### Table 1: Fraction of random subset sum problems solved by a particular reduction algorithm applied to bases L and L0, respectively.

"... In PAGE 6: ... When one uses known algorithms for lattice basis reduction, applying them to lattice L0 instead of lattice L also yields dramatic improvements, although the results are not as good as they would be in the presence of a lattice oracle. For example, Table1 presents the comparison obtained in one particular set of experiments. The lattices used were not exactly L and L0, and the reduction algorithm used a combination of ideas from several sources.... In PAGE 6: ... More extensive data sets and details of the computations are presented in [14]. For each entry in Table1 , n denotes the number of items, and b the number of bits... ..."

### Table 3: Time-Line of Partial Key-Exposure Attacks on RSA and RSA-like cryptosystems. The top half of the table corresponds to attacks with known most significant bits. The bottom half of the table corresponds to attacks with known least significant bits. It is assumed that all primes are balanced.

2004

"... In PAGE 61: ... We leave the details to [58]. Time-Line In Table3 , we present a time-line of partial key-exposure at- tacks on RSA and RSA-like systems that use lattice basis reduction. 4.... ..."

### Table 1: Fraction of random subset sum problems solved by a particular re- duction algorithm applied to bases L and L0, respectively.

1992

"... In PAGE 14: ... When one uses known algorithms for lattice basis reduction, applying them to lattice L0 instead of lattice L also yields dramatic improvements, although the results are not as good as they would be in the presence of a lattice oracle. For example, Table1 presents the comparison obtained in one particular set of experiments. The lattices used were not exactly L and L0, and the reduction algorithm used a combination of ideas from several sources.... ..."

Cited by 57

### Table 1: Fraction of random subset sum problems solved by a particular re- duction algorithm applied to bases L and L0, respectively.

1992

"... In PAGE 14: ... When one uses known algorithms for lattice basis reduction, applying them to lattice L0 instead of lattice L also yields dramatic improvements, although the results are not as good as they would be in the presence of a lattice oracle. For example, Table1 presents the comparison obtained in one particular set of experiments. The lattices used were not exactly L and L0, and the reduction algorithm used a combination of ideas from several sources.... ..."

Cited by 57

### Table 1. The six reduction steps of the lexicon lattice.

2000

Cited by 4

### Table 1 lists the estimated maximum number of balanced primes that are consid- ered safe for various modulus sizes. The data in the table is taken from [9], and was determined by the crossover point of the expected runtimes of the NFS and ECM.

2006

"... In PAGE 7: ... Table1 . Estimated maximum number of safe primes allowed for various modulus sizes.... In PAGE 7: ... Therefore, for a given modulus size, the security of r-prime RSA with balanced primes is the same for all safe values of r. Once the number of primes is increased beyond the maximum number given in Table1 , however, the security is decreased. In fact, once the number of primes is no longer a safe number, the security decreases with each additional prime in the modulus.... In PAGE 28: ... Also, unless otherwise stated, all experimental results for r-prime RSA with r = 2, 3 used 1024-bit moduli and all results with r = 4 used 2048-bit moduli. The choice of modulus size was based on Table1 when r = 2, 3. While Table 1 suggests using a 4096-bit modulus when r = 4, we instead used a 2048-bit modulus to decrease the time for the lattice basis reduction.... ..."

### Table 17: Sizes and lattice error rates of the reduction algorithms

"... In PAGE 21: ... For comparison purposes, we then transformed the minimized FSA back intoa node- based word lattice.3 From the results shown in Table17 , we observed that the exact and approximate reduction algorithms gave a 50% and 67% size reduction, respectively, over the original bigram lattices. Size is measured as the average number of transitions per lattice.... ..."

### Table 1. E ciency comparison for a random regular path. The rst column under l (resp. 0 l) gives the (mean) reduction time, and the second one, the total cumulative execution time.

2000

"... In PAGE 7: ... In the rst case, Lenstra apos;s reduction algorithm is applied to the basis Bl(y1; : : : ; yl?1; y), while in the second case it is applied to the basis B0 l(y1; : : : ; yl?1; y) constructed with the help of the previously reduced basis for the lattice 0(y1; : : : ; yl?1). For each value of l, from 2 to 32, the CPU time (in seconds) for the reduction required at the l-vertex, and the total cumulative CPU time to determine the rst l vertices, are recorded in Table1 . In most cases, the rst y that was tried already gave a regular vertex.... ..."

Cited by 13

### Table 6: Sizes and lattice error rates of the reduction algo- rithms

1999

"... In PAGE 4: ... Compared with the standard finitestate machine (FSM) determinizationandminimizationalgorithmsimplemented by AT amp;T, ourtwoalgorithmsproduced lattices with8%and 39% smaller sizes. These results are shown in Table6 . For the 1998 evaluations, we used the exact reduction algorithm.... ..."

Cited by 2

### Table 6: Sizes and lattice error rates of the reduction algo- rithms

1999

"... In PAGE 4: ... Compared with the standard finite state machine (FSM) determinizationandminimizationalgorithmsimplemented by AT amp;T, ourtwoalgorithmsproduced lattices with8% and 39% smaller sizes. These results are shown in Table6 . For the 1998 evaluations, we used the exact reduction algorithm.... ..."

Cited by 2