General LWE Parameters#

While our formulas are fine-tuned for FHE settings, our tool allows users to input arbitrary LWE parameters \((\lambda, n, \sigma_e, \sigma_s, q)\).

In particular, \(\sigma_s\) and \(\sigma_e\) can be chosen from the following distributions:

Uniform binary distribution \(\mathcal{U}_2\): Use the command --secret "binary".
Uniform ternary distribution \(\mathcal{U}_3\): Use the command --secret "ternary".
Uniform modulus distribution \(\mathcal{U}_p\): Use the command --secret "uniformmod" --p "5".
Uniform distribution \(\mathcal{U}_{[a,b]}\): Use the command --secret "uniform" --a "-1" --b "1".
Sparse ternary distribution \(\mathcal{HWT}(h)\): Use the command --secret "sparse" --hw "128", where hw is the Hamming weight \(h\).
Discrete Gaussian distribution \(\mathcal{D}_{\mathbb{Z}, \sigma^2}\): Use the command --secret "gaussian" --sig "3.19".
Centered binomial distribution \(\psi_\eta\): Use the command --secret "binomial" --eta "21".

In this case, we recommend using the option --num-only, which disables the fine-tuned formulas and runs only our numerical solver.

To evaluate the security of the Kyber scheme with \(n = 512\) and \(\log q = 11\), use the following command:

python3 estimate.py --param "lambda" --n "512" --logq "11" \
   --secret "binomial" --error "binomial" --std "1.22" --num-only

secret dist.     | lwe dim. | log q | usvp num | est usvp | bdd num | est bdd | output
-----------------+----------+-------+----------+----------+---------+---------+-------
CenteredBinomial | 512      | 11    | 136      | 137      | 136     | 131     | 136