# Tag Info

## New answers tagged provable-security

0

First, a fact. For some polynomial $f_x$ and some random polynomial of the same degree, say $t$, an adversary given only $f_x+t$, knows no additional information about $f_x$. Basically (due to the finite ring), this operation is the same thing as the one-time-pad. On to the problem at hand. Let $f_3=f_2\cdot(s+1)$. Since $f_2$ and $s$ have the same ...

3

From the key creators point of view, notice that:$g_1\bmod p=1$ and $g_2\bmod q=1$. Which means that $(g_1-1)\cdot(g_2-1)\bmod N=0$. Which implies that $g_1-1$ and $g_2-1$ share a common divisor with $p$ and $q$. To obtain $p$ we simply take $\gcd(g_1-1,N)$. To obtain $q$ we simply take $\gcd(g_2-1,N)$, or $N/p$. Because we have been able to factor the ...

3

NTRU, as it was originally introduced, is based on what people now call the "NTRU assumption", which really just assumes that it is difficult to break NTRU. Annoyingly circular, but that's how it is. Similar to how breaking RSA is not provably as hard as factoring (technically it is based on the "RSA assumption"), but people still think it is hard, NTRU ...

Top 50 recent answers are included