### 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CISS3341

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|q-ary Lattices and the Z-Shape

Recall that both NTRU and LWE give rise to $q$-ary lattices. These lattices always contain the vector $(q, 0, \ldots, 0)$ and all its permutations. These so-called ‘ $q$-vectors’ can be considered short, depending on the parameters of the instance being considered, and might be shorter than what we would expect to obtain following predictions such as the GSA or the TGSA. Furthermore, some of those $q$-vectors naturally appear in the typical basis construction of $q$-ary lattices. Even when this is not the case, they can be made explicit by computing the Hermite Normal Form.

To predict lattice reduction on such bases, we may observe that one of the guarantees of the LLL algorithm is that the first vector $\mathbf{b}_0$ never gets longer. For certain parameters this can contradict the GSA. In fact, if $\mathbf{b}_i^$ does not change for all $i$ cannot become longer either, which means that after the reduction algorithm has completed we may still have many such $q$-vectors at the beginning of our basis, unaffected by the reduction. It is therefore tempting to predict a piecewise linear profile, with two pieces. It should start with a flat line at $\lg q$, followed by a sloped portion following the predicted GSA slope.

In fact, the shape has three pieces, and this is easy to argue for LLL, since LLL is a self-dual algorithm. ${ }^2$ This means in particular that the last GramSchmidt vector cannot get shorter, and following the same argument, we can conclude that the basis must end with a flat piece of 1-vectors. All in all, the basis should follow a Z-shape, and this is indeed experimentally the case [280, 625], as depicted in Figure 2.5, where we picked a small $q$ to highlight the effect. We shall call such a prediction $[169,625]$ the ZGSA.

It is tempting to extend such a ZGSA model to other algorithms beyond LLL and this has been used for example in [169]. We might also attempt to refine it to a ZTGSA model, where we put an HKZ tail just before the flat section of Gram-Schmidt vectors of norm 1. However, this is a questionable way of reasoning, because BKZ, unlike LLL, is not self-dual. However, it is worth noting that it seems possible to force BKZ to behave in such a way, simply by restricting BKZ to work on the indices up $i<j$, where $j$ is carefully calibrated so that $\left|\mathbf{b}_j^{\star}\right| \approx 1$. This is not self-dual, but up to the tail of BKZ, it would produce a $Z$-shape as well.

Yet, we could also let BKZ work freely on the whole basis, and wonder what would happen. In other words, we may ask whether it is preferable to apply such a restriction to $\mathrm{BKZ}$ or not. A natural approach to answering this question would be to simply use the CN11 simulator, however, it appears that the $Z$-shape is very poorly simulated. Indeed, while the simulator can easily maintain $q$-vectors when they are shorter than the one locally predicted by the Gaussian heuristic, the phenomenon on the right end of the $Z$ seems more complicated: some 1-vectors are replaced by Gram-Schmidt vectors of norm strictly less than 1, but not all, see Figure 2.6. Thus, we see the Z-shape known from the literature but with the addition of a kink in the tail block.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Random Blocks

The heuristic analysis of $\mathrm{BKZ}$ is based on the assumption that each sublattice considered by the algorithm ‘behaves like a random lattice’ (strong version), or at least that the expectation or distribution of its shortest vector is the same as for a random lattice (weak version).

More formally, we would have to define the notion of a random lattice,invoking the Haar measure. However, we can nevertheless interrogate this heuristic without going into those details here. Indeed, as we can see in Figure $2.2$, the predicted slopes below dimension 30 are far from the actual behaviour. In fact, the predictions for small block sizes are nonsensical as they predict a flatter slope as $\beta$ decreases below 30 and even an inversion of the slope below block size $\approx 10$.

Although we can observe the prediction and the observation converging for block sizes above 50 , what level of precision do we attribute to those predictions? Given the phenomena perturbing the GSA surveyed in this chapter (heads, tails, ripples), how pertinent are the data from Figure 2.2? Pushing experimental evidence a bit further would be reassuring here: although we do not expect surprises, it would be good to replace this expectation with experimental evidence.

But, more conceptually, we note that making the strong version of the heuristic assumption (each block behaves like a random lattice) is self-contradictory. Indeed, the model leads us to conclude that the shape is essentially a line, at least when $\beta \ll d$ and the considered block $\mathbf{B}{[\kappa: \kappa+\beta]}$ is far from the head and the tail, i.e., $\kappa \gg \beta, d-\kappa \gg \beta$. But this block, like all other blocks, is fully HKZ-reduced: since $\mathbf{b}{\kappa+i}^{\star}$ is a shortest vector of $\Lambda\left(\mathbf{B}{[\kappa+i: k+i+\beta]}\right)$, it is also a shortest vector of $\Lambda\left(\mathbf{B}{[\kappa+i: k+\beta]}\right)$. Yet, HKZ-reduced bases of random lattices have a concave shape not a straight slope.

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。