Skip to content

Local minimums in zeta search for primal hybrid #171

@TabOg

Description

@TabOg

Summary

In the primal hybrid estimator, the binary search for zeta is finding attacks which are not the best globally, and so overestimating security. Initially raised as a PR (#170)

To Reproduce

parameters = LWE.Parameters(n=2**17, q = 2**3104, Xs=ND.SparseTernary(p=96, m=96, n=2 ** 17), Xe=ND.DiscreteGaussian(3.19), m=oo)
LWE.primal_hybrid(parameters, babai=False, mitm=True)
>> rop: ≈2^152.3, red: ≈2^152.2, svp: ≈2^148.1, β: 248, η: 32, ζ: ≈2^15.0 ...

Expected behaviour

At least as good an attack without mitm switched on:

LWE.primal_hybrid(parameters, babai=False, mitm=False)
>> rop: ≈2^141.4, red: ≈2^141.3, svp: ≈2^136.1, β: 350, η: 2, ζ: ≈2^12.9 ...

and with a different minimum finder (ternary search), found

>> rop: ≈2^134.9, red: ≈2^134.6, svp: ≈2^132.2, β: 322, η: 33, ζ: ≈2^13.8 ...

Additional context

Believe this is happening for a lot of parameters which are large, based on replacing binary search with ternary search.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions