Amortized Σ-Protocol for MLWE Problem

Abstract

MLWE is a fundamental hard problem in post-quantum lattice cryptography. Standard $\Sigma$-protocols perform poorly for multiple MLWE statements due to high communication and computation costs. This paper presents an amortized $\Sigma$-protocol for MLWE using a lightweight fold-split-fold technique that decomposes norm-bounded error vectors without relying on NTT, MLE, or sum-check protocols. The protocol achieves completeness, special soundness, and non-abort SHVZK with constant-round interaction and lightweight verification. The construction avoids complex tools and provides an efficient batch proof mechanism, offering a simple and practical solution for post-quantum cryptographic applications.

1. Introduction

Zero-knowledge proofs (ZKPs) [1] allow a prover to convince a verifier of the validity of a statement without revealing any secret information. As a classic three-round public-coin zero-knowledge framework, $\Sigma$-protocols [2] are widely adopted for their high efficiency, easy composition, and straightforward security proofs.

In scenarios such as authenticated key agreement protocols [3,4,5], secret sharing [6,7], post-quantum signatures [8,9,10,11,12], and cryptographic building blocks [13,14], we often need multiple $\Sigma$-protocols. In these cases, the number of instances to be proven by traditional $\Sigma$-protocols increases linearly, resulting in low efficiency. Against this background, Cramer and Damgård proposed amortized $\Sigma$-protocols [15]. Since their introduction, amortized $\Sigma$-protocols have been widely applied in anonymous transactions [16], identity management systems [17], and encryption [18]. These protocols greatly reduce communication and verification costs, supporting practical large-scale privacy-preserving systems [19,20].

Lattice-based cryptography has emerged as a leading candidate for post-quantum security due to its strong worst-case hardness and algebraic simplicity. However, early constructions based on standard LWE or Ring LWE suffer from either large key sizes (LWE) or restricted algebraic structures (Ring-LWE). To balance security, efficiency, and flexibility, the Module Learning with Errors (MLWE) problem [21,22] was introduced. MLWE works over module lattices, which offer a middle ground between the high dimensionality of LWE and the strong constraints of Ring-LWE. As a result, MLWE is now a core hardness assumption for lattice cryptography. Many practical zero-knowledge proofs rely on it. It is also used in other primitives, like encryption [23].

This paper considers the $\Sigma$-protocol for MLWE, as detailed below. Section 2 presents the definitions of $\Sigma$-protocols, MLWE, and relevant notations. Section 3 details the construction and security proofs of the proposed amortized MLWE $\Sigma$-protocol. Section 4 analyzes parameter selection and performance. Finally, Section 5 concludes the whole study.

1.1. Related Work

In 1991, Schnorr [24] proposed the first three-round interactive proof based on the discrete logarithm problem, pioneering the $\Sigma$-protocol. Cramer [2] further formalized the definition of $\Sigma$-protocols in 1997, defining them as three-round protocols with completeness, special soundness, and the SHVZK property. In recent studies, Albrecht and Lai [25] achieved tight standard soundness but incurred high soundness error, while the protocol in [26] proves small-norm witnesses and realizes security via soundness slack.

Lyubashevsky [27] proposed the first LWE-based $\Sigma$-protocol in 2009, establishing the fundamental framework for lattice-based zero-knowledge proofs. In 2012, Lyubashevsky [28] constructed a lightweight three-round LWE $\Sigma$-protocol using Fiat–Shamir transformation and rejection sampling. This trapdoor-free scheme simplifies protocol design and supports practical signature implementations. Recently, Nguyen [29] presented the first straight-line extractable zero-knowledge proof system from MLWE in 2025, which reduces nearly half of the proof size and greatly improves both proving and verifying efficiency.

To improve the scalability of multi-instance proofs, amortized zero-knowledge proofs for lattice problems have attracted intensive research attention. Amortized zero-knowledge proofs enhance the scalability of multi-instance lattice proofs and have been widely studied. Liu et al. [30] proposed a lattice inner product argument in 2019, cutting the proof size of LWE-based $\Sigma$-protocols from $O\left(n\right)$ to $O\left(\sqrt{n}\right)$. In 2021, Bootle et al. [31] constructed an amortized proof system for LWE. For instances sharing the same secret $\overrightarrow{s}$, its proof size is independent of instance quantity and is linear in secret length. When all instances share matrix A, the size is further reduced to $O\left(\sqrt{n}\right)$, yielding efficient batch proofs.

Recently, Boneh and Chen proposed LatticeFold [32]. It is a folding-based framework that constructs succinct lattice proof systems. It uses polynomial commitments and sum-check protocols. These tools compress multiple lattice instances. In a closely related direction, Zhang et al. [14] designed $\Sigma$-protocols for polynomial relations over lattices, focusing on the MSIS problem. To handle these complex polynomial constraints, their work integrates key techniques including the number theoretic transform (NTT) and multilinear extensions (MLEs).

1.2. Our Contribution

The amortization methods in Zhang et al.’s work target MSIS, which has a single bounded witness. MLWE differs: its witness splits into unbounded $\overrightarrow{s}$ and bounded $\overrightarrow{e}$. We adapt their folding technique to this setting and construct an amortized $\Sigma$-protocol tailored to MLWE.

Our protocol achieves proof size $\mathcal{O}\left(\right(\mathcal{l}+3\left)m\right)$ (in ${\mathcal{R}}_q$-elements). Since $\mathcal{l}\ll k$, this is significantly better than the direct approach $\mathcal{O}\left(km\right)$. Zhang et al. achieve better asymptotic efficiency using more advanced tools but with higher implementation overhead and deployment complexity.

Our protocol adopts a different design philosophy, involving low deployment barriers, simple implementation, and practically sufficient efficiency. It operates via the fold-split-fold method together with rejection sampling, resulting in a structure well-suited for scenarios where implementation cost and deployability are key. To our knowledge, this is the first amortized $\Sigma$-protocol for MLWE that achieves completeness, special soundness, and non-abort SHVZK simultaneously.

2. Preliminaries

For simplicity, we define the arrow “$\leftarrow$” to denote random sampling from a distribution. Let $\mathcal{R}=\mathbb{Z}\left[X\right]/(X^d+1)$ be a cyclotomic polynomial ring, where $d>1$ is a power of two. Let q be a modulus satisfying $q\equiv 1\left(\mathrm{mod}2d\right)$. Let ${\mathbb{Z}}_q:=\mathbb{Z}/q\mathbb{Z}$ be the ring of integers modulo q, i.e., $\{-{\displaystyle \frac{q-1}{2}},\dots ,{\displaystyle \frac{q-1}{2}}\}$. We use ${\mathbb{Z}}_q\left[X\right]$ to denote the set of polynomials over ${\mathbb{Z}}_q$. Let ${\mathcal{R}}_q=\mathcal{R}/q\mathcal{R}={\mathbb{Z}}_q\left[X\right]/(X^d+1)$ denote its quotient ring modulo q.

2.1. Interactive Sigma Protocol

We review some concepts about zero-knowledge proofs and $\Sigma$-protocal as follows:

Definition 1

([33] ($\Sigma$-protocol)). A three-move protocol that is public-coin, complete, k-special sound, and SHVZK is said to be Σ-protocol.

