A parameter study for LLL and BKZ with application to shortest vector problems

Louis Henkel; Nikolay Tcholtchev; Ren\'e Zander; Tobias K\"oppl

REVIEW 3 major objections 5 minor 23 references

A parameter study for LLL and BKZ with application to shortest vector problems

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Breakable LWE key length grows only logarithmically with modulus

desk verdict A careful but limited parameter scan of LLL/BKZ on tiny LWE instances; the data are credible as reported, but the headline logarithmic scaling is under-supported and needs uncertainty quantification. read the letter →

arxiv 2502.05160 v1 pith:RPLDE5GQ submitted 2025-02-07 cs.CR

Tobias Köppl , René Zander , Louis Henkel , Nikolay Tcholtchev This is my paper · ORCID

classification cs.CR

keywords learningwitherrors(LWE)shortestvectorproblem(SVP)LLLalgorithmBKZlatticereductionparameterstudymodule-latticekeyencapsulation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks when two standard lattice-reduction algorithms, LLL and BKZ, can actually recover the secret from a learning-with-errors (LWE) instance after converting it into a shortest-vector problem. Running many instances with key length n and ring modulus q, it reports that for fixed q the LLL success probability falls exponentially with n, while for fixed n success rises with q; the largest n at which LLL still succeeds half the time grows logarithmically in q. BKZ behaves similarly, with larger block sizes recovering secrets at larger n at exponentially growing runtime. If these scalings hold, they map a practical boundary for lattice-reduction attacks and caution that raising the modulus alone does not buy much added security when the error is small.

What carries the argument

The argument rests on three objects: the lattice embedding that turns an LWE instance into a shortest-vector problem by building a basis whose rows generate a lattice containing the secret-error vector; the LLL and BKZ reduction routines, which return a reduced basis and count as successful when that basis contains a solution vector; and the sigmoid model $p_{\rho,\sigma}(n) = 1 - (1 + \exp(\rho - \sigma n))^{-1}$ used to summarize the discrete success measurements. The model's two parameters $\rho$ and $\sigma$ are fitted per modulus, and their ratio $\rho/\sigma$ defines the key length with 50% success. That ratio is what produces the logarithmic growth curve in the paper's Figure 2.

What would settle it

Measure LLL success directly at many moduli $q$ spanning several orders of magnitude, with fine steps in key length $n$ around the predicted 50% threshold, using enough instances per point to keep confidence intervals narrow. If the directly observed 50% key length does not grow logarithmically in $q$ (for example, if it saturates or grows linearly), the central claim is falsified. A minimal check: for $q = 3329$ the fitted curve predicts near-certain success at $n = 40$; observing success below 50% there would already contradict the model.

Watch

Extended reading notes

Core claim

The paper's central empirical discovery is a quantitative boundary for LLL on LWE-derived shortest-vector problems: after embedding an LWE instance into a lattice and applying LLL, the success probability decreases exponentially with key length n for fixed modulus q, and the key length at which success crosses 50% grows logarithmically with q. The paper derives this from fitting sigmoid curves to measured success rates for moduli q in {71, 401, 3329} and reading the 50% threshold from the fitted parameters. For BKZ, success increases with block size beta, and for beta = 56 the algorithm still recovers secrets in 28% of instances at n = 104 with q = 401. The paper interprets these results as showing that practical vulnerability extends far beyond the theoretical regime where the modulus exceeds the squared key length, and that parameter selection must treat n and q as coupled.

Load-bearing premise

The logarithmic scaling of the breakable key length rests on the assumption that the measured success-probability curve is a smooth S-shaped (sigmoid) curve, so that its 50% point can be recovered from two fitted parameters; if the true curve has a different shape, the reported logarithmic trend could be an artifact of the fit rather than a property of the algorithms.

