Entropy Suffices for Key Guessing

ePrint Report: Entropy Suffices for Key Guessing

Timo Glaser, Alexander May, Julian Nowakowski

Modern (lattice-based) cryptosystems typically sample their secret keys component-wise and independently from a discrete probability distribution $\chi$. For instance, KYBER has secret key entries from the centered binomial distribution, DILITHIUM from the uniform distribution, and FALCON from the discrete Gaussian.
As attacks may require guessing of a subset of the secret key coordinates, the complexity of enumerating such sub-keys is of fundamental importance.

Any length-$n$ sub-key with …

attacks distribution entropy eprint report falcon instance key keys may report secret secret key secret keys