In this paper, we will more generally refer to $\Sigma$-protocols also for k-move protocols that are public-coin, complete (with some completeness error), $(k_1,\dots ,k_n)$-special sound, and (non-abort) SHVZK.

Definition 2

([33] (Completeness)). If P and V follow the protocol on input x and private input ω to P where $(x,\omega )\in R$, then V always accepts.

Definition 3

([34] (Special Soundness)). There exists a ploynomial-time algorithm A that given any x and any pair of accepting transcripts $(a,e,z),(a,e^{\prime },z^{\prime })$ for x, where $e\ne e^{\prime }$, outputs w such that $(x,\omega )\in R$. A Σ-protocol is called k-special sound if there exists an efficient algorithm that, upon inputting any statement x and k accepting transcripts $(a,c_1,z_1),\dots ,(a,c_k,z_k)$ with a common first message a and pairwise distinct challenges $c_i$, outputs a witness ω for x.

A Σ-protocol is said to achieve an honest-verifier zero-knowledge (HVZK) [26] if there exists an efficient algorithm, referred to as a simulator, that takes a valid statement y (along with a corresponding witness x) and outputs an accepting transcript whose distribution is identical to that of transcripts generated by an interaction between an honest prover and an honest verifier. In many practical Σ protocols, the simulator operates by first choosing a random challenge c and then constructing the first message a and response z accordingly; this strengthened flavor is commonly known as special honest-verifier zero-knowledge (SHVZK). Furthermore, a protocol is called non-abort honest-verifier zero-knowledge if the transcript distribution produced by the simulator is statistically indistinguishable from the one produced in an honest protocol execution, provided that the honest prover never aborts during the process.

Definition 4

([14]). We define a mapping as "extractive injective" if and only if during the extraction process, the extracted system comprising rewinding factors, private inputs, and public outputs is “perfectly injective”. In other words, each output can only extract exactly one input set.

Definition 5

([35]). Define a subset $\mathcal{C}$ of ${\mathcal{R}}_q$ as a challenge space if the difference of any two distinct elements in $\mathcal{C}$ is not a zero divisor. $\mathcal{C}$ is further a strong challenge space if the difference of any two distinct elements in it is invertible in ${\mathcal{R}}_q$.

Sometimes we need a strong challenge space $\mathcal{C}\subset {\mathcal{R}}_q$ whose elements have small norms. We use two quantities: the expansion factor ${\overline{\omega }}_{{\mathcal{R}}_q}\left(\mathcal{C}\right)$ of $\mathcal{C}$ and the soundness slack ${\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )$, with slack factor $\zeta$ introduced by extraction for vectors in [26].

$${\overline{\omega }}_{{\mathcal{R}}_q}\left(\mathcal{C}\right)=\underset{c\in \mathcal{C},x\in {\mathcal{R}}_q^m\setminus \left\{0\right\}}{\max }{\displaystyle \frac{\parallel cx\parallel }{\parallel x\parallel }};{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )=\underset{c\ne c^{\prime },x\in {\mathcal{R}}_q^m\setminus \left\{0\right\}}{\max }\underset{a\in {\mathcal{R}}_q:a(c-c^{\prime })=\zeta }{\max }{\displaystyle \frac{\parallel ax\parallel }{\parallel x\parallel }}.$$

Theorem 1

([36]). Sequential composition: Let $R_1$, $R_2$, and $R_3$ be three relations. Given two reduction of knowledge protocols, ${\Pi }_1$ from R to $R_2$ and ${\Pi }_2$ from $R_2$ to $R_3$, the composed protocol ${\Pi }_1\diamond {\Pi }_2$ is a reduction of knowledge from $R_1$ to $R_3$.

2.2. Hard Problems on Lattice

The security of lattice-based $\Sigma$-protocols relies on the hardness of certain computational problems. We now define the Module Learning with Errors (MLWE) problem and its relevant properties.

Definition 6

([37] ($\mathrm{MLWE}$ Problem)). Let $m,n,q\ge 1$ be any positive integers. Let ${\chi }_{\mathcal{B}}$ be the probability distribution over ${\mathcal{R}}_q$ bounded by $\mathcal{B}$. For $A\leftarrow \mathcal{U}\left({\mathcal{R}}_q^{n\times m}\right)$ and $\overrightarrow{s}\in {\mathcal{R}}_q^n$, $\overrightarrow{e}\leftarrow {\chi }_{\mathcal{B}}^m$ defines the distribution consisting of ($A,\overrightarrow{t}=A\overrightarrow{s}+\overrightarrow{e}$) as ${\mathcal{A}}_{\overrightarrow{s},{\chi }_{\mathcal{B}}}^m$. The search ${MLWE}_{n,m,q,\mathcal{B}}$ problem is defined as: given a sample $(A,\overrightarrow{t}=A\overrightarrow{s}+\overrightarrow{e})\in {\mathcal{R}}_q^{m\times n}\times {\mathcal{R}}_q^m$, solve for $\overrightarrow{s}\in {\mathcal{R}}_q^n$. The decision ${MLWE}_{n,m,q,\mathcal{B}}$ problem is defined as follows: determine whether multiple samples $(A,\overrightarrow{t}=A\overrightarrow{s}+\overrightarrow{e})$ are drawn from the distribution ${\mathcal{A}}_{s,{\chi }_{\mathcal{B}}}^m$ or from the distribution $\mathcal{U}({\mathcal{R}}_q^{m\times n}\times {\mathcal{R}}_q^m)$.

Theorem 2

([22] (Classical Hardness of MLWE)). Let $n,d,q\ge 2\in \mathbb{N}$, defining $N=dn$. Let $ϵ\left(N\right)=N^{-\omega \left(1\right)}$, $\alpha \in (0,1)$ of known factorization such that $\alpha q>2\sqrt{d}·\omega \left(\sqrt{\log n}\right).$ There is a quantum reduction from solving $\mathrm{Mod}-{\mathrm{GIVP}}_{\tilde{\gamma }}^{{\eta }_{ϵ}}$ in polynomial time (in the worst case, with high probability) to solving $MLW{E}_{q,{\Psi }_{\le \alpha }}$ in polynomial time with a non-negligible advantage, where

$$\tilde{\gamma }={\displaystyle \frac{\sqrt{8Nd}·\omega \left(\sqrt{\log n}\right)}{\alpha }}.$$

3. $\Sigma$-Protocol of LWE Problem

In this section, we focus on the construction of amortized $\Sigma$-protocols for lattice MLWE problems and specifically design an ${\mathrm{MLWE}}_{n,m,q,\mathcal{B}}^{\infty }$ protocol following the classical amortized proof framework. The target proof relation of our amortized $\Sigma$-protocol is defined as follows:

$$R=\{(A\in {\mathcal{R}}_q^{m\times n},{\overrightarrow{t}}_0,\dots ,{\overrightarrow{t}}_{k-1}\in {\mathcal{R}}_q^m,\mathcal{B};{\overrightarrow{s}}_0,\dots ,{\overrightarrow{s}}_{k-1}\in {\mathcal{R}}_q^n,{\overrightarrow{e}}_0,\dots ,{\overrightarrow{e}}_{k-1}\in {\mathcal{R}}_q^m):A{\overrightarrow{s}}_i+{\overrightarrow{e}}_i={\overrightarrow{t}}_i,{\parallel {\overrightarrow{e}}_i\parallel }_{\infty }⩽\mathcal{B}\}.$$

Our protocol integrates witness folding and rejection sampling. Folding compresses multiple MLWE witnesses to reduce proof size and communication cost via amortization. Rejection sampling controls the ${\mathcal{l}}_{\infty }$-norm of folded error vectors to avoid overflow and meet required constraints. We next present the folding process of ${\mathrm{MLWE}}_{n,m,q,\mathcal{B}}^{\infty }$, the amortized $\Sigma$-protocol construction, and formal proofs for completeness, special soundness, and zero-knowledge.

