Predicting Module-Lattice Reduction
Léo Ducas, Lynn Engelberts, Paola de Perthuis
TL;DR
The paper analyzes the average-case performance of module-BKZ versus unstructured BKZ, showing that the slope outcome is governed by the discriminant $|\Delta_K|$ of the underlying number field and quantifying the equivalent blocksize gain as $\beta_{eq} = \beta + \frac{\ln\left(\frac{|\Delta_K|}{d^d}\right)}{d \ln\beta} \beta (1+o(1)) + d-1 + o(1)$. It develops a module-lattice extension of the geometric series assumption (module-GSA), decomposing the slope into four terms $t_1$–$t_4$ that capture module-lattice Gaussian heuristics, discriminant gaps, skewness, and index effects, with concrete experimental validation across cyclotomic fields. The authors provide an open-source implementation of module-BKZ for cyclotomic fields, and present detailed predictions showing substantial slope gains for non-power-of-two conductors (e.g., odd primes in the conductor) and a limited, nearly sublinear gain for power-of-two conductors, affecting parameter choices for module-lattice-based cryptosystems. Overall, the work connects slope behavior to algebraic invariants, offering practical guidance for assessing the security and efficiency trade-offs in module-lattice cryptography while outlining key open questions for further refinement and evaluation.
Abstract
Is module-lattice reduction better than unstructured lattice reduction? This question was highlighted as 'Q8' in the Kyber NIST standardization submission (Avanzi et al., 2021), as potentially affecting the concrete security of Kyber and other module-lattice-based schemes. Foundational works on module-lattice reduction (Lee, Pellet-Mary, Stehlé, and Wallet, ASIACRYPT 2019; Mukherjee and Stephens-Davidowitz, CRYPTO 2020) confirmed the existence of such module variants of LLL and block-reduction algorithms, but focus only on provable worst-case asymptotic behavior. In this work, we present a concrete average-case analysis of module-lattice reduction. Specifically, we address the question of the expected slope after running module-BKZ, and pinpoint the discriminant $Δ_K$ of the number field at hand as the main quantity driving this slope. We convert this back into a gain or loss on the blocksize $β$: module-BKZ in a number field $K$ of degree $d$ requires an SVP oracle of dimension $β+ \log(|Δ_K| / d^d)β/(d\log β) + o(β/ \log β)$ to reach the same slope as unstructured BKZ with blocksize $β$. This asymptotic summary hides further terms that we predict concretely using experimentally verified heuristics. Incidentally, we provide the first open-source implementation of module-BKZ for some cyclotomic fields. For power-of-two cyclotomic fields, we have $|Δ_K| = d^d$, and conclude that module-BKZ requires a blocksize larger than its unstructured counterpart by $d-1+o(1)$. On the contrary, for all other cyclotomic fields we have $|Δ_K| < d^d$, so module-BKZ provides a sublinear $Θ(β/\log β)$ gain on the required blocksize, yielding a subexponential speedup of $\exp(Θ(β/\log β))$.