Beyond LWE: Post-Quantum Assumptions under a Counterfactual Break of the Dihedral Coset Problem

Beyond LWE: Post-Quantum Assumptions under a Counterfactual Break of the Dihedral Coset Problem Ramses Fernandez[0000-0002-8959-636X] AegisQ Technologies rfernandez@aegisq.tech

arXiv:2610.36731v1 [cs.CR] 27 Oct 2026

October 28, 2026

Abstract A refuted 2026 claim of an efficient quantum algorithm for the Dihedral Coset Problem (DCP) motivates this survey of the consequences of a genuine breakthrough. We distinguish a noiseless cyclic coset-state solver, a solver with a prescribed failure exponent, and an extrapolated-state solver. Regev’s rare-corruption observation already makes the first hypothesis sufficient for lattice algorithms at some polynomial approximation factors; the witnessing algorithm determines the quantitative bounds. We compose unstructured reductions with explicit sample, state-preparation and success conditions, and compare their sufficient guarantees with more than thirty lattice and non-lattice assumptions. We restate the structured state conversion of Wen and Zheng and audit its forward parameter certificate; the printed bound supplies no certificate at the ML-KEM ring and modulus. We use an explicit affine embedding for heuristic gap estimates, explain the lossiness connection from decision NTRU to search Ring-LWE, and distinguish ordinary from module uniqueness. Chen’s withdrawn 2024 quantum algorithm for LWE and a proposed repair of its post-processing would, if correct, reach only a many-sample, small-noise LWE regime that the failure-exponent hypothesis already covers for exponents below 1/2, and no deployed parameter set. Tables separate rigorous consequences, heuristic comparisons and unverified applications, and distinguish solving a proof assumption from attacking a scheme. Classical structural attacks on Classic McEliece, which do not involve DCP but put the concrete security of the scheme under revision, are summarised here and analysed in detail in a companion paper. The survey closes with open questions and a scenario-planning checklist that requires a complete efficient reduction.

Keywords: Dihedral coset problem · Learning with errors · Hidden subgroup problem

Contents 1 Introduction 3 1.1 Post-quantum cryptography and the place of LWE . . . . . . . . . . . . . . . . . 3 1.2 Previous surveys and research context . . . . . . . . . . . . . . . . . . . . . . . . 4 1.3 The Simon episode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.4 Why a counterfactual survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.5 Summary of results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.6 Contributions and organisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.7 How to read this survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.8 Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1

2 Preliminaries 2.1 Lattices and Gaussian measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Lattice problems and their complexity . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Algorithms and concrete security . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 Learning with Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5 The Short Integer Solution problem . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 Algebraically structured variants . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.7 NTRU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.8 Hidden subgroups, dihedral cosets and hidden shifts . . . . . . . . . . . . . . . .

12 12 13 13 14 15 16 17 18

3 The claimed algorithms: strategy and status 3.1 The template: Regev’s reduction from DCP to subset sum . . . . . . . . . . . . . 3.2 Simon’s strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Why the strategy does not work . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 The author’s response of October 2026 . . . . . . . . . . . . . . . . . . . . . . . . 3.5 What the failure teaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 Chen’s LWE algorithm and a proposed repair . . . . . . . . . . . . . . . . . . . .

21 22 22 24 28 30 31

4 The counterfactual hypotheses and their reach 4.1 Three hypotheses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Regev’s reduction from unique-SVP to DCP . . . . . . . . . . . . . . . . . . . . . 4.3 Technical lemmas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 The reach theorem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 Proofs of the compositions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 The sample-count obstruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.7 The window outside the reach . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

34 34 36 37 40 42 49 51

5 The Wen–Zheng route: recovered map and audited scope

52

6 Consequences for the LWE family 6.1 Unstructured LWE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Ring- and Module-LWE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Middle-product, order-based and unified variants . . . . . . . . . . . . . . . . . . 6.4 Rounding, short secrets and strengthened assumptions . . . . . . . . . . . . . . . 6.5 Search, decision and quantum auxiliary states . . . . . . . . . . . . . . . . . . . . 6.6 Advanced primitives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.7 Consequences for the lattice standards . . . . . . . . . . . . . . . . . . . . . . . .

55 56 57 58 59 60 60 61

7 Other lattice assumptions: reach and limitations 7.1 SIS and Module-SIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2 Unstructured CVP-based encryption . . . . . . . . . . . . . . . . . . . . . . . . . 7.3 NTRU and NTRU Prime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4 The Lattice Isomorphism Problem . . . . . . . . . . . . . . . . . . . . . . . . . . 7.5 Heuristic gaps of deployed parameter sets . . . . . . . . . . . . . . . . . . . . . .

62 62 66 66 69 70

8 Alternatives outside lattices 8.1 Code-based cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2 Classic McEliece: structural cryptanalysis and current status . . . . . . . . . . . 8.3 Hash-based and symmetric-key signatures . . . . . . . . . . . . . . . . . . . . . . 8.4 Multivariate cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.5 Isogenies: commutative versus non-commutative . . . . . . . . . . . . . . . . . . 8.6 Equivalence problems and non-abelian group actions . . . . . . . . . . . . . . . .

72 72 76 77 78 79 81

2

8.7 8.8

Efficiency and concrete security of the alternatives . . . . . . . . . . . . . . . . . 81 Subset sum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

9 Notes on non-commutative hidden structures 9.1 Where the hidden subgroup problem is easy . . . . . . . . . . . . . . . . . . . . . 9.2 Limitations of known measurements . . . . . . . . . . . . . . . . . . . . . . . . . 9.3 Group-based cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4 Relaxed dihedral problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5 Criteria for evaluating alternative assumptions . . . . . . . . . . . . . . . . . . .

82 83 83 84 84 84

10 Future research and conclusions 10.1 Open questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.2 Hybrid designs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.3 Scenario-planning checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.4 Worked examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

84 85 87 88 88 89

References

90

1

Introduction

1.1

Post-quantum cryptography and the place of LWE

In 1994 Shor showed that a quantum computer factors integers and computes discrete logarithms in polynomial time [212]. His algorithms solve instances of the abelian hidden subgroup problem, and they undermine the factoring and discrete-logarithm assumptions behind RSA, finite-field Diffie–Hellman and elliptic-curve cryptography. Post-quantum cryptography is the response, public-key primitives based on problems for which no efficient quantum algorithm is known. NIST began a public standardisation process in 2016. Its first outputs, published in August 2024, are FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, derived from CRYSTALS-Dilithium) and FIPS 205 (SLH-DSA, derived from SPHINCS+ ) [172, 171, 173, 57, 94, 43]. A fourth standard, FN-DSA (derived from Falcon [108]), is in preparation as FIPS 206. In March 2025 NIST selected the code-based KEM HQC as a second key-encapsulation standard [174, 4], and in May 2026 it advanced nine candidates to the third round of a separate process for additional signatures [175], one of which, the lattice-isomorphism signature Hawk, has since been withdrawn by its submission team (Section 7.4) [176]. Three of the four schemes selected in NIST’s main process, the three published standards and FN-DSA, are built on lattices, and two of them, ML-KEM and ML-DSA, on the Learning with Errors (LWE) problem in its module form. LWE, introduced by Regev in 2005 [201], owes this position to an unusual combination of properties. It enjoys a worst-case to average-case reduction: solving random LWE instances is at least as hard as approximating standard lattice problems in the worst case, quantumly [201] and, for some parameters, classically [185, 62]. It is versatile, supporting public-key encryption, identity- and attribute-based encryption, and fully homomorphic encryption [112, 60, 187]. And its algebraically structured variants, Ring-LWE and Module-LWE [157, 150], are efficient enough to deploy at scale. The quantum hardness of LWE is a conjecture supported by reductions and by the study of attacks in specified parameter regimes. Quantum lattice-reduction and sieving algorithms give important benchmarks: the cited heuristic classical sieve has running time 20.292d+o(d) in dimension d [35], and the cited quantum random-walk sieve has running time 20.2570d+o(d) in its quantum-memory model [73]. These are algorithmic estimates, not lower bounds on all attacks. A different route is provided by reductions to dihedral problems. Regev reduced approximate unique-SVP to the dihedral coset problem with a failure parameter [199]; Brakerski, Kirshanova, 3

Stehlé and Wen connected LWE to an extrapolated form of that problem under parameterdependent quantum reductions [61]. This survey asks which cryptographic consequences those reductions justify for a hypothetical efficient solver, and at which parameters. √ The cited dihedral algorithms remain subexponential: Kuperberg’s sieves take time 2O( log N ) , √ while Regev’s polynomial-space variant takes 2O( log N log log N ) [143, 200, 144]. In Regev’s lattice reduction, N = (2M )n with M = 24n , hence log N = Θ(n2 ) [199]. Substituting this modulus into the first running-time bound gives 2O(n) , which does not establish a polynomial-time lattice algorithm or a concrete advantage over classical attacks. Sample consumption, bad-register tolerance and state-preparation accuracy must also match the reduction. Section 2 explains these requirements.

1.2

Previous surveys and research context

The relevant surveys approach this subject from complementary directions. Childs and van Dam [81] explain algebraic quantum algorithms; Peikert [187] develops lattice assumptions, reductions and constructions; Biasse, Bonnetain, Kirshanova, Schrottenloher and Song [49] examine quantum cryptanalysis and its costs. Chen and Sun [76] give a dedicated dihedral overview with measurement limitations, while Dutto, Mercuri, Murru and Romano [98] survey the HSP from mathematical and cryptographic perspectives. Table 1 compares these works with the question studied here. Prior survey

Relevant scope and overlap

Focus of the present survey

Childs–van Dam (2010) [81]

Algebraic quantum algorithms, including hidden subgroups and hidden shifts; explains the algorithmic framework behind dihedral methods. SIS, LWE and ring variants, their worst-case foundations and cryptographic applications; includes the NTRU lossiness connection. Quantum attacks and cost models for classical and post-quantum assumptions; overlaps on lattices, codes, isogenies and hidden shifts. Dihedral HSP and DCP, Fourier sampling, alternative measurements and bounds on success from coset samples. Abelian and non-abelian HSP, Fourier and black-box methods, and links to lattices, graph isomorphism and code equivalence.

Fix state-input solver hypotheses and track their cryptographic consequences through quantitative reductions.

Peikert (2016) [187]

Biasse et al. (2023) [49] Chen–Sun (2024) [76] Dutto et al. (2025) [98]

Distinguish an algorithm for a proof assumption, loss of a worst-case hardness premise, and an explicit scheme attack. Ask what follows if specified dihedral solvers become efficient, accounting for samples, preparation errors and instance promises. Use the solver interface as a premise and audit the reductions needed to transfer its capability to cryptographic instances. Compare a selected range of assumptions under separate cyclic, robust and extrapolated-state hypotheses.

Table 1: Comparison by organising question and analytical output. The scope descriptions concern the cited versions; they are not claims that these works omit every individual connection used here.

Positioning and coverage. Our contribution is the combined parameter and assumption audit: compatible solver domains, available classical samples and quantum states, preparation and success losses, and the promises required by concrete embeddings. This builds on the mechanisms explained in the cited literature; it is not a priority claim for the underlying reductions. Section 1.6 identifies their antecedents and the quantitative derivations made explicit here. The classification is selective: it includes assumptions with a direct dihedral connection, 4

lattice assumptions reached by the composed oracles, and prominent alternatives that illustrate the limits of those routes. Inclusion outside a known route is not evidence of a separation. The recent structured connection of [225] is treated as a primary reduction to audit, rather than as another survey. Concrete attack estimation has its own literature [14, 147, 211], discussed in Section 2.3; our heuristic comparisons do not replace it. Historical context. The following claims and cryptanalytic developments motivate the need to distinguish algorithmic statements, parameter-qualified consequences and deployed attacks. Structured lattices, 2014–2017. Quantum algorithms for computing unit groups, class groups and principal ideal generators in number fields of arbitrary degree [99, 52], combined with a classical method for recovering a short generator from an arbitrary one in cyclotomic fields [87], broke schemes whose security relied on the hardness of finding short generators of principal ideals. Cramer, Ducas and Wesolowski extended the approach to arbitrary ideals, solving the shortest vector problem in ideal lattices of cyclotomic fields in quantum polynomial e √n)) [88], and Pellet-Mary, Hanrot and Stehlé time within an approximation factor exp(O( obtained trade-offs using a preprocessing phase that depends only on the field [191]. These attacks exploit algebraic structure, but at subexponential approximation factors, far above the polynomial factors on which Ring-LWE and Module-LWE are based. They exhibit algorithms exploiting particular algebraic structures; their stated approximation factors do not themselves give attacks on the deployed Ring-LWE or Module-LWE parameters considered here. Eldar and Hallgren, 2021–2022. Eldar and Hallgren described an efficient quantum algorithm for the bounded distance decoding problem on a class of integer lattices with a subexponential approximation factor, using a quantum state on lattices as an approximate eigenvector to self-reduce the instance [101]. Ducas and van Woerden observed that known classical, and even deterministic, polynomial-time algorithms, LLL in particular, already solve the instances covered by the claim [96]. This comparison supplies no improvement over the cited classical algorithms at those parameters, and no attack on the cryptographic instances considered here. Chen, 2024, and a proposed repair. In April 2024 Chen claimed polynomial-time quantum algorithms for GapSVP and SIVP on all n-dimensional lattices within approximation factors e 4.5 ), obtained through a quantum algorithm for LWE with certain polynomial modulus-toΩ(n noise ratios. On April 18 the author reported a bug in Step 9 of the algorithm, found by Hongxun Wu and, independently, by Thomas Vidick, and stated that he did not know how to fix it; the claim of a polynomial-time quantum algorithm for LWE with polynomial modulus-to-noise ratios was withdrawn [77]. In September 2025 Zhang proposed an exact replacement for Steps 8 and 9 [227]. Its current version states the consequence for LWE only conditionally, on assumptions that include side information about a run-dependent offset, supplied by the state-preparation oracle, and in October 2025 Apon published a rebuttal of its first and third versions [19]. Section 3.6 places both claims in the map of this survey. Classical breaks of post-quantum candidates, 2022. Two candidates fell to classical cryptanalysis. SIDH and its KEM SIKE, an isogeny-based scheme in the fourth round of the NIST process, were broken by torsion-point attacks that recover the secret isogeny in polynomial time [70, 158, 202]. The multivariate signature Rainbow, a finalist, was broken by Beullens with a key-recovery attack that takes on average 53 hours on a laptop for the security-level-1 parameters [47]. Neither break used a quantum computer. Structural attacks on McEliece, 2024–2026. Starting with a subexponential distinguisher in 2024 [197], classical structural attacks on binary Goppa codes led in 2026 to a quasi-polynomial 5

distinguisher [114] and to conditional key-recovery estimates below the classical-work references discussed by their authors [206, 224]; the lowest are about 289 to 2128 per run of the underlying sparse linear algebra, from bit operations with free memory to memory-charged costs, depending on the parameter set and the cost model, under heuristic assumptions tested only on small keys [224]. Key-recovery challenges with brute-force labels up to 254 were solved along the way [31, 126, 207, 224, 208]. The German BSI advised against new deployments of the scheme [68]. None of these attacks is quantum; Section 8.2 summarises them, and a companion paper [107] analyses them in detail, separating the proved, experimental and heuristic claims. These episodes illustrate three recurring issues. Several high-profile claims received rapid scrutiny, including counterexamples and formal developments. Algebraic structure can enable attacks that generic estimates miss. Diversifying assumptions can reduce reliance on one problem family, provided the combined construction has an appropriate security argument; diversity alone is not a security guarantee.

1.3

The Simon episode

On August 6, 2026, Daniel R. Simon made public a preliminary draft, received by the ePrint archive on August 3, claiming a polynomial-time quantum algorithm for the Dihedral Coset Problem [214]. According to the abstract of its current revision, the method follows Regev’s reduction of the dihedral subgroup problem to modular subset sum but erases sample bits without a subset-sum oracle, tolerates faulty samples at rates up to 1/O(log n), and would yield √ quantum algorithms for approximate SVP with factor n polylog(n) and for LWE with matching parameters. The claim carried unusual weight. The DCP is the problem to which Regev reduced the unique Shortest Vector Problem in 2002 [199], and it is equivalent, in an extrapolated form, to LWE [61]. The claim therefore prompted questions about ML-KEM and ML-DSA [172, 171]; consequences for their parameters require the sample, distribution and solver-domain checks developed below. It is a small irony of the history that, according to contemporaneous reporting [194], the author of the claim is the same Simon whose 1994 algorithm for hidden periods over Fn2 [213] inspired Shor’s factoring algorithm [212]. The claim did not survive scrutiny. Within days, Daniel Apon identified a gap in the argument for the third lemma of the preprint and stated publicly that the lemma is false, a one-page counterexample was posted, and the revised drafts through August 17 did not repair it in the cited analyses [214, 194]. On August 15, Gupte, Ragavan and Zhandry published a no-go result, whose main bound is formalised in Lean 4 for a formal model of the algorithm, showing that the procedure keeps too little information about the Fourier labels after its third step to recover the hidden shift with non-negligible advantage; either the algorithm is incorrect or its expected running time is not polynomial [120, 121]. Guo and Yang then gave rigorous statements and proofs of the four lemmas of [214], and isolated the hypothesis they all require, that a certain partition be fixed independently of the measured string, which the algorithm, as specified, does not satisfy [119]. An independent Lean 4 audit reached the same conclusion: one lemma admits a corrected proof, but the adaptive-selection step on which the polynomial running time depends is not repaired [205]. The author has not withdrawn the claim. The revision dated October 7, 2026, posted on October 8 as the last of six revisions recorded by the ePrint archive, adds a note arguing that, because the groups the algorithm keeps are post-selected on all-zero Hadamard outcomes, the analysis of [120], which traces out the selection bits, mispredicts the algorithm’s output; the note concedes that the fourth lemma fails if the selection bits of those groups are traced out [214]. In our analysis the note does not remove the obstruction: the bound of [121] holds for every Boolean-output channel applied to the state that the algorithm keeps after its partial subset-sum measurement, with the Fourier labels reduced to their digests; its one-attempt form counts restarts as an outcome; and post-selection that succeeds with non-negligible probability can raise an exponentially small advantage only by a factor of order the inverse of its acceptance 6

probability, which leaves it negligible (Section 3.4). Section 3 describes the strategy, the three analyses and the response in detail.

1.4

Why a counterfactual survey

The episode motivates an explicit audit of the consequences of a specified quantum breakthrough. Refuting that algorithm does not establish DCP hardness. The cited cyclic sieves remain subexponential [143, 200, 144], and relaxed variants have distinct algorithms: Bai, Jangir, Kirshanova, Ngo and Youmans give a quasi-polynomial EDCP algorithm over power-of-two moduli [27], and Boucher, Fouque and Shen give a sieve for a cyclotomic generalisation [58]. Their time and sample bounds, moduli and amplitude requirements must all be matched to a lattice reduction. Improving sample efficiency would address one obstruction, but would not by itself establish polynomial running time or applicability to deployed distributions. The purpose of this counterfactual survey is to ask what a polynomial-time dihedral algorithm would imply through specified reductions. The cyclic hypotheses are qualitatively equivalent after existentially quantifying the failure exponent, by Regev’s rare-corruption observation (Theorem 4.4); a prescribed small exponent remains a distinct quantitative requirement. The extrapolated-state hypothesis supplies a separate route whose relation to the cyclic ones is unresolved. The classification records sufficient guarantees and their limitations, rather than predicting a breakthrough or giving operational migration advice. 1. Lattice consequences extend beyond LWE. Regev’s DCP reduction supplies a worstcase ordinary-uSVP oracle [199]. Combining it with the BDD connection and quantum step gives the SIVP and SIS guarantees stated in Section 4, using mechanisms already present in [154, 201, 216]. These consequences depend on approximation factors, norm bounds and input promises. Solving a SIS proof assumption removes that hardness premise from the security argument; it does not by itself yield a forgery (Section 7.1). 2. Some non-lattice actions have a direct route. Free and transitive cyclic group actions reduce to noiseless DCP when their group structure, public inputs and coherent evaluation meet the full conditions of Theorem 4.17(vii). Isogeny-based actions motivate this route [82, 71, 48]; commutativity alone does not verify its implementation requirements (Section 8.5). 3. Parameters decide applicability. We compare sufficient reduction bounds with instance parameters and identify where those comparisons give no certificate (Sections 4 and 7.5). This is a limit of the analysed routes, not a security margin. 4. Sample availability matters. The unstructured compositions have explicit sample requirements. The structured forward certificate is audited in Section 5; the polynomialmodulus adapter and conversions for deployed distributions still require the checks in Theorem 10.10.

1.5

Summary of results

We formalise the counterfactual in three variants, noiseless cyclic coset states (HHS ), Regev’s DCP with failure parameter (HReg (f )), and the extrapolated DCP (EDCP) of Brakerski, Kirshanova, Stehlé and Wen with ℓ states (HEDCP [ℓ]), and compose the published reductions into a reach theorem with explicit thresholds, deriving the quantitative compositions with their stated premises (Section 4). The following points summarise the classification.

7

Quantitative hypotheses. We distinguish quantitative counterfactuals for dihedral coset algorithms. A polynomial-time solver for noiseless cyclic coset states already yields polynomialfactor lattice algorithms, because it tolerates sufficiently rare corruptions. A prescribed failure exponent makes the approximation factors quantitative, while extrapolated-state solvers provide a separate route with explicit sample requirements. The resulting guarantees are compared with cryptographic instances only after accounting for sample availability, distributions, lattice promises and finite-dimensional bounds. Polynomial-factor consequences. Under HReg (f ), the compositions give worst-case GapSVP e 1+2f ), SIVP at O(n3/2+2f ), and SIS algorithms above the stated sample-dependent bounds. at O(n Under HHS these conclusions hold for some solver-dependent f (Theorem 4.18). Solving a proof assumption does not by itself produce a forgery. For HEDCP [ℓ], the restricted ball composition has an explicit admissible sample set and preparation budget; together with the information e 2 ). Its composed SIVP and SIS bound ℓ = Ω(n log q), its sufficient noise scale is at most 1/Ω(n 3 5/2 guarantees are about n and n up to logarithmic factors, without bounding every possible algorithm under the hypothesis. Limits of the classification. For the few-sample Module-LWE instances considered here, the unstructured compositions do not furnish a deployed-parameter attack certificate. The printed structured forward certificate is audited in Section 5 and gives no certificate at the ML-KEM ring and modulus; the polynomial-modulus adapter and conversions for deployed distributions remain unverified here. The embedding estimates also require a finite-dimensional reduction guarantee and a justified gap estimate. These are limits of the present classification, not a proof of security or a measured security margin. Standard-noise LWE is not certified by the unstructured compositions presented here. For NTRU, rotations√rule out ordinary uniqueness above factor one in the power-of-two cyclotomic case and above 3 for NTRU Prime; decision lossiness and module uniqueness require separate analysis. Small-norm SIS and the Lattice Isomorphism Problem likewise lack a certificate from these compositions. Outside lattices. Binary code-based encryption, hash-based and symmetric-key signatures, multivariate signatures and non-commutative isogeny problems have no applicable attack certificate from the dihedral reductions analysed here. Classical structural attacks have, however, put the concrete security of Classic McEliece under revision since 2024, while HQC, also outside the reach of the counterfactual, is not affected by them according to the BSI [68] (Section 8.2). The 2026 algorithm. We also explain the strategy of the 2026 preprint, which replaces the subset-sum step of Regev’s reduction by a bit-erasure procedure that uses only the top third of the Fourier labels, and the three published analyses showing why it cannot work as specified (Section 3). In our analysis, the author’s response of October 7, 2026, which relies on post-selection, does not change that conclusion: the published bound covers every processing of the state that the algorithm keeps, with the Fourier labels reduced to their digests, and post-selection that succeeds with non-negligible probability raises the distinguishing advantage by at most a factor equal to the inverse of its acceptance probability (Section 3.4). Earlier claims. Chen’s withdrawn 2024 algorithm for LWE [77] and Zhang’s conditional repair of its post-processing [227] are not dihedral solvers. In our analysis they target a single 4 m2 ), which lies inside the reach of H e LWE regime, many samples and q ∈ Ω((αq) Reg (f ) for every f < 1/2 (for prime q and m ≥ 2n lg q); a correct version of Simon’s claim would therefore have subsumed Chen’s conclusion for LWE in that range. The regime excludes standard-noise LWE and the deployed parameter sets, and no known reduction derives any of the three hypotheses from a solver for it (Section 3.6). 8

In total we classify more than thirty assumptions and schemes, including the NIST standards and the third-round candidates of the additional-signature process, estimate heuristic gaps for deployed parameter sets, and compare the efficiency of the schemes outside the reach.

1.6

Contributions and organisation

• Section 2 introduces the background used in the classification: lattices and Gaussian measures, the main lattice problems and their known complexity, lattice algorithms and concrete security, LWE and SIS with their worst-case reductions, the structured variants (Ring-, Module-, MiddleProduct and Order-LWE, LWR, CLWE, succinct LWE) and NTRU, and the hidden-subgroup family (Kuperberg’s sieve, DCP, EDCP and hidden shifts), with a map of their relations (Fig. 1). • Section 3 explains the strategy of [214] within Regev’s subset-sum template, and why it fails: the information-theoretic barrier of [120], the partition hypothesis of [119], and the lemma-level audit of [205], together with the author’s response of October 2026 and why, in our analysis, it does not remove the barrier; it also places Chen’s withdrawn 2024 algorithm for LWE and Zhang’s proposed repair in the same map (Section 3.6, Fig. 3 and Table 3). • Section 4 formalises the counterfactual as explicit hypotheses HHS , HReg (f ) and HEDCP [ℓ], with their sources, explains Regev’s reductions of 2002 and 2005 in enough detail to follow the composition, and proves a reach theorem (Theorem 4.17) with explicit thresholds: a e 1+2f ) for GapSVP, γ ⋆ = O(n3/2+2f ) sufficient γu = O(n1/2+2f ) for unique-SVP, γg = O(n 2 ) under H e for SIVP under HReg (f ) and O(ℓn EDCP [ℓ], and norm bounds above which SIS instances are solved. The quantitative compositions are derived explicitly as propositions (Section 4.5), using a version of Regev’s quantum step for randomised and average-case decoders (Theorem 4.15) and an explicit admissible range for the number of samples used in one ball-reduction invocation of [61, Thm. 3] (Theorem 4.9); an information-theoretic bound shows that the stated fixed-width, inverse-polynomial-success EDCP solver needs ℓ = Ω(n log q) states (Theorem 4.22), which constrains the stated fixed-width solver and the restricted ball composition. The section also analyses a sample-count obstruction for the specified few-sample constructions (Theorem 4.29) and illustrates it numerically. • Section 5 uses the full version of [225] to restate the exact conversion of structured states (Theorem 5.1) and to test the printed forward parameter certificate at the ML-KEM and ML-DSA public-key parameters: at the ML-KEM ring and modulus the certificate admits no feasible width (Theorem 5.2 and Table 5), and the polynomial-modulus adapter still requires a complete search, width, success and sample audit. • Section 6 records sufficient consequences and unresolved checks hypothesis by hypothesis, including the applications to lattice standards and FrodoKEM. • Section 7 examines the lattice assumptions that are not reached by the composition: SIS at small norm bounds, where it separates solving the assumption of a proof from forging, unstructured CVP-based schemes, NTRU, with its ring-dependent ordinary-uniqueness obstruction (Theorem 7.1), and the Lattice Isomorphism Problem; it estimates heuristic gaps for ML-KEM keys and ciphertexts, FrodoKEM, ML-DSA and FHE-style parameters, together with the reach of the SIS route on the lattice problems behind deployed signatures, and summarises its conclusions in Table 8. • Section 8 surveys the non-lattice alternatives, codes, hash-based and symmetric-key signatures, multivariate schemes, isogenies and equivalence-problem group actions, describing representative constructions and relevant quantum attacks, summarises the 2024–2026 structural cryptanalysis of Classic McEliece, analysed in detail in a companion paper [107], and compares the key and signature sizes of the schemes outside the reach. 9

• Section 9 discusses the research frontier of non-commutative hidden-subgroup problems, including candidates outside the analysed dihedral routes and the limited evidence supplied by measurement lower bounds. • Section 10 collects open questions with their background and priorities, scenario-planning consequences for hybrid designs, and a scenario-planning checklist for crypto-agility with worked examples, and concludes. • Section 1.8, which closes this introduction, collects the notation. Contribution and scope. Our contribution is the explicit accounting of parameters and assumptions in the compositions presented here: sample availability, preparation error, decoder success and the admissible range of the unstructured ball reduction. We derive the stated SIVP and SIS guarantees with these conditions and separate them from heuristic instance estimates. The quantum connection from BDD1/γ to SIVPO(nγ) is already recorded in [154, Sec. 1.2], using Regev’s quantum step; neither this connection nor its asymptotic loss is claimed as new. Our direct SIVP proof makes its constants and decoder implementation explicit. The SIS compositions use the same quantum step, with the average-case route following the method of [216]. The rare-corruption observation is already present in Regev’s work, the NTRU rotation argument is elementary, and the information bound is credited to the reviewer. For the structured route, we restate the state conversion of [225] and audit its forward width certificate: the printed bound supplies no certificate at the ML-KEM ring and modulus, while the polynomial-modulus adapter still needs the checks specified in Theorem 10.10. We make no priority claim for the underlying reduction mechanisms, for these elementary observations, or for an exhaustive classification of all possible dihedral consequences.

1.7

How to read this survey

The survey introduces the notation and reduction statements needed to follow its classification, and outlines the arguments behind the central connections. Full proofs, version-specific premises and algorithmic details should be checked in the primary sources. Readers with different aims can follow different paths. • Migration planners and standards engineers can read Section 1, the conclusion tables (Tables 6, 8 and 11), Sections 7.5 and 8.7 and the scenario-planning checklist of Section 10. • Cryptographers interested in the reductions can read Sections 2, 4 and 5 and then the conclusions of Sections 6 and 7. • Quantum-algorithms researchers can read Sections 2.8, 3 and 9 and the open questions.

1.8

Notation

Symbol

Meaning

Lattices L, L∗ λi (L), λ∞ 1 gh(L) ρs , DL+c,s ηϵ (L) ⊤ Λ⊥ q (A), Λq (A )

a lattice and its dual i-th successive minimum (Euclidean); minimum in the ℓ∞ norm p Gaussian heuristic d/(2πe) det(L)1/d 2 2 Gaussian function e−π∥x∥ /s ; discrete Gaussian on a coset smoothing parameter q-ary lattices {z : Az ≡ 0} and {y ≡ A⊤ s}

10

Symbol

Meaning

SVPγ , uSVPγ , GapSVPγ , SIVPγ , BDDδ , CVPγ gap

lattice problems of Theorem 2.1; CVPL,d denotes decoding within distance d ratio λ2 /λ1 of a unique-SVP instance; g, gA its heuristic value (for NTRU keys, the density ratio gh(Lh )/∥(f, g)∥, which is not a unique-SVP gap; Theorem 7.1) NTRU lattice {(u, v) ∈ R2 : uh ≡ v (mod q)}

Lh LWE, SIS and variants n, m, q α, σ, σs , σe LWEn,q,α,m , RLWE, MLWE SISn,m,q,β , MSIS R, Rq , k, ℓ′ Γf,A (d), c0 Hidden structure DN DCPfN EDCPℓn,N,ρ , G-EDCPℓn,N,r ℓ

IP-M-EDCP κ, c, r0 Mq (n), mmax

secret dimension, number of (scalar) samples, modulus noise rate (Gaussian parameter αq); standard deviations of secret and error Learning with Errors and its ring and module versions Short Integer Solution with absolute norm bound β; module version ring Z[x]/(xd + 1) (degree 256 in the standards), R/qR, module ranks (ML-DSA’s (k, ℓ′ ) is (k, ℓ) in [171]) sufficient finite-dimensional ordinary-uSVP bound from [199, Thm. 1.1], O(d1/2+2f ) asymptotically; coefficient of the separate numerical model dihedral group ZN ⋊ Z2 dihedral coset problem with failure parameter f > 0 (Theorem 2.4); + DCP∞ N is the noiseless problem, and f → 0 the limit of increasing tolerance extrapolated DCP with ℓ states and amplitude ρ; Gaussian version of width r (Theorem 2.5) number of EDCP states; ℓ = Ω(n log N ) at bounded width and inverse-polynomial success for every secret and arbitrary offsets (Theorem 4.22) structured EDCP of [225] (Section 5) √ statistical parameter of [61], fixed here to ⌈log2 n⌉, and constant 6 2πe of [61, Thm. 3]; minimal width in HEDCP [ℓ] numbers of samples admissible in the proof of [61, Thm. 3], conditions (B1)–(B3); their maximum, Θ(n) for n2 ≤ q ≤ poly(n)

Hypotheses and thresholds HReg (f ), HEDCP [ℓ], HHS , hypotheses of Section 4.1 Hab HS H⋆ conjunction HReg (f ) ∧ HEDCP ; no strict separation claimed γu (d) sufficient bound Γf,A (d) in theorem statements; c0 d1/2+2f is the numerical comparison model 1+2f e γg (d) = O(d ) GapSVP factor reached under HReg (f ) ⋆ γReg = O(n3/2+2f ), SIVP factors reached under HReg (f ) and HEDCP [ℓ] ⋆ 2 e ) γE = O(ℓn gap above which HEDCP [ℓ] decodes d-dimensional lattices in the worst gE (d) = 2d γE⋆ (d, ℓ) case (Theorem 4.24) αReg (m), αE (n, m, ℓ), sufficient LWE noise bounds of the two compositions, and the best ∗ e αE (n, ℓ) admissible value αE (n, mmax , ℓ) = 1/O(ℓn) (Section 4.4) βReg , βE , βcol , βvoid sufficient SIS solution bounds and bounds making the stated worst-case hardness premise unavailable, with each route’s parameter and distribution conditions Conclusions (given per hypothesis; compact glyphs

11

,

,

,

in multi-column tables)

Symbol Certified Conditional Open Outside reach Outside reach † , , ,

R H O U

(A), (B), (C)

2

Meaning reached by a composition of published reductions, or by a proposition of Section 4.5, at the relevant parameters parameter-dependent sufficient comparison, heuristic estimate or unverified application an unresolved connection, without an established consequence here no certificate from the reductions analysed; not a security or impossibility claim outside reach, with concrete security under active revision for unrelated reasons rigorous, heuristic, mathematical open question, unverified parameter application explicit attack; proof assumption solvable; guarantee no longer informative (Section 7.1)

Preliminaries

This section collects the background used in the rest of the survey. It is longer than a list of definitions because the reach of the counterfactual depends on the exact form of several classical results, the approximation factors in worst-case reductions, the number of samples a reduction consumes, the error tolerance of a quantum algorithm, and these details are easy to lose in a summary.

2.1

Lattices and Gaussian measures

A lattice is a discrete additive subgroup L ⊂ Rd . Every lattice is generated by a basis B = (b1 , . . . , bk ) of linearly independent vectors, L = L(B) = {Bz : z ∈ Zk }; the integer kqis the rank,

and the lattice is full-rank if k = d. The determinant or covolume is det(L) = det(B ⊤ B), independent of the choice of basis. The i-th successive minimum λi (L) is the smallest r such that the closed ball of radius r contains i linearly independent lattice vectors; in particular λ1 (L) is the length of a shortest nonzero vector. We use the Euclidean norm throughout unless a superscript ∗ says otherwise, as in λ∞ 1 . The dual lattice is L = {x ∈ span(L) : ⟨x, v⟩ ∈ Z for all v ∈ L}, with ∗ det(L ) = 1/ det(L). √ Minkowski’s theorem bounds λ1 (L) ≤ d det(L)1/d for a full-rank lattice. For “random” lattices the Gaussian heuristic predicts the more precise value s

λ1 (L) ≈ gh(L) :=

d det(L)1/d , 2πe

which is the radius of a ball of volume det(L), up to lower-order terms. The minima of a lattice and of its dual are linked by Banaszczyk’s transference theorem: 1 ≤ λ1 (L) λd (L∗ ) ≤ d [28]. Gaussian measures. For s > 0 let ρs (x) = exp(−π∥x∥2 /s2 ). The discrete Gaussian distribution DL+c,s on a coset L + c assigns to each point x the probability ρs (x)/ρs (L + c). Micciancio and Regev introduced the smoothing parameter ηϵ (L) = min{s > 0 : ρ1/s (L∗ \ {0}) ≤ ϵ}, the smallest width at which a Gaussian, reduced modulo the lattice, is ϵ-close to uniform [166]. Two p facts about it are used repeatedly. First, it is bounded by the last minimum: ηϵ (L) ≤ ln(2d(1 + 1/ϵ))/π ·λd (L) [166]. Second, Gaussian tail and anti-concentration estimates 12

control the lengths and independence of samples; the width and error conditions used here are stated in Theorem 4.10 [166, 201]. Gaussian measures are the technical heart of every worst-case to average-case reduction discussed below. q-ary lattices.

For a modulus q and a matrix A ∈ Zn×m define q m Λ⊥ q (A) = {z ∈ Z : Az ≡ 0 ⊤

Λq (A ) = {y ∈ Z

m

⊤

:y≡A s

(mod q)},

(mod q) for some s ∈ Zn }.

Both contain qZm , so all their successive minima are at most q. They are dual to each other up ⊤ ∗ to scaling, Λ⊥ q (A) = q · Λq (A ) , and when A has full rank modulo a prime q their determinants are q n and q m−n respectively. LWE lives on lattices of the form Λq (A⊤ ) and SIS on lattices of the form Λ⊥ q (A); when we write LWE with an m × n matrix A, the corresponding lattice is Λq (A) = {y ≡ As}.

2.2

Lattice problems and their complexity

We use the following standard problems, parameterised by an approximation factor γ = γ(d) ≥ 1. Definition 2.1 (Lattice problems). Given a basis of L ⊂ Rd : • SVPγ : find a nonzero v ∈ L with ∥v∥ ≤ γλ1 (L). • GapSVPγ : decide whether λ1 (L) ≤ 1 or λ1 (L) > γ. • SIVPγ : find d linearly independent vectors of L of length at most γλd (L). • uSVPγ : under the promise λ2 (L) > γλ1 (L), find a shortest nonzero vector. • BDDδ : given t with dist(t, L) ≤ δλ1 (L), find the closest lattice vector. • CVPγ : given t, find v ∈ L with ∥t − v∥ ≤ γ dist(t, L). The gap of a uSVP instance is the ratio λ2 /λ1 ; a uSVPγ algorithm solves every instance whose gap exceeds γ. The problems are closely related. Lyubashevsky and Micciancio proved p that uSVP, BDD and GapSVP are equivalent up to a factor n/ log n; in particular BDD1/(2γ) reduces to uSVPγ and uSVPγ reduces to BDD1/γ , a connection tight up to a small constant, and p GapSVP reduces to BDD with a loss of n/ log n [154]. Their paper used this to show that the Ajtai–Dwork cryptosystem [8] and Regev’s 2004 cryptosystem [198], previously based only on uSVP, can be based on worst-case GapSVP with factors O(n2.5 ) and O(n2 ) respectively. The approximation factor determines how hard these problems are. Exact SVP isp NP-hard under randomised reductions [7]. At the other end, GapSVPγ lies in NP ∩ coAM for γ = d/ log d √ [116] and in NP ∩ coNP for γ = d [5], so it is unlikely to be NP-hard at those factors. The worst-case foundations used below involve polynomial approximation factors. The cited general basis-reduction algorithms supply much larger approximation guarantees in polynomial time [151, 209]; their guarantees are not lower bounds against other algorithms or statements about every structured lattice. The counterfactual asks which polynomial factors become attainable through the specified reductions.

2.3

Algorithms and concrete security

Concrete security estimates for lattice schemes rest on a small number of algorithmic families.

13

Basis reduction. The LLL algorithm finds, in polynomial time, a basis whose first vector satisfies ∥b1 ∥ ≤ 2(d−1)/2 λ1 (L) [151]. The BKZ algorithm of Schnorr and Euchner generalises it by calling an exact SVP solver on projected sublattices of dimension β, the block size [209]. A commonly used heuristic estimates ∥b1 ∥ ≈ δβd det(L)1/d , where the root Hermite factor δβ
1/(2(β−1))

β decreases slowly with β; the standard estimate is δβ ≈ 2πe (πβ)1/β for large β [14]. The cost of BKZ is dominated by the cost of SVP in dimension β, and the usual block-reduction cost model associates polynomial approximation factors with large blocks and exponential cost. This is a description of that model, not an algorithm-independent lower bound.

Exact SVP. Enumeration solves SVP in time 2O(d log d) and polynomial memory. Sieving algorithms trade memory for time: the cited heuristic classical sieve runs in time 20.292d+o(d) [35], and the cited quantum random-walk variant in time 20.2570d+o(d) [73], improving on earlier quantum sieves [146] and on the exponent 0.2653 of Laarhoven’s quantum algorithm, as reported in [73]. Among provable algorithms, Aggarwal, Dadush, Regev and Stephens-Davidowitz solve SVP in time and space 2d+o(d) by discrete Gaussian sampling [3]. The General Sieve Kernel of Albrecht et al. is an implementation framework for sieving used in public lattice challenges [13]. Estimating schemes. An LWE instance is attacked either as a unique-SVP instance in an embedding lattice (the primal attack, which succeeds when BKZ with block size β isolates the planted short vector), or through short vectors in the dual lattice that distinguish LWE samples from uniform (the dual attack), or by combinatorial and algebraic methods. Albrecht, Player and Scott surveyed these attacks and their costs and introduced the estimator methodology used in concrete lattice-security analysis [14]. Two broader surveys complement it: Laarhoven, van de Pol and de Weger give a tutorial on hard lattice problems, basis reduction, enumeration and sieving and their use in security estimates [147], and Shen and Li survey the current state of classical lattice algorithms [211]. Throughout the survey, “concrete security” refers to estimates of this kind; the counterfactual supplies additional sufficient algorithmic guarantees. The estimates quoted for existing attacks do not bound the cost of all algorithms that a future solver might enable.

2.4

Learning with Errors

Definition 2.2 (LWE [201]). Let n, q, m be integers and χ an error distribution on Z, typically a discrete Gaussian of parameter αq for a noise rate α ∈ (0, 1). Search-LWEn,q,χ,m : given (A, b = As + e mod q) with A ← Zm×n uniform, s ∈ Znq and e ← χm , find s. Decision-LWE: q distinguish (A, b) from uniform. Under the conditions of the normal-form reduction, one can transfer hardness from a uniform secret to a secret drawn from the error distribution: Applebaum, Cash, Peikert and Sahai showed that LWE with a uniform secret reduces to LWE with a secret drawn from χ, the normal form [20]. The concrete LWE-based schemes considered here use short secrets, but their precise bounded distributions and the sample cost of conversions must still be checked. LWE as a lattice problem. The pair (A, b) gives a closest-vector instance on the q-ary lattice Λq (A) = {y ∈ Zm : y ≡ As (mod q)}, with a planted lattice point at distance ∥e∥ from a chosen lift of b. It meets a BDD promise only if that distance is sufficiently small relative to the lattice minimum. For short-secret LWE, an affine embedding contains the vector (s, e, τ ); this gives an ordinary-uSVP instance only when that vector is shortest and sufficiently separated from independent vectors. A Gaussian-heuristic comparison is gLWE ≈

gh(embedding lattice) . ∥(s, e, τ )∥ 14

(1)

Theorem 4.29 specifies the embedding, its determinant and the additional heuristic assumptions. The number of samples affects this comparison. Regev’s cryptosystem. The simplest LWE-based encryption scheme illustrates how LWE is used. The public key is an LWE instance (A, b) with m = O(n log q) samples. To encrypt a bit P P µ, choose a random subset S ⊆ {1, . . . , m} and output ( i∈S ai , i∈S bi + µ⌊q/2⌋), where ai P are the rows of A. Decryption subtracts ⟨ i∈S ai , s⟩ and checks whether the result is closer to 0 P or to q/2; correctness holds because the accumulated error i∈S ei is small. Semantic security follows from decision-LWE together with the leftover hash lemma [201]. √ Worst-case hardness. Regev’s main theorem states that, for αq > 2 n, an efficient algorithm e for LWEn,q,α yields an efficient quantum algorithm for SIVP and GapSVP within O(n/α) in the worst case [201]. The proof is iterative. Given samples from a discrete Gaussian DL,r on an arbitrary lattice L, the LWE oracle is used to solve BDD on the dual lattice L∗ within distance about αq/r (the classical step); a quantum procedure then turns this BDD solver into samples from a narrower Gaussian DL,r′ with r′ < r (the quantum step). Iterating from a very wide √ Gaussian, which is easy to sample, down to width about n ηϵ (L)/α yields short lattice vectors, which solve SIVP. The quantum step is the only place where quantum computation is needed. Peikert gave a classical reduction from GapSVP to LWE with an exponential modulus q ≥ 2n/2 [185], and Brakerski, Langlois, Peikert, Regev and Stehlé showed that LWE in dimension n with modulus q reduces to LWE in dimension about n log q with a polynomial modulus, which yields classical hardness for polynomial moduli at the cost of a larger dimension [62]. Search and decision. Search and decision LWE are connected by reductions with specific modulus, distribution and sample requirements. Regev’s reduction works for prime polynomial moduli [201]; Micciancio and Mol gave sample-preserving reductions for a wide class of moduli [163]. Sudo, Tezuka, Hara and Yoshida gave a quantum search-to-decision reduction, based on a quantum Goldreich–Levin theorem over Zq for prime q, that invokes the decision distinguisher only twice, whereas classical reductions require polynomially many invocations [218]. Algorithms for special parameters. LWE is easy when the error is very small. Arora and Ge linearise the system by observing that each error coordinate is a root of a known low-degree √ polynomial, which solves LWE in subexponential time when the error magnitude is o( n) and in polynomial time when it is constant, given enough samples [22]. Micciancio and Peikert showed, conversely, a hardness reduction for LWE with binary errors when the number of samples is limited [165]. Both results illustrate that the number of samples is a security parameter of LWE in its own right.

