\right))=2^{-r_2}\sqrt{|d_K|}.$$

(36)

4.2. Construction A over ${\mathcal{O}}_K$

Construction A provides a powerful method to build lattices from linear codes, and its generalization to number fields allows for the creation of lattices with rich algebraic properties suitable for wireless communication.

The generalized Construction A method leverages a number field K and a finite field ${\mathbb{F}}_{p^f}$. Let K be a Galois number field of degree n which is either totally real or a CM field. Let ${\mathcal{O}}_K$ be the ring of integers of K and $\mathfrak{p}$ be a prime ideal of ${\mathcal{O}}_K$ above the prime p. We have ${\mathcal{O}}_K/\mathfrak{p}\cong {\mathbb{F}}_{p^f}$, where f is the inertia degree of p. The reduction map $\rho$ from ${\mathcal{O}}_K^N$ to ${\mathbb{F}}_{p^f}^N$ is defined componentwise as

$$\begin{array}{ccc}\hfill \rho :{\mathcal{O}}_K^N& \to & {\mathbb{F}}_{p^f}^N,\hfill \\ \hfill (x_1,\dots ,x_N)& \mapsto & \left(x_1\mathrm{mod}\mathfrak{p},\dots ,x_N\mathrm{mod}\mathfrak{p}\right),\hfill \end{array}$$

(37)

for some positive integer N. Let $\mathcal{C}\subset {\mathbb{F}}_{p^f}^N$ be a linear code over ${\mathbb{F}}_{p^f}$. Since $\rho$ is a $\mathbb{Z}$-module homomorphism, ${\rho }^{-1}\left(\mathcal{C}\right)$ is a submodule of ${\mathcal{O}}_K^N$. Given that ${\mathcal{O}}_K$ is a free $\mathbb{Z}$-module of rank n, ${\rho }^{-1}\left(\mathcal{C}\right)$ is a free $\mathbb{Z}$-module of rank $nN$. The lattice is then constructed using a symmetric bilinear form $b_{\alpha }:{\mathcal{O}}_K^N\times {\mathcal{O}}_K^N\to \mathbb{R}$ defined by

$$b_{\alpha }(\mathbf{x},\mathbf{y})=\sum _{i=1}^N{\mathrm{Tr}}_{K/\mathbb{Q}}\left(\alpha x_i{\overline{y}}_i\right),$$

(38)

where $\alpha \in K\cap \mathbb{R}$ and ${\overline{y}}_i$ denotes the complex conjugate of $y_i$ if K is a CM field, and ${\overline{y}}_i=y_i$ if K is totally real. For $b_{\alpha }$ to be positive definite, $\alpha$ must be chosen to be totally positive, i.e., ${\sigma }_i\left(\alpha \right)>0$ for all real embeddings ${\sigma }_i:K\to \mathbb{R}$ [53]. If $\alpha$ is chosen from the codifferent of K (i.e., $\alpha \in {\mathcal{D}}_K^{-1}$), then $\mathrm{Tr}\left(\alpha x_i{\overline{y}}_i\right)\in \mathbb{Z}$ [53]. The pair $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ thus forms a lattice of rank $nN$. The canonical embedding ${\sigma }^N$, defined componentwise as ${\sigma }^N:K^N\to {\mathbb{R}}^{nN},(x_1,\dots ,x_N)\mapsto (\sigma \left(x_1\right),\dots ,\sigma \left(x_N\right))$, maps ${\rho }^{-1}\left(\mathcal{C}\right)$ to a real lattice ${\sigma }^N\left({\rho }^{-1}\left(\mathcal{C}\right)\right)\subset {\mathbb{R}}^{nN}$ of dimension $nN$.

This method of constructing lattices from linear codes is generally referred to as Construction A [46,49,53]. The original binary Construction A, proposed by Forney [71], used $K=\mathbb{Q}$, ${\mathcal{O}}_K=\mathbb{Z}$, $p=2$ and typically $\alpha =1/2$ or $\alpha =1$. This binary version can be seen as a particular case of the cyclotomic field approach by Ebeling [47], which takes $K=\mathbb{Q}\left({\zeta }_p\right)$, ${\mathcal{O}}_K=\mathbb{Z}\left[{\zeta }_p\right]$, and $\mathfrak{p}=(1-{\zeta }_p)$. The generalization to CM fields and totally real number fields, particularly when $\mathfrak{p}$ is totally ramified, has broadened the applicability of Construction A [49].

Generator and Gram Matrices for Construction A

The structure of the resulting lattice is explicitly defined by its generator and Gram matrices. Let $n=[K:\mathbb{Q}]$. We consider the $nN$-dimensional lattice $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$. Let $\Delta =|d_K|$ be the absolute value of the discriminant of K.

Proposition 3

([53]). The following results hold:

• The lattice $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ has discriminant ${\Delta }^N{p}^{2f(N-k)}N{\left(\alpha \right)}^N$ and volume ${\Delta }^{{\displaystyle \frac{N}{2}}}{p}^{f(N-k)}N{\left(\alpha \right)}^{{\displaystyle \frac{N}{2}}}$.
• The dual lattice $({\rho }^{-1}{\left(\mathcal{C}\right)}^{*},b_{\alpha })$ has discriminant ${\Delta }^{-N}{p}^{-2f(N-k)}N{\left(\alpha \right)}^{-N}$ and volume ${\Delta }^{{\displaystyle \frac{-N}{2}}}{p}^{-f(N-k)}N{\left(\alpha \right)}^{{\displaystyle \frac{-N}{2}}}$.
• The lattice $({\rho }^{-1}\left({\mathcal{C}}^{\perp }\right),b_{\alpha })$ has discriminant ${\Delta }^N{p}^{2fk}N{\left(\alpha \right)}^N$ and volume

  $${\Delta }^{{\displaystyle \frac{N}{2}}}{p}^{fk}N{\left(\alpha \right)}^{{\displaystyle \frac{N}{2}}}.$$

Let $\{v_1,\dots ,v_n\}$ be a $\mathbb{Z}$-basis for ${\mathcal{O}}_K$ and let $\{{\omega }_1,\dots ,{\omega }_n\}$ be a $\mathbb{Z}$-basis for $\mathfrak{p}$. Suppose $\mathcal{C}$ admits a generator matrix in the standard (systematic) form and let $\mathbf{A}$ be a matrix such that $\left[\begin{array}{cc}{\mathbf{I}}_k& \mathbf{A}\left(\mathrm{mod}\mathfrak{p}\right)\end{array}\right]$ is a generator matrix of $\mathcal{C}$.

Proposition 4

([53], Proposition 2.3). For K, a totally real number field of degree n with Galois group $\mathcal{G}=\left\{{\sigma }_1,\dots ,{\sigma }_n\right\}$, a generator matrix for $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is given by

$${\mathbf{M}}_{\mathcal{C}}=\left[\begin{array}{cc}{\mathbf{I}}_k\otimes \mathbf{M}& \mathbf{A}\tilde{\otimes }\mathbf{M}\\ {\mathbf{0}}_{n(N-k),nk}& {\mathbf{I}}_{N-k}\otimes {\mathbf{M}}_p\end{array}\right]\left({\mathbf{I}}_N\otimes {\mathbf{D}}_{\alpha }\right),$$

(39)

where $\mathbf{M}={\left[{\sigma }_j\left(v_i\right)\right]}_{i,j=1,\dots ,n}$, ${\mathbf{M}}_p={\left[{\sigma }_j\left({\omega }_i\right)\right]}_{i,j=1,\dots ,n}$ are, respectively, generator matrices for $({\mathcal{O}}_K^N,b_1)$ and $({\mathfrak{p}}^N,b_1)$, ${\mathbf{D}}_{\alpha }$ is a diagonal matrix whose diagonal entries are $\sqrt{{\sigma }_i\left(\alpha \right)}$, $i=1,\dots ,n$, and

$$\mathbf{A}\tilde{\otimes }\mathbf{M}\triangleq \left[\begin{array}{ccccccccccccc}{\mathbf{B}}_{1,1}& \cdots & {\mathbf{B}}_{1,n}& |& {\mathbf{B}}_{2,1}& \cdots & {\mathbf{B}}_{2,n}& |& \cdots & |& {\mathbf{B}}_{N-k,1}& \cdots & {\mathbf{B}}_{N-k,n}\end{array}\right],$$

(40)

where ${\mathbf{B}}_{j,i}={\sigma }_i\left({\mathbf{A}}_j\right)\otimes {\mathbf{M}}_i$, in which ${\mathbf{M}}_i$ and ${\mathbf{A}}_j$ denote the ith and jth columns of the matrices $\mathbf{M}$ and $\mathbf{A}$, respectively, for $i=1,\dots ,n$ and $j=1,\dots ,N-k$. The operation of ${\sigma }_i$ is understood componentwise, for $i=1,\dots ,n$. The Gram matrix ${\mathbf{G}}_{\mathcal{C}}={\mathbf{M}}_{\mathcal{C}}{\mathbf{M}}_{\mathcal{C}}^t$ of $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is

$${\mathbf{G}}_{\mathcal{C}}=\left[\begin{array}{cc}\mathrm{Tr}\left(\alpha ({\mathbf{I}}_k+{\mathbf{AA}}^t)\otimes {\mathbf{M}}_1{\mathbf{M}}_1^t\right)& \mathrm{Tr}\left(\alpha \mathbf{A}\otimes {\mathbf{M}}_1{\mathbf{M}}_{p,1}^t\right)\\ \mathrm{Tr}\left(\alpha \mathbf{A}\otimes {\mathbf{M}}_1{\mathbf{M}}_{p,1}^t\right)& \mathrm{Tr}\left(\alpha {\mathbf{I}}_{N-k}\otimes {\mathbf{M}}_{p,1}{\mathbf{M}}_{p,1}^t\right)\end{array}\right],$$

(41)

where $\mathrm{Tr}={\mathrm{Tr}}_{K/\mathbb{Q}}$ is taken componentwise, and ${\mathbf{M}}_1$ and ${\mathbf{M}}_{p,1}$ denote the first columns of the matrices $\mathbf{M}$ and ${\mathbf{M}}_p$, respectively.

When K is a CM number field, n is even and all embeddings of K into $\mathbb{C}$ are complex embeddings. Assume ${\sigma }_{i+1}$ is the conjugate of ${\sigma }_i$ for $i=1,3,5,\dots ,n-1$.

Proposition 5

([53], Proposition 2.6). Let K be a CM field with degree n and Galois group $\mathcal{G}=\{{\sigma }_1,{\sigma }_2,\dots ,{\sigma }_n\}$, where ${\sigma }_{i+1}$ is the conjugate of ${\sigma }_i$, for $i=1,3,\dots ,n-1$. A generator matrix for $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is given by

$${\mathbf{M}}_{\mathcal{C}}=\left[\begin{array}{cc}{\mathbf{I}}_k\otimes \mathbf{M}& \mathbf{A}\tilde{\tilde{\otimes }}\mathbf{M}\\ {\mathbf{0}}_{n(N-k),nk}& {\mathbf{I}}_{N-k}\otimes {\mathbf{M}}_p\end{array}\right]\left({\mathbf{I}}_N\otimes {\mathbf{D}}_{\alpha }\right),$$

(42)

where $\mathbf{M}$ is the generator matrix for the lattice $({\mathcal{O}}_K,b_1)$ with $\det \left(\mathbf{M}\right)={\Delta }^{{\displaystyle \frac{1}{2}}}$ as follows:

$$\mathbf{M}=\sqrt{2}\left[\begin{array}{cccccc}\Re {\sigma }_1\left(v_1\right)& \Im {\sigma }_2\left(v_1\right)& \Re {\sigma }_3\left(v_1\right)& \dots & \Re {\sigma }_{n-1}\left(v_1\right)& \Im {\sigma }_n\left(v_1\right)\\ ⋮& ⋮& ⋮& \ddots & ⋮& ⋮\\ \Re {\sigma }_1\left(v_n\right)& \Im {\sigma }_2\left(v_n\right)& \Re {\sigma }_3\left(v_n\right)& \dots & \Re {\sigma }_{n-1}\left(v_n\right)& \Im {\sigma }_n\left(v_n\right)\end{array}\right],$$

(43)

and ${\mathbf{M}}_p$ is the following generator matrix for $(\mathfrak{p},b_1)$ and has determinant ${\Delta }^{{\displaystyle \frac{1}{2}}}{p}^f$

$${\mathbf{M}}_p=\sqrt{2}\left[\begin{array}{cccccc}\Re {\sigma }_1\left({\omega }_1\right)& \Im {\sigma }_2\left({\omega }_1\right)& \Re {\sigma }_3\left({\omega }_1\right)& \dots & \Re {\sigma }_{n-1}\left({\omega }_1\right)& \Im {\sigma }_n\left({\omega }_1\right)\\ ⋮& ⋮& ⋮& \ddots & ⋮& ⋮\\ \Re {\sigma }_1\left({\omega }_n\right)& \Im {\sigma }_2\left({\omega }_n\right)& \Re {\sigma }_3\left({\omega }_n\right)& \dots & \Re {\sigma }_{n-1}\left({\omega }_n\right)& \Im {\sigma }_n\left({\omega }_n\right)\end{array}\right].$$

(44)

The matrix ${\mathbf{D}}_{\alpha }$ is a diagonal matrix whose diagonal entries are $\sqrt{{\sigma }_i\left(\alpha \right)}$, $i=1,\dots ,n$, $\mathbf{A}$ is a matrix such that $\left[\begin{array}{cc}{\mathbf{I}}_k& \mathbf{A}\left(\mathrm{mod}\mathfrak{p}\right)\end{array}\right]$ is a generator matrix of $\mathcal{C}$ and

$$\mathbf{A}\tilde{\tilde{\otimes }}\mathbf{M}\triangleq \left[\begin{array}{ccccccc}{\mathbf{A}}_1^{\prime }& |& {\mathbf{A}}_2^{\prime }& |& \dots & |& {\mathbf{A}}_{N-k}^{\prime }\end{array}\right],$$

(45)

where ${\mathbf{A}}_j^{\prime }=\left[\begin{array}{ccccccc}{\mathbf{B}}_{1,j}& {\mathbf{B}}_{1,j}^{\prime }& {\mathbf{B}}_{3,j}& {\mathbf{B}}_{3,j}^{\prime }& \dots & {\mathbf{B}}_{n-1,j}& {\mathbf{B}}_{n-1,j}^{\prime }\end{array}\right]$, for $j=1,\dots ,N-k$, in which ${\mathbf{B}}_{i,j}=\Re {\sigma }_i\left({\mathbf{A}}_j\right)\otimes {\mathbf{M}}_i+\Im {\sigma }_i\left({\mathbf{A}}_j\right)\otimes {\mathbf{M}}_{i+1}$, ${\mathbf{B}}_{i,j}^{\prime }=\Re {\sigma }_i\left({\mathbf{A}}_j\right)\otimes {\mathbf{M}}_{i+1}-\Im {\sigma }_i\left({\mathbf{A}}_j\right)\otimes {\mathbf{M}}_i$ with ${\mathbf{A}}_j$ and ${\mathbf{M}}_i$ as the jth and ith columns of $\mathbf{A}$ and $\mathbf{M}$, respectively, for $j=1,\dots ,N-k$ and $i=1,\dots ,n$. We understand ℜ and ℑ componentwise.

