Comment difference rough vs estimate #120
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
malb
reviewed
Aug 23, 2024
README.rst
Outdated
| We currently provide evaluators for the security of the `LWE`, `NTRU`, and `SIS` problems. | ||
| Our estimator integrates simulators for the best known attacks against these problems, and provides | ||
| bit-security estimates relying on heuristics to predict the cost of lattice reduction algorithms, the default being | ||
| using `[MATZOV22] <https://zenodo.org/record/6412487>` for lattice reduction cost, and the GSA assumption |
There was a problem hiding this comment.
We have a references file. Also, we shouldn't hardcode these choices here but document conf.py and point the reader there from here.
README.rst
Outdated
|
|
||
| It is possible to evaluate attacks cost individually, or using the helper functions: | ||
| - `*.estimator.rough`: fast routine that evaluates the security of the problem only against the usually most efficient | ||
| attacks. In this case, note that the concrete lattice reduction cost is evaluated using the non-default "Core-SVP" method |
There was a problem hiding this comment.
This shouldn't be hardcoded here, but the reader should be referred to the docstring of estimate.rough
README.rst
Outdated
| It is possible to evaluate attacks cost individually, or using the helper functions: | ||
| - `*.estimator.rough`: fast routine that evaluates the security of the problem only against the usually most efficient | ||
| attacks. In this case, note that the concrete lattice reduction cost is evaluated using the non-default "Core-SVP" method | ||
| from `[USENIX:ADPS16] <https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_alkim.pdf>`. |
There was a problem hiding this comment.
This is already documented in estimate.rough, we should point there.
estimator/lwe.py
Outdated
| @@ -37,6 +37,9 @@ def rough(self, params, jobs=1, catch_exceptions=True): | |||
| - Arora-GB only applies to bounded noise with at least `n^2` samples. | |||
| - BKW is not competitive. | |||
|
|
|||
| Lattice reduction cost is evaluated based on the non-default "Core-SVP" method from | |||
There was a problem hiding this comment.
This is already documented above in the docstring.
estimator/ntru.py
Outdated
| @@ -33,6 +33,9 @@ def rough(self, params, jobs=1, catch_exceptions=True): | |||
| - The dual hybrid MITM attack only applies to sparse secrets. | |||
| - The dense sublattice attack only applies to possibly overstretched parameters | |||
|
|
|||
| Lattice reduction cost is evaluated based on the non-default "Core-SVP" method from | |||
estimator/sis.py
Outdated
| @@ -27,6 +27,9 @@ def rough(self, params, jobs=1, catch_exceptions=True): | |||
| This function furthermore assumes the following heuristics: | |||
| - None at the moment. May change as more algorithms are added. | |||
|
|
|||
| Lattice reduction cost is evaluated based on the non-default "Core-SVP" method from | |||
|
Thanks for your feedback! I updated the pull request to take it into account, I hope that's better now :) |
|
Great! A few CI failures to take care of but otherwise good to go. Thank you! |
|
Perfect! Should be good now |
|
Ta! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Following a private email discussion with Martin and others, I would suggest adding a comment in the README about the main API and the cost models in use throughout the codebase.
I was quite confused that
roughuses [ADPS16] by default, but the rest of the code rather relies on [MATZOV] for the concrete cost of lattice reduction.