Short answer: Ring-LWE and Module-LWE are structured versions of the Learning With Errors (LWE) problem that underlies much lattice-based cryptography. Papers prove reductions that link their hardness to each other and to worst-case problems on structured lattices. These are theory results about hardness assumptions, and they do not prove that any scheme is secure against all attacks.

Plain LWE first

A 2017 paper on the IACR ePrint archive explains that lattice-based cryptography has emerged as a central area in the pursuit of quantum-safe primitives. It says schemes have been proposed for public-key encryption, key exchange, digital signatures, identity-based encryption and fully homomorphic encryption. A fundamental problem is LWE: for dimension n, modulus q and an error distribution, samples are built from a uniformly random vector a and a noisy inner product with a secret s. Distinguishing the samples from uniform is the decision problem, and finding the secret is the search problem. It adds that Regev's seminal work established reductions from standard problems such as finding short vectors in general lattices to LWE.

The structured variants

A 2024 paper in the Journal of Cryptology says there has been a proliferation of algebraically structured LWE variants, including Ring-LWE, Module-LWE, Polynomial-LWE, Order-LWE and Middle-Product LWE, supported by a web of reductions among them and from worst-case problems on structured lattices. It says these reductions are often hard to interpret and use because of their complex parameters and the large blowup and distortion of the error distributions.

What the reductions show

The 2024 paper gives a general framework covering all proposed LWE variants over commutative base rings, and uses it to give simpler, more general and tighter reductions from Ring-LWE to the other algebraic variants. It says the reductions have easy-to-analyze, frequently small error expansion, and in most cases leave the error unchanged. Its main message is that it is straightforward to use the hardness of Ring-LWE as the foundation for the hardness of the other algebraic LWE problems over number fields.

The 2017 paper presents a reduction from Module-LWE in dimension d with modulus q to Ring-LWE with a larger modulus, for power-of-two cyclotomics. Since Module-LWE is at least as hard as Ring-LWE, it concludes the two problems are polynomial-time equivalent in that setting, and that the Ring-LWE instance is equivalent to solving lattice problems on module lattices.

A 2019 ePrint paper says the 2017 reduction was, until then, the only one from Module-LWE to Ring-LWE. It notes that a direct reduction from decision Module-LWE to decision Ring-LWE leads to a super-polynomial increase in errors and fails even for power-of-two cyclotomic fields, and that whether decision Module-LWE can be reduced to decision Ring-LWE was open. It gives a reduction from worst-case decision Module-LWE with modulus q to average-case decision Ring-LWE with modulus q to the power d, over any cyclotomic field, increasing the error rate by a small polynomial factor. It also says its work shows that the 2017 search reductions work in arbitrary cyclotomic fields.

What this does not tell you

A reduction says one problem is at least as hard as another, not that either is hard in absolute terms. These papers do not analyze specific parameter sets used in any scheme, and they do not describe attacks on structured lattices.

FAQ

What is LWE?

Distinguishing noisy inner products with a secret from uniform samples (decision) or recovering the secret (search), per the 2017 paper.

What do Ring-LWE and Module-LWE add?

Algebraic structure over number fields. The 2024 paper unifies the variants in one framework.

Are Ring-LWE and Module-LWE equally hard?

For power-of-two cyclotomics, the 2017 paper concludes they are polynomial-time equivalent. Later papers extend related results to other fields.

Do the reductions prove a scheme is secure?

No. They relate the hardness of problems to one another and to worst-case lattice problems.

Why did error growth matter?

The 2024 paper says large blowup of error distributions made earlier reductions hard to use.

All field notes