Remark 1

([53], Remark 2.7). Let $\mathbf{v}={(v_1,v_2,\dots ,v_n)}^t$ and ${\mathbf{v}}_j^{\prime }={\mathbf{A}}_j\otimes \mathbf{v}$, for $j=1,\dots ,N-k$, then

$$\mathbf{A}\tilde{\tilde{\otimes }}\mathbf{M}=\sqrt{2}\left[\begin{array}{ccccccc}{\mathbf{V}}_1^{\prime }& |& {\mathbf{V}}_2^{\prime }& |& \dots & |& {\mathbf{V}}_{N-k}^{\prime }\end{array}\right],$$

(46)

where ${\mathbf{V}}_j^{\prime }=\left[\begin{array}{ccccc}\Re {\sigma }_1\left({\mathbf{v}}_j^{\prime }\right)& \Im {\sigma }_2\left({\mathbf{v}}_j^{\prime }\right)& \dots & \Re {\sigma }_{n-1}\left({\mathbf{v}}_j^{\prime }\right)& \Im {\sigma }_n\left({\mathbf{v}}_j^{\prime }\right)\end{array}\right]$, for $j=1,\dots ,N-k$. When p is totally ramified, the entries of $\mathbf{A}\left(\mathrm{mod}\mathfrak{p}\right)$ are in ${\mathbb{F}}_p$ and hence $\mathbf{A}\tilde{\tilde{\otimes }}\mathbf{M}=\mathbf{A}\otimes \mathbf{M}$. In this case, the generator matrix of $({\rho }^{-1}\left(\mathcal{C}\right),b_1)$ coincides with the one obtained in [49], Proposition 1.

Proposition 6

([53], Proposition 2.8). The Gram matrix ${\mathbf{G}}_{\mathcal{C}}={\mathbf{M}}_{\mathcal{C}}{\mathbf{M}}_{\mathcal{C}}^t$ of $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is

$${\mathbf{G}}_{\mathcal{C}}=\left[\begin{array}{cc}\mathrm{Tr}\left(\alpha ({\mathbf{I}}_k+\mathbf{A}{\mathbf{A}}^{†})\otimes \mathbf{v}{\mathbf{v}}^{†}\right)& \mathrm{Tr}\left(\alpha \mathbf{A}\otimes \left(\mathbf{v}{\omega }^{†}\right)\right)\\ \mathrm{Tr}\left(\alpha {\mathbf{A}}^t\otimes \left(\overline{\omega }{\mathbf{v}}^t\right)\right)& \mathrm{Tr}\left(\alpha {\mathbf{I}}_{N-k}\otimes \omega {\omega }^{†}\right)\end{array}\right],$$

(47)

where $\mathrm{Tr}={\mathrm{Tr}}_{K/\mathbb{Q}}$ is taken componentwise, $\omega ={({\omega }_1,{\omega }_2,\dots ,{\omega }_n)}^t$ and ${\mathbf{v}}^{†}={\overline{\mathbf{v}}}^t$ is the conjugate transpose of $\mathbf{v}$. Similarly, ${\mathbf{A}}^{†}={\overline{\mathbf{A}}}^t$ and ${\omega }^{†}={\overline{\omega }}^t$.

Two particular cases of the above construction method, when $\alpha =1/p$ or $\alpha =1/2p$ for K a real quadratic field with $\mathfrak{p}$ inert and K an imaginary quadratic field with $\mathfrak{p}$ totally ramified, have been discussed in [53].

4.3. Known Modular/Unimodular Constructions

Self-dual codes play a crucial role in constructing modular and unimodular lattices, a property that makes them particularly interesting for communication theory due to their well-behaved characteristics.

Proposition 7

([53], Proposition 2.9). If $\mathcal{C}$ is not self-orthogonal, i.e., if $\mathcal{C}\not\subset {\mathcal{C}}^{\perp }$, then $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is not an integral lattice for any $\alpha \in {\mathfrak{p}}^{-1}\cap \mathbb{Q}$ when K is totally real or when K is a CM field and $\mathfrak{p}$ is totally ramified.

This proposition justifies why we consider self-orthogonal codes in the construction of modular lattices, which are of great interest in information security. Past work has extensively explored modular lattice constructions from quadratic number fields [53]:

• Totally Real Quadratic Fields: Let $K=\mathbb{Q}\left(\sqrt{d}\right)$ be a totally real quadratic field, where d is a positive squarefree integer. Its Galois group is $\{{\sigma }_1,{\sigma }_2\}$. The discriminant $d_K$ is d for $d\equiv 1\left(\mathrm{mod}4\right)$, and $4d$ for $d\equiv 2,3\left(\mathrm{mod}4\right)$. For a prime $p\in \mathbb{Z}$ inert in K, and a linear code $\mathcal{C}$ over ${\mathbb{F}}_{p^2}$, if $\mathcal{C}$ is self-orthogonal, then $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is an integral lattice. Furthermore, if $\mathcal{C}$ is self-dual, then it forms a d-modular lattice with $\alpha =1/p$ (for $d\equiv 1\left(\mathrm{mod}4\right)$) or $\alpha =1/2p$ (for $d\equiv 2,3\left(\mathrm{mod}4\right)$).
• Imaginary Quadratic Fields (CM Fields): Let $K=\mathbb{Q}\left(\sqrt{-d}\right)$ be an imaginary quadratic field (d a positive squarefree integer). Its Galois group is $\{{\sigma }_1,{\sigma }_2\}$ where ${\sigma }_1$ is the identity and ${\sigma }_2$ is complex conjugation. The discriminant $\Delta$ is $4d$ for $d\equiv 1,2\left(\mathrm{mod}4\right)$, and d for $d\equiv 3\left(\mathrm{mod}4\right)$. For a prime $p\in \mathbb{Z}$ totally ramified in K, and a linear code $\mathcal{C}$ over ${\mathbb{F}}_p$, if $\mathcal{C}$ is self-orthogonal, then $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is integral. If $\mathcal{C}$ is self-dual, it produces unimodular lattices for $\alpha =1/p$ (for $d\equiv 3\left(\mathrm{mod}4\right)$) or $\alpha =1/2p$ (for $d\equiv 1,2\left(\mathrm{mod}4\right)$).

These results demonstrate how algebraic properties (type of field, prime factorization behavior) directly influence the modularity and integrality of constructed lattices.

4.4. Classical Families Used for Wiretap Codes

The development of lattice codes for wiretap channels has relied heavily on classical families of self-dual codes, which enable the construction of modular and unimodular lattices. These families are critical for balancing coding gain and secrecy performance.

Definition 14.

A linear code $\mathcal{C}\subset {\mathbb{F}}_q^N$ of dimension k over a finite field ${\mathbb{F}}_q$ (where q is a prime power) has a dual code $C^{\perp }=\left\{\mathbf{x}\in {\mathbb{F}}_q^N|\mathbf{x}·\mathbf{y}={\sum }_{i=1}^N{x}_i{y}_i=0\mathrm{for}\mathrm{all}\mathbf{y}\in \mathcal{C}\right\}$. $\mathcal{C}$ is self-orthogonal if $\mathcal{C}\subset {\mathcal{C}}^{\perp }$, and is self-dual if $\mathcal{C}={\mathcal{C}}^{\perp }$.

It is well known for the binary Construction A that $\mathcal{C}\subset {\mathbb{F}}_2^N$ is self-dual if and only if $({\rho }^{-1}\left(\mathcal{C}\right),b_{{\displaystyle \frac{1}{2}}})$ is unimodular [46,47]. More generally, for $K=\mathbb{Q}\left({\zeta }_p\right)$, if $\mathcal{C}\subset {\mathbb{F}}_p^N$ is self-dual, then $({\rho }^{-1}\left(\mathcal{C}\right),b_{{\displaystyle \frac{1}{p}}})$ is unimodular [47]. The converse of this statement is proved in [53] for totally real number fields and CM fields with a totally ramified prime.

Self-dual codes thus provide a systematic way to obtain modular lattices. Specific examples include the following:

• 2-Modular Lattices: Constructed from self-dual codes over ${\mathbb{F}}_3$ in imaginary quadratic fields like $K=\mathbb{Q}\left(\sqrt{-2}\right)$ [72].
• 3-Modular Lattices: Constructed from self-dual codes over ${\mathbb{F}}_4$ in fields like $K=\mathbb{Q}\left({\zeta }_3\right)$ [73].
• Other Modular Lattices: Quadratic fields ($\mathbb{Q}\left(\sqrt{-7}\right)$, $\mathbb{Q}\left(i\right)$) and specific cyclotomic fields ($\mathbb{Q}\left({\zeta }_3\right)$) have been used with self-dual codes to construct various modular lattices [74].

More generalized versions of Construction A have also been introduced, where the ring of integers ${\mathcal{O}}_K$ is replaced by any lattice $L\subset {\mathbb{R}}^n$, further expanding the scope of lattice constructions [75].

Self-Dual Codes for 5-Modular Lattices

For our construction of 5-modular lattices, we need a family of self-dual codes over ${\mathbb{F}}_5$. These codes exist if and only if their length is even [76]. A key property for a codeword $\mathbf{u}$ in a self-orthogonal code $\mathcal{C}$ over ${\mathbb{F}}_5$, if it contains i 0’s, j$\{\pm 1\}$’s and k$\{\pm 2\}$’s (so that the Hamming weight of $\mathbf{u}$ is $j+k$), then $\mathbf{u}·\mathbf{u}=0$ implies

$$j\equiv k\left(\mathrm{mod}5\right).$$

(48)

Equation (48) also implies that a codeword in a self-orthogonal code cannot have weight 1 or 3, although all other weights can occur [76]. Well-known 5-ary self-dual codes include [76]:

• ${\mathcal{C}}_2$: The $[2,1,2]$ code consisting of codewords $\left\{\right(0,0),(1,2),(2,-1),(-2,1),(-1,-2\left)\right\}$, with generator matrix $\left[12\right]$.
• ${\mathcal{F}}_N$: The $[N,N/2,4]$ code, for $N=6,8,10,\dots$, with a specific generator matrix structure

  $$\left[\begin{array}{cccccccccccccc}\hfill 1& \hfill -1& \hfill 2& \hfill 2& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill \dots & \hfill 0& \hfill 0& \hfill 0& \hfill 0\\ \hfill 0& \hfill 0& \hfill 1& \hfill -1& \hfill 2& \hfill 2& \hfill 0& \hfill 0& \hfill 0& \hfill \dots & \hfill 0& \hfill 0& \hfill 0& \hfill 0\\ \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 1& \hfill -1& \hfill 2& \hfill 2& \hfill 0& \hfill \dots & \hfill 0& \hfill 0& \hfill 0& \hfill 0\\ \hfill ⋮& \hfill ⋮& \hfill ⋮& \hfill ⋮& \hfill ⋮& \hfill ⋮& \hfill ⋮& \hfill ⋮& \hfill ⋮& \hfill \ddots & \hfill ⋮& \hfill ⋮& \hfill ⋮& \hfill ⋮\\ \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill \dots & \hfill 1& \hfill -1& \hfill 2& \hfill 2\\ \hfill 2& \hfill 2& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill 0& \hfill \dots & \hfill 0& \hfill 0& \hfill 1& \hfill -1\end{array}\right].$$

  (49)
  Exceptional cases like ${\mathcal{F}}_6$ and ${\mathcal{F}}_8$ have more convenient generator matrix forms. For ${\mathcal{F}}_6$, it is more convenient to use the generator matrix

  $$\left[\begin{array}{cccccc}\hfill 1& \hfill 0& \hfill 1& \hfill -1& \hfill -1& \hfill 1\\ \hfill 1& \hfill 1& \hfill 0& \hfill 1& \hfill -1& \hfill -1\\ \hfill 1& \hfill -1& \hfill 1& \hfill 0& \hfill 1& \hfill -1\end{array}\right].$$

  (50)
  For ${\mathcal{F}}_8$, it is convenient to use the generator matrix $\left[\begin{array}{ccc}{\mathbf{I}}_4& |& {\mathbf{H}}_4\end{array}\right]$, where ${\mathbf{I}}_n$ denotes an $n\times n$ identity matrix and ${\mathbf{H}}_4$ is a Hadamard matrix

  $${\mathbf{H}}_4=\left[\begin{array}{cccc}\hfill 1& \hfill 1& \hfill 1& \hfill 1\\ \hfill 1& \hfill -1& \hfill 1& \hfill -1\\ \hfill 1& \hfill 1& \hfill -1& \hfill -1\\ \hfill 1& \hfill -1& \hfill -1& \hfill 1\end{array}\right].$$

  (51)
• ${\mathcal{L}}_N$: The Hadamard codes, denoted by ${\mathcal{L}}_N$, contain three obvious classes of self-dual codes that can be obtained from Hadamard matrices. Let ${\mathbf{H}}_t$ denote an arbitrary Hadamard matrix of order t.

  -

  For $N\equiv 0\left(\mathrm{mod}20\right)$, let ${\mathcal{L}}_N$ be the code generated by the rows of ${\mathbf{H}}_N$.

  -

  For $N\equiv 8\left(\mathrm{mod}40\right)$, let ${\mathcal{L}}_N$ be the code with generator matrix $\left[\begin{array}{ccc}{\mathbf{I}}_{N/2}& |& {\mathbf{H}}_{N/2}\end{array}\right]$.

  -

  For $N\equiv 32\left(\mathrm{mod}40\right)$, let ${\mathcal{L}}_N$ have generator matrix $\left[\begin{array}{ccc}2{\mathbf{I}}_{N/2}& |& {\mathbf{H}}_{N/2}\end{array}\right]$. For example, there is a unique code ${\mathcal{L}}_8$ which is equivalent to ${\mathcal{F}}_8$.

• ${\mathcal{Q}}_N$ and ${\mathcal{Q}}_N^{\prime }$: The quadratic residue codes ${\mathcal{Q}}_N$ and ${\mathcal{Q}}_N^{\prime }$ differ from the Hadamard codes only in that the diagonal entries of the Hadamard matrices are altered [76].

  -

  When $N\equiv 0$ or $12\left(\mathrm{mod}20\right)$ and $N-1=q$ is a prime power, ${\mathcal{Q}}_N$ is the code with generator matrix $\left(m_{i,j}\right)$, where the rows and columns are labeled $\infty ,0,l,\dots ,q-1$, and $m_{i,i}=\sqrt{-q}$ for all i, $m_{\infty ,i}=1$ and $m_{i,\infty }=-1$. For $i\ge 0$, $m_{i,j}=1$ if $j-i$ is a square in ${\mathbb{F}}_q$, and $m_{i,j}=-1$ if $j-i$ is a nonsquare $(i,j>0,i\ne j)$. Then, ${\mathcal{Q}}_N$ is the usual self-dual extended quadratic residue code (see, for example, [77,78]). The first four of these codes are ${\mathcal{Q}}_{12}=[12,6,6]$, ${\mathcal{Q}}_{20}=[20,10,8]$, ${\mathcal{Q}}_{32}=[32,16,10]$ and ${\mathcal{Q}}_{60}=[60,30,d\le 18]$.

