There are types LWE, VectorLWE, and VectorRLWE, but not simple RLWE. Why? Isn’t RLWE the same as VectorLWE but consuming n a values instead of n^2?
An RLWE is a vector of two polynomials (A(X)), B(X)), where each one of them is defined over a polynomial ring (here Zq/(X^N+1)). This means that the product of two polynomials P1 and P2 (each belonging to Zq/(X^N+1)) is P1*P2 mod X^N+1 where each coefficients are reduced mod q.
Differently, a VectorLWE is a list of LWE ciphertexts, meaning that it belongs to Zq^(Dimension x (n+1)), where Dimension is the number of LWE ciphertexts in the VectorLWE and n is the size of the LWE secret key. An LWE (and by extension VectorLWE) relies on modular integer arithmetic only (and not a polynomial one).
In practice, using an RLWE might indeed reduce the memory impact. Using an RLWE you can encrypt up to N messages with a memory cost of 2N instead of N(n+1) for LWEs.
We decided to offer a simplified API for LWE ciphertexts (and not only VectorLWE) because TFHE use-cases traditionally rely on LWE ciphertexts to manipulate encrypted data.
can’t we use Galois Automorphisms to make the polynomial product become a coefficient-wise product? Just like SEAL does, using INTT and NTT