[
  {
    "id": "mr08-lwe-dual-geometry",
    "categoryId": "lwe-dual-lattice-models",
    "paperId": "micciancio-regev2008-lbc",
    "year": 2009,
    "date": "2008-11-07",
    "datePrecision": "day",
    "time": {
      "coefficient": null,
      "expression": "T_reduce(m, δ); m ≈ sqrt(n log₂(q) / log₂(δ))"
    },
    "space": {
      "coefficient": null,
      "expression": "Depends on the selected lattice-reduction algorithm."
    },
    "tags": [
      "dual",
      "historical model"
    ],
    "review": {
      "status": "source-checked"
    },
    "certificate": {
      "status": "not-provided",
      "lean": null
    },
    "notes": "Early explicit dual-LWE geometry model. Shortness and dimension predictions do not supply a universal LWE running-time exponent.",
    "extra": {
      "parameters": "Prime q=q(n); secret dimension n; root-Hermite factor δ; choose m only when enough samples are available.",
      "noise": "Rounded Gaussian width αq; continuous standard deviation αq/√(2π).",
      "secret": "General LWE secret in Z_q^n.",
      "samples": "At least m ≈ √(n log₂ q / log₂ δ); cap m by the actual sample budget.",
      "objective": "Distinguish LWE from uniform using a short dual vector.",
      "model": "Unscaled dual length ≈ q⁻¹ min(q, 2^{2√(n log₂(q) log₂(δ))}); source Eqs. (10)–(11).",
      "assumptions": "Empirical lattice-reduction quality model for random q-ary lattices.",
      "success": "Non-negligible distinguishing signal requires suitably small αq·||w||; no common fixed advantage is imposed here."
    },
    "evidence": {
      "url": "https://cseweb.ucsd.edu/~daniele/papers/PostQuantum.pdf",
      "locator": "§5, Security discussion, pp. 21–22, Eqs. (10)–(11)",
      "sourceVersion": "Author manuscript dated 7 November 2008; edited chapter February 2009"
    }
  },
  {
    "id": "aps15-lwe-dual-cost-model",
    "categoryId": "lwe-dual-lattice-models",
    "paperId": "albrecht-player-scott2015-concrete",
    "year": 2015,
    "date": "2015-10-02",
    "datePrecision": "day",
    "time": {
      "coefficient": null,
      "expression": "O(ε⁻² · T_BKZ(m,δ₀)); log₂δ₀=[log₂(f(ε)/α)]²/(4nlog₂q), f(ε)=√(ln(1/ε)/π)"
    },
    "space": {
      "coefficient": null,
      "expression": "Depends on the chosen SVP oracle inside BKZ."
    },
    "tags": [
      "dual",
      "historical cost model",
      "oracle samples"
    ],
    "review": {
      "status": "source-checked"
    },
    "certificate": {
      "status": "not-provided",
      "lean": null
    },
    "notes": "Historical dual model combining target vector length with a stated BKZ oracle. Its rule-of-thumb relation β/log₂β≈1/(2log₂δ₀) avoids falsely extrapolating an empirical seconds fit into a subexponential LWE algorithm.",
    "extra": {
      "parameters": "Fix n,q(n), Gaussian width αq, target one-vector bias ε and BKZ cost model; enough samples for optimized m.",
      "noise": "Discrete Gaussian width αq, standard deviation αq/√(2π).",
      "secret": "General LWE secret in Z_q^n.",
      "samples": "Unlimited samples in this historical survey; m≈√(nlog₂q/log₂δ₀) per fresh dual-vector instance, repeated for amplification.",
      "objective": "Distinguish LWE from uniform with constant final advantage.",
      "model": "||v||≈δ₀^m q^{n/m}; bias≈exp(−π(α||v||)²); β/log₂β≈1/(2log₂δ₀). Select the SVP-oracle cost explicitly.",
      "assumptions": "Lattice-reduction/Gaussian heuristic model and independent repetitions.",
      "success": "One-vector bias ε; O(ε⁻²) independent observations for constant final advantage."
    },
    "evidence": {
      "url": "https://www.degruyterbrill.com/document/doi/10.1515/jmc-2015-0016/pdf?licenseType=open-access",
      "locator": "§3.2, Corollary 3.2 / Remark 3.3; §4.1, Lemma 4.1; §5.3, Lemma 5.12 and following amplification discussion",
      "sourceVersion": "Journal of Mathematical Cryptology 9(3), published 2 October 2015"
    }
  },
  {
    "id": "albrecht17-dual-amortized",
    "categoryId": "lwe-dual-lattice-models",
    "paperId": "albrecht2017-dual-small-secret",
    "year": 2017,
    "date": "2017-05-18",
    "datePrecision": "day",
    "time": {
      "coefficient": null,
      "expression": "T_BKZ(m,β) + M·[T_rerandomize(m) + T_BKZ(m,β′)], with β′≤β"
    },
    "space": {
      "coefficient": null,
      "expression": "Reduced basis plus M short dual vectors, if stored."
    },
    "tags": [
      "dual",
      "amortization",
      "heuristic",
      "fixed samples"
    ],
    "review": {
      "status": "source-checked"
    },
    "certificate": {
      "status": "not-provided",
      "lean": null
    },
    "notes": "Reuses an expensive reduced basis to generate many shorter dual relations. The claimed reduction relies on relations being sufficiently short and sufficiently random; fixed-sample correlations remain a heuristic.",
    "extra": {
      "parameters": "Fix n,q, Gaussian width αq, lattice dimension m, block sizes β,β′ and required relation count M.",
      "noise": "Discrete Gaussian width αq.",
      "secret": "General LWE secret; this amortization does not require a short secret.",
      "samples": "Works on the available LWE matrix; reuses it, unlike fully independent fresh-sample amplification.",
      "objective": "Decision-LWE with amplified distinguishing advantage.",
      "model": "One BKZ-β preprocessing followed by sparse unimodular rerandomization and cheaper BKZ-β′; source instantiation β′=2.",
      "assumptions": "Cheap rerandomization yields short, adequately random relations; dependence can be ignored in the statistical test.",
      "success": "Target advantage determines M; source estimates use dual-vector norm inflation by a factor of two."
    },
    "evidence": {
      "url": "https://github.com/malb/publications/blob/2fc91ddbe45e21d7c337bfc658e4fd8926dd887c/on-dual-attacks-against-small-secret-lwe/small-sparse-secret.tex",
      "locator": "Section Amortising costs, Algorithm 1 and its Heuristic paragraph",
      "sourceVersion": "Author TeX commit 2fc91ddbe45e21d7c337bfc658e4fd8926dd887c, 18 May 2017; associated ePrint last revised 6 May 2017"
    }
  }
]