I might just ask about concrete evidence for the asymptotics of $\lambda_1(\Lambda^\perp(A))$. While my interest in that is influenced by the recent paper, whether or not that's true I'm pretty interested in it at this point (although not interested enough to start computing some short vectors myself)

@Mark Possibly relevant to your interests: groups.google.com/a/list.nist.gov/forum/#!forum/pqc-forum

they apparently moved the mailing list stuff to a google group

there is an "apply to join group" link near the top

it appears to still be active, the most recent date is January 13th

I decoded the mathjax. No idea what it even means. PQC isn't my thing.

I halfway get it. lambda conventionally refers to the shortest vector of the lattice

they appear to have placed an upper bound on the size of the shortest vector

I think that's what going on anyways, like I said, I only halfway get it

Mfw someone upvoted Paul's weird answer to my Twofish question.

I'm almost tempted to flag it as NAA because it only re-hashes what I already know.

It doesn't actually answer my question but just speculates.

Random question, but it's usually said that symmetric ciphers are not based on any hardness problem, unlike most asymmetric cryptography. Why couldn't the security of a symmetric cipher be thought of as coming from the difficulty of solving a set of multivariate polynomial equations? If an easy technique is found that renders said problem trivial, every symmetric cipher would be broken by an XSL-like algebraic attack.

But 3-SAT is NP-complete

Ah, so it would take a far bigger breakthrough than finding a fast classical factorization algorithm then, I take it.

only if, the cipher doesn't have some hidden structure.

@forest You are thinking about it the wrong way round. What you are saying would mean "If there exists a secure symmetric cipher, then solving systems of multivatiate polynomial equations is hard on average." But that doesn't help you to determine whether secure symetric ciphers exist. You want the opposite "If solving systems of multivatiate polynomial equations is hard, then there exists a secure symmetric cipher."

Yes, although a problem is NP-complete not all instances are hard to solve.

I always wonder how the Bard noticed the repeating structure in the Keeloq to break it algebraically.

Keeloq is that proprietary cipher with like 700 rounds, right?

This one eprint.iacr.org/2007/062.pdf

I said Bard since it is mentioned in his book...

Ah 528 rounds.

symantec.com/connect/blogs/what-if-aes-fails

I'm pretty sure I know what vendors would do.

I'm more curious about any official government policies.

Well, they already want the Clipper back. :)

lol

@suigin 久しぶりです。僕はその論文が知ってるとおもう。レーブーされたかも。メールが同じと連絡します。

Did Paul delete one downvoted answer yesterday to post another?

@FutureSecurity possibly, but this is no reason to worry as we generally encourage answers to not be fundamentally modified but instead a new answer to be posted

@SEJPM so delete the old one and write a new one is the preferred way?

@kelalaka yes

(for truly major revisions)

I see.

@Mark See, that turned out to be a nice question that the lattice folks were definitely already scrutinizing

The major revision part is still bad. He didn't learn what part was incorrect in that short time. I wouldn't credit him for revising because I don't think it came about from intellectual honesty.

@kelalaka Please refrain from answering questions in the comments

Sure.

@EllaRose I've cleaned up.

This has dupe with this but has no answer. What to do?

Thanks

I'm not sure what the policy on duplicates of unanswered questions is

I poked Mikero to answer at least one of them even a short answer so we can dupe. He already write a proof for this for his lectures he said.

I'm still reading a lot of question, and still have many. I started to put a up vote marker for every question :)

and of course for the good answers...