  -

  A conference matrix ${\mathbf{B}}_N$ is a real $N\times N$ matrix with diagonal entries 0 and other entries $\pm 1$ which satisfies $\mathbf{B}{\mathbf{B}}^t=(n-1){\mathbf{I}}_N$. For $N\equiv 6\left(\mathrm{mod}10\right)$, let ${\mathcal{Q}}_N$ be the self-dual code generated by the rows of a conference matrix ${\mathbf{B}}_N$, if one exists. For example, ${\mathcal{Q}}_6\cong {\mathcal{F}}_6$. A more interesting example is obtained from ${\mathbf{B}}_{16}$, which gives a $[16,8,7]$ code ${\mathcal{Q}}_{16}$ with generator matrix

  $$\left[\begin{array}{cccc}\hfill {\mathbf{B}}_4& \hfill {\mathbf{H}}_4& \hfill {\mathbf{H}}_4& \hfill {\mathbf{H}}_4\\ \hfill -{\mathbf{H}}_4& \hfill {\mathbf{B}}_4& \hfill {\mathbf{H}}_4& \hfill -{\mathbf{H}}_4\end{array}\right],$$

  (52)

  where ${\mathbf{H}}_4$ is given in (51) and

  $${\mathbf{B}}_4=\left[\begin{array}{cccc}\hfill 0& \hfill 1& \hfill 1& \hfill 1\\ \hfill -1& \hfill 0& \hfill 1& \hfill -1\\ \hfill -1& \hfill -1& \hfill 0& \hfill 1\\ \hfill -1& \hfill 1& \hfill -1& \hfill 0\end{array}\right].$$

  (53)

  -

  For $N\equiv 12\left(\mathrm{mod}20\right)$, let ${\mathcal{Q}}_N^{\prime }$ be the code generated by the rows of ${\mathbf{B}}_N+2{\mathbf{I}}_N$, where ${\mathbf{B}}_N$ is a skew-symmetric conference matrix.

  -

  For $N\equiv 0\left(\mathrm{mod}20\right)$, let ${\mathcal{Q}}_N^{\prime }$ be generated by $\left[\begin{array}{ccc}{\mathbf{I}}_{N/2}& |& {\mathbf{B}}_{N/2}\end{array}\right]$, where ${\mathbf{B}}_{N/2}$ is any conference matrix. For example, using the Paley matrix ${\mathbf{B}}_{20}$ produces a $[40,20,13]$ code ${\mathcal{Q}}_{40}^{\prime }$ [76].

  -

  For $N\equiv 32\left(\mathrm{mod}40\right)$, let ${\mathcal{Q}}_N^{″}$ be generated by $\left[\begin{array}{ccc}{\mathbf{I}}_{N/2}& |& {\mathbf{B}}_{N/2}+2{\mathbf{I}}_{N/2}\end{array}\right]$, where ${\mathbf{B}}_{N/2}$ is skew-symmetric.

  -

  For $N\equiv 4\left(\mathrm{mod}20\right)$, let ${\mathcal{Q}}_N$, be generated by $\left[\begin{array}{ccc}2{\mathbf{I}}_{N/2}& |& {\mathbf{B}}_{N/2}\end{array}\right]$, where ${\mathbf{B}}_{N/2}$ is any conference matrix. For example, using the Paley matrix ${\mathbf{B}}_{12}$ produces a $[24,12,9]$ code ${\mathcal{Q}}_{24}$.

  -

  Finally, for $N\equiv 16\left(\mathrm{mod}40\right)$, let ${\mathcal{Q}}_N^{\prime }$ generated by $\left[\begin{array}{ccc}2{\mathbf{I}}_{N/2}& |& {\mathbf{B}}_{N/2}+2{\mathbf{I}}_{N/2}\end{array}\right]$, where ${\mathbf{B}}_{N/2}$ is skew-symmetric.

5. Cyclotomic Fields and Modular Lattices

This section bridges the theoretical foundations of algebraic number theory with the practical construction of modular lattices for physical-layer security. We specifically focus on cyclotomic fields, which offer a rich algebraic structure for generating lattices with desirable properties. This survey consolidates classical and modern results on cyclotomic lattices, analyzes the conditions for their modularity, and identifies existing limitations, thereby setting the stage for our novel contributions in the next section.

5.1. Classical Cyclotomic Lattices

Cyclotomic fields, due to their well-understood algebraic properties and monogenicity (as discussed in Section 3.2), have been a fertile ground for lattice constructions, particularly in coding theory. Many interesting lattices can be constructed as ideal lattices over cyclotomic fields $K=\mathbb{Q}\left({\zeta }_m\right)$. For instance, root lattices like $E_8$ (for $m=15,20,24$), the Coxeter–Todd lattice $K_{12}$ (for $m=21$), and the Leech lattice ${\Lambda }_{24}$ (for $m=35,39,52,56,84$) have been realized as cyclotomic lattices [79].

Constructions of modular ideal lattices over specific cyclotomic fields $\mathbb{Q}\left({\zeta }_m\right)$ have been extensively studied. For example, for $m=p^r$ (p prime, $r\ge 1$), a construction results in an even, p-modular ideal lattice of trace type over $K=\mathbb{Q}\left({\zeta }_{p^r}\right)$, with a specified rank and determinant [79], Proposition 1. Similar constructions exist for $m=p^r{q}^s$ [79], Proposition 2.

Theorem 10

([79], Theorem 1). There exists a modular ideal lattice over $K=\mathbb{Q}\left({\zeta }_m\right)$ if and only if m is not a power of a prime p with $p\equiv 1\left(\mathrm{mod}4\right)$.

The authors of [79] have also characterized the cyclotomic fields for which there exists a modular ideal lattice of trace type.

Definition 15.

Let p be a prime divisor of m. Then, p is a norm of m if we have ${\mathcal{D}}_K=IJ\overline{J}$ for some integral ${\mathcal{O}}_K$-ideals I and J such that J is above p and I is prime to p. Let $m^{\prime }$ be a divisor of m. Then, $m^{\prime }$ is a norm of m if all the prime divisors of $m^{\prime }$ are norms of m.

Theorem 11

([79], Theorem 2). Let $\mathsf{\ell }=1$ or a prime number p, with $p\equiv 1\left(\mathrm{mod}4\right)$. Let $m={\mathsf{\ell }}^r{m}^{\prime }$, with $m^{\prime }$ prime to ℓ. Then, there exists an ℓ-modular ideal lattice of trace type if and only if $m^{\prime }$ is a norm of m.

For $\mathsf{\ell }=1$ (i.e., unimodular lattices), if m is a norm of m, then ${\mathcal{L}}_m^1\left(J\right)$ (constructed with $I=J^{-1}$ and $b(x,y)=\mathrm{Tr}\left(x\overline{y}\right)$) is a unimodular ideal lattice of trace type, and even if m is not a power of 2 [79], Proposition 5. For $\mathsf{\ell }=p$ (p prime, $p\not\equiv 1\left(\mathrm{mod}4\right)$), similar constructions yield p-modular ideal lattices of trace type [79], Proposition 6.

5.2. Conditions for Modularity

The modularity property is highly desirable for lattice codes in communication, as it ensures certain symmetries and favorable characteristics for secrecy metrics. Understanding the algebraic conditions that lead to modularity is therefore critical.

A lattice $(\Lambda ,b)$ is d-modular if it is integral and its dual ${\Lambda }^{*}$ is similar to $\Lambda$ scaled by $\sqrt{d}$, i.e., ${\Lambda }^{*}=\sqrt{d}\Lambda$. For Construction A over number fields, the modularity conditions are deeply intertwined with the properties of the underlying number field K, the choice of the element $\alpha$, and the characteristics of the linear code $\mathcal{C}$.

The key conditions for modularity in Construction A include the following:

• Self-Dual Codes: As shown in Proposition 2.9 [53], self-orthogonal codes are a prerequisite for integrality. Specifically, for Construction A over $\mathbb{Q}\left({\zeta }_p\right)$, a self-dual code $\mathcal{C}$ over ${\mathbb{F}}_p$ leads to a unimodular lattice $({\rho }^{-1}\left(\mathcal{C}\right),b_{1/p})$ [47].
• Discriminant and Trace Relations: The determinant of the lattice, its dual, and the properties of the trace form (${\mathrm{Tr}}_{K/\mathbb{Q}}$) play a direct role in determining modularity. The relation $\mathrm{vol}(\Lambda )=d^{n/4}$ for a d-modular lattice is a key property.
• Choice of $\alpha$: The specific choice of $\alpha \in K$ in the bilinear form $b_{\alpha }$ is critical. For instance, $\alpha =1/p$ or $\alpha =1/2p$ are common choices to achieve unimodularity or modularity over quadratic fields [53].

These algebraic conditions dictate whether the constructed lattice will possess the desired modularity, which directly influences its suitability for specific wireless communication scenarios.

5.3. Existing Results and Limitations

While Construction A over number fields is a powerful tool for designing lattices, achieving modularity for specific field types and parameters is not always straightforward. Prior research has identified both successful constructions and inherent limitations, often tied to the specific algebraic properties of the chosen number fields.

Notable successes in constructing modular and unimodular lattices from cyclotomic fields via Construction A include the following.

Proposition 8

([47], Section 5.2, [48], Example 1). For an odd prime p, let $K=\mathbb{Q}\left({\zeta }_p\right)$ be a CM field with ring of integers ${\mathcal{O}}_K=\mathbb{Z}\left[{\zeta }_p\right]$. Taking $\mathfrak{p}=(1-{\zeta }_p)$ and defining the bilinear form $b_{1/p}(\mathbf{x},\mathbf{y})={\sum }_{i=1}^N{\mathrm{Tr}}_{K/\mathbb{Q}}(x_i{\overline{y}}_i/p)$, if the code $\mathcal{C}\subset {\mathcal{C}}^{\perp }$ over ${\mathbb{F}}_p$, then $({\rho }^{-1}\left(\mathcal{C}\right),b_{1/p})$ yields an even integral lattice of rank $N(p-1)$. Furthermore, if $\mathcal{C}$ is self-dual, the resulting lattice is an even unimodular lattice.

Proposition 9

([49], Corollary 2). Let $K^{+}=\mathbb{Q}({\zeta }_p+{\zeta }_p^{-1})$ be a totally real subfield. For a code $\mathcal{C}\subset {\mathbb{F}}_p^N$ with $\mathcal{C}\subset {\mathcal{C}}^{\perp }$, the lattice $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ formed with $\alpha =1/p$ is an integral lattice of rank $N(p-1)/2$. If $\mathcal{C}$ is self-dual, this construction produces an odd unimodular lattice.

However, these successful constructions are often contrasted with scenarios where achieving modularity proves challenging, indicating inherent constraints in the design space. For instance, in this paper, we demonstrate a counter example where, for $K=\mathbb{Q}\left({\zeta }_6\right)$, a 3-modular lattice cannot be constructed via Construction A, despite initial conditions suggesting its feasibility. Similarly, for $K=\mathbb{Q}\left({\zeta }_4\right)=\mathbb{Q}\left(i\right)$ and prime $p=5$, our result shows that a 5-modular lattice is not obtained from Construction A, even with an integral code over ${\mathbb{F}}_5$.

These examples highlight that achieving modularity is not universally guaranteed. Furthermore, the literature has generally not addressed the specific case of cyclotomic fields $\mathbb{Q}\left({\zeta }_{p^r}\right)$ and $\mathbb{Q}({\zeta }_{p^r}+{\zeta }_{p^r}^{-1})$ for ramification degree $r>1$, nor general cyclotomic fields $\mathbb{Q}\left({\zeta }_n\right)$ where n is not a prime power. The observed difficulties in achieving modularity under specific conditions, coupled with these unaddressed cases, represent significant gaps and limitations in existing Construction A frameworks for cyclotomic fields. Our work, therefore, aims to directly address these limitations by rigorously establishing new existence and non-existence results for p-modular lattices derived from these specific types of cyclotomic fields.

6. Newly Proposed $\mathit{p}$-Modular Lattices for $\mathit{p}\equiv \mathbf{1}\left(\mathrm{mod}\mathbf{4}\right)$

This section reviews the newly proposed family of p-modular lattices in [80] specifically constructed from cyclotomic number fields, addressing some of the limitations identified in the existing literature (Section 5.3). Following [80], we review the construction methodology, characterize the key algebraic and geometric properties of these lattices, and rigorously establish non-existence results for certain parameter choices. These findings provide critical design principles and insights into the suitability of these new lattices for physical-layer security applications.

The importance of cyclotomic number fields in the construction of modular lattices for wireless communication cannot be overstated. Their well-defined algebraic properties and monogenicity make them ideal candidates for systematic lattice design. In this section, we present a new framework based on Construction A and cyclotomic number fields, yielding a family of p-modular lattices where $p\equiv 1\left(\mathrm{mod}4\right)$.

A foundational result in algebraic number theory is the Kronecker–Weber theorem, which highlights the pervasive nature of cyclotomic fields in number theory. Every cyclotomic field is an Abelian extension of the rational number field $\mathbb{Q}$. The Kronecker–Weber theorem, first announced by Kronecker in 1853, provides a powerful converse.

Theorem 12

(Kronecker–Weber [81,82]). Every finite Abelian extension of $\mathbb{Q}$ lies in a cyclotomic field $\mathbb{Q}\left({\zeta }_m\right)$ for some integer m.

In other words, any algebraic integer in a number field whose Galois group is Abelian can be expressed as a sum of roots of unity with rational coefficients. Let ${\mathbb{Q}}_m=\mathbb{Q}\left(e^{2\pi i/m}\right)$. We can assume that $m\not\equiv 2\left(\mathrm{mod}4\right)$, because if $m\equiv 2\left(\mathrm{mod}4\right)$ with $m=2m_0$, then it is easy to check that $e^{-2\pi i/m_0}$ is a primitive mth root of unity, and hence ${\mathbb{Q}}_m={\mathbb{Q}}_{m_0}$. The Kronecker–Weber theorem motivates the following definition.

Definition 16

(Conductor). Let $L/\mathbb{Q}$ be a finite Abelian extension. A positive integer m is a defining modulus or an admissible modulus of L if $L\subset {\mathbb{Q}}_m$. Such an m exists by the Kronecker–Weber theorem. The conductor of L, ${\mathfrak{f}}_L$, is the smallest admissible modulus of L.

