Skip to main content

Table 12 Bit-security estimations under different cost models and assumptions

From: Hybrid dual attack on LWE with arbitrary secrets

Name Core-SVP Model Practical Model
Assumption 1 Assumption 2 Amortising cost Assumption 1 Assumption 2 Amortising cost
Dual H2M \(\Delta\) Dual H2M \(\Delta\) Dual H2M \(\Delta\) Dual H2M \(\Delta\) Dual H2M \(\Delta\) Dual H2M \(\Delta\)
Kyber512 117 114 3 122 119 3 138 138 0 146 140 6 152 145 7 167 164 3
Kyber768 181 175 6 188 182 6 210 210 0 211 201 10 218 208 10 240 236 4
Kyber1024 253 245 8 263 254 9 292 292 0 284 271 13 294 280 14 323 318 5
Saber512 117 114 3 122 119 3 137 137 0 146 141 5 151 146 5 167 164 3
Saber768 189 184 5 196 191 5 219 219 0 219 211 8 226 218 8 249 245 4
Saber1024 258 250 8 268 260 8 297 297 0 288 277 11 298 286 12 328 324 4
Dilithium1024 123 121 2 126 124 2 135 135 0 154 150 4 157 153 4 165 163 2
Dilithium1280 181 179 2 186 183 3 198 198 0 212 208 4 216 212 4 229 227 2
Dilithium1792 251 246 5 257 252 5 272 272 0 282 275 7 288 281 7 304 301 3
Frodo640 141 139 2 147 145 2 164 164 0 171 167 4 177 172 5 194 192 2
Frodo976 205 202 3 212 209 3 233 233 0 236 230 6 243 237 6 264 261 3
Frodo1344 270 264 6 278 272 6 302 302 0 301 292 9 309 300 9 333 330 3
NTRULPrime653 130 125 5 135 129 6 151 150 1 159 149 10 165 154 11 180 174 6
NTRULPrime761 155 148 7 161 153 8 179 177 2 184 172 12 191 177 14 209 199 10
NTRULPrime857 176 168 8 183 174 9 203 200 3 206 192 14 213 198 15 233 222 11
NTRULPrime953 195 187 8 202 193 9 224 221 3 225 211 14 233 218 15 254 245 9
NTRULPrime1013 209 200 9 217 207 10 239 236 3 239 225 14 247 232 15 270 260 10
NTRULPrime1277 269 256 13 279 264 15 306 299 7 300 281 19 309 289 20 337 323 14
  1. *H2M means Hybrid 2m in this table