Editorial extensions

If this is right

If LLL's 50% threshold grows as $\log q$, then increasing the modulus from $q$ to $q^2$ only adds a constant amount to the key length an attacker can handle, so security parameters cannot rely on large $q$ alone.
For BKZ, the success curves imply a concrete trade-off: raising block size $\beta$ buys access to larger key lengths, but the runtime grows exponentially in $\beta$, so there is a sharp cost ceiling.
The measured vulnerable region sits well inside the theoretical guarantee region; designers should use empirical boundaries to decide when lattice reduction must be combined with other solvers.
For fixed key length, larger moduli make LWE instances easier for both LLL and BKZ, so parameter sets that scale $q$ without scaling $n$ are systematically weaker.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The logarithmic scaling likely extends only to the tested range of moduli; at very large $q$ the embedding's shortest vector may no longer be the secret-error vector, so the curve should bend or break. That is a testable prediction: repeat the sweep at $q$ beyond 3329 and watch for the 50% threshold to stop growing.
The study fixes the error distribution to values in $\{-2,\ldots,2\}$; with wider error, the secret vector is less distinctive, and both the key-length threshold and its dependence on $q$ would likely shift, giving a way to separate the effect of error width from the effect of modulus.
The same threshold methodology could be applied to the multi-block parameter sets used by the standardized module-lattice scheme, where the block structure may change how $n$ and $q$ trade off.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's my take. The paper does one thing and does it cleanly: it measures LLL and BKZ success probabilities on small LWE-derived SVP instances across a grid of n and q, and summarizes the LLL curves with a sigmoid fit. That is useful reference data for benchmarking hybrid solvers, and the qualitative trends—larger q helps, larger block size helps, larger n hurts—are reproduced cleanly and are consistent with prior work, including the Laine–Lauter result the authors cite.

The soft spot is the headline quantitative claim. The 'maximum key length for 50% success' is computed as rho/sigma from the sigmoid fit, and the paper only reports fit parameters for three moduli (q=71, 401, 3329). If Figure 2 really uses only those three points, the claimed logarithmic scaling is not distinguishable from any monotone concave curve; if it uses all eight moduli, the case is still thin because there is no uncertainty quantification. With 128 instances per (n,q), binomial standard errors reach about 4.4 percentage points, and a point near the transition can move rho/sigma by more than one grid step. So the logarithmic law is plausible but not established to the precision the figures imply.

A second, smaller issue: the BKZ experiments discard instances with floating-point precision errors, which can bias success probabilities upward in the large-n, high-beta regime where the boundary is claimed. The paper should report how many instances were discarded and count them as failures in a sensitivity check.

Context matters: the tested sizes are n up to 112 and k=1, far below actual ML-KEM parameters (n=256, k=2–4). So the security implications are limited, which the authors mostly acknowledge.

Who is this for? Anyone doing empirical benchmarking of lattice reduction on small instances, or building hybrid solvers that need to know when plain LLL/BKZ is enough. It is not a security analysis of ML-KEM. It deserves a serious referee: the experimental design is transparent, the write-up is honest, and the weaknesses are fixable with more reporting rather than a different method. I would send it to review, with the request that the authors add uncertainty quantification and clarify exactly which moduli go into Figure 2.

Referee Report

3 major / 5 minor

Summary. This paper experimentally evaluates the LLL and BKZ lattice reduction algorithms on SVP instances obtained from LWE problems via Bai-Galbraith embedding, using parameter ranges inspired by FIPS 203 but with block count k=1. For LLL it measures success probability over 128 instances per (n,q) for n=8,...,80 and q in {3,17,71,277,401,521,1031,3329}, fits sigmoid curves, and infers that the maximum key length for 50% success grows logarithmically with q. For BKZ it measures success over 512/256 instances for n up to 112, q in {71,401,3329}, and block sizes beta=8,...,56, and reports success probabilities and runtimes. The central claims are the logarithmic scaling of the LLL threshold and the qualitative dependence of success on beta and q.

Significance. The paper provides a useful empirical snapshot of where small-scale LWE-derived SVP instances are solvable by standard lattice reduction, and the qualitative monotonicity results are plausible and consistent with prior work. The use of standard fpylll implementations and a reasonably broad parameter grid are strengths. However, the headline quantitative claim (logarithmic growth of the LLL threshold) is derived entirely from a three-point logistic fit without uncertainty quantification, so the significance of that specific result is currently not established; the paper is more convincing as a qualitative parameter study.

major comments (3)