2.5

The Short Integer Solution problem

Definition 2.3 (SIS [6]). SISn,m,q,β : given uniform A ∈ Zn×m , find nonzero z ∈ Zm with Az ≡ 0 q (mod q) and ∥z∥ ≤ β, i.e. a short nonzero vector of Λ⊥ q (A). √ A solution exists whenever β ≥ m q n/m , by Minkowski’s theorem applied to Λ⊥ q (A). Ajtai’s 1996 paper, which founded lattice-based cryptography, showed that solving SIS on average is at least as hard as approximating lattice problems within polynomial factors in the worst case, and deduced that the function fA (x) = Ax mod q on short inputs x is one-way and, for suitable parameters, collision-resistant [6]. Micciancio and Regev tightened the reduction using e Gaussian measures, basing SIS on SIVP within O(n) factors [166], and Micciancio and Peikert δ extended √ it to moduli as small as β · n for any constant δ > 0 [165]. In the form we use, for q ≥ β · ω( n log n), SISn,m,q,β is at least as hard as SIVPβ·O( e √n) in the worst case [166, 112, 165]. 15

SIS is the basis of lattice-based hash functions and signatures. Gentry, Peikert and Vaikuntanathan showed how to generate A together with a short basis of Λ⊥ q (A) (a trapdoor), how to use it to sample short preimages of fA from a discrete Gaussian without leaking the trapdoor, and how this yields hash-and-sign signatures in the random-oracle model and identity-based encryption from the dual of Regev’s scheme [112]. Micciancio and Peikert simplified trapdoor generation with structured “gadget” matrices [164]. Lyubashevsky gave signatures without trapdoors in the Fiat–Shamir paradigm, using rejection sampling to make the distribution of signatures independent of the secret key [153]; this “Fiat–Shamir with aborts” design underlies ⊥ ⊤ ∗ ML-DSA. The duality Λ⊥ q (A) = q · Λq (A ) connects the two problems: short vectors of Λq (A) are exactly what the dual attack uses to distinguish LWE samples from uniform, so suitable nontrivial SIS solutions can distinguish LWE when the induced error inner product has a detectable bias. A norm bound alone must be interpreted together with the error distribution and distinguishing advantage.

2.6

Algebraically structured variants

Plain LWE needs public matrices of Θ(n2 log q) bits. Structured variants replace the integers by a ring of algebraic integers, so that one ring element encodes a whole structured block of the matrix. Ring-LWE. Let R = Z[x]/(xd +1) with d a power of two (the ring of integers of a power-of-two cyclotomic field) and Rq = R/qR. A Ring-LWE sample is (a, b = a · s + e) ∈ Rq2 with uniform a, a secret s ∈ Rq and a short error e ∈ R. Multiplication by a is a negacyclic d × d matrix, so one ring sample is d structured scalar LWE samples. Lyubashevsky, Peikert and Regev introduced the problem for general number fields, proved a quantum reduction from worst-case approximate SVP on ideal lattices to search Ring-LWE, and a search-to-decision reduction for cyclotomic fields with suitable moduli [157]. Peikert, Regev and Stephens-Davidowitz later gave a direct worst-case hardness reduction for decision Ring-LWE over any number field and modulus, with the error requirements of their theorem [190]. Module-LWE and Module-SIS. Module-LWE uses vectors in Rqk : samples are (a, b = ⟨a, s⟩ + e) with a, s ∈ Rqk . It interpolates between Ring-LWE (k = 1) and LWE (d = 1). Brakerski, Gentry and Vaikuntanathan introduced it as “general LWE” [60], and Langlois and Stehlé proved worst-case to average-case reductions for Module-LWE and Module-SIS from problems on module lattices [150]. Albrecht and Deo showed that Module-LWE of rank k with modulus q reduces to Ring-LWE with modulus q k [12]. ML-KEM and ML-DSA use Module-LWE over R = Z[x]/(x256 + 1) with small rank k ∈ {2, 3, 4} (ML-KEM) or rank pairs up to (8, 7) (ML-DSA) [172, 171]. Middle-Product, Order and general structured LWE. Roşca, Sakzad, Stehlé and Steinfeld introduced Middle-Product LWE (MP-LWE), in which the product of polynomials is replaced by the “middle” coefficients of the product, so that the problem is defined independently of any particular number field; they proved that MP-LWE is at least as hard as Polynomial-LWE for every polynomial in an exponentially large family, so hardness of any source family transfers under the corresponding parameter map [203]. Njah Nchiwo and Pellet-Mary improved the reduction from RLWE to MP-LWE [180], and Pellet-Mary and Xia gave a unified reduction, parameterised by field elements, that recovers the earlier ones as special cases and applies to number fields satisfying their polynomial-boundedness conditions [193]. Bolboceanu, Brakerski, Perlman and Sharma introduced Order-LWE, a version over orders of number fields, and used it to study Ring-LWE with entropic secrets [54]. Peikert and Pepin gave a unified framework for these algebraically structured variants with simpler and tighter reductions among them [189]. 16

The direction of all these reductions matters below: they show that the variants are at least as hard as Ring-LWE, not that they are easier. Short distributions. Deployed schemes use secrets and errors with small bounded coefficients rather than Gaussians. Boudgoust, Jeudy, Roux-Langlois and Wen proved that Module-LWE with a uniform η-bounded secret, for any 1 ≤ η ≪ q, and Gaussian error is at least as hard as standard Module-LWE when the module rank is at least logarithmic in the ring degree, in both search and decision versions; they also proved that search Module-LWE with uniform η-bounded error is at least as hard as the standard problem when the number of samples is close to the module rank [59]. Learning with Rounding. Banerjee, Peikert and Rosen replaced the random error by deterministic rounding: an LWR sample is (a, ⌊(p/q)⟨a, s⟩⌉ mod p) for a smaller modulus p [29]. They showed that LWR is at least as hard as LWE when q/p exceeds the LWE error by a large enough factor, and used it to build pseudorandom functions. An LWR instance is again a BDD instance, with an error of size about q/p. Assumptions for advanced primitives. Wee introduced the ℓ-succinct LWE assumption, a falsifiable assumption implied by evasive LWE, to build attribute-based encryption and laconic function evaluation for circuits with sublinear ciphertext overhead [223]. Abram, Malavolta and Roy introduced the decomposed LWE assumption, which can be interpreted as postulating the circular security of a natural lattice-based encryption scheme, used it for succinct randomised encodings and attribute-based encryption for RAM programs, and showed that it is implied by succinct LWE [2]. Abram, Arnon, Cini, Lou, Malavolta and Roy proved the converse, so that the two assumptions are equivalent under appropriate parameters [1]. Both are strengthenings of LWE, in the sense that their hardness implies that of LWE. For an algorithm the relevant direction is the converse: an LWE solver breaks succinct LWE directly, because its instances contain a standard LWE instance with a uniform matrix, and breaks decomposed LWE only through the reduction of [1], at the parameters for which it is proved (Section 6.4). Continuous LWE. Bruna, Regev, Song and Tang introduced Continuous LWE (CLWE), in which samples are Gaussian vectors y ∈ Rn labelled by γ⟨y, w⟩ + e mod 1 for a hidden unit vector w; they proved its hardness from worst-case lattice problems by a quantum reduction and deduced the hardness of learning mixtures of Gaussians [67]. Gupte, Vafa and Vaikuntanathan gave a classical reduction from LWE to CLWE [122].

2.7

NTRU

In the NTRU cryptosystem of Hoffstein, Pipher and Silverman the secret key is a pair of polynomials f, g with small coefficients in a ring Rq = Zq [x]/(Φ), and the public key is h = g/f [128]. Encryption adds a small multiple of h to an encoding of the message; decryption multiplies by f , which turns the ciphertext into a short element that can be recovered exactly and reduced modulo a small modulus. Key recovery asks for a short vector of the rank-two module lattice Lh := {(u, v) ∈ R2 : uh ≡ v (mod q)}, which contains (f, g); for coefficient size σ, the ratio √ gh(Lh )/∥(f, g)∥ = Θ( q/σ) measures how much shorter the key is than a typical lattice vector. Because Lh is an R-module, the rotations xi (f, g) are as short, or almost as short, as the key itself, giving the ring-dependent uniqueness bounds of Theorem 7.1 in Section 7.3. The decision NTRU problem asks to distinguish h from a uniform element of Rq . Three results frame its relation to LWE. Stehlé and Steinfeld gave an NTRU variant with √ Gaussian keys of width about q · poly(n), for which the public key is statistically close to uniform, so that ciphertexts are Ring-LWE samples and security reduces to Ring-LWE [215]. 17

Pellet-Mary and Stehlé observed that decision NTRU reduces to search Ring-LWE, which gives only an upper bound on its hardness, and provided reduction-based lower bounds: worst-case approximate SVP on ideal lattices reduces to an average-case search variant of NTRU, and another average-case search variant reduces to decision NTRU [192]. The relation hf − g = 0 is a homogeneous short relation, not a sample from the standard Ring-LWE distribution: h depends on the short pair (f, g). The connection from decision NTRU to search Ring-LWE instead uses a lossiness argument; see [187, Sec. 4.4.4]. To compose that connection with a dihedral solver, one must match the Ring-LWE oracle’s sample count, secret and error distributions, and success probability. For certain large-modulus NTRU parameter families, independent attacks are known: Albrecht, Bai and Ducas showed that the norm map to a subfield reduces key recovery to a lower-dimensional lattice when q is large, breaking the “overstretched” parameters used in some multilinear-map and homomorphic-encryption proposals [10], and Kirchner and Fouque showed that lattice reduction itself performs much better than expected on such parameters because of a dense sublattice [139]. NTRU Prime replaces the cyclotomic ring by a prime-degree field with a large Galois group, to avoid algebraic structure that attacks might exploit [41].

2.8

Hidden subgroups, dihedral cosets and hidden shifts

The hidden subgroup problem. In the hidden subgroup problem (HSP) for a finite group G, one is given oracle access to a function f : G → S that is constant on the left cosets of an unknown subgroup H and takes distinct values on distinct cosets; the task is to find H. P The standard method prepares |G|−1/2 g |g⟩|f (g)⟩ and measures the second register, leaving a P uniformly random coset state |H|−1/2 h∈H |gh⟩. For abelian G, measuring the quantum Fourier transform of coset states yields elements of the annihilator of H, and polynomially many of them determine H; this is Simon’s algorithm over Fn2 [213] and the core of Shor’s algorithms over cyclic groups [212]. For non-abelian groups the Fourier transform is indexed by irreducible representations, and the question becomes which measurements on coset states are informative. Measuring only the name of the representation (weak Fourier sampling) suffices for normal subgroups [124]; measuring also inside the representation (strong Fourier sampling) helps for some groups and provably fails for others (Section 9). Ettinger, Høyer and Knill showed that the query complexity of the HSP is polynomial for every finite group: polynomially many coset states always contain enough information to identify H, although extracting it may take exponential time [103]. The dihedral group. The dihedral group DN = ZN ⋊ Z2 is the simplest non-abelian group of cryptographic interest. Its interesting subgroups are generated by a reflection (d, 1), and coset sampling for the subgroup {0, (d, 1)} yields states √12 (|0, x⟩ + |1, x + d⟩) with uniformly random x. Ettinger and Høyer showed that O(log N ) such states determine d information-theoretically, but their procedure for extracting it takes exponential time [102]. Kuperberg’s sieve. Applying the Fourier transform over ZN to the second register of a coset state and measuring it yields a uniformly random classical label y ∈ ZN and the qubit |ψy ⟩ = √12 |0⟩ + ω yd |1⟩ ,

ω = e2πi/N .

For N a power of two, a qubit with label y = N/2 is √12 (|0⟩ + (−1)d |1⟩) and reveals the parity of d by a Hadamard measurement. Kuperberg’s idea is to manufacture such labels by combining qubits: measuring the parity of two qubits |ψy1 ⟩ ⊗ |ψy2 ⟩ leaves, with probability 1/2 each, a qubit equivalent to |ψy1 +y2 ⟩ or |ψy1 −y2 ⟩, with known label. By repeatedly combining pairs whose labels agree √ on many low-order bits, the algorithm zeroes those bits in stages, reaching label N/2 after O( log N ) stages; the parity of d follows, and the remaining bits are found recursively. 18

√

The algorithm runs in time, query complexity and quantum space 2O( log N ) [143]. Regev gave a √ variant with polynomial space and running √time 2O( log N log log N ) [200], and Kuperberg a second algorithm, the collimation sieve, with 2O( log N ) quantum time, O(log N ) quantum space and √ O( log N ) 2 classical space, which performs better when that classical memory can be accessed quantumly [144]. All three algorithms consume a subexponential number of coset states, which is one obstacle to composing them with reductions that supply only polynomially many states. DCP with failure parameter. Regev’s reduction from lattices produces dihedral coset states that are only mostly correct. He therefore defined a version of the problem that tolerates a fraction of corrupted inputs. Definition 2.4 (DCP with failure parameter [199, Def. 2.1]). Let N ≥ 2 be an integer and f > 0, and use binary logarithms in this definition. The input to DCPfN is a list of poly(log N ) registers. Each is, with probability at least 1 − 1/(log N )f , in the state √12 (|0, x⟩ + |1, (x + d) mod N ⟩) on 1 + ⌈log N ⌉ qubits, where x ∈ ZN is arbitrary and d ∈ ZN is fixed; otherwise it is in an arbitrary state |b, x⟩ (a bad register). The goal is to output d with probability poly(1/ log N ) in time poly(log N ). A smaller f means more bad registers, hence a stronger algorithm; for f = 0 every register could be bad, which is why f > 0 is required, and we write f → 0+ for the limit of increasing tolerance. The noiseless problem, written DCP∞ N (f = ∞), is the plain DCP. The main theorem of [199] states that a solution to DCPf yields a quantum algorithm for uSVPγ with γ = Θ(n1/2+2f ); Section 4.2 explains how. The same paper shows that an algorithm solving a 1/poly(log N ) fraction of legal subset-sum instances with modulus N yields a solution to DCPf with f = 1 [199, Thm. 1.3], so that average-case subset sum would give a quantum worst-case to average-case reduction for Θ(n2.5 )-unique-SVP [199, Cor. 1.5]. This connection between DCP and subset sum is the template that the 2026 claim tried to complete (Section 3). Extrapolated DCP. Brakerski, Kirshanova, Stehlé and Wen generalised the coset states to superpositions over more than two multiples of the secret. Definition 2.5 (Extrapolated DCP [61, Def. 4]). For integers n, N and an amplitude function P ρ : Z → R≥0 , EDCPℓn,N,ρ asks, given ℓ states j∈supp(ρ) ρ(j)|j⟩|(xk + j · s) mod N ⟩ (normalisation omitted), k = 1, . . . , ℓ, with arbitrary xk ∈ ZnN and a fixed secret s ∈ ZnN , to find s. The two main instantiations are uniform EDCP, with ρ uniform on {0, . . . , M − 1}, and Gaussian EDCP, G-EDCPn,N,r , with ρ(j) ∝ exp(−πj 2 /r2 ). For n = 1 and ρ the indicator of {0, 1} this is DCPN without bad registers. They proved that LWE and EDCP are equivalent under quantum polynomial-time reductions, the extrapolation growing as the LWE noise rate decreases [61]. Quantitatively, from m = Ω(κ)
√ samples of LWEn,q,α they produce ℓ states of G-EDCPn,q,r for every r < 1/ c m κ ℓ α q n/m , √ with c = 6 2πe and κ a statistical parameter, using a reduction based on intersections of balls [61, Thm. 3]; a simpler reduction based on separating cubes, in the spirit of Regev’s 2002 reduction, gives r < 1/(32 mκαℓq n/m ) [61, Thm. 2]. The proof of Theorem 3 needs a lower bound on the minimum of Λq (A) and a radius condition [61, Lem. 6, App. B.1] that together restrict m to a range excluding both m close to n and m = Θ(n log q) (Section 4.4). The factor ℓ appears because the ℓ states are produced by repetitions of one procedure on the same samples and must all be valid; Section 4.5 shows that it cannot be treated as a constant. Conversely, for √ widths r = Ω( κ), ℓ = Ω(κ) states of G-EDCPn,N,r yield ℓ samples of LWEn,N,α with α = 1/r [61, Thm. 4]. The authors observe that, for polynomial M , a DCP algorithm yields an algorithm for uniform EDCP, giving consequences for LWE within the corresponding parameter promises; they also note a connection with the generalised hidden shift problem of Childs and van Dam, 19

discussed below. Wen and Zheng extended the equivalence to Module-LWE over Z[x]/(xd + 1), d a power of two, with constant module rank, polynomial modulus and O(log q) module samples, via a structured problem, IP-M-EDCP, that is equivalent to Module-LWE and reduces to plain EDCP [225]; Section 5 recovers the exact state map and checks its parameter certificate; the first ordinary EDCP output has modulus q d + 1, and no deployed attack follows from the audited bounds. Bai, Jangir, Kirshanova, Ngo and Youmans gave a quasi-polynomial algorithm for EDCP over power-of-two moduli; it requires quasi-polynomially many EDCP samples, while the reductions from LWE provide only polynomially many, and it does not apply to the moduli of deployed schemes [27]. Boucher, Fouque and Shen introduced the Cyclotomic Coset Problem, a generalisation of DCP that keeps a hidden-subgroup structure, and solved it with a quantum sieve in time and sample complexity 2Op (log n log q) using polynomial quantum space; this is quasi-polynomial for polynomial moduli, but the available reductions again generate only limited approximate states, so the result does not give a quasi-polynomial algorithm for standard LWE [58]. Related problems. Chen, Liu and Zhandry gave polynomial-time quantum algorithms for variants of average-case lattice problems via a filtering technique: for SIS in the infinity norm with very wide matrices, polynomial modulus and bound q/2 − O(1), and for EDCP with suitable amplitude functions, both through LWE with quantum auxiliary states [79]. Kothari, O’Donnell and Wu gave classical, deterministic algorithms for all the SIS∞ variants treated there, eliminating the exponential quantum speedup [142]. Cartor, Manganiello and Youmans generalised the BDD-to-EDCP direction to finite abelian groups with translation-invariant metrics, covering Hamming-, rank- and Lee-metric decoding [69]; we return to the consequences for codes in Section 8.1. Hidden shifts. Definition 2.6 (Hidden shift). Given injective f0 , f1 : G → S on an abelian group G with f1 (x) = f0 (x + s) for all x, find s. The abelian hidden shift problem is an instance of the HSP in the generalised dihedral group G ⋊ Z2 . For G = ZN , coset sampling reduces it to DCP: superposing over x and a control bit and measuring the function register yields the states of Theorem 2.4, with no bad registers (Theorem 4.6). The converse is not known: an algorithm with oracle access to f0 , f1 may use them in ways that a supply of coset states does not allow. Kuperberg’s algorithm applies to every finite abelian group [143]. Childs and van Dam studied a generalised hidden shift problem, in which an injective function f : {0, . . . , M − 1} × ZN → S satisfies f (b + 1, x + s) = f (b, x); for M = 2 it is the dihedral HSP, for M = N it is an abelian problem solvable by Shor’s methods, and for M = N ε with fixed ε > 0 they gave a polynomial-time quantum algorithm that applies the pretty good measurement to max{3, log(1/ε)} registers at once and reduces the resulting state-distinguishing task to integer programming in constant dimension [80]. The problem is close in spirit to EDCP with a large extrapolation, which is the connection noted in [61]. Childs and van Dam give a broad account of algebraic quantum algorithms [81]; Table 1 explains how our organising question differs. A map of the relations. Figure 1 summarises how the problems of this section are related. The left column contains the lattice problems, the middle column the dihedral coset problems that the reductions produce, and the right column the hidden-subgroup and hidden-shift problems from which the dihedral coset problem comes. Read from left to right, the figure shows why an efficient algorithm for a dihedral coset problem would reach lattices; read upwards in the right column, it displays the route for cyclic isogeny actions satisfying the full evaluation and

20

public-input conditions of Section 8.5. The tags anticipate the three hypotheses of Section 4.1, each of which assumes that the tagged problem is easy.

[201]

Lattice problems

Dihedral coset problems

Hidden subgroups and shifts

GapSVPγ , SIVPγ (worst case)

Subset sum (average case)

HSP on finite G (easy for abelian G)

f = 1 [199]

special case

uSVPγ (worst case)

LWEn,q,α

[199] Θ(n1/2+2f )

(with bad registers) DCPfN

HReg (f )

[61]

Dihedral HSP on DN = ZN ⋊ Z2 zero

noise

EDCPn,N,ρ (over Zn N) HEDCP [225]

Module-LWE

[225]

IP-M-EDCP (structured)

coset sampling, Theorem 4.6

DCPN , perfect states (noiseless coset states) HHS cyclic class group [82, 48]

Cyclic isogeny actions with efficient evaluation

Figure 1: Relations between lattice problems, dihedral coset problems, and hidden-subgroup and hidden-shift problems. An arrow A → B means that A reduces to B, so that an efficient quantum algorithm for B yields one for A; a double arrow denotes an equivalence. Labels give the source of each step, with the approximation factor γ of the first reduction and the failure parameter f of Theorem 2.4. The zero-noise arrow uses a solver for a prescribed noisy problem on noiseless inputs. In the converse algorithmic direction, Theorem 4.4 permits some solver-dependent failure exponent; it does not identify any fixed-f problems. The structured edges record the parameter-qualified published connection; the first EDCP modulus is q d + 1, and the printed forward bound supplies no ML-KEM certificate (Section 5). Tags in red identify the corresponding solver hypotheses of Section 4.1. The HEDCP tag covers only its stated polynomial-modulus Gaussian domain, not every EDCP state in the diagram; in particular it does not include the first large-modulus structured output. The cited algorithms for noiseless cyclic √ O( log N ) DCP include Kuperberg’s 2 sieves and Regev’s polynomial-space variant with an additional √ log log N in the exponent [143, 200, 144]. General abelian actions require the corresponding group and evaluation conditions [82].

3

The claimed algorithms: strategy and status

This section describes the algorithm of [214] and the reasons it does not solve DCP, and, in Section 3.6, Chen’s earlier claim for LWE and a proposed repair of it. We rely on the preprint itself, in its revision dated October 7, 2026, which we have read in full [214]; on the refutation of Gupte, Ragavan and Zhandry and its Lean development [120, 121]; on the rigorous restatement of the lemmas by Guo and Yang [119]; and on the independent Lean audit [205]. The three analyses predate the October revision: the Lean development of [121] models the draft dated August 11, Guo and Yang’s paper was received on August 17, and the audit, as consulted, does not discuss the October note. Contemporaneous public commentary is cited through [194, 196] and is used for dates and for the public objections that preceded the formal analyses. Where the sources describe the same step at different levels of detail, we say which source we follow. We do not reconstruct details that none of the sources states; the paragraph of informal intuition in Section 3.3, the assessment in Section 3.4 and our other readings of the draft are marked as ours. Statements about the two Lean developments refer to their public repositories as consulted on October 2, 2026, whose descriptions we re-read on October 18; we were not able to record commit identifiers, and the repositories may have changed since. A Lean development verifies 21

the stated theorems about a formal model of the algorithm; whether the model matches every detail of a draft that was revised several times is argued in natural language by the authors, and we report it as such.

3.1

The template: Regev’s reduction from DCP to subset sum

Kuperberg’s and Regev’s algorithms start from the same observation [143, 199], recalled in Section 2.8. Applying the quantum Fourier transform over ZN to the second register of a coset state √12 (|0, x⟩ + |1, x + d⟩) and measuring it yields a uniformly random classical Fourier label

y ∈ ZN together with the qubit |ψy ⟩ = √12 (|0⟩ + e2πi yd/N |1⟩). The labels are known; the phases carry the information about d. A qubit whose label is N/2 reveals the parity of d directly, and the difficulty is to produce such a label from random ones. The two algorithms differ in how they combine qubits. Kuperberg combines them two at a time: a parity measurement on |ψy1 ⟩ ⊗ |ψy2 ⟩ produces a qubit with label y1 ± y2 , and pairing qubits whose labels agree on many low-order bits zeroes √ those bits in stages. The price is that each stage discards most of the qubits, so that 2O( log N ) samples are needed [143]. Regev instead combines many qubits at once. Taking the tensor product of Q qubits gives the state 2−Q/2

X

e2πi d (

b y )/N i i i

P

|b⟩,

b∈{0,1}Q

in which the phase of each selection vector b depends on d only through the subset sum i bi yi . If one could coherently map every b with a given subset sum to a single register value, the selection bits would disappear and the phases would encode d in a form that a Fourier measurement can read. Regev proved that an algorithm solving a 1/poly(log N ) fraction of legal subset-sum instances with modulus N suffices for this, and obtains a solution to DCP with failure parameter f = 1 [199, Thm. 1.3]. Schematically, the template prepares a superposition over selection vectors, partially measures the subset sum, and then removes the selection bits coherently before a bit of d can be read; Gupte, Ragavan and Zhandry call this last part the uncomputation stage [120]. In Regev’s reduction, the subset-sum solver is what makes the uncomputation possible. Average-case modular subset sum with these parameters is not known to be easy, the subset-sum instances in question are themselves closely related to lattice problems [148, 156], so the template had not, before 2026, produced an efficient DCP algorithm. P

3.2

Simon’s strategy

According to its abstract, the algorithm “is based on Regev’s polynomial-time reduction of the Dihedral Subgroup Problem (DSP) to the modular subset sum problem”, but “uses a different technique to erase sample bits without use of a subset sum oracle” [214]. The intended contribution is thus a replacement, inside Regev’s template, of the subset-sum solver in the uncomputation stage. We follow the step-by-step description of Guo and Yang [119], which covers the same operations as the seven-step specification formalised in [121] and the detailed description in Section 2.2 of the October revision [214], divided slightly differently (see below). The algorithm works with N = 2n and the parameters Q = knc+1 samples (k > c), G = Q/m groups,

m = c log n bits per group (c ≥ 12), a = n/ log n,

L = log n.

With c ≥ 12 the algorithm consumes at least kn13 coset states per output bit: polynomially many, as the reductions require, but a large polynomial. It proceeds as follows. Step 1. Fourier sampling. Apply the Fourier transform to the Q samples, producing quantum Fourier labels [119, 121]. 22

Step 2. Subset-sum measurement. Measure a subset-sum quantity, obtaining a classical outcome z ′ and retaining a quantum register (b, h) [121]; in [119] this step produces the record entries Y and z ′ . Step 3. Grouping. Partition {1, . . . , Q} into G groups of m indices, compute the subset sum of each group and keep its top L bits [119]; the Lean specification calls the results the “high group words” [121]. The Lean specification models this step through coordinatewise digests of the Fourier labels that retain only their n − ℓ most significant bits, with ℓ = ⌊2n/3⌋ [121]. Step 4. Hadamard measurement. Apply a Hadamard transform to all Q selection bits and measure, obtaining a classical string φ′ divided into blocks φ′j , one per group [119]. Step 5. Adaptive partition. A group whose block φ′j is all-zero contributes no sign. Let A consist of the first a such groups and B of the rest [119]; the remaining words are kept in the order of A [121]. Step 6. Erasure. Perform the “certified reversible erasure” of the selection information, including carry-flag detection, and the associated measurements [121]. This is the bit-erasure technique of the abstract. Step 7. Output. Measure the resulting register h∗ and output one bit of the hidden shift [119, 121]. Steps 3–6 play the role of the uncomputation stage of the template: instead of a subset-sum solver, they use the high-order part of the group sums and the Hadamard outcomes to decide which selection information to erase. In the draft’s own numbering, which [121] follows, step 4 is our Step 4 together with the choice of A, and step 5 measures the group words of the groups in B and keeps those of A in order; its step 6 adds the group words of A modulo n into a sum s∗ , uses it to erase the last of them, and proceeds only if a carry flag is zero and the Hadamard-transformed low-order bits of s∗ are all zero, the latter an event of expected probability 2/n; and its step 7 computes and measures h′ = h ⊕ h∗ , which erases h, before h∗ is measured in the Hadamard basis to give the last bit dn of the hidden shift [214]. The procedure is repeated polynomially many times for each bit, and the remaining bits are obtained by the recursion of Regev’s template. The four lemmas. The correctness argument of [214] rests on four lemmas, of which only Lemma 2 is proved in full in the draft; Lemmas 1, 3 and 4 are proved by sketches. In the October revision, and in the readings of [119, 205]: • Lemma 1 asserts that, if k > c, then with constant probability the measured Hadamard string has at least n/ log n all-zero groups, so that Step 5 succeeds [214]. Guo and Yang state it as follows: if Z is the number of groups with φ′j = 0, then Pr[Z ≥ a] → 1 under the hypothesis k > c [119]. • Lemma 2 asserts that the contribution of the groups in B is the same for two values of z ∗ that differ only in their most significant bit h∗ . It is an exact statement, with a complete proof in [214], as [119] confirm. • Lemma 3 asserts that after the measurements no value z ∗ contributes an amplitude αz ∗ of exponentially large magnitude, except with probability O(2−n ) over the measured record, √ and a corollary bounds by n, except with probability O(1/n), the amplitude collected by each value of the top log n bits of z ∗ [214]. The October sketch computes the expectation of αz2∗ under the actual distribution of the Hadamard string by rewriting it as an expectation under the uniform distribution, which is how it keeps the two distributions apart. Guo P 2 and Yang prove, assumingthe partition hypothesis discussed below, that E z ∗ αz ∗ ≤ 1, −2 hence Pr maxz ∗ |αz ∗ | > θ ≤ θ for every threshold θ > 0 [119]. 23

Information p loss: Advantage ≤ Q K/N [120]

1 Fourier sampling

2 subset-sum measurement

3 grouping: top bits only

4 Hadamard, measure φ′

7 output one bit

6 certified erasure

5 choose A from φ′

Adaptive choice: Breaks Hypothesis (U) [119]

Steps 3–6 form the uncomputation stage, where Regev’s template uses a subset-sum solver [199].

Figure 2: The seven steps of the algorithm of [214], as described in [119, 121], and the two places where the analyses locate the failure. The draft, and [121] after it, numbers our Step 4 and the choice of A as step 4, and the measurement of the words of B as step 5.

• Lemma 4 asserts, for c ≥ 12, that the amplitudes collected by two values of the top log n bits of z ∗ that differ only in h∗ differ by an expected multiplicative factor 1 ± O(n−((c−1)/2−1) ), with probability at least 1 − 1/n, so that the bias survives amplification [214]. Guo and Yang prove instead an additive bound on the difference between the two amplitudes that determine the output bit, of order n−((c−1)/2−1) times a factor depending on the record, plus a residual term, and observe that the closing argument needs no more than this [119]. The closing argument of the draft combines Lemma 4 with the corollary of Lemma 3: the differences between paired amplitudes add up to at most 1/n except with probability 1/n, so that measuring h∗ in the Hadamard basis returns dn with probability “significantly greater than 1/2” [214]. Claimed consequences. The theorem of the draft asserts that there is a constant c′ such that, from samples that are correct with probability at least 1 − 1/(c′ log n), a polynomial-time quantum algorithm computes the last bit of the hidden shift [214]. Its abstract states that, combined with the reductions of [199, 61], it yields polynomial-time quantum algorithms for √ √ SVP with approximation factor n polylog(n) and for LWE with α = n polylog(n), in the draft’s notation; its final corollary states the same with O(·), and for these parameters the draft cites personal communications from S. Ragavan and D. Micciancio [214]. In the language of Section 4, it is a claim of the type HReg (f ), which also implies HHS ; Theorem 4.28 relates the claimed tolerance to the failure exponent. The draft’s route to LWE through [61] needs more than a cyclic solver: [61] connects LWE to extrapolated coset states over ZnN with polynomial N , not to cyclic coset states over Z2n ; no general implication from a cyclic solver to an extrapolated one is known (Section 4.1). Under HReg (f ), LWE is reached instead through the unique-SVP embedding of Theorem 4.17 (iii), with its sample and noise conditions. The draft does not mention any deployed parameter set [214].

3.3

Why the strategy does not work

The three cited analyses challenge the claim by different routes. The first proves a limitation for its formal observation model; the second and third identify gaps in the correctness argument. Relating the formal model to the evolving draft remains a separate step, as noted above. The author’s response to the first analysis is assessed in Section 3.4.

24

An information-theoretic barrier. Gupte, Ragavan and Zhandry prove a limitation that cannot be removed by repairing the analysis while retaining their formal observation model [120]. Their argument concerns the output bit for two secrets d0 , d1 whose least significant bits differ: an algorithm that recovers d bit by bit must, in particular, distinguish such a pair. The key observation is structural. Because Step 3 passes the Fourier labels to the rest of the computation only through coordinatewise digests Hi : ZN → [K], functions applied separately to each label yi , with at most K possible values, the final observation depends on the labels only through the digests Hi (yi ). The main theorem of the Lean development, stated for a formal model of the algorithm’s observation (the seven-step specification of [121]), asserts that for every n, every sample count Q, every digest size 1 ≤ K ≤ N = 2n , every coordinatewise digest family H = (H1 , . . . , HQ ), every such pair d0 , d1 and every Boolean-output quantum channel applied to the algorithm’s observation, the digests, the Step 2 outcome z ′ and the retained register (b, h), the output distributions satisfy ∆ Pd0 , Pd1

q

≤ Q K/N ,

where ∆ is the statistical (trace) distance [121]; the Lean development proves it by a hybrid argument, and the bound grows linearly with the number of samples. For the algorithm of [214], the digests keep n − ℓ bits with ℓ = ⌊2n/3⌋, so K = 2n−ℓ and the bound is Q · 2−ℓ/2 ≈ Q · 2−n/3 , negligible for every polynomial Q. Within that observation model, the bound allows arbitrary post-processing: retries, several invocations, adaptive stopping, majority votes and randomised decisions. Their refutation corollary turns it into the dichotomy quoted in Section 1: for every sufficiently large n, every pair with opposite least significant bits and every prefix-stable controller, either one of the two executions has expected sample count at least 2⌊n/9⌋ , or both terminate almost surely and their output laws are within poly(n) · 2−⌊n/9⌋ [121]. Thus the formalised algorithm cannot have both the claimed efficiency and correctness. In the words of the abstract, the method operates “using only the most-significant third of the classical Fourier labels”, whereas any successful DCP algorithm in Regev’s template would require “extensive use of the classical Fourier labels in the uncomputation stage” [120]. The barrier is not specific to Simon’s choices of parameters: it applies to algorithms satisfying the same coordinatewise-digest observation model [120, 196]. Informal intuition. The following example illustrates one parity-extraction method; it is not a characterisation of all quantum measurements. Write d = 2d′ + dlsb . A combined phase qubit with label Y has phase 2πY (2d′ + dlsb )/N . Taking Y = N/2 eliminates the contribution of d′ while preserving the parity-dependent sign. Producing this label requires control of its low-order bits. This explains why those bits matter to this method, but does not itself prove that other methods fail. The formal limitation is the bound of [121], with its coordinatewise-digest and observation-model premises. The partition hypothesis. Guo and Yang give rigorous statements and complete proofs of the lemmas of [214], in some cases stronger than the originals: Lemma 1 holds with probability tending to one, provided k > c; Lemma 3 holds at every threshold without the well-behavedness condition of the original; and Lemma 4 holds in an additive form, which is all the closing argument uses [119]. According to Guo and Yang, however, the lemmas require the following hypothesis: Hypothesis (U). The A/B partition is fixed and does not vary with φ′ ; with the rest of the record held fixed, φ′B ranges over all of {0, 1}QB [119]. In Step 5, A is defined as the first a groups whose block φ′j is all-zero, which makes A a function of the measured string φ′ : which groups end up in A depends on which blocks happened to be 25

measured as zero. The algorithm therefore does not supply Hypothesis (U), and, as Guo and Yang conclude, establishing the four lemmas “does not by itself establish the correctness of the algorithm” [119]. Lemma-level audit. The independent Lean audit examines the published proofs one by one, and distinguishes carefully between what it formalises and what it argues in natural language [205]. • Lemma 1. The published proof uses a simultaneous swap of selection bits and low parts of the samples that is meant to preserve the fibres of the measured subset sum. The audit shows that the swap changes the contribution by B(φj − φi )(Hi − Hj ), which need not vanish modulo the measured modulus, and gives a counterexample with n = 8 in which the contribution changes from 1 to 5 modulo 128. The constant-probability claim nevertheless has a corrected proof, formalised in Lean for n ≥ 1024, k = 24, c = 12 (in the audit’s notation), using collision bounds and Chebyshev’s inequality. • Lemma 3. After A is chosen adaptively, states with identical B-components become perfectly correlated rather than pairwise independent, contrary to the variance argument. An analysis in two copies, stated in natural language and not formalised, indicates that the first-zero decoder makes almost every Fourier mode diagonal. For one natural repair, the decoder without a guard, the correct and wrong output masses are 1/2 + o(1) each; for the draft’s own post-selection in its step 6, subject to one guard estimate still to be completed, the calculation predicts masses 1/(2L) + o(1/n) each and acceptance 1/L + o(1/n), with L = n/2. In both cases the output bit carries no bias. The audit also notes that conditioning on acceptance introduces a factor equal to the inverse of the acceptance probability, which can spoil the claimed exponential bounds. It concludes that Lemma 3 is “not repaired in the sense needed by the paper’s polynomial-time algorithm”. • Lemma 4. A printed exponent contains an extra +n, which is repairable, but the multiplicative amplitude bound remains unproved: independent coordinates can become correlated after conditioning, and nearly equal counts of signed terms give no multiplicative control when cancellation is possible. The audit records Lemma 4 as unproved, not refuted; its clean-oracle calculation, also in natural language and pending the same guard estimate, contradicts the closeness of branch amplitudes that the proposed decoder needs. • Implementation. Every decoder the audit analyses meets a coherent scale of 2n/2 , and none of the realisations considered has polynomial cost. The revision record. The preprint was received by the ePrint archive on August 3, 2026, made public on August 6, and revised six times, last on October 8; the PDF of that revision is dated October 7, 2026, and is still labelled a preliminary draft [214, 194]. According to the first note on the ePrint record, the proof of Lemma 3 in the first draft had conflated pairwise independence under the uniform and the actual distributions of the Hadamard string, and the revised proof keeps them apart; a separate note, added after [120] appeared, said that the refutation was being evaluated. According to the ePrint record, the October revision adds a note addressing the claims of [120], discussed in Section 3.4, and clarifies the proof of Lemma 3 in response to comments by Sam Jaques [214]. Both revisions concern the proof of Lemma 3, whose October sketch still rests on pairwise independence over the Hadamard string [214, §2.2]. The audit finds that pairwise independence still fails once A has been chosen adaptively [205], Guo and Yang locate the same dependence in Hypothesis (U) [119], and the barrier of [120] does not depend on any lemma, so revising those lemmas alone cannot overcome it within the formal observation model. 26

Ingredient

Finding

Source

Algorithm as specified

p Fails: advantage ≤ Q K/N ≈ Q 2−n/3 for post-processing within the formal observation model; exponential samples or negligible advantage. Repaired: published proof invalid (the October sketch keeps the swap argument [214]); the constant-probability claim has a corrected proof, and holds with probability tending to one. Holds: exact, with complete proof. Conditional: holds under Hypothesis (U); not repaired for the algorithm as specified; the October sketch still varies the Hadamard string freely with the rest of the record fixed. Conditional: additive form holds under (U); multiplicative form unproved; the author concedes that it fails when the selection bits of A are traced out. Fails: A depends on φ′ , so Hypothesis (U) is not supplied. Unknown: analysed decoders have coherent scale 2n/2 .

[120, 121] (Lean)

Lemma 1

Lemma 2 Lemma 3

Lemma 4

Partition rule (Step 5) Polynomial implementation Response of October 7

No escape: post-selection accepted with probability Ω(1/n) stays within the bound, which covers every channel on the digest-restricted state, restarts included; the adaptive step is asserted, not proved.

[205] (Lean), [119]

[119] [119, 205]; Section 3.4

[119, 205], [214, §3]

[119] [205] [214, §3]; our analysis (Section 3.4)

Table 2: Status of the ingredients of [214] according to the published analyses and, for the revision of October 7, 2026, our analysis.

27

3.4

The author’s response of October 2026

The revision dated October 7 adds a section, “A Note on [6]”, in which the author answers the refutation of Gupte, Ragavan and Zhandry, reference [6] of the draft [214, §3]. The note restates the result of [120] as the statement that the density matrix after Step 2 is exponentially close to the one obtained if all the selection qubits bi are traced out, which would destroy the relation between the phases of the two values of h that encodes dn . It then makes three claims. • A concession. Lemmas 1–3 are “completely compatible” with [120]; Lemmas 2 and 3 concern the part of the state indexed by B, which could be traced out without affecting the algorithm. “Rather, it’s Lemma 4, the claim that the ϕA state portions are roughly evenly distributed among z ∗ values, that fails once the bits in ϕA are traced out”, and this “would certainly cause the algorithm to fail”. • Post-selection. Because A is chosen so that the Hadamard outcomes on its selection bits are all zero, the values of h and h∗ computed when those bits are traced out may “diverge non-negligibly from the actual case, despite the proof in [6]”. According to the note, the closeness proved in [120] is an average over the Fourier labels, and an all-zero Hadamard outcome changes that average. • Three variations. If all the selection bits are measured as zero after their Hadamard transform, the algorithm works, but this happens with exponentially small probability. If a set A of n/ log n groups is fixed in advance and the other selection bits are measured, the algorithm works in the also exponentially unlikely case that the Hadamard outcomes on A are all zero, whereas tracing out the bits of A predicts failure; according to the note, it works equally well if the other bits are not measured, provided the outcomes on A are all zero “and would form exactly the set A chosen by the algorithm”. For the algorithm as specified, “its output will be identical to that of the previous variation in which A is pre-selected, conditioned on the Hadamard transforms all coming out as hoped, the only difference is the much larger success probability due to post-selection”. The note reconciles this with [120] by observing that, whatever set A is post-selected, “the probability that that particular set produced all zeroes when Hadamard-transformed was a priori exponentially small, and thus nominally consistent with the result in [6]”, and summarises that post-selection lets the required deviation “hold with high probability overall, rather than an exponentially small one”. The note concludes that tracing out all the selection bits “will thus produce an incorrect prediction of the algorithm’s output”. The note does not discuss the statement of the main theorem of [120], a bound for every channel applied to the digest-restricted state, or its Lean development, and it names no step of the draft that their formal model leaves out. It accepts the closeness of density matrices as it restates it, and maintains only that tracing out the selection bits mispredicts the output of the post-selected algorithm. The algorithm it defends has the seven steps modelled in [121] (Section 3.2). Assessment.

We find in the note no argument that removes the barrier, for four reasons.

