mirror of
https://github.com/lux-apps/papers.git
synced 2026-11-03 05:07:46 +00:00
zeekay
4a753bb639
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
25 lines
997 B
TeX
25 lines
997 B
TeX
\section{Security Parameters and Concrete Hardness}
|
|
|
|
|
|
\subsection{How to Choose Parameters}
|
|
|
|
Lattice parameters are chosen to resist the best known attacks. The primary attack is
|
|
the \emph{primal lattice attack} using the BKZ algorithm:
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item Construct a lattice from the LWE instance.
|
|
\item Run BKZ with block size $\beta$ to find a short vector.
|
|
\item The cost is approximately $2^{0.292\beta}$ classical operations (Core-SVP model).
|
|
\end{enumerate}
|
|
|
|
For 128-bit security, we need $\beta \geq 439$, which corresponds to ML-KEM-768 parameters.
|
|
|
|
\subsection{Quantum Security}
|
|
|
|
The best known quantum speedup for lattice attacks is Grover-like: $2^{0.265\beta}$
|
|
instead of $2^{0.292\beta}$. This is a modest improvement---unlike the exponential
|
|
speedup Shor provides against RSA/ECC. Lattice schemes with 128-bit classical security
|
|
provide approximately 117-bit quantum security, which is sufficient.
|
|
|
|
%% ============================================================
|