I want to implement the NTRU cryptosystem. What is the method and algorithm to choose vectors elements from a uniform distribution and discrete Gaussian distribution?

  • 2
    $\begingroup$ This question is too vague. Did you mean sample the secret key from uniform/Gaussian or message? In both case you can do it. Just a reminder you will also need to modify your modulus q to adjust the decryption error rates and the impacts on security estimates. $\endgroup$ May 1, 2017 at 20:10
  • $\begingroup$ Hello, thanks for your reponse M. Zhenfel. In other hand : For NTRU, how to choose the polynomials: f(x),g(x) and e(x) with Unform Distribution or Gaussian Distribution. $\endgroup$
    – Hassan
    May 4, 2017 at 18:04

1 Answer 1


The only parameter sets officially published for NTRUEncrypt use fixed-Hamming-weight polynomials: see the open-source code at https://github.com/NTRUOpenSourceProject/ntru-crypto and in particular the EESS#1 specification at https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/doc/EESS1-v3.1.pdf

If you want uniformly distributed polynomials, you'll need to work out the parameter sets yourself. There's guidance in https://github.com/NTRUOpenSourceProject/ntru-crypto/blob/master/doc/NewParameters.pdf, though it's tailored for the fixed Hamming weight case.

If you want Gaussian, then Stehle and Steinfeld's paper is the starting point: http://perso.ens-lyon.fr/damien.stehle/downloads/ntru.pdf. I had a memory that I had seen parameters derived for this approach, but I can't find that paper at the moment.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.