New answers tagged

1 vote

How to reconstruct low order bits of $t$ of CRYSTALS-Dilithium from a small number of signatures?

While this doesn't fully answer your question (and is only mildly more interesting than a comment), I think the Dilithium authors just assume the adversary knows $\mathbf{t}_0$. See for example ...
Mark's user avatar
  • 12.5k

Top 50 recent answers are included