{
  "id": "bg17-checked-guessing-hybrid",
  "categoryId": "lwe-small-secret-hybrid-models",
  "paperId": "bai-galbraith2013-binary-lwe",
  "year": 2014,
  "date": "2017-02-21",
  "datePrecision": "day",
  "time": {
    "coefficient": null,
    "expression": "min_{0≤k≤n} 2^k · C_lattice(n−k,m,q,σ)"
  },
  "space": {
    "coefficient": null,
    "expression": "Space of the chosen residual lattice solver, plus polynomial storage."
  },
  "tags": [
    "hybrid",
    "small secret",
    "Gaussian error"
  ],
  "review": {
    "status": "source-checked"
  },
  "certificate": {
    "status": "not-provided",
    "lean": null
  },
  "notes": "An early explicitly described guessing/lattice hybrid. This basic binary-secret formula is distinct from the later meet-in-the-middle hybrid with a binary error distribution.",
  "extra": {
    "parameters": "Fix n,m,q, error standard deviation σ and k guessed secret coordinates.",
    "noise": "Independent discrete Gaussian errors, standard deviation σ.",
    "secret": "Uniform binary secret in {0,1}^n for the 2^k factor; ternary guessing would cost 3^k.",
    "samples": "m original samples, preserved after subtracting a candidate partial secret; no extra oracle samples assumed.",
    "objective": "Recover the entire secret.",
    "model": "Exhaust partial secret values then apply a specified residual lattice attack C_lattice.",
    "assumptions": "Residual solver’s cost/success assumptions; expected or repeated cost must use a consistent success target.",
    "success": "The correct guess reduces to the smaller instance; overall success follows the residual solver."
  },
  "evidence": {
    "url": "https://eprint.iacr.org/2013/839.pdf",
    "locator": "§6.4, p. 12, combining the lattice attack with exhaustive search",
    "sourceVersion": "Full ePrint version last revised 21 February 2017; first ePrint 16 December 2013; ACISP 2014"
  }
}