Read as
Lattice cryptanalysis is the field that determines how confident we should be in ML-KEM, ML-DSA, and lattice-based PQ. The state-of-the-art classical attacks are LLL (basis reduction, polynomial time but exponential approximation factor), BKZ (block KZ reduction, parameter-tunable), and sieving algorithms (BDGL, BKW, exponential time, exponential space). Quantum attacks on lattices are not asymptotically faster — Grover-style speedups give modest improvements. This module is the technical landscape for evaluating long-term confidence in ML-KEM/DSA: which attacks scale, what the security margins actually are, and where research could change the calculus.
When ML-KEM-768 says “Level 3 security, equivalent to AES-192 against quantum,” that claim depends on no major cryptanalytic breakthrough against lattices. Understanding the cryptanalysis is how you know whether to trust the security claim, and when to update it.
The lattice problems we trust
Three problems underpin lattice crypto:
- SVP (Shortest Vector Problem) — find the shortest non-zero vector in a lattice. NP-hard in worst case.
- CVP (Closest Vector Problem) — given a target, find the lattice point closest to it. Also NP-hard.
- LWE (Learning With Errors) — the variant that ML-KEM/DSA actually use. Reduction shows it’s at least as hard as worst-case SVP variants.
“NP-hard worst case” doesn’t mean “always hard.” Cryptography needs average-case hardness. Lattice crypto’s average-case hardness for the parameter ranges we use is conjectural — well-studied, broadly believed, but not proven.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants