4
$\begingroup$

I'm going to use NTRU as post-quantum public-key encryption algo in my project.
I've googled attacks on NTRU and found a lot of them
but since I'm new to NTRU and don't understand the math used, and could not conclude whether NTRU is still secure, if yes which parameter sets are secure?

For 256bit security, I found EES743EP1 and NIST NTRU-HRSS and NTRU-HPS Wikipedia article says the latter one is secure against MOST attacks and says nothing about others.

My current library supports EES1087EP2 ,EES1171EP1,EES1499EP1 ,EES743EP1 are they secure? or I should switch to NTRU-HRSS or I'm better not to use NTRU?
(i don't care about speed and prefer security over performance )

Thanks in advance

Improve this question
$\endgroup$
7
  • 2
    $\begingroup$ Wait for the finalization of the NIST PQC? $\endgroup$
    – kelalaka
    Commented Apr 8, 2022 at 19:04
  • 1
    $\begingroup$ Normally I would say that if it is a final candidate for the NIST PQC that it would be considered secure, however with the current state I might get hammered into submission by Bernstein, as he certainly expressed doubts about the security of the CRYSTALS submissions (Kyber and Dilithium) $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 8, 2022 at 21:30
  • 1
    $\begingroup$ @MaartenBodewes my question only concerns attacks published/known till now,as far as I know NTRU is in the market for decades so current research doe it should be more reliable than new algo proposed $\endgroup$
    – morthy
    Commented Apr 8, 2022 at 23:56
  • 1
    $\begingroup$ How do you define "secure from attacks"? Bringing the security below the minimum security level decided by NIST? Bringing the security low enough that attacks are practical? An improvement in any attack at all? None of the supported algorithms you mentioned are fatally broken, at least. $\endgroup$
    – forest
    Commented Apr 9, 2022 at 21:05
  • 1
    $\begingroup$ @morthy I'm not writing an answer right now because I'm not completely sure, but I'm pretty sure that no serious attacks exist against the listed parameters. Relevant: crypto.stackexchange.com/q/88567/54184 $\endgroup$
    – forest
    Commented Apr 9, 2022 at 22:15

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.