Based on the above ${\mathrm{MLWE}}_{n,m,q,\mathcal{B}}^{\infty }$ witness relation, we adopt witness splitting and folding operations to aggregate k independent MLWE instances into a single compact witness. The detailed folding protocol ${\Pi }_0$ is presented below.

Protocol ${\Pi }_0$

$\mathcal{P}(A,{\left({\overrightarrow{t}}_j\right)}_{j=0}^{k-1},\mathcal{B};{\left({\overrightarrow{s}}_j\right)}_{j=0}^{k-1},{\left({\overrightarrow{e}}_j\right)}_{j=0}^{k-1})$, $\mathcal{V}(A,{\left({\overrightarrow{t}}_j\right)}_{j=0}^{k-1},\mathcal{B})$

1: $\mathcal{V}\to \mathcal{P}$:${\overrightarrow{\rho }}_1\leftarrow {\mathcal{C}}^k$, ${\overrightarrow{\rho }}_2\leftarrow {\mathcal{C}}^{\mathcal{l}}.$

2: $\mathcal{P}$: Compute $\overrightarrow{e}={\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e}}_j$, $\overrightarrow{s}={\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{s}}_j$.

3: $\mathcal{V}$:Compute: ${\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{t}}_i$

4: $\mathcal{P}$: Set $({\overrightarrow{\mathbf{e}}}_0,\dots ,{\overrightarrow{\mathbf{e}}}_{\mathcal{l}-1}):=\mathbf{split}\left(\overrightarrow{e}\right)$, $({\overrightarrow{\mathbf{s}}}_0,\dots ,{\overrightarrow{\mathbf{s}}}_{\mathcal{l}-1}):=\mathbf{split}\left(\overrightarrow{s}\right)$.

5: $\mathcal{P}\to \mathcal{V}$: $\left({\overrightarrow{f}}_i\right)$ such that: ${\overrightarrow{f}}_i=A{\overrightarrow{\mathbf{s}}}_i+{\overrightarrow{\mathbf{e}}}_i\mathrm{mod}q.$

6: $\mathcal{V}$: Check ${\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{f}}_i\stackrel{?}{=}{\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{t}}_j.$

7: $\mathcal{P}$: Compute ${\overrightarrow{e}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{\mathbf{e}}}_i$, ${\overrightarrow{s}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{\mathbf{s}}}_i.$

8: $\mathcal{P}$: Output ${\overrightarrow{e}}_{*}$ and ${\overrightarrow{s}}_{*}$

9: $\mathcal{V}$: Output ${\overrightarrow{f}}_{*}$ such that: ${\overrightarrow{f}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{f}}_i.$

Theorem 3.

Let $pp:=(k,n,m,\mathcal{B},A,\gamma <q/2)$ be the public parameters such that $\mathcal{C}\subset R_q$ are superpoly large strong sampling sets where ${\overline{\omega }}_{{\mathcal{R}}_q}\left(\mathcal{C}\right)=c$. Let $k\mathcal{B}=\overline{\mathcal{B}}$, choose $c,\omega ,\mathcal{l}$ such that ${\omega }^{\mathcal{l}}=\overline{\mathcal{B}}$, $c\mathcal{l}\omega =b$ and $b<\gamma$. ${\Pi }_1$ satisfies completeness and the extractive injective.

Proof. 

Completeness: From the parameter settings, we can directly obtain ${\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e}}_j={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{\mathbf{e}}}_i$ and ${\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{s}}_j={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{\mathbf{s}}}_i.$ The prover computes $\overrightarrow{e}={\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e}}_j$, $\overrightarrow{s}={\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{s}}_j.$ ${\parallel \overrightarrow{e}\parallel }_{\infty }⩽k\mathcal{B}=\overline{\mathcal{B}}$ then splits $\overrightarrow{e}$ and $\overrightarrow{s}$ into $({\overrightarrow{\mathbf{e}}}_0,\dots ,{\overrightarrow{\mathbf{e}}}_{\mathcal{l}-1})$ and $({\overrightarrow{\mathbf{s}}}_0,\dots ,{\overrightarrow{\mathbf{s}}}_{\mathcal{l}-1})$ and ${\parallel {\overrightarrow{\mathbf{e}}}_j\parallel }_{\infty }⩽\omega$. Then, the prover sends ${\overrightarrow{f}}_i=A{\overrightarrow{s}}_i+{\overrightarrow{e}}_i\mathrm{mod}q$ for each $i\in \left[\mathcal{l}\right]$. The verifier verifies that ${\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{f}}_i\stackrel{?}{=}{\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{t}}_j.$ If the check is passed, the prover computes and outputs ${\overrightarrow{e}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{\mathbf{e}}}_i$ and ${\overrightarrow{s}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{\mathbf{s}}}_i$. Moreover, $\parallel {\overrightarrow{e}}_{*}\parallel ⩽c\mathcal{l}\omega =b.$ The verifier outputs ${\overrightarrow{f}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{f}}_i.$

Extractive injective: For any output ${\overrightarrow{e}}_{*}$ with a small norm bound, the analysis in [14] ensures that there exists a unique sequence ${\left({\overrightarrow{\mathbf{e}}}_i\right)}_{i=0}^{\mathcal{l}-1}$ that maps to ${\overrightarrow{e}}_{*}$. As a result, summing ${\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{\mathbf{e}}}_i$ yields exactly one vector $\overrightarrow{e}$. Likewise, for this fixed $\overrightarrow{e}$, there exists a unique input solution sequence ${\left({\overrightarrow{e}}_j\right)}_{j=0}^{k-1}$ that produces it. Similarly, for any output ${\overrightarrow{s}}_{*}$, there exists a unique sequence ${\left({\overrightarrow{\mathbf{s}}}_i\right)}_{i=0}^{\mathcal{l}-1}$ that maps to ${\overrightarrow{s}}_{*}$. As a result, summing ${\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{\mathbf{s}}}_i$ yields exactly one vector $\overrightarrow{s}$. For a given output $\overrightarrow{s}$ that does not require a small norm bound, there exists a unique input solution sequence ${\left({\overrightarrow{s}}_j\right)}_{j=0}^{k-1}$ that produces it. Therefore, ${\Pi }_1$ is extractive injective. □

