# security parameter in lattice cryptography

In paper Lattice Signatures Without Trapdoors(Lyubashevsky2012), $$n$$ is the security parameter, why the authors set $$n$$ as 512 but not 80/100/112 to get 80-bit security/100-bit/112-bit security?

• He mentions in the paper that it's for a security of ~100 bits – Binou Mar 31 at 13:04

The answer of course is due to cryptanalytic estimates. In particular, one estimates how difficult the underlying problem is (for factoring, it's roughly $$\exp(O(\sqrt[3]{n}))$$, and then sets the security parameter such that it takes $$\approx 2^{80}$$ bit operations to break.
These estimates are of course just estimates, and its an active area of research to try to get better estimates of the concrete security of lattice-based cryptography. But parameters themselves are chosen such that, when state of the art attacks are applied, it takes $$2^{80}$$ (or $$2^{100}$$ or $$2^{112}$$) bit operations to break the scheme.