Table 3 A comparison of BKW algorithms in sample reduction and hypothesis testing
BKW algorithms | Sample reduction | Hypothesis testing |
|---|---|---|
Plain BKW | Reduces a fixed number of positions to zero | Optimal distinguisher |
FFT-BKW | Same as Plain BKW except removing the final iteration | FFT distinguisher |
LMS-BKW | Reduces a fixed number of positions to a small value not to zero by combining lazy modulus switching | Optimal distinguisher |
Coded-BKW | Reduces an increasing number of positions to a small value not to zero by combining linear lattice codes | Subspace hypothesis testing + FFT |
Sieve-Coded-BKW | Reduces a decreasing number of positions to a small value not to zero by combining linear lattice codes and sieving. Different cases with different reduction factors | Subspace hypothesis testing + FFT |
BKW-FWHT-SR | Fully reduces a given amount of positions and partially reduces an additional position to configured values | Map LWE to LPN + FWHT distinguisher |