A Variant of NTRU with Non-invertible Polynomials

Abstract

Abstract. We introduce a generalization of the NTRU cryptosystem and describe its advantages and disadvantages as compared with the original NTRU protocol. This extension helps to avoid the potential problem of finding "enough" invertible polynomials within very thin sets of polynomials, as in the original version of NTRU. This generalization also exhibits certain attractive "pseudorandomness" properties that can be proved rigorously using bounds for exponential sums. A Generalization of NTRUIn this generalization of the original NTRU cryptosystem [5,6], one selects integer parameters (N, p, q) and four sets L f , L g , L ϕ , L m of polynomials in the ring R = Z Z[X]/(X N − 1) as in the standard version of NTRU. We denote by the operation of multiplication in the ring R. The parameters q and p are distinct prime numbers such that gcd(N, q) = 1, and the sets L f , L g , L ϕ , L m are chosen to satisfy the "width condition"we define the width of F byOur extension of the original NTRU scheme can be described as follows.Key Creation. Alice randomly selects polynomials f ∈ L f , g ∈ L g and G ∈ R such that G has an inverse modulo q and f has an inverse modulo p. This is easily accomplished since G is allowed to range over all of R, and p will be very small in any practical implementation of this scheme. Alice first computes inverses G * q and f * p that satisfythen Alice computes the productsAlice publishes the pair of polynomials (h, H) as her public key, retaining (f, g, G) as her private key. The polynomial f * p is simply stored for later use, and the polynomial G * q may be discarded.Encryption. Suppose Bob (the encrypter) wants to send a secret message to Alice (the decrypter). Bob selects a message m from the set of plaintexts L m . Next, Bob selects a random polynomial ϕ ∈ L ϕ and uses Alice's public key (h, H) to compute e ≡ p ϕ h + H m (mod q).Bob then transmits e to Alice.Decryption. Alice has received e from Bob. To decrypt the message, she first computeschoosing the coefficients of a to lie in the interval from −q/2 to q/2. The remainder of our procedure now follows the standard version of NTRU; that is, Alice treats a as a polynomial with integer coefficients and recovers the message by computing m ≡ f * p a (mod p).One easily verifies that the case G = f corresponds to the classical NTRU cryptosystem (in this case, H = 1, so the public key consists solely of the polynomial h). Moreover, if f (and therefore H) is invertible modulo q, then this generalization is equivalent to the original scheme. Indeed, instead of decrypting e the attacker can try to decryptwhere H * q H ≡ 1 (mod q). On the other hand, if f is a zero-divisor in the ring R, then our construction seems to produce a new scheme.The main disadvantage of this scheme versus the classical NTRU scheme is that the public key size and the encryption time are roughly doubled.The advantages are:• This scheme provides more flexibility in the choice of parameters. In particular, it is likely that this generalization is more robust against some of the ...

DTRU1: first generalization of NTRU using dual integers

“…If d(y) < 1 4 ϕ(t) , then all dual integers equal to y ←→ mod t are reduced to y using the algorithm described previously.…”

“…-In 2000, William D. Banks and Igor E. Shparlinski have proposed in [1] a new a variant of NTRU with Non-Invertible Polynomials on the same ring as NTRU. This generalization is more secure against some of the known attacks on classical NTRU such as lattice attack.…”

“…We have also design over the ring of Dual Integer the cryptosystem "NTRU with non-inverible polynomial" proposed by Banks and Shparlinski [1]. This this version is more secure than NTRU but is less efficient too.…”

Generalisations of NTRU cryptosystem

“…Because, for taking f ∈ L f to be invertible, we do not know if there exist enough invertible polynomials from the required space. Therefore, in 2002, Banks et al gave a variant of NTRU that is generalisation of NTRU with non‐invertible polynomials to tackle this situation.…”

“…In 2002, Banks et al presented a generalisation of NTRU scheme to prevent the problem of finding enough invertible polynomial within a very less range of polynomials.…”