On the Complexity of the BKW Algorithm on LWE

Designs, Codes, and Cryptography - Netherlands
doi 10.1007/s10623-013-9864-x