Cryptanalysis of the Revised NTRU Signature Scheme

Abstract

Abstract. In this paper, we describe a three-stage attack against Revised NSS, an NTRU-based signature scheme proposed at the Eurocrypt 2001 conference as an enhancement of the (broken) proceedings version of the scheme. The first stage, which typically uses a transcript of only 4 signatures, effectively cuts the key length in half while completely avoiding the intended hard lattice problem. After an empirically fast second stage, the third stage of the attack combines lattice-based and congruence-based methods in a novel way to recover the private key in polynomial time. This cryptanalysis shows that a passive adversary observing only a few valid signatures can recover the signer's entire private key. We also briefly address the security of NTRUSign, another NTRUbased signature scheme that was recently proposed at the rump session of Asiacrypt 2001. As we explain, some of our attacks on Revised NSS may be extended to NTRUSign, but a much longer transcript is necessary. We also indicate how the security of NTRUSign is based on the hardness of several problems, not solely on the hardness of the usual NTRU lattice problem.

Candidate Multilinear Maps from Ideal Lattices

“…Our new algebraic/lattice attacks are extensions of an algorithm by Gentry and Szydlo [GS02], which combines lattice reduction and Fermat's Little Theorem in a clever way to solve a relative norm equation in a cyclotomic field. Our new attacks include a dimension-halving attack on principal ideal lattices (Section 7.8.1), demonstrating that one needs to double the dimension of principal ideal lattices (compared to general ideal lattices) to preserve security.…”

“…Our new attacks are extensions of techniques that were developed in [GS02] for attacking NTRU signatures: In Section 7.8.1 we describe a "dimension-halving attack" on principal ideal lattices, demonstrating that one needs to double the dimension of principal ideal lattices (compared to general ideal lattices) to preserve security. Then in Section 7.6 we provide a polynomial-time algorithm that solves the closest principal ideal generator problem in certain cases.…”

“…. are ring elements, and its goal is to use "averaging" to recover v · v, where v = v(x −1 ) is the conjugate of v. It was used by Kaliski (in connection with patent [HKL + 00]) and Gentry and Szydlo [GS02] in attacks against NTRU signature schemes [HKL + 00, HPS01]. We review the averaging attack here.…”

“…If the averaging attack is successful and we recover v · v, we can then use an algorithm by Gentry and Szydlo [GS02]. This algorithm takes v · v and a basis of the ideal v , and outputs the actual element v in polynomial time.…”

“…Here, we describe an algorithm by Gentry and Szydlo [GS02] (the GS algorithm) that recovers v from v · v and a basis of the ideal v . The algorithm runs in polynomial time.…”