Skip to main content

Table 11 Bit-security estimations under Assumption 1

From: Hybrid dual attack on LWE with arbitrary secrets

Name Core-SVP Model Practical Model
Classical Quantum Classical Quantum
Dual Hybrid 2m Dual Hybrid 2m Dual Hybrid 2m Dual Hybrid 2m
\(\lambda\) \(\lambda\) r \(\lambda\) \(\lambda\) r \(\lambda\) \(\lambda\) r \(\lambda\) \(\lambda\) r
Kyber512 117 114 13 103 102 7 146 140 26 132 128 20
Kyber768 181 175 24 159 157 13 211 201 38 189 183 28
Kyber1024 253 245 34 223 219 19 284 271 49 253 246 34
Saber512 117 114 11 103 102 6 146 141 22 132 129 17
Saber768 189 184 20 166 164 11 219 211 32 196 191 23
Saber1024 258 250 31 227 223 17 288 277 43 257 251 30
Dilithium1024 123 121 14 108 108 6 154 150 26 139 136 20
Dilithium1280 181 179 15 160 159 8 212 208 25 190 188 18
Dilithium1792 251 246 30 221 219 16 282 275 42 252 248 30
Frodo640 141 139 10 124 123 5 171 167 19 154 151 13
Frodo976 205 202 17 181 179 9 236 230 27 211 208 17
Frodo1344 270 264 28 238 235 17 301 292 41 268 263 28
NTRULPrime653 130 125 25 114 112 14 159 149 48 144 137 37
NTRULPrime761 155 148 38 136 133 22 184 172 61 166 158 45
NTRULPrime857 176 168 46 155 151 26 206 192 72 185 176 51
NTRULPrime953 195 187 44 172 168 24 225 211 68 202 193 50
NTRULPrime1013 209 200 45 184 180 25 239 225 67 214 205 48
NTRULPrime1277 269 256 90 237 231 56 300 281 112 268 256 83