diff --git a/estimator/lwe_primal.py b/estimator/lwe_primal.py index aca4de3..87dda2b 100644 --- a/estimator/lwe_primal.py +++ b/estimator/lwe_primal.py @@ -99,6 +99,8 @@ def cost_gsa( tau = False # Tau false ==> instance is homogeneous d = PrimalUSVP._solve_for_d(params, m, beta, tau, xi) if d is None else d + if d < beta: + d = beta # if d == β we assume one SVP call, otherwise poly calls. This makes the cost curve jump, so # we avoid it here. if d == beta and d < m: @@ -197,6 +199,15 @@ def __call__( >>> LWE.primal_usvp(params, red_shape_model=Simulator.CN11, optimize_d=False) rop: ≈2^87.6, red: ≈2^87.6, δ: 1.006114, β: 209, d: 400, tag: usvp + >>> params = LWE.Parameters(n=384, q=2**7, Xs=ND.Uniform(0, 1), Xe=ND.CenteredBinomial(8), m=2*384) + >>> LWE.primal_usvp(params, red_cost_model=RC.BDGL16) # Issue #87 + rop: ≈2^161.8, red: ≈2^161.8, δ: 1.003634, β: 456, d: 595, tag: usvp + + >>> Xe=ND.DiscreteGaussian(stddev=3.19) + >>> params = LWE.Parameters(n=1030, m=2060, q=2**64, Xs=ND.Uniform(0, 1), Xe=Xe) + >>> LWE.primal_usvp(params, red_cost_model=RC.BDGL16) # Issue 95 + rop: ≈2^56.6, red: ≈2^56.6, δ: 1.009686, β: 91, d: 1618, tag: usvp + The success condition was formulated in [USENIX:ADPS16]_ and studied/verified in [AC:AGVW17]_, [C:DDGR20]_, [PKC:PosVir21]_. The treatment of small secrets is from [ACISP:BaiGal14]_. @@ -369,6 +380,10 @@ def cost( else: # we scaled the lattice so that χ_e is what we want eta = PrimalHybrid.svp_dimension(r, params.Xe) + if eta > d: + # Lattice reduction was not strong enough to "reveal" the LWE solution. + # A larger `beta` should perhaps be attempted. + return Cost(rop=oo) svp_cost = costf(red_cost_model, eta, eta) # when η ≪ β, lifting may be a bigger cost svp_cost["rop"] += PrimalHybrid.babai_cost(d - eta)["rop"] @@ -573,6 +588,15 @@ def __call__( >>> LWE.primal_bdd(params) rop: ≈2^43.7, red: ≈2^43.7, svp: ≈2^22.1, β: 40, η: 2, d: 1516, tag: bdd + We also test a LWE instance with a large error (coming from issue #106):: + + >>> LWE.primal_bdd(LWE.Parameters(n=256, q=12289, Xs=ND.UniformMod(2), Xe=ND.UniformMod(1024))) + rop: ≈2^116.3, red: ≈2^41.4, svp: ≈2^116.3, β: 40, η: 340, d: 340, tag: bdd + + >>> LWE.primal_bdd(LWE.Parameters(n=700, q=2**64, Xs=ND.UniformMod(2), Xe=ND.UniformMod(2**59))) + rop: ≈2^263.2, red: ≈2^42.8, svp: ≈2^263.2, β: 40, η: 867, d: 867, tag: bdd + + """ if zeta == 0: