> Instead of performing 96 lattice reductions with a near guarantee of recovering 96 smooth values, a very rough approximation with the correct determinant indi

> Instead of performing 96 lattice reductions with a near guarantee of recovering 96 smooth values, a very rough approximation with the correct determinant indicates that we would need to perform 2^200 reductions of enormous lattices to find enough smooth values. > This is well beyond any plausible computation. It strongly suggests that this particular approach does not scale to the point of practically breaking RSA. > However, there are many open questions. Would a different lattice construction avoid this problem? Can the bound be established in another way? What are the concrete performance numbers and asymptotic complexity? - Keegan Ryan https://twitter.com/inf_0_/status/1367377462582079489 https://twitter.com/inf_0_/status/1367377462582079489