2
$\begingroup$

What advantages and disadvantages can be distinguished in NTRU-based and LWE-based schemes relative to each other? In what cases which scheme gives advantage?

UPD: I'm interesting in two things: 1)how well-studied their respective hardness problems are? 2)how fast existing NTRU-based and LWE-based PKE schemes relative to each other?

$\endgroup$
  • $\begingroup$ You might need to narrow down the question a little bit. For example, NTRU is faster but lacks forward secrecy (i.e. generating new public keys is too expensive to do on every connection). Or is it the relative security against a quantum adversary you care about? Or how well-studied their respective hardness problems are? $\endgroup$ – forest Jan 23 '19 at 6:46
  • $\begingroup$ @forest I'm interesting in two things: 1)how well-studied their respective hardness problems are? 2)how fast existing NTRU-based and LWE-based PKE schemes relative to each other? $\endgroup$ – OneUser Jan 23 '19 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.