← Hall of Foundations Exhibit 153 · R_q = Z_q[X]/(Xⁿ+1)
The Structure Inside ML-KEM & ML-DSA

Numbers that
are polynomials

The lattice exhibits showed why hard problems on a grid protect a key. But the deployed post-quantum standards don't use plain grids — they use lattices built from polynomials, where a whole list of numbers multiplies as a single object and wraps around a ring boundary. That structure is what makes ML-KEM fast enough to ship.

The missing bridge. Between the finite-fields exhibit (numbers mod q) and the lattice exhibits (geometry) sits this: arithmetic on polynomials whose coefficients are numbers mod q, and which themselves wrap modulo Xⁿ+1. Module-LWE — the real hardness assumption under Kyber and Dilithium — lives in exactly this ring.
§1

A coefficient list that acts as one number

A polynomial like 3 + 2X + 5X² + X³ is just its list of coefficients, [3, 2, 5, 1]. In the ring R_q = Z_q[X]/(Xⁿ+1) two rules apply: every coefficient is reduced mod q, and any power Xⁿ or higher wraps back down — because Xⁿ is defined to equal −1. That single rule, Xⁿ = −1, is what makes the ring "negacyclic."

Xⁿ = −1  →  Xⁿ⁺ᵏ wraps to −Xᵏ, coefficients mod q
§2

Watch the multiplication wrap

Multiplying two polynomials would normally push degrees up to 2n−2. The ring folds everything above degree n−1 back down with a sign flip, and reduces mod q, so the product is another length-n list. Edit either polynomial's coefficients and watch the product — and the terms that wrapped — recompute.

—
Teal terms landed in place; the vermilion arc shows terms that exceeded degree n−1 and wrapped with a sign flip (Xⁿ = −1). Edit coefficients with the fields below.
Keyboard alternative: enter comma-separated coefficients for polynomials a and b, then multiply.
§3

Why a ring and not just a grid

A single ring element already packs n numbers. Stack a few of them into a module and you have a lattice with enormous dimension but a tiny, structured description — you store a handful of polynomials, not a giant matrix. That compression is the difference between a post-quantum scheme that's a research curiosity and one that fits in a TLS handshake.

The polynomial ring is how you get a thousand-dimensional lattice into a few kilobytes — security from geometry, efficiency from structure.
Where this touches your keys

The arithmetic inside every ML-KEM operation

ML-KEM and ML-DSA spend nearly all their time doing exactly this: multiplying polynomials in R_q, accelerated by the Number Theoretic Transform. Both standards (see Modern Cryptography) are built on Module-LWE, which is the LWE problem transplanted from plain vectors into this ring. This exhibit is the structure those primitives are made of.

Bridges: Finite Fields (coefficients mod q) → here → Lattices (the geometry). Tested logic in crypto-algebra.js.