API Reference

src.formulas.ball_log_vol(n)

Calculate the logarithm of the volume of an n-dimensional ball.

Parameters:

n – Dimension of the ball.

Returns:

Logarithm of the volume of the ball.

src.formulas.check_overstreched(params)

Check if the parameters are in the overstretched regime.

Parameters:

params – Dictionary of parameters.

Returns:

Beta value if overstretched, -1 otherwise.

src.formulas.delta(k)

Calculate the root-Hermite factor for a given block size.

Parameters:

k – Block size.

Returns:

Root-Hermite factor.

src.formulas.delta_exact(beta)

Borrowed from the Lattice Estimator :param beta: :return:

src.formulas.log_gh(d, logvol=0)

Calculate the Gaussian Heuristic constant for a given dimension.

Parameters:

• d – Dimension.

• logvol – Logarithm of the volume.

Returns:

Gaussian Heuristic constant.

src.formulas.model_lambda_bdd(d, logq, std_s, std_e, params)

Model the lambda value for the BDD model.

Parameters:

• d – Dimension.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

• std_s_num – Numerical standard deviation of the secret.

• params – Model parameters.

Returns:

Lambda value.

src.formulas.model_lambda_bdd_s(d, logq, params)

Model the lambda value for the simplified BDD model.

Parameters:

• d – Dimension.

• logq – Logarithm of the modulus.

• params – Model parameters.

Returns:

Lambda value.

src.formulas.model_lambda_usvp(d, logq, std_s, std_e, params)

Model the lambda value for the USVP model.

Parameters:

• d – Dimension.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

• params – Model parameters.

Returns:

Lambda value.

src.formulas.model_lambda_usvp_s(d, logq, params)

Model the lambda value for the simplified USVP model.

Parameters:

• d – Dimension.

• logq – Logarithm of the modulus.

• params – Model parameters.

Returns:

Lambda value.

src.formulas.model_n_bdd_rev1(l, logq, std_s, std_e, params)

Model the n value for the BDD model.

Parameters:

• l – Security parameter.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

• params – Model parameters.

Returns:

n value.

src.formulas.model_n_bdd_rev1_exact(l, logq, std_s, std_e, params)

src.formulas.model_n_bdd_s(l, logq, params)

Model the n value for the simplified BDD model.

Parameters:

• l – Security parameter.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

• params – Model parameters.

Returns:

n value.

src.formulas.model_n_usvp(l, logq, std_s, std_e, params)

Model the n value for the USVP model.

Parameters:

• l – Security parameter.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

• params – Model parameters.

Returns:

n value.

src.formulas.model_n_usvp_s(l, logq, params)

Model the n value for the simplified USVP model.

Parameters:

• l – Security parameter.

• logq – Logarithm of the modulus.

• params – Model parameters.

Returns:

n value.

src.formulas.predicted_beta_bdd(n, q, sigma, zeta)

Predict the beta value for the BDD model.

Parameters:

• n – Dimension.

• q – Modulus.

• sigma – Standard deviation of the error.

• zeta – Ratio of standard deviations.

Returns:

Predicted beta value.

src.formulas.predicted_beta_bdd_rev1(n, q, sigma, zeta)

src.formulas.predicted_beta_usvp(d, lnq, sig, chi)

Predict the beta value for the USVP model.

Parameters:

• d – Dimension.

• lnq – Logarithm of the modulus.

• sig – Standard deviation of the error.

• chi – Ratio of standard deviations.

Returns:

Predicted beta value.

src.numerical_solver.numerical_lambda_bdd(n, logq, std_s, std_e)

Estimate the lambda value for the BDD model using numerical methods.

Parameters:

• n – Dimension.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

Returns:

Lambda value.

src.numerical_solver.numerical_lambda_bdd_rev1(n, logq, std_s, std_e)

src.numerical_solver.numerical_lambda_usvp(n, logq, std_s, std_e)

Estimate the lambda value for the USVP model using numerical methods.

Parameters:

• n – Dimension.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

Returns:

Lambda value.

src.numerical_solver.numerical_logq_bdd(l, n, std_s, std_e)

src.numerical_solver.numerical_logq_usvp(l, n, std_s, std_e)

Estimate the n value for the USVP model using numerical methods.

Parameters:

• l – Security parameter.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

Returns:

n value.

src.numerical_solver.numerical_n_bdd(l, logq, std_s, std_e)

Estimate the n value for the BDD model using numerical methods.

Parameters:

• l – Security parameter.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

Returns:

n value.

src.numerical_solver.numerical_n_usvp(l, logq, std_s, std_e)

Estimate the n value for the USVP model using numerical methods.

Parameters:

• l – Security parameter.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

Returns:

n value.

src.numerical_solver.numerical_std_e_bdd(l, n, logq, std_s)

Estimate the std_e value for the BDD model using numerical methods, with retry logic for convergence.

Parameters:

• l – Security parameter.

• n – Dimension.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• retry_range – Tuple specifying the range for random starting points.

• max_retries – Maximum number of retries.

Returns:

std_e value.

src.numerical_solver.numerical_std_e_usvp(l, n, logq, std_s)

Estimate the n value for the USVP model using numerical methods.

Parameters:

• l – Security parameter.

• logq – Logarithm of the modulus.

• std_s – Standard deviation of the secret.

• std_e – Standard deviation of the error.

Returns:

n value.

members:

undoc-members:

show-inheritance:

src.numerical_hybrid.approx_binom(n, k)

Parameters:

• n – integer

• k – integer

Returns:

apprixmation to binom(n,k) from Wiki

src.numerical_hybrid.approx_startpoint_bdd(n, logq, h)

This function is used to compute the starting point for numerical_lambda_hybrid_v2() :param n: LWE dimension :param logq: LWE modulus :param h: Ternary secret weight :return: tuple (beta, d)

src.numerical_hybrid.babai_prob(n, logq, sigma_e, h, beta, d)

The function is taken from the LatticeEstimator (GSA + Babai probability) :param n: LWE dimension :param logq: LWE modulus :param sigma_e: LWE error st. dev :param h: Ternary secret weight :param beta: BKZ parameter :param d: optimal lattice dimension :return: probability of Babai algorithm

src.numerical_hybrid.check_candidates_logq_exact(candidate_list, mitm, std_e, coreSVP)

receives a list of logqs and their corresponding [ng, beta, d] found by numerical_logq_hybrid_runoptimize outputs logq that gives l_ closes to the target security level l according to exact_runtime() :param candidate_list: :return: smallest(?) logq scored by exact_runtime()

src.numerical_hybrid.entropy(x)

Parameters:

x

Returns:

Binary entropy function of x

src.numerical_hybrid.exact_runtime(n, logq, sigma_e, h, beta, d, ng, w, mitm, coreSVP=<function <lambda>>)

The function is needed to filter solutions :param n: LWE dimension :param logq: LWE modulus :param sigma_e: LWE error st. dev :param h: Ternary secret weight :param beta: BKZ parameter :param d: optimal lattice dimension :param ng: Number of guessed coordinates :param w: Weight of guessed secret :return: tuple (runtime of bkz, runtime of enumeration, babai probability) on log2-scale

src.numerical_hybrid.log2_delta(beta)

Parameters:

beta – bkz block size

Returns:

log2(_delta(beta))

src.numerical_hybrid.mitm_babai_probability(n, logq, sigma_e, h, beta, d, fast=False)

The function is taken from the LatticeEstimator (GSA + Babai probability) Compute the “e-admissibility” probability associated to the mitm step, according to [WAHC:SonChe19]

Params r:

the squared GSO lengths

Params stddev:

the std.dev of the error distribution

Parameters:

fast – toggle for setting p = 1 (faster, but underestimates security)

Returns:

probability for the mitm process

src.numerical_hybrid.numerical_lambda_hybrid_v2(n, logq, sigma_e, h, mitm, coreSVP)

Caller’s function for sec. level of hybrid attack :param n: LWE dimension :param logq: LWE modulus :param sigma_e: LWE error st. dev :param h: Ternary secret weight :return: security level for hybrid attack. Return float(‘inf’) if numerical solver fails

src.numerical_hybrid.numerical_logq_hybrid(n, l, h, mitm, std_e, coreSVP)

Parameters:

• n – LWE dimension

• l – Target sec. level

• h – Ternary secret weight

Returns:

logq best scored by check_candidates_logq_exact()

src.numerical_hybrid.numerical_logq_hybrid_runoptimize(n, l, sigma_e, h, initial_guess, mitm, coreSVP)

Internal function. Brute-forces over wg-weight :param n: LWE dimension :param l: Target sec. level :param sigma_e: LWE error st.dev :param h: Ternary secret weight :param initial_guess: tuple (logq, beta) :return: list of tuples [l, n, h, logq, beta, d, ng, wg]

src.numerical_hybrid.numerical_logq_starting_point(n, l, sigma_e, h)

Starting point for logq computations adapted from numerical_logq_bdd() WARNING: the initial point computations rely on BDGL core-SVP. It should be good enough for any known coreSVP model :param n: LWE dimension :param l: Target sec. level :param sigma_e: LWE error st. dev :param h: Ternary secret weight :return: tuple (logq, beta).

src.numerical_hybrid.probability_enum(n, h, ng, w)

This function used to compute exact complexity of hybrid :param n: LWE dimension :param h: Ternary secret weight :param ng: Number of guessed coordinates :param w: Weight of guessed secret :return: Probability that the secret has weight w on ng coordinates

src.numerical_hybrid.ss_enum(ng, w)

This function used to compute exact complexity of hybrid :param ng: Number of guessed coordinates :param w: Weight of guessed secret :return: Number of vectros of dim ng of weight up to (including) w