A Subfield Lattice Attack on Overstretched NTRU Assumptions

Abstract

Abstract. The subfield attack exploits the presence of a subfield to solve overstretched versions of the NTRU assumption: norming the public key h down to a subfield may lead to an easier lattice problem and any sufficiently good solution may be lifted to a short vector in the full NTRU-lattice. This approach was originally sketched in a paper of Gentry and Szydlo at Eurocrypt'02 and there also attributed to Jonsson, Nguyen and Stern. However, because it does not apply for small moduli and hence NTRUEncrypt, it seems to have been forgotten. In this work, we resurrect this approach, fill some gaps, analyze and generalize it to any subfields and apply it to more recent schemes. We show that for significantly larger moduli -a case we call overstretched-the subfield attack is applicable and asymptotically outperforms other known attacks. This directly affects the asymptotic security of the bootstrappable homomorphic encryption schemes LTV and YASHE which rely on a mildly overstretched NTRU assumption: the subfield lattice attack runs in sub-exponential time 2 O(λ/ log 1/3 λ) invalidating the security claim of 2 Θ(λ) . The effect is more dramatic on GGH-like Multilinear Maps: this attack can run in polynomial time without encodings of zero nor the zero-testing parameter, yet requiring an additional quantum step to recover the secret parameters exactly. We also report on practical experiments. Running LLL in dimension 512 we obtain vectors that would have otherwise required running BKZ with block-size 130 in dimension 8192. Finally, we discuss concrete aspects of this attack, the condition on the modulus q to guarantee full immunity, discuss countermeasures and propose open questions.

Provably Secure NTRU Instances over Prime Cyclotomic Rings

“…We present a theoretical construction with suggested parameters in the asymptotic sense. There are a batch of cryptanalyses work aiming at NTRU, such as hybrid attack [19], subfield attack [1] and straightforward attack [22]. Detailed analyses of our NTRU variant against these attacks should be wellconsidered.…”

“…If ω n 2 log 0.5 n p 2 rt/q < 1(resp. ω n log 0.5 n p 2 rt/q < 1 if deg p = 0) and t = √ nαq (n−1)k log((n−1)k) 1/4 > 1, then the decryption algorithm of NTRUEncrypt recovers M with probability 1 − n −ω (1) over the choice of s, e, f, g.…”

“…In the course of assessing the security of NTRU, Coppersmith and Shamir first claimed in [5] that one can convert breaking NTRU to solving hard problems on the so-called NTRU lattice. Then an army of cryptanalyses [1,2,4,9,10,12,15,19,21,22,29,34] have brought security estimations on NTRU and its variants, and NTRU is still considered secure in practice.…”

“…As a large subring, this ring is much closer to the original NTRU ring. It is also remarked that a class of subfield attacks [1] is proposed recently and affects the asymptotic security of NTRU for large moduli q. Note that the subfield attack is not applicable to the setting of [33], but it is still meaningful to consider NTRU over the fields with no subfields of desired relative degree.…”

A Survey on Homomorphic Encryption Schemes

“…A practical variant of their scheme, which reintroduces the DSRP assumption is also presented in the same work. However, it is later shown that the optimizations and parameter selection that yield a significant increase in the performance makes it vulnerable to sub-field lattice attacks [Albrecht et al 2016]. The attack shown by Albrecht et al affected not only [Bos et al 2013], but every other NTRU-like scheme, which relies on DSRP problem and whose parameters (e.g., secret key, modulus) are chosen poorly.…”