I want to implement the NTRU cryptosystem. What is the method and algorithm to choose vectors elements from a uniform distribution and discrete Gaussian distribution?
$\begingroup$
$\endgroup$
2
-
2$\begingroup$ This question is too vague. Did you mean sample the secret key from uniform/Gaussian or message? In both case you can do it. Just a reminder you will also need to modify your modulus q to adjust the decryption error rates and the impacts on security estimates. $\endgroup$– zhenfei zhangMay 1, 2017 at 20:10
-
$\begingroup$ Hello, thanks for your reponse M. Zhenfel. In other hand : For NTRU, how to choose the polynomials: f(x),g(x) and e(x) with Unform Distribution or Gaussian Distribution. $\endgroup$– HassanMay 4, 2017 at 18:04
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
The only parameter sets officially published for NTRUEncrypt use fixed-Hamming-weight polynomials: see the open-source code at https://github.com/NTRUOpenSourceProject/ntru-crypto and in particular the EESS#1 specification at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/doc/EESS1-v3.1.pdf
If you want uniformly distributed polynomials, you'll need to work out the parameter sets yourself. There's guidance in https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/doc/NewParameters.pdf, though it's tailored for the fixed Hamming weight case.
If you want Gaussian, then Stehle and Steinfeld's paper is the starting point: http://perso.ens-lyon.fr/damien.stehle/downloads/ntru.pdf. I had a memory that I had seen parameters derived for this approach, but I can't find that paper at the moment.
