I studied some papers related to NTRU. All these papers describe NTRU as a lattice based cryptosystem but I could not find any paper which illustrates NTRU algorithm from lattice point of view. It would be of great help if anyone describes NTRU algorithm using lattices and how the algorithm is based on Shortest Vector Problem(SVP).

  • $\begingroup$ Cf. section 7.11 of Hoffstein, Pipher, Silverman, An Introduction to Mathematical Cryptography $\endgroup$
    – yoyo
    Feb 13, 2023 at 23:37

1 Answer 1


Currently, there is no formal proof of NTRU being based on a lattice problem, but you can find a description of NTRU in terms of lattices in Section 5.2 of [Ber09]. For lattice-based attacks for NTRU you can review [HPS98]. There is, however, a provably-secure variant of NTRU that is ultimately based on the hardness of the SVP problem [SS11].


[Ber09] Post-quantum cryptography (2009). Springer Berlin Heidelberg.

[HPS98] Hoffstein, J., Pipher, J., & Silverman, J. H. (1998). NTRU: A ring-based public key cryptosystem. In Algorithmic number theory (pp. 267-288)

[SS11] Stehlé, D., & Steinfeld, R. (2011). Making NTRU as secure as worst-case problems over ideal lattices. In Advances in Cryptology–EUROCRYPT 2011 (pp. 27-47).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.