Windowed Hankel LWE: A Structured-LWE Problem for Cryptanalysis, with a Compact KEM

Middle-Product LWE keeps the long polynomial operand secret and publishes many short operands. This arrangement admits reductions from Ring-LWE, but it is also why MP-LWE schemes are large, with public keys of about 16 KB. We study the dual arrangement, Windowed Hankel LWE. Its public matrix is a Hankel (equivalently, row-reversed Toeplitz) matrix generated by one long pseudorandom sequence, its secret is short, and only the convolution coefficients that depend on every secret coordinate are published: a noisy middle product. The problem sits between unstructured LWE and Ring- or Module-LWE, and needs no reduction modulo a fixed polynomial. On it we build a KEM with n = 640, q = 2^12 and binomial noise. A complete exchange takes 2,528 bytes (excluding format headers), the decryption failure rate is below 2^−134.3, and a constant-time C implementation completes a handshake in 57 µs on an Apple M3 Max. We prove IND-CPA security in the random-oracle model under the hardness of the problem, and bound the IND-CCA security of the Fujisaki–Okamoto transform that the scheme uses. Treated as unstructured LWE, the cheapest generic attack costs 2^137.1 in the Core-SVP model, against 2^115.5 for Kyber-512. For the natural structural attacks we find no advantage over uniform matrices, under the models and experiments we examine: the embedding into the cyclic ring Z_q[X]/(X^1407 − 1) and its subrings, shifted and biased dual functionals, algebraic decoding, low-rank Hankel methods, and lattice reduction at reduced dimensions. Because the MP-LWE reductions do not transfer, the hardness of Windowed Hankel LWE is a new assumption. We state what would count as a break, and we publish challenge instances, each with a uniform-matrix twin, to invite its cryptanalysis.