Paper 2026/1326

LaMS: A p-adic Layered Modulus Switching for Provable Dual Attacks on LWE

Abstract

The Learning with Errors (LWE) problem is a central foundation for post-quantum schemes such as Kyber and Dilithium. Dual attacks are among the main tools for assessing the concrete hardness of LWE instances. At EUROCRYPT 2024, Pouly and Shen introduced the first provable dual attack against LWE. Subsequently, at ASIACRYPT 2025, Qu and Xu incorporated modulus switching into this framework by recovering the guessed secret mod several small primes and recombining the resulting residues via the Chinese Remainder Theorem (CRT). Although this CRT-based strategy substantially reduces the search space, it reconstructs the full guessed secret through several distinct primes whose product must exceed \(q\). Consequently, the total guessing cost is dominated by the largest CRT prime \(p_k\). This raises a natural question: can the same recovery effect be achieved by repeatedly applying the subroutine with a fixed small prime, while further reducing the overall complexity? We answer this question affirmatively by proposing layered modulus switching (LaMS), a provable modulus switching dual attack based on a \(p\)-adic view of the guessed secret. Instead of recovering residues mod several distinct primes, LaMS fixes a single small prime \(p\) and recovers the guessed secret digit by digit in its \(p\)-adic expansion. After each digit is recovered, its contribution is subtracted from the LWE samples, producing a new target LWE instance in which the next digit becomes the new secret mod \(p\). As a result, the guessing cost is reduced from \(O(\mathrm{poly}(m,n)(N+\sum_{j=1}^{k}p_j^{n_{\mathrm{guess}}}))\) in the CRT-based attack to \(O(\mathrm{poly}(m,n)\lceil\log_p q\rceil(N+p^{n_{\mathrm{guess}}}))\), where \(p \ll p_k\). We also correct a parameter issue in two previous works (EUROCRYPT 2024 and ASIACRYPT 2025) on Kyber estimates. After this correction, LaMS lowers the estimated attack cost by up to 1 bit for Kyber compared with the corrected CRT-based attack of Qu and Xu.

Note: We have revised our previous estimates of the algorithmic success probabilities in Theorems 2 and 3. This correction introduces an additional factor of q^{2n_{guess}} in the numerator of N in the parameter selection. After re-evaluating the resulting complexity, we unfortunately found that the estimated complexity of our method is higher than that obtained by Pouly and Shen at EUROCRYPT 2024. Obtaining a tighter complexity analysis of our method and exploring possible improvements will be an important direction for future work.