Solving LWE with Independent Hints about Secret and Errors — Lu, Feng, Pan (2025)

maocred@gmail.com (Halois) — Wed, 27 May 2026 12:00:00 +0800

Reading: Lu, Feng, Pan (2025). Solving LWE with Independent Hints about Secret and Errors.

问题设定： 给定 LWE 实例 $(A, \mathbf{b} = \mathbf{s}A + \mathbf{e} \bmod q)$ 和一组精确的侧信道 hint（关于 $\mathbf{s}$ 或 $\mathbf{e}$ 的内积值），构造 primal attack 格基进行密钥恢复。

本文的改进： 将 Nowakowski-May (ASIACRYPT 2023) 嵌入 hint 时使用的 LLL 约简替换为 Hermite 标准型（HNF）——一个多项式次数更低的整数线性代数操作。Kyber512 上 234 个完美 hint 的基构造从 2.16 小时降至 0.35 小时。格基维度与行列式与 MN23 等价，对完美 hint 行列式略有增大。

本笔记关注： (1) 构造链——hint 转为 lattice hint 后如何通过矩阵乘法嵌入 primal attack 格基；(2) HNF 比 LLL 快在哪——多项式次数的差距及其工程含义；(3) 论文未说但值得追问的部分——带噪 hint、联合 hint、attack pipeline 完整评测的缺失。

Lattice Part 9: Concrete Security of Lattice Schemes — Primal, Dual, BKZ

maocred@gmail.com (Halois) — Wed, 25 Sep 2024 12:00:00 +0800

Reading: Peikert’s survey as the wide-angle frame¹, Albrecht-Player-Scott for concrete-LWE attack modeling², Chen-Nguyen for BKZ quality heuristics³, the Homomorphic Encryption Standard for published parameter-table practice⁴, and the LWE Estimator for the operational interface between these papers and actual numbers⁵.

Parts 0-3 fixed the geometric vocabulary: bases, reduced bases, SVP/CVP, cosets, and short modular witnesses. A deployed lattice scheme then adds concrete parameters such as dimension, modulus, secret distribution, error distribution, and sample count. None of those symbols, by itself, proves that one parameter set costs an attacker $2^{128}$ steps. That last sentence is not a theorem output. It is an attacker model layered on top of the theorem.

So this chapter stays on the attacker side of the interface. The real objects are primal attacks, dual attacks, BKZ block size, root-Hermite factor, and the estimator-style chain that turns $(n,q,\chi,k,m)$ into a work factor only after a long list of modeling decisions has been fixed.

This chapter therefore separates asymptotic hardness claims from concrete parameter-setting practice. It defines primal and dual attack viewpoints clearly, then uses concrete security estimation and attack-cost modeling to map parameter choices to attack-cost estimates.

In that exact sense, the goal is to connect BKZ quality assumptions to concrete lattice-scheme security reasoning rather than to repeat a security badge from the reduction side.

Primal Attack on As it was

Solving LWE with Independent Hints about Secret and Errors — Lu, Feng, Pan (2025)

Lattice Part 9: Concrete Security of Lattice Schemes — Primal, Dual, BKZ