[
  {
    "id": "bg17-checked-guessing-hybrid",
    "categoryId": "lwe-small-secret-hybrid-models",
    "paperId": "bai-galbraith2013-binary-lwe",
    "year": 2014,
    "date": "2017-02-21",
    "datePrecision": "day",
    "time": {
      "coefficient": null,
      "expression": "min_{0≤k≤n} 2^k · C_lattice(n−k,m,q,σ)"
    },
    "space": {
      "coefficient": null,
      "expression": "Space of the chosen residual lattice solver, plus polynomial storage."
    },
    "tags": [
      "hybrid",
      "small secret",
      "Gaussian error"
    ],
    "review": {
      "status": "source-checked"
    },
    "certificate": {
      "status": "not-provided",
      "lean": null
    },
    "notes": "An early explicitly described guessing/lattice hybrid. This basic binary-secret formula is distinct from the later meet-in-the-middle hybrid with a binary error distribution.",
    "extra": {
      "parameters": "Fix n,m,q, error standard deviation σ and k guessed secret coordinates.",
      "noise": "Independent discrete Gaussian errors, standard deviation σ.",
      "secret": "Uniform binary secret in {0,1}^n for the 2^k factor; ternary guessing would cost 3^k.",
      "samples": "m original samples, preserved after subtracting a candidate partial secret; no extra oracle samples assumed.",
      "objective": "Recover the entire secret.",
      "model": "Exhaust partial secret values then apply a specified residual lattice attack C_lattice.",
      "assumptions": "Residual solver’s cost/success assumptions; expected or repeated cost must use a consistent success target.",
      "success": "The correct guess reduces to the smaller instance; overall success follows the residual solver."
    },
    "evidence": {
      "url": "https://eprint.iacr.org/2013/839.pdf",
      "locator": "§6.4, p. 12, combining the lattice attack with exhaustive search",
      "sourceVersion": "Full ePrint version last revised 21 February 2017; first ePrint 16 December 2013; ACISP 2014"
    }
  }
]