Skip to main content

Table 11 Bit-security estimations under Assumption 1

From: Hybrid dual attack on LWE with arbitrary secrets

Name

Core-SVP Model

Practical Model

Classical

Quantum

Classical

Quantum

Dual

Hybrid 2m

Dual

Hybrid 2m

Dual

Hybrid 2m

Dual

Hybrid 2m

\(\lambda\)

\(\lambda\)

r

\(\lambda\)

\(\lambda\)

r

\(\lambda\)

\(\lambda\)

r

\(\lambda\)

\(\lambda\)

r

Kyber512

117

114

13

103

102

7

146

140

26

132

128

20

Kyber768

181

175

24

159

157

13

211

201

38

189

183

28

Kyber1024

253

245

34

223

219

19

284

271

49

253

246

34

Saber512

117

114

11

103

102

6

146

141

22

132

129

17

Saber768

189

184

20

166

164

11

219

211

32

196

191

23

Saber1024

258

250

31

227

223

17

288

277

43

257

251

30

Dilithium1024

123

121

14

108

108

6

154

150

26

139

136

20

Dilithium1280

181

179

15

160

159

8

212

208

25

190

188

18

Dilithium1792

251

246

30

221

219

16

282

275

42

252

248

30

Frodo640

141

139

10

124

123

5

171

167

19

154

151

13

Frodo976

205

202

17

181

179

9

236

230

27

211

208

17

Frodo1344

270

264

28

238

235

17

301

292

41

268

263

28

NTRULPrime653

130

125

25

114

112

14

159

149

48

144

137

37

NTRULPrime761

155

148

38

136

133

22

184

172

61

166

158

45

NTRULPrime857

176

168

46

155

151

26

206

192

72

185

176

51

NTRULPrime953

195

187

44

172

168

24

225

211

68

202

193

50

NTRULPrime1013

209

200

45

184

180

25

239

225

67

214

205

48

NTRULPrime1277

269

256

90

237

231

56

300

281

112

268

256

83