On the Efficiency of Provably Secure NTRU

Cabarcas, Daniel; Weiden, Patrick; Buchmann, Johannes

doi:10.1007/978-3-319-11659-4_2

Cited by 11 publications

(13 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Fourth, even if the conversion were tight, switching to these "provable" cryptosystems would impose considerable costs. One example of these costs is quantified in the analysis of [31]. Another example of these costs is implicit in the security analysis of [5]: the Ring-LWE parameters in [5] are not chosen to ensure the hardness of Ring-LWE, but merely to ensure hardness against attacks using the very small number of output samples actually provided by the cryptosystem.…”

Section: Worst-case-to-average-case Reductionsmentioning

confidence: 99%

NTRU Prime: Reducing Attack Surface at Low Cost

Bernstein

Chuengsatiansup

Lange

et al. 2017

Lecture Notes in Computer Science

124

View full text Add to dashboard Cite

Abstract. Several ideal-lattice-based cryptosystems have been broken by recent attacks that exploit special structures of the rings used in those cryptosystems. The same structures are also used in the leading proposals for post-quantum lattice-based cryptography, including the classic NTRU cryptosystem and typical Ring-LWE-based cryptosystems. This paper (1) proposes NTRU Prime, which tweaks NTRU to use rings without these structures; (2) proposes Streamlined NTRU Prime, a public-key cryptosystem optimized from an implementation perspective, subject to the standard design goal of IND-CCA2 security; (3) finds high-security post-quantum parameters for Streamlined NTRU Prime; and (4) optimizes a constant-time implementation of those parameters. The resulting sizes and speeds show that reducing the attack surface has very low cost.

show abstract

Section: Worst-case-to-average-case Reductionsmentioning

confidence: 99%

NTRU Prime: Reducing Attack Surface at Low Cost

Bernstein

Chuengsatiansup

Lange

et al. 2017

Lecture Notes in Computer Science

124

View full text Add to dashboard Cite

show abstract

“…Some background material from [POG15a] is also used. [CWB14] concluded that it is inferior to other lattice-based PKEs.…”

Section: Chapter 5 Implementation Of Ring-lwe Encryption Onmentioning

confidence: 99%

Efficient implementation of ideal lattice-based cryptography

Pöppelmann¹

2017

It - Information Technology

View full text Add to dashboard Cite

Digital signatures and public-key encryption are used to protect almost any secure communication channel on the Internet or between embedded devices. Currently, protocol designers and engineers usually rely on schemes that are either based on the factoring assumption (RSA) or on the hardness of the discrete logarithm problem (DSA/ECDSA). But in case of advances in classical cryptanalysis or progress on the development of quantum computers the hardness of these closely related problems might be seriously weakened. In order to prepare for such an event, research on alternatives is required to provide long-term security.In this thesis, we focus on the efficient implementation of such alternative public-key cryptosystems whose security is based on the intractability of certain computational problems on ideal lattices. While an extensive theoretical background exists for lattice-based and ideal latticebased cryptography, not much is known about the efficiency of practical instantiations, especially on constrained and cost-sensitive platforms. We thus investigate novel algorithms and implementation techniques for fast and flexible polynomial multiplication and Gaussian sampling and then use these building blocks to implement public-key encryption and signature schemes. The results provided in this thesis show that lattice-based schemes can be optimized for high performance or resource efficiency on embedded microcontrollers and reconfigurable hardware. Our implementations of a public-key encryption scheme based on the ring learning with errors problems (RLWE) or of the bimodal lattice signature scheme (BLISS) can even outperform classical ECC-and RSA-based implementations.Lattice-based cryptography can also be used to realize homomorphic cryptography that allows computation on encrypted data. However, due to the large parameter sets and complex operations required, even for simple homomorphic evaluation operations, the performance of these schemes is a major issue preventing practical usage. In this thesis we investigate options for acceleration of homomorphic cryptography in a cloud environment using reconfigurable hardware. We implement all evaluation operations of the YASHE homomorphic encryption scheme and propose methods to deal with large ciphertext and key sizes as well as limited memory bandwidth. KeywordsPost-quantum cryptography, public-key cryptosystem, embedded system, microcontroller, FPGA KurzfassungDigitale Signaturen und Public-Key-Verschlüsselung werden für den Schutz nahezu jeder sicheren Kommunikation über das Internet oder zwischen eingebetteten Systemen genutzt. Die Sicherheit basiert dabei entweder auf der Faktorisierungsannahme (RSA) oder der Annahme, dass es schwer ist, das diskrete Logarithmus-Problem (DSA/ECDSA) zu lösen. Durch Fortschritte in der klassischen Kryptoanalyse oder bei der Entwicklung von Quantencomputern könnten diese Probleme allerdings in Zukunft ernsthaft geschwächt oder gelöst werden. Daher ist Forschung zu alternativen Public-Key-Kryptosystemen erforderlich, die in ...

show abstract

“…For a positive real s ∈ R + , the discrete Gaussian distribution χ s on an interval of integers [a, b] is a discrete probability distribution that assigns to each element x in the interval a probability proportional to exp(−(x − µ) 2 /2σ 2 ), where, similar to the continuous Gaussian distribution, µ denotes the mean, and σ > 0 is the standard deviation which is equal to s/ √ 2π [13,9]. In other words, the discrete Gaussian distribution is obtained by limiting the domain of the probability density function of a continuous Gaussian distribution to the integers, followed by proper scaling so that the total probability equals 1.…”

Section: Discrete Gaussian Samplingmentioning

confidence: 99%

“…Let p be an element of R q with small coefficients; p is coprime with q and will determine the plaintext space. A common choice is to take p = 3 for q a power of 2 [36,15,9]. The secret key is then a pair of polynomials (f, g) whose coefficients are chosen uniformly at random from {−1, 0, 1}.…”

Section: Ntru Encryption Schemesmentioning

confidence: 99%

“…We will give a high-level overview of these schemes in the next section and summarize their operations in Table 1. The parameters have been selected to provide about 128-bit security based on the suggestions by Hirschhorn et al [15], Tore Kasper Frederiksen [11], Ruckert and Schneider [28], Lindner and Peikert [20], Cabarcas, Weiden, and Buchmann [9], as well as NIST Special Publication 800-57 Part 1 [4]. For ease of reference, they are summarized in Table 2.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Portable Implementation of Lattice-based Cryptography using JavaScript

Yuan

Cheng

Kiyomoto

et al. 2016

IJNC

View full text Add to dashboard Cite

In recent years, lattice-based cryptography has attracted a high degree of attention in the cryptologic research community. It is expected to be in wide use in the foreseeable future once large quantum computers are in sight. On the other hand, JavaScript is a standard programming language for Web applications. It is now supported on a wide variety of computing platforms and devices with immense efficiency improvement in the past few years. In this paper, we present the results of our JavaScript implementation of several lattice-based encryption schemes and show the speed performance on four common Web browsers on PC. Furthermore, we show performance results on two smaller computing platforms, namely, tablets running the Android operating system, as well as Tessel, an embedded system equipped with an ARM Cortex M3 microcontroller. Our results demonstrate that some of today's lattice-based cryptosystems can already have efficient JavaScript implementations and hence are ready for use on a growing list of computing platforms with JavaScript support.Keywords: Lattice-based cryptography, JavaScript, Android, Tessel 309Portable Implementation of Lattice-based Cryptography using JavaScript 1. Positive integers n, q, d1, d2, d3, dm; gcd(3, q)=1 (let p=3); 2. Ring:and g ∈ L (n/3,(n/3)−1) ; let F = f 1 ·f 2 + f 3 , then f = 1 + 3F; 4. fq·f ≡ 1(mod q); 5. Secret key: f; 6. Public key: h ≡ 3f q ·g (mod q); Regev's LWE [26,22] 1. Positive integers m, n, l, q, t, r (t q and r q) and a real α > 0; 2. Matrix S∈Z 1. Integers n, q > 0 and a real s > 0; 2. Ring: Rq = Zq[x]/(x n + 1); 3. Three random polynomials e ← χs, a ∈ Rq, and a small s ∈ Rq; 4. b = a ·s + e ∈ Rq; 5. Secret key: s ∈ Rq; 6. Public key: (a, b)∈ Rq×Rq; 1. Plaintext m ∈ {0, 1} n ; 2. Three random polynomials e1, e2 ← χs and a small t ∈ Rq; 3. (c1, c2) = (a ·t + e1, b ·t + e2 + encode(m)) ∈Rq × Rq;LP10 ring-LWE [19] 1. Integers n, q > 0 and a real s > 0; 2. Ring: Rq = Zq[x]/(x n + 1); 3. Three random polynomials r1,r2 ← χs, and a ∈ Rq; 4. b = r1 − a·r2 ∈ Rq; 5. Secret key: r2 ← χs; 6. Public key: (a, b)∈ Rq×Rq; 1. Plaintext m ∈ {0, 1} n ; 2. Three random polynomials e1, e2, e3 ← χs; 3. (c1, c2) = (a ·e1 + e2, b ·e1 + e3 + encode(m)) ∈Rq × Rq;

show abstract

On the Efficiency of Provably Secure NTRU

Cited by 11 publications

References 24 publications

NTRU Prime: Reducing Attack Surface at Low Cost

NTRU Prime: Reducing Attack Surface at Low Cost

Efficient implementation of ideal lattice-based cryptography

Portable Implementation of Lattice-based Cryptography using JavaScript

Contact Info

Product

Resources

About