General: ======== In Section 12 we write that two independent separable statistics are used, and that they are identically distributed as a one-variate normal random variable N(u, u) for u = n*mu*C^(-1)*mu. mu*C^(-1)*mu = u/n = 9.3498065782031568501973e-13 n = 2^39 * 7: ============= u = 3.5980773675668169780516 (computed in the "old" way. Ignore this unless you are verifying an old draft of the paper) u = 3.5980773675668169704622 (computed like in paper) z = 1.0335996763286862643819 n = 3848290697216 log2(n) = 41.807354922057604108138 alpha = 0.99269207541645714573241 beta = 0.088194138395904420113568 (1-beta) = 0.9118058616040955798661 (1-beta)^2 = 0.83138992925558710201175 (1-alpha) = 0.0073079245835428542675885 log2(1-alpha) = -7.0963225389711979463649 2*log2(1-alpha) = -14.19264507794239589273 # of K^hat returned = 2^39.807354922057604108138 # of keys to test = 2^41.807354922057604108138 n = 2^39 * 7.2257: ================== u = 3.7140896621182213402888 z = 0.98061363072909915519076 n = 3972370584411 log2(n) = 41.853137357524727288349 alpha = 0.99257519589049966079368 beta = 0.078041603343014413075699 (1-beta) = 0.92195839665698558693108 (1-beta)^2 = 0.850007285166319572281 (1-alpha) = 0.0074248041095003392063172 log2(1-alpha) = -7.0734313212376363545243 2*log2(1-alpha) = -14.146862642475272709049 # of K^hat returned = 2^39.853137357524727291819 # of keys to test = 2^41.853137357524727291819