13 ms·

Does this result apply to all LWE problems? Does this approach care about LWE vs Ring-LWE at all? If so, it's a big blow to systems like FrodoKEM that banked o

• tux3 2y ago
  Not a lattice expert, so add salt to taste, but it looks like LWE in general (incluring RLWE) But the current attack essentially wants q > n^2, so even if it is confirmed, not all LWE schemes are dead. There will certainly be people who tweak the params in response and carry on. However, attacks only get better. And for people in FHE who are squeezed between performance problems and dangerously thin security parameters, it is a bad day if confirmed. There's no credible practical alternative to LWE for FHE...
• j2kun 2y ago
  RingLWE security reduces to LWE via a relatively simple reduction (see https://www.jeremykun.com/2022/12/28/estimating-the-security-of-ring-learning-with-errors-rlwe/ https://www.jeremykun.com/2022/12/28/estimating-the-security...).