1. The bound already covers post-selection. The main theorem of [121] bounds the trace distance between the states of the two secrets formed by the digests of the Fourier labels, the Step 2 outcome z ′ and the retained register (b, h); its proof dephases the selection bits one at a time and shows that the fully dephased state does not depend on the secret. This is the closeness that the note restates, with one difference that matters: it concerns the digest-restricted state, not the state that keeps the full labels, from which dn can in principle be read, as a subset-sum solver does in Regev’s template. Since no channel increases trace distance, the bound applies to the output law of every Boolean-output channel applied to that state, with no restriction on efficiency; Hadamard transforms, measurements, adaptive 28

choices and post-selection are all such channels. The exact procedure is not literally of this form, because the draft’s step 3 keeps the top bits of the exact group sums, which depend on the low-order label bits through carries. The refutation corollary replaces these words by words rebuilt from the digests, which differ only on a set of labels of probability at most polynomial times 2ℓ−n ; it applies the main theorem to the rebuilt procedure, grouping, Hadamard transforms, choice of A with a restart if too few groups qualify, the two post-selections of the draft’s step 6 and the final measurements, and transfers the bound to the exact procedure. In this one-attempt form a restart is an outcome in its own right, and the total-variation distance between the laws of the outcomes restart, output 0 and output 1 is at most poly(n) · 2−⌊n/3⌋ [121]. 2. Conditioning loses only the acceptance probability. Let ε bound the total-variation distance between the two outcome laws, restarts included; let p0 , p1 be the acceptance probabilities for the two secrets, q0 , q1 the probabilities of output 1 given acceptance, and ∆1 = p0 q0 − p1 q1 , ∆0 = p0 (1 − q0 ) − p1 (1 − q1 ). Then p0 (q0 − q1 ) = (1 − q1 )∆1 − q1 ∆0 and |∆0 |, |∆1 | ≤ ε, so p0 |q0 − q1 | ≤ ε: given acceptance, the distinguishing advantage is at most ε/p0 . The bound concerns the acceptance event of the whole algorithm, the union over all candidate sets A; that each particular set is a priori exponentially unlikely does not enter. Read as conditional probabilities, the draft’s claims put the acceptance probability of a run at Ω(1/n), constant probability for Lemma 1 and for the carry flag, and expected probability 2/n for the all-zero outcome of step 6, so the conditional advantage remains at most O(n) · poly(n) · 2−⌊n/3⌋ , still negligible. The same computation answers the remark that the closeness proved in [120] is an average over the Fourier labels: the algorithm’s success probability is the same average, and an all-zero Hadamard outcome is one of the accepted events it covers. Whatever the acceptance probability p, an advantage δ given acceptance requires p ≤ ε/δ, which is exponentially small for δ ≥ 1/poly(n); the third point then applies. The audit applies the same elementary rule to the tail bounds of Lemma 3, where conditioning on acceptance mass ρ costs a factor 1/ρ, notes that a concrete lower bound on the acceptance probability of step 6 still needs a new hypothesis or repair, and, in a two-copy calculation stated in natural language and pending one guard estimate, predicts for that step an acceptance probability 1/L + o(1/n) with L = n/2 and equal correct and wrong output masses: acceptance of order 1/n and no bias [205]. 3. Amplification needs exponentially rare events. Post-selection can turn a small distance into a large one only on events of exponentially small probability, as in the three variations of the note. For the algorithm itself, repeating a run until such an event occurs costs exponentially many samples in expectation, which is the first alternative of the refutation corollary [121]; for the note’s variations, which the corollary does not model, the same conclusion follows from the main theorem and the second point. The note relies on the opposite move when it passes from its second variation to its third: it invokes the closeness proved in [120] for measuring or not measuring the selection bits of B, a bound of order Q · 2−n/3 , and then conditions on all-zero outcomes on A, an event it calls exponentially unlikely. By the same accounting the closeness gives no control after such conditioning; this is the reasoning that the note applies to A but not to B. 4. The decisive step is the adaptive choice. The note’s final claim, that choosing A after the Hadamard measurement gives the same output as fixing it in advance and conditioning on the same outcome, is asserted without proof. Since A is a function of the measured string, the two procedures leave the same state for each complete outcome, so the claim amounts to the correctness of the pre-selected procedure when one also conditions on A being the set that the algorithm would choose. That condition constrains the outcomes on B; it is the conditioning excluded by Hypothesis (U) [119] and the source of the correlations found by the audit [205]. The note derives that correctness from its second variation, 29

which does not condition on B, and from the proof of its Section 2, which, according to [119], needs a fixed partition. Within the formal model, the claim cannot hold together with the claimed correctness of the pre-selected variation: together they would give a conditional advantage bounded away from zero at acceptance probability Ω(1/n), hence an unconditional advantage of order 1/n, far above the bound. The clarified sketch of Lemma 3 does not address the adaptive choice either. It varies the Hadamard string with the rest of the record fixed and treats each of its bits as free, “assuming uniform D”, although the same string determines which groups form A. Lemma 1 is still proved by the swap argument for which the audit gives a counterexample, and Lemma 4 is still stated in multiplicative form with a sketch [214, 205]. The revision therefore leaves the findings of Table 2 unchanged; the table records the October sketches and adds a row for the note. It does make one point explicit: by the author’s own account, correctness rests on Lemma 4 in the regime in which the selection bits of A are not traced out, which is where the adaptive choice of A enters.

3.5

What the failure teaches

The three analyses and the response discussed in Section 3.4 support four lessons, each of which bears on the counterfactual studied in the rest of this survey. 1. Uncomputation requires a justified algorithm. Regev’s template reduces DCP to removing the selection bits after a partial measurement of a subset sum [199]. Simon’s strategy attacks exactly that step, and the barrier of [120] constrains algorithms in the stated observation model: a digest that keeps a third of each labelpleaves a distinguishing advantage of at most Q · 2−n/3 , and more generally the bound Q K/N is non-negligible for polynomial Q only if each coordinatewise digest retains all but O(log n) bits of its label. Within that coordinatewise-digest model, an algorithm realising HReg (f ) would therefore have to make, in the words of [120], “extensive use of the classical Fourier labels” in the uncomputation stage. 2. Adaptive measurements need adaptive analyses. The gap identified in [119] is a classical pitfall: choosing a subset of registers using measurement outcomes can invalidate independence assumptions; the cited analyses identify this failure in the proposed partition rule. The audit’s correlation counterexamples make the same point at the level of individual lemmas [205]. 3. Formal developments make the verified scope explicit. Both negative analyses come with Lean developments, which verify the stated bounds for formal models of the algorithm and, in the audit, part of the lemma-level arguments [121, 205]; the decisive one appeared nine days after the preprint became public [194]. The formal bounds support the refutation of the specified model; the correspondence between model and draft remains an informal step requiring its own justification. This is also why the refutation does not make the counterfactual moot: it disposes of a template with limited label information, not of DCP, as Section 1 and Theorem 4.7 explain. 4. Post-selection does not create information. When a distinguishing advantage is bounded for every channel acting on the retained registers, post-selection that succeeds with nonnegligible probability can increase it by at most the inverse of the acceptance probability. Larger gains require accepting exponentially rare events and paying for them with exponentially many samples. The same accounting applies to any proposed DCP algorithm that combines a lossy observation with adaptive post-selection (Section 3.4).

30

3.6

Chen’s LWE algorithm and a proposed repair

Two earlier claims bear on the same question from another direction: instead of solving a dihedral problem, they target LWE directly. We describe them from the preprints themselves, Chen’s paper in its revision of April 19, 2024, which carries the author’s note of April 18 [77] and Zhang’s in its eighth arXiv version, of May 14, 2026 [227], and from the public rebuttal of the latter [19]. The comparisons with the reach theorem at the end of this subsection are our analysis. Chen’s claim. In April 2024 Chen announced a polynomial-time quantum algorithm for LWE with certain polynomial modulus-noise ratios [77], following earlier work on quantum algorithms for LWE-type problems given quantum samples [79, 78]. As stated, the algorithm e 4 m2 ), in solves LWE with m ≥ Ω(n log q) samples and noise DZ,β , β = αq, whenever q ∈ Ω(β 4 e e −3.5 ), time poly(m, log q, β). Combined with Regev’s reduction [201] at q ∈ O(n ) and α ∈ O(n it would give SIVP and GapSVP for all n-dimensional lattices within factors of order n4.5 , up to logarithmic factors [77, Thm. 1.6, Cor. 1.7]. The algorithm introduces Gaussian functions with complex variances, exploiting the “Karst wave” in the discrete Fourier transform of complex Gaussians, and windowed quantum Fourier transforms with complex Gaussian windows. In nine steps it prepares a superposition over a lattice under a complex Gaussian window, alternates quantum Fourier transforms with a second window, measures low-order bits, extracts a state with purely imaginary Gaussian amplitudes, and in Step 9 extracts a linear equation over the secret; repetitions give a linear system, solved by Gaussian elimination. On April 18, 2024 the author reported that Step 9 contains a bug, found by Hongxun Wu and, independently, Thomas Vidick, that he did not know how to fix, and stated that the claim of a polynomial-time quantum algorithm for LWE with polynomial modulus-noise ratios no longer holds; the paper remains online, with a clarification of Step 8, as a source of techniques [77]. The details of the bug are given in Section 3.5.9 of the updated paper; we do not reconstruct them. Zhang’s proposed repair. Zhang proposed to replace Chen’s Steps 8 and 9 by a single exact post-processing routine [227]. In the eighth version, this Step 9† measures the residue τ = X1 mod D2 of the first coordinate, applies a diagonal quadratic phase that cancels the chirp, using a run-local gauge value, and applies a quantum Fourier transform over ZM . Writing b = (−1, 2p1 s, 2p1 e) ∈ Z1+n+m for the planted vector of Chen’s lattice formulation of LWE and Q = (c + 1)∥b∥2 , the paper proves, under conditions AC1–AC5 described below (AC1–AC4 for the uniformity statement, given resonance), that accepted outcomes u satisfy ⟨b, u⟩ ≡ 0 (mod Q) with probability 1 − negl(n) and are uniform on the hyperplane {v ∈ Z1+n+m : ⟨b, v⟩ ≡ 0 Q (mod Q)}, so that O(n + m) of them determine b, hence s and e [227, Lem. 2.2, Lem. 3.3, Thm. 3.4]. The consequence for LWE is stated conditionally: assuming Chen’s reduction from LWE to a lattice problem and its unique-shortest-vector promise, if Chen’s front end can be compiled in a re-tuned configuration satisfying AC1–AC4 and the Gaussian-envelope hypotheses of the paper’s Proposition 2.6, which imply AC5, the routine solves Chen’s chosen-secret instance and, through Chen’s classical reductions, LWE in the same parameter regime [227, Cor. 3.5]. AC1 concerns the state after Chen’s Step 7, AC2 requires Q to be odd, AC3 keeps Chen’s scaling, and AC5 is a spectral concentration condition, which the paper proves for Gaussian envelopes under additional hypotheses. AC4 assumes that the preparation oracle “also returns, as classical side information,” the residue v1∗ (E) mod Q of the run-dependent affine offset of the front end, or an equivalent gauge value. The paper does not assume that this value is derivable from the coordinate registers, calls it an additional oracle promise for a black-box oracle, and offers as the alternative a compilation that requires E to be “available coherently during the preparation” [227, Sections 1 and 2, Prop. 2.3]. The paper does not show that a re-tuned front end supplies AC4 or meets the hypotheses of Proposition 2.6, and it gives no cost for supplying AC4. 31

The published rebuttal. Apon’s rebuttal [19], first posted on October 18, 2025 and revised on October 28, raises two objections, both about the first steps of Zhang’s routine. First, it points out that in the first version, of September 15, 2025, the coherent shift of Step 9† adds to a copy of the coordinate registers a shift along the planted vector, so that computing it presupposes the answer. Second, it argues that in the third version, of October 1, the latest when the rebuttal was written, the idea behind the routine, a “pair-shift difference” that subtracts a shifted copy to cancel the unknown offset, relies on a reversible “coordinate evaluator” meant to reproduce Chen’s pipeline up to Step 8.f, although that pipeline measures a register in its first step, and it concludes that there is no evidence that an efficient evaluator of this kind exists. The revision of October 28 replies to a note of October 24 in which, according to the rebuttal, Zhang argued that deferred measurement resolves this point; the reply states that the deferred circuit needs two strongly correlated measurements to return the same value, which happens with negligible probability. Its author believes that these issues refute the paper’s claims. The eighth version, which the rebuttal predates, no longer contains the pair-shift step. It receives one copy of the state after Chen’s Step 7, does not assume that two copies with the same offset can be obtained, and takes the residue of the run-dependent offset, which depends on Chen’s measurement outcomes, from the oracle as side information (AC4). In our reading, what the pair-shift step was meant to do, remove the dependence on the unknown offset, now rests on that assumption, which, as noted above, the paper does not show how to meet. Neither the paper nor the rebuttal has been peer reviewed. Claim

What was claimed

Where it would enter the map

Status

Chen 2024 [77]

Quantum polynomial-time search-LWE for m ≥ Ω(n log q) 4 2 e and q ∈ Ω((αq) m ); hence SIVP and GapSVP within factors of order n4.5 via [201].

Withdrawn: bug in Step 9, found by H. Wu and, independently, T. Vidick; claim withdrawn on April 18, 2024.

Zhang 2025–26 [227]

An exact replacement for Chen’s Steps 8–9 whose accepted outcomes, under AC1–AC5, are uniform on the dual hyperplane of the planted vector; LWE in Chen’s regime if the front end meets the conditions.

Simon 2026 [214]

Quantum polynomial-time DCP tolerating faulty samples at √ rate 1/O(log n); SVP at n polylog(n) and LWE through [199, 61].

A many-sample, small-noise LWE regime inside the reach of HReg (f ) for f < 1/2; large-width G-EDCP via [61, Thm. 4]; no known route to the three hypotheses; excludes ML-KEM, FrodoKEM and standard-noise LWE. The same regime as Chen’s claim, if the conditions held; no new consequence. AC4 requires the preparation oracle to supply a residue of a run-dependent offset, which the paper does not assume derivable from the coordinate registers. A claim of type HReg (f ) for every constant f > 0 (Theorem 4.28); a correct version would subsume Chen’s conclusion for LWE (Theorem 4.17 (iii)).

Conditional: version 8 of May 2026, not peer reviewed; rebuttal of versions 1 and 3 [19].

Refuted: Sections 3.3 and 3.4.

Table 3: Three claimed polynomial-time quantum algorithms bearing on LWE, their place in the counterfactual map and their status.

Where the claims enter the counterfactual. Figure 3 and Table 3 summarise the following comparison. 32

Simon 2026 [214] DCPN , faults at rate 1/O(log n) Refuted

Chen 2024 [77] LWE, m ≥ Ω(n log q), e (β 4 m2 ) q ∈ Ω Withdrawn

if correct; R. 4.28

claimed, on a subregime

repairs if AC1–AC5

Thm. 4.17 Uniform LWE, m ≥ 2n lg q, HReg (f ), every (iii) α ≤ αReg (m); it contains constant f > 0 Chen’s regime if f < 1/2 (HHS : some fA , L. 4.4) [201]: e O(n/α)

[199]; Thm. 4.17

[61], Thm. 4

Zhang 2025–26 [227] exact routine for Chen’s Steps 8–9 Conditional

G-EDCPn,N,r , large widths only; from Chen’s regime: e (N 3/4 ℓ1/2 ) r ≥ Ω

not reached

ML-KEM, FrodoKEM, standard-noise LWE Outside the regime

Worst-case uSVP, BDD, GapSVP, SIVP at polynomial factors

Figure 3: Where the three claimed algorithms would enter the counterfactual map, drawn in the solver direction of Fig. 4: an arrow from A to B means that an algorithm for A yields one for B. Dotted arrows are claims, and the one from Chen’s claim ends at the node that contains its regime; solid arrows are proved under the cited premises; the dashed arrow marks parameters outside the claimed regime. The inclusion of Chen’s regime, the width bound for G-EDCP and the comparison with deployed parameters are our analysis (Section 3.6).

1. A direct LWE solver, not a dihedral one. Chen’s statement, and Zhang’s conditional version of it, concern LWE in a single regime: many samples, m ≥ Ω(n log q), and noise that is e 3 m2 ). No known reduction derives HHS , small relative to the modulus, α = β/q ≤ 1/Ω(β HReg (f ) or HEDCP [ℓ] from a solver for this regime: no reduction of cyclic DCP to LWE is known, and the only known general route from an LWE solver to extrapolated states is the converse reduction [61, Thm. 4], which turns ℓ states of G-EDCPn,N,r into ℓ samples of 4 ℓ2 ), and ℓ ≥ Ω(n log N ) states, e LWE with α = 1/r. With Chen’s condition, N ∈ Ω((N/r) 3/4 ℓ1/2 ), up to the noise distribution produced by that e this covers only widths r ≥ Ω(N reduction, whereas HEDCP [ℓ] requires every r ≥ r0 . 2. Inside the reach of HReg (f ). Theorem 4.17 (iii) solves search-LWE with m ≥ 2n lg q √ samples, prime q and noise DZm ,αq whenever α ≤ αReg (m) = 1/(8 m γu (m + 1)), that e 3 m2 ), so for noise parameters β ≥ 1 is, α ≤ 1/O(m1+2f ). Chen’s regime gives α ≤ 1/Ω(β and every f < 1/2, each instance of that regime with m ≥ 2n lg q and prime q lies inside the reach once n is large enough, for all but a q −n fraction of A. At the parameters √ of the lattice corollary (β ≈ n, α ≈ n−3.5 , m = Θ(n log q)) the same holds for every f < 5/4. The corollary’s factor of order n4.5 is weaker than the HReg (f ) guarantees, e 1+2f ), for f < 3/2 and f < 7/4 respectively. SIVP at O(n3/2+2f ) and GapSVP at O(n Under HEDCP [ℓ], with q ≤ poly(n) and the samples reduced to mmax (n, q), the certified ∗ (n, ℓ) = 1/O(ℓn) e scale αE exceeds the corollary’s α ≈ n−3.5 whenever ℓ ≤ n5/2 /polylog(n). Under HHS the comparison depends on the witness through fA (Theorem 4.4). 3. Subsumed by a correct version of Simon’s claim. Read as a claim of type HReg (f ) (Section 3.2), the tolerance claimed in [214] exceeds the one that HReg (f ) grants for every constant f > 0 (Theorem 4.28). A solver with that tolerance would therefore satisfy HReg (f ) for every constant f , in particular for f < 1/2, and by the previous point would solve every instance of Chen’s regime with m ≥ 2n lg q, prime q and β ≥ 1. In this precise sense Simon’s claim was the more far-reaching one: it would have implied Chen’s conclusion for LWE in that range, and stronger worst-case factors; no converse implication is known. 33

4. No deployed parameter set. Chen’s condition and sample √ count fail for the deployed LWE-based KEMs. For ML-KEM and FrodoKEM, with β = 2π σ for the error standard deviation σ, the ratio β 4 m2 /q ranges from about 4 × 103 (FrodoKEM-1344) to 3 × 104 e and each key offers m = n (FrodoKEM-640) before the logarithmic factors hidden in Ω, e √n), is excluded samples rather than Ω(n log q). Standard-noise LWE, with α = 1/O( 2 ) when β ≥ 1. A correct version of the e as well, since the regime requires α ≤ 1/Ω(m withdrawn claim would thus have certified only LWE instances that Table 6 already lists as reached under HReg (f ) for f < 1/2 (many samples, small noise), and none of the parameter sets of Table 7. 5. A repaired step is not a repaired algorithm. Zhang’s routine addresses Chen’s postprocessing. Its consequence for LWE remains conditional on the front end and on side information about a run-dependent offset that the paper does not show how to obtain from LWE samples. Even if AC1–AC5 were established, the result would solve LWE only in the regime of the first point and would add no consequence to the classification. We therefore record the Chen–Zhang route as a withdrawn claim with a conditional repair, not as a hypothesis of this survey.

4

The counterfactual hypotheses and their reach

This section turns “DCP is easy” into three precise hypotheses, which differ in their access model, robustness to faulty inputs and extrapolation requirements, and derives their consequences. We compose published reductions while retaining the parameters and promises needed at each step. The propositions of Section 4.5 make the resulting bounds, decoder success and preparation error explicit; the underlying mechanisms are credited there. The information-theoretic bound of Theorem 4.22, due to an anonymous reviewer, constrains the number of extrapolated states. To make the compositions checkable, Section 4.2 explains Regev’s reduction from lattices to DCP in detail.

4.1

Three hypotheses

“DCP is easy” is ambiguous in four ways that change the consequences: the tolerance to bad registers, the group (ZN with N exponential, versus ZnN with N polynomial), the robustness to non-uniform amplitudes, and the access model (coset states, or oracle access to the functions that define them). We therefore state three hypotheses. All three are state-input hypotheses: the algorithm receives quantum states and nothing else. Hypothesis 4.1 (HReg (f )). Fix a constant f > 0. There is a quantum algorithm solving DCPfN in time poly(log N ), with inverse-polynomial success probability, for every N . Hypothesis 4.2 (HEDCP [ℓ]). Let ℓ = ℓ(n, N ) be bounded by a polynomial in n. There are a constant r0 > 0 and a quantum polynomial-time algorithm that, for every polynomially bounded modulus N and every r ≥ r0 , solves G-EDCPℓn,N,r from ℓ states, for every secret and arbitrary offsets, with success probability at least 1/poly(n). We write HEDCP when the sample complexity is left unspecified. Hypothesis 4.3 (HHS ). There is a quantum algorithm that, given polynomially many noiseless dihedral coset states over ZN (the input of DCP∞ N , Theorem 2.4), recovers the hidden shift in time poly(log N ) with inverse-polynomial success probability, for every N , every secret and arbitrary offsets. The generalised form Hab HS asserts the same for finite abelian groups given by generators and relations. Lemma 4.4. Let L = max{1, log2 N }, using the binary logarithm in the corruption probability of Theorem 2.4. Suppose a noiseless cyclic coset-state algorithm A uses at most Q(L) ≤ CLa 34

registers and succeeds with probability at least p(L) ≥ cL−b , for every secret and arbitrary offsets. Under the corruption model of DCPfN , its success is at least p(L) − Q(L)L−f . Consequently, A establishes HReg (f ) for every fixed f > a + b, with sufficiently large input size. In particular,
HHS ⇐⇒ ∃ f > 0 constant : HReg (f ) . Proof. A register corrupted with probability at most L−f has trace distance at most L−f from its ideal coset state. The tensor-product hybrid bound gives total distance at most Q(L)L−f . Applying A and measuring its output cannot increase this distance. If f > a + b, then CLa−f ≤ cL−b /2 for sufficiently large L, preserving inverse-polynomial success. The finitely many smaller input sizes can be handled separately. The reverse implication uses inputs with no bad registers. This is the rare-corruption observation underlying [199, Cor. 1.2]. Sources and justification. The hypotheses isolate the input promises of the reductions, rather than claiming minimal solver assumptions. Regev’s Definition 2.1 and Theorem 1.1 give the probabilistic bad-register model and the fixed-f lattice consequence [199]. His Corollary 1.2 already records the qualitative consequence of a noiseless solver; Theorem 4.4 makes its sample and success dependence explicit. The unstructured hypothesis HEDCP [ℓ] is used with the Gaussian-state reductions of [61]. We expose ℓ because the forward reduction must prepare all states correctly, while Theorem 4.22 gives ℓ = Ω(n log N ) at fixed width. The structured state map of [225] and its parameter audit appear in Section 5. Its large-modulus output is not an additional clause hidden inside HEDCP ; the exact positive composition there uses Hab HS (or HHS for rank one), subject to the forward preparation and state budget. The cyclic and abelian hidden-shift hypotheses use the coset-state access model of [143, 82]; Theorem 4.6 gives the required state preparation from efficient injective functions. What the hypotheses mean. The parameter f in HReg (f ) is prescribed: each register is bad with probability at most (log N )−f in the model of Theorem 2.4. It is not an unrestricted adversarial entangled-noise model. The vector-state hypothesis HEDCP [ℓ] concerns polynomial moduli and Gaussian widths at least r0 . The cyclic hypothesis HHS concerns noiseless states; Theorem 4.4 explains why sufficiently rare corruptions preserve its inverse-polynomial success. Known subexponential cyclic sieves [143, 200, 144] and the quasi-polynomial EDCP algorithm [27] do not furnish these polynomial-time, polynomial-sample guarantees in the required regimes. Relations between the hypotheses. For each fixed f > 0, HReg (f ) implies HHS . Conversely, Theorem 4.4 shows that HHS implies HReg (fA ) for some constant fA depending on the sample complexity and success probability of its witnessing algorithm. Thus the existential form of HReg and HHS are qualitatively equivalent. A specified small value of f remains a stronger quantitative requirement: the lemma gives no such value independently of the solver. Also, HReg (f1 ) implies HReg (f2 ) whenever f2 ≥ f1 , because the permitted corruption probability decreases. We establish no additional implication involving HEDCP [ℓ]. Its relation to the cyclic hypotheses remains a separate question. We retain H⋆ := HReg (f ) ∧ HEDCP as notation for the conjunction, without asserting a strict separation from HHS . The next lemmas concern smooth extrapolation and coset-state preparation, respectively. Lemma 4.5. Let ρ : Z → R≥0 have finite support J, with the index j ∈ J stored in binary on poly(n) qubits and membership in J decidable in classical polynomial time, and set ε := maxk ρ(2k + 1)/ρ(2k) − 1 over the k with ρ(2k)ρ(2k + 1) > 0. Suppose a quantum algorithm A recovers s ∈ ZnN from ℓ states of the form a|0⟩|yk ⟩ + b|1⟩|yk + s⟩ with arbitrary yk and |b/a − 1| ≤ 35

′

ε, succeeding with probability p. Then there is a quantum algorithm that solves EDCPℓn,N,ρ with ℓ′ = O(ℓ/πρ ) samples and success probability p − 2−Ω(ℓ) , where πρ := Prj∼ρ2 [ j and j ⊕ 1 both in supp(ρ) ]. Proof. The algorithm needs no access to ρ beyond the given states and the membership test for J: it only measures a function of the index register, never prepares amplitudes, and it is efficient P when πρ ≥ 1/poly(n). Write each extrapolated state as k ρ(2k)|2k⟩|x + 2ks⟩ + ρ(2k + 1)|2k +
1⟩|x + (2k + 1)s⟩ and measure the observable ⌊j/2⌋. On outcome k the state collapses, up to normalisation, to ρ(2k)|2k⟩|y⟩ + ρ(2k + 1)|2k + 1⟩|y + s⟩ with y = x + 2ks, which after relabelling the first register as a qubit is a two-point state with b/a = ρ(2k + 1)/ρ(2k). The outcome k is known, but y is not; since A accepts arbitrary yk , this does not matter. A sample is useful when both 2k and 2k + 1 lie in the support, which happens with probability πρ ; by a Chernoff bound, O(ℓ/πρ ) samples yield ℓ useful ones except with probability 2−Ω(ℓ) . Run A on them. For Gaussian ρ of width r, first truncate to |j| ≤ tr: by an elementary estimate of the 2 Gaussian tail, each state moves by trace distance at most e−πt /2 for t ≥ 1. On the truncated 2 support, ρ(2k + 1)/ρ(2k) = e−π(4k+1)/r with |4k + 1| ≤ 2tr + 1, so ε ≤ eπ(2tr + 1)/r2 ≤ 3eπt/r when r ≥ 7t (using |e−x − 1| ≤ e|x| for |x| ≤ 1), and πρ ≥ 1/2. Robust two-point solvers 2 with tolerance ε therefore handle G-EDCP of width r = Ω(t/ε), at a cost of ℓe−πt /2 in success probability; this is the quantitative form of the observation in [61] that a DCP algorithm yields an EDCP algorithm. The lemma is stated over ZnN . HReg (f ) concerns the cyclic group ZN , and we do not know an unconditional translation between two-point solvers over ZN and over ZnN (Theorem 10.5); this is why HEDCP is stated separately. (Regev’s own embedding of Zn into ZN , recalled in Section 4.2, works for differences with small coordinates, which is the situation of the two-point problem but not of an arbitrary secret s ∈ ZnN .) Lemma 4.6. Let f0 , f1 : ZN → S be injective, efficiently computable in superposition, with f1 (x) = f0 (x + s). Then poly(log N ) registers of DCP∞ N with secret −s can be prepared with O(1) evaluations each. In particular, under HHS the shift s can be recovered in quantum polynomial time from oracle access to f0 , f1 . 1 Proof. Prepare √2N

x∈ZN |b⟩|x⟩|fb (x)⟩ and measure the last register, obtaining some z ∈ S. By injectivity there are exactly two preimages: x0 = f0−1 (z) with b = 0, and x1 = f1−1 (z) = x0 − s with b = 1. The post-measurement state is √12 (|0, x0 ⟩ + |1, x0 − s⟩), a dihedral coset state with uniformly random x0 and secret −s, and no bad registers. √ Remark 4.7. Kuperberg’s algorithm uses 2O( log N ) registers and time [143]. Regev’s reduction

P

b∈{0,1}

P

produces instances with N = 2Θ(n ) (Section 4.2) and needs an algorithm that tolerates bad registers, while the reductions of [61, 225] provide only polynomially many samples. These resource and modulus requirements prevent these direct compositions from establishing the claimed improvements for the LWE instances considered here. In particular, the quasi-polynomial EDCP algorithm of [27] requires quasi-polynomially many samples and power-of-two moduli; no matching preparation from ML-KEM is supplied by this comparison. A mismatch with its original modulus q = 3329 alone would not rule out every possible reduction. The cyclotomic sieve of [58] runs in time 2Op (log n log q) , quasi-polynomial for polynomial q, but the available reductions again generate only limited approximate states. For hidden-shift instances with perfect states and no sample bottleneck, such as CSIDH, Kuperberg-type algorithms do apply, at subexponential cost [82, 55, 188]. 2

4.2

Regev’s reduction from unique-SVP to DCP

Because HReg (f ) is defined by what Regev’s reduction needs, we summarise how that reduction works, following [199]. It has two stages. 36

From unique-SVP to the two-point problem. The intermediate problem is a vector version of DCP. The input to the two-point problem with failure parameter f consists of poly(n log M ) registers; each is, with probability at least 1 − 1/(n log(2M ))f , in a state √12 (|0, a⟩ + |1, a′ ⟩) with a, a′ ∈ {0, . . . , M − 1}n and a fixed difference a′ − a, and otherwise in an arbitrary state; the goal is to output the difference. Given a lattice with a unique shortest vector u, the reduction creates a superposition over many lattice points and then collapses it, by a measurement, onto just two points whose difference is u. The collapse uses a random partition of space into translated cubes whose side length is proportional to ∥u∥. Because u is unique up to sign and every lattice vector not parallel to it is much longer, a cube can contain at most a pair of points differing by u; measuring the cube index leaves the superposition of those two points. Registers become bad when the cube boundary separates the pair, which happens with small but non-zero probability, and this is the origin of the failure parameter. Coordinates are written in an LLL-reduced basis, which keeps them in a range of size M . From the two-point problem to DCP. The vector difference is encoded into a single integer by the map (a1 , . . . , an ) 7−→ a1 + a2 · 2M + · · · + an (2M )n−1 , which embeds {0, . . . , M − 1}n into ZN with N = (2M )n ; the spacing 2M prevents carries from mixing coordinates, so the cyclic difference determines the vector difference [199, Lem. 3.2]. With M = 24n , chosen to accommodate the size of the LLL coefficients, the modulus is N = 2n(4n+1) , so log N = Θ(n2 ). Parameters. Balancing the probability that a pair is split against the required failure rate gives the approximation factor. With cubes the reduction handles Θ(n1+2f )-unique-SVP; replacing cubes by balls improves this to Θ(n1/2+2f ) [199]. Combined with the subset-sum connection of [199, Thm. 1.3], which yields DCP with failure parameter f = 1, this gives a quantum worst-case to average-case reduction for Θ(n2.5 )-unique-SVP [199, Cor. 1.5]. Two features of the reduction drive the rest of this section: the oracle must tolerate bad registers, and the reduction makes no use of algebraic structure, so it also applies to ideal and module lattices that meet the ordinary uniqueness promise.

4.3

Technical lemmas

We use the following facts, stated with the parameters needed below. Throughout, q is prime. Fix f > 0 and a witnessing algorithm A. Write Γf,A (d) for a sufficient finite-dimensional ordinaryuSVP promise bound for the reduction of [199, Thm. 1.1]; asymptotically it is O(d1/2+2f ). In theorem statements below, γu (d) denotes such a valid bound, enlarged if necessary to be at least one. For numerical comparisons only, we use the model c0 d1/2+2f . Its constant, the starting dimension and the running-time polynomial may depend on f and A; no uniform limit as f → 0+ is asserted. Lemma 4.8 (Random q-ary lattices [112, Lem. 5.3]). Let m ≥ 2n lg q. For all but a q −n fraction of A ∈ Zm×n , λ1 (Λq (A)) ≥ λ∞ of A ∈ Zn×m and q q 1 (Λq (A)) ≥ q/4. For all but a negligible fraction √ √ ⊥ any function ω( log m), the smoothing parameter satisfies ηϵ (Λq (A)) ≤ ω( log m) for some negligible ϵ. √ Lemma 4.9. Let m ≥ n satisfy q (m−n)/m ≥ 2 2πe, and let A ∈ Zm×n be uniform. Then q √ √ (m−n)/m m λ1 (Λq (A)) ≥ min{q, m q /(2 2πe)} √ except with probability (3/4) , and except with probability 2−m+1 if moreover q (m−n)/m ≥ 2πe m. Proof. Let R be the minimum in the statement. A nonzero y ∈ Zm with ∥y∥ < R ≤ q is not in qZm , so it lies in Λq (A) only if As ≡ y for some s = ̸ 0, which for each fixed s has probability 37

q −m ; hence Pr[λ1 < R] ≤ q n−m Nm (R), where Nm (R) counts the integer points of norm less √ than R. Unit cubes centred at those points lie in the ball of radius R + m/2, whose volume is √ p
m √ √ √ at most (R + m/2) 2πe/m / πm. With R ≤ m q (m−n)/m /(2 2πe) this gives Pr[λ1 < √ √
m √ R] ≤ 21 + 2πe/(2q (m−n)/m ) / πm, which is at most (3/4)m when q (m−n)/m ≥ 2 2πe, and √
m √ √ at most 21 (1 + 1/m) / πm ≤ e 2−m / πm ≤ 2−m+1 when q (m−n)/m ≥ 2πe m. This is Lemma 6 of [61] with an explicit range of validity; as stated there, for all m ≥ n, the lemma fails at m = n, where Λq (A) = Zn for invertible A. The first statement of Theorem 4.8 says that a random q-ary lattice has no unusually short vectors once there are enough rows: a vector As mod q with all coordinates below q/4 is unlikely to exist for s = ̸ 0 when m is ⊥ large compared with n log q. The second says that Λq (A) is “smooth” at a width barely above constant, a property used in the distributional analysis of Gaussian preimage sampling [112]. The smoothing bound alone does not supply a trapdoor or an efficient sampler. Lemma 4.10 (Gaussian facts [28, 166, 201]). Let Λ ⊂ Rm be a full-rank lattice. √ (a) For every s > 0, a sample of DΛ,s has norm greater than s m with probability less than 2−m [28, Lem. 1.5]; the same holds for a continuous Gaussian vector of parameter s in Rm . √ (b) If s ≥ 2 ηϵ (Λ) with ϵ ≤ 1/10, a sample of DΛ,s lies outside any fixed hyperplane with probability at least 1/10 [201, Lem. 3.15]. p √ ∗ (c) η2−m (Λ) ≤ m/λ p1 (Λ ), and ηϵ (Z) ≤ ln(2 + 2/ϵ)/π [166, Lems. 3.2 and 3.3]; in particular η2−m (Z) ≤ m/2 for m ≥ 2. √ (d) λm (Λ) ≤ 2m ηϵ (Λ) for every ϵ ≤ 1/10. √ √ Proof of (d). Sample from DΛ,s with s = 2 ηϵ (Λ). By (a) each sample has norm at most s m except with probability 2−m , and by (b) it lies in any fixed hyperplane with probability at most √ 9/10; hence O(m) samples contain m linearly independent vectors of norm at most s m with √ positive probability, so λm (Λ) ≤ s m. Lemma 4.11 (BDD, uSVP and GapSVP [154]). For every γ ≥ 1: BDD1/(2γ) reduces to uSVPγ ; p and GapSVPγ ′ with γ ′ = O(γ d/ log d) reduces to uSVPγ (via BDD). All reductions are classical, polynomial-time, and dimension-preserving up to one. The first reduction is Kannan’s embedding: a BDD target t close to a lattice point v becomes the unusually short vector (t − v, µ) of the lattice generated by the basis and (t, µ) for a suitable µ, whose gap is about 1/δ. The second is a randomised self-reduction in the style of Goldreich and Goldwasser: perturb a lattice point by a random short vector and ask the BDD oracle to undo the perturbation, which succeeds reliably only when the lattice has no short vectors [116, 154]. Decoding can also be obtained from short dual vectors, with a larger loss. Lemma 4.12. For every γ ≥ 1, BDD1/(2nγ) on n-dimensional lattices reduces in classical polynomial time to SIVPγ on their duals. Proof. Let t satisfy dist(t, L) ≤ λ1 (L)/(2nγ). The SIVPγ oracle applied to L∗ returns linearly independent s1 , . . . , sn ∈ L∗ of length at most γλn (L∗ ), which can be converted into a basis T of L∗ whose Gram–Schmidt vectors satisfy ∥t̃i ∥ ≤ ∥s̃i ∥ ≤ γλn (L∗ ) [162, Lem. 7.1]. The dual basis B = T −⊤ of L, taken in reverse order, has Gram–Schmidt norms 1/∥t̃n ∥, . . . , 1/∥t̃1 ∥, so Babai’s nearest-plane algorithm with this basis returns the closest lattice point to every target within distance 12 mini ∥b̃i ∥ ≥ 1/(2γλn (L∗ )) [23]. By Banaszczyk’s transference theorem λ1 (L)λn (L∗ ) ≤ n [28], this radius is at least λ1 (L)/(2nγ).

38

Lemma 4.13 (Regev’s worst-case reduction [201, Thm. 3.1]). Let α ∈ (0, 1) and q satisfy √ αq > 2 n. An efficient algorithm that solves search-LWEn,q,α′ for every α′ ≤ α, from polynomially many samples, yields an efficient quantum algorithm for SIVPγ and GapSVPγ on all e n-dimensional lattices, with γ = O(n/α). The structure of the proof, an iteration that alternates a classical BDD step using the LWE oracle with a quantum step that narrows a discrete Gaussian, is described in Section 2.4. For our purposes the lemma is a black box with one important property: the reduction chooses the LWE parameters (n, q, α, m) itself, so it may request the polynomially many samples allowed by its LWE-oracle interface. This is different from a fixed public-key sample budget. Regev states the theorem for errors drawn from a rounded continuous Gaussian: inside the reduction the oracle is called on samples whose continuous Gaussian error is rounded to the nearest integer. Replacing that deterministic rounding by the randomised rounding of √ Theorem 4.16 below produces discrete Gaussian errors at the cost of an additive term ω( log n), in quadrature, √ in their parameter, which is negligible against αq > 2 n; the lemma therefore also applies to algorithms for errors DZ,α′ q , the convention of [61]. This observation is standard [186]. The quantum step of that iteration is useful on its own, because it converts a dual-lattice decoder satisfying the stated radius, success and coherent-implementation requirements into a Gaussian sampler for the primal lattice. Lemma 4.14 (Regev’s quantum step [201, Lem. 3.14]). There is an efficient quantum algorithm that, given an n-dimensional lattice L, a number d < λ1 (L∗ )/2 and an oracle that solves CVPL∗ ,d , that is, finds the closest point of L∗ to any target within distance d of L∗ , outputs a sample from DL,√n/(√2 d) , up to statistical distance 2−Ω(n) . The algorithm has four steps [201]: (1) prepare the Gaussian superposition y ρd/√n (y)|y⟩ over a fine grid, truncated to ∥y∥ < d; (2) compute t = y mod P(L∗ ), the reduction modulo a fundamental parallelepiped of L∗ , in a second register; (3) use the oracle once, on the second register, to find the lattice point closest to t, hence y, and erase the first register, possible because d < λ1 (L∗ )/2 makes y a function of t; (4) apply the quantum Fourier transform to the remaining register, which maps a periodic Gaussian state on L∗ to a Gaussian superposition on L of reciprocal width, and measure. In Regev’s reduction the decoder is built from the LWE oracle and from wider Gaussian samples; under HReg (f ) a worst-case decoder is available directly (Theorem 4.11), which is what makes Theorems 4.19 and 4.20 below sharper than a detour through LWE. Two technicalities arise when the lemma is used with the decoders available to us: they are randomised and may fail, and in one application they succeed only on average over the target. The next lemma handles both. P

Lemma 4.15. Let L ⊂ Rn be a full-rank lattice, 0 < d < λ1 (L∗ )/2, and let D be a quantum n ∗ algorithm that, √ on input t ∈ R , outputs a point of L . Let y be∗ a continuous Gaussian vector of parameter d/ 2n conditioned on ∥y∥ < d, let t := y mod P(L ), and let p̄ := Pr D(t) = t − y , 



the probability being over y and the internal randomness of D; note that t − y is the point of L∗ closest to t. Run the algorithm of Theorem 4.14 with step (3) implemented by running D √ √ reversibly, using its output to erase the first register, and uncomputing D, and let w := n/( 2 d). Then: (a) the output distribution is within statistical distance

p

2(1 − p̄) + 2−Ω(n) of DL,w ;

−Ω(n) ≤ p̄ 2 , the output lies in G with (b) for every set G of outputs √ with2 δG := 1 − DL,w (G) + 2 probability at least (p̄ − δG ) .

39

In particular, if D errs with probability ε on every target within distance d of L∗ , the √ at most output is within statistical distance 2ε + 2−Ω(n) of DL,w . Proof. After step (2) the state is y cy |y⟩|t(y)⟩, where |cy |2 ∝ ρd/√n (y)2 = ρd/√2n (y) on the ball ∥y∥ < d, which is the distribution of y in the statement; since d < λ1 (L∗ )/2, the map y 7→ t(y) is injective on the ball. Let A be a unitary implementation of D that leaves its input register P unchanged, A|t⟩|0⟩ = |t⟩ x |x⟩|γt,x ⟩, where ∥γt,x ∥2 is the probability that D outputs x on input t, and let S be the permutation |y⟩|t⟩|x⟩ 7→ |y − t + x⟩|t⟩|x⟩. Step (3) applies A† SA (Bennett’s compute–use–uncompute [36]); with an exact oracle it maps |y⟩|t(y)⟩|0⟩ to |0⟩|t(y)⟩|0⟩. For each y, writing t = t(y), P

⟨0|⟨t|⟨0| A† SA |y⟩|t⟩|0⟩ =

X

⟨0|y − t + x⟩ ⟨x′ |x⟩ ⟨γt,x′ |γt,x ⟩ = ∥γt,t−y ∥2 = Pr[D(t) = t − y],

x,x′

and terms with distinct y are orthogonal because the second register is never changed. Hence the P actual state |Ψ⟩ and the ideal state |Ψ0 ⟩ after step (3) satisfy ⟨Ψ0 |Ψ⟩ = y |cy |2 Pr[D(t(y)) = t(y) − y] = p̄, and the same holds after the unitary step (4). For (a): the outcomes of one measurement on two at most their trace distance p p pure states are within statistical distance −Ω(n) 2 1 − |⟨Ψ0 |Ψ⟩| ≤ 2(1 − p̄), and the ideal outcome is 2 -close to DL,w by Theorem 4.14. For (b): let PG project onto the outcomes in G; then ∥PG Ψ∥ ≥ |⟨Ψ0 |PG |Ψ⟩| ≥ |⟨Ψ0 |Ψ⟩| − |⟨Ψ0 |(1 − PG )|Ψ⟩| ≥ p̄ − ∥(1 − PG )Ψ0 ∥ ≥ p̄ −

p

δG ,

since ∥(1 − PG )Ψ0 ∥2 is the probability that the ideal procedure outputs a point outside G. The last claim is (a) with p̄ ≥ 1 − ε, because every t(y) lies within distance ∥y∥ < d of L∗ . Lemma 4.16 (Randomised rounding). Let ε ∈ (0, 1/2], r ≥ ηε (Z) and sc > 0. Let e be a continuous Gaussian variable of parameter sc and, given e, let y ← DZ,r,e be a discrete Gaussian sample over Z centred at e. Then y is within statistical distance 2ε of DZ,√s2 +r2 . Consequently, c for a ∈ Z, rounding a + e randomly in this way yields a + y. Proof. For r ≥ ηε (Z) p and every c ∈ R, Poisson summationR gives ρr (Z + c) ∈ [1 − ε, 1 + ε] · r [166]. Hence, with s := s2c + r2 and the convolution identity R ρsc (e)ρr (y − e) de = (sc r/s) ρs (y), Pr[y] =

h 1 ρsc (e) ρr (y − e) 1 i ρs (y) · de ∈ , · . sc ρr (Z − e) 1+ε 1−ε s R

Z

Since s ≥ r ≥ ηε (Z), also ρs (Z) ∈ [1 − ε, 1 + ε] · s, so the ratio of Pr[y] to DZ,s (y) = ρs (y)/ρs (Z) lies in [(1 − ε)/(1 + ε), (1 + ε)/(1 − ε)], and the statistical distance is at most ε/(1 − ε) ≤ 2ε. The last statement holds because DZ,r,a+e = a + DZ,r,e for a ∈ Z. This is the one-dimensional, continuous case of the convolution theorem of [186].

