A Note on Parameter Choices of Round5
We examine the current parameter choice of Round5, and rectify its consideration of the improved dual attack due to Albrecht [Alb17]: there is one significant optimization of Albrecht’s dual attack, which was not reflected to Round5 parameter choices. By taking this into consideration, some parameter choices of Round5 cannot enjoy the claimed security level. For simplicity, we omit the details for the dual attack (and primal attack) and assume the readers are already familiar with the attacks. Please refer to Section 2.7.4 and 2.7.5 of original specification document [BBF19] for the detailed explanation for the attacks.