For positive integers $\overline{\mathcal{B}}=k\mathcal{B}$ and $b<\gamma$, choose $\omega ,\mathcal{l}$ such that ${\omega }^{\mathcal{l}}=\overline{\mathcal{B}}$ and $c\mathcal{l}\omega =b$ (c is the norm bound of challenges). Initially, the verifier chooses a random challenge ${\overrightarrow{\rho }}_1\in {\mathcal{C}}^k$ from a compact strong challenge space. Subsequently, the prover calculates the associated random linear combination $\overrightarrow{e}={\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e}}_j$. For an m-size vector $\overrightarrow{e}\in {\mathcal{R}}_q^m$ where ${\parallel \overrightarrow{e}\parallel }_{\infty }\le \overline{\mathcal{B}}$, we can split it into an $m\times \mathcal{l}$ matrix $\mathbf{split}\left(\overrightarrow{e}\right):=({\overrightarrow{\mathbf{e}}}_0,\dots ,{\overrightarrow{\mathbf{e}}}_{\mathcal{l}-1})$, such that ${\parallel {\overrightarrow{\mathbf{e}}}_i\parallel }_{\infty }\le \omega$ for all $i\in \left[\mathcal{l}\right]$ and $\overrightarrow{e}:={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{\mathbf{e}}}_i$. Furthermore, we can fold them into one ${\overrightarrow{e}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{\mathbf{e}}}_i$ such that ${\parallel {\overrightarrow{e}}_{*}\parallel }_{\infty }\le b$ by applying the same folding operation with the challenge ${\overrightarrow{\rho }}_2\in {\mathcal{C}}^{\mathcal{l}}$. With an analogy, we can split it into an $m\times \mathcal{l}$ matrix $\mathbf{split}\left(\overrightarrow{s}\right):=({\overrightarrow{\mathbf{s}}}_0,\dots ,{\overrightarrow{\mathbf{s}}}_{\mathcal{l}-1})$, such that $\overrightarrow{s}:={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{\mathbf{s}}}_i$. The difference is that we cannot guarantee that the norm of vector ${\overrightarrow{\mathbf{s}}}_i$ is bounded by some value for all $i\in \left[\mathcal{l}\right]$.

Therefore, our protocol does not require bounding the norm of ${\overrightarrow{\mathbf{s}}}_i$. We let ${\overrightarrow{f}}_i=A{\overrightarrow{\mathbf{s}}}_i+{\overrightarrow{\mathbf{e}}}_i\mathrm{mod}q$ for $i\in \left[\mathcal{l}\right]$. Compute ${\overrightarrow{s}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{\mathbf{s}}}_i,$ where the random challenge ${\overrightarrow{\rho }}_2\in {\mathcal{C}}^{\mathcal{l}}$. Then we can obtain that

$$A{\overrightarrow{s}}_{*}+{\overrightarrow{e}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}(A{\overrightarrow{\mathbf{s}}}_i+{\overrightarrow{\mathbf{e}}}_i)={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{f}}_i,{\parallel {\overrightarrow{e}}_{*}\parallel }_{\infty }\le b.$$

Next, we construct and prove the security of the protocol for the making operation with respect to the ${\mathrm{MLWE}}_{n,m,q,b}^{\infty }$ problem. The construction and proof of this protocol involve the following two relations:

$$\begin{gathered} R(A,b)=\{(\overrightarrow{y};{\overrightarrow{s}}_{*},{\overrightarrow{e}}_{*}):{\overrightarrow{s}}_{*}\in {\mathcal{R}}_q^n,{\overrightarrow{e}}_{*}\in {\mathcal{R}}_q^m,A{\overrightarrow{s}}_{*}+{\overrightarrow{e}}_{*}=\overrightarrow{y}\left(\mathrm{mod}q\right),{\parallel {\overrightarrow{e}}_{*}\parallel }_{\infty }\le b\}; \\ R(A,2\gamma {\overline{w}}_{{\mathbb{Z}}_q}(\mathcal{C},\zeta ),\zeta )=\{(\overrightarrow{y};{\overrightarrow{s^{\prime }}}_{*},{\overrightarrow{e^{\prime }}}_{*}):{\overrightarrow{s^{\prime }}}_{*}\in {\mathcal{R}}_q^n,{\overrightarrow{e^{\prime }}}_{*}\in {\mathcal{R}}_q^m, \\ A{\overrightarrow{s^{\prime }}}_{*}+{\overrightarrow{e^{\prime }}}_{*}=\zeta \overrightarrow{y}\left(\mathrm{mod}q\right),{\parallel {\overrightarrow{e^{\prime }}}_{*}\parallel }_{\infty }\le 2\gamma {\overline{w}}_{{\mathbb{Z}}_q}(\mathcal{C},\zeta )\}. \end{gathered}$$

where $R(A,b)$ corresponds to the ${\mathrm{MLWE}}_{n,m,q,b}^{\infty }$ protocol to be proven and $R(A,2\gamma {\overline{\omega }}_{{\mathbb{Z}}_q}(\mathcal{C},\zeta ),\zeta )$ is the relation to be verified for the protocol’s special soundness.

To guarantee zero-knowledge and error vector bounds, we adopt rejection sampling. Existing studies use the algorithm $\mathbf{Rej}$ [28] to filter out-of-bound outputs, while we directly utilize rejection sampling results in our protocol.

Theorem 4.

Let $\mathcal{B}=k\overline{\mathcal{B}}$ and $b<\gamma$. Choose $\omega ,\mathcal{l}$ such that ${\omega }^{\mathcal{l}}=\overline{\mathcal{B}}$. ${\Pi }_1$ is a three-move Σ-protocol for relation $R(A,b)$. The protocol ${\Pi }_1$ is complete, non-abort SHVZK, and special soundness.

Protocol ${\Pi }_1$
PRIVATE PARAMETERS: ${\overrightarrow{s}}_{*}\in {\mathcal{R}}_q^n;{\overrightarrow{e}}_{*}\in {\mathcal{R}}_q^m$
INPUT($A,\overrightarrow{y};{\overrightarrow{s}}_{*},{\overrightarrow{e}}_{*}$)
$A{\overrightarrow{s}}_{*}+{\overrightarrow{e}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,j}{\overrightarrow{f}}_i=\overrightarrow{y}$; ${\parallel {\overrightarrow{e}}_{*}\parallel }_{\infty }⩽b$
Prover		Verifier
$\overrightarrow{r}\leftarrow {\mathcal{R}}_q^m$ with ${\parallel \overrightarrow{r}\parallel }_{\infty }\le \sigma$; $\overrightarrow{h}\leftarrow {\mathcal{R}}_q^n$
$\overrightarrow{T}=A\overrightarrow{h}+\overrightarrow{r}\mathrm{mod}q$
	$\stackrel{\overrightarrow{T}}{\to }$
		$\lambda \leftarrow \mathcal{C}$
	$\stackrel{\lambda }{\leftarrow }$
run $\mathbf{Rej}(\overrightarrow{g},\lambda {\overrightarrow{e}}_{*})$
$\overrightarrow{g}=\lambda {\overrightarrow{e}}_{*}+\overrightarrow{r}$
$\overrightarrow{f}=\lambda {\overrightarrow{s}}_{*}+\overrightarrow{h}$
	$\stackrel{\overrightarrow{g},\overrightarrow{f}}{\to }$
		$A\overrightarrow{f}+\overrightarrow{g}\stackrel{?}{=}\lambda \overrightarrow{y}+T$
		${\parallel \overrightarrow{g}\parallel }_{\infty }\stackrel{?}{⩽}\gamma$

Proof. 

