Skip to main content
SpringerLink
Log in

Choosing Parameters for NTRUEncrypt

  • Conference paper
  • First Online:
Topics in Cryptology – CT-RSA 2017 (CT-RSA 2017)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10159))

Included in the following conference series:

Abstract

We describe a method for generating parameter sets, and calculating security estimates, for NTRUEncrypt. Our security analyses consider lattice attacks, the hybrid attack, subfield attacks, and quantum search. Analyses are provided for the IEEE 1363.1-2008 product-form parameter sets, for the NTRU Challenge parameter sets, and for two new parameter sets. These new parameter sets are designed to provide \(\ge 128\)-bit post-quantum security.

An extended version of the paper is available at [10].

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    In practice q has a strong impact on the effectiveness of pure lattice reduction attacks as well. For large q the relevant problem becomes Unique-SVP which appears to be somewhat easier than Hermite-SVP. Conservative parameter generation should ensure that it is difficult to solve Hermite-SVP to within a factor of \(q/\varDelta ^{1/2N} = \sqrt{q}\).

  2. 2.

    A lattice reduction algorithm that achieves root Hermite factor \(\delta \) returns a basis with \(\Vert {\varvec{b}}_1\Vert _2 \approx \delta ^n \det (\varLambda )^{1/n}\).

  3. 3.

    We will abuse notation slightly and allow \(\varPi \) to act on elements of R by acting on their coefficient vectors lifted to \(\mathbb {Z}^N\).

  4. 4.

    The \(X_k\) for different k have the same distribution, but they are not completely independent. However, they are so weakly correlated as to not affect our analysis.

References

  1. NTRU OpenSource Project.online. https://github.com/NTRUOpenSourceProject/ntru-crypto

  2. 2015. https://www.ntru.com/ntru-challenge/

  3. Bernstein, D.J.: Cost analysis of hash collisions: will quantum computers makeSHARCS obsolete? (2009). http://cr.yp.to/papers.html#collisioncost

  4. Chen, Y., Nguyen, P.Q.: BKZ 2.0: better lattice security estimates. In: Lee, D.H., Wang, X. (eds.) ASIACRYPT 2011. LNCS, vol. 7073, pp. 1–20. Springer, Heidelberg (2011). doi:10.1007/978-3-642-25385-0_1

    Chapter  Google Scholar 

  5. Chen, Y., Nguyen, P.Q.: BKZ 2.0: Better lattice security estimates (full version) (2011). http://www.di.ens.fr/~ychen/research/Full_BKZ.pdf

  6. Ducas, L., Durmus, A., Lepoint, T., Lyubashevsky, V.: Lattice signatures and bimodal Gaussians. In: Canetti, R., Garay, J.A. (eds.) CRYPTO 2013. LNCS, vol. 8042, pp. 40–56. Springer, Heidelberg (2013). doi:10.1007/978-3-642-40041-4_3

    Chapter  Google Scholar 

  7. Fluhrer, S.R.: Quantum cryptanalysis of NTRU. IACR Cryptology ePrint Archive, 2015:676 (2015)

    Google Scholar 

  8. Gama, N., Nguyen, P.Q.: Predicting lattice reduction. In: Smart, N. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 31–51. Springer, Heidelberg (2008). doi:10.1007/978-3-540-78967-3_3

    Chapter  Google Scholar 

  9. Hirschhorn, P.S., Hoffstein, J., Howgrave-Graham, N., Whyte, W.: Choosing NTRUEncrypt parameters in light of combined lattice reduction and MITM approaches. In: Abdalla, M., Pointcheval, D., Fouque, P.-A., Vergnaud, D. (eds.) ACNS 2009. LNCS, vol. 5536, pp. 437–455. Springer, Heidelberg (2009). doi:10.1007/978-3-642-01957-9_27

    Chapter  Google Scholar 

  10. Hoffstein, J., Pipher, J., Schanck, J.M., Silverman, J.H., Whyte, W., Zhang, Z.: Choosing Parameters for NTRUEncrypt (full version). IACR Cryptology ePrint Archive 2015:708 (2015)

    Google Scholar 

  11. Hoffstein, J., Pipher, J., Silverman, J.H.: NTRU: a ring-based public key cryptosystem. In: Buhler, J.P. (ed.) ANTS 1998. LNCS, vol. 1423, pp. 267–288. Springer, Heidelberg (1998). doi:10.1007/BFb0054868

    Chapter  Google Scholar 

  12. Hoffstein, J., Silverman, J.H.: Optimizations for NTRU (2000)

    Google Scholar 

  13. Hoffstein, J., Silverman, J.H.: Random small hamming weight products with applications to cryptography. Discrete Appl. Math. 130(1), 37–49 (2003)

    Article  MathSciNet  MATH  Google Scholar 

  14. Hoffstein, J., Silverman, J.H., Whyte, W.: Provable Probability Bounds for NTRUEncrypt Convolution (2007). http://www.ntru.com

  15. Howgrave-Graham, N.: A hybrid lattice-reduction and meet-in-the-middle attack against NTRU. In: Menezes, A. (ed.) CRYPTO 2007. LNCS, vol. 4622, pp. 150–169. Springer, Heidelberg (2007). doi:10.1007/978-3-540-74143-5_9

    Chapter  Google Scholar 

  16. Howgrave-Graham, N., Silverman, J.H., Whyte, W.: Choosing parameter sets for NTRUEncrypt with NAEP and SVES-3. In: Menezes, A. (ed.) CT-RSA 2005. LNCS, vol. 3376, pp. 118–135. Springer, Heidelberg (2005). doi:10.1007/978-3-540-30574-3_10

    Chapter  Google Scholar 

  17. Stehlé, D., Steinfeld, R.: Making NTRU as secure as worst-case problems over ideal lattices. In: Paterson, K.G. (ed.) EUROCRYPT 2011. LNCS, vol. 6632, pp. 27–47. Springer, Heidelberg (2011). doi:10.1007/978-3-642-20465-4_4

    Chapter  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Brown University, Providence, USA

    Jeff Hoffstein, Jill Pipher & Joseph H. Silverman

  2. University of Waterloo, Waterloo, Canada

    John M. Schanck

  3. Security Innovation, Wilmington, USA

    John M. Schanck, William Whyte & Zhenfei Zhang

Authors
  1. Jeff Hoffstein
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jill Pipher
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. John M. Schanck
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Joseph H. Silverman
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. William Whyte
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Zhenfei Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Zhenfei Zhang .

Editor information

Editors and Affiliations

  1. Cryptography Research Inc. , San Francisco, California, USA

    Helena Handschuh

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Cite this paper

Hoffstein, J., Pipher, J., Schanck, J.M., Silverman, J.H., Whyte, W., Zhang, Z. (2017). Choosing Parameters for NTRUEncrypt . In: Handschuh, H. (eds) Topics in Cryptology – CT-RSA 2017. CT-RSA 2017. Lecture Notes in Computer Science(), vol 10159. Springer, Cham. https://doi.org/10.1007/978-3-319-52153-4_1

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-52153-4_1

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-52152-7

  • Online ISBN: 978-3-319-52153-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation