In this work we study mathematical structures called module lattices that are highly relevant for the new cryptographic protocols selected by the American National Institute of Standards and Technology (NIST). We prove that the average-case and the worst-case of a specific shortest vector problem (SIVP) do not differ much in computational hardness.

In this roughly 150 pages counting paper, we describe and analyze very precise methods that allow for rigorous computations in number theory, a branch of mathematics that is closely related to cryptography. As a consequence we make an very precise and rigorous analysis of the classical resources (i.e., how large/fast an ordinary computer should be) required for computing certain number-theoretic quantities highly relevant for cryptography (S-unit groups). The end result of this paper is a (under GRH) provable sub-exponential running time, which solves a conjecture posed by Buchmann that was open for more than three decades.

In this paper, a very precise and rigorous analysis is made of the quantum resources (i.e., how large/fast a quantum computer should be) required for computing certain number-theoretic quantities (S-unit groups) that are highly relevant for cryptography.

This survey, mostly written in the years 2022-2023, is meant as an as short as possible description of the current state-of-the-art lattice attacks on lattice-based cryptosystems, without losing the essence of the matter.