Completeness: The honest prover computes: $\overrightarrow{g}=\lambda {\overrightarrow{e}}_{*}+\overrightarrow{r}$, $\overrightarrow{f}=\lambda {\overrightarrow{s}}_{*}+\overrightarrow{h}$. Then $A\overrightarrow{f}+\overrightarrow{g}=A(\lambda {\overrightarrow{s}}_{*}+\overrightarrow{h})+(\lambda {\overrightarrow{e}}_{*}+\overrightarrow{r})=\lambda (A{\overrightarrow{s}}_{*}+{\overrightarrow{e}}_{*})+(A\overrightarrow{h}+\overrightarrow{r})$. By definitions $\overrightarrow{T}=A\overrightarrow{h}+\overrightarrow{r}$ and $A{\overrightarrow{s}}_{*}+{\overrightarrow{e}}_{*}=\overrightarrow{y}$, we obtain $A\overrightarrow{f}+\overrightarrow{g}=\lambda \overrightarrow{y}+\overrightarrow{T}$. Thus the first verification equation $A\overrightarrow{f}+\overrightarrow{g}\stackrel{?}{=}\lambda \overrightarrow{y}+\overrightarrow{T}$ holds with equality. Since ${\parallel \overrightarrow{r}\parallel }_{\infty }⩽\sigma$, ${\parallel \lambda \parallel }_{\infty }⩽c$, the norm of $\overrightarrow{g}$ is less than $\gamma$. Moreover, the rejection sampling condition $\mathbf{Rej}(\overrightarrow{g},\lambda {\overrightarrow{e}}_{*})$ is satisfied for the honest prover. Therefore the second check ${\parallel \overrightarrow{g}\parallel }_{\infty }\stackrel{?}{⩽}\gamma$ is satisfied. The protocol is complete.

Special Soundness: Specifically, the extractor first requires two accepting transcripts of the same $\overrightarrow{T}$ but with different $\lambda$ values to recover the amortized witness. Let $a({\lambda }^{\left(1\right)}-{\lambda }^{\left(2\right)})=\zeta$. Let $(\overrightarrow{T},{\lambda }^{\left(1\right)},{\overrightarrow{g}}^{\left(1\right)},{\overrightarrow{f}}^{\left(1\right)})$ and $(\overrightarrow{T},{\lambda }^{\left(2\right)},{\overrightarrow{g}}^{\left(2\right)},{\overrightarrow{f}}^{\left(2\right)})$ be two accepting transcripts for ${\lambda }^{\left(1\right)}\ne {\lambda }^{\left(2\right)}\in \mathcal{C}.$ Define ${\overrightarrow{e^{\prime }}}_{*}=a({\overrightarrow{g}}^{\left(1\right)}-{\overrightarrow{g}}^{\left(2\right)})$ and ${\overrightarrow{s^{\prime }}}_{*}=a({\overrightarrow{f}}^{\left(1\right)}-{\overrightarrow{f}}^{\left(2\right)})$. ${\parallel {\overrightarrow{e^{\prime }}}_{*}\parallel }_{\infty }\le 2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\gamma$ and $A{\overrightarrow{s^{\prime }}}_{*}+{\overrightarrow{e^{\prime }}}_{*}=Aa({\overrightarrow{f}}^{\left(1\right)}-{\overrightarrow{f}}^{\left(2\right)})+a({\overrightarrow{g}}^{\left(1\right)}-{\overrightarrow{g}}^{\left(2\right)})=a({\lambda }^{\left(1\right)}-{\lambda }^{\left(2\right)})\overrightarrow{y}=\zeta \overrightarrow{y}$ also apply.

Non-abort SHVZK: We simulate a transcript as follows: Sampling ${\lambda }_0\leftarrow \mathcal{C}$, the simulator runs on input public parameters and challenge ${\lambda }_0$. If $\mathbf{Rej}(\overrightarrow{g},\lambda {\overrightarrow{e}}_{*})$ outputs ⊥, the simulator returns $(\perp ;{\lambda }_0;\perp ,\perp )$. Otherwise, the simulator set ${\overrightarrow{g}}_0$, ${\overrightarrow{f}}_0$ computes the first message as $\overrightarrow{T}=A{\overrightarrow{g}}_0+{\overrightarrow{f}}_0-c\overrightarrow{y}$ and outputs $(\overrightarrow{T},{\lambda }_0,{\overrightarrow{g}}_0,{\overrightarrow{f}}_0)$. Since the output distribution of the simulator and transcripts are statistically distinctive and $\overrightarrow{T}$ is determined by the values ${\lambda }_0$, ${\overrightarrow{f}}_0$, ${\overrightarrow{g}}_0$, and $\overrightarrow{y}$, statistical non-abort SHVZK follows. □

To ensure the zero-knowledge property of this amortized MLWE $\Sigma$-protocol, we sequentially compose protocol ${\Pi }_0$ and the masking operation protocol ${\Pi }_1$ together. Protocol ${\Pi }_0$ reduces relation R to relation $R(A,b)$. Protocol ${\Pi }_1$ reduces relation $R(A,b)$ to relation $R(A,\gamma )$ where

$$R(A,\gamma )=\left\{(\lambda {\overrightarrow{f}}_{*}+\overrightarrow{T};\overrightarrow{f},\overrightarrow{g}):\overrightarrow{f}\in {\mathcal{R}}_q^n,\overrightarrow{g}\in {\mathcal{R}}_q^m,A\overrightarrow{f}+\overrightarrow{g}=\lambda {\overrightarrow{f}}_{*}+\overrightarrow{T}\mathrm{mod}q,{\parallel \overrightarrow{g}\parallel }_{\infty }\le \gamma \right\}.$$

According to Theorem 1, the protocol ${\Pi }_0\diamond {\Pi }_1$ reduces relation R to $R(A,\gamma ).$ The composite $\Sigma$-protocol ${\Pi }_{ZKmain}$ is as follows:

