Is Ring-LWE now (2021) broken? A recent (29 Mar 2021) article &quot;Ring-LWE over two-to-power cyclotomics is not hard&quot; by Hao Chen is available in pre-print here: https://eprint.iacr.org/2021/418
I'm not a cryptographer. Does this article mean that Ring-LWE is unsuitable for post-quantum asymmetric cryptography? Does this means that others algorithms might be similarly affected? Or is the author somehow wrong?
Update: 20210403
TL;DR

If correct, the paper would affect the security of a wide range of RLWE systems, including all of the most commonly used variants.
However, the paper violates a &quot;no go&quot; theorem of a reviewed and established paper by Peikert.

Putting to the side the question of whether the paper is correct or not, there are RLWE instances that do not take place in power of two cyclotomic rings (although it is by far the most popular choice). For the NIST process it is worth noting that both CRYSTALS submissions (KYBER and DILITHIUM), FALCON and SABER all do use power of two cyclotomic rings. NTRU however uses $x^{509}-1$, $x^{677}-1$ and $x^{821}-1$, NTRUPrime does not even use a cyclotomic ring.
Thus even if the claims are met, they do not break all ring lattice systems, nor even all NIST ring lattice candidates.
(Technically the NTRU and LWE problems are distinct, though both are solved in practice by solving SVP/CVP instances, so I'll abusively elide the difference between RLWE and ring lattice instances).
The paper claims to break  decisional RLWE (distinguishing $(\mathbf a, \mathbf {as}+\mathbf e)$ from $(\mathbf a, \mathbf b)$ as opposed to recovering $\mathbf s$ and $\mathbf e$) in power of 2 cyclotomic rings. It then claims a quantum attack on a short sub-basis question. By section 5 of the LPR paper a decisional RLWE method would convert to a search RLWE method on cyclotomic rings (thanks to Mark and Chris Peikert for pointing out this reduction). This observation is not made in section 3.4 of Hao Chen's paper.
In terms of the distinguishing attack, the nub of the idea seems to be that we can find a sublattice $\mathbf L_2$ which contains both an ideal lattice $\mathbf Q$ that is dense enough that quite a few random elements end up in there and another sublattice $\mathbf L_1$ where error vectors have an elevated chance of appearing (e.g. the chance of an error vector appearing in $\mathbf L_1$ is twice the chance of a random vector appearing in $\mathbf L_2$). Then, if given a large collection of $(\mathbf a,\mathbf b)$ pairs from which we must guess the ones where $\mathbf b$ was generated from $\mathbf b=\mathbf{as}+\mathbf e$ we specialise to the subset where $\mathbf a\in \mathbf Q$. If generated via RLWE then $\mathbf{as}\in \mathbf Q\subset \mathbf L_2$ by the ideal property and $\mathbf e\in \mathbf L_1\subset \mathbf L_2$ with elevated probability, thus $\mathbf{as}+\mathbf e\in \mathbf L_2$ with elevated probability. If we therefore pick the $(\mathbf a,\mathbf b)$ pairs where $\mathbf a\in Q$ and $\mathbf b\in L_2$ and declare these to be RLWE instances, we would be more likely to be correct. Cyclotomic lattices do lend themselves to a wide choice of $\mathbf Q$.
However, lattices such as $L_2$ cannot exist for worst case error distributions. Section 5 of the Peikert paper linked in the TL;DR shows that if $\mathbf Q$ is dense enough to contain many $\mathbf a$, then the distribution of errors for worst case error distributions is smooth (i.e. does not have elevated probability) in $\mathbf Q$ and hence $\mathbf L_2$. Provably-hard ring LWE instances will usually have some reduction to worst case error distribution.
The &quot;no go&quot; observation is due to Chris Peikert and is largely taken from his twitter feed as linked in the paragraph above. Any errors and misrepresentations are due to me.