# Parameters for LWE

In the LWE problem there are two methods in order to choose secure parameters. The Lindner-Peikert and Micciancio-Regev method. The first method is an attack to BDD : find closest vector knowing the distance is bounded. The second method uses a distinguisher of SIS problem in order to attack the Decision-LWE. If someone applies one of the previous methods will finally find some values for the parameters of LWE. In this paper(table 1,p.15) this has be done for the case of Ring LWE. My question is, if someone knows a similar referance for the case of LWE that suggests specific values for the security parameters.

• There's still a lot of work being done on attacks on LWE and choosing parameters. If you want to make up-to-date choices, you may want to check more recent papers. (The most recent I can find on the Cryptology ePrint Archive for instance is this paper accepted for the upcoming Eurocrypt 2017 conference.) – TMM Feb 1 '17 at 14:43
• @TMM thanks for the reference. Indeed, there is a description and a code in sage that it provides (secure) specific values for the LWE-parameters. You can add it as an answer, since my question was asking for reference. – 111 Feb 1 '17 at 17:54

Then finally, even if you had full knowledge of the state-of-the-art methods for solving LWE, choosing parameters can still be done in various ways, ranging from aggressive/optimized to conservative/secure. Do you choose parameters such that the current best attack would take $2^{80}$ time? So that any small improvement to the algorithm might make the best attack take only $2^{60}$ time? Or do you choose parameters such that the current best attacks take at least $2^{120}$ time so that even if there are some improvements, you won't have to adjust your parameters in the near future?