[Section IV-A, Figure 2] The logarithmic-growth claim is supported only by fitting the sigmoid p_{rho,sigma}(n) = 1 - (1 + exp(rho - sigma n))^{-1} separately for q=71, 401, 3329 and plotting rho/sigma as the 50% threshold. With only three moduli, the fitted curve in Figure 2 cannot distinguish logarithmic growth from any monotone concave trend, and no confidence intervals, residuals, or fit-quality diagnostics are reported; a single borderline point among the 128-instance binomial samples can move rho/sigma by more than one grid step. Please report the thresholds for all eight moduli with uncertainty intervals, or downgrade the claim to a qualitative trend.
[Section IV-A and IV-B, sample sizes] The empirical probabilities are not accompanied by confidence intervals. For LLL, 128 instances per (n,q) give a binomial standard error of up to about 4.4 percentage points near p=0.5; for BKZ, the reduced sample sizes at large n have similar issues. Since the fitted thresholds and the BKZ boundary are read off from these probabilities, the absence of confidence intervals leaves the numerical thresholds, not just the qualitative trends, unquantified. Please add confidence intervals or provide raw per-instance outcomes.
[Section IV-B, discarded instances] The statement 'Instances that encountered errors due to insufficient floating-point precision during the BKZ calculations were discarded' is a potential source of selection bias. If precision failures occur preferentially on harder instances (larger n, larger beta), the reported success probabilities are biased upward exactly in the regime where the BKZ boundary is claimed. Please report the fraction of discarded instances per (n,beta) and, if possible, re-run with higher precision or treat precision failure as a failure outcome in a sensitivity analysis.

minor comments (5)

[Section IV-A] The text states that the success probability 'decreases exponentially' with key length, but the fitted model is a logistic curve; the exponential decay holds only in the tail. Please clarify the wording or fit an exponential model.
[Section II, reference [3]] The embedding in Section II is attributed to Bai and Galbraith, but the cited reference [3] is Albrecht et al.; a proper citation to the original Bai-Galbraith work or a source describing the embedding is missing.
[Throughout] There are several typos: 'bock size' in Sections III and IV-B, 'latticed-based' in Section IV-C, and 'Transitioning' in reference [1].
[Section IV, experimental setup] The experiments restrict to k=1, while FIPS 203 uses k=2,3,4. The paper should state whether the conclusions are expected to carry over to the structured k>1 case, since the block count changes the lattice dimension m=kn.
[General] No code or data availability statement is provided. For an empirical parameter study, releasing instance generation scripts and raw outcomes would substantially strengthen reproducibility.

Circularity Check

1 steps flagged · score 6.0 of 10

The logarithmic scaling of the LLL threshold is a fitted quantity (ρ/σ) presented as an empirical result; underlying success-probability data are independent, so circularity is partial.

fitted input called prediction [Section IV-A and Figure 2 caption]
"This Figure shows the maximum key length n for which the probability that the LLL algorithm recovers the secret is at least 50% for varying modulus q. The results indicate that this key length n grows logarithmically with the modulus q. [...] The values n are computed as the ratio of the fit parameters ρ/σ."

The 50% threshold is not measured directly on the n grid; it is defined as n = ρ/σ from the sigmoid p_{ρ,σ}(n) = 1 − (1 + exp(ρ − σn))^{-1} fitted to the measured success probabilities. Thus the 'maximum key length' displayed in Figure 2 is a deterministic function of the fitted parameters, and the claimed logarithmic growth of this threshold with q is a statement about the fitted ρ/σ values, not about an independently observed quantity. If the sigmoid is misspecified or the fit parameters are uncertain (only 128 instances per (n,q) with no confidence intervals or residual diagnostics), the logarithmic scaling and numerical thresholds are artifacts of the fitting procedure.

full rationale

The core experimental data—success probabilities of LLL and BKZ per (n, q, β)—are direct observations and are not circular. The qualitative findings that success decreases with n and increases with q rest on those measurements. However, the paper's central quantitative claim, that the maximum LLL-solvable key length grows logarithmically with q, is not based on directly measured thresholds. The text explicitly states that the values in Figure 2 are 'computed as the ratio of the fit parameters ρ/σ', so the logarithmic law is a property of the fitted sigmoid parameters, not of an independently measured quantity. This is a fitted parameter renamed as an empirical result, and it is load-bearing for the strongest claim. The self-citations [8] and [18] are background references and are not load-bearing for the central derivation. The BKZ floating-point-error discarding is a bias concern, not circularity. Overall, the paper is partially circular: one central numeric result reduces to the fit, while the underlying measurements remain independent.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The fitted sigmoid parameters are the only free numbers in the analysis. The threshold n = rho/sigma is derived from them. The LLL delta and BKZ block sizes are chosen hyperparameters, not fitted. The paper introduces no new entities.

