Preset: c2_design_smallq  target=128.0 bits
C2 block size: 3  dictionary entries: 58482
Public CLPN rows: 239542272  within-entry diffs: 490462801920  cross-entry diffs: 167288657412096
Seeded storage proxy: dense=122885185536 field elements, seeded=239600754 field elements, reduction=512.87x
Minimum finite screen bits: 0.01
Passes screening target: False
Attack screens:
  - clean-subset linear solving [GSW/sparse-LPN expansion-key row screen]: bits=0.01 status=critical
    263169 row-level objects, dimension 512, eta=1.52588e-05.
  - Prange information-set decoding [GSW/sparse-LPN expansion-key row screen]: bits=0.01 status=critical
    First-order decoding estimate using the expansion-key row count.
  - BKW-style noisy-linear learning [GSW/sparse-LPN expansion-key row screen]: bits=215.44 status=above-target
    Coarse q-ary BKW screen; specialized sparse-LPN estimators remain required.
  - within-entry clean-subset solving [C2 CLPN dictionary, message-eliminating row differences]: bits=0.09 status=critical
    490462801920 within-entry difference rows, dimension 512, eta_eff=0.000122066.
  - within-entry Prange/ISD screen [C2 CLPN dictionary, message-eliminating row differences]: bits=0.09 status=critical
    Random-code decoding proxy on row-difference samples from each dictionary entry.
  - within-entry BKW-style screen [C2 CLPN dictionary, compaction secret r]: bits=1723.60 status=above-target
    Coarse BKW screen for the q-ary LPN compaction secret under difference noise.
  - cross-entry clean-subset solving [C2 block dictionary, joint secret (r, s_block)]: bits=0.09 status=critical
    167288657412096 cross-entry difference rows inside blocks, joint dimension <= 515, eta_eff=0.000122066.
  - cross-entry Prange/ISD screen [C2 block dictionary, joint secret (r, s_block)]: bits=1.44 status=critical
    First-order decoding proxy for relations induced by differences of dictionary entries in the same block.
  - cross-entry BKW-style screen [C2 block dictionary, joint secret (r, s_block)]: bits=1723.60 status=above-target
    Coarse BKW screen on the enlarged q-ary LPN instance with dimension n_c + block_size.
  - sparse-row collision entropy [expansion row-distribution sanity screen]: bits=22.17 status=collision-risk
    sparse row entropy 22.17 bits; birthday excess log2(samples)-H/2=6.92.
  - seeded-storage does not reduce samples [C2 seeded dictionary storage model]: bits=512.87 status=informational
    seeded A representation reduces dense dictionary storage by about 512.87x in this proxy, but public b rows remain 239542272; attack screens are unchanged.
Blockers:
  - GSW/sparse-LPN expansion-key row screen: clean-subset linear solving at 0.01 bits (critical)
  - GSW/sparse-LPN expansion-key row screen: Prange information-set decoding at 0.01 bits (critical)
  - C2 CLPN dictionary, message-eliminating row differences: within-entry clean-subset solving at 0.09 bits (critical)
  - C2 CLPN dictionary, message-eliminating row differences: within-entry Prange/ISD screen at 0.09 bits (critical)
  - C2 block dictionary, joint secret (r, s_block): cross-entry clean-subset solving at 0.09 bits (critical)
  - C2 block dictionary, joint secret (r, s_block): cross-entry Prange/ISD screen at 1.44 bits (critical)
  - expansion row-distribution sanity screen: sparse-row collision entropy at 22.17 bits (collision-risk)
Seeded C2 reduces storage/materialization cost only.  It does not reduce public-sample exposure. The cross-entry dictionary-difference surface should be treated as a mandatory cryptanalysis item.
Screening estimate only; not a certified sparse/q-ary-LPN security estimator or a proof of insecurity. It is designed to catch regimes that are obviously unsuitable before detailed cryptanalysis.