4.4

The reach theorem

The thresholds that govern the consequences are q

e 1+2f ), γg (d) := O γu (d) d/ log d = O(d

1 αReg (m) := √ , 8 m γu (m + 1)


1 √ ⋆ γReg (n) := 1 + 2 n γu (n + 1) = O n3/2+2f , n √
βReg (m) := 4 2 m γu (m + 1) = O m3/2+2f , gE (d) := 2d γE⋆ (d, ℓ), 1 ∗ √ (m ∈ Mq (n)), αE (n, ℓ) := αE (n, mmax , ℓ), αE (n, m, ℓ) := c r0 κ ℓ m q n/m √ n o √ m βE (n, m, ℓ) := max √ ∗ , 4 2m , 2 αE (n, ℓ)

40

√ where c = 6 2πe is the constant of [61, Thm. 3] and r0 the constant of HEDCP [ℓ]. The set Mq (n) contains the numbers of samples for which the proof of [61, Thm. 3] applies: (B1) m = Ω(κ); √ (B2) q (m−n)/m ≥ 2 2πe, so that the lower bound on λ1 (Λq (A)) of [61, Lem. 6] holds except with probability (3/4)m (Theorem 4.9); √ √ (B3) m q (m−n)/m /(3 2πe) ≤ q, the radius condition of [61, App. B.1], which keeps the balls of the reduction below the minimum of Λq (A), itself at most q; and mmax = m q) := max Mq (n). Condition (B2) is a mild lower bound on m, m ≥ √max (n,
n ln q/ ln q/(2 2πe) . Condition (B3) is an upper bound on m: in the regime m = Θ(n log q) √ it fails, since m q −n/m grows with n, so the width bound of [61, Thm. 3] cannot be used there. For ML-KEM’s modulus q = 3329 and n = 768, for instance, Mq (n) consists of roughly 1.35n ≤ m ≤ 5n. The parameter κ is the statistical parameter of [61]: Brakerski, Kirshanova, Stehlé and Wen treat n, q and m as functions of κ and use it to truncate Gaussian amplitudes to √ |j| ≤ κ r and to bound failure probabilities by 2−Ω(κ) . We fix κ := ⌈log2 n⌉, which makes those probabilities negligible; soft-O notation hides powers of log n and log q, including κ. Finally, ∗ (n, ℓ)/2 e γE⋆ (n, ℓ) denotes the approximation factor O(n/α) that Theorem 4.13 yields at α = αE (Theorem 4.24), and gE (d) is the gap above which the worst-case route of HEDCP [ℓ] decodes d-dimensional lattices. For n ≤ q ≤ poly(n) (Theorem 4.23), Mq (n) ̸= ∅ and mmax = Θ(n), so ∗ = 1/O(ℓn), 2 ), g (d) = O(ℓd 3 ) and, for m = Θ(n log q), β = O(ℓn 3/2 ). e e e e that αE γE⋆ = O(ℓn E E Theorem 4.17. Let f > 0 and let ℓ be as in HEDCP [ℓ]. (i) Under HReg (f ), uSVPγ is in BQP for every γ ≥ γu (d), in the worst case over all ddimensional lattices, including ideal and module lattices. (ii) Under HReg (f ), BDDδ is in BQP for δ ≤ 1/(2γu (d + 1)), and GapSVPγg (d) is in BQP, in the worst case. (iii) Under HReg (f ), search-LWEn,q,α,m with m ≥ 2n lg q and α ≤ αReg (m) is in BQP for all but e 1+2f ). More generally, a q −n fraction of A; for m = Θ(n log q) this covers every α ≤ 1/O(n every LWE-type instance (unstructured, ring, module, middle-product or rounding) whose embedding lattice is a γu -unique-SVP instance, with the planted vector as its shortest vector, is solved. Decision-LWE is then solved directly. ⋆ (n) is in BQP in the worst case (Theorem 4.19). (iv) Under HReg (f ), SIVPγReg

(v) Under HReg (f ), SISn,m,q,β with m ≥ 2n lg q is in BQP whenever β ≥ βReg (m), for all but a e √n) ≥ γ ⋆ (n), that is for β ≥ O(n e 1+2f ), the q −n fraction of A (Theorem 4.20). For β · O( Reg cited worst-case hardness premise of [166, 165] becomes unavailable, under the reduction’s parameter conditions. (vi) Under HEDCP [ℓ], let q ≤ poly(n). Search-LWEn,q,α,m with m ∈ Mq (n) is solved with ∗ (n, ℓ) = probability 1/poly(n) whenever α < αE (n, m, ℓ), with largest certified bound α < αE e 1/O(ℓn) (Theorem 4.21); SIVPγE⋆ and GapSVPγ ⋆ are in BQP, and so is BDD on dE dimensional lattices with gap at least gE (d), in the worst case√(Theorem 4.24); and, if Mq (n) ̸= ∅, SISn,m,q,β with uniform A, m ≥ 2n lg q and q > 2 βE (n, m, ℓ) is solved with probability 1/poly(n) for every β > βE (n, m, ℓ) (Theorem 4.25). Since ℓ = Ω(n log q) for every algorithm at width r0 (Theorem 4.22), the restricted ball composition certifies noise scales at most α ≈ n−2 and yields factors γ ≈ n3 and bounds β ≈ n5/2 , up to polylogarithmic factors (Theorem 4.23).

41

(vii) Under HHS , the vectorization problem for every free and transitive action ⋆ of a cyclic group ⟨g⟩ ∼ = ZN on a set X is solved, provided N and g are known and x 7→ gx ⋆ E is computable in quantum polynomial time for arbitrary x ∈ ZN . All required evaluation inputs must be public or efficiently recoverable, and the evaluation must use consistent encodings and polynomial total cost. Under Hab HS the same holds for free and transitive abelian group actions satisfying these conditions. Proof. (i) is [199, Thm. 1.1] applied to the algorithm postulated by HReg (f ): the reduction of Section 4.2 generates DCPN registers that are bad with probability at most 1/(log N )f , which is the tolerance assumed, and it makes no use of algebraic structure in the input lattice. Keeping the shortest of the candidates returned by repeated runs amplifies the success probability. (ii): compose (i) with Theorem 4.11; the embedding used for BDD raises the dimension by one. (iii): let b = As + e with e ← DZm ,αq . By Theorem 4.8, λ1 (Λq (A)) ≥ q/4 for all but √ −n a q fraction of A, and by Theorem 4.10(a), dist(b, Λq (A)) ≤ ∥e∥ ≤ αq m except with √ probability 2−m . If α ≤ αReg (m), then αq m ≤ (q/4)/(2γu (m + 1)) ≤ λ1 (Λq (A))/(2γu (m + 1)), so b is a BDD1/(2γu (m+1)) instance, solved by (ii). A candidate lattice point v is accepted if √ √ ∥b − v∥ ≤ αq m; since 2αq m < q/4, only the closest point passes, which allows amplification. The closest point is As mod q, from which s follows by linear algebra, since A has full column rank except with probability at most q n−m . For m = Θ(n log q) and sufficiently large dimension, e 1+2f ), with constants the bound γu (m + 1) = O(m1/2+2f ) gives the sufficient noise scale 1/O(n depending on the fixed reduction and witness. For decision-LWE, a uniform b lies within distance √ αq m of Λq (A) only with negligible probability, by a counting argument, so no candidate passes. The general statement is (i) applied to the Kannan embedding of the instance; it requires a bound on the gap, which for structured instances must be verified separately since Theorem 4.8 concerns uniform A. (iv), (v) and (vi) are proved in Section 4.5: (iv) is Theorem 4.19; the first claim of (v) is Theorem 4.20, and the second holds because [166, 165] base SISβ on SIVPβ·O( e √n) ; (vi) combines Theorems 4.21 to 4.25. (vii): the functions f0 (x) = gx ⋆ E and f1 (x) = gx ⋆ E ′ with E ′ = ga ⋆ E are injective (freeness) and satisfy f1 (x) = f0 (x + a); apply Theorem 4.6. For Hab HS , decompose the group into cyclic factors and apply the generalised hypothesis to the resulting abelian hidden shift. Corollary 4.18. Under HHS , there is a constant fA > 0 such that all conclusions of Theorem 4.17 under HReg (fA ) hold, with their stated sample, distribution and promise conditions. In particular, unique-SVP, GapSVP and SIVP admit quantum polynomial-time algorithms at some polynomial approximation factors. The SIS and LWE conclusions hold at the corresponding solver-dependent bounds. Proof. Apply Theorem 4.4, then the fixed-parameter statements of Theorem 4.17.

4.5

Proofs of the compositions

We give explicit derivations of items (iv)–(vi) of Theorem 4.17 from the results recalled in Section 4.3. The reduction mechanisms have antecedents: in particular, [154, Sec. 1.2] already records the quantum reduction SIVPO(nγ) ≤Q BDD1/γ , and the average-case decoder route to SIS follows [216]. The propositions below specify the resulting bounds under our solver hypotheses, with the dimension shifts, matrix promises, Gaussian conventions, preparation precision and success probabilities needed for composition. Theorem 4.15 supplies the coherent implementation and error analysis for the decoders used here. The information-theoretic bound of Theorem 4.22 is due to an anonymous reviewer.

42

Proposition 4.19 (SIVP under HReg (f )). Assume HReg (f ). There is a quantum polynomial-time algorithm that, given a basis of a full-rank lattice L ⊂ Rn , outputs n linearly independent vectors ⋆ (n) λ (L), except with probability 2−Ω(n) . of L of length at most γReg n Proof. A reliable decoder. By Theorem 4.17(ii) there is a quantum algorithm B that solves BDD1/(2γu (n+1)) on n-dimensional lattices with success probability at least 1/p(n), for a polynomial p. For d > 0, let Bd run B on its target t (for the lattice L∗ ) n p(n) times and return the first candidate x ∈ L∗ with ∥t − x∥ ≤ d, or 0 if there is none. If d ≤ λ1 (L∗ )/(2γu (n + 1)) and dist(t, L∗ ) ≤ d, each run returns the closest point with probability at least 1/p(n), and, since d < λ1 (L∗ )/2, the closest point is the only point of L∗ within distance d; so Bd errs with probability at most (1 − 1/p(n))np(n) ≤ e−n . Sampling. For such d, √ Theorem 4.15 with D = Bd yields samples within statistical distance √ −Ω(n) 2 of DL,w , w = n/( 2 d). Guessing d. The LLL algorithm [151] applied to L∗ returns v ∈ L∗ \ {0} with λ1 (L∗ ) ≤ ∥v∥ ≤ 2(n−1)/2 λ1 (L∗ ). For i = 0, 1, . . . , n2 let di := ∥v∥(1 + 1/n)−i /(2γu (n + 1)). Since d0 ≥ λ1 (L∗ )/(2γu (n + 1)) > dn2 and consecutive values differ by the factor 1 + 1/n, some index i∗ satisfies λ1 (L∗ ) λ1 (L∗ ) < di∗ ≤ . (1 + 1/n) 2γu (n + 1) 2γu (n + 1) For each i, draw 40n samples with d = di , discard those that are zero or not in L (membership is a linear-algebra test), and pool the rest. Output n linearly independent vectors of the pool, chosen greedily by increasing length; by the exchange property of linear independence, their maximum length is the smallest possible among linearly independent n-subsets of the pool. √ √ Analysis at i∗ . Let w∗ := n/( 2 di∗ ). A nonzero dual vector has a nonzero integer inner product with one of n linearly independent lattice vectors of length at most λn (L), so λ1 (L∗ )λn (L) ≥ 1 and √ (1 + 1/n) 2 n γu (n + 1) ∗√ ⋆ w n < ≤ γReg (n) λn (L). λ1 (L∗ ) √ √ On the other hand w∗ ≥ 2n γu (n + 1)/λ1 (L∗ ) ≥ 2 η2−n (L) by Theorem 4.10(c). By Theo√ rem 4.10(a,b), a sample of DL,w∗ has length at most w∗ n except with probability 2−n , and lies outside any fixed hyperplane with probability at least 1/10. While the samples drawn so far span a proper subspace, each new sample leaves it with probability at least 1/10 − 2−Ω(n) ≥ 1/20; by a Chernoff bound, 40n samples contain n linearly independent ones except with probability √ 2−Ω(n) , and all of them have length at most w∗ n except with probability 40n 2−n . The greedy ⋆ (n)λ (L). choice then has maximum length at most γReg n Proposition 4.20 (SIS under HReg (f )). Assume HReg (f ), let q be prime and m ≥ 2n lg q. ⊤ There is a quantum polynomial-time algorithm that, given A ∈ Zn×m with λ∞ q 1 (Λq (A )) ≥ q/4, −n which holds for all but a q fraction of A (Theorem 4.8), outputs a nonzero z ∈ Λ⊥ q (A) with −Ω(m) ∥z∥ ≤ βReg (m), except with probability 2 . ∗ −1 ⊤ ∗ ∞ ∗ Proof. Let L := Λ⊥ q (A), of rank m; its dual is L = q Λq (A ), so λ1 (L ) ≥ λ1 (L ) ≥ 1/4. ∗ ∗ Set d := 1/(8γu (m + 1)), so that d ≤ λ1 (L )/(2γu (m + 1)) and d < λ1 (L )/2. With the decoder Bd of the previous proof, now for the m-dimensional lattice L∗ , Theorem 4.15 yields √ √ √ −Ω(m) samples within statistical distance 2 of DL,w with w = m/( 2 d) = 4 2m γu (m + 1). By √ Theorem 4.10(a), a sample has length at most w m = βReg (m) except with probability 2−m . It is zero with probability 1/ρw (L), and by the Poisson summation formula

ρw (L) = det(L∗ ) wm ρ1/w (L∗ ) ≥

43

wm wm ≥ n, det(L) q

because every term of ρ1/w (L∗ ) is positive and the term at 0 equals 1, and det(L) = [Zm : L] ≤ q n . Since w ≥ 4 and q n ≤ 2m/2 , a sample is zero with probability at most 2−3m/2 . Output the first sample that is nonzero and has length at most βReg (m). Proposition 4.21 (LWE under HEDCP [ℓ]). Assume HEDCP [ℓ], let q ≤ poly(n) be prime and m ∈ Mq (n). If α < αE (n, m, ℓ), there is a quantum polynomial-time algorithm that, given m samples of LWEn,q,α with a uniform matrix, any secret and errors DZ,αq , recovers the secret with probability at least 1/poly(n). Let pA (n) be an inverse-polynomial lower bound on the EDCP solver’s success at the parameters used. √ Given m′ ≥ 2n lg q independent further samples with the same secret, and α < 1/(8 m′ ), the recovery procedure can be repeated and checked against these further samples. For all but a ′

δmat = q −n + q n−m + (3/4)m fraction of pairs of matrices, T independent repetitions recover the secret with probability at least ′

1 − 2−m − 2−m − exp −T pA (n)/8 .

The probability here is over the two error vectors and the internal randomness, with the matrices fixed. Over all matrices as well, subtract δmat from the displayed lower bound. √ Proof. Since α < αE , fix r ∈ [r0 , r∗ ) with r∗ = 1/(c m κℓαq n/m ) > r0 . Conditions (B1)–(B3) supply the dimension, first-minimum and radius premises used in the ball construction of [61, Thm. 3 and App. B.1]. The good preparation matrix event also requires full column rank. The √ unrounded√bound in Theorem 4.9 is (3/4)m / πm; rank failure costs at most q n−m . By (B2), √ q n−m ≤ [2 2πe]−m , and their sum is at most (3/4)m . The error-norm condition ∥e∥ ≤ m αq fails with probability at most 2−m . For such fixed good samples, the ideal reduction prepares ℓ states with the input secret, and all are valid with probability at least (1 − 1/ℓ)ℓ ≥ 1/4 for ℓ ≥ 2. The asymptotic lower bound in Theorem 4.22 permits this restriction; bounded exceptional dimensions can be handled separately. Preparation precision. Fix the input samples satisfying the matrix and error-norm conditions. In the ideal preparation, the branch on which all ℓ states are valid has probability at least 1/4. Hence the ideal composed procedure recovers the secret with probability at least pA (n)/4. Choose the ball-state preparation error per use at most pA (n)/(16ℓ), and the total Gaussiantruncation and circuit-implementation error at most pA (n)/16. The hybrid bound and contractivity under the complete measurement instrument give distance at most pA (n)/8 between the actual and ideal complete procedures. The actual recovery probability is therefore at least pA (n)/8. This comparison includes the measurement outcomes and bad branches; it does not condition on a rare postselection event. The arbitrary inverse-polynomial accuracy in the ball-preparation lemma permits the required choice. Since ℓ and p−1 A are polynomially bounded, a sufficiently large fixed precision exponent suffices. With κ = ⌈log2 n⌉, the Gaussian truncation error is eventually smaller than the allotted inverse-polynomial budget. If a preparation circuit uses K approximate ball-state primitives in total, allocate pA /(16K) to each; here K is polynomially bounded. This is the same hybrid budget. The available arbitrary fixed inverse-polynomial accuracy [61, App. B.1, Lem. 14] suffices; no uniform polynomial dependence on log(1/ε) for arbitrarily small ε is assumed. For every fixed inverse-polynomial precision target, the reduction runs in time polynomial in the total input length and in n, m, log q, ℓ, κ. The polynomial degree may depend on the fixed precision exponent and on the postulated solver. Our choice κ = ⌈log2 n⌉ controls statistical truncation errors; it is not a bound on the length of the input.

44

Verification and amplification. Reserve independent samples (A′ , b′ ) and accept a candidate √ ′ ŝ when the centred residual b′ − A′ ŝ mod q has norm at most m′ αq. Exclude the q −n + q n−m fraction for which the bound λ1 (Λq (A′ )) ≥ q/4 or full column rank fails. For the remaining matrices and bounded √ errors, a√wrong secret differs by a nonzero lattice vector and has residual norm at least q/4 − m′ αq > m′ αq. Only the correct secret passes. The error vectors are sampled once. The probability that either exceeds its stated norm ′ bound is at most 2−m + 2−m . Condition on both bounds and on the good matrices. The residual test rejects every incorrect candidate and accepts the secret. Each repetition uses fresh internal randomness and has conditional success at least pA (n)/8. Thus the probability that all T repetitions fail is at most (1 − pA (n)/8)T , bounded by the displayed exponential. Finally remove the conditioning by the union bound. Taking T = ⌈8(n + 2) ln 2/pA (n)⌉ bounds internal failure by 2−n−2 . Together with the fixederror tails this gives 1 − 2−Ω(n) success on good matrices. Removing the matrix conditioning subtracts δmat as stated. The factor ℓ in αE is easy to overlook, because it is absent from the qualitative statement “LWE and EDCP are equivalent”. It cannot be absorbed into a constant: the next proposition gives a lower bound of order n log N at fixed width and inverse-polynomial success probability. Proposition 4.22. Let n, N, ℓ ≥ 1 and r > 0. Any algorithm, of any running time, that receives ℓ states of G-EDCPn,N,r with a uniformly random secret s ∈ ZnN and independent uniformly random offsets outputs s with probability at most (1 + r)2ℓ . Nn Consequently, success probability p requires ℓ ≥ (n log N − log(1/p))/(2 log(1 + r)). In particular, an algorithm as in HEDCP [ℓ], run at width r0 with success probability p ≥ 1/poly(n), requires ℓ ≥ (1 − o(1)) n log N/(2 log(1 + r0 )) = Ω(n log N ). Proof. A G-EDCP state is |ψx,s ⟩ = 2 j aj = 1. Let S :=

P

j∈Z aj |j⟩|x + js⟩ with aj

P

q

= ρr (j)/ ρr/√2 (Z) > 0 and

q

√ j aj = ρr (Z)/ ρr/ 2 (Z). Since ρr is decreasing on [0, ∞), ρr (Z) ≤

P

1 + 2 0∞ ρr = 1 + r, and ρr/√2 (Z) ≥ 1, so S ≤ 1 + r. For vectors vj and positive weights P P P wj , the Cauchy–Schwarz inequality | j ⟨u, vj ⟩|2 ≤ ( j wj ) j |⟨u, vj ⟩|2 /wj gives the operator P P P P inequality ( j vj )( j vj )† ≤ ( j wj ) j wj−1 vj vj† . With vj = aj |j⟩|x + js⟩ and wj = aj it yields P |ψx,s ⟩⟨ψx,s | ≤ S j aj |j⟩⟨j| ⊗ |x + js⟩⟨x + js|. Averaging over the uniform offset x, and using P x |x + js⟩⟨x + js| = I for every j and s, the state σs of one register satisfies R

σs ≤ S 2 τ,

τ :=

X a

j

j

S



|j⟩⟨j| ⊗ N −n I,

where τ is a density operator that does not depend on s. Hence σs⊗ℓ ≤ S 2ℓ τ ⊗ℓ , and P for every measurement {Ms } the probability of a correct guess is N −n s Tr(Ms σs⊗ℓ ) ≤ P S 2ℓ N −n s Tr(Ms τ ⊗ℓ ) = S 2ℓ N −n . The consequences follow by taking logarithms; an algorithm as in HEDCP [ℓ] succeeds with probability p ≥ 1/poly(n) for every secret and arbitrary offsets, hence for uniform ones, at width r0 in particular. This argument was suggested by an anonymous reviewer; it replaces a truncation argument of an earlier draft and removes a factor log log n. Its form, dominating the averaged state by a secret-independent state, is standard, and we do not claim priority for the bound. Corollary 4.23. Assume HEDCP [ℓ] and let q ≤ poly(n). For every m ≥ n satisfying the radius condition (B3), αE (n, m, ℓ) ≤

1 (1 + o(1)) log(1 + r0 ) 1 ≤ = . e 2 r0 κ ℓ m r0 κ n2 log q Ω(n2 ) 45

If moreover q ≥ n and n is large, then Mq (n) ̸= ∅, mmax ∈ Mq (n), the first bound is attained ∗ (n, ℓ) = (1 + o(1))/(2r κℓm up to a factor 1 + o(1) at m = mmax , so that αE 0 max ) is the largest admissible value, and mmax =

 n log q  (1 + o(1)) 2n ln q √ =Θ , log n ln mmax − 2 ln(3 2πe)

which is Θ(n) for q = nΘ(1) . √ √ n/m ≥ √m/(3 2πe), so √m q n/m ≥ m/(3 2πe) and Proof. Condition √ (B3) is equivalent to q √ αE (n, m, ℓ) ≤ 3 2πe/(c r0 κℓm) = 1/(2r0 κℓm), since c = 6 2πe; the second inequality follows from m ≥ n and Theorem 4.22. The consequences for SIVP and SIS follow because the √ e thresholds of Theorems 4.24 and 4.25 are O(n/α) and m/α. For the second statement: √ the function m 7→ m q −n/m is increasing, so (B3) holds exactly for m up to the largest integer m3 at which it holds; for q ≥ n it holds at m = n, so m3 ≥ n. At m3 the inequality √ √ n/m q ≥ m/(3 2πe) holds with near-equality, by the maximality of m3 , which gives the attainment and, after taking logarithms, the formula for m3 . Condition (B2) holds at m3 , √ √ √ because q (m3 −n)/m3 = q · q −n/m3 ≥ (1 − o(1)) 3 2πe q/ m3 ≥ 2 2πe when q ≥ n, and (B1) √ holds because m3 ≥ n ≥ κ; hence mmax = m3 . Since m 7→ m q n/m is decreasing for m < 2n ln q, which contains mmax for large n, αE is largest at mmax among admissible m. The bound persists if the number of states may depend on the width: the admissible noise rate is governed by the product ℓr, and ℓr ≥ r(n log q − O(log n))/(2 log(1 + r)) is increasing in r, hence smallest at r = r0 . The sufficient noise bound derived for the ball reduction with the admissibility conditions (B1)–(B3) is at most 1/(2r0 κℓm). Together with Theorem 4.22, this makes the largest noise e 2 ). The SIVP and SIS parameters reported scale certified by this calculation at most 1/Ω(n below are the guarantees obtained by composing this calculation. This is not a lower bound on every algorithm available under HEDCP [ℓ]. Condition (B3) constrains the number of samples used in one invocation of this ball construction, not the total number of samples an adversary may possess. Additional samples may be reserved for verification or a suitable subset may be chosen. The cube construction of [61, Thm. 2] has its own parameter conditions and is not excluded by (B3). The separate cube construction has sufficient width bound r < 1/(32mκℓαq n/m ) [61, Thm. 2]; displaying it does not establish its other premises for a concrete instance. Corollary 4.24 (Worst-case consequences of HEDCP [ℓ]). Assume HEDCP [ℓ]. Then SIVPγE⋆ and 2 ), and BDD e GapSVPγ ⋆ are in BQP with γE⋆ = O(ℓn 1/gE (d) is in BQP on d-dimensional lattices, E in the worst case. Proof. Let q be a prime with n2 ≤ q ≤ poly(n), chosen below, m := mmax (n, q) ∈ Mq (n) ∗ (n, ℓ)/2 = 1/O(ℓn). e and α :=√αE By Theorem 4.21, with m′ = ⌈2n lg q⌉ further samples (and α < 1/(8 m′ ), which holds for large n because κ → ∞), LWEn,q,α′ is solved with probability 1 − 2−Ω(n) from m + m′ samples, for every α′ ≤ α and all but a negligible fraction of matrices. √ Choose q > 2 n/α, which is possible with q polynomial. Theorem 4.13, with its remark on discrete Gaussian errors (the factor 2 in α absorbs the 1 + o(1) loss), gives SIVP and GapSVP 2 ). The statement on BDD follows from Theorem 4.12, applied in e e within O(n/α) = O(ℓn dimension d. Proposition 4.25 (SIS under HEDCP [ℓ]). Assume HEDCP [ℓ]. Let q ≤ poly(n) be a prime √ with Mq (n) ̸= ∅, let 2n lg q ≤ m ≤ poly(n), and suppose βE (n, m, ℓ) < q/ 2. For every β > βE (n, m, ℓ) there is a quantum polynomial-time algorithm that solves SISn,m,q,β with probability at least 1/poly(n) over a uniform A ∈ Zn×m and its internal randomness. q 46

√ √ √ Proof. Let β ′ := min{β, q/ 2} > βE (n, m, ℓ) and α := m/( 2 β ′ ). Then α < √ √ ∗ min{αE (n, ℓ), 1/(8 m)} by the definition of βE , and αq ≥ m. Let m0 := mmax (n, q), which is smaller than 2n lg q ≤ m, and let S be the algorithm of Theorem 4.21 for m0 samples of LWEn,q,α , without amplification; let pS ≥ 1/poly(n) be its success probability over a uniform matrix, a uniform secret, errors DZm0 ,αq and its randomness. ⊤ −n fraction (Theorem 4.8). Let L := Λ⊥ (A), Fix A with λ∞ q 1 (Λq (A )) ≥ q/4, which excludes a q √ so that L∗ = q −1 Λq (A⊤ ) ⊇ Zm and λ1 (L∗ ) ≥ 1/4, and set d := m α < 1/8 ≤ λ1 (L∗ )/2. Define a decoder D for L∗ : on input t ∈ Rm , (1) pick a uniform s̃ ∈ Znq and set t′ := t + q −1 A⊤ s̃; (2) round each coordinate of qt′ randomly, bi ← DZ,αq/√2, qt′ ; (3) run S on the first m0 rows of i

(A⊤ , b mod q), obtaining ŝ; (4) let u := q −1 (A⊤ (ŝ − s̃) mod q) ∈ Rm and output u + ⌊t − u⌉ ∈ L∗ , rounding coordinatewise. We bound the success probability p̄ of D in the sense √ of Theorem √ 4.15. There t = y − v with v ∈ L∗ and y a continuous Gaussian of parameter d/ 2m = α/ 2 conditioned on ∥y∥ < d; the conditioning changes probabilities by at most 2−m (Theorem 4.10(a)). Write v = q −1 A⊤ sv + kv with sv ∈ Znq and kv ∈ Zm . Then qt′ ≡ A⊤ s′ + qy (mod q) with s′ := s̃ − sv , which is uniform and√independent of y, and qy has independent continuous Gaussian coordinates of parameter p αq/ 2 ≥ m/2 ≥ η2−m (Z) (Theorem 4.10(c)). By Theorem 4.16, b − A⊤ s′ is within statistical distance 2m 2−m of DZm ,αq . Thus the first m0 rows of (A⊤ , b) form, up to statistical distance 2−Ω(m) , an LWE instance with a uniform matrix, uniform secret s′ and errors DZm0 ,αq . If S returns ŝ = s′ , then u ≡ −q −1 A⊤ sv (mod Zm ), hence t−u ≡ y (mod Zm ), and since ∥y∥∞ < 1/8 the output is t − y, the closest point of L∗ . Hence p̄ ≥ pS (A) − 2−Ω(m) , where pS (A) is the success probability of S on the first m0 rows of the fixed matrix A⊤ . √ √ Apply Theorem 4.15(b) with G := {z ∈ L \ {0} : ∥z∥ ≤ β ′ }. The width is w = m/( 2 d) = √ √ ′ 1/( 4.10(a) and the argument of Theorem 4.20 (here w > √ √2 α) = β / m, so by Theorem −m 4 2 m ≥ 4), 1 − DL,w (G) ≤ 2 + 2−3m/2 and δG = 2−Ω(m) . The output lies in G with probability at least max{0, pS (A) − 2−Ω(m) }2 . Averaging over A and using the convexity of x 7→ max{0, x − δ}2 , the success probability is at least (pS − 2−Ω(m) )2 − q −n ≥ 1/poly(n). Solutions are checked (Az ≡ 0, z ̸= 0, ∥z∥ ≤ β) before being output. The idea of using an average-case LWE solver as the decoder in the quantum step is that of Stehlé, Steinfeld, Tanaka and Xagawa, who re-interpreted Regev’s quantum reduction as a reduction from SIS to LWE [216]; Theorem 4.15 supplies the analysis for decoders that succeed only on average and with probability 1/poly(n), and Theorem 4.16 reconciles the continuous offsets of the quantum step with the discrete errors of [61]. The thresholds in numbers. The following model illustrates differences between the asymptotic sufficient bounds; it does not estimate finite-dimensional attack costs. Table 4 evaluates them, ignoring constants and logarithmic factors, for dimensions 512 and 1024 and three values of the failure parameter. Three observations are worth making. First, even in the normalisation ⋆ f → 0+ , the SIVP threshold γReg ≈ n3/2 is about 213.5 –215 , larger than the signature proof factors in this normalisation (Section 7.1). Second, once the number of states and the radius condition are accounted for, the displayed sufficient bounds from the restricted ball composition are less favourable than the Regev-route bounds for LWE and SIS when f < 1/2, and for SIVP when f < 3/4: the restricted ball composition certifies noise scales at most about n−2 and yields SIVP factors about n3 and SIS bounds about n5/2 . Third, the normalised unique-SVP threshold √ n is only about 24.5 –25 , comparable to the heuristic gaps of deployed key-recovery lattices (Section 7.5); comparisons at this scale depend on constants that [199] does not make explicit, which is why we report them as heuristic comparisons, not as conclusions. Remark 4.26. Items (v) and (vi) reach SIS through the quantum step applied to the q-ary lattice Λ⊥ q (A), not through SIVP: under HReg (f ) the decoder of the dual lattice is the worstcase BDD algorithm (Theorem 4.20); under HEDCP [ℓ] it is the average-case LWE solver, used 47

n = d = 512 Threshold (exponent of 2) Under HReg (f ) γu ≈ d1/2+2f (unique-SVP) γg ≈ d1+2f (GapSVP) 1/αReg ≈ n1+2f (LWE, many samples) ⋆ γReg ≈ n3/2+2f (SIVP) βReg ≈ n3/2+2f (SIS) Under HEDCP [ℓ], with ℓ ≈ n ∗ 1/αE ≈ ℓn ≈ n2 (LWE, mmax samples) γE⋆ ≈ ℓn2 ≈ n3 (SIVP) βE ≈ ℓn3/2 ≈ n5/2 (SIS)

n = d = 1024

f → 0+

f = 1/4

f =1

f → 0+

f = 1/4

f =1

4.5 9 9 13.5 13.5

9 13.5 13.5 18 18

22.5 27 27 31.5 31.5

5 10 10 15 15

10 15 15 20 20

25 30 30 35 35

18 27 22.5

20 30 25

Table 4: Illustrative values of the thresholds of Theorem 4.17, as exponents e such that the threshold is about 2e , ignoring constants and logarithmic factors. The rows for HEDCP [ℓ] take ℓ ≈ n, the informationtheoretic minimum up to logarithmic factors (Theorem 4.22), and do not depend on f . The column f → 0+ is a normalisation (Section 4.3). These are normalisations of sufficient guarantees, not necessary attack thresholds. Applying them requires the finite-dimensional bound and every sample, distribution and instance promise.

as in the quantum reduction from SIS to LWE of [216] (Theorem 4.25). Related quantum equivalences between LWE with quantum auxiliary states and (I)SIS appear in [79, 89, 72]. 3/2 ) coincides, up to polylogarithmic factors, with e Under HEDCP [ℓ], the threshold βE = O(ℓn √ ⋆ 3/2 e e the norm γE /O( n) = O(ℓn ) at which the stated worst-case hardness premise becomes unavailable: this composition solves SIS at bounds comparable to those where its stated worstcase foundation becomes uninformative; below them it supplies no converse. Under HReg (f ), e 1+2f ) by a the threshold βReg = O(m3/2+2f ) lies above the worst-case-premise threshold O(n √ factor of about n. The claim that “no reduction connects DCP to SIS” should therefore be replaced by the sharper question of Theorem 10.3: whether DCP connects to SIS at the small norm bounds used by signature security proofs. Solving the exact SIS assumptions used at those bounds would remove the hardness premise from those security arguments; it would not by itself produce forgeries (Section 7.1). Remark 4.27. The route of Theorem 4.21 loses twice. The factor ℓ in αE arises because the ℓ states produced by [61, Thm. 3] must be valid simultaneously; and the √ radius condition √ n/m (B3) is at least about mmax /(3 2πe) instead of √ forces m ≤ mmax = Θ(n), so that m q O( n log q). A solver whose robustness matched the preparation error model, including possible correlations, might remove the requirement that all states be valid simultaneously. If such a composition allowed constant per-state error growing linearly with width, the factor ℓ might be replaced by a constant. This is a conjectural modification of the reduction, not a theorem about arbitrary invalid states, and it leaves the second loss: even then the route would reach e e √n). We do not build noise rates of about 1/(r0 κ mmax ) = 1/O(n), not the standard rate 1/O( such robustness into HEDCP [ℓ]; whether a reduction from LWE to EDCP can avoid both losses is Theorem 10.6. Remark 4.28. The draft [214] asserts, in its October revision as before, tolerance to faulty samples at rates up to 1/O(log n), where its n is log N , and consequences for approximate SVP √ at factor n polylog(n) in the lattice dimension (Section 3.2). Since log N = Θ(n2 ) in Regev’s reduction, a failure rate 1/O(log log N ) = 1/O(log n) corresponds to (log N )f = O(log n), that is to f = Θ(log log n/ log n) → 0: a stronger tolerance than HReg (f ) grants for any constant f > 0. If Regev’s theorem applied at such an f with controlled constants, which is not established, 48

√ since the theorem is stated for fixed f , it would yield the unique-SVP factor n polylog(n) and, e through Theorem 4.11, GapSVP at factor O(n). Even the weaker reading with constant f > 0 ⋆ reaches every polynomial factor above γReg .

4.6

The sample-count obstruction

Both routes to LWE in Theorem 4.17, (iii) and (vi), need many more samples than the secret dimension: m ≥ 2n lg q for the first, and m ∈ Mq (n), which excludes m close to n, for the second. That is the natural regime inside Regev’s reduction, where the reduction itself chooses m, but not the regime of deployed schemes: a public key of ML-KEM contains m = n (scalar) LWE samples, one of ML-DSA m ≈ n (m/n ∈ {1, 6/5, 8/7}), and the component u of an ML-KEM ciphertext is again an LWE instance with m = n samples, in a fresh secret. (The second component v is not an LWE sample in that secret, because it contains the encoded message; but recovering the secret from u decrypts v.) In this passive public-key setting, no additional supply of independent samples under the same secret is assumed. Interactive access or auxiliary keys require a separate analysis. The following proposition quantifies the loss. Proposition 4.29 (Sample-count obstruction). Consider normal-form LWE with n secret coordinates, m samples, modulus q, and secret and error coordinates of standard deviation σ. (a) Heuristic: For the embedding of dimension n + m + 1 defined below, with scale τ ≍ σ and log q + | log σ| + | log(τ /σ)| = o(n + m), the first-order heuristic gap estimate is q m/(n+m) √ , σ 2πe √ √ √ increasing from g(n) ≈ q/(σ 2πe) to q/(σ 2πe) as m/n → ∞. Under the additional heuristic that the embedded planted vector is shortest and its gap is represented by the displayed estimate, comparison with Γf,A (n + m + 1) gives a heuristic sufficient certificate. If the estimated gap is below this bound, or the bound is unavailable, this comparison is inconclusive. g(m) ≈

(b) Rigorous: If m = n and αq ≥ 1, the restricted ball construction of Theorem 4.21 supplies no certificate at these parameters. The value m = n is not in Mq (n): condition (B2) fails, and so does the lower bound on λ1 (Λq (A)) on which [61, Thm. 3] relies, since Λq (A) = Zn for invertible A; and even taking the width bound of the theorem at face value, every √ √ state it would produce has width r < 1/(c n κ ℓ) ≤ 1/(c n κ) and is within trace distance 2−Ω(n) of a state independent of s, so that polynomially many such states carry negligible information about s. Proof. (a) Write b = As+e (mod q), with integer representatives for s and e, and put D = n+m. The homogeneous lattice L0 = {(x, y) ∈ Zn × Zm : Ax + y ≡ 0

(mod q)}

has determinant q m , since the map (x, y) 7→ Ax + y onto Zm q is surjective. The vector (s, e) belongs to the affine coset Ax + y ≡ b, not to L0 in general. For a positive rational embedding scale τ , define the full-rank lattice Lτ,b = {(x, y, τ z) : x ∈ Zn , y ∈ Zm , z ∈ Z, Ax + y ≡ zb

(mod q)}.

Clearing a common denominator for rational τ does not change approximation ratios. The lattice has dimension D + 1, determinant τ q m , and contains the planted vector (s, e, τ ). The determinant follows from the same surjectivity argument before scaling the last coordinate by τ . 49

(a) Cyclic hypotheses and group actions some solver-dependent fA ; L. 4.4

HReg (f ) fixed-f hypotheses

Free, transitive cyclic actions efficient inputs and evaluation Thm. 4.17(vii)

HHS noiseless cyclic states zero corruptions

(b) Proved lattice consequences with route-specific parameters HEDCP [ℓ] polynomialmodulus domain

HReg (f ) [199, 154] Thm. 4.17(i)–(ii)

P. 4.21

Uniform LWE: α < αE m0 ∈ Mq (n)

uSVPγu , BDDδu , GapSVPγg worst-case oracles P. 4.19

Thm. 4.17(iii)

P. 4.20

⋆ SIVPγReg

O(n3/2+2f ) factor

C. 4.24

SIVP, GapSVP e 2 ) factor O(ℓn BDD1/gE

Uniform LWE α ≤ αReg (m)

SISβ , β ≥ βReg O(m3/2+2f ) bound

P. 4.25

SISβ β > βE

Here δu = 1/(2γu (d + 1)); all factors and bounds are defined in Section 4.4. Reg-LWE and both SIS routes require m ≥ 2n lg q and the stated matrix promises; q is prime. EDCP-LWE uses (B1)–(B3), with extra samples for √ √ amplification; the worst-case composition chooses q, α with αq > 2 n. EDCP-SIS also requires βE < q/ 2. The SIS edges use dual decoding and Gaussian sampling, not a reversal of a worst-case hardness reduction.

(c) Conditional embedding applications verified embedding or BDD promise

uSVPγu or BDD1/gE

Few-sample MLWE and other LWE-type instances Thm. 4.17(iii); P. 4.29

(d) Structured route: state conversion and application checks Ordinary EDCP solver at (k, Q) Q = qd + 1

L. 5.1

IP-M-EDCP solver same Q and secret

[225] Thm. 4

MLWE within the source preparation contract

The left solver is outside the stated HEDCP domain. Filtering via (4) supplies it under Hab HS (HHS for k = 1) at the stated widths and state budget. The dashed application requires all source distributions, width, sample and preparation-error conditions. The audited printed certificate gives no ML-KEM application (Section 5).

(e) Research questions Cyclic-to-vector translation? HReg (f ) ⇒ HEDCP [ℓ]? Q. 10.5

NTRU key recovery; LIP Q. 10.4; Q. 10.9

SIS at small norm bounds Q. 10.3

Figure 4: Detailed algorithmic implications. An arrow A → B means that a solver for A yields an algorithm for B, reversing the problem-reduction convention of Fig. 1. Solid arrows are proved under all premises of the cited result; dashed arrows identify instance or preparation conditions still to be checked for an application. The separate research-question boxes assert no reduction. P., C. and L. locate the explicit derivations; literature citations identify their sources. The HHS lattice factors depend on its witness through fA . No general implication between HEDCP and the cyclic solver hypotheses is established here. Solving SIS does not automatically yield a forgery.

50

Under the Gaussian heuristic for competing vectors, and the model ∥s∥2 + ∥e∥2 ≈ Dσ 2 , the gap estimate is p (D + 1)/(2πe) (τ q m )1/(D+1) √ . gτ (m) ≈ Dσ 2 + τ 2 For τ comparable to σ, with log q + | log σ| + | log(τ /σ)| = o(D), this agrees to first order with √ m/D q /(σ 2πe). The heuristic also assumes that the planted direction is shortest and that no atypically short competing direction invalidates the gap. Applying the uSVP theorem requires those promises; the determinant computation alone does not establish them. (b): for invertible A ∈ Zn×n , AZnq = Znq , so Λq (A) = Zn and λ1 = 1, below the bound q √ √ n/(2 2πe) that [61, Lem. 6] gives at m = n, for n ≥ 69. Taking the width bound at face √ value, with m = n, q n/m = q and αq n/m = αq ≥ 1, so the admissible width is r < 1/(c n κ ℓ). P 2 2 2 2 A Gaussian amplitude of width r places relative weight j̸=0 e−2πj /r ≤ 2e−2πc nκ (1 + o(1)) outside j = 0; the state is therefore 2−Ω(n) -close to |0⟩|xk ⟩, which is independent of s. By the triangle inequality, poly(n) such states are jointly 2−Ω(n) -close to s-independent states. Corollary √ 4.30. For a normal-form LWE instance with m = n, the first-order gap estimate is √ q/(σ 2πe). Comparing it with Γf,A (2n + 1) gives a heuristic sufficient certificate, subject to the planted-vector and gap assumptions. No converse is claimed. For ML-KEM, the heuristic normalised gaps of keys and ciphertexts are about 0.3–0.4 (Table 10). These compare with the f → 0+ model only; an explicit finite-dimensional bound and the actual embedding promise remain necessary for a rigorous certificate. At m = n, the restricted unstructured ball construction supplies no certificate (Theorem 4.29(b)). The printed structured forward bound supplies no certificate at the ML-KEM ring and modulus (Theorem 5.2); this is a limitation of that sufficient bound. √ A worked example. Figure 5 plots the first-order normalised gap g(m)/ n + m for ML-KEM768-type √ parameters (q = 3329, σ = 1, n = 768) and ML-DSA-44-type parameters (q = 8 380 417, σ = 2, n = 1024). The line at one is the comparison model f → 0+ , c0 = 1, not a theorem threshold. The ML-KEM-type public-key value is about 0.4 and its compressed ciphertext component about 0.3; the model curve crosses one near m = 1.85n. The ML-DSA-type value is about 11 only in the separate scenario where full t is supplied; the published-key estimate is about 0.3. These comparisons illustrate sample sensitivity, without certifying actual gaps or attacks. The two analysed unstructured direct constructions lose a factor q n/m in their sufficient noise guarantees. Large modulus-to-noise ratios can improve those comparisons, but a structured embedding still needs its actual gap and distribution promises. More samples do not suffice by e √n) of Regev’s and dual-Regev encryption, the themselves: at the standard noise rate α = 1/O( displayed direct guarantees supply no certificate even with m = Θ(n log q) (Section 6.1).

4.7

The window outside the reach

Theorem 4.17 gives sufficient guarantees for lattice instances with verified promises. A plantedshortest-vector instance with actual gap above γu is solved by the ordinary-uSVP route. An approximate lattice problem is solved when the available oracle’s factor meets the target specification. Under HHS , use the corresponding bounds for some solver-dependent fA . Under HEDCP [ℓ], the restricted ball composition and the worst-case route have their own sample, distribution and gap conditions. Failure of one of these comparisons to certify an instance gives no converse about the solver’s behaviour. We use “window outside the reach” only for the region without a certificate from these stated guarantees; its boundary is not a measured security margin. Solving a SIS proof assumption also remains distinct from forging a signature (Section 7.1). Figure 4 retains the distinct quantitative routes. In particular, its two SIS branches 51

√ normalised gap g(m)/ n + m

√ ML-DSA-44-type: q ≈ 223 , σ = 2, n = 1024 ML-KEM-768-type: q = 3329, σ = 1, n = 768 √ threshold γu = n + m (f → 0+ , c0 = 1)

104 103 102 101

full t supplied: 10.9 crosses at m ≈ 1.85n

100 1

public key, m = n: 0.36

1.5

2

2.5

3

samples relative to secret dimension, m/n Figure 5: The sample-count obstruction (Theorem 4.29). Normalised unique-SVP gap of the LWE embedding lattice √ as a function of the number of samples, for two parameter families, against the heuristic yardstick g = n + m (f → 0+ , c0 = 1); points above it satisfy only this model comparison, subject to the actual gap and finite-dimensional guarantee. Series are distinguished by colour (Wong palette), line pattern, marker shape and legend; the plotted values for public keys also appear in Table 10, together with those of ciphertexts.

use dual decoding and Gaussian sampling (Theorem 4.26); they do not follow by reversing a worst-case-to-average-case hardness reduction. Its conditional application panels require the stated instance or preparation certificates, and its research-question boxes assert no additional reduction. The ordinary-EDCP solver in the structured panel has exponential modulus in the ring degree and is not supplied by the polynomial-modulus hypothesis.

