pub fn recover_short_generator(h: &Cyclo) -> Option<Cyclo>Expand description
CDPR short-generator recovery. Given a generator h of a principal ideal that has an unusually short
generator g (so h = g·u for a unit u), recover a short generator: project Log(h) onto the log-unit
lattice against the cyclotomic-unit basis to strip the unit, divide it out exactly (via the
Galois-conjugate inverse), and pick the exact generator of smallest coefficient-norm over a local search
around the rounded lattice point. Returns g up to a root of unity ±Xᵐ. This is the genuine break on
schemes that expose a short principal-ideal generator (Soliloquy, Smart–Vercauteren); it does not touch
Module-LWE, where the secret is not such a generator.