Potential fix for #87 and #95

[ludopulles]

Two clamping changes to hopefully fix the two issues above. As it's a change in the important part primal_usvp of the lattice estimator, I would appreciate someone double-checking if I am not breaking stuff with these changes 😄 .

• Explanation d = max(d, beta): _solve_for_d computes the optimal d using the ABC-formula (aka solving a quadratic equation), and makes sure this value d is in between n and m, but it does not consider beta here. By increasing d, you simply take a "suboptimal" d but one in which you can actually run BKZ-beta.

• Explanation if eta > d: In some cases it turns out beta is low, you have weak BKZ-beat lattice reduction, which does allow you to solve the BDD instance "even with a SVP-call in dimension eta = d + 1" (i.e. the two curves in [PKC:PosVir21]_ do not intersect, not even at non-integer points). Ergo, try bigger block sizes beta in cost_zeta (the level above cost). However, I'm not entirely sure this infinity-cost is handled properly in cost_zeta. The CI doctests suggest it does work.

Closes: #87
Closes: #95

[ludopulles]

Also fixes #106:

from estimator import *
params = LWE.Parameters(n=700, q=2**64, Xs=ND.UniformMod(2), Xe=ND.UniformMod(2**64//2**5))
LWE.primal_bdd(params)

Output: rop: ≈2^263.2, red: ≈2^42.8, svp: ≈2^263.2, β: 40, η: 867, d: 867, tag: bdd

Closes: #106

[malb]

This looks good to me, could we add some tests to show that this fixes these corner cases? Just to prevent future regressions

[ludopulles]

Of course, they are added!

[malb]

Looks good to me. @bencrts do you agree?

[bencrts]

Yep! Thanks @ludopulles