5

The Wen–Zheng route: recovered map and audited scope

We use the full version of [225] to recover the exact conversion of structured states, transcribe the forward parameter conditions, and test them at the public-key parameters. These are distinct results: the state conversion is exact, the forward construction has restrictive sufficient conditions, and its polynomial-modulus adapter needs a complete resource ledger before it can invoke HEDCP [ℓ] as defined here. The theorem numbers and page references below refer to the 86-page full version of [225]. Parameters and distributions. Write k for the module rank (the source’s n), m for the number of independent ring samples under one secret, t for the amplified sample count (the source’s m′ ), and L for the number of structured states (the source’s l). Thus the scalar secret dimension is dk, not k. Set F (X) = X d + 1,

Q = F (q) = q d + 1,

Sq =

qd − 1 , q−1

z = (1, q, . . . , q d−1 ).

Theorem 4 of [225] assumes power-of-two d = poly(κ), constant k, m = O(log κ), and a polynomially bounded unramified prime q. It requires the prime ideals above q to satisfy mini N(pi ) ≥ (kd)ω(1/(m−k+1)) . √ Its polynomial-LWE input has independent coefficient discrete Gaussians of widths σs , σe ≥ d for the secret and errors, respectively; these are Gaussian parameters, not coefficient standard deviations. Bounded, centred-binomial, compressed or rounded inputs need a separate conversion. For power-of-two √ cyclotomics the unnormalised canonical embedding scales coefficient Euclidean norms by d; Gaussian covariances must be converted accordingly. This does not identify different error distributions. In particular, O(log κ) 52

is an upper bound on m, not a promise that every smaller sample count satisfies the regularity argument: the invoked Lemma 49 and Corollary 6 require m > k. The printed forward certificate.

Lemma 28 and Theorem 4, pp. 39 and 44–45 of [225], use

ρ2 ≥ 2d q k/m+2/(dm) , √ √ 15 B= + 3σs κ k 2 + 18k + 2mσe ρ2 d2 κ, 2   √ √ Q1−k/t 3 + r κ Bd( 2 + 2/q) Sq ≤ , C ≥ 8. 4tLC

(2) (3)

Here B is the source’s c′max and r is its structured-state width. The amplified matrix is statistically close to uniform over Zt×k Q ; its error may depend on that matrix, which is explicitly allowed in Lemma 30. The evaluation encoding of the secret is injective because F (q) ≥ q d , so recovering the encoded secret recovers the polynomial secret by the source’s centred digit map. The construction is claimed to produce L approximate states with negligible individual trace error and constant joint good-branch probability, using polynomial time in the full input length and k, d, t, L, log q, κ. We use (3) exactly as a printed sufficient certificate, not as a necessary condition for any algorithm. Lemma 30 instead √ retains the expansion factor EF (F ), and the proof uses EF (F ) ≤ 2; using 2 in place of 2 is a conservative strengthening. All negative certificate checks below already use the more permissive printed constant. The source’s ideal all-good product is (1 − 1/(tL))tL , which is below 1/e, not above it. For tL ≥ 2 it is at least 1/4; this repairs the stated constant without changing polynomial-time claims, after accounting separately for the preprocessing and matrix events. If the usable goodbranch probability is c, the target solver succeeds with probability p, and the full preparation instrument has trace error at most ε, the composed recovery probability is at least cp − ε. Thus individual errors must be budgeted against L and p, not merely called small after conditioning on a measurement outcome. Lemma 5.1. An ideal product-amplitude IP-M-EDCP state X

d−1 Y

c∈Zd

i=0

!

a(ci ) |c⟩|x + ⟨c, z⟩se mod Q⟩

reduces by measurement to one ordinary EDCP state of dimension k, modulus Q and onedimensional amplitude a, with the same secret. The conversion preserves the number of states and cannot increase trace distance. It holds for every secret and arbitrary offsets. Proof. Measure c1 , . . . , cd−1 , obtaining u1 , . . . , ud−1 . With x′ = x + ( state is X a(j)|j⟩|x′ + j se mod Q⟩.

Pd−1 i e, the remaining i=1 q ui )s

j∈Z

This is the construction of [225, Thm. 5, pp. 45–46]. Its action is independent of the secret distribution; in particular it also applies to the encoded Gaussian secret produced by Theorem 4, although the formal statement of Theorem 5 names a uniform secret. Trace-distance contraction follows because measurement is a quantum channel when its classical outcome is retained. What solver this actually reaches. The output has log Q = Θ(d log q), but Q is exponential in d. Polynomial bit length alone does not place this state in HEDCP [ℓ], which assumes a polynomial modulus in its EDCP dimension. The source’s Definition 22 uses amplitudes p DZ,r , whereas its√construction writes ρr . Under the former convention the amplitude width in Theorem 2.5 is 2r; under the latter it is r. One must fix this convention in a quantitative adapter. The constant factor does not change the exclusions below. 53

There is nevertheless a precise positive consequence under the already stated abelian hypothesis. For amplitude width R in this survey’s convention, project an EDCP register onto j ∈ {0, 1} and attenuate the j = 0 amplitude to equal the j = 1 amplitude. This produces a noiseless coset state over (ZQ )k with heralded probability 2

2e−2π/R pR = P . −2πj 2 /R2 j∈Z e

(4)

For R bounded below by a positive constant and bounded above by a polynomial in the input length, pR ≥ 1/poly(kd log q). If the witnessing Hab HS solver needs J registers, O((J +log(1/δ))/pR ) independently prepared ideal EDCP states suffice to obtain J coset states except with probability δ. Consequently, an efficient forward preparation meeting all its premises, this larger state budget, and the cp − ε error budget gives a search algorithm under Hab HS . For k = 1 the group is cyclic, so HHS suffices. This consequence does not assume that cyclic and general abelian state-input problems are interchangeable, and does not insert an extra clause into HEDCP . For the original HEDCP [ℓ] route, Appendix E, Lemma 58 of [225] proposes a modulus-todimension adapter. Its intermediate dimension satisfies n′ ≥ (k + 1)d⌈log q⌉ + 2κ; it reserves 16k + 4⌈ln ln Q⌉ input states for normal form, requires the remaining sample count to be at least n′ log q, and incurs a further width loss and output-state budget. These are additional requirements, not properties of the exact map above. In particular the invoked EDCP-to√ LWE lemma requires r = Ω( κ), and the unknown-noise routines invoked twice have their own polynomial sample overheads. The displayed fixed sample ledger in Lemma 58 does not explicitly propagate those overheads. We therefore retain this adapter as a source-stated route requiring a completed search, width, success and sample audit before it supports a new HEDCP [ℓ] consequence. Proposition 5.2. For the printed certificate (3), define Amax =

Q . 4eCkLSq ln Q

For every real t > 0, hence also every admissible integer amplified sample count, the certificate requires √ √ 3 + r κ Bd( 2 + 2/q) ≤ Amax . (5) At d = 256, q = 3329, k ∈ {2, 3, 4}, C ≥ 8, and L ≥ 1, Amax < 0.01. Thus this certificate has no feasible positive width at the ML-KEM ring and modulus, regardless of t, even before checking input distributions and amplification premises. Proof. Divide (3) by Sq . The only dependence of its right-hand side on t is e−k ln Q/t /t, whose maximum for t > 0 is 1/(ek ln Q), attained at t = k ln Q. For q ≥ 3, d ≥ 2, we have Q qd + 1 = (q − 1) d < q, Sq q −1

ln Q > d ln q.

Hence Amax < q/(4eCkLd ln q). Substituting q = 3329, d = 256, and even the most permissive C = 8, k = 2, L = 1 gives less than 0.009217. The left-hand side of (5) exceeds 3. √ The positive widths in the last three rows are far below the Ω( κ) input requirement of the source’s polynomial-modulus adapter; no efficient two-point-filter application is certified here by (4). None of these rows is a recovered attack. For ML-KEM and ML-DSA-44, m = k also lies outside the strict m > k premise of the regularity lemma used in amplification. Ciphertext compression and ML-DSA’s omitted low bits introduce further conversion obligations; they cannot repair the displayed sufficient tests by themselves. 54

Input parameters

k

m

Amax , approximately

Width required by certificate

ML-KEM-512 ML-KEM-768 ML-KEM-1024 ML-DSA-44 ML-DSA-65 ML-DSA-87

2 3 4 4 5 7

2 3 4 4 6 8

0.009214 0.006142 0.004607 5.901936 4.721549 3.372535

no feasible r no feasible r no feasible r r < 2.17 · 10−19 r < 1.24 · 10−18 r < 1.04 · 10−19

Table 5: Optimistic tests of the printed Wen–Zheng √ certificate, not attack costs or security bounds. We set C = 8, L = 1, relax κ to 1, take σs = σe √ = d = 16, minimise ρ2 , and maximise over all real t > 0. The ML-DSA bounds use (Amax − 3)/(Bd( 2 + 2/q)) and are rounded upwards. These Gaussian surrogates are not the deployed distributions. Real state budgets and statistical parameters only tighten the test.

The route with more input samples. Appendix D.5, Lemma 52 of [225], avoids amplification when sufficiently many independent samples are supplied, with the source suggesting order k log q. It allows nonconstant rank and a broader class of polynomials. In the cyclotomic case above, one may take the carry bound Bmany =

√ √ 15 + 3σs κ k 2 + 18k + σe κ. 2

√ Lemma 30 then uses t = m, B = Bmany , and EF (F ) in place of 2 in (3). This removes the amplification error but not the modulus, state count, width or distribution conditions. In particular, extra states generated from the same input are not extra independent ring samples, and the additive-3 obstruction of Theorem 5.2 still applies to this printed bound at the ML-KEM ring and modulus. For any parameter family satisfying the forward inequalities and the full preparation contract, the positive solver composition above applies. We do not infer such a family merely from the failure of the displayed deployed-parameter tests.

6

Consequences for the LWE family

This section records sufficient consequences for LWE-type assumptions under each hypothesis and the checks still needed for particular instances. Most entries follow from Theorem 4.17. Their applicability depends on the number of samples under one secret, the modulus-to-noise ratio, the algebraic structure of the public matrix, and the promises of the chosen embedding; the name “Module-LWE” alone fixes none of these. An algorithm for LWE with uniform A does not automatically solve a structured instance. The worst-case oracles of Theorem 4.17 can apply to structured lattices, but their promises must be established for the particular embedding. Under HHS , Theorem 4.18 supplies these oracles at some solver-dependent polynomial factors. Under HEDCP [ℓ], Theorem 4.24 supplies a separate worst-case route. The exact structured state conversion of Wen and Zheng [225] is restated in Theorem 5.1; its first output has exponential modulus, and the numerical certificate audit gives no deployed application (Section 5). How conclusions are assigned. For HReg (f ), check a sufficient finite-dimensional promise Γf,A and the actual planted vector, or the sample and distribution premises of the direct LWE result. For HHS , make the same checks with the solver-dependent exponent from Theorem 4.4. For HEDCP [ℓ], select an admissible number m0 of uniform samples with α < αE (n, m0 , ℓ); reserve m′ additional samples if using the amplified guarantee. Alternatively verify the worst-case embedding promise at gE . For the structured route, check the source-specific inequalities and 55

solver domain in Section 5. The remaining polynomial-modulus adapter audit is recorded in Theorem 10.10; its status is U . Heuristic gap and norm calculations are marked H and remain conditional. The conjunction H⋆ makes each certified route available but does not remove its premises. Assumption Worst-case lattice problems LWE, many samples, small noise

HHS HReg (f ) HEDCP Sufficient guarantee or remaining check Some solver-dependent polynomial factors under HHS ; the explicit factors of Theorems 4.17, 4.18 and 4.24 otherwise. Uniform-matrix and distribution conditions; α ≤ αReg or α < αE with admissible subset and holdout samples. Under HHS , substitute fA . No certificate from the stated sufficient bounds for e √n) (Section 6.1). α = 1/O( Verify the planted-shortest-vector promise and actual gap against Γf,A or gE . The FHE row is one illustrative comparison. Finite-dimensional embedding comparison unresolved; restricted ball construction supplies no certificate at m = n.

R

R

R

R

R

R

H

H

H

Few-sample unstructured LWE (FrodoKEM) Few-sample MLWE (ML-KEM, ML-DSA keys) Gaussian EDCP

H

H

H

H

H

Embedding promises remain conditional; the audited structured bounds give no deployed certificate (Table 5).

R

R

R

Ring-LWE, Module-LWE with a large gap

H

H

H

By hypothesis in its domain. Cyclic hypotheses cover parameters whose EDCP-to-LWE image [61, Thm. 4] meets the inherited LWE bounds; no general cyclic-to-vector implication asserted. Worst-case oracles apply when the actual structured embedding promise is verified; uniform-matrix estimates do not establish it. The structured route has separate width, sample and modulus conditions (Section 5). Restricted distributions and their conversions must be checked [59]. Conditional worst-case embedding route; hardness reductions from Ring-LWE give no solver for the target [203, 180, 193, 189, 54]. √ Many-sample BDD certificate for p ≥ 4 m γu (m + 1); otherwise verify the embedding promise (Section 6.4). Ignore the hint for succinct LWE; use the parameter-matched equivalence for decomposed LWE [1]. The discrete-secret reduction to LWE [122]; general secrets lack a certificate here. Measurement gives corresponding classical samples [79, 72]. Conditional Ring-LWE ciphertext embedding route [215]; ordinary deployed NTRU is treated separately in Section 7.3.

LWE, many samples, standard noise LWE, few samples, large q/σ

MLWE, short secrets

as MLWE

MP-LWE, Order-LWE

H

H

H

LWR

R

R

H

Succinct / decomposed LWE CLWE S|LWE⟩ Stehlé–Steinfeld NTRU variant

as LWE as LWE / as LWE H

H

H

Table 6: Consequences under each hypothesis, with all stated parameter and promise conditions. : proved consequence; : conditional; : unresolved connection; : no certificate from the analysed reductions. Basis marks: R rigorous, H heuristic, U unverified parameter application. The HHS lattice bounds depend on its witness through fA ; they are not numerical certificates for a deployed scheme. No absence of a certificate asserts security or failure of all attacks.

6.1

Unstructured LWE

Four regimes. With sufficiently many samples and sufficiently small noise, Theorem 4.17 certifies LWE under HReg (f ); Theorem 4.21 gives a second sufficient range under HEDCP [ℓ], using m0 ∈ Mq (n) and, for amplification, m′ holdout samples. The displayed bounds do not certify many-sample LWE at the standard noise rate. For few samples, the ordinary-uSVP comparison 56

depends on the embedded planted vector and its actual gap: a large modulus-to-noise ratio improves the heuristic estimate, while the estimates for the deployed small-ratio instances remain inconclusive. At m = n the restricted ball construction provides no certificate. These are regimes of the stated guarantees, not necessary conditions on all possible attacks. Regev’s cryptosystem and its dual. Regev’s cryptosystem uses q ≍ n2 , m = Θ(n log q) and √ α = 1/( n log2 n) [201]. The q/4 lower bound used in the displayed BDD certificate gives a ratio of only Θ(log3/2 n) against the error norm, which does not verify the required polynomial promise. Likewise α exceeds the sufficient ball-reduction noise bound. These failed comparisons do not prove that an actual lattice gap or another attack cannot be better. The dual cryptosystem of [112] supplies many samples in a fresh secret per ciphertext; its standard-noise regime is also uncertified by the stated bounds. We therefore record no attack certificate here under any of the three hypotheses, without asserting an impossibility result. Lindner–Peikert-type designs and FrodoKEM. Lindner and Peikert’s compact design publishes b = As + e with square A; a ciphertext supplies an instance in a fresh secret and a message-bearing component [152]. FrodoKEM uses unstructured A and parameters (n, q, σ) = (640, 215 , 2.8), (976, 216 , 2.3) and (1344, 216 , 1.4) [56, 17]. Its eight secret columns share A but each has √ only m = n samples. The heuristic gap estimates are about 16, 27 and 44, or 0.4–0.9 times d (Table 10). These numbers specify comparisons that would suffice under the model c0 d1/2+2f ; they do not prove failure below a bound. The restricted ball composition does not certify these samples, and the structured connection does not apply to unstructured A. This leaves quantitative applicability unresolved, rather than establishing a comparative security margin. Normal form, small errors and the role of samples. The normal-form transformation of Applebaum, Cash, Peikert and Sahai [20] converts LWE with a uniform secret into LWE with a secret drawn from the error distribution, at the cost of n samples; it is why short secrets are standard and why the gap of Theorem 4.29 is computed with secret and error of comparable size. Two results discussed in Section 2.4 show that the number of samples is a security parameter in its own right: the Arora–Ge linearisation [22] breaks LWE with very small errors given many samples, while Micciancio and Peikert prove LWE with binary errors hard when the number of samples is limited [165]. The sample-count obstruction is the counterfactual analogue of the same phenomenon.

6.2

Ring- and Module-LWE

What the worst-case reductions say. Lyubashevsky, Peikert and Regev defined RingLWE over the ring of integers R of an arbitrary number field K, with the secret in the dual ideal R∨ and errors that are Gaussian in the canonical embedding of K into Rn [157]. Their first theorem is a quantum reduction, modelled on Regev’s, from worst-case approximate SVP on ideal lattices to search Ring-LWE. Their second, for cyclotomic fields and primes q ≡ 1 modulo the conductor, is a search-to-decision reduction: such q split completely, the Chinese remainder theorem decomposes Rq into n copies of Zq , and the Galois automorphisms of the field permute the copies transitively, which lets an algorithm that solves decision on one copy recover the whole secret. Peikert, Regev and Stephens-Davidowitz later reduced worst-case ideal-lattice problems directly to decision Ring-LWE, for any number field and any modulus, removing the algebraic restrictions of the search-to-decision step [190]. Langlois and Stehlé proved the analogous worst-case to average-case reductions for Module-LWE and Module-SIS from problems on module lattices [150], and Boudgoust, Jeudy, Roux-Langlois and Wen gave hardness reductions for bounded secret and error distributions under the conditions of their 57

theorems [59]. These reductions establish conditional hardness of the structured problems from their source assumptions. They also show that the worst-case problems behind Ring- and Module-LWE are problems on structured lattices, which is why the quantum algorithms for ideal lattices of Section 1.2 [87, 88, 191] matter for their foundations, though not, at subexponential approximation factors, for their concrete security. Conditional structured consequences. The worst-case ordinary-uSVP and BDD oracles apply to Ring- or Module-LWE embeddings satisfying their actual planted-vector and gap promises. The average-case uniform-matrix theorem cannot supply those promises for structured A. Under HHS the same statement holds with a solver-dependent polynomial factor; under HEDCP [ℓ] the sufficient worst-case bound is gE . Wen and Zheng’s structured route [225] is analysed with its explicit forward certificate and exact state map in Section 5. The numerical audit supplies no deployed attack: ML-KEM fails the printed width inequality even after optimising the amplified sample count, and the ML-DSA Gaussian surrogate bounds are too small for the source’s polynomial-modulus adapter. This is a limitation of those sufficient certificates, not an impossibility result. Rank changes in the heuristic gap comparison. Albrecht and Deo reduced Module-LWE of rank k and modulus q to Ring-LWE with√modulus q k , sample by sample, at the cost of increasing the noise rate by a factor nc+1/2 k for ring degree n, rank k and any constant c > 0, in power-of-two cyclotomics [12]; together with the trivial converse this makes the two problems polynomially equivalent. In the normal-form heuristic used here, this map does not increase the estimated gap. For an instance with secret dimension n, m scalar samples and √ noise rate α, Theorem 4.29(a) gives g ≈ q −n/(n+m) /(α e), so that at fixed noise rate a larger modulus decreases this heuristic estimate for a few-sample instance. For an ML-KEM public key √ (n = m = 256k) the gap is q −1/2 /(α e); after the Albrecht–Deo map the secret dimension is 256, the number of samples 256k, the modulus q k and the noise rate α′ ≥ α, so the gap becomes √ q −k/(k+1) /(α′ e), smaller by at least a factor q k/(k+1)−1/2 . Thus this map does not improve the displayed heuristic comparison. This is not a theorem about actual structured gaps or every possible rank-changing reduction.

6.3

Middle-product, order-based and unified variants

The constructions. Middle-Product LWE, introduced by Roşca, Sakzad, Stehlé and Steinfeld, <2n−1 [x], and returns b = a ⊙ s + e, where a ⊙ s takes a ∈ Z<n n n q [x] uniform, a secret s ∈ Zq consists of the n middle coefficients of the product a · s, which has degree less than 3n − 2 [203]. The point of the definition is that it refers to no particular polynomial modulus: the authors proved that MP-LWE is at least as hard as Polynomial-LWE modulo f for every f in an exponentially large family of monic polynomials with bounded expansion factor, so a suitable MP-LWE solver yields solvers for each source family at the parameters of its reduction, and they built a public-key encryption scheme from it. Njah Nchiwo and Pellet-Mary improved the parameters of the reduction from Ring-LWE [180], and Pellet-Mary and Xia gave a single reduction, parameterised by field elements, that recovers the earlier ones and applies to number fields satisfying their polynomial-boundedness conditions [193]. Order-LWE, introduced by Bolboceanu, Brakerski, Perlman and Sharma, replaces the ring of integers by an arbitrary order of the field; they reduced worst-case problems on lattices associated with ideals of the order to it and used it to study Ring-LWE with secrets from non-uniform, entropic distributions [54]. Peikert and Pepin placed Ring-, Polynomial-, Module-, Order- and Middle-Product LWE in one framework and gave simpler and tighter reductions among them [189].

58

Conclusion. Hardness reductions from Ring-LWE or worst-case problems to these variants do not supply algorithms in the reverse direction. The worst-case ordinary-uSVP route applies if the chosen embedding has the planted vector as a shortest vector and its actual gap meets the oracle promise. Uniform-matrix estimates do not establish that promise for middle-product or order-based instances; we have not verified it here. Under HEDCP [ℓ], the worst-case route of Theorem 4.24 similarly requires the appropriate embedding promise at gE . We establish no additional EDCP-based certificate for these variants. A future structured reduction would require its own parameter and state-preparation audit.

6.4

Rounding, short secrets and strengthened assumptions

Learning with Rounding. An LWR sample (a, ⌊(p/q)⟨a, s⟩⌉ mod p), multiplied by q/p, is an LWE-type sample whose error is deterministic and bounded by q/(2p) in absolute value [29]. Banerjee, Peikert and Rosen proved LWR at least as hard as LWE when q/p exceeds the LWE error by a sufficiently large (in their reduction, super-polynomial) factor, and built pseudorandom functions from it. For the algorithmic direction, take prime q, uniform independent rows and m ≥ 2n lg q. Outside the exceptional matrices in Theorem 4.8, the rescaled instance meets a √ √ BDD promise of gap at least (q/4)/((q/2p) m) = p/(2 m), which Theorem 4.17(ii) solves when √ e 1+2f ). Few-sample instances require a separate embedding analysis. p ≥ 4 m γu (m + 1) = O(n For structured Module-LWR matrices, the uniform-matrix minimum bound cannot be assumed; the actual lattice minimum and planted-vector promise must be checked. Short secrets. Shorter secrets and errors increase the displayed heuristic gap estimate. With the usual rescaling of the secret coordinates, an instance with secret standard deviation σs and n/(n+m) m/(n+m) √ error standard deviation σe has heuristic gap q m/(n+m) /(σs σe 2πe), which reduces to Theorem 4.29(a) when σs = σe ; smaller widths improve that model comparison. Applying an oracle still requires the actual distribution and embedding promises. The hardness reductions of [59] alone do not establish those algorithmic premises. Succinct and decomposed LWE. Wee’s ℓ-succinct LWE [223] and the decomposed LWE assumption of Abram, Malavolta and Roy [2], proved equivalent by Abram, Arnon, Cini, Lou, Malavolta and Roy [1], assert that LWE remains hard when the adversary also receives structured auxiliary information, in the case of decomposed LWE, information that can be read as circularsecurity leakage of a natural encryption scheme. They are strengthenings of LWE: their hardness implies that of LWE. The converse direction, which is the one an algorithm needs, requires an argument. For succinct LWE it is immediate: an instance consists of a standard LWE instance with a uniform matrix together with a hint, and a solver for that LWE instance, run while ignoring the hint, succeeds with the same probability, because the marginal distribution of the instance is unchanged. For decomposed LWE, whose samples may encrypt functions of the secret, a standard LWE solver does not apply directly; the transfer goes through the reduction of [1], which turns an adversary against succinct LWE into one against decomposed LWE, and holds only at the parameters for which their equivalence is proved. These arguments transfer an algorithm to the corresponding assumption only with matched parameters and access models. An attack on an attribute-based encryption, laconic function evaluation or succinct randomised encoding construction requires a further construction-specific argument; it does not follow merely because its security proof uses that assumption. Continuous LWE. Bruna, Regev, Song and Tang reduced worst-case lattice problems to CLWE by a quantum reduction [67], and Gupte, Vafa and Vaikuntanathan reduced LWE to CLWE classically [122]. These reductions show that CLWE is at least as hard as the source problems; they give no algorithm for CLWE. For an algorithm the relevant result is the reduction 59

in the opposite direction, also given by Gupte, Vafa and Vaikuntanathan, from CLWE with a discrete secret to LWE, which, as they note, nearly completes the picture modulo the discretesecret requirement [122, App. C]. Under H⋆ , discrete-secret CLWE therefore falls whenever the LWE instance produced by that reduction is in the reach, while for general-secret CLWE the reductions reviewed here provide no algorithmic certificate, recorded as Outside reach. Quantum-state LWE. In S|LWE⟩ the adversary receives, instead of a classical sample, a quantum state that superposes the possible errors. Measuring the state yields a classical LWE sample with error distributed according to the squared amplitudes, so a classical solver applies when its required distribution, parameters and sample budget match that measured marginal. Chailloux and Hermouet proved a quantum equivalence between S|LWE⟩ and ISIS [72], building on the filtering technique of Chen, Liu and Zhandry [79] and on the quantum oblivious LWE sampling of Debris-Alazard, Fallahpour and Stehlé [89]; transferring an algorithm to ISIS requires the parameters and resources of their equivalence. This does not itself give a forgery for the SIS-based signatures discussed in Section 7.1.

6.5

Search, decision and quantum auxiliary states

Search and decision LWE are related by reductions with explicit modulus, distribution and resource conditions [201, 163]. The quantum reduction of Sudo, Tezuka, Hara and Yoshida, built on a quantum Goldreich–Levin theorem over Zq for prime q, recovers the secret with only two queries to a decision oracle [218], but the query count alone does not establish preservation of a fixed classical sample budget. A use under H⋆ must check the decision-oracle interface, coherent access and the reduction parameters; sample-preserving results such as [163] apply under their own conditions. In the other direction the relevant works are the quantum bridges between LWE and SIS. Chen, Liu and Zhandry’s filtering technique converts states with a known amplitude profile into states with a profile suited to the problem at hand; it yields polynomial-time quantum algorithms for SIS∞ with very wide matrices, polynomial modulus and bound q/2 − O(1), and for EDCP with suitable amplitude functions [79]. Kothari, O’Donnell and Wu later gave classical deterministic algorithms for all the SIS∞ variants treated there [142]. Debris-Alazard, Fallahpour and Stehlé showed how to sample LWE instances obliviously, that is, without knowing a secret for them, with a quantum algorithm, which contradicts the lattice knowledge assumptions used by some standard-model SNARKs [89]. These results matter here because they are explicit quantum connections between the LWE and SIS worlds. None of them gives a DCP-based algorithm for SIS at the small norm bounds of signatures (Theorem 10.3).

6.6

Advanced primitives

Fully homomorphic encryption was first realised over ideal lattices [111]; later leveled and approximate-eigenvector constructions use LWE or its structured variants [60, 113]. Evaluation and bootstrapping keys encrypt functions of a secret and cannot automatically be counted as independent LWE samples. For the illustrative FHE parameters in Table 10, the heuristic public-key gap is much larger than the model d1/2+2f over the displayed range of f . This is a conditional comparison for that parameter set. A rigorous attack certificate additionally requires a finite-dimensional reduction bound and the appropriate embedding promise; we do not infer a uniform classification of all FHE parameters from this example. The table’s illustrative public key uses ring degree 215 , modulus 2880 and error standard deviation 3.2. Attribute-based encryption, pseudorandom functions and identity-based encryption likewise require their own sample and noise analysis [223, 2, 29, 112, 187]; no family-wide conclusion follows from this example.

60

6.7

Consequences for the lattice standards

ML-KEM [172, 57] and ML-DSA [171, 94] are built on Module-LWE over Rq = Zq [x]/(x256 + 1), the ring setting of [225], and ML-DSA’s unforgeability rests additionally on Module-SIS. Table 7 lists the parameters needed for their comparisons. Parameter set rank ML-KEM-512 ML-KEM-768 ML-KEM-1024 ML-DSA-44 ML-DSA-65 ML-DSA-87 FrodoKEM-640 FrodoKEM-976 FrodoKEM-1344

q distributions

k = 2 3329 k = 3 3329 k = 4 3329 (4, 4) ≈ 223 (6, 5) ≈ 223 (8, 7) ≈ 223 none 215 none 216 none 216

CBD, η1 = 3 / η2 = 2 CBD, η1 = 2 / η2 = 2 CBD, η1 = 2 / η2 = 2 uniform, η = 2 uniform, η = 4 uniform, η = 2 σ = 2.8 σ = 2.3 σ = 1.4

m/n: key; ctxt other 1; 1 (u) 1; 1 (u) 1; 1 (u) 1 6/5 8/7 1; 1 1; 1 1; 1

(du , dv ) = (10, 4) (du , dv ) = (10, 4) (du , dv ) = (11, 5) d = 13, τ = 39 d = 13, τ = 49 d = 13, τ = 60 n̄ = 8 n̄ = 8 n̄ = 8

Table 7: Parameters of the LWE-based standards [172, 171] and of FrodoKEM [17] that determine the conclusions. CBD is the centred binomial distribution; for ML-KEM, η1 governs the key-generation secret and error and the encryption secret r, and η2 the encryption errors e1 , e2 ; ML-DSA uses q = 8 380 417 and module rank (k, ℓ′ ), written (k, ℓ) in [171]; FrodoKEM’s matrix is unstructured and its error distribution approximates a rounded Gaussian of standard deviation σ. The column m/n gives the number of scalar samples per secret coordinate in a public key and, for KEMs, in the ciphertext component that is an LWE instance in the fresh secret (u for ML-KEM, C1 for FrodoKEM); the other component carries the encoded message and is not an LWE sample in that secret. ML-KEM ciphertexts are compressed to du and dv bits per coefficient, and ML-DSA public keys omit the d low-order bits of t; both add deterministic noise and lower the gap estimates in the heuristic model of Table 10.

• ML-KEM ( H / H / H under HHS /HReg (f ) /HEDCP [ℓ]). A key publishes t = As + e and a ciphertext includes compressed u = A⊤ r + e1 and a message-bearing v [172]. The key and u each have m/n = 1; recovering r from u would decrypt the message. Their normalised heuristic gaps are about 0.3–0.4. An explicit finite-dimensional guarantee and the embedding promises are not established here. The printed Wen–Zheng certificate has no feasible width here (Theorem 5.2). • ML-DSA ( H / H / H ). Its public key supplies the high bits t1 of t = As1 + s2 and has m/n ∈ {1, 6/5, √ 8/7} [171]. Dropping thirteen bits lowers the published-key heuristic gap to about 0.3 d. The full-t rows describe a separate scenario in which t0 is supplied to the adversary. We do not derive this additional input from ordinary signatures. The dependence of hints on ct0 does not by itself give an efficient reconstruction algorithm for t0 . Conclusions for the published key therefore use the published-key rows; the full-t rows are reported only as conditional sensitivity estimates. The Module-SIS norm comparisons in Table 9 concern a proof assumption, and do not themselves yield a forgery. • FN-DSA (Falcon, / / ). The power-of-two cyclotomic key lattice has λ2 = λ1 , so it does not meet the ordinary-uSVP promise (Theorem 7.1). The lossiness connection does not supply a verified deployed key attack, and the displayed sampler norm calculation does not certify the proof’s SIS bound (Sections 7.1 and 7.3). • FrodoKEM ( H / H / ). The sufficient embedding comparison is unresolved; the restricted unstructured ball construction gives no certificate for its square-matrix instances (Section 6.1). 61

• SLH-DSA ( / / ) has no lattice dependency [173]. XMSS and LMS share that property [85]; HQC is a code-based KEM selected by NIST [4, 174]. For the few-sample Module-LWE instances considered here, the unstructured compositions do not furnish a deployed-parameter attack certificate. The printed structured forward certificate is audited in Section 5 and gives no certificate at the ML-KEM ring and modulus; the polynomial-modulus adapter and conversions for deployed distributions remain unverified here. The embedding estimates also require a finite-dimensional reduction guarantee and a justified gap estimate. These are limits of the present classification, not a proof of security or a measured security margin.

7

Other lattice assumptions: reach and limitations

This section examines SIS at small norm bounds, CVP-based encryption, NTRU and lattice isomorphism. Each presents additional requirements or limitations for the compositions of Theorem 4.17. For NTRU, the obstruction to an ordinary-uSVP promise depends on the key ring and its symmetries. Few-sample LWE and Module-LWE are treated in Sections 6 and 7.5. The absence of a certificate from these routes supplies neither a separation nor positive evidence of hardness. Table 8 summarises the conclusions of this section.

7.1

SIS and Module-SIS

Three regimes. Recall from Section 2.5 that SISn,m,q,β asks for a nonzero z ∈ Λ⊥ q (A) with ∥z∥ ≤ β, an absolute length, and that for uniform A with m ≥ 2n lg q the lattice Λ⊥ q (A) has √ √ λm ≤ 2m ω( log m) (Theorems 4.8 and 4.10). Under the modulus, matrix, sample and norm conditions of the cited propositions, we compare two sufficient bounds. Their asymptotic forms suppress constants and logarithms; they are not sharp finite-dimensional thresholds. The first is the norm βcol above which SIS instances are solved: βReg (m) = O(m3/2+2f ) under HReg (f ) 3/2 ) under H e (Theorem 4.20), βE (n, m, ℓ) = O(ℓn EDCP [ℓ] for m = Θ(n log q) (Theorem 4.25), and ⋆ the smaller of the two under H . The second is the norm βvoid above which the stated worst-case hardness premise becomes unavailable, because [166, 165] base SISβ on SIVPβ·O( e √n) and that √ 3/2 ) under e n), which is O(n e 1+2f ) under HReg (f ), O(ℓn e problem has become easy: βvoid := γ ⋆ /O( ⋆ HEDCP [ℓ], and the smaller of the two under H . With those qualifications, the following three cases organise the sufficient guarantees. 1. β ≥ βcol :

Certified. The SIS instance is solved.

2. βvoid ≤ β < βcol : Conditional. The stated direct SIS algorithm supplies no certificate, while the cited worst-case hardness premise becomes unavailable. The reduction remains mathematically valid; other hardness evidence is not excluded. 3. β < βvoid : Open. Neither guarantee is reached by these comparisons; this does not prove the instance or its foundation hard. √ Under HReg (f ), the displayed asymptotic bounds differ by about n, before accounting for suppressed factors and side conditions. Under HEDCP [ℓ] alone, for uniform A with Θ(n log q) 3/2 ), e columns (a wider matrix can be restricted to that many columns), both thresholds are O(ℓn at least about n5/2 by Theorem 4.23, so their displayed orders coincide up to polylogarithmic factors. This comparison neither fixes a finite-dimensional boundary nor proves hardness below √ it. SIS with norm bound β and LWE with noise rate α ≈ m/β rest on the same worst-case e e √n β) [201, 166, 165], and Theorem 4.25, following [216], problem, SIVP within O(n/α) = O( √ √ turns an LWE solver at noise rate α into a SIS solver at norm m/( 2 α); the proposition 62

Assumption or scheme

HHS HReg (f ) HEDCP Reason or remaining check

SIS, β ≥ βcol

R

R

R

SIS, βvoid ≤ β < βcol

R

R

R

SIS, β < βvoid SIS-only primitives (Ajtai’s function, GPV signatures) ML-DSA (Module-LWE key; Module-SIS proof assumption)

H

H

H

FN-DSA (Falcon)

GGH-type encryption NTRU-HPS, NTRU-HRSS, Streamlined NTRU Prime

LIP-based schemes (e.g. Hawk)

ML-KEM, FrodoKEM (keys, ciphertexts)

as in Section 6.7

Solved under the modulus, matrix, sample and norm conditions of Theorems 4.20 and 4.25: βReg (m) = O(m3/2+2f ); e 3/2 ) for m = Θ(n log q). Under HHS , substitute fA . βE = O(ℓn For a scheme this is kind (B), which does not by itself give a forgery. Kind (C): SIVPβ·O e(√n) , the worst-case premise of [166, 165], is

e 1+2f ) solved, but no SIS algorithm is certified; βvoid = O(n under HReg (f ). Under HEDCP [ℓ] the two thresholds coincide up to polylogarithmic factors. Neither guarantee is reached; the DCP–SIS question at small norm bounds is open in both directions (Theorem 10.3). √ e Third regime: β = m for Ajtai’s function and O(n) for GPV signatures with the trapdoors of [164], a margin of about n2f under HReg (f ). SWIFFT’s collisions also have coefficients in {−1, 0, 1}, but its matrix is ring-structured, outside the uniform-matrix thresholds. √ Published-key gap about 0.3 D (Table 10). Module-SIS (SUF): heuristic comparison c0 ≲ 0.6–0.7 at f → 0+ (Table 9), kind (B). Under HEDCP the glyph rests on the key; for Module-SIS neither Theorem 4.25 nor the audited Wen–Zheng route supplies a certificate (Section 5). λ2 = λ1 excludes the ordinary-uSVP route (Theorem 7.1); the estimated typical norm of the quantum-step samples exceeds the proof’s SIS bound even at γu = 1 (our norm-model estimate, Table 9), so it certifies no solution at that bound; the lossiness connection gives no verified key attack. The BDD gap is a small constant rather than γu ; no worst-case foundation, and classical breaks of GGH encryption [177] and of GGH signatures [178]. Glyphs: key recovery and decryption, not established by these reductions. For keys, rotations exclude an ordinary-uSVP √ promise above 1 for xn − 1 (keys not fixed by x) and above 3 for NTRU Prime (Theorem 7.1); density ratios are not uSVP gaps (Table 10). Decision NTRU: conditional gap-based and lossiness routes (Theorem 7.2), neither certified here for deployed parameters. Overstretched NTRU: independent classical attacks [10, 139]. For the class of Zn , no ordinary-uSVP promise above one, and the guarantee of a polynomial-factor SIVP oracle alone does not recover an exact isometry; these observations concern that class, and the compositions give no general attack certificate. Hawk has been withdrawn [176]; the structural attack of [217] reduces its key recovery to exact SVP in dimension n/2 + 1, which the polynomial-factor guarantees do not solve automatically. Normalised heuristic gaps 0.28–0.85 at f → 0+ , c0 = 1 for ML-KEM keys and u and FrodoKEM keys; the restricted ball construction gives no certificate (Table 10).

Table 8: Summary of the conclusions of this section under each hypothesis, with all stated parameter and promise conditions; glyphs and basis marks as in Table 6. SIS rows classify instances by their norm bound relative to the thresholds of Section 7.1. For SIS-based primitives a conclusion concerns the assumption of the security proof, kind (B), unless stated, and does not by itself give a forgery. No absence of a certificate asserts security or failure of all attacks.

63

certifies this connection when its full modulus, distribution, sample and norm conditions hold. Under HReg (f ) the band is wider because the direct SIVP algorithm of Theorem 4.19 is stronger, √ by a factor of about m, than the one obtained through LWE. Under H⋆ with ℓ ≈ n, the solution threshold is about nmin{3/2+2f, 5/2} and the worst-case-premise threshold about nmin{1+2f, 5/2} , up to logarithmic factors. Solving SIS is not forging. The regimes classify SIS instances, not schemes. For a primitive whose security proof reduces to SIS we distinguish three kinds of consequence, and conclusions on SIS-based primitives in this survey refer to the second unless we say otherwise. (A) Explicit attack: an algorithm that recovers keys, decrypts, forges signatures or finds collisions for the scheme as deployed. (B) Proof assumption solvable: the problem to which the security proof reduces, at the parameters of the proof, is solved (regime 1). The hardness premise is then unavailable, but an attack follows only if a solution of that norm and form is itself a break, which needs a reduction in the converse direction. (C) Guarantee no longer informative: the worst-case problem on which the assumption is based is solved (regime 2), while the assumption itself is not known to be. √ The gap between (A) and (B) is concrete. A SIS solution of norm m is a collision of Ajtai’s function only if it lies in {−1, 0, 1}m , and a forgery of a hash-and-sign signature needs a short preimage of a hashed target, that is, a solution of an inhomogeneous problem, which a solver for homogeneous SIS does not provide. A forger yields a SIS solution; a SIS solver does not, by itself, yield a forger. SIS-only primitives. The primitives whose security rests on SIS alone have norm bounds of very different sizes. Ajtai’s function fA (x) = Ax mod q on binary inputs x ∈ {0, 1}m has a collision-resistance reduction to the stated SIS assumption because a collision x ̸= x′ yields √ √ e √n) it is deep in z = x − x′ ∈ {−1, 0, 1}m with Az ≡ 0 and ∥z∥ ≤ m [6]; with β = m = O( the third regime. SWIFFT is a fast instantiation of the same idea over the ring Z257 [x]/(x64 + 1), compressing 1024 input bits through sixteen ring elements, with collisions again giving solutions with coefficients in {−1, 0, 1} [155]. Hash-and-sign signatures in the style of Gentry, Peikert and Vaikuntanathan sign a message by sampling, with a trapdoor, a short preimage x of the hashed message from a discrete Gaussian; a forgery, combined with the signer’s own preimage of the same hash, gives a SIS solution of norm about twice the signature bound [112]. With e √n) and the signature the trapdoors of Micciancio and Peikert [164] the Gaussian width is O( e bound O(n), so these signatures lie in the third regime: clearly under HEDCP [ℓ], whose thresholds are at least about n5/2 , and under HReg (f ) by a margin of n2f , up to logarithmic factors and constants. Lyubashevsky’s Fiat–Shamir with aborts reduces to SIS alone only when the public key is statistically close to uniform [153]; in practical instantiations, ML-DSA included, the key is only computationally hidden and its secrecy rests on Module-LWE. The deployed signatures. Table 9 compares estimated typical sampler norms with the bounds in the security proofs of FN-DSA and ML-DSA. The model replaces dual minima by Gaussian-heuristic values unless a known short vector invalidates that substitution. For Falcon, √ the dual contains the conjugate secret scaled by q −1 , of norm at most 1.17/ q ≈ 0.011 [108]. With γu = 1, the resulting typical ℓ2 norms are about 5.5 · 104 and 1.1 · 105 , versus proof bounds about 1.2 · 104 and 1.7 · 104 . The short vector in the dual invalidates the use of the larger Gaussian-heuristic dual minimum in this calculation. With the resulting dual bound, the displayed sampler’s estimated typical output norm exceeds the target bound even in the optimistic comparison γu = 1. Thus this norm 64

calculation does not certify a solution at the required bound. We do not claim an impossibility result for this sampler or for other attacks; that would require an appropriate bound on the probability of a useful short output. For ML-DSA the strong-unforgeability proof uses Module-SIS with the displayed ℓ∞ bounds [26, 171]. The model comparisons at c0 ≲ 0.6–0.7 are heuristic sufficient comparisons, not attack thresholds. Ordinary unforgeability also involves SelfTargetMSIS and the hash function. Under HEDCP [ℓ], Theorem 4.25’s uniform-matrix and sample premises do not certify these structured instances; the audited Wen–Zheng search-MLWE route does not supply a small-norm ModuleSIS solver (Section 5). A homogeneous SIS solution still does not supply an inhomogeneous hashed-target preimage or an actual forgery. Instance Falcon-512 (as SIS) Falcon-1024 (as SIS) ML-DSA-44 MSIS (SUF) ML-DSA-65 MSIS (SUF) ML-DSA-87 MSIS (SUF)

m 1024 2048 2304 3072 4096

n

λ1 (L∗ ) Required

512 ≤ 0.011 ℓ2 ≤ 11 668 1024 ≤ 0.011 ℓ2 ≤ 16 765 1024 0.0097 ℓ∞ ≤ 218.5 1536 0.0046 ℓ∞ ≤ 220 2048 0.0054 ℓ∞ ≤ 220

Heuristic comparison HReg , f → 0+ not certified not certified c0 ≲ 0.7 c0 ≲ 0.7 c0 ≲ 0.6

Open Open ConditionalH ConditionalH ConditionalH

Table 9: Heuristic reach of Theorem 4.20 on the lattice problems behind the security proofs of deployed signatures, for f → 0+ (our norm-model estimates; Falcon’s displayed dual-minimum upper bound comes from a known short vector). L∗ is the dual of the relevant q-ary lattice of dimension m with n constraints, normalised as in the proof of Theorem 4.20; with d = λ1 (L∗ )/(2γu (m + 1)), the √ the decoding distance ∗ quantum step produces samples of width w = 2m γu (m + 1)/λ1 (L ), and the last but one column gives the largest c0 for which their typical norm meets the required bound. “SUF” is strong unforgeability. A conclusion here is of kind (B): the assumption of the proof would be solvable, which does not by itself give a forgery. Falcon’s problem is inhomogeneous and structured and is treated, optimistically for the attacker, as homogeneous SIS with the bound 2β of the proof; for it, λ1 (L∗ ) is bounded by the conjugate of the secret key, not taken from the Gaussian heuristic (0.070 and 0.099), and “not certified” means that the estimated typical norm exceeds the bound even at γu (m + 1) = 1. This does not bound the probability of a useful short output or rule out other attacks.