Example 2

([83]). Let $L=\mathbb{Q}({\zeta }_m+{\zeta }_m^{-1})$ be the maximal real subfield of ${\mathbb{Q}}_m$. For $m\ge 5$, its conductor ${\mathfrak{f}}_L=m$. If $m=3,4$, then $L=\mathbb{Q}$ and ${\mathfrak{f}}_L=1$. As another case, consider $L=\mathbb{Q}\left(\sqrt{d}\right)$, where d is a squarefree integer, $\left|d\right|>1$. Then, its conductor is given by

$${\mathfrak{f}}_L=\left|d_L\right|=\left\{\begin{array}{cc}\left|d\right|,\hfill & ifd\equiv 1\left(\mathrm{mod}4\right),\hfill \\ \left|4d\right|,\hfill & ifd\equiv 2,3\left(\mathrm{mod}4\right).\hfill \end{array}\right.$$

(54)

If $L={\mathbb{Q}}_p$ (p an odd prime), then using (26), $d_L={(-1)}^{{\displaystyle \frac{p-1}{2}}}{p}^{p-2}$ is the square of an integer in ${\mathcal{O}}_L$; thus, $\mathbb{Q}\left(\sqrt{{(-1)}^{{\displaystyle \frac{p-1}{2}}}p}\right)\subset {\mathbb{Q}}_p$. It follows that for a prime p:

$$\mathbb{Q}\left(\sqrt{p}\right)\subset \left\{\begin{array}{cc}{\mathbb{Q}}_p,\hfill & ifp\equiv 1\left(\mathrm{mod}4\right),\hfill \\ {\mathbb{Q}}_{4p},\hfill & ifp\equiv 3\left(\mathrm{mod}4\right),\hfill \\ {\mathbb{Q}}_8,\hfill & ifp=2.\hfill \end{array}\right.$$

(55)

Moreover, if $d=\pm 2^{\nu }{p}_1{p}_2\cdots p_r$ is squarefree, then $\mathbb{Q}\left(\sqrt{d}\right)\subset {\mathbb{Q}}_{4d}$.

6.1. Construction: Generalized Construction A from $\mathbb{Q}\left({\zeta }_p\right)$

Our primary construction leverages the generalized Construction A framework (Section 4.2) applied to cyclotomic number fields $\mathbb{Q}\left({\zeta }_p\right)$ for primes $p\equiv 1\left(\mathrm{mod}4\right)$. This specific choice of number field allows for the creation of p-modular lattices with well-defined properties.

Theorem 13.

Let $K=\mathbb{Q}\left({\zeta }_p\right)$ where p is an odd prime and $p\equiv 1\left(\mathrm{mod}4\right)$, with the ring of integers ${\mathcal{O}}_K=\mathbb{Z}\left[{\zeta }_p\right]$. Then, K is a CM field and the prime p totally ramifies in K as $p{\mathcal{O}}_K={\mathfrak{P}}^{p-1}$, with residue field ${\mathcal{O}}_K/\mathfrak{P}\cong {\mathbb{F}}_p$, where $\mathfrak{P}=p{\mathcal{O}}_K+(1-{\zeta }_p){\mathcal{O}}_K$. Let $\mathcal{C}\subset {\mathbb{F}}_p^N$ be an $(N,k)$ self-dual code over ${\mathbb{F}}_p$. Then, $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ with $b_{\alpha }(\mathbf{x},\mathbf{y})={\sum }_{i=1}^N{\mathrm{Tr}}_{K/\mathbb{Q}}\left(\alpha x_i{\overline{y}}_i\right)$ and $\alpha ={\displaystyle \frac{1}{\sqrt{p}}}$, is a p-modular lattice.

Proof. 

See Appendix A.1. □

Remark 2.

For $K=\mathbb{Q}\left({\zeta }_p\right)$, the $p-1$ embeddings ${\sigma }_1,\dots ,{\sigma }_{p-1}:K\to \mathbb{C}$ are given by

$${\sigma }_r\left({\zeta }_p\right)={\zeta }^r,r=1,\dots ,p-1.$$

(56)

Then, the trace of an element $\gamma \in K$, $\gamma =a_0+a_1{\zeta }_p+\dots +a_{p-2}{\zeta }_p^{p-2}$, $a_i\in \mathbb{Q}$, is easily computed to be [47], p. 122

$${\mathrm{Tr}}_{K/\mathbb{Q}}\left(\gamma \right)=(p-1)a_0-a_1-a_2-\cdots -a_{p-2}.$$

(57)

Let $\mathfrak{P}=(1-{\zeta }_p)$ be the principal ideal of ${\mathcal{O}}_K=\mathbb{Z}\left[{\zeta }_p\right]$ generated by the element $1-{\zeta }_p$ in ${\mathcal{O}}_K$. Then, $\mathfrak{P}\cap \mathbb{Z}=p\mathbb{Z}$ and for any $x\in \mathfrak{P}$, ${\mathrm{Tr}}_{K/\mathbb{Q}}\left(x\right)\in p\mathbb{Z}$ [47], p. 122. The mapping $\rho :{\mathcal{O}}_K\to {\mathbb{F}}_p$ sending $\gamma =a_0+a_1{\zeta }_p+\cdots +a_{p-2}{\zeta }_p^{p-2}$, $a_i\in \mathbb{Z}$, to $\rho \left(\gamma \right)=a_0+a_1+\cdots +a_{p-2}\left(\mathrm{mod}p\right)$ is an additive homomorphism and the kernel of this homomorphism is equal to $\mathfrak{P}$. This shows that the mapping ρ can be considered as the reduction $\mathrm{mod}$$\mathfrak{P}$ [47], p. 123. The vectors

$$1-{\zeta }_p,{\zeta }_p-{\zeta }_p^2,{\zeta }_p^2-{\zeta }_p^3,\dots ,{\zeta }^{p-2}-{\zeta }^{p-1}$$

(58)

form a $\mathbb{Z}$-basis for $\mathfrak{P}$ [47], p. 126.

Remark 3.

In order to use Theorem 13, we need to express $\sqrt{p}$ in terms of the $\mathbb{Z}$-basis of $\mathbb{Z}\left[{\zeta }_p\right]$. To this end, we use quadratic Gauss sums. A quadratic Gauss sum can be interpreted as a linear combination of the values of the complex exponential function with coefficients given by a quadratic character (for a general character, one obtains a more general Gauss sum) [84], pp. 70–76. Let p be an odd prime number and a an integer. Then, the Gauss sum $\left(\mathrm{mod}p\right)$, $g(a;p)$, is the sum of the pth roots of unity

$$g(a;p)=\sum _{k=0}^{p-1}{e}^{2\pi ia{k}^2/p}=\sum _{k=0}^{p-1}{\zeta }_p^{a{k}^2}.$$

(59)

If a is not divisible by p, an alternative expression for the Gauss sum is

$$G(a,\chi )=\sum _{k=0}^{p-1}\chi \left(k\right)e^{2\pi iak/p},$$

(60)

where $\chi \left(k\right)=\left({\displaystyle \frac{k}{p}}\right)$ is the Legendre symbol, which is a quadratic character $\left(\mathrm{mod}p\right)$. Putting a general character χ in place of the Legendre symbol defines the Gauss sum $G\left(\chi \right)$. The value of the Gauss sum is an algebraic integer in $\mathbb{Q}\left({\zeta }_p\right)$. The evaluation of the Gauss sum can be reduced to the case $a=1$ as follows:

$$g(a;p)=\left({\displaystyle \frac{a}{p}}\right)g(1;p).$$

(61)

We also have the following useful result [84], p. 75

$$g(1;p)=\sum _{k=0}^{p-1}{e}^{2\pi i{k}^2/p}=\left\{\begin{array}{ccc}\sqrt{p}\hfill & & \hfill p\equiv 1\left(\mathrm{mod}4\right),\\ i\sqrt{p}\hfill & & \hfill p\equiv 3\left(\mathrm{mod}4\right).\end{array}\right.$$

(62)

The main reason for applying the canonical embedding on algebraic lattices is the embedding of their corresponding lattices, into the real space ${\mathbb{R}}^n$ for some n. Theorem 13 does not guarantee that its introduced lattice is embedded in ${\mathbb{R}}^{N(p-1)}$, because the element $\alpha$ is not necessarily totally positive and some of $\sqrt{{\sigma }_i\left(\alpha \right)}$’s may be purely imaginary numbers. This issue, particularly for $p=5$, is addressed in the following proposition.

Proposition 10.

Let $p=5$ and ${\rho }^{-1}\left(\mathcal{C}\right)$ be the obtained lattice in Theorem 13. Define ${\Gamma }_{\mathcal{C}}={\sigma }^N\left({\rho }^{-1}\left(\mathcal{C}\right)\right)$, where ${\sigma }^N$ is the canonical embedding which has been applied componentwise over ${\mathcal{O}}_K^N$; that is, ${\sigma }^N(x_1,\dots ,x_N)=(\sigma \left(x_1\right),\dots ,\sigma \left(x_N\right))$, for $(x_1,\dots ,x_N)\in {\mathcal{O}}_K^N$ and $\sigma =({\sigma }_1,\dots ,{\sigma }_4)$. Then, ${\Gamma }_{\mathcal{C}}$ is a $\mathbb{Z}$-lattice in ${\mathbb{R}}^{2N}\times {\mathbb{R}}^{*2N}$, where ${\mathbb{R}}^{*}$ is the set of purely imaginary numbers.

Proof. 

See Appendix A.2. □

Using Theorem 13, we find a new family of 5-modular lattices which is applicable in information security. We need a family of self dual codes over ${\mathbb{F}}_5$, which is provided in [76].

Example 3.

Let $p=5$ and $K=\mathbb{Q}\left({\zeta }_5\right)$, with $\rho :\mathbb{Z}{\left[{\zeta }_5\right]}^2\to {\mathbb{F}}_5^2$ given in Remark 2. The degree of $K/\mathbb{Q}$ is 4, and the four embeddings of K are ${\sigma }_1$, which is the identity, ${\sigma }_2$, which is the conjugate of ${\sigma }_1$ and maps ${\zeta }_5$ to ${\zeta }_5^4$, ${\sigma }_3$, which maps ${\zeta }_5$ to ${\zeta }_5^2$, and ${\sigma }_4$, which is the conjugate of ${\sigma }_3$ and maps ${\zeta }_5$ to ${\zeta }_5^3$. Consider the self dual code $\mathcal{C}={\mathcal{C}}_2$ of length 2 over ${\mathbb{F}}_5$ as in the above, with generator matrix $\left[\begin{array}{cc}\mathbf{I}& \mathbf{A}\left(\mathrm{mod}5\right)\end{array}\right]$ and $\mathbf{A}\left(\mathrm{mod}5\right)=\left[\begin{array}{c}2\end{array}\right]$. Using the mapping ρ is Remark 2, we can take 2 to be the preimage of 2 and we have $\mathbf{A}=\left[\begin{array}{c}2\end{array}\right]$. We next compute a generator matrix for the lattice ${\rho }^{-1}\left(\mathcal{C}\right)$ explicitly using the discussion from Section 4. We choose the basis $\{v_1=1,v_2={\zeta }_5,v_3={\zeta }_5^2,v_4={\zeta }_5^3\}$ for ${\mathcal{O}}_K$, and it follows that the generator matrix for the lattice ${\mathcal{O}}_K$ together with the trace form $〈x,y〉={\mathrm{Tr}}_{K/\mathbb{Q}}\left(x\overline{y}\right)$, $x,y\in {\mathcal{O}}_K$, is

$$\mathbf{M}=\sqrt{2}\left[\begin{array}{cccc}\Re {\sigma }_1\left(1\right)& \Im {\sigma }_2\left(1\right)& \Re {\sigma }_3\left(1\right)& \Im {\sigma }_4\left(1\right)\\ \Re {\sigma }_1\left({\zeta }_5\right)& \Im {\sigma }_2\left({\zeta }_5\right)& \Re {\sigma }_3\left({\zeta }_5\right)& \Im {\sigma }_4\left({\zeta }_5\right)\\ \Re {\sigma }_1\left({\zeta }_5^2\right)& \Im {\sigma }_2\left({\zeta }_5^2\right)& \Re {\sigma }_3\left({\zeta }_5^2\right)& \Im {\sigma }_4\left({\zeta }_5^2\right)\\ \Re {\sigma }_1\left({\zeta }_5^3\right)& \Im {\sigma }_2\left({\zeta }_5^3\right)& \Re {\sigma }_3\left({\zeta }_5^3\right)& \Im {\sigma }_4\left({\zeta }_5^3\right)\end{array}\right]=\sqrt{2}\left[\begin{array}{cccc}1& 0& 1& 0\\ \Re {\zeta }_5& \Im {\zeta }_5^4& \Re {\zeta }_5^2& \Im {\zeta }_5^3\\ \Re {\zeta }_5^2& \Im {\zeta }_5^3& \Re {\zeta }_5^4& \Im {\zeta }_5\\ \Re {\zeta }_5^3& \Im {\zeta }_5^2& \Re {\zeta }_5& \Im {\zeta }_5^4\end{array}\right].$$

(63)

It should be noted that

$$\begin{array}{ccc}\Re {\zeta }_5=\Re {\zeta }_5^4=\cos \left({\displaystyle \frac{2\pi }{5}}\right)={\displaystyle \frac{-1+\sqrt{5}}{4}},& & \Re {\zeta }_5^2=\Re {\zeta }_5^3=\cos \left({\displaystyle \frac{4\pi }{5}}\right)={\displaystyle \frac{-1-\sqrt{5}}{4}},\end{array}$$

$$\begin{array}{ccc}\Im {\zeta }_5={\displaystyle \frac{1}{4}}\sqrt{10+2\sqrt{5}},& & \Im {\zeta }_5^4={\displaystyle \frac{-1}{4}}\sqrt{10+2\sqrt{5}},\\ \Im {\zeta }_5^2={\displaystyle \frac{1}{4}}\sqrt{10-2\sqrt{5}},& & \Im {\zeta }_5^3={\displaystyle \frac{-1}{4}}\sqrt{10-2\sqrt{5}}.\end{array}$$

Using Proposition 5, a generator matrix for $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$, with $\alpha =1/\sqrt{5}$, is

$${\mathbf{M}}_{\mathcal{C}}=\left[\begin{array}{cc}\mathbf{M}& \mathbf{A}\otimes \mathbf{M}\\ {\mathbf{0}}_{4\times 4}& {\mathbf{M}}_p\end{array}\right]\left({\mathbf{I}}_2\otimes {\mathbf{D}}_{\alpha }\right),$$