Protocol ${\Pi }_{ZKmain}$
PRIVATE PARAMETERS: $\overrightarrow{s}\in {\mathcal{R}}_q^n;\overrightarrow{e}\in {\mathcal{R}}_q^m$
INPUT($A,{\overrightarrow{t}}_i,\mathcal{B};{\overrightarrow{s}}_i,{\overrightarrow{e}}_i$)
$A{\overrightarrow{s}}_i+{\overrightarrow{e}}_i={\overrightarrow{t}}_i\mathrm{mod}q\in {\mathcal{R}}_q^m$; ${\parallel {\overrightarrow{e}}_i\parallel }_{\infty }⩽\mathcal{B}$
Prover		Verifier
		${\overrightarrow{\rho }}_1\leftarrow {\mathcal{C}}^k$, ${\overrightarrow{\rho }}_2\leftarrow {\mathcal{C}}^{\mathcal{l}}$
	$\stackrel{{\overrightarrow{\rho }}_1,{\overrightarrow{\rho }}_2}{\leftarrow }$
$\overrightarrow{e}={\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e}}_j$
$\overrightarrow{s}={\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{s}}_j$
$({\overrightarrow{\mathbf{e}}}_0,\dots ,{\overrightarrow{\mathbf{e}}}_{\mathcal{l}-1}):=\mathbf{split}\left(\overrightarrow{e}\right)$
$({\overrightarrow{\mathbf{s}}}_0,\dots ,{\overrightarrow{\mathbf{s}}}_{\mathcal{l}-1}):=\mathbf{split}\left(\overrightarrow{s}\right)$
${\overrightarrow{f}}_i=A{\overrightarrow{s}}_i+{\overrightarrow{e}}_i\mathrm{mod}q$
${\overrightarrow{e}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{\mathbf{e}}}_i$
${\overrightarrow{s}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{\mathbf{s}}}_i$
${\overrightarrow{f}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{f}}_i$
$\overrightarrow{r}\leftarrow {\mathcal{R}}_q^m$ with ${\parallel \overrightarrow{r}\parallel }_{\infty }\le \sigma$ $\overrightarrow{h}\leftarrow {\mathcal{R}}_q^n$
$\overrightarrow{T}=A\overrightarrow{h}+\overrightarrow{r}\mathrm{mod}q$
	$\stackrel{{\left({\overrightarrow{f}}_i\right)}_{i=0}^{\mathcal{l}-1},\overrightarrow{T}}{\to }$
		${\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{f}}_i\stackrel{?}{=}{\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{t}}_j$
		$\lambda \leftarrow \mathcal{C}$
	$\stackrel{\lambda }{\leftarrow }$
run $\mathbf{Rej}(\overrightarrow{g},\lambda {\overrightarrow{e}}_{*},\varphi ,\tau )$
$\overrightarrow{g}=\lambda {\overrightarrow{e}}_{*}+\overrightarrow{r}$, $\overrightarrow{f}=\lambda {\overrightarrow{s}}_{*}+\overrightarrow{h}$
	$\stackrel{\overrightarrow{g},\overrightarrow{f}}{\to }$
		$A\overrightarrow{f}+\overrightarrow{g}\stackrel{?}{=}\lambda {\overrightarrow{f}}_{*}+\overrightarrow{T}$
		${\parallel \overrightarrow{g}\parallel }_{\infty }\stackrel{?}{⩽}\gamma$

Theorem 5.

Let $pp:=(k,n,m,\mathcal{B},A,\gamma <q/2)$ be the public parameters such that $\mathcal{C}\subset R_q$ are strong sampling sets where ${\overline{\omega }}_{{\mathcal{R}}_q}\left(\mathcal{C}\right)=c$. Choose b, ℓ, ω, σ, and $\overline{k}$ such that $k\mathcal{B}=\overline{\mathcal{B}}={\omega }^{\mathcal{l}},$$c\mathcal{l}\omega =b$, $(\sigma +cb)\le \gamma$, and $\gamma =\overline{k}b$. ${\Pi }_{ZKmain}$ satisfies completeness, special soundness, and non-abort SHVZK.

Proof. 

Completeness: From the paramenter settings and the completeness of ${\Pi }_1$, we have ${\parallel {\overrightarrow{e}}_{*}\parallel }_{\infty }⩽b=c\mathcal{l}\omega$ and send $\overrightarrow{T}=A\overrightarrow{h}+\overrightarrow{r}\mathrm{mod}q$ to the verifier. If the ${\overrightarrow{e}}_{*}$ pass the rejection sampling in the honest execution, the prover sends $\overrightarrow{g}=\lambda {\overrightarrow{e}}_{*}+\overrightarrow{r}$, $\overrightarrow{f}=\lambda {\overrightarrow{s}}_{*}+\overrightarrow{h}$. It can be proven that the verifier accepts in the honest execution. First, since

$${\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e}}_j={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{\mathbf{e}}}_i=\overrightarrow{e},{\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{s}}_j={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{\mathbf{s}}}_i=\overrightarrow{s};$$

we have

$${\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{f}}_i={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i(A{\overrightarrow{\mathbf{s}}}_i+{\overrightarrow{\mathbf{e}}}_i)=A\left({\sum }_{j=0}^{k-1}{\overrightarrow{\rho }}_{1,j}{\overrightarrow{s}}_i\right)+{\sum }_{j=0}^{k-1}{\overrightarrow{\rho }}_{1,j}{\overrightarrow{e}}_j={\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{t}}_j.$$

The verfier passes the check. According to Theorem 3, the verifier passes the check as follows:

$$A\overrightarrow{f}+\overrightarrow{g}=\lambda {\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{f}}_i+\overrightarrow{T},{\parallel \overrightarrow{g}\parallel }_{\infty }⩽\gamma .$$

In summary, completeness is proved.

Special soundness: First, from Theorem 4 we have

$$A{\overrightarrow{s^{\prime }}}_{*}+{\overrightarrow{e^{\prime }}}_{*}=\zeta \overrightarrow{y}=\zeta \left({\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{f}}_i\right)={\overrightarrow{f^{\prime }}}_{*}\mathrm{and}\parallel {\overrightarrow{e^{\prime }}}_{*}{\parallel }_{\infty }\le 2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\gamma ,$$

with

$${\overrightarrow{e^{\prime }}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{{\mathbf{e}}^{\prime }}}_i,{\overrightarrow{s^{\prime }}}_{*}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}{\overrightarrow{{\mathbf{s}}^{\prime }}}_i,$$

corresponding to the extraction process for a single ${\overrightarrow{{\mathbf{e}}^{\prime }}}_i$ for $i\in \left[\mathcal{l}\right]$.

Secondly, we demonstrate that the fold-split-fold procession in ${\Pi }_{ZKmain}$ is extractive injective. There is just one unique valid input set corresponding to the output. For a given output ${\overrightarrow{e}}_{*}$ with a small norm bound of $\overrightarrow{g}$, the analysis in this paper guarantees that there is only one set of ${\left({\overrightarrow{\mathbf{e}}}_i\right)}_{i=0}^{\mathcal{l}-1}$ corresponding to ${\overrightarrow{e}}_{*}$. Hence, computing ${\sum }_{i=0}^{\mathcal{l}}{\omega }^i{\overrightarrow{\mathbf{e}}}_i$ will only yield one result vector $\overrightarrow{e}$. Similarly, for this fixed $\overrightarrow{e}$, there is only one set of input solutions ${\left({\overrightarrow{e}}_j\right)}_{j=0}^{k-1}$ corresponding to it.

