Paper 2026/1048

Unified Dual Attack Analyses: Covariance-Based Score Distribution Prediction for LWE

Abstract

The Learning with Errors (LWE) problem underpins many post-quantum cryptosystems, including the NIST-selected CRYSTALS-KYBER and CRYSTALS-DILITHIUM. Recent dual attacks have demonstrated remarkable effectiveness against concrete LWE-based schemes, with some claims suggesting that the security of CRYSTALS-KYBER may be reduced below the NIST threshold. However, the analysis of the score distribution for the correct guess in dual attacks has consistently relied on a flawed independence assumption, leading to variance estimates that are far smaller than the true score variance. This issue has been highlighted in several studies. For instance, Bashiri and Wiemers (JMC 2025) proposed an estimate of the variance, yet our experiments reveal that their approach performs poorly in medium-to-high dimensions. On the other hand, many works have characterized the success probability of dual attacks, but these are either based on the BDD problem or limited to specific attack types, lacking a unified analytical framework for dual attacks on LWE. These theoretical gaps motivate us to develop a unified estimation of the expectation and variance of the score in dual attacks. In this paper, we propose a unified predictive model for the expectation and variance of the score, covering three types of dual attacks: the original dual attack, the dual attack with modulus switching, and the dual attack with decoding (Crypto 2025). Our key observation is that the cosine of the angle between different short vectors follows a normal distribution, which we use to estimate the covariance between individual scores. By decomposing the score expression into a combination of simple distributions, we obtain estimates for the expectation and variance of individual scores, and combine these with the covariance to derive closed-form estimates for the total variance. Experiments show that our estimates achieve high accuracy and outperform previous work in medium-to-high dimensions. We also extend the prediction method of Ducas and Pulles (JOC 2026) for the score of incorrect guesses to a more general setting and, together with our predictive model, provide an extended characterization of the tail behavior.