Two caveats. First, many practical “SIS-based” schemes are SIS and LWE schemes: MLDSA’s public key is a Module-LWE sample, so key recovery is reached whenever that instance is (Section 7.5), whatever the status of Module-SIS. Second, the SIS-only constructions reviewed here supply hash functions, commitments and signatures; they do not establish a SIS-only KEM. This is a limit of the reviewed constructions, not an impossibility claim for encryption. For Module-SIS [150], the worst-case decoder can still be used, but the direct SIS propositions also require distribution and dual-minimum conditions. Uniform-matrix bounds do not transfer automatically to a structured matrix; the signature calculations above remain heuristic. The SIS∞ results. The algorithms of Chen, Liu and Zhandry for SIS∞ with very wide matrices, polynomial modulus and bound q/2 − O(1) [79] are sometimes cited as evidence that SIS is quantumly fragile. They concern a regime far from cryptographic SIS, pass through LWE with quantum auxiliary states rather than through DCP, and have been fully dequantised: Kothari, O’Donnell and Wu solve all the SIS∞ variants treated there with classical deterministic algorithms [142]. They are relevant here only as a reminder that the DCP–SIS question at small norm bounds is open in both directions (Theorem 10.3).

65

7.2

Unstructured CVP-based encryption

An early lattice-based public-key scheme designed for efficiency, by Goldreich, Goldwasser and Halevi (GGH), uses a “good” private basis, nearly orthogonal, and publishes a “bad” basis of the same lattice. A message is encoded as a lattice point v, and the ciphertext is c = v + e for a small error e with entries ±σ; the owner of the good basis decodes by Babai’s rounding, which succeeds because the error is small compared with the good basis [117]. A signature scheme follows the same pattern, signing a hashed message by finding a nearby lattice point. Nguyen showed that the encryption scheme leaks information: since every error entry is ±σ, the ciphertext determines the message modulo 2σ, and the remaining problem is a closest-vector instance with a much smaller error; with this observation he decrypted the authors’ challenge ciphertexts in dimensions up to 350 [177]. Nguyen and Regev later showed that GGH and NTRUSign signatures leak the shape of the secret basis, each signature is a point in a hidden parallelepiped, which can be learned from enough of them, and recovered secret keys experimentally [178]. This is the attack that hash-and-sign schemes with Gaussian sampling [112] were designed to avoid. Under H⋆ , GGH decryption is a BDD instance whose gap is fixed by the quality of the private basis. For the nearly orthogonal private bases recommended by its authors, a scaled identity plus a small perturbation, and an error spread over all coordinates, the Euclidean gap λ1 /∥e∥ is a small constant rather than the polynomial factor γu ; decryption works because Babai’s rounding tolerates errors that are small in the coordinates of the private basis, not because the instance is a unique-SVP instance with a large gap. GGH-type encryption is therefore Open under all three hypotheses: outside the reach of the reductions, but with no worst-case foundation and with a record of classical breaks, which makes it an unattractive candidate.

7.3

NTRU and NTRU Prime

The schemes. NTRU (Section 2.7) is used in three forms. NTRU-HPS and NTRU-HRSS, merged as the NTRU submission to the NIST process, use Zq [x]/(xn − 1) with q a power of two and ternary keys; Streamlined NTRU Prime uses the field Q[x]/(xp − x − 1) of prime degree with a large Galois group, to avoid algebraic structure that attacks might exploit, and NTRU LPRime is the corresponding Ring-LWE-style variant [41]; and Falcon, selected by NIST for standardisation as FN-DSA (FIPS 206, in preparation), uses NTRU lattices over Z[x]/(xn + 1) with q = 12289 as the basis of a hash-and-sign signature with fast Fourier sampling [108]. No unique shortest vector. NTRU key recovery asks for a short vector of the lattice Lh := {(u, v) ∈ R2 : uh ≡ v (mod q)}, which contains the secret key (f, g). It is tempting to √ read it as a unique-SVP instance with gap gh(Lh )/∥(f, g)∥ = Θ( q/σ), but Lh is an R-module, and multiplication by x maps the key to other lattice vectors that are as short, or almost as short. Lemma 7.1 (Rotations of NTRU keys). Let R = Z[x]/(Φ) with Φ monic and irreducible over Q of degree n ≥ 2, and let L ⊆ Rk be a nonzero R-submodule, viewed as a lattice through the coefficient embedding. For every nonzero v ∈ L, the vectors v, xv, . . . , xn−1 v lie in L and are linearly independent. (a) If Φ = xn + 1, they all have norm ∥v∥; hence λ1 (L) = λ2 (L) = · · · = λn (L). √ √ (b) If Φ = xp − x − 1, then ∥xv∥ ≤ 3 ∥v∥; hence λ2 (L) ≤ 3 λ1 (L). In particular, the NTRU lattice Lh of Falcon’s ring √ or of NTRU Prime’s field is never a γ-unique-SVP instance for γ > 1, respectively γ > 3, whatever h and q. Proof. L is closed under multiplication by x. If i<n ci xi v = 0 with c ∈ Qn not all zero, then c(x) v = 0 in (Q[x]/(Φ))k , a vector space over the field Q[x]/(Φ) in which c(x) ̸= 0 is P

66

invertible, so v = 0; this proves linear independence. (a) Multiplication by x sends the coefficient vector (a0 , . . . , an−1 ) of each component to (−an−1 , a0 , . . . , an−2 ), an isometry; applying it to a shortest nonzero vector gives n linearly independent vectors of norm λ1 . (b) Since xp = x + 1, multiplication by x sends (a0 , . . . , ap−1 ) to (ap−1 , a0 + ap−1 , a1 , . . . , ap−2 ), of squared norm at most ∥a∥2 + a20 + 2a2p−1 ≤ 3∥a∥2 , using (a0 + ap−1 )2 ≤ 2a20 + 2a2p−1 ; applying this to a shortest √ nonzero vector v gives a second, linearly independent vector of norm at most 3 λ1 . The observation is elementary, and folklore among cryptanalysts; we state it to identify an obstruction to the direct ordinary-uSVP route. For Z[x]/(xn − 1) with n an odd prime, used by NTRU-HPS and NTRU-HRSS, the ring is not a field, but multiplication by x is still a permutation of coefficients: if xv = λv for a nonzero v, then |λ| = 1; λ = −1 is impossible, since it would give v = xn v = −v; so every nonzero lattice vector not fixed by multiplication by x has a linearly independent rotation of the same norm. The Kannan embedding of an LWE, Ring-LWE or Module-LWE instance is not an R-module, its embedding coordinate is a single integer, so the rotation argument does not automatically obstruct those affine embeddings. For NTRU keys, the exact obstruction and excluded approximation factors depend on the ring, as specified above. Ordinary and module uniqueness. In a rank-two module, many short vectors may belong to one line over the number field while being linearly independent over Q. Ordinary Euclidean uniqueness and module uniqueness are therefore different promises. Felderhoff, Pellet-Mary and Stehlé study module-uSVP and its relation to NTRU, including reductions with ideal-SVP oracle requirements [104]. These results do not directly instantiate Regev’s ordinary-uSVP promise, but they are relevant to any proposed module-aware replacement for that route. For the power-of-two cyclotomic√NTRU lattice, Theorem 7.1 gives λ2 = λ1 . For the NTRU √ Prime lattice it instead gives λ2 ≤ 3 λ1 , excluding the ordinary γ-uSVP promise for γ > 3. The latter statement does not assert equality of the two minima or exclude every γ > 1. What the subfield attack does not supply. The attack of Albrecht, Bai and Ducas [10] concerns h = g/f mod q and uses the multiplicative norm NK/L (h) = NK/L (g)/NK/L (f ) mod q in a proper subfield. Their Theorem 2 requires coprimality of the normed ideals and a sufficient length separation; it recovers a multiple of the normed key, which must then be lifted. The asymptotic attack analysis uses Heuristic 1 to control the sizes of norms and inverse norms. As the authors emphasise in their introduction, the relative norm is not additive. It therefore does not turn As + e into a fresh lower-dimensional Module-LWE sample with a controlled additive error, and supplies neither the sample amplifier nor the modulus adapter missing from a deployed Wen–Zheng application. Its overstretched NTRU attacks are independent of the present DCP hypotheses and do not assert ordinary-uSVP uniqueness of a ring-generated short submodule. Reach. The direct ordinary-uSVP route is excluded √ for Falcon’s cyclotomic keys at factors above one and for NTRU Prime keys at factors above 3. The ratio gh(Lh )/∥(f, g)∥ in Table 10 is a density comparison, not that promise. A decision-NTRU distinguisher based on GapSVP could apply if the structured and uniform branches satisfy a proved length separation exceeding the available approximation bound; the displayed density estimates alone do not prove it. The Stehlé–Steinfeld variant [215] has a separate Ring-LWE ciphertext connection, again requiring the embedding or oracle promises. Overstretched NTRU has independent classical subfield and dense-sublattice attacks [10, 139]. None of these observations establishes deployed NTRU key recovery or decryption from the present hypotheses. The indirect Ring-LWE route. The lossiness reduction gives a possible route to decision NTRU through a search Ring-LWE solver, subject to its sample and width requirements. It does 67

not interpret (h, 0) as an ordinary Ring-LWE sample and does not recover an NTRU key. We have not established that the dihedral algorithms considered here meet those oracle requirements for a deployed NTRU distribution. Consequently this connection gives no deployed-parameter attack in the present analysis. The rotation obstruction to the direct ordinary-uSVP argument remains separate. The precise sufficient variant below separates the sample and width requirements from the rotation obstruction. Lemma 7.2. Let R be a ring whose additive group has an integral basis of rank d, let q ≥ 2, and use the Euclidean coefficient norm in that basis. Write Rq = R/qR and DR,w (e) ∝ exp(−π∥e∥2 /w2 ). Suppose a polynomial-time quantum algorithm O recovers a uniform s ∈ Rq with probability at least 1 − ε from t Ring-LWE samples (ai , ai s + ei ), where the ai are independent uniform elements of Rq and the ei are independent DR,w errors. Consider a distribution on tuples (a1 , . . . , at ) such that every tuple admits f, g1 , . . . , gt ∈ R with f ̸≡ 0 (mod qR), ai f = gi

(mod qR)

(1 ≤ i ≤ t),

t X

∥gi ∥2 ≤ B 2 .

i=1

The lossiness distinguisher below has, under ideal Gaussian sampling, a difference in acceptance probabilities between independent uniform ai and this distribution of at least 1 −ε− 2

r

πB . 8w

√ In particular, if w ≥ 2π B and ε ≤ 1/8, the advantage is at least 1/8. Efficient approximate Gaussian sampling preserves this conclusion up to its statistical error: joint sampling error at most ηsamp costs at most 2ηsamp in the advantage. Proof. Given (ai ), sample s uniformly and the errors independently as above, call O on (ai , ai s + ei )ti=1 , and accept exactly when its answer is s. Uniform inputs are accepted with probability at least 1 − ε. Fix a tuple satisfying the short-relation promise, and let P be the distribution of (s, e1 , . . . , et ). Define the translation T (s, e1 , . . . , et ) = (s + f mod qR, e1 − g1 , . . . , et − gt ). It preserves all pairs given to O, while changing the correct secret. Let P ′ = T∗ P . The uniform secret is invariant under translation. For the errors, symmetry gives zero mean and hence, using natural logarithms, π X DKL (P ∥P ′ ) = 2 ∥gi ∥2 . w i Pinsker’s inequality therefore gives ′

∆(P, P ) ≤

r

πB . 2w

Let u be the recovery probability under P . Under P ′ , the same observed pairs have the alternative target s + f , distinct from s. Thus the two recovery probabilities sum to at most one. They differ by at most ∆(P, P ′ ), implying u ≤ (1 + ∆(P, P ′ ))/2. Subtract this upper bound from the uniform-input acceptance probability. For a single public key the lemma supplies only t = 1: reusing h does not give independent √ uniform ai in the uniform branch. If each ∥gi ∥ ≤ B0 , the sufficient width is w ≥ 2πt B0 . A short-relation promise holding with probability 1 − η costs at most a further η in advantage. The conclusion is a decision distinguisher, not recovery of a denominator. 68

Conclusion. Deployed NTRU key recovery and decryption are not established by these reductions under any of the three hypotheses; they remain Open. The direct ordinary-uSVP √ obstruction is exact for power-of-two cyclotomics and excludes factors above 3 for NTRU Prime. Decision NTRU has conditional gap-based and lossiness routes, with their respective promises and oracle requirements; neither is certified here for deployed parameters. Overstretched NTRU has independent classical attacks [10, 139]. Module-uSVP and ideal-lattice algorithms remain relevant background [104, 99, 52, 87, 88, 191], without yielding the missing deployed key-recovery certificate.

7.4

The Lattice Isomorphism Problem

The problem. Two lattices are isomorphic if an orthogonal transformation maps one onto the other. Given bases B and B ′ = OBU with O orthogonal and U unimodular, the search Lattice Isomorphism Problem (LIP) asks for O, or equivalently for U . In the language of quadratic forms, which Ducas and van Woerden adopted because it removes the real-valued O from the picture, the Gram matrices Q = B ⊤ B and Q′ = B ′⊤ B ′ satisfy Q′ = U ⊤ QU , and LIP asks for U ∈ GLn (Z); the decision version asks whether two forms are equivalent [97]. Cryptography from LIP. Ducas and van Woerden defined an average-case distribution on an isomorphism class by sampling a basis through discrete Gaussian sampling, proved a worst-case to average-case reduction within a class, and built from LIP an identification scheme in the style of the graph-isomorphism protocol, a key encapsulation mechanism and a hash-and-sign signature scheme [97]. The idea of the KEM and of the signature is to hide a lattice with good decoding or sampling properties, for instance Zn or a remarkable lattice, behind a random isomorphism, so that the secret isomorphism gives the decoder and the public form does not. Bennett, Ganju, Peetathawatchai and Stephens-Davidowitz studied rotations of Zn specifically, the simplest case, with both algorithms and cryptographic constructions [37]. Hawk, by Ducas, Postlethwaite, Pulles and van Woerden, is a signature based on module LIP over power-of-two cyclotomics: the secret is a basis of a rank-two module isomorphic to Z2n , and signing requires only discrete Gaussian sampling over Z2n , which is simple and fast [95]. Reach. For the isomorphism class of Zn , every rotation has all successive minima equal. Such an instance supplies no ordinary-uSVP promise above one. The guarantee of a polynomial-factor SIVP oracle alone also does not recover an exact isometry. These observations concern this class, not all LIP instances, and do not exclude other reductions. We record LIP-based schemes as Open because the compositions established here provide no general attack certificate. The 2026 attack on Hawk. The concrete history is cautionary. Straznickas and Weis showed in July 2026 that key recovery for Hawk-n reduces in polynomial time to SVP in dimension n/2 + 1, by exploiting the structure of the power-of-two cyclotomic field; this lowers the estimated key-recovery cost from 2150 to 2108 for Hawk-512 and from 2288 to 2182 for Hawk-1024, and a Hawk-256 key was recovered in hours on a single server [217]. The attack does not apply to Falcon. NIST’s page for the third round of the additional-signature process, which had admitted Hawk in May [175], records that the submission team has withdrawn it [176]; the date of the team’s announcement, July 29, 2026, is taken from secondary reporting [125]. Two observations matter here. First, the attack targets the algebraic structure of the module instance, not LIP as such. Second, it reduces key recovery to exact SVP in half the dimension, the polynomial-factor guarantees of Theorem 4.17 do not automatically solve that exact problem. Thus this published attack does not by itself supply an additional efficient attack under H⋆ . The episode shows that structured instances of young assumptions need independent scrutiny before they can carry the weight that ML-KEM and ML-DSA would leave behind. 69

7.5

Heuristic gaps of deployed parameter sets

Sufficient certificates and heuristic comparisons. Fix a failure exponent f and a witnessing algorithm A. Let Γf,A (d) be an upper bound on a sufficient ordinary-uSVP promise for the resulting reduction. A key-recovery application requires that its embedded planted vector be shortest and that the actual gap exceed this bound. Failure to establish that inequality gives no certificate from this theorem; it does not prove failure of the algorithm on the instance. The model c0 d1/2+2f and the limit f → 0+ are used only for comparisons. The asymptotic constants and the starting dimension may depend on f and A. Gaussian-heuristic gaps are additional estimates. None of these comparisons is a necessary and sufficient cryptanalytic threshold. Method. Table 10 applies Theorem 4.29(a) to deployed parameter sets. For an instance with n secret coordinates of standard deviation σs and m samples with error standard deviation σe , the embedding lattice has exact dimension n + m + 1. We report D = n + m as the first-order dimension in the numerical table. After rescaling the secret coordinates, its first-order heuristic gap is q m/(n+m) , g ≈ n/(n+m) m/(n+m) √ σs σe 2πe which for keys with m = n and σs = σe = σ is q/(2πe)/σ. For ML-KEM ciphertexts we take the component u = A⊤ r + e1 alone: an instance with m = n samples in the fresh secret r, whose error is e1 plus the compression error, of variance about (q/2du )2 /12; with the rounding rules of [172] its exact variance is 0.92 for du = 10 and 0.38 for du = 11, the values we use. The component v is not an LWE sample in r, since it contains the encoded message, but recovering r from u decrypts it; for ML-DSA we give the gap both for the √ published key, where the dropped low bits t0 contribute an error of standard deviation 213 / 12, and for the full t. For NTRU keys the same formula, with secret f and error g, gives the ratio gh(Lh )/∥(f, g)∥, which is not a unique-SVP √ gap (Theorem 7.1); we list it to show √ how dense the planted sublattice is. The column g/ D compares the gap with the model D at f → 0+ and c0 = 1; it records the c0 comparison that would suffice within this heuristic model at f → 0+ , without certifying a finite-dimensional bound (the NTRU density ratios are not ordinary-uSVP gaps). These are first-order estimates: they ignore sublattice selection and other refinements that a real attacker would optimise, treat compression errors as independent noise, and are given to two significant digits because nothing in them is more precise. p

Interpretation. The tables give sufficient comparisons under explicit models, not necessary attack thresholds. The cyclic hypothesis HHS supplies polynomial-factor lattice algorithms, but the unknown witnessing solver leaves its quantitative factor unspecified. The structured certificate audit in Section 5 supplies no deployed attack; the remaining polynomial-modulus adapter questions are recorded in Theorem 10.10. An explicit Γf,A would resolve one input to the embedding comparison; actual gaps, distributions and sample availability remain to be checked. The FHE row is an illustrative parameter set, and the full-t ML-DSA rows assume extra input. NTRU’s density ratios do not remove its ring-dependent uniqueness obstruction. Absence of a certificate records the limits of this analysis.

70

Instance ML-KEM-512 key ML-KEM-768 key ML-KEM-1024 key ML-KEM-512 ctxt (u) ML-KEM-768 ctxt (u) ML-KEM-1024 ctxt (u) FrodoKEM-640 key FrodoKEM-976 key FrodoKEM-1344 key ML-DSA-44 key (t1 only) ML-DSA-65 key (t1 only) ML-DSA-87 key (t1 only) ML-DSA-44 full t supplied ML-DSA-65 full t supplied ML-DSA-87 full t supplied Falcon-512 key (NTRU) ‡ Falcon-1024 key (NTRU) ‡ sntrup761 key (NTRU Prime) ‡ FHE example RLWE key Many-sample, q=3329, σ=1

q 3329 3329 3329 3329 3329 3329 215 216 216 ≈ 223 ≈ 223 ≈ 223 ≈ 223 ≈ 223 ≈ 223 12289 12289 4591 2880 3329

√ g g/ D HReg (f )

D

1024 11 1536 14 2048 14 1024 11 1536 12 2048 13 1280 16 1952 27 2688 44 2048 12 2816 14 3840 16 2048 500 2816 560 3840 840 1024 6.6 2048 9.4 1522 23 216 ≈ 2436 ≫ n ≈ 800

0.36 Conditional Conditional 0.36 0.31 Conditional Conditional 0.33 0.30 Conditional 0.28 Conditional Conditional 0.44 0.61 Conditional Conditional 0.85 0.27 Conditional 0.26 Conditional Conditional 0.26 11 Conditional (f ≲ 0.15) 11 Conditional (f ≲ 0.15) Conditional (f ≲ 0.15) 14 0.21 Open 0.21 Open Open 0.59 ≫1 Conditional – n, f

Ball no cert. no cert. no cert. no cert. no cert. no cert. no cert. no cert. no cert. no cert. no cert. no cert. no cert. no cert. no cert. n/a n/a n/a no cert. no cert.

Table 10: First-order heuristic gap estimates and NTRU density ratios, with parameters from [172, 171, 17, 108, 41]. The dimension column is D = n + m; the exact affine embedding has dimension D + 1 and determinant τ q m (Theorem 4.29). Its exact gτ expression applies when the first-order approximation is √ unjustified. All numerical comparisons are conditional; g/ D is a model normalisation, not an attack threshold. Full-t rows assume that additional input is supplied; the displayed f range also assumes c0 = 1. “No cert.” means the restricted ball construction or its displayed width and noise bounds supply no certificate; it is not a claim about every construction in [61] or all EDCP algorithms; “n/a” means no direct application is made here. ‡: NTRU √ values are density ratios, not ordinary-uSVP gaps; Falcon has λ2 = λ1 , and NTRU Prime has λ2 ≤ 3λ1 . The FHE row is an illustrative parameter set with error standard deviation 3.2.

71

8

Alternatives outside lattices

Table 11 summarises this section. The common thread is one question that each family must answer: does a complete efficient reduction to the assumed coset-state problem exist, rather than just a hidden-shift subroutine? For each family we describe the underlying problem and the main constructions, representative classical and quantum attacks, and the reason for its conclusion.

8.1

Code-based cryptography

Decoding problems. A linear [n, k] code over Fq is a k-dimensional subspace C ⊆ Fnq , given (n−k)×n

by a generator matrix G ∈ Fk×n or a parity-check matrix H ∈ Fq with C = {c : Hc⊤ = 0}. q The syndrome decoding problem asks, given H, a syndrome s and a weight w, for an error e of Hamming weight w with He⊤ = s. Berlekamp, McEliece and van Tilborg proved its decision version NP-complete [38], whereas cryptographic security requires hardness of the particular average-case distribution. Worst-case NP-completeness alone does not establish average-case hardness for random codes, Goppa codes or deployed parameters. McEliece and Niederreiter. In McEliece’s 1978 cryptosystem the secret is a binary Goppa code, defined by a support and a Goppa polynomial of degree t over F2m , for which an efficient decoder corrects t errors; the public key is a disguised generator matrix Gpub = SGP with S invertible and P a permutation; a message µ is encrypted as c = µGpub + e with e of weight t, and decrypted by undoing P , decoding, and undoing S [159]. Niederreiter’s dual version publishes a disguised parity-check matrix and encrypts by encoding the message into the error vector, the ciphertext being its syndrome [179]. Classic McEliece, a modern instantiation, is a Niederreiter-style KEM with binary Goppa codes and a public key in systematic form; its smallest parameter set, mceliece348864, has n = 3488, m = 12 and t = 64, a public key of 261 120 bytes and a ciphertext of 96 bytes [11]. Classic McEliece was a fourth-round NIST candidate that NIST did not select [174]; it was standardised by ISO/IEC in June 2026 and has been recommended by the BSI since 2020, a recommendation now restricted (Section 8.2) [132, 68]. Information-set decoding. The generic attack on syndrome decoding goes back to Prange [195]: choose k coordinates at random, hope that the error vanishes on them, and solve the
n
resulting linear system; each attempt succeeds with probability n−k / t t , so the expected cost is exponential in t. Its refinements lower the exponent but keep the structure of a search over a large space of guesses. That structure is exactly what Grover’s algorithm accelerates: Bernstein showed that a Grover search over Prange’s guesses halves the exponent [40], and Kachigar and Tillich obtained small further gains from quantum walks applied to the advanced variants [136]. Until recently no structural attack came close: the best key recovery for Classic McEliece parameters, a brute-force search combined with Sendrier’s support splitting algorithm, cost more than 23000 even for the smallest parameter set [210, 68], and the security levels of the scheme were set by generic decoding [15]. Section 8.2 summarises the subsequent structural attacks and their evidential limits, which a companion paper analyses in detail [107]. Quantum Fourier sampling. In a code-equivalence formulation where both G and Gpub are supplied, recovering a hiding pair (S, P ) can be expressed as a hidden-subgroup problem over a group built from GLk (F2 ) and the symmetric group Sn . Dinh, Moore and Russell showed that, for well-permuted and well-scrambled codes, this hidden-subgroup problem cannot be solved by strong Fourier sampling, the measurement strategy behind the efficient abelian algorithms, or by any measurement of a single coset state, extending the negative results for graph isomorphism 72

Family (examples)

HHS HReg HEDCP Evidence

Goppa-code McEliece (Classic McEliece)

under revision †

Quasi-cyclic codes (HQC, BIKE)

moderate

LPN-based PKE (Alekhnovich)

moderate

Rank-metric codes (RYDE, Mirath) Lee-metric codes

moderate R

R

R

limited

Hash-based (SLH-DSA, XMSS, LMS) Symmetric ZK (FAEST, Picnic)

high

Multivariate (UOV, MAYO, QR-UOV, SNOVA; MQOM) Code-in-the-head (SDitH) Cyclic isogeny actions (CSIDH-type, CSI-FiSh)

moderate

Supersingular endomorphism ring (SQIsign) Higher-dimensional isogeny PKE (FESTA, POKÉ) Equivalence group actions (LESS, MEDS, ALTEQ)

high (AES)

high R

R

limited

moderate limited

Problem and cited attacks Decoding random linear codes (NP-hard in the worst case [38]); Grover-accelerated information-set decoding [40, 136]; the hiding resists strong Fourier sampling on single coset states [93]. Classical structural recovery estimates (per run 289 –2128 across cost models [224, 107]) depend on unverified structural premises, repetitions and the memory model (Section 8.2); small challenge recoveries are distinct evidence. Quasi-cyclic syndrome decoding; ISD with Grover. The algebraic structure is the analogue of ideal lattices and deserves monitoring. √ LPN at noise rate about 1/ n [16]; noisy binary dihedral cosets are LPN (Theorem 8.1), an equivalence rather than a barrier. Rank decoding, MinRank; the BDD-to-EDCP reduction of [69] is effective only where decoding is already easy. The Lee-metric connections to lattices and EDCP [69] require the stated metric, distribution, parameter and solver-domain promises; no family-wide conclusion follows. Second preimage and related properties; generic Grover and BHT benchmarks [118, 65, 39]. AES or LowMC relation plus hash, commitment and proof-transform assumptions; MPC- and VOLE-in-the-head [131, 75, 34]. MQ (NP-hard [110]) with trapdoor structure; Grover-enhanced algebraic attacks [45]. Structural breaks have been classical [47, 220]. Syndrome decoding of random codes [105]. Cyclic DCP via noiseless cosets, conditional on the complete action, public-input and coherent-evaluation requirements (Section 8.5) [82, 48]. Non-cyclic actions require Hab HS . Known subexponential attacks [143, 188]. The polynomial-modulus HEDCP does not supply this route. Endomorphism ring and isogeny path problems e 1/4 ) [50], [100, 226]; generic quantum attacks in time O(p claw finding [135]. Non-commutative isogeny problems with torsion information [33, 32]; young assumptions.

moderate to Code, matrix-code and trilinear-form equivalence. limited Measurement limitations are proved for specific symmetric-group and code-equivalence settings [168, 123, 93]; no corresponding general bound is established here for MEDS or ALTEQ.

Table 11: Non-lattice families under the three hypotheses; glyphs and basis marks as in Table 6. The glyph records no certificate from the analysed reductions, not security. The fifth column is a qualitative assessment of the cited evidence, not a security level or ranking: high, an extensively studied underlying problem with generic quantum benchmarks in the cited analyses; moderate, a studied problem with structured variants, algorithmic progress or breaks of related schemes; limited, a young assumption or known subexponential attack; under revision †, active structural attacks (Section 8.2). Primitive-specific assumptions and measurement-model qualifications remain essential.

73

to subgroups of arbitrary structure, including automorphism groups of codes [93], in line with the general limitations of coset states for Sn [168, 123] discussed in Section 9. That formulation supplies the hidden generator G as an additional input; it is not itself a key-recovery reduction from the McEliece public key alone. These results limit a class of measurements on coset states; they are not lower bounds against every quantum algorithm, and they do not by themselves establish quantum security. Quasi-cyclic codes: HQC and BIKE. HQC works in F2 [x]/(xn − 1) with n prime. The secret key is a pair of sparse polynomials (x, y) and the public key is (h, s = x + hy) for uniform h; to encrypt µ, one samples sparse r1 , r2 , e and sends u = r1 + hr2 and v = µG + sr2 + e, where G generates a public decodable code; the receiver computes v − uy = µG + (xr2 − r1 y + e), whose error term has low weight, and decodes [4]. Since the decoding code is public, security rests on the hardness of decoding random quasi-cyclic codes rather than on hiding a structured code. NIST selected HQC for standardisation in March 2025 [174], with a draft standard (FIPS 207) in preparation. BIKE uses quasi-cyclic moderate-density parity-check codes: the secret is a pair of sparse polynomials (h0 , h1 ), the public key is h = h1 h−1 0 , and decryption uses bit-flipping decoding, whose failure rate must be negligible for CCA security [21]; it was not selected [174]. The BSI notes that HQC is not affected by the 2024–2026 structural attacks on McEliece (Section 8.2) [68]. Quasi-cyclic codes are the code-based analogue of ideal lattices; no attack certificate is established by the DCP routes reviewed here, and structured decoding requires its own analysis (Section 10). LPN. Learning Parity with Noise, LPNn,τ , asks to recover s ∈ Fn2 from samples (a, ⟨a, s⟩ + ϵ) with uniform a and Bernoulli noise ϵ of rate τ ; it is the binary analogue of LWE and the average-case form of decoding a random linear code. Alekhnovich built public-key encryption √ from LPN with noise rate about 1/ n [16]. Brakerski, Lyubashevsky, Vaikuntanathan and Wichs gave a worst-case hardness result for LPN, through a smoothing lemma for codes: a worst-case nearest-codeword problem for balanced codes, with relative error about log2 n/n, can be solved with an LPN distinguisher at the very high noise rate 1/2 − 1/poly(n); the worst-case problem is only mildly hard, it has a quasi-polynomial algorithm and lies in Search-BPPSZK , and LPN at noise rate 1/2 − 1/poly(n) already implies symmetric cryptography. They also showed that LPN with the very low noise rate log2 (n)/n implies collision-resistant hash functions [63]. These results give the code-based family a foundation independent of lattices at the extremes of the noise range, but not a worst-case foundation for the noise rates used by public-key encryption. The dihedral route beyond lattices. The q-ary lattice of an LPN instance contains 2Zm , √ so its minimum is at most 2 while the error has norm Θ( τ m); when τ m grows, this typically violates the small-radius Euclidean BDD promise used here. This embedding therefore supplies no certificate from Theorem 4.17. The dihedral route is nevertheless not intrinsically latticespecific. Debris-Alazard, Remaud and Tillich gave a quantum reduction from finding short codewords in a random linear code to decoding, by adapting to the Hamming metric the reading of Regev’s quantum step as a reduction from short vectors to closest vectors [90]; the coarser metric required decoding beyond the unique-decoding radius, errors uniform of fixed weight instead of Bernoulli, and an analysis with orthogonal polynomials. In September 2026 Cartor, Manganiello and Youmans gave a general quantum reduction from BDD over finite abelian groups with translation-invariant metrics to EDCP, using locality-sensitive hashing to play the role of Regev’s partition into cubes; they instantiated it for the Hamming, rank and p-Lee metrics and recovered the LWE-to-EDCP reduction through the equivalence between lattice problems and Lee-metric decoding [69]. The authors note that for the Hamming and rank metrics their reductions yield a non-negligible number of EDCP states only in parameter regimes where known decoding algorithms are already efficient. These instantiations supply no attack certificate for 74

cryptographic Hamming- or rank-metric parameters here. The Lee-metric connection must be matched to the exact metric, distributions, parameters and EDCP solver domain before transferring a lattice consequence. The following lemma describes what a dihedral problem over a binary group amounts to, in one natural noise model. Lemma 8.1 (Binary dihedral cosets are LPN). Over the group Fn2 , consider the dihedral coset problem in which each register is, independently, with probability 1 − τ a good register √1 (|0, y⟩ + |1, y + s⟩) with uniformly random y, and with probability τ a uniformly random 2 computational-basis state |b, x⟩. This problem is equivalent, under quantum polynomial-time reductions in both directions, to search-LPNn,τ /2 . In particular the noiseless problem (τ = 0) is solved by Simon’s algorithm [213]. Proof. Write |ĉ, ẑ⟩ := H ⊗(n+1) |c, z⟩. Expanding a
good register in this basis, the coefficient of |ĉ, ẑ⟩ is proportional to (−1)⟨z,y⟩ 1 + (−1)c+⟨z,s⟩ . Averaging over uniform y kills every off′ diagonal term between distinct z, z ′ , since it carries the phase (−1)⟨z⊕z ,y⟩ ; hence the density matrix of a good register is the classical mixture of |ĉ, ẑ⟩ with z uniform and c = ⟨z, s⟩. A bad register is maximally mixed, i.e. the uniform mixture over all |ĉ, ẑ⟩, for which c = ⟨z, s⟩ P with probability 1/2. Each register is therefore exactly the mixture z,c Pr[z, c] |ĉ, ẑ⟩⟨ĉ, ẑ| with (z, c) distributed as an LPN sample of noise rate τ /2. Measuring in the Hadamard basis turns registers into LPN samples, and preparing |ĉ, ẑ⟩ from an LPN sample (z, c) turns samples into registers with the correct density matrix; both maps are efficient. For τ = 0, n + O(1) samples determine s by linear algebra. The lemma is an equivalence, not a barrier. In its noise model, uniform independent offsets and maximally mixed bad registers; adversarial bad registers are not covered, a noise-tolerant dihedral algorithm over Fn2 is an LPN algorithm and conversely, and the noiseless problem is easy. It says nothing about whether LPN or decoding is hard, and it does not exclude attacks on binary codes through reductions of another kind. What it shows is narrower: this noisy binary-coset formulation supplies no attack without an LPN solver, so a reduction from binary decoding to a dihedral problem over Fn2 would lead back to a decoding problem. The hypotheses of Section 4.1 specify cyclic coset-state or Gaussian extrapolated-state interfaces; they do not automatically provide this noisy binary solver. The surveyed reductions supply no attack certificate for the cryptographic Hamming-decoding regimes considered [69]. We therefore record no DCP-based certificate for Classic McEliece, HQC or BIKE here. Their independent attack analyses remain necessary (Table 11). Rank and Lee metrics. Rank-metric codes are subspaces of Fnqm whose vectors are viewed as m×n matrices over Fq , with the rank as weight; their decoding problem and the related MinRank problem underlie the signature schemes RYDE and Mirath, second-round candidates of the additional-signature process that did not advance to the third round [175]. As noted above, the reduction of [69] reaches rank-metric decoding only in easy regimes, so these assumptions remain outside the reach. The Lee-metric connections are conditional on the metric, distributions and parameter promises of [69]; their applicability must be checked for each proposed cryptographic instance ( Conditional). Code-based signatures. Syndrome Decoding in the Head, by Feneuil, Joux and Rivain, is a Fiat–Shamir signature from a zero-knowledge proof of knowledge of a syndrome-decoding solution, built with the MPC-in-the-head technique described in Section 8.3 [105]; it is a third-round candidate [175].

75

8.2

Classic McEliece: structural cryptanalysis and current status

Between 2024 and October 2026 the structural cryptanalysis of McEliece with binary Goppa codes moved further, at the parameters of Classic McEliece, than in the previous four decades. A companion paper [107] analyses these works in detail, version by version; here we summarise what matters for the classification. The attacks are classical attacks on the hidden Goppa description, not applications of a DCP solver; none uses a hidden-shift structure, so none changes a classification of this survey. They bear, however, on the independent evidence recorded for Classic McEliece in Table 11. What has been shown. Randriambololona’s syzygy distinguisher is asymptotically subexponential in the error-correcting capacity t [197, 68]. The higher-order-vanishing distinguisher of Hemmert and Wiemers led to key recoveries by Hemmert and by Saarinen’s HOVER algorithm, which solved public TII challenges up to TII-252 without threatening Classic McEliece parameters [127, 126, 207]. A Pfaffian attack breaks very high-rate Goppa codes, including the CFS signature scheme, but does not apply at the rates of Classic McEliece [31, 68], and a heuristic key recovery conjectured to be subexponential remains far above the targets, its distinguishing step alone costing about 2454 at level 1 [66, 224]. The Holdout/Hermite distinguisher of Ghoshal, Ishai, Jain and Sun is quasi-polynomial in the asymptotic Classic McEliece regime, at an estimated 2114 –2124 bit operations for the five parameter sets [114], and the lowest estimates for key recovery rest on it. Saarinen’s itemised conditional costing gives 2126.8 –2145.2 bit operations in a model that excludes memory traffic [206]. Weis estimates one run of the underlying sparse linear algebra at 289 –298 bit operations, at 2107 –2117 when each operation is charged the square root of the memory it addresses, and at 2117 –2128 under the rule of the Classic McEliece security guide, with one run or 103 to 1443 runs per key recovery [224]; Vedenev’s revision of October 7 reports conditional estimates of 289.9 –298.6 [222]. Public challenges with brute-force labels up to 254 have been solved along the way [31, 126, 207, 224, 222, 208]; these labels are brute-force work factors, not security levels. What has not been shown. No key recovery has been run at a Classic McEliece size. The lowest estimates rest on heuristic assumptions, on kernel dimensions, the span of gradients, the structure of a column kernel and the behaviour of the iterative solver, tested on instances with at most about 107 unknowns, whereas a full-size run has 238 to 242 . For one and the same run, the published figures differ by about thirty bits between cost models, and a run would need 100 TiB to 1.5 PiB of memory and, on a mesh at 109 steps per second, between 7 and 420 years [224]. Against Grover-accelerated information-set decoding, about 2101 to 2183 logical gates for the five sets [40, 224], the conditional structural estimates are lower for the four larger sets in essentially every cost model and comparable for mceliece348864; Weis knows of no quantum speed-up for the structural computation [224]. Standardisation and guidance. NIST did not select Classic McEliece [174]; ISO/IEC standardised selected parameter sets in June 2026, excluding mceliece348864 [132, 84]. In its note of 29 September 2026 the BSI records that the published results do not yet enable a practical attack on its recommended parameter sets. It nevertheless advises against Classic McEliece in new developments, recommends FrodoKEM, ML-KEM or, once its standard is published, HQC for key agreement, limits the current recommendation for Classic McEliece to hybrid use with a classical scheme, and expects to revise it in early 2027; it states that FrodoKEM, ML-KEM and HQC are not affected by these results [68]. A classical component can preserve a classical security guarantee if the combiner has the required property; it alone cannot provide a post-quantum guarantee against Shor’s algorithm.

76

How the evidence fits together. Table 12 separates the questions that are easily conflated. Evidence

What it supports

What remains separate

GIJS distinguisher [114] HOVER and TII recoveries [207, 208, 224, 222] Full-size cost analyses [206, 224, 222] Fourier-sampling limitations [93]

Recognition of Goppa public keys in the stated asymptotic regime. Demonstrated recovery of particular small public challenge keys.

Efficient decryption and equivalent-key recovery need additional arguments. Success and resources for a Classic McEliece parameter distribution.

Conditional arithmetic estimates for specified algorithms.

Structural success, repetitions, memory costs and implementation validation.

Limits on specified quantum measurements in a code-equivalence formulation. A dated deployment recommendation responding to the developing evidence.

Security against classical structure recovery or arbitrary quantum algorithms. A practical key-recovery demonstration or a general security theorem.

BSI guidance [68]

Table 12: Evidence categories for Classic McEliece, as checked on October 11, 2026. No row by itself settles the other questions.

Conclusion. We retain Outside reach † . The surveyed DCP reductions supply no attack certificate for Classic McEliece (Section 8.1, with Theorem 8.1 and the discussion following it). What changes is the independent evidence recorded in the fifth column of Table 11: the lowest published estimates are no longer those of generic decoding with a Grover speed-up but those of classical structural attacks whose concrete cost is under revision, and the dagger in Tables 11 and 13 records exactly this. This is neither an endorsement for new deployment nor a claim of a practical full-size break. Two consequences follow for the rest of the survey. First, the KEM layer of a post-DCP world becomes thinner: among standardised and standard-track KEMs, HQC, whose decoding code is public and whose security rests on decoding random quasi-cyclic codes, is the code-based KEM outside the reach of the counterfactual that, according to the BSI, is not affected by these attacks [68]. This raises the stakes of Theorem 10.7; HQC still needs its own security analysis, since its lack of exposure to these particular Goppa attacks is not a blanket security guarantee. FrodoKEM and ML-KEM keep the status given in Section 6.7. Second, the hybrid designs of Section 10.2 would take HQC as the code-based component to analyse first, with Classic McEliece used, if at all, as an additional component pending re-evaluation, in line with the BSI’s advice. The episode also illustrates again a lesson of Section 1.2: weaknesses have appeared where algebraic structure is hidden, in ideal lattices, in overstretched NTRU (Section 7.3), and now in the Goppa structure of McEliece, and step 9 of the scenario-planning checklist (Table 14) is not a formality.

8.3

Hash-based and symmetric-key signatures

One-time and few-time signatures. Lamport’s one-time signature takes as secret key 2ℓ random strings xi,b and as public key their images yi,b = H(xi,b ); a message digest d ∈ {0, 1}ℓ is signed by revealing xi,di for each i [149]. A key can be used once. Winternitz-type schemes replace the 2ℓ strings by hash chains, trading signature size for computation; WOTS+ adds randomising bitmasks so that collision resistance of the hash function is not needed [129]. Merkle trees. Merkle authenticated 2h one-time public keys with a binary hash tree whose root is the long-term public key; a signature consists of a one-time signature and the authentication path of its leaf [161]. The resulting schemes are stateful: the signer must never reuse a leaf. 77

XMSS [130] and LMS [160] are standardised stateful schemes, approved by NIST together with requirements on state management [85]. Stateless signatures: SPHINCS+ and SLH-DSA. SPHINCS removed the state by using a hypertree of Merkle trees, a pseudorandomly chosen leaf for each message, and a few-time signature at the bottom [42]; SPHINCS+ improved it with the FORS few-time scheme and tweakable hash functions [43]. FIPS 205 standardises it as SLH-DSA, with SHA-2 and SHAKE instantiations at three security levels, each in a “small” and a “fast” variant; at level 1 the public key has 32 bytes and signatures 7 856 bytes (small) or 17 088 bytes (fast) [173]. Security reduces to properties of the hash function, pseudorandomness, second-preimage resistance and related properties of tweakable hashes, without a lattice or class-group hardness premise. Quantum attacks. Generic quantum attack benchmarks for hash functions include the following: Grover search finds preimages in about 2n/2 evaluations [118], and the Brassard–Høyer– Tapp algorithm finds collisions in about 2n/3 evaluations using comparable quantum-accessible memory [65]. Bernstein argued that, once hardware costs are accounted for, the latter is no better than parallel classical collision search [39]. These benchmarks do not use a DCP oracle. The reductions analysed here establish no additional hash attack; this does not rule out attacks exploiting a particular hash function or future algorithms. Signatures from symmetric primitives. The MPC-in-the-head paradigm of Ishai, Kushilevitz, Ostrovsky and Sahai turns a secure multiparty computation of a relation into a zeroknowledge proof: the prover simulates the parties “in its head”, commits to their views, and opens a subset chosen by the verifier [131]. Applied to the relation y = Ek (x) for a block cipher E, with Fiat–Shamir, it yields signatures based on the one-wayness of k 7→ Ek (x) together with the commitment, hash and proof-transform assumptions: Picnic used LowMC [75], and FAEST uses AES with the more efficient VOLE-in-the-head technique [34]. FAEST, MQOM (the same paradigm for multivariate quadratic systems) and SDitH are third-round candidates [175]. The encryption question. The signature constructions discussed here do not supply a KEM. Merkle-puzzle key agreement illustrates a restricted query-complexity gap, whose quantum treatment depends on the access model [64]; it is not an impossibility theorem for every construction using symmetric primitives. This survey establishes no KEM based solely on the one-wayness premise used by these signatures.

8.4

Multivariate cryptography

The MQ problem and its trapdoors. Multivariate schemes rely on the problem of solving a system of m quadratic equations in n variables over a finite field (MQ), which is NP-hard in the worst case [110]. A trapdoor is introduced by composing an easily invertible quadratic map F with secret affine maps, P = T ◦ F ◦ S. In Patarin’s oil-and-vinegar construction the variables are split into “oil” and “vinegar” variables and the central polynomials contain no oil×oil terms, so that fixing the vinegar variables leaves a linear system in the oil variables [184]. Kipnis and Shamir broke the balanced version, with as many oil as vinegar variables, by recovering the hidden oil subspace [138]; Kipnis, Patarin and Goubin proposed the unbalanced version, UOV, with more vinegar than oil variables, which has resisted for over twenty-five years [137]. The record of the family. The failures of the family are instructive. Rainbow, a multi-layer version of UOV [92] and a NIST finalist, was broken by Beullens with a key-recovery attack that takes about a weekend on a laptop at security level 1 [47]. HFE uses a low-degree univariate central map over an extension field [183]. Tao, Petzoldt and Ding give key-recovery attacks on 78

the HFE variants analysed in [220]; this does not justify a blanket claim about every HFE-based signature or parameter set. These attacks and the Rainbow break exploit structure classically. The candidates considered here include UOV and compact variants: MAYO, which uses a small oil space and recovers invertibility by “whipping” the public map into several copies [46], QR-UOV and SNOVA, all third-round candidates together with MQOM [175]. Quantum attacks. The cited quantum improvements include Grover-enhanced algebraic methods, which accelerate the exhaustive-search component of hybrid Gröbner-basis and linearisation attacks [45]. The reviewed routes give no DCP-based attack certificate. They also do not establish a multivariate KEM as a replacement for the schemes compared here.

8.5

Isogenies: commutative versus non-commutative

The relevant distinction is between complete action-based reductions and attacks that contain only a hidden-shift subroutine. Calling a construction commutative or non-commutative does not alone verify either its applicability or its resistance to a DCP solver. Background. An isogeny is a non-constant morphism between elliptic curves that preserves the point at infinity; a separable isogeny is determined, up to isomorphism of the target, by its finite kernel, and Vélu’s formulas compute it in time polynomial in the kernel size. The endomorphism ring of an elliptic curve over a finite field is either an order in an imaginary quadratic field (ordinary curves, and the Fp -rational endomorphisms of supersingular curves over Fp ) or a maximal order in the quaternion algebra ramified at p and ∞ (supersingular curves over Fp2 ). The first case carries a commutative group action; the second does not. Commutative group actions. When the relevant endomorphism ring is an order O in an imaginary quadratic field, the class group cl(O) acts freely and transitively on the curves with that ring: an ideal class [a] maps E to the target of the isogeny with kernel E[a]. Couveignes [86] and Rostovtsev and Stolbunov [204] proposed Diffie–Hellman key exchange from this “hard homogeneous space” on ordinary curves. CSIDH made it efficient with supersingular curves over Fp : for p = 4ℓ1 · · · ℓn − 1 with small odd primes ℓi , the ideals above ℓi act through ℓi -isogenies computable over Fp , a secret key is an exponent vector (e1 , . . . , en ) in a small box, and the public key is the curve [le11 · · · lenn ] ⋆ E0 , represented by one coefficient of a Montgomery equation [71]. CSIDH-512 uses n = 74 primes and exponents in [−5, 5], with 64-byte public keys. Alamati, De Feo, Montgomery and Patranabis abstracted the properties such actions provide into a framework of cryptographic group actions and built further primitives on it [9]. Beullens, Kleinjung and Vercauteren computed the class group of the CSIDH-512 order, it is cyclic, of order roughly √ p, together with a reduced basis of its relation lattice, which gives every class a canonical representation and makes Fiat–Shamir signatures with uniformly random challenges possible (CSI-FiSh) [48]. Quantum attacks: a hidden shift. Childs, Jao and Soukharev observed that recovering the class [a] with E ′ = [a] ⋆ E is an abelian hidden shift problem: the functions x 7→ x ⋆ E and x 7→ x ⋆ E ′ on the class group differ by a shift by [a]. With Kuperberg’s or Regev’s sieve this gives a subexponential quantum algorithm, under the generalised Riemann hypothesis for the evaluation of the action [82]. This attack supplies a concrete quantum benchmark for CSIDH, analysed by Bonnetain and Schrottenloher [55] and, with Kuperberg’s collimation sieve, by Peikert, who estimated that CSIDH-512 key recovery needs only about 216 quantum evaluations of the group action using 240 bits of quantumly accessible classical memory, which challenges the level-1 estimate under that evaluation and memory model; an evaluation count is not an end-to-end gate or hardware cost [188]; the cost of a single quantum evaluation of the action was 79

analysed by Bernstein, Lange, Martindale and Panny [44]. Since the CSIDH-512 class group is cyclic [48], coset sampling turns its key recovery into a cyclic DCP instance with perfect coset states (Theorem 4.6), so it is covered by HHS when the complete evaluation and public-input conditions below are met. Actions satisfying the evaluation hypotheses. The hidden-shift argument applies to free and transitive actions with an efficiently available group decomposition and efficient coherent evaluation on arbitrary group elements, using a consistent encoding of the acted-on objects. The inputs required by the evaluation algorithm must be public or efficiently recoverable from the public instance. For example, the cited Clapoti result assumes an effective primitive orientation [182]. The application must verify this requirement, as well as the relevant cyclic or general abelian group hypothesis. We therefore state the consequence for actions satisfying these conditions, rather than for every construction described as commutative. SIDH and its break. The Supersingular Isogeny Diffie–Hellman protocol of Jao and De Feo avoided commutativity: each party computes a secret isogeny of smooth degree from a fixed supersingular curve and publishes its target together with the images of a basis of a torsion subgroup, which the other party needs to complete the exchange [134]. Its KEM, SIKE, reached the fourth round of the NIST process. In 2022 it was broken classically: Castryck and Decru recovered keys in polynomial time when the starting curve has a known endomorphism ring, Maino, Martindale, Panny, Pope and Wesolowski gave a direct attack, and Robert extended the attack to polynomial time for every starting curve [70, 158, 202]. All three exploit the torsion-point images through higher-dimensional isogenies, without using a DCP oracle. Non-commutative problems. The supersingular ℓ-isogeny graph over Fp2 is a Ramanujan graph, and walks in it define the hash function of Charles, Goren and Lauter, whose collision resistance rests on the difficulty of finding paths [74]. Eisenträger, Hallgren, Lauter, Morrison and Petit showed, heuristically, that finding isogeny paths and computing endomorphism rings reduce to each other [100], and Wesolowski proved the equivalence under the generalised Riemann hypothesis [226]. The quaternion side is easy: Kohel, Lauter, Petit and Tignol gave a heuristic polynomial-time algorithm that connects maximal orders by ideals of ℓ-power norm [141]; the hardness lies in passing from a curve to its endomorphism ring. Generic attacks find a e 1/2 ) classically; Delfs and Galbraith gave path between two supersingular curves in time O(p 1/4 e an O(p ) classical algorithm for curves defined over Fp [91], and Biasse, Jao and Sankar a e 1/4 ) for arbitrary supersingular curves, which walks from each quantum algorithm in time O(p curve to one defined over Fp with a Grover-accelerated search and then solves the commutative problem between the two Fp -curves with a subexponential hidden-shift algorithm [50]. For the specific claw-finding instances of SIKE, Jaques and Schanck showed that quantum claw-finding is no better than the classical parallel collision search once memory costs are accounted for [135]. What the counterfactual changes. In the algorithm of [50], a hidden-shift subroutine handles the commutative problem between Fp -rational curves. Replacing that subroutine under HHS , or Hab HS for a non-cyclic class group, requires the complete public-input and evaluation conditions above. If those conditions hold, the unchanged outer Grover search still has cost e 1/4 ). This describes that particular composition; it is neither an optimality statement for O(p supersingular path finding nor a bound on every attack a hypothetical solver might enable. SQIsign. SQIsign, by De Feo, Kohel, Leroux, Petit and Wesolowski, is a Fiat–Shamir signature from an identification protocol: the prover knows a secret isogeny from a curve E0 with known endomorphism ring to its public curve EA , hence the endomorphism ring of EA ; it commits to a random isogeny E0 → E1 , receives a challenge isogeny E1 → E2 , and responds with an 80

isogeny EA → E2 of smooth degree computed on the quaternion side with a variant of KLPT and translated back to curves [106]. Security rests on the endomorphism ring problem and on the response distribution revealing nothing useful. Later versions use higher-dimensional isogeny representations to make signing and verification efficient [221]; SQIsign is a third-round candidate, with the smallest combined size of public key and signature among the schemes compared in Table 13 [175]. Encryption after SIDH. Post-SIDH public-key encryption uses higher-dimensional isogenies constructively: FESTA turns the machinery of the torsion attacks into a trapdoor [33], and POKÉ is a compact PKE built on similar techniques [32]. Both rely on non-commutative problems with controlled torsion information; they are Outside reach in our classification, but their assumptions are young.

8.6

Equivalence problems and non-abelian group actions

The problems. Three families of signature schemes use group actions of non-abelian groups. In linear code equivalence, given generator matrices G, G′ of two [n, k] codes, one seeks S ∈ GLk (Fq ) and a monomial matrix Q (a permutation combined with nonzero scalings) such that G′ = SGQ; LESS builds a Fiat–Shamir signature from the corresponding identification protocol, in which the prover commits to a random code equivalent to G and reveals, according to the challenge, an equivalence with G or with G′ [51]. In matrix code equivalence the codes are subspaces of Fm×n q and the acting group is GLm (Fq ) × GLn (Fq ), acting by C 7→ ACB; this is the basis of MEDS [83]. In alternating trilinear form equivalence, GLn (Fq ) acts on alternating trilinear forms by change of variables; this is the basis of ALTEQ [219]. LESS was a second-round candidate and MEDS and ALTEQ first-round candidates of NIST’s additional-signature process; none is among the third-round candidates [175]; that selection outcome alone establishes neither hardness nor a cryptanalytic break. Conclusion. The natural quantum approach to these problems is a hidden-subgroup or hidden-shift problem in non-abelian groups such as GLk × Sn , for which the negative results proved for the symmetric group and for code equivalence, strong Fourier sampling on single coset states, and entangled measurements on few of them, fail [168, 123, 93], suggest similar limits; for matrix-code and trilinear-form equivalence we know of no corresponding proof. The reductions analysed here give no attack certificate ( Outside reach); the Fourier-sampling results are independent evidence that limits a class of measurements, not a consequence of the counterfactual and not a proof of quantum security. They are the natural candidates when one wants a group-action interface, for ring signatures or threshold constructions, say, without the commutativity that makes CSIDH fragile under HHS .

8.7

Efficiency and concrete security of the alternatives

Table 13 reports public-key and ciphertext or signature sizes for selected parameter sets; MLKEM-768 is included as a level-3 reference. Classic McEliece has a large public key and short ciphertext, HQC a smaller key and larger ciphertext, and FrodoKEM keys and ciphertexts near ten kilobytes. These sizes affect protocol design, but do not establish deployability or a security ranking. In particular, FrodoKEM’s lack of a certificate from the restricted ball route does not prove a stronger position than ML-KEM under the counterfactual. Their unresolved checks differ (Sections 5 and 6.1). Classic McEliece also requires the independent structural-attack assessment summarised in Section 8.2; the companion paper [107] compares the structural estimates with classical and Grover-accelerated generic decoding for each parameter set. For signatures, SLH-DSA uses small public keys and kilobyte-scale signatures, UOV trades larger keys for short signatures, and MAYO and SQIsign have the displayed size profiles. FAEST 81

additionally illustrates signatures using a symmetric relation, with the hash, commitment and proof-transform assumptions described above. Security comparisons require family-specific attacks and cost models: information-set decoding [40, 136], generic preimage and collision search [118, 65, 39], algebraic attacks on MQ [45], and isogeny-path algorithms [50, 135]. Their resource measures and hypotheses differ; no uniform “at most Grover” bound or common security ordering follows from this table. Scheme (level 1)

Family

pk (B)

Key encapsulation ML-KEM-768 (ref., level 3) FrodoKEM-640 Classic McEliece 348864 HQC-1

module lattice 1 184 unstructured lattice 9 616 binary Goppa codes † 261 120 quasi-cyclic codes 2 241

Signatures ML-DSA-44 (reference) FN-DSA-512 (reference) SLH-DSA-128s / 128f UOV (OV-Ip-pkc) MAYO-1 SQIsign (NIST-I, v3.0)

module lattice NTRU lattice hash-based multivariate multivariate isogenies

ct / sig (B) HHS HReg HEDCP 1 088 9 720 96 4 433

H

H

H

H

1 312 2 420 897 ≈666 32 7 856 / 17 088 43 576 128 1 420 454 83 200

H

H

H

H

Table 13: Sizes of level-1 parameter sets (ML-KEM-768 shown as the commonly deployed reference). Sources: the normative standards FIPS 203–205 [172, 171, 173]; for FN-DSA, the Falcon specification [108], the predecessor of the forthcoming FIPS 206; the FrodoKEM specification [17]; the Open Quantum Safe parameter tables for Classic McEliece, HQC, UOV and MAYO [181]; and the SQIsign specification v3.0 [221]. Sizes of round-3 candidates are those of their specifications as of October 2026 and may change during the NIST process. The last three columns give the conclusion under each hypothesis, with the glyphs and marks of Table 6; the dagger is explained in Table 11.

8.8

Subset sum

In the subset-sum problem modulo N one is given a1 , . . . , an ∈ ZN and a target t and asked for P a subset S with i∈S ai ≡ t (mod N ); the density n/ log N governs its difficulty. Regev showed that an average-case subset-sum algorithm yields a DCP algorithm with failure parameter f = 1 [199, Thm. 1.3]; the implication runs from subset sum to DCP, so this direction alone does not turn a DCP algorithm into a subset-sum algorithm, and the 2026 claim tried precisely to replace this step (Section 3). Lyubashevsky, Palacio and Segev built public-key encryption and other primitives provably as secure as subset sum [156]. In the other direction, Lagarias and Odlyzko showed that subset sum of sufficiently low density reduces to a short-vector problem in a lattice [148], and the densities that make the cryptosystems of [156] secure are close to the lattice regime. We classify subset-sum public-key encryption as Open.

9

Notes on non-commutative hidden structures

Non-abelian hidden-subgroup and hidden-shift problems are one research direction for assumptions outside the dihedral routes analysed here. The evidence includes limitations on particular quantum measurements, alongside algorithms that solve some non-abelian cases. Neither noncommutativity nor a measurement lower bound establishes resistance to every DCP-enabled attack. This section reviews those results, the record of group-based constructions and relaxed dihedral algorithms. It does not derive a new deployable KEM or a formal separation from DCP. 82

9.1

Where the hidden subgroup problem is easy

Query complexity is not the obstacle. Ettinger, Høyer and Knill showed that for every finite group polynomially many coset states determine the hidden subgroup information-theoretically [103]. The difficulty of the HSP is therefore computational: the question is always whether an efficient measurement extracts the information that the states contain. Normal subgroups and weak Fourier sampling. Hallgren, Russell and Ta-Shma showed that measuring only the name of the irreducible representation in the Fourier transform of a coset state, weak Fourier sampling, determines the normal core of the hidden subgroup, and hence solves the HSP for normal subgroups whenever the Fourier transform over the group can be implemented efficiently [124]. Dihedral reflections are not normal, which is why the method fails for DCP. Strong Fourier sampling and optimal measurements. Moore, Rockmore, Russell and Schulman showed that strong Fourier sampling, which also measures inside the representation, in a suitably chosen basis, solves the HSP in affine groups and in q-hedral groups Zp ⋊ Zq with q large, and gives algorithms for related hidden-shift problems [167]. Bacon, Childs and van Dam took the opposite route: they computed the optimal (pretty good) measurement on several coset states at once for semidirect products Zrp ⋊ Zp , including the Heisenberg group, and reduced its implementation to solving systems of polynomial equations, which is efficient for constant r [25]. Ivanyos, Sanselme and Santha solved the HSP in extraspecial groups [133], and Friedl, Ivanyos, Magniez, Santha and Sen solved the hidden translation problem, the non-abelian analogue of the hidden shift, in solvable groups of bounded exponent and derived length [109]. Most recently, Morales gave polynomial-time algorithms for semidirect products A ⋊ Zpk with scalar action and for quasi-Hamiltonian groups given in a structured presentation [169]. Scope of these algorithms. A cryptographic problem with a complete efficient reduction to one of these efficiently solvable HSP families is exposed when the reduction meets the algorithm’s subgroup, presentation and access promises. A group name alone is insufficient: these results neither solve every problem over that group nor exclude all cryptographic assumptions defined using it.

9.2

Limitations of known measurements

The symmetric group. For the order-two hidden subgroups used to express graph isomorphism, Moore, Russell and Schulman show that measuring a single coset state in any basis yields only exponentially small information [168]. Hallgren, Moore, Rötteler, Russell and Sen extended this to entangled measurements: in their coset-state measurement model, polynomial-resource procedures require measurements entangled across Ω(n log n) registers for the specified hiddensubgroup family [123]. Graph isomorphism itself is classically solvable in quasi-polynomial time by Babai’s algorithm [24], which shows that hardness of the quantum HSP route does not imply hardness of the underlying problem; code equivalence has its own negative results with specific code and measurement premises [93]. We establish no corresponding general lower bound for matrix-code or trilinear-form equivalence in Section 8.6. Sample complexity of hidden shifts. Zhou studied the generalised hidden shift problem over arbitrary finite √ groups and its sample complexity, obtaining for the symmetric group Sn a lower bound of Ω( n log n) in the saturated case [228]. Such results bound sample requirements in their specified models. They should be distinguished from computational lower bounds and from the state budgets of cryptographic reductions.

83

Infinite groups. Kuperberg extended the hidden subgroup problem to infinite groups, including Lie groups and arithmetic groups [145]. This suggests non-abelian analogues of lattice problems, defined by discrete subgroups of non-abelian Lie groups, to which the Euclidean-lattice reduction of Section 4.2 does not directly apply; a separation from other dihedral routes remains unproved. Dutto, Mercuri, Murru and Romano surveyed the hidden subgroup problem from a mathematical and cryptographic perspective [98].

9.3

Group-based cryptography

Braid-group key exchange is the classical example of a non-commutative assumption. Anshel, Anshel and Goldfeld proposed a key exchange based on commutators in a non-commutative group [18], and Ko, Lee, Cheon, Han, Kang and Park a Diffie–Hellman analogue based on the conjugacy search problem in braid groups [140]. Most such proposals were broken by length-based attacks and by attacks through linear representations of braid groups, surveyed by Myasnikov, Shpilrain and Ushakov [170]. The lesson is that non-commutativity is not sufficient: an assumption meant to survive a DCP break also needs average-case hardness under classical attack, which must be assessed independently for each equivalence problem in Section 8.6. Nor is it necessary: hash-based and code-based assumptions lie outside the reach of the hypotheses without any non-abelian structure.

9.4

Relaxed dihedral problems

The dihedral family itself is not monolithic. Childs and van Dam solved the generalised hidden shift problem in polynomial time once the extrapolation range is a polynomial power of the modulus [80]; Chen, Liu and Zhandry solved EDCP for suitable amplitude functions by filtering [79]; Bai, Jangir, Kirshanova, Ngo and Youmans solved EDCP over power-of-two moduli in quasi-polynomial time with quasi-polynomially many samples [27]; and Boucher, Fouque and Shen solved a cyclotomic generalisation of DCP with a quantum sieve in time 2Op (log n log q) [58]. The direct compositions examined in Theorem 4.7 give no attack on the standard LWE regimes considered here: their sample budgets, amplitudes, widths, moduli and running times do not all match. This does not exclude every LWE parameter family or alternative reduction. Characterising compatible amplitude profiles, moduli and sample counts could identify further positive compositions.

9.5

Criteria for evaluating alternative assumptions

Research considerations. Three checks can guide the assessment of alternatives, without providing necessary or sufficient conditions for DCP resistance. First, audit all known complete reductions and their access requirements; non-abelian structure and limits on Fourier sampling do not establish a separation. Second, analyse average-case classical and quantum attacks at the intended distribution and parameters. Third, identify the primitive required: an assumption supporting signatures need not supply a KEM. Equivalence-based signatures and higher-dimensional isogeny encryption illustrate different goals and different unresolved security questions. Formal independence from DCP would require a precisely stated model and a separate separation argument.

10

Future research and conclusions

This section collects questions that could clarify or extend the classification, draws scenarioplanning consequences for hybrid designs, turns the classification into a scenario-planning checklist with worked examples, and concludes.

84

10.1

Open questions

The questions below are stated with the background needed to attack them. They are ordered by their consequences for the classification. Open Question 10.1 (Few-sample reductions). Is there a quantum reduction from LWE with m = n + O(n/ log n) samples and αq = O(1) to an extrapolated dihedral problem with non-negligible extrapolation? Background. Both unstructured routes lose a factor q n/m (Section 4.6), and this loss contributes to the failure of the displayed sufficient bounds for FrodoKEM and the published keys of ML-DSA. Finite-dimensional factors, structure and rounded distributions require additional checks. The loss reflects the fact that the error must be small relative to the minimum of Λq (A), whose Gaussian-heuristic value scales as q 1−n/m . A reduction exploiting the short secret, as the normal-form transformation [20] and affine embedding do, might avoid this particular loss. We establish no such few-sample EDCP construction here. Open Question 10.2 (The finite-dimensional factor of Regev’s theorem). What finitedimensional factor Γf,A (d) does Regev’s reduction [199, Thm. 1.1] guarantee, as a function of f , of the dimension and of the parameters of the postulated solver, and how far can it be reduced by optimising the partition, the embedding into ZN and the analysis? Background. Tables 9 and 10 compare the estimates with c0 d1/2+2f . In the formal normalisation f → 0+ , the sufficient model comparisons correspond to c0 below about 0.3–0.9 for the LWE examples and 0.6–0.7 for ML-DSA’s Module-SIS norm model. The constants and starting dimension need not be uniform in f . An explicit finite-dimensional bound would resolve one input to the comparison; the actual planted vector, gap, distribution and sample conditions would still be required. It would neither remove NTRU’s ordinary-uniqueness obstruction nor implement the hypothetical solver. Open Question 10.3 (DCP and SIS at small norm bounds). Does a DCP algorithm, under e 1+2f ) under HReg (f ) or HEDCP [ℓ], yield an algorithm for SISn,m,q,β with β below βvoid (O(n 3/2 ) under H e HReg (f ), O(ℓn EDCP [ℓ]), in particular at the norm bounds of the signatures of Table 9? Does it yield forgeries, which need inhomogeneous solutions for hashed targets and, for ML-DSA, solutions compatible with its rounding and hints? Conversely, can one establish a separation from the specified DCP capabilities in a precisely defined computational or oracle model? 3/2 ), essentially where its worste Background. Under HEDCP [ℓ], SIS is solved for β > βE = O(ℓn case foundation fails under that hypothesis; under HReg (f ), for β ≥ βReg = O(m3/2+2f ), a factor √ of about n above it (Theorems 4.20 and 4.25, Section 7.1). Solving the exact SIS assumption of a security proof would remove its hardness premise; a forgery needs more (Section 7.1). The compositions reviewed here do not certify the signature parameters below those bounds [216, 79, 89, 72]. The dequantisation in [142] concerns particular wide-matrix SIS∞ algorithms; it does not preclude every quantum advantage in such regimes.

Open Question 10.4 (An EDCP characterisation of NTRU). Is small-modulus NTRU equivalent, or reducible, to an extrapolated dihedral problem, in the way that LWE and Module-LWE are [61, 225]? Background. The exact rotation bounds in Theorem 7.1 obstruct a direct ordinary-uSVP application at the stated factors. The homogeneous relation hf − g = 0 is not a standard Ring-LWE sample. The lossiness route of Theorem 7.2 requires a search Ring-LWE solver at its particular sample count and width; a single key gives only one candidate ring element. Module-uSVP is a different promise [104]. A new structured route or a verified composition meeting these oracle requirements could change the decision classification; key recovery requires its own reduction. 85

Open Question 10.5 (From cyclic DCP to vector EDCP). Does an algorithm for DCPfN on cyclic groups imply one for G-EDCPn,N,r over ZnN on the parameter families of [61]? Background. Theorem 4.5 reduces EDCP with smooth amplitudes to robust two-point solvers over ZnN , so the question is whether such solvers follow from cyclic ones. Regev’s embedding of {0, . . . , M − 1}n into ZN (Section 4.2) handles differences with small coordinates, which is the situation of the two-point problem but not of an arbitrary secret in ZnN . An affirmative answer on selected parameter families would establish only a restricted implication. To derive HReg (f ) ⇒ HEDCP [ℓ], it would need to cover the full latter domain with its secret, offset, width, state-budget and success guarantees; the compositions of Theorems 4.24 and 4.25 require their respective subdomains. Open Question 10.6 (Robust extrapolated solvers). Can the reduction from LWE to Gaussian EDCP be arranged so that a solver tolerating a constant fraction of invalid states suffices, removing the factor ℓ from the admissible width, and so that the radius condition (B3) no longer forces m ≤ mmax (Theorem 4.27)? Conversely, is robustness to invalid states harder to achieve for extrapolated states than for the two-point problem behind HReg (f )? Background. At fixed width and inverse-polynomial success, Theorem 4.22 shows that ℓ = Ω(n log q) states are necessary, so requiring all of them to be valid costs that factor in the √ noise rate reached; the radius condition costs a further factor of about n up to logarithms (Theorems 4.23 and 4.27). Removing the first loss alone would bring the route to noise rates of e about 1/O(n). Within this width calculation, removing both losses would be needed to certify e √n): the regime of Regev’s and dual-Regev encryption and the standard noise rate α = 1/O( of identity-based encryption in the style of [112], regimes without a certificate from the stated compositions (Section 6.1). Open Question 10.7 (Structured codes). Is there a hidden-structure attack on quasi-cyclic syndrome decoding analogous to the quantum attacks on principal ideals [87, 52]? Can the BDDto-EDCP reductions of [69] be made effective for Hamming-metric decoding in cryptographic regimes over large alphabets, where Theorem 8.1 does not apply? Background. Code-based KEMs are candidates for independent assessment in this scenario (Section 8), so their structured variants deserve the scrutiny that ideal lattices received after 2014. Over Fn2 the noisy dihedral problem of Theorem 8.1 is LPN, so that formulation gives no new route; this is an equivalence, not a protection, and it does not exclude reductions of another kind. Over larger alphabets the EDCP route of [69] is a genuinely different problem. Open Question 10.8 (Structural attacks on Classic McEliece). Do the Holdout/Hermite key-recovery methods [114, 206, 208, 222, 224] succeed on the Classic McEliece parameter distributions, with what structural success probabilities and end-to-end costs including repetitions and realistic memory access? In particular, do the heuristic assumptions behind the lowest estimates, on the dimension of the row kernel, the span of the gradients, the structure of the column kernel and the behaviour of block Lanczos over F2 [224], hold at 238 to 242 unknowns? Can the reported small-instance recoveries be extended without assuming the full-size rank and locator-uniqueness properties? Does a quantum computer accelerate the underlying sparse linear algebra over F2 ? Is there a regime of binary Goppa codes, for example with n < 2m and larger m, or another family of codes with an efficient decoder, that resists all known structural attacks with public keys of comparable size? Background. These attacks are classical and Goppa-specific, so they do not rely on the counterfactual, but they remain relevant to assessing the alternative KEMs (Section 8.2); the companion paper [107] states this question in more detail. Their asymptotic claims are strong, subexponential and quasi-polynomial distinguishers [197, 114], while their concrete estimates 86

rest on unreviewed analyses and on heuristic assumptions tested only on small instances, of the order of 107 unknowns at most [207, 208, 224]. For one and the same run, the published figures differ by about thirty bits between cost models [224, 107]. The scaling of the run with m suggests that larger extension degrees with n < 2m could restore the margins at public keys several times larger, but Weis presents such sets as illustrations, not proposals [224]. Weis knows of no quantum speed-up for a run; the question matters here because the counterfactual presupposes large quantum computers, and for mceliece348864 the structural attack and Grover-accelerated generic decoding are already of comparable cost under the stated assumptions (Section 8.2). The BSI expects to revise its recommendation in early 2027 [68]. Open Question 10.9 (Gapless lattice problems). Can LIP for Zn or for remarkable lattices be related to uSVP or SIVP at polynomial factors? Is there a DCP-type quantum reduction for LIP? The 2026 attack on Hawk [217] reduces structured LIP to exact SVP in half the dimension; is there an analogous reduction for unstructured LIP? Background. Rotations of Zn have no ordinary uniqueness gap, and the approximation guarantees established here do not recover their exact isometries (Section 7.4). A reduction to a promised lattice problem would give a positive composition only if its parameters matched the available oracle. A relation to hidden structure over a group such as GLn (Z) would similarly require an explicit access model and reduction. Remark 10.10. The forward parameter audit is given in Section 5. The remaining verification concerns the Appendix E adapter of [225]: propagate every search/decision conversion, unknownnoise sample amplification, Gaussian width convention and success loss, and verify that the final dimension, polynomial modulus, width and state count meet the same witnessing HEDCP [ℓ] solver. This is a source-proof and composition audit, not a new mathematical open problem. √ The audit must include the Ω( κ) input-width condition of the invoked EDCP-to-LWE reduction and the two calls to the unknown-noise routine, whose stated sample overhead is polynomial rather than sample preserving. A corrected adapter would still not remove the failure of the printed forward certificate at ML-KEM parameters proved in Theorem 5.2. Extending the forward range, handling actual bounded and rounded distributions, or improving the width bound are separate research questions.

10.2

Hybrid designs

The observations in this subsection and the next are scenario planning under the counterfactual. They do not provide a migration recommendation. X-Wing combines ML-KEM-768 and X25519 with a SHA3-based combiner and a security argument tailored to those components [30]. Against a sufficiently capable quantum adversary, the discrete-logarithm premise of X25519 is unavailable [212]; any remaining security argument must use the ML-KEM and combiner assumptions in the relevant model. This does not establish exact equality between the concrete security of the hybrid and of ML-KEM. ML-KEM’s classification under the present hypotheses remains conditional (Theorems 10.2 and 10.10). General KEM combiners can preserve security when at least one component remains secure, subject to their component, validation and security-model requirements [115, 53]. Combining a lattice KEM with a code-based KEM such as HQC is therefore one design to analyse; merely pairing two schemes does not establish the combiner theorem’s premises. ML-KEM with FrodoKEM diversifies structure and parameters while retaining LWE-family dependencies, without proving independence of the two assumptions. For signatures, an analogous robust combination requires both component signatures to verify for the same bound message and identity, and an appropriate composition argument. The sizes in Table 13 inform bandwidth assessment but do not by themselves select a secure combination.

87

10.3

Scenario-planning checklist

The checklist in Table 14 records sufficient consequences and unresolved premises for each assumption in a system. A negative or unverified answer gives no attack certificate from that step. Its purpose is scenario planning and dependency accounting. #

Check

Consequence if verified

1

Is there a complete polynomial-time reduction to cyclic coset states (or general abelian states)? Count group-structure computation, public inputs, consistent encodings, coherent preparation, oracle calls, success and all remaining processing. Count independent available samples M for each secret. Separate the reduction subset m0 from holdout samples m′ . Correlated evaluation keys and signature hints do not automatically add independent samples. For uniform LWE, does some m0 ∈ Mq (n) satisfy α < αE (n, m0 , ℓ)? For amplification also require M ≥ m0 + m′ , m′ ≥ 2n lg q and the verification noise bound. Alternatively verify the worst-case gE promise.

under the matching cyclic or abelian hypothesis.

2

3

4

Does the actual embedding have its planted vector shortest and gap above Γf,A (D + 1)? Under HHS use the witness-dependent fA . Record heuristic comparisons separately.

5

Is the exact SIS or lattice proof assumption solved at its stated distribution and bound? Turning its solutions into a forgery or collision needs an additional algorithm.

6

Is a worst-case foundation solvable at the reduction’s approximation factor?

7

Is a lattice instance left without a certificate by steps 3–6?

8

Does a non-lattice family lack a known complete reduction to the assumed solver? Assess independent classical and quantum attacks, including scheme-specific structure, evidence and implementation costs (Tables 11 and 13; for Classic McEliece, Section 8.2 and [107]).

9

R

An input budget for later checks. under HEDCP [ℓ] with all conditions. Structured route: also check Section 5; no deployed certificate. R if proved; H for a heuristic or unspecified-bound comparison. Kind (B): proof assumption solvable. Kind (A) requires an explicit attack. Kind (C): that hardness guarantee is uninformative; no attack follows automatically. Record , or and the missing premise. within this analysis; no security claim. Record independent evidence; use a dagger where under revision. R

Table 14: Scenario-planning checklist. A hidden-shift subroutine alone is insufficient for step 1; a failure to certify later steps is not an impossibility theorem.

10.4

Worked examples

The following applications of the checklist summarise the conclusions of Sections 6 to 8; conclusions are triples for HHS / HReg (f ) / HEDCP [ℓ], with the glyphs and marks of Table 6. • ML-KEM-768: H / H / H . Both key and ciphertext component u have m/n = 1. The normalised gap estimate is 0.3–0.4; finite-dimensional and actual-gap checks remain, and the printed structured certificate has no feasible width (Theorem 5.2).

88

• Regev’s 2005 cryptosystem: / / . Its standard noise rate is outside the sufficient unstructured bounds derived here. This does not exclude another reduction or better behaviour of a solver. • FrodoKEM-976: H / H / . Each secret has m/n = 1 and normalised heuristic gap about 0.6. The sufficient embedding comparison is unresolved, and the restricted ball construction gives no certificate. • ML-DSA-44: H / H / H . √ Use the published-key estimate of about 0.3 D. Full t supplied gives a separate sensitivity √ estimate near 11 D, with no reconstruction from signatures asserted. Module-SIS norm comparisons concern a proof assumption, not a forgery. • FN-DSA-512: / / . The ordinary-uSVP key promise fails by exact rotational symmetry. The displayed typicalnorm calculation does not certify the required SIS bound; it proves no short-output impossibility. • CSIDH-512: R / R / . For the cyclic action satisfying the complete evaluation and public-input conditions (Section 8.5) [48]. The corresponding non-cyclic abelian action uses Hab HS . • Classic McEliece: / / . With the independent-revision dagger. Step 9 must account for the version-specific structural analyses, challenge recoveries and cost-model conditions summarised in Section 8.2 and analysed in [107]: conditional per-run estimates of 289 –298 bit operations, or 2107 –2117 with a square-root charge per memory access, for the five parameter sets, with one run or 103 to 1443 runs per key recovery [224] (Table 12); the BSI advises against new deployments [68]. The DCP classification does not settle these questions; Theorem 10.8 records them. • SQIsign: / / . e 1/4 ) cost if its comThe unchanged outer search in the composition of [50] retains its O(p mutative subroutine can be replaced under the stated evaluation conditions (Section 8.5). • SLH-DSA: / / . No DCP consequence is established; hash preimage and collision attacks remain independent checks.

10.5

Conclusions

A noiseless cyclic DCP breakthrough would have lattice consequences at some polynomial factors; the strength needed for a given cryptographic instance depends on the witnessing algorithm and on the parameters and promises of the intervening reductions. We give explicit sufficient guarantees for the unstructured compositions considered and the structured state conversion; the explicit structured forward certificate supplies none for ML-KEM, and the polynomialmodulus adapter and several concrete embedding comparisons remain unresolved. A solved proof assumption is distinguished throughout from an explicit attack on a scheme, and absence of a certificate here is neither a security proof nor an impossibility result for future reductions. Chen’s withdrawn 2024 algorithm for LWE and Zhang’s conditional repair of it would, if correct, have reached only a many-sample, small-noise LWE regime inside the reach of HReg (f ) for f < 1/2, not standard-noise LWE or the deployed parameter sets (Section 3.6). Free and transitive cyclic actions satisfying the complete evaluation and public-input conditions are a separate rigorous consequence, extended to abelian actions under Hab HS . A hidden-shift subroutine does not suffice if the rest of an attack stays super-polynomial. For NTRU, the 89

rotation bounds, module-uSVP distinction and lossiness oracle requirements prevent a blanket key-recovery claim. Outside lattices, no DCP-based certificate is recorded for binary code-based KEMs, but for Classic McEliece conditional classical estimates far below its targeted levels (Section 8.2, [107]) mean that, in line with the BSI’s advice, a post-DCP KEM layer cannot treat it as a conservative fallback before re-evaluation; HQC, not exposed to these attacks, needs its own analysis. The tables and checklist make explicit these dependencies and the checks a concrete application needs. Relative to the surveys of Table 1, the contribution is this joint accounting of solver domains, reduction parameters and evidential status, with the stated quantitative derivations, not new reduction mechanisms or an exhaustive security classification.

Acknowledgements The author used Anthropic tools to assist with language editing of this manuscript. The scientific content, claims, proofs, and conclusions are the author’s own. The resulting work, in its totality, is an accurate representation of the author’s underlying work, and the author take full responsibility for the veracity and correctness of all material.

References [1] Abram, D., Arnon, G., Cini, V., Lou, P., Malavolta, G., Roy, L.: Decomposed LWE is equivalent to succinct LWE. Cryptology ePrint Archive, Paper 2026/1829 (2026) [2] Abram, D., Malavolta, G., Roy, L.: Key-homomorphic computations for RAM: Fully succinct randomised encodings and more. In: Advances in Cryptology – CRYPTO 2025. LNCS, Springer (2025), doi:10.1007/978-3-032-01881-6_8; ePrint 2025/339 [3] Aggarwal, D., Dadush, D., Regev, O., Stephens-Davidowitz, N.: Solving the shortest vector problem in 2n time using discrete Gaussian sampling. In: Proceedings of the 47th Annual ACM Symposium on Theory of Computing (STOC 2015). pp. 733–742 (2015) [4] Aguilar Melchor, C., et al.: Hamming quasi-cyclic (HQC). Submission to the NIST PostQuantum Cryptography Standardization Process; selected for standardisation in March 2025 (2025) [5] Aharonov, D., Regev, O.: Lattice problems in NP ∩ coNP. Journal of the ACM 52(5), 749–765 (2005) [6] Ajtai, M.: Generating hard instances of lattice problems (extended abstract). In: Proceedings of the 28th Annual ACM Symposium on Theory of Computing (STOC 1996). pp. 99–108. ACM Press (1996). https://doi.org/10.1145/237814.237838, http: //dx.doi.org/10.1145/237814.237838 [7] Ajtai, M.: The shortest vector problem in L2 is NP-hard for randomized reductions. In: Proceedings of the 30th Annual ACM Symposium on Theory of Computing (STOC 1998). pp. 10–19 (1998) [8] Ajtai, M., Dwork, C.: A public-key cryptosystem with worst-case/average-case equivalence. In: Proceedings of the 29th Annual ACM Symposium on Theory of Computing (STOC 1997). pp. 284–293 (1997) [9] Alamati, N., Feo, L.D., Montgomery, H., Patranabis, S.: Cryptographic group actions and applications. In: Advances in Cryptology – ASIACRYPT 2020. LNCS, vol. 12492, pp. 411–439. Springer (2020) 90

[10] Albrecht, M.R., Bai, S., Ducas, L.: A subfield lattice attack on overstretched NTRU assumptions. In: Advances in Cryptology – CRYPTO 2016. LNCS, vol. 9814, pp. 153–178. Springer (2016) [11] Albrecht, M.R., Bernstein, D.J., Chou, T., Cid, C., Gilcher, J., Lange, T., Maram, V., von Maurich, I., Misoczki, R., Niederhagen, R., Paterson, K.G., Persichetti, E., Peters, C., Schwabe, P., Sendrier, N., Szefer, J., Tjhai, C.J., Tomlinson, M., Wang, W.: Classic McEliece: Conservative code-based cryptography. Submission to the NIST Post-Quantum Cryptography Standardization Process, Round 4 (2022), https://classic.mceliece.o rg/ [12] Albrecht, M.R., Deo, A.: Large modulus ring-LWE ≥ module-LWE. In: Advances in Cryptology – ASIACRYPT 2017. LNCS, vol. 10624, pp. 267–296. Springer (2017) [13] Albrecht, M.R., Ducas, L., Herold, G., Kirshanova, E., Postlethwaite, E.W., Stevens, M.: The general sieve kernel and new records in lattice reduction. In: Advances in Cryptology – EUROCRYPT 2019. LNCS, vol. 11477, pp. 717–746. Springer (2019) [14] Albrecht, M.R., Player, R., Scott, S.: On the concrete hardness of learning with errors. Journal of Mathematical Cryptology 9(3), 169–203 (2015) [15] Albrecht, M.R., et al.: Classic McEliece: Conservative code-based cryptography: Guide for security reviewers. https://classic.mceliece.org/mceliece-security-20221023. pdf (2022) [16] Alekhnovich, M.: More on average case vs approximation complexity. In: 44th IEEE Symposium on Foundations of Computer Science (FOCS 2003). pp. 298–307 (2003) [17] Alkim, E., Bos, J.W., Ducas, L., Longa, P., Mironov, I., Naehrig, M., Nikolaenko, V., Peikert, C., Raghunathan, A., Stebila, D.: FrodoKEM: Learning with errors key encapsulation. algorithm specifications and supporting documentation. Submission to the NIST Post-Quantum Cryptography Standardization Process, Round 3 (2021), https://frodokem.org/ [18] Anshel, I., Anshel, M., Goldfeld, D.: An algebraic method for public-key cryptography. Mathematical Research Letters 6(3), 287–291 (1999) [19] Apon, D.: So about that quantum lattice thing: Rebuttal to “Exact Coset Sampling for Quantum Lattice Algorithms”. Cryptology ePrint Archive, Paper 2025/1945 (2025), received October 18, 2025; revised October 28, 2025. https://eprint.iacr.org/2025/1 945 [20] Applebaum, B., Cash, D., Peikert, C., Sahai, A.: Fast cryptographic primitives and circular-secure encryption based on hard learning problems. In: Advances in Cryptology – CRYPTO 2009. LNCS, vol. 5677, pp. 595–618. Springer (2009) [21] Aragon, N., et al.: BIKE: Bit flipping key encapsulation. Submission to the NIST PostQuantum Cryptography Standardization Process, Round 4 (2022) [22] Arora, S., Ge, R.: New algorithms for learning in presence of errors. In: Automata, Languages and Programming – ICALP 2011. LNCS, vol. 6755, pp. 403–415. Springer (2011) [23] Babai, L.: On Lovász’ lattice reduction and the nearest lattice point problem. Combinatorica 6(1), 1–13 (1986)

91

[24] Babai, L.: Graph isomorphism in quasipolynomial time. In: Proceedings of the 48th Annual ACM Symposium on Theory of Computing (STOC 2016). pp. 684–697 (2016) [25] Bacon, D., Childs, A.M., van Dam, W.: From optimal measurement to efficient quantum algorithms for the hidden subgroup problem over semidirect product groups. In: 46th IEEE Symposium on Foundations of Computer Science (FOCS 2005). pp. 469–478 (2005) [26] Bai, S., Ducas, L., Kiltz, E., Lepoint, T., Lyubashevsky, V., Schwabe, P., Seiler, G., Stehlé, D.: CRYSTALS-Dilithium: Algorithm specifications and supporting documentation (version 3.1). Submission to the NIST Post-Quantum Cryptography Standardization Process, Round 3 (2021), february 8, 2021 [27] Bai, S., Jangir, H., Kirshanova, E., Ngo, T., Youmans, W.: A quasi-polynomial time algorithm for the extrapolated dihedral coset problem over power-of-two moduli. In: Advances in Cryptology – CRYPTO 2025. LNCS, Springer (2025), doi:10.1007/978-3-03201878-6_14; ePrint 2025/1046 [28] Banaszczyk, W.: New bounds in some transference theorems in the geometry of numbers. Mathematische Annalen 296(4), 625–635 (1993) [29] Banerjee, A., Peikert, C., Rosen, A.: Pseudorandom functions and lattices. In: Advances in Cryptology – EUROCRYPT 2012. LNCS, vol. 7237, pp. 719–737. Springer (2012) [30] Barbosa, M., Connolly, D., Duarte, J.D., Kaiser, A., Schwabe, P., Varner, K., Westerbaan, B.: X-Wing: The hybrid KEM you’ve been looking for. IACR Communications in Cryptology 1(1) (2024) [31] Bardet, M., Lemoine, A., Tillich, J.P.: An attack on the CFS scheme and on TII McEliece challenges. In: Advances in Cryptology – CRYPTO 2026. LNCS, vol. 16803, pp. 380–412. Springer (2026), cryptology ePrint Archive, Paper 2026/430 [32] Basso, A., Maino, L.: POKÉ: A compact and efficient PKE from higher-dimensional isogenies. In: Advances in Cryptology – EUROCRYPT 2025. LNCS, Springer (2025) [33] Basso, A., Maino, L., Pope, G.: FESTA: Fast encryption from supersingular torsion attacks. In: Advances in Cryptology – ASIACRYPT 2023. LNCS, vol. 14444, pp. 98–126. Springer (2023) [34] Baum, C., Braun, L., Delpech de Saint Guilhem, C., Klooß, M., Orsini, E., Roy, L., Scholl, P.: Publicly verifiable zero-knowledge and post-quantum signatures from VOLE-inthe-head. In: Advances in Cryptology – CRYPTO 2023. LNCS, vol. 14085, pp. 581–615. Springer (2023) [35] Becker, A., Ducas, L., Gama, N., Laarhoven, T.: New directions in nearest neighbor searching with applications to lattice sieving. In: Proceedings of the 27th Annual ACMSIAM Symposium on Discrete Algorithms (SODA 2016). pp. 10–24 (2016) [36] Bennett, C.H.: Logical reversibility of computation. IBM Journal of Research and Development 17(6), 525–532 (1973) [37] Bennett, H., Ganju, A., Peetathawatchai, P., Stephens-Davidowitz, N.: Just how hard are rotations of Zn ? Algorithms and cryptography with the simplest lattice. In: Advances in Cryptology – EUROCRYPT 2023. LNCS, vol. 14008, pp. 252–281. Springer (2023) [38] Berlekamp, E.R., McEliece, R.J., van Tilborg, H.C.A.: On the inherent intractability of certain coding problems. IEEE Transactions on Information Theory 24(3), 384–386 (1978) 92