Rewinding ${\overrightarrow{\rho }}_2$ and constructing linear equations for fixed A, ${\overrightarrow{t}}_i$, ${\overrightarrow{\rho }}_1$, and ${\left({\overrightarrow{f}}_i\right)}_{i=0}^{\mathcal{l}-1}$, rewinding the verifier and choosing ℓ independently with ${\overrightarrow{\rho }}_2^{\left(1\right)},{\overrightarrow{\rho }}_2^{\left(2\right)},\dots ,{\overrightarrow{\rho }}_2^{\left(\mathcal{l}\right)}\in {\mathcal{C}}^{\mathcal{l}}$, where every ${\overrightarrow{\rho }}_2^{\left(j\right)}=({\rho }_{2,0}^{\left(j\right)},{\rho }_{2,1}^{\left(j\right)},\dots ,{\rho }_{2,\mathcal{l}-1}^{\left(j\right)})$, we can obtain the linear combinations

$${\overrightarrow{e^{\prime }}}_{*}^{\left(j\right)}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}^{\left(i\right)}{\overrightarrow{{\mathbf{e}}^{\prime }}}_i(j=1,2,\dots ,\mathcal{l});{\overrightarrow{s^{\prime }}}_{*}^{\left(j\right)}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}^{\left(i\right)}{\overrightarrow{{\mathbf{s}}^{\prime }}}_i(j=1,2,\dots ,\mathcal{l}).$$

The coefficient matrix of the above linear combinations is denoted as $M\in {\mathcal{C}}^{\mathcal{l}\times \mathcal{l}}$. Obviously, M is invertible. Then

$$\left(\begin{array}{c}{\overrightarrow{{\mathbf{e}}^{\prime }}}_0\\ {\overrightarrow{{\mathbf{e}}^{\prime }}}_1\\ ⋮\\ {\overrightarrow{{\mathbf{e}}^{\prime }}}_{\mathcal{l}-1}\end{array}\right)=M^{-1}\left(\begin{array}{c}{\overrightarrow{e^{\prime }}}_{*}^{\left(1\right)}\\ {\overrightarrow{e^{\prime }}}_{*}^{\left(2\right)}\\ ⋮\\ {\overrightarrow{e^{\prime }}}_{*}^{\left(\mathcal{l}\right)}\end{array}\right);\left(\begin{array}{c}{\overrightarrow{{\mathbf{s}}^{\prime }}}_0\\ {\overrightarrow{{\mathbf{s}}^{\prime }}}_1\\ ⋮\\ {\overrightarrow{{\mathbf{s}}^{\prime }}}_{\mathcal{l}-1}\end{array}\right)=M^{-1}\left(\begin{array}{c}{\overrightarrow{s^{\prime }}}_{*}^{\left(1\right)}\\ {\overrightarrow{s^{\prime }}}_{*}^{\left(2\right)}\\ ⋮\\ {\overrightarrow{s^{\prime }}}_{*}^{\left(\mathcal{l}\right)}\end{array}\right).$$

From this, all items can be enumerated and extracted as ${\overrightarrow{{\mathbf{e}}^{\prime }}}_0,{\overrightarrow{{\mathbf{e}}^{\prime }}}_1,\dots ,{\overrightarrow{{\mathbf{e}}^{\prime }}}_{\mathcal{l}-1}$ and ${\overrightarrow{{\mathbf{s}}^{\prime }}}_0,{\overrightarrow{{\mathbf{s}}^{\prime }}}_1,\dots ,{\overrightarrow{{\mathbf{s}}^{\prime }}}_{\mathcal{l}-1}$ one by one. We can obtain $A{\overrightarrow{{\mathbf{s}}^{\prime }}}_i+{\overrightarrow{{\mathbf{e}}^{\prime }}}_i\left(\mathrm{mod}q\right)=\zeta {\overrightarrow{f}}_i$ for any $i\in \left[\mathcal{l}\right].$

Combining $\zeta {\overrightarrow{f}}_i=A{\overrightarrow{{\mathbf{s}}^{\prime }}}_i+{\overrightarrow{{\mathbf{e}}^{\prime }}}_i\left(\mathrm{mod}q\right)$$(i=0,1,\dots ,\mathcal{l}-1)$ in the protocol, we have

$${\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e^{\prime }}}_j={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{{\mathbf{e}}^{\prime }}}_i=\overrightarrow{e^{\prime }}\mathrm{and}{\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{s^{\prime }}}_j={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{{\mathbf{s}}^{\prime }}}_i=\overrightarrow{s^{\prime }}.$$

Suppose we have obtained k sets of linearly independent linear combinations of $\overrightarrow{e^{\prime }}$ and $\overrightarrow{s^{\prime }}$, which are generated by k linearly independent challenge vectors ${\overrightarrow{\rho }}_1^{\left(t\right)}=\left({\rho }_{1,0}^{\left(t\right)},{\rho }_{1,1}^{\left(t\right)},\dots ,{\rho }_{1,k-1}^{\left(t\right)}\right)$ for $t=1,2,\dots ,k$. Specifically, we have:

$${\overrightarrow{e^{\prime }}}^{\left(t\right)}={\sum }_{j=0}^{k-1}{\rho }_{1,j}^{\left(t\right)}{\overrightarrow{e}}_j,{\overrightarrow{s^{\prime }}}^{\left(t\right)}={\sum }_{j=0}^{k-1}{\rho }_{1,j}^{\left(t\right)}{\overrightarrow{s}}_j(t=1,2,\dots ,k).$$

The coefficient matrix of the above linear combinations is denoted as $M_0\in {\mathcal{C}}^{k\times k}$. Obviously, the matrix $M_0$ is invertible. By left-multiplying both sides of the above equation by $M_0^{-1}$ (the inverse of $M_0$), we can uniquely extract all ${\overrightarrow{e^{\prime }}}_j$ and ${\overrightarrow{s^{\prime }}}_j$$(j=0,1,\dots ,k-1)$:

$$\left(\begin{array}{c}{\overrightarrow{e^{\prime }}}_0\\ {\overrightarrow{e^{\prime }}}_1\\ ⋮\\ {\overrightarrow{e^{\prime }}}_{k-1}\end{array}\right)=M_0^{-1}\left(\begin{array}{c}{\overrightarrow{e^{\prime }}}^{\left(1\right)}\\ {\overrightarrow{e^{\prime }}}^{\left(2\right)}\\ ⋮\\ {\overrightarrow{e^{\prime }}}^{\left(k\right)}\end{array}\right);\left(\begin{array}{c}{\overrightarrow{s^{\prime }}}_0\\ {\overrightarrow{s^{\prime }}}_1\\ ⋮\\ {\overrightarrow{s^{\prime }}}_{k-1}\end{array}\right)=M_0^{-1}\left(\begin{array}{c}{\overrightarrow{s^{\prime }}}^{\left(1\right)}\\ {\overrightarrow{s^{\prime }}}^{\left(2\right)}\\ ⋮\\ {\overrightarrow{s^{\prime }}}^{\left(k\right)}\end{array}\right).$$

In conclusion, with k linearly independent challenge vectors ${\overrightarrow{\rho }}_1^{\left(t\right)}$ and their corresponding linear combinations ${\overrightarrow{e^{\prime }}}^{\left(t\right)}$ and ${\overrightarrow{s^{\prime }}}^{\left(t\right)}$, we can uniquely extract all individual ${\overrightarrow{e^{\prime }}}_j$ and ${\overrightarrow{s^{\prime }}}_j$$(j=0,1,\dots ,k-1)$ by inverting the coefficient matrix $M_0$. We can obtain that

$$A{\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{{\mathbf{s}}^{\prime }}}_i+{\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{{\mathbf{e}}^{\prime }}}_i={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i\zeta {\overrightarrow{f}}_i={\sum }_{j=0}^{k-1}{\rho }_{1,j}\zeta {\overrightarrow{t}}_j.$$

Then, we can deduce that $A{\overrightarrow{s^{\prime }}}_j+{\overrightarrow{e^{\prime }}}_j=\zeta {\overrightarrow{t}}_i\left(\mathrm{mod}q\right)$.