(64)

where ${\mathbf{M}}_p$ is obtained using the $\mathbb{Z}$-basis $\{{\omega }_1=1-{\zeta }_5,{\omega }_2={\zeta }_5-{\zeta }_5^2,{\omega }_3={\zeta }_5^2-{\zeta }_5^3,$${\omega }_4={\zeta }_5^3-{\zeta }_5^4\}$ for $\mathfrak{P}$ as follows:

$$\begin{array}{ccc}\hfill {\mathbf{M}}_p& =& \sqrt{2}\left[\begin{array}{cccc}\Re {\sigma }_1\left({\omega }_1\right)& \Im {\sigma }_2\left({\omega }_1\right)& \Re {\sigma }_3\left({\omega }_1\right)& \Im {\sigma }_4\left({\omega }_1\right)\\ \Re {\sigma }_1\left({\omega }_2\right)& \Im {\sigma }_2\left({\omega }_2\right)& \Re {\sigma }_3\left({\omega }_2\right)& \Im {\sigma }_4\left({\omega }_2\right)\\ \Re {\sigma }_1\left({\omega }_3\right)& \Im {\sigma }_2\left({\omega }_3\right)& \Re {\sigma }_3\left({\omega }_3\right)& \Im {\sigma }_4\left({\omega }_3\right)\\ \Re {\sigma }_1\left({\omega }_4\right)& \Im {\sigma }_2\left({\omega }_4\right)& \Re {\sigma }_3\left({\omega }_4\right)& \Im {\sigma }_4\left({\omega }_4\right)\end{array}\right]\hfill \\ & =& \sqrt{2}\left[\begin{array}{cccc}\Re (1-{\zeta }_5)& \Im (1-{\zeta }_5^4)& \Re (1-{\zeta }_5^2)& \Im (1-{\zeta }_5^3)\\ \Re ({\zeta }_5-{\zeta }_5^2)& \Im ({\zeta }_5^4-{\zeta }_5^3)& \Re ({\zeta }_5^2-{\zeta }_5^4)& \Im ({\zeta }_5^3-{\zeta }_5)\\ \Re ({\zeta }_5^2-{\zeta }_5^3)& \Im ({\zeta }_5^3-{\zeta }_5^2)& \Re ({\zeta }_5^4-{\zeta }_5)& \Im ({\zeta }_5-{\zeta }_5^4)\\ \Re ({\zeta }_5^3-{\zeta }_5^4)& \Im ({\zeta }_5^2-{\zeta }_5)& \Re ({\zeta }_5-{\zeta }_5^3)& \Im ({\zeta }_5^4-{\zeta }_5^2)\end{array}\right].\hfill \end{array}$$

(65)

The matrix ${\mathbf{D}}_{\alpha }$ is the diagonal matrix $\mathrm{diag}\left(\sqrt{{\sigma }_1\left(\alpha \right)},\sqrt{{\sigma }_2\left(\alpha \right)},\sqrt{{\sigma }_3\left(\alpha \right)},\sqrt{{\sigma }_4\left(\alpha \right)}\right)$. In order to show that $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is integral, we compute the Gram matrix which is proposed in (47). Define $\mathbf{v}={(v_1,v_2,v_3,v_4)}^t={(1,{\zeta }_5,{\zeta }_5^2,{\zeta }_5^3)}^t$ and $\mathit{\omega }={({\omega }_1,{\omega }_2,{\omega }_3,{\omega }_4)}^t=(1-{\zeta }_5)\mathbf{v}$, then

$${\mathbf{G}}_{\mathcal{C}}=\left[\begin{array}{cc}{\mathrm{Tr}}_{K/\mathbb{Q}}\left(5\alpha \mathbf{v}{\mathbf{v}}^{†}\right)& {\mathrm{Tr}}_{K/\mathbb{Q}}\left(2\alpha \mathbf{v}{\mathit{\omega }}^{†}\right)\\ {\mathrm{Tr}}_{K/\mathbb{Q}}\left(2\alpha \overline{\mathit{\omega }}{\mathbf{v}}^t\right)& {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\alpha \mathit{\omega }{\mathit{\omega }}^{†}\right)\end{array}\right],$$

in which

$$\mathbf{v}{\mathbf{v}}^{†}=\left[\begin{array}{c}1\\ {\zeta }_5\\ {\zeta }_5^2\\ {\zeta }_5^3\end{array}\right]\left[\begin{array}{cccc}1& {\zeta }_5^4& {\zeta }_5^3& {\zeta }_5^2\end{array}\right]=\left[\begin{array}{cccc}1& {\zeta }_5^4& {\zeta }_5^3& {\zeta }_5^2\\ {\zeta }_5& 1& {\zeta }_5^4& {\zeta }_5^3\\ {\zeta }_5^2& {\zeta }_5& 1& {\zeta }_5^4\\ {\zeta }_5^3& {\zeta }_5^2& {\zeta }_5& 1\end{array}\right],$$

(66)

$$\mathbf{v}{\mathit{\omega }}^{†}=\mathbf{v}\left(\overline{1-{\zeta }_5}\right){\mathbf{v}}^{†}=(1-{\zeta }_5^4)\mathbf{v}{\mathbf{v}}^{†},$$

(67)

$$\overline{\mathit{\omega }}{\mathbf{v}}^t=\left(\overline{1-{\zeta }_5}\right)\overline{\mathbf{v}}{\mathbf{v}}^t=(1-{\zeta }_5^4){\left(\mathbf{v}{\mathbf{v}}^{†}\right)}^t,$$

(68)

$$\mathit{\omega }{\mathit{\omega }}^{†}=(1-{\zeta }_5)(1-{\zeta }_5^4)\left(\mathbf{v}{\mathbf{v}}^{†}\right)=(3+{\zeta }_5^2+{\zeta }_5^3)\mathbf{v}{\mathbf{v}}^{†}.$$

(69)

Using the additive property of the trace function, it is enough to find ${\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^i\right)$, for $i=0,1,\dots ,4$. We have

$$\begin{array}{ccc}\hfill {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}\right)& =& {\mathrm{Tr}}_{K/\mathbb{Q}}(-1-2{\zeta }_5^2-2{\zeta }_5^3)=4(-1)+2+2=0,\hfill \\ \hfill {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5\right)& =& {\mathrm{Tr}}_{K/\mathbb{Q}}(2+{\zeta }_5+2{\zeta }_5^2)=8-1-2=5,\hfill \\ \hfill {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^2\right)& =& {\mathrm{Tr}}_{K/\mathbb{Q}}(2{\zeta }_5+{\zeta }_5^2+2{\zeta }_5^3)=-2-1-2=-5,\hfill \\ \hfill {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^3\right)& =& {\mathrm{Tr}}_{K/\mathbb{Q}}(-2-2{\zeta }_5-{\zeta }_5^3)=-8+2+1=-5,\hfill \\ \hfill {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^4\right)& =& {\mathrm{Tr}}_{K/\mathbb{Q}}(1-{\zeta }_5-{\zeta }_5^2+{\zeta }_5^3)=4+1+1-1=5.\hfill \end{array}$$

For example, we compute the upper left component of ${\mathbf{G}}_{\mathcal{C}}$ as follows:

$$\begin{array}{ccc}\hfill {\mathrm{Tr}}_{K/\mathbb{Q}}\left(5\alpha \mathbf{v}{\mathbf{v}}^{†}\right)& =& \left[\begin{array}{cccc}{\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^4\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^3\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^2\right)\hfill \\ {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^4\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^3\right)\hfill \\ {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^2\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^4\right)\hfill \\ {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^3\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5^2\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}{\zeta }_5\right)\hfill & {\mathrm{Tr}}_{K/\mathbb{Q}}\left(\sqrt{5}\right)\hfill \end{array}\right]\hfill \\ & =& \left[\begin{array}{cccc}\hfill 0& \hfill 5& \hfill -5& \hfill -5\\ \hfill 5& \hfill 0& \hfill 5& \hfill -5\\ \hfill -5& \hfill 5& \hfill 0& \hfill 5\\ \hfill -5& \hfill -5& \hfill 5& \hfill 0\end{array}\right].\hfill \end{array}$$

Other components can be computed similarly and we have

$${\mathbf{G}}_{\mathcal{C}}=\left[\begin{array}{cccccccc}\hfill 0& \hfill 5& \hfill -5& \hfill -5& \hfill -2& \hfill 4& \hfill 0& \hfill -4\\ \hfill 5& \hfill 0& \hfill 5& \hfill -5& \hfill 2& \hfill -2& \hfill 4& \hfill 0\\ \hfill -5& \hfill 5& \hfill 0& \hfill 5& \hfill -4& \hfill 2& \hfill -2& \hfill 4\\ \hfill -5& \hfill -5& \hfill 5& \hfill 0& \hfill 0& \hfill -4& \hfill 2& \hfill -2\\ \hfill -2& \hfill 2& \hfill -4& \hfill 0& \hfill -2& \hfill 3& \hfill -2& \hfill -2\\ \hfill 4& \hfill -2& \hfill 2& \hfill -4& \hfill 3& \hfill -2& \hfill 3& \hfill -2\\ \hfill 0& \hfill 4& \hfill -2& \hfill 2& \hfill -2& \hfill 3& \hfill -2& \hfill 3\\ \hfill -4& \hfill 0& \hfill 4& \hfill -2& \hfill -2& \hfill -2& \hfill 3& \hfill -2\end{array}\right].$$

(70)

Thus, $({\rho }^{-1}\left(\mathcal{C}\right),b_{\alpha })$ is an integral lattice and it can be checked that $\det \left({\mathbf{G}}_{\mathcal{C}}\right)=5^4$, that is a necessary condition for being 5-modular.

6.2. Non-Existence of Modular Lattices from Prime-Power Cyclotomic Fields via Construction A

In this section, we review the construction of modular lattices in [80] using the provided algebraic tools in the previous sections. We consider $K=\mathbb{Q}\left({\zeta }_n\right)$ and its maximal totally real subfield $K^{+}$, when n is a prime power or when n is composite. There are two approaches to construct modular lattices using algebraic number fields:

• Construction using ideal lattices [79,85,86,87],
• Construction using generalized Construction A, which was introduced in Section 4.2.

An ideal lattice is an ideal of a number field K together with a bilinear form satisfying an invariance relation [86]. Using ideal lattices in order to construct modular lattices has been investigated in [79,85,87]. Here, we concentrate on generalizing the results of Propositions 8 and 9 to obtain d-modular lattices using cyclotomic number fields. As far as we are aware, the generalizations of the above results to $K=\mathbb{Q}\left({\zeta }_{p^r}\right)$ and $K^{+}=\mathbb{Q}({\zeta }_{p^r}+{\zeta }_{p^r}^{-1})$, with $r>1$, or generalization to the cases that $K=\mathbb{Q}\left({\zeta }_n\right)$, with $n\ne p^r$ for a prime number p, have not been addressed in the literature. In the following theorems, we consider all of these cases.

Theorem 14.

Let $K=\mathbb{Q}\left({\zeta }_{p^r}\right)$, with $r>1$ and p an odd prime number, be the cyclotomic field with the ring of integers ${\mathcal{O}}_K=\mathbb{Z}\left[{\zeta }_{p^r}\right]$. We have that K is a CM field and the prime p totally ramifies in K as $p{O}_K={\mathfrak{P}}^{p^{r-1}(p-1)}$, with residue field ${\mathcal{O}}_K/\mathfrak{P}\cong {\mathbb{F}}_p$, where $\mathfrak{P}=(1-{\zeta }_{p^r})$. Let $\mathcal{C}\subset {\mathbb{F}}_p^N$ be an $(N,k)$ self-dual code over ${\mathbb{F}}_p$. Then, $({\rho }^{-1}\left(\mathcal{C}\right),b_{1/p})$ with $b_{1/p}(\mathbf{x},\mathbf{y})={\sum }_{i=1}^N{\mathrm{Tr}}_{K/\mathbb{Q}}(x_i{\overline{y}}_i/p)$, is d-modular if and only if $d=1$ and $r=1$.

Proof. 

See Appendix A.3. □

Theorem 15.

Let $K^{+}=\mathbb{Q}({\zeta }_{p^r}+{\zeta }_{p^r}^{-1})$, with $r>1$ and p an odd prime number, be the totally real maximal subfield of a cyclotomic field with the ring of integers ${\mathcal{O}}_{K^{+}}=\mathbb{Z}[{\zeta }_{p^r}+{\zeta }_{p^r}^{-1}]$. We have that $K^{+}$ is a totally real number field and the prime p totally ramifies in $K^{+}$ as $p{O}_{K^{+}}={\mathfrak{p}}^{{\displaystyle \frac{p^{r-1}(p-1)}{2}}}$, with residue field ${\mathcal{O}}_{K^{+}}/\mathfrak{p}\cong {\mathbb{F}}_p$, where $\mathfrak{p}=(2-{\zeta }_{p^r}-{\zeta }_{p^r}^{-1})$. Let $\mathcal{C}\subset {\mathbb{F}}_p^N$ be an $(N,k)$ self-dual code over ${\mathbb{F}}_p$. Then, $({\rho }^{-1}\left(\mathcal{C}\right),b_{1/p})$ with $b_{1/p}(\mathbf{x},\mathbf{y})={\sum }_{i=1}^N{\mathrm{Tr}}_{K/\mathbb{Q}}(x_i{y}_i/p)$ is d-modular if and only if $d=1$ and $r=1$.

Proof. 

See Appendix A.4 □

In other cases, that is when $K=\mathbb{Q}\left({\zeta }_n\right)$ and $n\ne p^r$ for an odd prime number p, making a general decision is not easy. In the sequel, we present an example that indicates the complexity of this general case.

Example 4.

Let $K=\mathbb{Q}\left({\zeta }_6\right)$ with the ring of integers ${\mathcal{O}}_K=\mathbb{Z}\left[{\zeta }_6\right]$. The minimal polynomial of ${\zeta }_6$ is ${\Phi }_6\left(X\right)=X^2-X+1$ and using Proposition 2, we conclude that 2 is inert in ${\mathcal{O}}_K$; that is, $\mathfrak{P}=2{\mathcal{O}}_K$ is a prime ideal of ${\mathcal{O}}_K$ with residue field ${\mathcal{O}}_K/\mathfrak{P}\cong {\mathbb{F}}_4$. Define $\rho :{\mathcal{O}}_K^N\to {\mathbb{F}}_4^N$, as the componentwise reduction modulo $\mathfrak{P}$ and consider the $2N$-dimensional lattice ${\Gamma }_{\mathcal{C}}=({\rho }^{-1}\left(\mathcal{C}\right),b_{1/2})$, where $b_{1/2}(\mathbf{x},\mathbf{y})={\sum }_{i=1}^N{\mathrm{Tr}}_{K/\mathbb{Q}}(x_i{y}_i/2)$ and $\mathcal{C}$ is an $(N,k)$ linear code over ${\mathbb{F}}_4$. The volume of ${\Gamma }_{\mathcal{C}}$ is $\mathrm{vol}\left({\Gamma }_{\mathcal{C}}\right)={\left|d_K\right|}^{{\displaystyle \frac{N}{2}}}{4}^{N-k}{2}^{-N}$, where $d_K$ is given in (25)

$$d_K={(-1)}^{\varphi \left(6\right)/2}{\displaystyle \frac{6^{\varphi \left(6\right)}}{{\prod }_{p|6}{p}^{\varphi \left(6\right)/(p-1)}}}={\displaystyle \frac{-6^2}{2^2{3}^1}}=-3.$$

(71)

