estimator.lwe.Estimate

estimator.lwe.Estimate#

class estimator.lwe.Estimate[source]#
__call__(params, red_cost_model=<estimator.reduction.MATZOV object>, red_shape_model='gsa', deny_list=(), add_list=(), jobs=1, catch_exceptions=True, quiet=False)[source]#

Run all estimates, based on the default cost and shape models for lattice reduction.

Parameters:

  • params – LWE parameters.

  • red_cost_model – How to cost lattice reduction.

  • red_shape_model – How to model the shape of a reduced basis (applies to primal attacks)

  • deny_list – skip these algorithms

  • add_list – add these (name, function) pairs to the list of algorithms to estimate.a

  • jobs – Use multiple threads in parallel.

  • catch_exceptions – When an estimate fails, just print a warning.

  • quiet – suppress printing

EXAMPLE

>>> from estimator import *
>>> _ = LWE.estimate(schemes.Kyber512)
bkw                  :: rop: ≈2^178.8, m: ≈2^166.8, mem: ≈2^167.8, b: 14, t1: 0, t2: 16, ℓ: 13, #cod: 448...
usvp                 :: rop: ≈2^143.8, red: ≈2^143.8, δ: 1.003941, β: 406, d: 998, tag: usvp
bdd                  :: rop: ≈2^140.2, red: ≈2^139.1, svp: ≈2^139.3, β: 389, η: 422, d: 1005, tag: bdd
dual                 :: rop: ≈2^149.9, mem: ≈2^97.1, m: 512, β: 424, d: 1024, ↻: 1, tag: dual
dual_hybrid          :: rop: ≈2^139.7, red: ≈2^139.5, guess: ≈2^135.9, β: 387, p: 5, ζ: 0, t: 50, β': 391...

>>> _ = LWE.estimate(schemes.Kyber512, quiet=True)

Methods

__init__()

rough(params[, jobs, catch_exceptions, quiet])

This function makes the following (non-default) somewhat routine assumptions to evaluate the cost of lattice reduction, and to provide comparable numbers with most of the literature:
Contents