Meanwhile, since the ${\Pi }_1$ is extractive injective and ${\parallel {\overrightarrow{e^{\prime }}}_{*}\parallel }_{\infty }⩽2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\gamma$, where $c\mathcal{l}\omega =b$, $\overline{\mathcal{B}}={\omega }^{\mathcal{l}}$, $(\sigma +cb)\le \gamma$, $\gamma =\overline{k}b$, and the coefficients of M and $M_0$ are of constant order (determined by the properties of the challenge domain $\mathcal{C}$), it follows that every

$${\overrightarrow{e^{\prime }}}_{*}^{\left(j\right)}={\sum }_{i=0}^{\mathcal{l}-1}{\rho }_{2,i}^{\left(j\right)}{\overrightarrow{{\mathbf{e}}^{\prime }}}_i⩽c\mathcal{l}·{\parallel {\overrightarrow{{\mathbf{e}}^{\prime }}}_i\parallel }_{\infty },j\in \left[\mathcal{l}\right].$$

Then, we have $\parallel {\overrightarrow{{\mathbf{e}}^{\prime }}}_i{\parallel }_{\infty }\le 2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\overline{k}\omega$ and $2c\mathcal{l}\overline{k}\omega {\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )=2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\gamma$. Now, we have

$${\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e^{\prime }}}_j={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{{\mathbf{e}}^{\prime }}}_i=\overrightarrow{e^{\prime }}$$

and ${\parallel \overrightarrow{e^{\prime }}\parallel }_{\infty }⩽2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\overline{k}\overline{\mathcal{B}}$. Then we have ${\parallel {\sum }_{j=0}^{k-1}{\rho }_{1,j}{\overrightarrow{e^{\prime }}}_j\parallel }_{\infty }⩽2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\overline{k}k\mathcal{B}=2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\overline{k}\overline{\mathcal{B}}$. Then we can obtain ${\overrightarrow{e^{\prime }}}_j$ that ${\parallel {\overrightarrow{e^{\prime }}}_j\parallel }_{\infty }⩽2{\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )\overline{k}\mathcal{B}$. Therefore, the extracted ${\overrightarrow{e^{\prime }}}_j$ is the error vector required.

In summary, the extractor $\mathcal{E}$ can extract all valid witnesses $({\overrightarrow{s^{\prime }}}_j,{\overrightarrow{e^{\prime }}}_j)$ for $j\in \left[k\right]$ by solving the system of linear equations through multiple rewinds of the challenge ${\overrightarrow{\rho }}_1$, ${\overrightarrow{\rho }}_2$, and other transcripts. Therefore, ${\Pi }_{ZKmain}$ demonstrates $(k,\mathcal{l},2)$ special soundness.

Non-abort SHVZK: For ${\Pi }_{ZKmain}$, denote the folding challenge in the first folding operation as ${\overrightarrow{\rho }}_1$. Randomly sample the splitting operation, ${\overrightarrow{f^{\prime }}}_1,\dots ,{\overrightarrow{f^{\prime }}}_{\mathcal{l}-1}\leftarrow {\mathcal{R}}_q^m$ and set

$${\overrightarrow{f^{\prime }}}_0={\sum }_{j=0}^{k-1}{\overrightarrow{\rho }}_{1,j}{\overrightarrow{t}}_j-{\sum }_{i=1}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{f^{\prime }}}_i.$$

Obviously, ${\left({\overrightarrow{f^{\prime }}}_i\right)}_{i=0}^{\mathcal{l}-1}$ pass the check of ${\Pi }_{ZKmain}$. Moreover, ${\left({\overrightarrow{f^{\prime }}}_i\right)}_{i=0}^{\mathcal{l}-1}$ are indistinguishable from real ones.

Similarly, denote the folding challenge as ${\rho }_2$ in the second folding operation. The simulator simply computes ${\overrightarrow{f}}_{*}:={\sum }_{i=0}^{\mathcal{l}-1}{\omega }^i{\overrightarrow{f^{\prime }}}_i$. Finally, from Protocol 1, it follows that the masking operation satisfies zero-knowledge. Since all steps pass, the simulated transcript is a valid one and indistinguishable from a real transcript. Therefore, the protocol ${\Pi }_{ZKmain}$ is non-abort SHVZK. □

4. Parameter

In this section, the rings $\mathcal{R}$ and their monomial challenge set $\mathcal{C}=\{0,\pm 1,\dots ,\pm X^{d-1}\}$ have certain convenient properties. In particular, $\left|\mathcal{C}\right|=2d+1$ and ${\overline{\omega }}_{{\mathcal{R}}_q}\left(\mathcal{C}\right)=1$. More precisely, $2/(c-c^{\prime })\in \mathcal{R}$ is a polynomial with coefficients in $\{-1,0,1\}$ for all distinct $c,c^{\prime }\in \mathcal{C}$. This implies that the constant 2 is the slack factor value $\zeta =2$ in this instantiation. From this, it follows that ${\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},2)⩽d$. For a more detailed discussion on optimal challenge sets, see [38].

In this section, let $pp:=(n,m,A,\gamma <q/2)$ be the public parameters. Choose b, ℓ, $\omega$, and $\sigma$ such that $k\mathcal{B}=\overline{\mathcal{B}}={\omega }^{\mathcal{l}}$, $c\mathcal{l}\omega =b$, and $(\sigma +cb)\le \gamma$. The problem ${\mathsf{MLWE}}_{n,m,q,\mathcal{B}}$ inherits classical worst-case hardness from module lattice problems if the following hold: the module rank satisfies $n\ge 2$, $q\ge 2{\left(dn\right)}^2$ and $q\equiv 1\left(\mathrm{mod}2d\right)$. Under these parameters, there exists a classical PPT reduction from worst-case $\mathrm{Mod}-{\mathrm{GIVP}}_{\tilde{\gamma }}^{{\eta }_{ϵ}}$ to $MLW{E}_{q,{\Psi }_{\le \alpha }}$ using $\mathsf{poly}\left(dn\right)$ samples. From Theorem 2, we require $\alpha q\ge 2\sqrt{d}·\omega \left(\sqrt{\log n}\right).$ From Theorem 4 and the hardness of the MLWE problem, it follows that this problem is hard if $2\sqrt{d}·\omega \left(\sqrt{\log n}\right)<2\gamma {\overline{\omega }}_{{\mathcal{R}}_q}(\mathcal{C},\zeta )=2\gamma d<{\displaystyle \frac{q}{2}}$, then ${\displaystyle \frac{\omega \left(\sqrt{\log n}\right)}{\sqrt{d}}}<\gamma <{\displaystyle \frac{q}{4d}}$.

5. Conclusions

This paper proposes a lightweight amortized $\Sigma$-protocol tailored for MLWE. Following existing lattice proof frameworks, our construction abandons complex tools such as NTT and relies only on fold-split-fold operations and rejection sampling. The protocol supports efficient batch proofs for multiple MLWE statements and satisfies completeness, special soundness, and non-abort SHVZK. It can be applied to post-quantum signatures and secure data transmission, providing a practical and efficient solution for lattice-based cryptographic applications.