Thus, $vol\left({\Gamma }_{\mathcal{C}}\right)=3^{{\displaystyle \frac{N}{2}}}{2}^{N-2k}$. Equating $vol\left({\displaystyle \frac{1}{\sqrt{d}}}{\Gamma }_{\mathcal{C}}\right)$ and $vol\left({\Gamma }_{\mathcal{C}}^{*}\right)$ gives us $d^N=3^N{4}^{N-2k}$. If we consider a self dual code $\mathcal{C}$ over ${\mathbb{F}}_4$, $k=N/2$ and $d=3$. In principal, it seems that construction of a family of 3-modular lattices is possible. However, this is not true and we show this providing a counter example. Consider the self-dual code $\mathcal{C}=〈(1,\omega ,\omega +1,0),(1,1,1,1)〉$ [52], where ω is the primitive element of ${\mathbb{F}}_4$ and ${\omega }^2+\omega +1=0$. The Galois group of $K/\mathbb{Q}$ is $\mathcal{G}=\{{\sigma }_1,{\sigma }_2\}$, where ${\sigma }_1$ is the identity map and ${\sigma }_2$ is complex conjugation. The set $\{v_1=1,v_2={\zeta }_6\}$ forms a $\mathbb{Z}$-basis for ${\mathcal{O}}_K$ and $\{{\omega }_1=2,{\omega }_2=2{\zeta }_6\}$ forms a $\mathbb{Z}$-basis for $\mathfrak{P}$. The map $\rho :{\mathcal{O}}_K^N\to {\mathbb{F}}_4^N$ sends ${\zeta }_6$ to ω and using the following generator matrix for $\mathcal{C}$

$$\left[\begin{array}{cc}{\mathbf{I}}_2& \mathbf{A}\left(\mathrm{mod}\mathfrak{P}\right)\end{array}\right]=\left[\begin{array}{cccc}1& 0& \omega & \omega +1\\ 0& 1& \omega +1& \omega \end{array}\right],$$

(72)

we obtain

$$\mathbf{A}=\left[\begin{array}{cc}{\zeta }_6& {\zeta }_6+1\\ {\zeta }_6+1& {\zeta }_6\end{array}\right].$$

(73)

Using the above matrix $\mathbf{A}$ and the matrices in Proposition 5, gives us the generator matrix of ${\Gamma }_{\mathcal{C}}$

$$\mathbf{M}=\sqrt{2}\left[\begin{array}{cc}\Re {\sigma }_1\left(1\right)& \Im {\sigma }_2\left(1\right)\\ \Re {\sigma }_1\left({\zeta }_6\right)& \Im {\sigma }_2\left({\zeta }_6\right)\end{array}\right]=\sqrt{2}\left[\begin{array}{cc}1& 0\\ {\displaystyle \frac{1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}\end{array}\right],$$

(74)

$${\mathbf{M}}_p=\sqrt{2}\left[\begin{array}{cc}\Re {\sigma }_1\left(2\right)& \Im {\sigma }_2\left(2\right)\\ \Re {\sigma }_1\left(2{\zeta }_6\right)& \Im {\sigma }_2\left(2{\zeta }_6\right)\end{array}\right]=\sqrt{2}\left[\begin{array}{cc}2& 0\\ 1& -\sqrt{3}\end{array}\right],$$

(75)

$$\begin{array}{ccc}\hfill \mathbf{A}\tilde{\tilde{\otimes }}\mathbf{M}& =& \sqrt{2}\left[\begin{array}{cccc}\Re {\sigma }_1({\mathbf{A}}_{\mathbf{1}}\otimes \mathbf{v})& \Im {\sigma }_2({\mathbf{A}}_{\mathbf{1}}\otimes \mathbf{v})& \Re {\sigma }_1({\mathbf{A}}_{\mathbf{2}}\otimes \mathbf{v})& \Im {\sigma }_2({\mathbf{A}}_{\mathbf{2}}\otimes \mathbf{v})\end{array}\right]\hfill \\ & =& \sqrt{2}\left[\begin{array}{cccc}{\displaystyle \frac{1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}& {\displaystyle \frac{3}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}\\ {\displaystyle \frac{-1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}& 0& -\sqrt{3}\\ {\displaystyle \frac{3}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}& {\displaystyle \frac{1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}\\ 0& -\sqrt{3}& {\displaystyle \frac{-1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}\end{array}\right],\hfill \end{array}$$

(76)

$${\mathbf{D}}_{\alpha }=\left[\begin{array}{cc}\sqrt{{\sigma }_1\left({\displaystyle \frac{1}{2}}\right)}& 0\\ 0& \sqrt{{\sigma }_2\left({\displaystyle \frac{1}{2}}\right)}\end{array}\right]={\displaystyle \frac{1}{\sqrt{2}}}{\mathbf{I}}_2,$$

(77)

where $\tilde{\tilde{\otimes }}$ was defined in (45). Thus, the generator matrix of ${\Gamma }_{\mathcal{C}}$ is

$${\mathbf{M}}_{\mathcal{C}}=\left[\begin{array}{cccccccc}1& 0& 0& 0& {\displaystyle \frac{1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}& {\displaystyle \frac{3}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}\\ {\displaystyle \frac{1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}& 0& 0& {\displaystyle \frac{-1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}& 0& -\sqrt{3}\\ 0& 0& 1& 0& {\displaystyle \frac{3}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}& {\displaystyle \frac{1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}\\ 0& 0& {\displaystyle \frac{1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}& 0& -\sqrt{3}& {\displaystyle \frac{-1}{2}}& {\displaystyle \frac{-\sqrt{3}}{2}}\\ 0& 0& 0& 0& 2& 0& 0& 0\\ 0& 0& 0& 0& 1& -\sqrt{3}& 0& 0\\ 0& 0& 0& 0& 0& 0& 2& 0\\ 0& 0& 0& 0& 0& 0& 1& -\sqrt{3}\end{array}\right].$$

(78)

Computing the Gram matrix ${\mathbf{G}}_{\mathcal{C}}={\mathbf{M}}_{\mathcal{C}}{\mathbf{M}}_{\mathcal{C}}^t$ indicates that ${\Gamma }_{\mathcal{C}}$ is not integral and consequently is not modular.

The only case that was not considered in the previous theorems is the case where $n=2^r$, for $r>1$. In this case, we were unsuccessful in changing r and $\alpha$ in order to obtain a family of d-modular lattices. We should point out that when considering applications in information security only special values of d are accepted, more precisely, $d=1,2,3,5,6,7,11,14,15$ and 23 [53]. We could not find any modular lattice in our trials using cyclotomic number fields (with non-prime orders) and Construction A, that fulfil these conditions. Thus, these remain open problems.

Example 5.

Let $K=\mathbb{Q}\left({\zeta }_4\right)=\mathbb{Q}\left(i\right)$ be the cyclotomic field of order 4 with the ring of integers ${\mathcal{O}}_K=\mathbb{Z}\left[i\right]$. Then, K is a CM field and the prime $p=5$ splits completely in K as $5{\mathcal{O}}_K={\mathfrak{P}}_1{\mathfrak{P}}_2$, with residue field ${\mathcal{O}}_K/{\mathfrak{P}}_i\cong {\mathbb{F}}_5$, for $i=1,2$, where ${\mathfrak{P}}_1=5{\mathcal{O}}_K+(i-2){\mathcal{O}}_K$ and ${\mathfrak{P}}_2=5{\mathcal{O}}_K+(i-3){\mathcal{O}}_K$. Let $\mathcal{C}\subset {\mathbb{F}}_5^N$ be an $(N,k)$ self-dual code over ${\mathbb{F}}_5$. Then, $({\rho }^{-1}\left(\mathcal{C}\right),b_{1/2})$ with $b_{1/2}(\mathbf{x},\mathbf{y})={\sum }_{i=1}^N{\mathrm{Tr}}_{K/\mathbb{Q}}(x_i{\overline{y}}_i/2)$ is an integral lattice and its determinant is $5^N$. Thus, ${\rho }^{-1}\left(\mathcal{C}\right)$ has some necessary conditions to be a 5-modular lattice. However, one can check that this lattice is not 5-modular.

6.3. Secrecy Performance Characterization via Secrecy Gain and Flatness Factor

Computing the secrecy gain for unimodular lattices has been considered in [40]. Then, in [30,52], the authors propose some methods, based on the techniques introduced in [57] for calculating the theta series of modular lattices, to calculate the weak secrecy gain of $2,3$-modular lattices and 5-modular lattices, respectively. The introduced approaches to obtain a closed form expression for the theta series of modular lattices can be divided into two different cases: the modular form approach and the weight enumerator approach. The modular form approach relies on the fact that the theta series of an ℓ-modular lattice belongs to the space of modular forms generated by some basic functions, which gives a decomposition formula. The formula is given for ℓ-modular (possibly odd) lattices, which holds for the specific values of $\mathsf{\ell }=1,2,3,5,6,7,11,14,15,23$ [30,57]. A weight enumerator approach exploits the connection between the weight enumerator of a self-dual code and the theta series of a lattice constructed from this code. The theta series of a 5-modular lattice $\Gamma$, with dimension $n=2t$, can be written as [30,57], Lemma 2

$${\Theta }_{\Gamma }\left(\tau \right)=f_1{\left(\tau \right)}^t\sum _{i=0}^{⌊{\displaystyle \frac{5t}{8}}⌋}{a}_i{f}_2{\left(\tau \right)}^i,$$

(79)

where $f_1\left(\tau \right)={\vartheta }_3\left(\tau \right)\vartheta \left(5\tau \right)$ and

$$f_2\left(\tau \right)={\left({\displaystyle \frac{\eta \left(\frac{\tau }{2}\right)\eta \left(\frac{5\tau }{2}\right)\eta \left(2\tau \right)\eta \left(10\tau \right)}{\eta {\left(\tau \right)}^2\eta {\left(5\tau \right)}^2}}\right)}^{{\displaystyle \frac{8}{2}}},$$

(80)

in which $\eta$ is the Dedekind eta function which is defined by [88], Chapter 3

$$\eta \left(\tau \right)=q^{{\displaystyle \frac{1}{12}}}\prod _{m=1}^{\infty }(1-q^{2m}).$$

(81)

Equation (79) gives the theta series in terms of the unknown values $a_i$’s. An interesting computational approach has been proposed in [30] for the cases that $\mathsf{\ell }=2,3$. In their approach, the Gram matrix has been computed and inputted it to Magma [89] to generate the lattice $\Lambda$. The first few terms of ${\Theta }_{\Lambda }\left(\tau \right)$ have been obtained (using the command ThetaSeries$(\Lambda ,0,\mathrm{Ord})$;). Then, by solving a linear system of equations in terms of the unknowns $a_i$’s, the theta series has been obtained as polynomials in terms of basic functions ${\vartheta }_1,{\vartheta }_2,{\vartheta }_3$ which are implemented in Mathematica [90]. Then, the weak secrecy gains have been approximated using Mathematica. We are not able to use this approach for the obtained lattice in Example 3, because the Gram matrix of our lattices are not positive definite and it is a necessary condition for Magma to compute the theta series; we are not aware of other computer algebra packages for this task.

The main conclusion about the connection between the weak secrecy gain of the lattice and other lattice parameters has been reported in [53] after studying many examples. This conclusion is summarized as follows [53], Remark 4.12:

1.

When the dimension increases, the weak secrecy gain ${\chi }_{\Lambda }$ tends to increase, which has been proven for unimodular lattices [40].

2.

Fixing dimension and level d, a large length for the shortest non-zero vector is more likely to induce a large ${\chi }_{\Lambda }$.

3.

Fixing dimension, level d and the length of the shortest non-zero vector, a smaller kissing number gives a larger ${\chi }_{\Lambda }$. It was shown for unimodular lattices [40] that when the dimension n is fixed, $n\le 23$, the secrecy gain is totally determined by the kissing number, and the lattice with the best secrecy gain is the one with the smallest kissing number.

4.

Fixing dimension, the length of the shortest non-zero vector, kissing number, and a smaller level d gives a bigger ${\chi }_{\Lambda }$. However, the lattices with high level d are more likely to have a large length for the shortest non-zero vector.

6.4. Motivation for Indefinite Theta Series in Physical Layer Security

The construction of p-modular lattices in our framework inevitably produces lattices whose Gram matrices are not positive definite and have indefinite signature. While this is a natural outcome from the algebraic constraints imposed by the construction, it creates a fundamental obstacle: the classical theta series ${\Theta }_{\Lambda }\left(\tau \right)={\sum }_{x\in \Lambda }{q}^{2Q\left(x\right)}$, $q=e^{\pi i\tau }$, is only absolutely convergent on the unit disk when the quadratic form Q is positive definite. For indefinite lattices, the summand does not decay fast enough along directions of positive norm, and the series diverges on the unit circle. This prevents the direct use of standard tools from modular lattice theory for computing secrecy gain, flatness factor, or any performance metric that depends on the analytic behavior of ${\Theta }_{\Lambda }\left(\tau \right)$.

Mathematical advances in the theory of indefinite theta series, most notably the work of Zwegers [56] and the general framework developed in [55], provide a way around this difficulty. Instead of attempting to force convergence by restricting the lattice or modifying the construction, one replaces the classical theta series by a modular completion built from special kernels that regularize the contribution of directions with positive norm. These kernels are expressed in terms of generalized error functions, such as $E_1$, $M_1$ in the Lorentzian case and their higher-dimensional analogues $E_2$, $M_2$ for signature $(2,n-2)$ lattices. The key insight is that these functions interpolate smoothly between the discontinuous sign functions that appear in naive truncations of the lattice sum, while still satisfying Vignéras’ differential equation and thus preserving modular covariance.

From the perspective of physical-layer security, this development is highly relevant. The secrecy rate and the eavesdropper’s decoding probability are governed by the flatness factor of the lattice, which in turn depends on the behavior of its theta series near the unit circle. As we discussed earlier, for positive definite lattices, the flatness factor admits a clean expression in terms of ${\Theta }_{\Lambda }\left(\tau \right)$ evaluated at purely imaginary arguments. However, for the indefinite lattices produced by our construction, the classical theta series is not defined in this regime. The modularly completed indefinite theta series, on the other hand, is well defined and exhibits controlled analytic behavior even when the underlying quadratic form has mixed signature.

This observation motivates the study of indefinite theta series as a natural analytic tool for characterizing secrecy performance. The completed theta series captures the oscillatory structure of the lattice while regularizing divergent contributions, allowing us to define meaningful analogues of the flatness factor and secrecy gain. Moreover, the modular properties of the completed series provide structural constraints that can be exploited to bound or approximate the eavesdropper’s error probability. In particular, the smoothing induced by the generalized error functions plays a role analogous to artificial noise in physical-layer security: it suppresses the contribution of directions that would otherwise leak information to the eavesdropper.

In summary, although our construction yields indefinite lattices for which the classical theta series is not applicable, the modern theory of indefinite theta series offers a principled replacement. This framework not only restores analytic control but also reveals deeper connections between lattice geometry, modularity, and secrecy performance. Consequently, the study of indefinite theta series is not merely a mathematical necessity but a promising avenue for developing new secrecy metrics and designing lattice codes optimized for physical layer security.

Indefinite Quadratic Forms, Vignéras’ Operator, and Generalized Error Functions

The analytic framework for handling theta series associated with indefinite lattices relies on several structural definitions. These notions originate in the modern theory of indefinite theta series and generalized error functions, and they provide the mathematical backbone for constructing modularly well-behaved completions of divergent lattice sums [55].

Let $\Lambda$ be a lattice equipped with a symmetric bilinear form $B(·,·)$ and associated quadratic form $Q\left(x\right)=B(x,x)$, where $x\in \Lambda \otimes \mathbb{R}$. The form Q is said to have signature$(n_{+},n_{-})$ if it has $n_{+}$ positive and $n_{-}$ negative eigenvalues. In our construction of p-modular lattices, the Gram matrices naturally acquire mixed signature, which places us in the regime $n_{+}\ge 1$ where classical theta series fail to converge.