[39] Bernstein, D.J.: Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete? In: Workshop Record of SHARCS 2009 (2009) [40] Bernstein, D.J.: Grover vs. McEliece. In: Post-Quantum Cryptography – PQCrypto 2010. LNCS, vol. 6061, pp. 73–80. Springer (2010) [41] Bernstein, D.J., Chuengsatiansup, C., Lange, T., van Vredendaal, C.: NTRU prime: Reducing attack surface at low cost. In: Selected Areas in Cryptography – SAC 2017. LNCS, vol. 10719, pp. 235–260. Springer (2017) [42] Bernstein, D.J., Hopwood, D., Hülsing, A., Lange, T., Niederhagen, R., Papachristodoulou, L., Schneider, M., Schwabe, P., Wilcox-O’Hearn, Z.: SPHINCS: Practical stateless hashbased signatures. In: Advances in Cryptology – EUROCRYPT 2015. LNCS, vol. 9056, pp. 368–397. Springer (2015) [43] Bernstein, D.J., Hülsing, A., Kölbl, S., Niederhagen, R., Rijneveld, J., Schwabe, P.: The SPHINCS+ signature framework. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS 2019). pp. 2129–2146 (2019) [44] Bernstein, D.J., Lange, T., Martindale, C., Panny, L.: Quantum circuits for the CSIDH: Optimizing quantum evaluation of isogenies. In: Advances in Cryptology – EUROCRYPT 2019. LNCS, vol. 11477, pp. 409–441. Springer (2019) [45] Bernstein, D.J., Yang, B.Y.: Asymptotically faster quantum algorithms to solve multivariate quadratic equations. In: Post-Quantum Cryptography – PQCrypto 2018. LNCS, vol. 10786, pp. 487–506. Springer (2018) [46] Beullens, W.: MAYO: Practical post-quantum signatures from oil-and-vinegar maps. In: Selected Areas in Cryptography – SAC 2021. LNCS, vol. 13203, pp. 355–376. Springer (2021) [47] Beullens, W.: Breaking Rainbow takes a weekend on a laptop. In: Advances in Cryptology – CRYPTO 2022. LNCS, vol. 13508, pp. 464–479. Springer (2022) [48] Beullens, W., Kleinjung, T., Vercauteren, F.: CSI-FiSh: Efficient isogeny based signatures through class group computations. In: Advances in Cryptology – ASIACRYPT 2019. LNCS, vol. 11921, pp. 227–247. Springer (2019) [49] Biasse, J.F., Bonnetain, X., Kirshanova, E., Schrottenloher, A., Song, F.: Quantum algorithms for attacking hardness assumptions in classical and post-quantum cryptography. IET Information Security 17(2), 171–209 (2023), doi:10.1049/ise2.12081 [50] Biasse, J.F., Jao, D., Sankar, A.: A quantum algorithm for computing isogenies between supersingular elliptic curves. In: Progress in Cryptology – INDOCRYPT 2014. LNCS, vol. 8885, pp. 428–442. Springer (2014) [51] Biasse, J.F., Micheli, G., Persichetti, E., Santini, P.: LESS is more: Code-based signatures without syndromes. In: Progress in Cryptology – AFRICACRYPT 2020. LNCS, vol. 12174, pp. 45–65. Springer (2020) [52] Biasse, J.F., Song, F.: Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields. In: Proceedings of the 27th Annual ACM-SIAM Symposium on Discrete Algorithms (SODA 2016). pp. 893–902 (2016) [53] Bindel, N., Brendel, J., Fischlin, M., Goncalves, B., Stebila, D.: Hybrid key encapsulation mechanisms and authenticated key exchange. In: Post-Quantum Cryptography – PQCrypto 2019. LNCS, vol. 11505, pp. 206–226. Springer (2019) 93

[54] Bolboceanu, M., Brakerski, Z., Perlman, R., Sharma, D.: Order-LWE and the hardness of ring-LWE with entropic secrets. In: Advances in Cryptology – ASIACRYPT 2019. LNCS, vol. 11922, pp. 91–120. Springer (2019) [55] Bonnetain, X., Schrottenloher, A.: Quantum security analysis of CSIDH. In: Advances in Cryptology – EUROCRYPT 2020. LNCS, vol. 12106, pp. 493–522. Springer (2020) [56] Bos, J.W., Costello, C., Ducas, L., Mironov, I., Naehrig, M., Nikolaenko, V., Raghunathan, A., Stebila, D.: Frodo: Take off the ring! Practical, quantum-secure key exchange from LWE. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS 2016). pp. 1006–1018 (2016) [57] Bos, J.W., Ducas, L., Kiltz, E., Lepoint, T., Lyubashevsky, V., Schanck, J.M., Schwabe, P., Seiler, G., Stehlé, D.: CRYSTALS-Kyber: A CCA-secure module-lattice-based KEM. In: IEEE European Symposium on Security and Privacy (EuroS&P 2018). pp. 353–367 (2018) [58] Boucher, M., Fouque, P.A., Shen, Y.: Cyclotomic cosets: Hidden subgroup and quantum sieving algorithm for prime-power moduli. Cryptology ePrint Archive, Paper 2026/2249; arXiv:2609.34996 (2026) [59] Boudgoust, K., Jeudy, C., Roux-Langlois, A., Wen, W.: On the hardness of module learning with errors with short distributions. Journal of Cryptology 36(1), 1 (2023), doi:10.1007/s00145-022-09441-3 [60] Brakerski, Z., Gentry, C., Vaikuntanathan, V.: (Leveled) fully homomorphic encryption without bootstrapping. In: Proceedings of the 3rd Innovations in Theoretical Computer Science Conference (ITCS 2012). pp. 309–325 (2012) [61] Brakerski, Z., Kirshanova, E., Stehlé, D., Wen, W.: Learning with errors and extrapolated dihedral cosets. In: Public-Key Cryptography – PKC 2018. LNCS, vol. 10770, pp. 702–727. Springer (2018), arXiv:1710.08223 [62] Brakerski, Z., Langlois, A., Peikert, C., Regev, O., Stehlé, D.: Classical hardness of learning with errors. In: Proceedings of the 45th Annual ACM Symposium on Theory of Computing (STOC 2013). pp. 575–584 (2013) [63] Brakerski, Z., Lyubashevsky, V., Vaikuntanathan, V., Wichs, D.: Worst-case hardness for LPN and cryptographic hashing via code smoothing. In: Advances in Cryptology – EUROCRYPT 2019. LNCS, vol. 11478, pp. 619–635. Springer (2019) [64] Brassard, G., Høyer, P., Kalach, K., Kaplan, M., Laplante, S., Salvail, L.: Merkle puzzles in a quantum world. In: Advances in Cryptology – CRYPTO 2011. LNCS, vol. 6841, pp. 391–410. Springer (2011) [65] Brassard, G., Høyer, P., Tapp, A.: Quantum cryptanalysis of hash and claw-free functions. In: LATIN’98: Theoretical Informatics. LNCS, vol. 1380, pp. 163–169. Springer (1998) [66] Briaud, P., Lemoine, A., Randriambololona, H., Tillich, J.P.: A heuristic subexponential attack on the McEliece cryptosystem. Cryptology ePrint Archive, Paper 2026/1232 (2026), posted June 10, 2026; revised September 17, 2026 [67] Bruna, J., Regev, O., Song, M.J., Tang, Y.: Continuous LWE. In: Proceedings of the 53rd Annual ACM Symposium on Theory of Computing (STOC 2021). pp. 694–707 (2021)

94

[68] BSI (Bundesamt für Sicherheit in der Informationstechnik): Notes on recent developments concerning Classic McEliece. BSI publication (2026), dated 29 September 2026; consulted October 11, 2026. https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto /Notes_Classic_McEliece.pdf [69] Cartor, R., Manganiello, F., Youmans, W.: A locality-sensitive hashing framework for reducing bounded distance decoding to EDCP. In: Theory of Cryptography – TCC 2026. LNCS, Springer (2026), cryptology ePrint Archive, Paper 2026/2055 [70] Castryck, W., Decru, T.: An efficient key recovery attack on SIDH. In: Advances in Cryptology – EUROCRYPT 2023. LNCS, vol. 14008, pp. 423–447. Springer (2023) [71] Castryck, W., Lange, T., Martindale, C., Panny, L., Renes, J.: CSIDH: An efficient post-quantum commutative group action. In: Advances in Cryptology – ASIACRYPT 2018. LNCS, vol. 11274, pp. 395–427. Springer (2018) [72] Chailloux, A., Hermouet, P.: On the quantum equivalence between S|LWE⟩ and ISIS. In: Advances in Cryptology – CRYPTO 2026. LNCS, Springer (2026), doi:10.1007/978-3-03235377-1_13; ePrint 2025/1857 [73] Chailloux, A., Loyer, J.: Lattice sieving via quantum random walks. In: Advances in Cryptology – ASIACRYPT 2021. LNCS, vol. 13093, pp. 63–91. Springer (2021) [74] Charles, D.X., Goren, E.Z., Lauter, K.E.: Cryptographic hash functions from expander graphs. Journal of Cryptology 22(1), 93–113 (2009) [75] Chase, M., Derler, D., Goldfeder, S., Orlandi, C., Ramacher, S., Rechberger, C., Slamanig, D., Zaverucha, G.: Post-quantum zero-knowledge and signatures from symmetric-key primitives. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS 2017). pp. 1825–1842 (2017) [76] Chen, I., Sun, D.: The dihedral hidden subgroup problem. Journal of Mathematical Cryptology 18(1), 20220029 (2024), doi:10.1515/jmc-2022-0029 [77] Chen, Y.: Quantum algorithms for lattice problems. Cryptology ePrint Archive, Paper 2024/555 (2024), received April 10, 2024. On April 18, 2024 the author reported a bug in Step 9, found by Hongxun Wu and independently by Thomas Vidick, and withdrew the main claim; revised April 19, 2024. https://eprint.iacr.org/2024/555 [78] Chen, Y., Hu, Z., Liu, Q., Luo, H., Tu, Y.: LWE with quantum amplitudes: Algorithm, hardness, and oblivious sampling. In: Advances in Cryptology – CRYPTO 2025. LNCS, Springer (2025), ePrint 2023/1498; arXiv:2310.00644 [79] Chen, Y., Liu, Q., Zhandry, M.: Quantum algorithms for variants of average-case lattice problems via filtering. In: Advances in Cryptology – EUROCRYPT 2022. LNCS, vol. 13277, pp. 372–401. Springer (2022) [80] Childs, A.M., van Dam, W.: Quantum algorithm for a generalized hidden shift problem. In: Proceedings of the 18th Annual ACM-SIAM Symposium on Discrete Algorithms (SODA 2007). pp. 1225–1232 (2007) [81] Childs, A.M., van Dam, W.: Quantum algorithms for algebraic problems. Reviews of Modern Physics 82(1), 1–52 (2010) [82] Childs, A.M., Jao, D., Soukharev, V.: Constructing elliptic curve isogenies in quantum subexponential time. Journal of Mathematical Cryptology 8(1), 1–29 (2014) 95

[83] Chou, T., Niederhagen, R., Persichetti, E., Randrianarisoa, T.H., Reijnders, K., Samardjiska, S., Trimoska, M.: Take your MEDS: Digital signatures from matrix code equivalence. In: Progress in Cryptology – AFRICACRYPT 2023. LNCS, vol. 14064, pp. 28–52. Springer (2023) [84] Classic McEliece team: Classic McEliece: ISO. https://classic.mceliece.org/iso.h tml (2026), web page, version June 15, 2026; consulted October 11, 2026 [85] Cooper, D.A., Apon, D.C., Dang, Q.H., Davidson, M.S., Dworkin, M.J., Miller, C.A.: Recommendation for stateful hash-based signature schemes. Special Publication 800-208, NIST (2020) [86] Couveignes, J.M.: Hard homogeneous spaces. Cryptology ePrint Archive, Paper 2006/291 (2006) [87] Cramer, R., Ducas, L., Peikert, C., Regev, O.: Recovering short generators of principal ideals in cyclotomic rings. In: Advances in Cryptology – EUROCRYPT 2016. LNCS, vol. 9666, pp. 559–585. Springer (2016) [88] Cramer, R., Ducas, L., Wesolowski, B.: Short Stickelberger class relations and application to Ideal-SVP. In: Advances in Cryptology – EUROCRYPT 2017. LNCS, vol. 10210, pp. 324–348. Springer (2017) [89] Debris-Alazard, T., Fallahpour, P., Stehlé, D.: Quantum oblivious LWE sampling and insecurity of standard model lattice-based SNARKs. In: Proceedings of the 56th Annual ACM Symposium on Theory of Computing (STOC 2024) (2024) [90] Debris-Alazard, T., Remaud, M., Tillich, J.P.: Quantum reduction of finding short code vectors to the decoding problem. arXiv:2106.02747 (2021) [91] Delfs, C., Galbraith, S.D.: Computing isogenies between supersingular elliptic curves over Fp . Designs, Codes and Cryptography 78(2), 425–440 (2016) [92] Ding, J., Schmidt, D.: Rainbow, a new multivariable polynomial signature scheme. In: Applied Cryptography and Network Security – ACNS 2005. LNCS, vol. 3531, pp. 164–175. Springer (2005) [93] Dinh, H., Moore, C., Russell, A.: McEliece and Niederreiter cryptosystems that resist quantum Fourier sampling attacks. In: Advances in Cryptology – CRYPTO 2011. LNCS, vol. 6841, pp. 761–779. Springer (2011) [94] Ducas, L., Kiltz, E., Lepoint, T., Lyubashevsky, V., Schwabe, P., Seiler, G., Stehlé, D.: CRYSTALS-Dilithium: A lattice-based digital signature scheme. IACR Transactions on Cryptographic Hardware and Embedded Systems 2018(1), 238–268 (2018) [95] Ducas, L., Postlethwaite, E.W., Pulles, L.N., van Woerden, W.: Hawk: Module LIP makes lattice signatures fast, compact and simple. In: Advances in Cryptology – ASIACRYPT 2022. LNCS, vol. 13794, pp. 65–94. Springer (2022) [96] Ducas, L., van Woerden, W.: A note on a claim of Eldar & Hallgren: LLL already solves it. Cryptology ePrint Archive, Paper 2021/1391 (2021) [97] Ducas, L., van Woerden, W.: On the lattice isomorphism problem, quadratic forms, remarkable lattices, and cryptography. In: Advances in Cryptology – EUROCRYPT 2022. LNCS, vol. 13277, pp. 643–673. Springer (2022)

96

[98] Dutto, S., Mercuri, P., Murru, N., Romano, L.: A survey about hidden subgroup problem from a mathematical and cryptographic perspective. arXiv:2512.02087 (2025) [99] Eisenträger, K., Hallgren, S., Kitaev, A., Song, F.: A quantum algorithm for computing the unit group of an arbitrary degree number field. In: Proceedings of the 46th Annual ACM Symposium on Theory of Computing (STOC 2014). pp. 293–302 (2014) [100] Eisenträger, K., Hallgren, S., Lauter, K., Morrison, T., Petit, C.: Supersingular isogeny graphs and endomorphism rings: Reductions and solutions. In: Advances in Cryptology – EUROCRYPT 2018. LNCS, vol. 10822, pp. 329–368. Springer (2018) [101] Eldar, L., Hallgren, S.: An efficient quantum algorithm for lattice problems achieving subexponential approximation factor. arXiv:2201.13450 (2022), see the response of Ducas and van Woerden, Cryptology ePrint Archive, Paper 2021/1391 [102] Ettinger, M., Høyer, P.: On quantum algorithms for noncommutative hidden subgroups. Advances in Applied Mathematics 25(3), 239–251 (2000) [103] Ettinger, M., Høyer, P., Knill, E.: The quantum query complexity of the hidden subgroup problem is polynomial. Information Processing Letters 91(1), 43–48 (2004) [104] Felderhoff, J., Pellet-Mary, A., Stehlé, D.: On Module Unique-SVP and NTRU. In: Advances in Cryptology – ASIACRYPT 2022, Part III. pp. 709–740. Springer (2022), full version: https://eprint.iacr.org/2022/1203 [105] Feneuil, T., Joux, A., Rivain, M.: Syndrome decoding in the head: Shorter signatures from zero-knowledge proofs. In: Advances in Cryptology – CRYPTO 2022. LNCS, vol. 13508, pp. 541–572. Springer (2022) [106] Feo, L.D., Kohel, D., Leroux, A., Petit, C., Wesolowski, B.: SQISign: Compact postquantum signatures from quaternions and isogenies. In: Advances in Cryptology – ASIACRYPT 2020. LNCS, vol. 12491, pp. 64–93. Springer (2020) [107] Fernandez, R.: Structural cryptanalysis of Classic McEliece, 2024–2026: A critical assessment of claims, costs and evidence. arXiv:2610.31196 [cs.CR] (2026) [108] Fouque, P.A., Hoffstein, J., Kirchner, P., Lyubashevsky, V., Pornin, T., Prest, T., Ricosset, T., Seiler, G., Whyte, W., Zhang, Z.: Falcon: Fast-Fourier lattice-based compact signatures over NTRU. Submission to the NIST Post-Quantum Cryptography Standardization Process, Round 3 (2020) [109] Friedl, K., Ivanyos, G., Magniez, F., Santha, M., Sen, P.: Hidden translation and orbit coset in quantum computing. In: Proceedings of the 35th Annual ACM Symposium on Theory of Computing (STOC 2003). pp. 1–9 (2003) [110] Garey, M.R., Johnson, D.S.: Computers and Intractability: A Guide to the Theory of NP-Completeness. W. H. Freeman (1979) [111] Gentry, C.: Fully homomorphic encryption using ideal lattices. In: Proceedings of the 41st Annual ACM Symposium on Theory of Computing (STOC 2009). pp. 169–178 (2009) [112] Gentry, C., Peikert, C., Vaikuntanathan, V.: Trapdoors for hard lattices and new cryptographic constructions. In: Proceedings of the 40th Annual ACM Symposium on Theory of Computing (STOC 2008). pp. 197–206 (2008) [113] Gentry, C., Sahai, A., Waters, B.: Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based. In: Advances in Cryptology – CRYPTO 2013. LNCS, vol. 8042, pp. 75–92. Springer (2013) 97

[114] Ghoshal, A., Ishai, Y., Jain, A., Sun, N.: Quasipolynomial cryptanalysis of the McEliece cryptosystem (or: PIR meets McEliece). Cryptology ePrint Archive, Paper 2026/1630 (2026), posted August 7, 2026; revised August 27, 2026 [115] Giacon, F., Heuer, F., Poettering, B.: KEM combiners. In: Public-Key Cryptography – PKC 2018. LNCS, vol. 10769, pp. 190–218. Springer (2018) [116] Goldreich, O., Goldwasser, S.: On the limits of nonapproximability of lattice problems. Journal of Computer and System Sciences 60(3), 540–563 (2000) [117] Goldreich, O., Goldwasser, S., Halevi, S.: Public-key cryptosystems from lattice reduction problems. In: Advances in Cryptology – CRYPTO 1997. LNCS, vol. 1294, pp. 112–131. Springer (1997) [118] Grover, L.K.: A fast quantum mechanical algorithm for database search. In: Proceedings of the 28th Annual ACM Symposium on Theory of Computing (STOC 1996). pp. 212–219 (1996) [119] Guo, Y., Yang, S.: Rigorous statements and proofs of the lemmas in Simon’s algorithm for the dihedral coset problem and their underlying hypothesis. Cryptology ePrint Archive, Paper 2026/1714; arXiv:2608.16598 (2026), https://eprint.iacr.org/2026/1714 [120] Gupte, A., Ragavan, S., Zhandry, M.: The ePrint:2026/1591 quantum algorithm does not solve DCP. Cryptology ePrint Archive, Paper 2026/1693 (2026), posted August 15, 2026; revised September 1, 2026. https://eprint.iacr.org/2026/1693 [121] Gupte, A., Ragavan, S., Zhandry, M.: Lean 4 formalisation of “the ePrint:2026/1591 quantum algorithm does not solve DCP”. GitHub repository (2026), main theorem MainTheorem.thm_main; refutation corollary in Refutation.lean. https://github.com /sragavan99/lean-ePrint-2026-1591-refutation; consulted October 2, 2026 (commit identifier not recorded); README re-read October 18, 2026 (models the draft dated August 11, 2026) [122] Gupte, A., Vafa, N., Vaikuntanathan, V.: Continuous LWE is as hard as LWE & applications to learning Gaussian mixtures. In: 63rd IEEE Symposium on Foundations of Computer Science (FOCS 2022). pp. 1162–1173 (2022) [123] Hallgren, S., Moore, C., Rötteler, M., Russell, A., Sen, P.: Limitations of quantum coset states for graph isomorphism. Journal of the ACM 57(6), 34:1–34:33 (2010) [124] Hallgren, S., Russell, A., Ta-Shma, A.: The hidden subgroup problem and quantum computation using group representations. SIAM Journal on Computing 32(4), 916–934 (2003) [125] HAWK team: Withdrawal of HAWK from the third round of the NIST additional signature process. Announcement on the NIST pqc-forum mailing list, July 29, 2026, as reported in The Hacker News, https://thehackernews.com/2026/07/claude-ai-just-cracked-p ost-quantum.html (2026) [126] Hemmert, T.: Key recovery for the McEliece cryptosystem using higher-order vanishing. Cryptology ePrint Archive, Paper 2026/1339 (2026), posted June 29, 2026 [127] Hemmert, T., Wiemers, A.: Distinguishing Goppa codes using higher-order vanishing. In: Advances in Cryptology – CRYPTO 2026. LNCS, vol. 16803, pp. 191–223. Springer (2026), cryptology ePrint Archive, Paper 2025/1661

98

[128] Hoffstein, J., Pipher, J., Silverman, J.H.: NTRU: A ring-based public key cryptosystem. In: Algorithmic Number Theory – ANTS-III. LNCS, vol. 1423, pp. 267–288. Springer (1998) [129] Hülsing, A.: W-OTS+ – shorter signatures for hash-based signature schemes. In: Progress in Cryptology – AFRICACRYPT 2013. LNCS, vol. 7918, pp. 173–188. Springer (2013) [130] Hülsing, A., Butin, D., Gazdag, S.L., Rijneveld, J., Mohaisen, A.: XMSS: eXtended Merkle Signature Scheme. RFC 8391 (2018) [131] Ishai, Y., Kushilevitz, E., Ostrovsky, R., Sahai, A.: Zero-knowledge from secure multiparty computation. In: Proceedings of the 39th Annual ACM Symposium on Theory of Computing (STOC 2007). pp. 21–30 (2007) [132] ISO/IEC: ISO/IEC 18033-2:2006/Amd 2:2026, information technology — security techniques — encryption algorithms — part 2: Asymmetric ciphers, amendment 2. International Organization for Standardization (2026) [133] Ivanyos, G., Sanselme, L., Santha, M.: An efficient quantum algorithm for the hidden subgroup problem in extraspecial groups. In: STACS 2007. LNCS, vol. 4393, pp. 586–597. Springer (2007) [134] Jao, D., Feo, L.D.: Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. In: Post-Quantum Cryptography – PQCrypto 2011. LNCS, vol. 7071, pp. 19–34. Springer (2011) [135] Jaques, S., Schanck, J.M.: Quantum cryptanalysis in the RAM model: Claw-finding attacks on SIKE. In: Advances in Cryptology – CRYPTO 2019. LNCS, vol. 11692, pp. 32–61. Springer (2019) [136] Kachigar, G., Tillich, J.P.: Quantum information set decoding algorithms. In: PostQuantum Cryptography – PQCrypto 2017. LNCS, vol. 10346, pp. 69–89. Springer (2017) [137] Kipnis, A., Patarin, J., Goubin, L.: Unbalanced oil and vinegar signature schemes. In: Advances in Cryptology – EUROCRYPT 1999. LNCS, vol. 1592, pp. 206–222. Springer (1999) [138] Kipnis, A., Shamir, A.: Cryptanalysis of the oil and vinegar signature scheme. In: Advances in Cryptology – CRYPTO 1998. LNCS, vol. 1462, pp. 257–266. Springer (1998) [139] Kirchner, P., Fouque, P.A.: Revisiting lattice attacks on overstretched NTRU parameters. In: Advances in Cryptology – EUROCRYPT 2017. LNCS, vol. 10210, pp. 3–26. Springer (2017) [140] Ko, K.H., Lee, S.J., Cheon, J.H., Han, J.W., sung Kang, J., Park, C.: New public-key cryptosystem using braid groups. In: Advances in Cryptology – CRYPTO 2000. LNCS, vol. 1880, pp. 166–183. Springer (2000) [141] Kohel, D., Lauter, K., Petit, C., Tignol, J.P.: On the quaternion ℓ-isogeny path problem. LMS Journal of Computation and Mathematics 17(A), 418–432 (2014) [142] Kothari, R., O’Donnell, R., Wu, K.: No exponential quantum speedup for SIS∞ anymore. In: Proceedings of the 58th Annual ACM Symposium on Theory of Computing (STOC 2026) (2026), doi:10.1145/3798129.3800731; arXiv:2510.07515 [143] Kuperberg, G.: A subexponential-time quantum algorithm for the dihedral hidden subgroup problem. SIAM Journal on Computing 35(1), 170–188 (2005) 99

[144] Kuperberg, G.: Another subexponential-time quantum algorithm for the dihedral hidden subgroup problem. In: 8th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 2013). LIPIcs, vol. 22, pp. 20–34 (2013) [145] Kuperberg, G.: The hidden subgroup problem for infinite groups. arXiv:2507.18499 (2025) [146] Laarhoven, T., Mosca, M., van de Pol, J.: Solving the shortest vector problem in lattices faster using quantum search. In: Post-Quantum Cryptography – PQCrypto 2013. LNCS, vol. 7932, pp. 83–101. Springer (2013) [147] Laarhoven, T., van de Pol, J., de Weger, B.: Solving hard lattice problems and the security of lattice-based cryptosystems. Cryptology ePrint Archive, Paper 2012/533 (2012) [148] Lagarias, J.C., Odlyzko, A.M.: Solving low-density subset sum problems. Journal of the ACM 32(1), 229–246 (1985) [149] Lamport, L.: Constructing digital signatures from a one way function. Tech. Rep. CSL-98, SRI International (1979) [150] Langlois, A., Stehlé, D.: Worst-case to average-case reductions for module lattices. Designs, Codes and Cryptography 75(3), 565–599 (2015) [151] Lenstra, A.K., Lenstra, H.W., Lovász, L.: Factoring polynomials with rational coefficients. Mathematische Annalen 261, 515–534 (1982) [152] Lindner, R., Peikert, C.: Better key sizes (and attacks) for LWE-based encryption. In: Topics in Cryptology – CT-RSA 2011. LNCS, vol. 6558, pp. 319–339. Springer (2011) [153] Lyubashevsky, V.: Lattice signatures without trapdoors. In: Advances in Cryptology – EUROCRYPT 2012. LNCS, vol. 7237, pp. 738–755. Springer (2012) [154] Lyubashevsky, V., Micciancio, D.: On bounded distance decoding, unique shortest vectors, and the minimum distance problem. In: Advances in Cryptology – CRYPTO 2009. LNCS, vol. 5677, pp. 577–594. Springer (2009) [155] Lyubashevsky, V., Micciancio, D., Peikert, C., Rosen, A.: SWIFFT: A modest proposal for FFT hashing. In: Fast Software Encryption – FSE 2008. LNCS, vol. 5086, pp. 54–72. Springer (2008) [156] Lyubashevsky, V., Palacio, A., Segev, G.: Public-key cryptographic primitives provably as secure as subset sum. In: Theory of Cryptography – TCC 2010. LNCS, vol. 5978, pp. 382–400. Springer (2010) [157] Lyubashevsky, V., Peikert, C., Regev, O.: On ideal lattices and learning with errors over rings. Journal of the ACM 60(6), 43:1–43:35 (2013), preliminary version in EUROCRYPT 2010 [158] Maino, L., Martindale, C., Panny, L., Pope, G., Wesolowski, B.: A direct key recovery attack on SIDH. In: Advances in Cryptology – EUROCRYPT 2023. LNCS, vol. 14008, pp. 448–471. Springer (2023) [159] McEliece, R.J.: A public-key cryptosystem based on algebraic coding theory. DSN Progress Report 42–44, Jet Propulsion Laboratory (1978) [160] McGrew, D., Curcio, M., Fluhrer, S.: Leighton-Micali hash-based signatures. RFC 8554 (2019)

100

[161] Merkle, R.C.: A certified digital signature. In: Advances in Cryptology – CRYPTO ’89. LNCS, vol. 435, pp. 218–238. Springer (1990) [162] Micciancio, D., Goldwasser, S.: Complexity of Lattice Problems: A Cryptographic Perspective, The Kluwer International Series in Engineering and Computer Science, vol. 671. Kluwer Academic Publishers (2002) [163] Micciancio, D., Mol, P.: Pseudorandom knapsacks and the sample complexity of LWE search-to-decision reductions. In: Advances in Cryptology – CRYPTO 2011. LNCS, vol. 6841, pp. 465–484. Springer (2011) [164] Micciancio, D., Peikert, C.: Trapdoors for lattices: Simpler, tighter, faster, smaller. In: Advances in Cryptology – EUROCRYPT 2012. LNCS, vol. 7237, pp. 700–718. Springer (2012) [165] Micciancio, D., Peikert, C.: Hardness of SIS and LWE with small parameters. In: Advances in Cryptology – CRYPTO 2013. LNCS, vol. 8042, pp. 21–39. Springer (2013) [166] Micciancio, D., Regev, O.: Worst-case to average-case reductions based on Gaussian measures. SIAM Journal on Computing 37(1), 267–302 (2007) [167] Moore, C., Rockmore, D., Russell, A., Schulman, L.J.: The power of strong Fourier sampling: Quantum algorithms for affine groups and hidden shifts. SIAM Journal on Computing 37(3), 938–958 (2007) [168] Moore, C., Russell, A., Schulman, L.J.: The symmetric group defies strong Fourier sampling. SIAM Journal on Computing 37(6), 1842–1864 (2008) [169] Morales, M.E.S.: The hidden subgroup problem in semidirect products and quasiHamiltonian groups. arXiv:2608.05321 (2026) [170] Myasnikov, A., Shpilrain, V., Ushakov, A.: Group-Based Cryptography. Advanced Courses in Mathematics – CRM Barcelona, Birkhäuser (2008) [171] National Institute of Standards and Technology: Module-lattice-based digital signature standard. FIPS 204, NIST (2024) [172] National Institute of Standards and Technology: Module-lattice-based key-encapsulation mechanism standard. FIPS 203, NIST (2024) [173] National Institute of Standards and Technology: Stateless hash-based digital signature standard. FIPS 205, NIST (2024) [174] National Institute of Standards and Technology: Status report on the fourth round of the NIST post-quantum cryptography standardization process. NIST IR 8545, NIST (2025) [175] National Institute of Standards and Technology: Nine candidates advance to the third round of the additional digital signatures for the PQC standardization process. NIST News, May 14, 2026 (accompanying NIST IR 8610) (2026) [176] National Institute of Standards and Technology: Post-quantum cryptography: Additional digital signature schemes – round 3 additional signatures. CSRC project page, last updated September 28, 2026; records that the HAWK submission team has withdrawn HAWK and links its announcement on the pqc-forum. https://csrc.nist.gov/projects/pqc-dig -sig/round-3-additional-signatures (2026), accessed October 8, 2026

101

[177] Nguyen, P.Q.: Cryptanalysis of the Goldreich–Goldwasser–Halevi cryptosystem from Crypto ’97. In: Advances in Cryptology – CRYPTO 1999. LNCS, vol. 1666, pp. 288–304. Springer (1999) [178] Nguyen, P.Q., Regev, O.: Learning a parallelepiped: Cryptanalysis of GGH and NTRU signatures. In: Advances in Cryptology – EUROCRYPT 2006. LNCS, vol. 4004, pp. 271–288. Springer (2006) [179] Niederreiter, H.: Knapsack-type cryptosystems and algebraic coding theory. Problems of Control and Information Theory 15(2), 159–166 (1986) [180] Njah Nchiwo, R.Y., Pellet-Mary, A.: Improved reduction from RLWE to MP-LWE. In: Public-Key Cryptography – PKC 2026. LNCS, Springer (2026), doi:10.1007/978-3-03226731-3_6; ePrint 2026/342 [181] Open Quantum Safe Project: liboqs algorithm datasheets: Classic McEliece, HQC, UOV, MAYO. https://openquantumsafe.org/liboqs/algorithms/ (2026), accessed October 1, 2026 [182] Page, A., Robert, D.: Introducing Clapoti(s): Evaluating the isogeny class group action in polynomial time. Cryptology ePrint Archive, Paper 2023/1766 (2023) [183] Patarin, J.: Hidden fields equations (HFE) and isomorphisms of polynomials (IP): Two new families of asymmetric algorithms. In: Advances in Cryptology – EUROCRYPT 1996. LNCS, vol. 1070, pp. 33–48. Springer (1996) [184] Patarin, J.: The oil and vinegar signature scheme. Presented at the Dagstuhl Workshop on Cryptography (1997) [185] Peikert, C.: Public-key cryptosystems from the worst-case shortest vector problem. In: Proceedings of the 41st Annual ACM Symposium on Theory of Computing (STOC 2009). pp. 333–342 (2009) [186] Peikert, C.: An efficient and parallel Gaussian sampler for lattices. In: Advances in Cryptology – CRYPTO 2010. LNCS, vol. 6223, pp. 80–97. Springer (2010) [187] Peikert, C.: A decade of lattice cryptography. Foundations and Trends in Theoretical Computer Science 10(4), 283–424 (2016) [188] Peikert, C.: He gives C-sieves on the CSIDH. In: Advances in Cryptology – EUROCRYPT 2020. LNCS, vol. 12106, pp. 463–492. Springer (2020) [189] Peikert, C., Pepin, Z.: Algebraically structured LWE, revisited. Journal of Cryptology 37, 28 (2024), doi:10.1007/s00145-024-09508-3 [190] Peikert, C., Regev, O., Stephens-Davidowitz, N.: Pseudorandomness of ring-LWE for any ring and modulus. In: Proceedings of the 49th Annual ACM Symposium on Theory of Computing (STOC 2017). pp. 461–473 (2017) [191] Pellet-Mary, A., Hanrot, G., Stehlé, D.: Approx-SVP in ideal lattices with pre-processing. In: Advances in Cryptology – EUROCRYPT 2019. LNCS, vol. 11477, pp. 685–716. Springer (2019) [192] Pellet-Mary, A., Stehlé, D.: On the hardness of the NTRU problem. In: Advances in Cryptology – ASIACRYPT 2021. LNCS, vol. 13090, pp. 3–35. Springer (2021)

102

[193] Pellet-Mary, A., Xia, W.: A unified reduction from RLWE to MP-LWE. In: Advances in Cryptology – ASIACRYPT 2026. LNCS, Springer (2026), cryptology ePrint Archive, Paper 2026/2026. https://eprint.iacr.org/2026/2026 [194] PostQuantum.com: Simon claims polynomial-time DCP quantum algorithm. News article (2026), timeline of the claim, D. Apon’s analysis (August 9–11, 2026) and the refutation; update of October 11, 2026 on the revision posted October 8. https://postquantum.co m/security-pqc/simon-quantum-algorithm-lattice-pqc/ [195] Prange, E.: The use of information sets in decoding cyclic codes. IRE Transactions on Information Theory 8(5), 5–9 (1962) [196] Quentir: A lattice attack was claimed on 3 august 2026 and answered on 15 august: What ePrint 2026/1591 and 2026/1693 say about ML-KEM. Blog post (2026), https://www.quen tir.ai/blog/2026/simon-dcp-lattice-claim-refuted-eprint-1591-1693-ml-kem [197] Randriambololona, H.: The syzygy distinguisher. In: Advances in Cryptology – EUROCRYPT 2025. LNCS, vol. 15606, pp. 324–354. Springer (2025), cryptology ePrint Archive, Paper 2024/1193 [198] Regev, O.: New lattice-based cryptographic constructions. Journal of the ACM 51(6), 899–942 (2004) [199] Regev, O.: Quantum computation and lattice problems. SIAM Journal on Computing 33(3), 738–760 (2004), preliminary version in FOCS 2002 [200] Regev, O.: A subexponential time algorithm for the dihedral hidden subgroup problem with polynomial space. arXiv:quant-ph/0406151 (2004) [201] Regev, O.: On lattices, learning with errors, random linear codes, and cryptography. Journal of the ACM 56(6), 34:1–34:40 (2009), preliminary version in STOC 2005 [202] Robert, D.: Breaking SIDH in polynomial time. In: Advances in Cryptology – EUROCRYPT 2023. LNCS, vol. 14008, pp. 472–503. Springer (2023) [203] Roşca, M., Sakzad, A., Stehlé, D., Steinfeld, R.: Middle-product learning with errors. In: Advances in Cryptology – CRYPTO 2017. LNCS, vol. 10403, pp. 283–297. Springer (2017) [204] Rostovtsev, A., Stolbunov, A.: Public-key cryptosystem based on isogenies. Cryptology ePrint Archive, Paper 2006/145 (2006) [205] royess: Lean 4 audit of the dihedral coset algorithm of ePrint 2026/1591. GitHub repository (2026), https://github.com/royess/dihedral-coset-lean-audit; consulted October 2, 2026 (commit identifier not recorded); README re-read October 18, 2026 [206] Saarinen, M.J.O.: Bit operation cost of “holdout” key-recovery attacks against Classic McEliece. Cryptology ePrint Archive, Paper 2026/1786 (2026), posted August 24, 2026; revised September 15, 2026. https://eprint.iacr.org/2026/1786 [207] Saarinen, M.J.O.: HOVER: Higher-order vanishing endomorphism recovery. Cryptology ePrint Archive, Paper 2026/1778 (2026), posted August 22, 2026; revised August 24 and October 8, 2026. NORDSEC 2026, LNCS to appear; ePrint revision consulted October 11, 2026. Technical details cited from this preprint follow the revision of August 24, 2026. https://eprint.iacr.org/2026/1778 [208] Saarinen, M.J.O.: Two-anchor holdout/hermite: Solving the TII-254 McEliece key recovery challenge. Cryptology ePrint Archive, Paper 2026/1986 (2026), posted September 11, 2026; revised September 24, 2026. https://eprint.iacr.org/2026/1986 103

[209] Schnorr, C.P., Euchner, M.: Lattice basis reduction: Improved practical algorithms and solving subset sum problems. Mathematical Programming 66, 181–199 (1994) [210] Sendrier, N.: Finding the permutation between equivalent linear codes: The support splitting algorithm. IEEE Transactions on Information Theory 46(4), 1193–1203 (2000) [211] Shen, T., Li, X.: A survey on classical lattice algorithms. Cryptography 10(2), 17 (2026), doi:10.3390/cryptography10020017 [212] Shor, P.W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing 26(5), 1484–1509 (1997) [213] Simon, D.R.: On the power of quantum computation. SIAM Journal on Computing 26(5), 1474–1483 (1997) [214] Simon, D.R.: A polynomial-time quantum algorithm for the dihedral coset problem. Cryptology ePrint Archive, Paper 2026/1591 (2026), received August 3, 2026; made public August 6; revised six times, last on October 8, 2026 (PDF dated October 7, 2026, still labelled a preliminary draft), adding Section 3, “A Note on [6]”, on ePrint 2026/1693. https://eprint.iacr.org/2026/1591 [215] Stehlé, D., Steinfeld, R.: Making NTRU as secure as worst-case problems over ideal lattices. In: Advances in Cryptology – EUROCRYPT 2011. LNCS, vol. 6632, pp. 27–47. Springer (2011) [216] Stehlé, D., Steinfeld, R., Tanaka, K., Xagawa, K.: Efficient public key encryption based on ideal lattices. In: Advances in Cryptology – ASIACRYPT 2009. LNCS, vol. 5912, pp. 617–635. Springer (2009) [217] Straznickas, Z., Weis, S.A.: HAWK-n key recovery reduces to SVP in dimension n/2 + 1. Cryptology ePrint Archive, Paper 2026/1593 (2026), https://eprint.iacr.org/2026/1 593 [218] Sudo, K., Tezuka, M., Hara, K., Yoshida, Y.: Quantum search-to-decision reduction for the LWE problem. In: Progress in Cryptology – AFRICACRYPT 2023. LNCS, vol. 14064. Springer (2023), journal version in IEICE Trans. Fundamentals E108.A(2), 2025; ePrint 2023/344 [219] Tang, G., Duong, D.H., Joux, A., Plantard, T., Qiao, Y., Susilo, W.: Practical postquantum signature schemes from isomorphism problems of trilinear forms. In: Advances in Cryptology – EUROCRYPT 2022. LNCS, vol. 13277, pp. 582–612. Springer (2022) [220] Tao, C., Petzoldt, A., Ding, J.: Efficient key recovery for all HFE signature variants. In: Advances in Cryptology – CRYPTO 2021. LNCS, vol. 12825, pp. 70–93. Springer (2021) [221] The SQIsign team: SQIsign: Algorithm specifications and supporting documentation, version 3.0. https://sqisign.org/ (2026), round-3 submission to the NIST additional signatures process [222] Vedenev, K.: Extending distinguishing to key recovery for subfield subcodes of GRS codes. Cryptology ePrint Archive, Paper 2026/1747 (2026), posted August 20, 2026; revised October 7, 2026. https://eprint.iacr.org/2026/1747. Earlier versions, in particular the working draft of September 6, 2026, are identified explicitly where they are discussed [223] Wee, H.: Circuit ABE with poly(depth, λ)-sized ciphertexts and keys from lattices. In: Advances in Cryptology – CRYPTO 2024. LNCS, Springer (2024), ePrint 2024/1416 104

[224] Weis, S.A.: Improving GIJS key recovery for Classic McEliece. Cryptology ePrint Archive, Paper 2026/1984 (2026), version 0.5, October 6, 2026; version 0.1 posted September 11, 2026. https://eprint.iacr.org/2026/1984 [225] Wen, W., Zheng, J.: Module learning with errors and structured extrapolated dihedral cosets. In: Advances in Cryptology – CRYPTO 2026. LNCS, Springer (2026), doi:10.1007/978-3-032-35377-1_9; ePrint 2026/155 [226] Wesolowski, B.: The supersingular isogeny path and endomorphism ring problems are equivalent. In: 62nd IEEE Symposium on Foundations of Computer Science (FOCS 2021). pp. 1100–1111 (2021) [227] Zhang, Y.: Exact coset sampling for quantum lattice algorithms. arXiv:2509.12341 [quantph] (2025), first posted September 15, 2025; version 8 of May 14, 2026 used here. https: //arxiv.org/abs/2509.12341 [228] Zhou, J.: On the sample complexity of the generalized hidden shift problem over arbitrary finite groups. arXiv:2609.05828 (2026)

105

Related documents

• Beyond LWE: Post-Quantum Assumptions under a Counterfactual Break of the Dihedral Coset Problem#1468335
• Solving computational tasks using quantum computing — Accenture Global Solutions Limited (US11250334B2)#607103
• Quantum state isomorphism problems for groups#1155196
• GreenPeas: Unlocking Adaptive Quantum Error Correction with Just-in-Time Decoding Hypergraphs#120490
• Higher-order Parity Constraints for Quantum Approximate Optimization#1401551