Provably Secure NTRU Instances over Prime Cyclotomic Rings

Abstract

Due to its remarkable performance and potential resistance to quantum attacks, NTRUEncrypt has drawn much attention recently; it also has been standardized by IEEE. However, classical NTRUEncrypt lacks a strong security guarantee and its security still relies on heuristic arguments. At Eurocrypt 2011, Stehlé and Steinfeld first proposed a variant of NTRUEncrypt with a security reduction from standard problems on ideal lattices. This variant is restricted to the family of rings Z[X]/(X n + 1) with n a power of 2 and its private keys are sampled by rejection from certain discrete Gaussian so that the public key is shown to be almost uniform. Despite the fact that partial operations, especially for RLWE, over Z[X]/(X n + 1) are simple and efficient, these rings are quite scarce and different from the classical NTRU setting. In this work, we consider a variant of NTRUEncrypt over prime cyclotomic rings, i.e. Z[X]/(X n−1 + · · · + X + 1) with n an odd prime, and obtain IND-CPA secure results in the standard model assuming the hardness of worst-case problems on ideal lattices. In our setting, the choice of the rings is much more flexible and the scheme is closer to the original NTRU, as Z[X]/(X n−1 + · · · + X + 1) is a large subring of the NTRU ring Z[X]/(X n −1). Some tools for prime cyclotomic rings are also developed.

NTRU-Like Random Congruential Public-Key Cryptosystem for Wireless Sensor Networks

“…NTRU variants working with different rings. An NTRU variant that works with polynomials with prime cyclotomic rings was proposed in [35]. A variant of NTRU working with non-invertible polynomials was proposed in [22].…”

“…NTRU and its known variants [7,8,[19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34][35][36][37][38], shown in Section 2, work with degree N polynomials. The main problem NTRU faces is that it is susceptible to the lattice basis reduction attack (LBRA) using the Gaussian lattice reduction (GLR) algorithm for two-dimensional lattices and the LLL algorithm for higher dimensions [39].…”

Computational aspects of lattices and their cryptographic applications

“…2011 年, Stehlé 和 Steinfeld [65] 在形如 Z[x]/(x 2 m + 1) 的环上建立了可 证明安全的 NTRU, 这个构造的抗量子性质目前也受到关注. 在更一般分圆环上可证明安全的 NTRU 的构造由 Yu 等 [66] 、Wang 和 Wang [67] 给出.…”

Modified multi-key fully homomorphic encryption based on NTRU cryptosystem without key-switching

“…The RLWE represents an algebraic variant of the LWE [21] , whose hardness can be reduced to the hardness of the worstcase problems on ideal lattices in the standard model. However, recently, it has been shown that subfield attacks [22][23][24][25] affected the asymptotic security of NTRUtype schemes for large moduli q: Yu et al [26,27] considered a variant of NTRU encrypt over prime cyclotomic rings and obtained the INDistinguish-ability under Chosen-Plaintext Attack (IND-CPA) secure results in the standard model assuming the hardness of the worstcase problems on ideal lattices, which was shown to be a good choice to resist the subfield attacks.…”