Definition 17

(Vignéras’ Operator). Let Λ be a lattice equipped with a symmetric bilinear form $B(·,·)$ of signature $(n_{+},n_{-})$, and let $Q\left(x\right)=B(x,x)$ denote the associated quadratic form. We write $B^{-1}$ for the bilinear form on the dual space whose matrix is the inverse of the matrix of B. Following the general framework of Vignéras, we introduce the second–order differential operator [54]

$${\mathcal{W}}_{\lambda }\Phi \left(x\right):={\Delta }_{B^{-1}}\Phi \left(x\right)+2\pi x·{\nabla }_x\Phi \left(x\right)-2\pi \lambda \Phi \left(x\right),$$

(82)

where ${\Delta }_{B^{-1}}$ is the Laplacian associated with $B^{-1}$ and $x·{\nabla }_x$ is the Euler operator. A function $\Phi \left(x\right)$ is said to be a Vignéras kernel of weight λ if it satisfies the differential equation

$${\mathcal{W}}_{\lambda }\Phi \left(x\right)=0.$$

(83)

Solutions of (83) play a central role in the construction of modular completions of indefinite theta series. In particular, when $\Phi$ satisfies suitable decay conditions, the associated theta series transforms as a Jacobi form of weight $\lambda +{\displaystyle \frac{n}{2}}$, even when the underlying quadratic form Q has mixed signature.

Definition 18

(Indefinite Theta Series with Kernel [55]). Given a kernel $\Phi \left(x\right)$ satisfying mild growth conditions, one defines the regularized theta series

$$\begin{array}{c}\hfill {\Theta }_{\Phi }(\tau ,b,c)=\sum _{k\in \Lambda +\mathcal{P}/2}{(-1)}^{B(k,\mathcal{P})}{q}^{-2Q(k+b)}{e}^{2\pi iB(c,k+b)}\Phi (k+b),\end{array}$$

(84)

where $\mathcal{P}$ is a characteristic vector and $(b,c)$ are real shifts.

When $\Phi$ is locally constant (e.g., a sign function), the series is holomorphic but not modular; when $\Phi$ solves Vignéras’ equation, the series is modular but non-holomorphic. The modular completion replaces the discontinuous kernel by a smooth one.

Definition 19

(Generalized Error Functions [55]). For signature $(1,n-1)$, the classical error function

$$\begin{array}{c}\hfill E_1\left(u\right)=\mathrm{Erf}\left(\sqrt{\pi }u\right),\end{array}$$

(85)

where $\mathrm{Erf}\left(x\right)={\displaystyle \frac{2}{\sqrt{\pi }}}{\int }_0^x{e}^{-t^2}dt$, and its complementary counterpart

$$\begin{array}{c}\hfill M_1\left(u\right)=-\mathrm{sign}\left(u\right)\mathrm{Erfc}\left(\right|u|\sqrt{\pi }),\end{array}$$

(86)

in which $\mathrm{Erfc}\left(x\right)=1-\mathrm{Erf}\left(x\right)={\displaystyle \frac{2}{\sqrt{\pi }}}{\int }_x^{\infty }{e}^{-t^2}dt$, provide the smoothing needed to regularize the theta series.

In higher signature, one introduces double error functions $E_2$ and $M_2$, depending on two real variables $(u_1,u_2)$ and a geometric parameter controlling the angle between the associated hyperplanes. These functions interpolate between piecewise-constant sign kernels and smooth solutions of Vignéras’ equation on ${\mathbb{R}}^2$.

Definition 20

(Modular Completion [55]). Given a discontinuous kernel ${\Phi }_{\mathrm{disc}}$ (typically built from sign functions that restrict the lattice to a cone), its modular completion is constructed by replacing each sign term with the corresponding smooth error function:

$$\begin{array}{c}\hfill {\Phi }_{\mathrm{comp}}\left(x\right)={\Phi }_{\mathrm{disc}}\left(x\right)+(correctiontermsbuiltfrom{M}_1,M_2,\mathrm{etc}.).\end{array}$$

(87)

The resulting completed theta series is modular and well-behaved on the unit circle, even when Q is indefinite. These definitions allow us to reinterpret the divergent theta series associated with our p-modular constructions as regularized indefinite theta series. This provides a mathematically rigorous pathway to define secrecy-relevant quantities—such as flatness factor and secrecy gain—even when the underlying lattice is not positive definite.

6.5. Quantitative Comparison of Lattice Families for PLS

To position the proposed p-modular lattices within the broader framework of algebraic lattice design for physical-layer security, we compare their principal structural invariants like signature, discriminant, and modularity constant, which together with the minimum norm and kissing number, strongly influence shaping behavior, coding efficiency, and the analytic feasibility of secrecy metrics.

Table 2. Secrecy-relevant indicators for classical and proposed lattice families, including signature and definiteness.

Lattice Family	Construction Setting	Field Signature	Is Definite?	Secrecy Implications
Unimodular lattices	Integral, positive-definite	$(n,0)$	Yes	Classical secrecy gain and flatness factor available; strong shaping
q-modular lattices	Integral, positive-definite	$(n,0)$	Yes	Classical secrecy metrics applicable; good confusion at Eve
Lattices from cyclotomic fields	Canonical embedding or Construction A	CM: $(0,{\displaystyle \frac{n}{2}})$ or real: $(n,0)$	Yes	Classical secrecy metrics applicable (positive-definite theta series)
Proposed p-modular lattices	As in Theorem 13: $K=\mathbb{Q}\left({\zeta }_p\right)$, $\alpha =1/\sqrt{p}$	CM: $(0,{\displaystyle \frac{p-1}{2}})$	No, mixed signature $(n_{+},n_{-})$	Classical secrecy gain fails for analytic model; modularly completed indefinite theta series required for secrecy-relevant quantities
Prime-power cyclotomic fields $\mathbb{Q}\left({\zeta }_{p^r}\right)$, $r>1$	No modular Construction A lattice	CM: $(0,{\displaystyle \frac{\varphi \left(p^r\right)}{2}})$	Not applicable	Not suitable for PLS under generalized Construction A

summarizes these invariants across classical and newly introduced families. Beyond these structural aspects, secrecy-relevant analytic behavior must be interpreted in light of the dependencies identified in [53], Remark 4.12: the weak secrecy gain ${\chi }_{\Lambda }$ tends to increase with dimension; it improves with larger minimum norm; it decreases with larger kissing number when dimension, level, and minimum norm are fixed; and, for fixed geometric parameters, smaller level d generally yields larger ${\chi }_{\Lambda }$, while higher levels often enable larger minimum norms. These principles provide a quantitative framework for evaluating the proposed p-modular lattices.

For $K=\mathbb{Q}\left({\zeta }_p\right)$, the discriminant satisfies $\left|\mathrm{disc}\left(K\right)\right|=p^{p-2}$, and the modularity constant p imposes strong arithmetic constraints on the admissible combinations of volume, minimum norm, and kissing number. Moreover, the total ramification of p in $\mathbb{Q}\left({\zeta }_p\right)$ facilitates Construction A lattices for which the minimum norm can be improved through the underlying code while keeping the growth of the kissing number analytically tractable. In this sense, the p-modular family occupies a structurally advantageous region of the secrecy-design landscape: the dimension grows linearly with p, the minimum norm is tunable via the code, and the kissing number can be studied and bounded through the explicit cyclotomic embedding.

Indeed, in the cyclotomic setting, the kissing number of the associated lattices can be analyzed with finer arithmetic control by exploiting the explicit $\mathbb{Q}$-embedding of ${\mathcal{O}}_K$ into Euclidean space. For $K=\mathbb{Q}\left({\zeta }_p\right)$, the canonical embedding $\sigma :K\hookrightarrow {\mathbb{C}}^{(p-1)/2}$ (or its realification into ${\mathbb{R}}^{p-1}$) is determined by the embeddings ${\sigma }_j\left({\zeta }_p\right)=\exp \left({\displaystyle \frac{2\pi ij}{p}}\right)$, $1\le j\le {\displaystyle \frac{p-1}{2}}$, where each ${\sigma }_j$ is paired with its complex conjugate. Writing $x\in {\mathcal{O}}_K$ in the power basis $x={\sum }_{k=0}^{p-2}{a}_k{\zeta }_p^k$ with $a_k\in \mathbb{Z}$, the Euclidean norm of its image is

$$\begin{array}{c}\hfill {\parallel \sigma \left(x\right)\parallel }^2=\sum _{j=1}^{(p-1)/2}{\left|{\sigma }_j\left(x\right)\right|}^2=\sum _{j=1}^{(p-1)/2}{\left|\sum _{k=0}^{p-2}{a}_k\exp \left({\displaystyle \frac{2\pi ijk}{p}}\right)\right|}^2,\end{array}$$

(88)

which is an explicit positive-definite quadratic form in the integer vector $(a_0,\dots ,a_{p-2})$. The Construction A lattices considered in this work are obtained by embedding codewords with coordinates in (the image of) ${\mathcal{O}}_K$ and then scaling by a suitable power of the prime above p, so any non-zero lattice vector corresponds to a tuple $(x_1,\dots ,x_N)\in {\mathcal{O}}_K^N$ whose Euclidean norm is given by ${\sum }_{i=1}^N{\parallel \sigma \left(x_i\right)\parallel }^2$, again an explicit quadratic form in the underlying integer coefficients. The minimum norm ${\lambda }_1(\Lambda )$ is therefore the minimum of this quadratic form over a discrete subset of ${\mathbb{Z}}^{(p-1)N}$ determined by the code constraints, and candidate shortest vectors can be characterized by bounding the integer coefficients $a_k$.

From the arithmetic side, the algebraic norm $N_{K/\mathbb{Q}}\left(x\right)={\prod }_{j=1}^{p-1}{\sigma }_j\left(x\right)$ is an integer and satisfies an inequality of the form

$$\begin{array}{c}\hfill |N_{K/\mathbb{Q}}\left(x\right)|\le C_p{\parallel \sigma \left(x\right)\parallel }^{p-1},\end{array}$$

(89)

for a constant $C_p$ depending only on p. Thus, any bound on the Euclidean norm imposes a corresponding bound on $|N_{K/\mathbb{Q}}\left(x\right)|$. Consequently, the set of $x\in {\mathcal{O}}_K$ that can contribute to shortest vectors lies in a finite, explicitly describable subset of ${\mathcal{O}}_K$ cut out by simultaneous constraints on ${\parallel \sigma \left(x\right)\parallel }^2$ and $|N_{K/\mathbb{Q}}\left(x\right)|$. Moreover, the Galois group $\mathrm{Gal}(K/\mathbb{Q})\cong {(\mathbb{Z}/p\mathbb{Z})}^{\times }$ acts transitively on the embeddings ${\sigma }_j$ and preserves the Euclidean norm, so (under the natural assumption that the lattice and the code constraints are stable under this action) if x yields a shortest vector, then so do all its Galois conjugates, which form orbits whose sizes divide $p-1$. As a consequence, the multiplicity of shortest vectors (and hence the kissing number) can be expressed in terms of the number of Galois orbits of algebraic integers (or code-constrained tuples) achieving ${\lambda }_1(\Lambda )$, each orbit contributing a controlled number of vectors. Altogether, the explicit quadratic form arising from the cyclotomic embedding, the finiteness imposed by algebraic norm bounds, and the orbit structure induced by the Galois action ensure that both the minimum norm and the kissing number of the resulting p-modular lattices can be studied and bounded through the cyclotomic embedding, rather than treated as opaque geometric invariants of an arbitrary Euclidean lattice.

Although the analytic lift of these lattices has mixed signature, which makes classical positive-definite theta-series techniques inapplicable, recent advances on modular completions of indefinite theta series provide a natural analytic framework for assessing their secrecy performance. Taken together, these structural constraints and analytic tools indicate that the proposed p-modular lattices are well aligned with the geometric and arithmetic features empirically associated with large secrecy gain, and they therefore constitute a technically robust and theoretically well-motivated class of lattices for high-dimensional physical-layer security.

6.6. Open Problems and Future Research Directions

The interplay between indefinite theta series and physical-layer security opens a number of intriguing research avenues. A central open problem is the development of secrecy metrics, such as generalized flatness factors or secrecy gains, that remain analytically meaningful when the underlying lattice has mixed signature and the classical theta series diverges. Closely related is the challenge of characterizing the behavior of modular completions built from higher-dimensional error functions (e.g., $E_2$ and $M_2$) in channel regimes relevant to wiretap coding, particularly when the noise distribution interacts nontrivially with the time-like and space-like directions of the lattice. Another promising direction is the design of coding schemes whose secrecy performance can be directly optimized through the geometry of indefinite cones, potentially leveraging the structural constraints imposed by Vignéras’ equation. Extending these ideas to signatures $(n_{+},n_{-})$ with $n_{+}>2$, where triple and higher-order generalized error functions arise, remains largely unexplored and may reveal new analytically tractable lattice families. Finally, bridging the gap between the abstract modular-analytic theory and practical wiretap coding through numerical approximations, simulation frameworks, or machine-assisted optimization of indefinite kernels represents a fertile direction for future research.

7. Discussion and Integration into Modern Wireless Systems

The evolution toward next-generation wireless networks is characterized by the adoption of advanced paradigms that fundamentally reshape wireless communication. Within this landscape, lattice-based PLS offers both significant opportunities and formidable challenges. Modern architectures such as multi-antenna systems (MIMO and massive MIMO), RIS, and ML–driven optimization are no longer peripheral enhancements but central pillars of wireless design. Their integration with algebraic lattice coding introduces new dimensions of secrecy: spatial degrees of freedom, programmable propagation environments, and data-driven adaptation can be harnessed to reinforce the confusion of eavesdroppers while sustaining reliability for legitimate users [91]. This section explores how the code-based wiretap approaches like lattice-code surveyed earlier can be adapted to, and enriched by, these emerging technologies. For each paradigm, we highlight recent advances, analyze how lattice coset structures interact with the new physical and algorithmic features, and identify open research directions that define the frontier of secure 6G system design.

7.1. MIMO and Massive MIMO Deployment

Massive MIMO has emerged as a cornerstone of 5G and 6G wireless systems, offering unprecedented spectral efficiency and reliability by exploiting large antenna arrays to serve multiple terminals simultaneously. Beyond throughput, these spatial degrees of freedom provide new opportunities for physical-layer security. By carefully designing precoders and injecting artificial noise (AN), transmitters can degrade the eavesdropper’s channel while maintaining high- quality links for legitimate users. Recent works have demonstrated that secrecy capacity in massive MIMO can be significantly improved by exploiting channel hardening and favorable propagation. For example, refs. [92,93] analyzed secrecy in spherical-wave channels and showed that near-field beamforming can be leveraged to enhance PLS in practical deployments. Similarly, ref. [94] studied secrecy guard zones in ultra-reliable low-latency communications (uRLLC), highlighting how dense antenna deployments can enforce spatial secrecy constraints under strict latency requirements.

