alt.hn

5/29/2026 at 3:22:19 AM

A Gentle Introduction to Lattice-Based Cryptography [pdf]

 https://cryptography101.ca/wp-content/uploads/lattice-based-cryptography.pdf

by jayhoon

5/31/2026 at 2:46:12 PM

I've implemented ML-KEM by the spec as an exercise recently (https://github.com/AlexanderYastrebov/mlkem) and here are related links that helped me understand the math:

* [Enough Polynomials and Linear Algebra to Implement Kyber](https://words.filippo.io/kyber-math/)

* [Basic Lattice Cryptography. The concepts behind Kyber (ML-KEM) and Dilithium (ML-DSA)](https://eprint.iacr.org/2024/1287.pdf)

* [A Complete Beginner Guide to the Number Theoretic Transform (NTT)](https://eprint.iacr.org/2024/585.pdf)

by age123456gpg

5/31/2026 at 3:09:14 PM

I did the same. Something that helped me get my head around it was realising that NTT is mostly a performance optimization, a bit like montgomery form in RSA. You can conceptually implement ML-KEM without it, it'll just be slower (it also won't be interoperable because the wire format involves the NTT'd form - I think, it's been a while since I looked at it in detail).

by Retr0id

5/31/2026 at 3:04:15 PM

It's a superficial point but this relatively newer style (La)TeX layout makes me much more keen to read documents for some reason.

by vmilner

5/31/2026 at 3:27:17 PM

What's with the huge border whitespace?

by SauntSolaire

5/31/2026 at 3:59:03 PM

So let’s say this is wildly over my head… what would be some good places to start reading to gain a minimal foundation to engage with this?

by allthetime

5/31/2026 at 4:50:44 PM

Simply put, you'll need algebra, linear algebra, number theory. So a lot of math with various degrees of depth.

by ArcHound

5/31/2026 at 7:56:22 PM

Do you have any recommendations for effective self-learning paths? I have murky old foundations in all three fields (took first year linear algebra and a variety of logic courses) so am not starting from nothing but the few times I’ve tried to jump back in I always get a bit bogged down and can’t keep with it.

by allthetime

5/31/2026 at 7:00:58 AM

Oh this brings me back to my uni days. I suppose that since this is the basis of post-quantum crypto it is a good time to learn this.

Seems to me that these lattices and error-correcting codes are very close to each other, but for some reason they are discussed separately.

I'd wager that there will be some reductions between those problems - maybe I could dig more around that.

by ArcHound

5/31/2026 at 7:36:09 PM

[flagged]

by sspoisk

5/31/2026 at 2:10:52 PM

[flagged]

by falcons-edge

5/31/2026 at 9:34:19 AM

Good stuff to know, just in case the life extension tech explodes and we're all alive by the time cryptographically relevant quantum computers actually hit the scene.

by cykros

5/31/2026 at 10:04:31 AM

Lattice-based cryptography exists in the present (Both Chrome and Firefox support X25519MLKEM768 hybrid key agreement, by default)

by Retr0id

5/31/2026 at 12:58:42 PM

Yes, but it exists because it was deemed better to be cautious and implement PQC despite the uncertainty and different points of view around the time scale to have cryptographically relevant quantum computers (or, from a different point of view, precisely due to the uncertainties). Their comment was in the wrong tone, but the doubts are there. BTW, PQC can be interesting to learn regardless of the discussion around quantum computers.

by GTP

5/31/2026 at 1:10:58 PM

"will we have a CRQC soon" is the subject of much debate but "will we have a CRQC ever" is pretty uncontroversially a possibility, and so it is worth defending against harvest-now-decrypt-later attacks in the present - which is why X25519MLKEM768 is widely deployed already.

by Retr0id

5/31/2026 at 7:39:45 PM

However, the time needed to get one plays a crucial role. Governments need to protect some piece of data for a very long time, but common people are generally fine with keeping something secret for their lives' duration. I don't care if someone decrypts my laptop's SSD after I'm dead.

by GTP

5/31/2026 at 5:24:39 PM

If quantum computers start breaking crypto within a few years, don't say you weren't sufficiently warned.

by Jach