free parameters (6)

rho for q=71 = 9.32
Sigmoid fit parameter from Section IV-A, used to compute the 50 percent success threshold.
sigma for q=71 = 0.35
Sigmoid fit parameter from Section IV-A, used to compute the 50 percent success threshold.
rho for q=401 = 17.00
Sigmoid fit parameter from Section IV-A, used to compute the 50 percent success threshold.
sigma for q=401 = 0.36
Sigmoid fit parameter from Section IV-A, used to compute the 50 percent success threshold.
rho for q=3329 = 26.94
Sigmoid fit parameter from Section IV-A, used to compute the 50 percent success threshold.
sigma for q=3329 = 0.38
Sigmoid fit parameter from Section IV-A, used to compute the 50 percent success threshold.

assumptions (5)

standard math Bai-Galbraith embedding produces a lattice whose shortest vector corresponds to the LWE secret-error vector (s,e,1).
Used in Section II, Step (3), to reformulate LWE as SVP. This is a known construction.
domain assumption The secret and error entries are drawn from a centered binomial distribution with support in {-2,...,2}.
Section IV states this but does not give the exact distribution parameters or sampling procedure, which affects instance hardness.
domain assumption The fpylll implementations of LLL and BKZ 2.0 are correct and representative of the algorithms.
The experiments rely entirely on fpylll, so any implementation bug would affect all results.
domain assumption The success of an attack is correctly determined by checking whether the reduced basis contains the secret vector.
Section IV defines success as the secret being recovered, but the exact extraction procedure from the reduced basis is not described.
ad hoc to paper A sigmoid function p(rho,sigma,n) = 1 - (1 + exp(rho - sigma n))^{-1} is an appropriate model for the success probability as a function of key length.
This functional form is chosen by the authors in Section IV-A to fit the data and is then used to derive the threshold curve in Figure 2.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A parameter study for LLL and BKZ with application to shortest vector problems." pith.science (2026). https://pith.science/paper/RPLDE5GQ

@misc{pith2026250205160,
  author       = {Pith},
  title        = {Pith review of: A parameter study for LLL and BKZ with application to shortest vector problems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RPLDE5GQ}},
  note         = {Machine review of arXiv:2502.05160}
}

read the original abstract

In this work, we study the solution of shortest vector problems (SVPs) arising in terms of learning with error problems (LWEs). LWEs are linear systems of equations over a modular ring, where a perturbation vector is added to the right-hand side. This type of problem is of great interest, since LWEs have to be solved in order to be able to break lattice-based cryptosystems as the Module-Lattice-Based Key-Encapsulation Mechanism published by NIST in 2024. Due to this fact, several classical and quantum-based algorithms have been studied to solve SVPs. Two well-known algorithms that can be used to simplify a given SVP are the Lenstra-Lenstra-Lov\'asz (LLL) algorithm and the Block Korkine-Zolotarev (BKZ) algorithm. LLL and BKZ construct bases that can be used to compute or approximate solutions of the SVP. We study the performance of both algorithms for SVPs with different sizes and modular rings. Thereby, application of LLL or BKZ to a given SVP is considered to be successful if they produce bases containing a solution vector of the SVP.

Figures

Figures reproduced from arXiv: 2502.05160 by the authors.

**Figure 3.** The average runtime for the BKZ algorithm for varying block size [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

**Figure 4.** The probability that the BKZ algorithm recovers the secret for varying key length [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 22 canonical work pages

[1]

Securing Tomorrow, Today: Trasitioning to Post-Quantum Cryptography,

Bundesamt f ¨ur Informationssicherheit, “Securing Tomorrow, Today: Trasitioning to Post-Quantum Cryptography,” A joint statement from partners from 18 EU member states, https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/PQC- joint-statement.pdf? blob=publicationFile&v=5, Accessed: 02.02.2025, 2024

work page 2025
[2]

FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard,

National Institute of Standards and Technology, “FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard,” https://csrc.nist.gov/pubs/fips/203/ipd, 2024

work page 2024
[3]

Revisiting the Expected Cost of Solving uSVP and Applications to LWE,

M. R. Albrecht, G. G ¨opfert, F. Virdia, T. Wunderer, “Revisiting the Expected Cost of Solving uSVP and Applications to LWE,” Advances in Cryptology – ASIACRYPT 2017, Springer International Publishing, pp. 297–322, 2017

work page 2017
[4]

Post-quantum cryptography,

D. Bernstein and T. Lange, “Post-quantum cryptography,” Nature, vol. 549, pp. 188–194, 2017

work page 2017
[5]

A hybrid lattice basis reduction and quantum search attack on LWE,

F. G ¨opfert, C. van Vredendaal and T. Wunderer, “A hybrid lattice basis reduction and quantum search attack on LWE,” In Post-Quantum Cryptography: 8th International Workshop, PQCrypto 2017, Proceedings 8 (pp. 184–202). Springer International Publishing, 2017

work page 2017
[6]

Toeplitz and circulant matrices: A review,

R. Gray, “Toeplitz and circulant matrices: A review,” Foundations and Trends® in Communications and Information Theory, vol. 2(3), pp. 155– 239, 2006

work page 2006
[7]

A fast quantum mechanical algorithm for database search,

L. K. Grover, “A fast quantum mechanical algorithm for database search,” Proceedings of the twenty-eighth annual ACM symposium on Theory of computing, pp. 212–219, 1996

work page 1996
[8]

Resilience of lattice-based Cryptosystems to Quantum Attacks,

T. K ¨oppl, R. Zander and N. Tcholtchev, “Resilience of lattice-based Cryptosystems to Quantum Attacks,” 2024 IEEE Symposium on Com- puters and Communications (ISCC), pp. 1–6, 2024

work page 2024

Show all 23 references

[9]

Post quantum cryptography (PQC)–An overview,

M. Kumar and P. Pattnaik, “Post quantum cryptography (PQC)–An overview,” 2020 IEEE High Performance Extreme Computing Confer- ence (HPEC), pp. 1–9, 2020

2020
[10]

Key Recovery for LWE in Polynomial Time,

K. Laine, K. Lauter, “Key Recovery for LWE in Polynomial Time,” Cryptology ePrint Archive, Paper 2015/176, 2015

2015
[11]

Factoring polynomials with rational coefficients,

A. Lenstra, H. Lenstra and L. Lov ´asz, “Factoring polynomials with rational coefficients,” Mathematische Annalen, vol. 261, pp. 515–534, 1982

1982
[12]

Using Variational Quantum Algorithm to Solve the LWE Problem,

L. Lv et al., “Using Variational Quantum Algorithm to Solve the LWE Problem,” Entropy, vol. 24, pp. 1428, 2022

2022
[13]

A complete analysis of the BKZ lattice reduction algorithm,

J. Li and P. Nguyen, “A complete analysis of the BKZ lattice reduction algorithm,” Journal of Cryptology, 38, 1, pp. 1–58, Springer, 2025

2025
[14]

A decade of lattice cryptography,

C. Peikert, “A decade of lattice cryptography,” Foundations and trends® in theoretical computer science, vol. 10, pp. 283–424, 2016

2016
[15]

Grover’s oracle for the Shortest Vector Problem and its application in hybrid classical-quantum solver,

M. Prokop, P. Wallden and D. Joseph, “Grover’s oracle for the Shortest Vector Problem and its application in hybrid classical-quantum solver,” IEEE Transactions on Quantum Engineering, IEEE Transactions on Quantum Engineering, 2024

2024
[16]

Extended Lattice Reduction Experiments Using the BKZ Algorithm,

M. Schneider, J. Buchmann, “Extended Lattice Reduction Experiments Using the BKZ Algorithm,” Lecture Notes in Informatics (LNI), Pro- ceedings – Series of the Gesellschaft fur Informatik (GI), pp. 241–252, 2010

2010
[17]

Lattice basis reduction: Improved practical algorithms and solving subset sum problems,

C. P. Schnorr, M. Euchner, “Lattice basis reduction: Improved practical algorithms and solving subset sum problems,” Mathematical Program- ming, vol. 66, pp. 181-189, 1994

1994
[18]

Qrisp: A Framework for Compilable High-Level Pro- gramming of Gate-Based Quantum Computers,

R. Seidel, S. Bock, R. Zander, M. Petri ˇc, N. Steinmann, N. Tcholtchev, M. Hauswirth, “Qrisp: A Framework for Compilable High-Level Pro- gramming of Gate-Based Quantum Computers,” arXiv:2406.14792, 2024

2024 arXiv
[19]

Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,

P. W. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,” SIAM Journal on Computing, vol. 26, pp. 1484–1509, 1997

1997
[20]

Shortest Vectors in Lattices of Bai-Galbraith’s Embedding Attack on the LWE Problem,

S. Uemura, K. Fukushima, S. Kiyomoto, M. Kudo and T. Takagi, “Shortest Vectors in Lattices of Bai-Galbraith’s Embedding Attack on the LWE Problem,” Advances in Information and Computer Security: 16th International Workshop on Security, IWSEC 2021, Virtual Event, September 8–10...

2021
[21]

Improved Progressive BKZ with Lattice Sieving and a Two-Step Mode for Solving uSVP,

W. Xia, L. Wang, D. Gu and B. Wang, “Improved Progressive BKZ with Lattice Sieving and a Two-Step Mode for Solving uSVP,” Cryptology ePrint Archive, Paper 2022/1343, 2022

2022
[22]

fpylll, a Python wrapper for the fplll lattice reduction library, Version 0.6.1,

The FPLLL Developers, “fpylll, a Python wrapper for the fplll lattice reduction library, Version 0.6.1,” https://github.com/fplll/fpylll, 2024

2024
[23]

SageMath, the Sage Mathematics Software System, Version 10.0,

The Sage Developers, “SageMath, the Sage Mathematics Software System, Version 10.0,” https://www.sagemath.org, 2024

2024

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [1]

Securing Tomorrow, Today: Trasitioning to Post-Quantum Cryptography,

Bundesamt f ¨ur Informationssicherheit, “Securing Tomorrow, Today: Trasitioning to Post-Quantum Cryptography,” A joint statement from partners from 18 EU member states, https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/PQC- joint-statement.pdf? blob=publicationFile&v=5, Accessed: 02.02.2025, 2024

work page 2025

[2] [2]

FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard,

National Institute of Standards and Technology, “FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard,” https://csrc.nist.gov/pubs/fips/203/ipd, 2024

work page 2024

[3] [3]

Revisiting the Expected Cost of Solving uSVP and Applications to LWE,

M. R. Albrecht, G. G ¨opfert, F. Virdia, T. Wunderer, “Revisiting the Expected Cost of Solving uSVP and Applications to LWE,” Advances in Cryptology – ASIACRYPT 2017, Springer International Publishing, pp. 297–322, 2017

work page 2017

[4] [4]

Post-quantum cryptography,

D. Bernstein and T. Lange, “Post-quantum cryptography,” Nature, vol. 549, pp. 188–194, 2017

work page 2017

[5] [5]

A hybrid lattice basis reduction and quantum search attack on LWE,

F. G ¨opfert, C. van Vredendaal and T. Wunderer, “A hybrid lattice basis reduction and quantum search attack on LWE,” In Post-Quantum Cryptography: 8th International Workshop, PQCrypto 2017, Proceedings 8 (pp. 184–202). Springer International Publishing, 2017

work page 2017

[6] [6]

Toeplitz and circulant matrices: A review,

R. Gray, “Toeplitz and circulant matrices: A review,” Foundations and Trends® in Communications and Information Theory, vol. 2(3), pp. 155– 239, 2006

work page 2006

[7] [7]

A fast quantum mechanical algorithm for database search,

L. K. Grover, “A fast quantum mechanical algorithm for database search,” Proceedings of the twenty-eighth annual ACM symposium on Theory of computing, pp. 212–219, 1996

work page 1996

[8] [8]

Resilience of lattice-based Cryptosystems to Quantum Attacks,

T. K ¨oppl, R. Zander and N. Tcholtchev, “Resilience of lattice-based Cryptosystems to Quantum Attacks,” 2024 IEEE Symposium on Com- puters and Communications (ISCC), pp. 1–6, 2024

work page 2024