A Refined Hardness Estimation of LWE in Two-Step Mode

Download PDF
Open Webpage

Wenwen Xia, Leizhang Wang, Geng Wang, Dawu Gu, Baocang Wang

Published: 2024, Last Modified: 21 Jan 2026Public Key Cryptography (3) 2024EveryoneRevisionsBibTeXCC BY-SA 4.0
Abstract: Recently, researchers have proposed many LWE estimators, such as lattice-estimator (Albrecht et al, Asiacrypt 2017) and leaky-LWE-Estimator (Dachman-Soled et al, Crypto 2020), while the latter has already been used in estimating the security level of Kyber and Dilithium using only BKZ. However, we prove in this paper that solving LWE by combining a lattice reduction step (by LLL or BKZ) and a target vector searching step (by enumeration or sieving), which we call a Two-step mode, is more efficient than using only BKZ.