Research proof index

Multiplication by a generator permutes Hexp (as a Finset), i.e. the image under i ↦ (g·i) mod 2^{α+1} is Hexp itself, for g a generator of H = ⟨σ_{-1}, σ_{4k+1}⟩. This is the group-translation fact g • H = H transported through the Hexp ↔ H bridge. Proof: the number-theoretic input (two_pow_dvd_four_pow_sub_one_iff ⟹ `(4k+1)^{2^{α-κ-1}}...

Every exponent enumerated by Hexp is odd (so the corresponding σ_i is a genuine automorphism). The base 4k+1 is odd; reduction mod the even conductor 2^{α+1} and the (m − ·) reflection both preserve oddness.

Irreducibility of the splitting factor. X^{2^{α-1}} - r is irreducible over ZMod q, given the order fact horder (supplied by orderOf_q_mod_two_pow). Uses ZMod.irreducible_of_dvd_cyclotomic_of_natDegree: the factor divides cyclotomic 2^{α+1} = X^{2^α}+1 and has degree 2^{α-1} = orderOf (q mod 2^{α+1}).

If a is coprime to f then Ideal.Quotient.mk (span {f}) a is a unit.

Lyubashevsky–Seiler: short elements are invertible (LS18, Cor. 1.2; Hachi, Lemma 3). Over the power-of-two cyclotomic modulus powTwoCyclotomic α (φ = X^{2^α}+1) with a prime q ≡ 5 (mod 8), a nonzero element of Rq (powTwoCyclotomic α) with centered ℓ₁ norm ≤ κ and κ² < q is a unit: by the algebraic core a non-unit forces q ∣ ‖c‖₂², whil...

X^e + σ_{-1}(X^e) ∈ R_q^H when d/2k ∣ e: X^e is then σ_{4k+1}-fixed (its exponent is a multiple of d/2k), and the sum is symmetric under σ_{-1} (which has order 2).