While these approaches rely on spatial processing, lattice codes provide an algebraic complement. Nested lattice coset coding introduces structured randomness that confuses the eavesdropper independently of channel state information (CSI) assumptions. Semantically secure lattice codes for compound MIMO channels, as developed by [95], demonstrate that secrecy can be achieved even under partial or uncertain CSI. These constructions align naturally with massive MIMO, where imperfect CSI is common due to pilot contamination and feedback delays. By embedding cyclotomic p-modular lattices (with $p\equiv 1\left(\mathrm{mod}4\right)$) into space–time blocks, one can exploit unit-group rotations and Minkowski embeddings to maintain low flatness factor at Eve while preserving diversity and rate at the receiver. The dual lattice’s theta series governs Eve’s confusion, and when combined with AN in unused spatial dimensions, secrecy gain can be amplified.

Cell-free massive MIMO extends these ideas by distributing many access points (APs) to jointly serve users via coherent transmission. This architecture inherently reduces Eve’s ability to gain coherent combining benefits in passive scenarios. Ref. [96] showed that secure transmission in cell- free systems can be maintained against active eavesdroppers by coordinating AN and robust power control. More recently, ref. [97] analyzed secrecy rate degradation under pilot contamination and proposed secure pilot design strategies for cell-free networks. These findings suggest that lattice-coded pilots, constructed from collision-resistant projections of cyclotomic lattices, could further mitigate spoofing attacks, while coset-coded payloads ensure resilience against residual leakage. In ultra-dense cell-free deployments, ref. [96] demonstrated that secrecy can be preserved even under hardware impairments by adopting rate-splitting multiple access (RSMA), opening avenues for lattice-coded RSMA schemes.

From a lattice perspective, space–time lattice designs remain particularly attractive. Semantically secure lattice codes for compound MIMO channels [94] and design criteria for MIMO wiretap channels [98] provide theoretical foundations for integrating algebraic lattices into multi-antenna secrecy. By aligning legitimate codewords with the receiver’s dominant singular vectors and dispersing Eve’s projections through lattice rotations, one can systematically engineer flatness factors that remain low at Eve. In multi-receiver wiretap scenarios, refs. [99,100] characterized optimal encoding orders for Gaussian MIMO channels, offering guidance for scheduling lattice layers across streams to maintain confidentiality. These results highlight the synergy between algebraic lattice coding and massive MIMO: spatial degrees of freedom create controllable subspaces for secrecy-aware transmission, while structured cosets ensure persistent confusion at Eve independent of beamforming imperfections.

The trade-offs are clear. Multi-antenna lattice precoding can significantly improve secrecy capacity but requires careful CSI acquisition and high-complexity decoding. Sphere decoding scales poorly with dimension, and while massive MIMO provides many antennas, practical receivers often limit effective dimensionality per codeword to meet latency constraints. Hybrid designs, such as block-diagonal space–time lattices or multi-layer coset coding with short lattices, can deliver secrecy gains without prohibitive complexity. Emerging ML-aided lattice decoders may further reduce decoding burden, though interpretability and robustness against adversarial attacks remain open challenges. Ultimately, joint precoder–lattice co-design under imperfect CSI, pilot contamination, and energy constraints offers a realizable path to secrecy gains in 5G/6G MIMO systems.

7.2. RIS-Aided Communications

Reconfigurable intelligent surfaces change the secrecy game by turning the propagation environment into a controllable design variable. An RIS is a planar array of passive elements whose reflection coefficients (amplitude and/or phase) can be programmed to reshape multipath, steer energy, and create constructive or destructive interference patterns at chosen spatial locations. For physical-layer security, this capability enables a new class of defenses: instead of relying only on transmitter beamforming or artificial noise, the network can program the channel so that the legitimate receiver sees a strengthened, well-conditioned effective lattice channel while the Eve sees a scrambled, low-mutual-information projection. This programmable geometry is a natural partner for algebraic lattice codes, because lattice secrecy metrics (flatness factor, secrecy gain, and dual-lattice theta series) are fundamentally geometric and therefore directly affected by RIS-induced channel transformations [101,102].

Recent works have established RIS as an effective secrecy tool in a variety of practical settings. The authors in [103] analyzed RIS-aided links with mobile or unmanned aerial vehicle (UAV) eavesdroppers and show that RIS phase control can substantially increase ergodic secrecy capacity by dispersing Eve’s channel gains and reducing its coherent combining opportunities. UAV-mounted RIS and jointly optimize UAV trajectory and RIS phase profiles have been studied by [104] to maximize secrecy rate under realistic CSI uncertainty, demonstrating that mobility plus programmable reflections yields large secrecy improvements over static deployments. Advancing physical-layer security in RIS-assisted wireless systems, the authors in [101] address multi-user secrecy in intelligent reflective surfaces (IRS)-aided systems and propose joint beamformer–phase optimization algorithms that balance secrecy across users while respecting RIS hardware constraints. These works make two points clear for lattice-based secrecy: (i) RIS can amplify the channel asymmetry that lattice coset coding exploits, and (ii) RIS constraints (finite phase resolution, training overhead, and imperfect CSI) must be explicitly modeled when designing algebraic codes for RIS channels.

From the lattice-coding side, there is a compact set of rigorous results that translate naturally to RIS contexts. A lattice design criterion presented in [105] for wiretap channels correlates algebraic diversity and minimum distance with secrecy performance. This criterion pinpoints algebraic parameters that increase the eavesdropper’s flatness factor under conditions where the effective channel is favorable to the legitimate receiver. In [102], Near-Field RIS secure lattice constructions were developed for compound channels, with the investigation revealing that control over the flatness factor facilitates information-theoretic secrecy, even amidst channel uncertainty. Also, ref. [106] constructs almost universal modular coding structures that achieve secrecy capacity and enable quantum-resistant authentication and key agreement, making them compatible with lattice-based RIS-assisted 6G networks. It considers a range of fading wiretap channels, demonstrating robustness of algebraic lattices to channel variations. Although these lattice works were not written specifically for RIS, their secrecy metrics are channel-geometric: an RIS that reshapes singular vectors and path gains directly changes the lattice embedding seen by the receiver and Eve. Therefore, the algebraic design aspects identified in these works (index, discriminant, unit rotations, and modularity) can be jointly optimized with the RIS phase shifts.

Putting these strands together suggests concrete design recipes and research directions:

• Co-optimization of RIS phases and lattice rotations. Treat RIS phase settings and lattice unit rotations as coupled variables in a secrecy objective that directly includes the flatness factor or secrecy gain. The RIS can be used to align the receiver’s effective channel with lattice directions that maximize minimum distance, while simultaneously dispersing Eve’s projections to increase the flatness factors.
• Robust coset scheduling under quantized RIS control. Practical RIS hardware has finite phase resolution and limited update rates. Design cyclotomic p-modular coset families whose decoding regions are tolerant to small phase errors, and schedule coset randomization across coherence blocks so that Eve cannot average out RIS-induced randomness.
• Pilot and training design using lattice structure. Pilot contamination and insecure feedback are major RIS vulnerabilities. Lattice-structured pilots (pilots drawn from carefully chosen coset representatives) can make spoofing harder and enable joint pilot–phase estimation algorithms that exploit algebraic redundancy to detect active attacks.
• Mobility and time-varying RIS strategies. For UAV-RIS or mobile RIS platforms, synchronize coset changes with RIS trajectory/phase updates so that Eve’s channel observations are decorrelated over time; this temporal diversity compounds the spatial confusion provided by lattice cosets.
• Complexity-aware implementations. High-dimension lattices yield strong secrecy gains but heavy decoding cost. Use block-diagonal or layered lattice constructions that match RIS-created subspaces, enabling per-subspace decoding with moderate complexity while preserving global secrecy metrics.

There are also important practical challenges. Accurate CSI is essential for effective RIS phase optimization; imperfect CSI reduces the ability to align lattice directions and can leak structure to Eve if not handled carefully [107]. Channel estimation overhead for RIS-assisted links is nontrivial, and secure feedback channels for RIS control are required to prevent adversarial reconfiguration. Finally, hardware impairments (phase noise, element coupling, and quantization) change the effective lattice seen by receivers; algebraic constructions with built-in robustness (e.g., modular lattices with favorable discriminants and unit groups) are promising candidates to absorb such distortions [105,108].

In short, RIS and lattice codes are complementary: RIS provides a programmable, geometric degree of freedom that can be exploited to shape the lattice channel in favor of secrecy, while algebraic lattice constructions provide provable, information-theoretic secrecy metrics that guide RIS optimization. Because the studies that jointly analyze lattice codes and RIS secrecy are still sparse, a high-impact research agenda is to develop rigorous flatness-factor and secrecy-gain analyses for RIS-transformed lattice channels, accompanied by practical co-design algorithms that respect RIS quantization, training, and complexity constraints.

7.3. Potential Machine-Learning Integration

Machine learning is increasingly leveraged in wireless systems, and physical-layer security is no exception. Deep learning can, for example, learn to optimize transmit strategies or to detect eavesdropping anomalies in complex environments. In the context of lattice-based PLS, ML can aid both encoding and decoding. On the encoding side, reinforcement learning has been proposed to tune IRS or UAV parameters for secrecy, effectively learning good RIS configurations without full CSI. For instance, ref. [109] apply a deep deterministic policy gradient (DDPG) algorithm to jointly optimize the phases of UAV-mounted RIS and achieve a high secrecy rate in a complex cell-free MIMO scenario. This demonstrates that ML can help solve the non-convex optimization problems arising in coded secure transmission. On the decoding side, one might employ neural-network-based lattice decoders that approximate maximum-likelihood decoding for high-dimensional lattices, reducing complexity. Preliminary work on deep decoders for lattice codes suggests that neural nets can learn to invert lattice quantization under noise [110,111].

Moreover, ML can assist in estimating the eavesdropper’s channel or in implementing privacy amplification: for example, a neural network could predict the secrecy outage probability of a given lattice code in fading environments, and adapt the code parameters (such as choosing among different cyclotomic lattices); accordingly, [112] presents a dynamic range query privacy-preserving scheme for blockchain-enhanced smart grid based on lattice. Conversely, one must be cautious of adversarial machine learning: an intelligent eavesdropper might use ML to infer the lattice structure or to mount new attacks.

The literature on learning for secure communications is rapidly growing. In addition to the DDPG [113], there are broad surveys of ML for wireless security. For example, ref. [114] overview 5G-and-beyond privacy-preserving data-driven learning models for emerging communication networks and mention the use of learning algorithms for joint communication and physical-layer security. The authors in [115] study intelligent decentralized federated graph learning with lightweight zero trust architecture for next-generation networking security, making it compatible with lattice-based architectures. These and related works indicate that ML can augment lattice-based schemes, but also that integrating ML introduces new trade-offs: learning models need data and training time, and their decisions may lack provable guarantees (in contrast to information-theoretic lattice designs). Ensuring the reliability and interpretability of ML-aided PLS algorithms is thus an open challenge.

7.4. Open Problems

The integration of modular lattice codes into MIMO, RIS, and ML-based systems raises many research questions. First, designing optimal lattice codes for MIMO wiretap channels remains unsolved: how to choose p-modular lattices that maximize secrecy gain under multi-antenna constraints and imperfect CSI? Closed-form design criteria (generalizing flatness factor) for fading MIMO channels are still lacking. Second, implementation complexity is a major issue: effective high-dimensional lattice decoding in real time (especially over MIMO) is challenging. Hybrid schemes that combine lattices with more conventional MIMO precoding need exploration. Third, in RIS-assisted systems, joint optimization of lattice cosets and RIS phases is a new design space. How to quantize phase shifts to preserve lattice secrecy, and how to coordinate distributed RIS elements for cooperative secrecy coding, are open problems. Additionally, the discrete nature of p-modular lattices (integer ring structure) may need adaptation to the analog domain of RIS (like continuous phase).

From a machine learning perspective, integrating data-driven methods with algebraic coding raises questions of generalization and security: can learning algorithms reliably optimize lattice-coded transmissions for secrecy across diverse channel conditions? How can we guard against learned models that may overfit or be fooled by adversaries? The intersection of ML and lattice coding is largely unexplored. Finally, multi-user and network scenarios (multiple eavesdroppers, relays, or feedback links) have not been studied with cyclotomic lattice codes. Extending these codes to distributed networks (for example, using compute-and-forward or cooperative jamming with lattices) is a rich avenue for future work. Modern intelligent wireless platforms offer new tools for physical-layer security, but they also introduce new vulnerabilities and design complexities. The algebraic and geometric features of $p\equiv 1\left(\mathrm{mod}4\right)$ cyclotomic lattices (e.g., rich unit groups, well-roundedness) may be leveraged to meet these challenges. For instance, their flatness factors could potentially be engineered to remain low over the enhanced channels in RIS environments, or ML could be used to approximate optimal decoding. Nevertheless, rigorous analysis and prototypes are needed to validate these ideas in practice.

8. Conclusions

This article has provided a comprehensive survey bridging the theoretical richness of algebraic lattice theory with its critical applications in physical-layer security for wireless communications. We established the foundational models of wireless wiretap channels and detailed essential information-theoretic secrecy metrics such as secrecy gain and flatness factor, which remain central to evaluating the confidentiality of lattice-coded transmissions. Our exposition moved from algebraic number theory fundamentals and Construction A to modular and unimodular lattice families, consolidating classical and modern results into a unified framework that highlights the deep interplay between algebraic structures and secure communication. In addition, we reviewed a newly proposed family of p-modular lattices constructed from cyclotomic number fields $\mathbb{Q}\left({\zeta }_p\right)$ for primes $p\equiv 1\left(\mathrm{mod}4\right)$, developed through a generalized Construction A methodology. We rigorously characterized their algebraic and geometric properties and established a non-existence theorem for p-modular lattices arising from prime-power cyclotomic fields $\mathbb{Q}\left({\zeta }_{p^n}\right)$ with $n>1$. These results provide concrete engineering design principles, identifying both viable construction pathways and fundamental structural limitations for future lattice code development.

Another future research direction is the integration of recent advances in the theory of indefinite theta series and modular completions. Since these p-modular constructions naturally yield lattices with mixed signature, the classical theta series fails to converge on the unit circle, rendering traditional secrecy metrics inapplicable. By drawing on the modern framework of Vignéras’ differential equation and the generalized error functions $E_1,M_1,E_2,M_2$, we highlighted how modularly completed indefinite theta series offer a principled analytic replacement. This perspective opens the door to defining secrecy-relevant quantities for indefinite lattices and suggests new directions for characterizing flatness, smoothing, and eavesdropper performance through the geometry of time-like and space-like directions.

The broader implications of this research are significant for next-generation wireless systems. The algebraic structure, modular behavior, and potential secrecy advantages of these lattices make them promising candidates for integration into advanced communication paradigms such as Massive MIMO, RIS-aided architectures, and machine-learning-driven optimization. By combining algebraic number theory, modular analysis, and physical-layer security, this paper serves as both a tutorial and a design resource, guiding researchers and engineers in leveraging sophisticated mathematical tools to build robust, analyzable, and secure wireless networks for the future.