1
$\begingroup$

During the encryption process in NTRU, a random polynomial $r$ of small coefficients is generated to bind to the message to obscure it, and this polynomial must be kept secret. Does this polynomial have to be unique per message?

$\endgroup$
1
$\begingroup$

Does this polynomial have to be unique per message?

Yes, if two messages $m_0, m_1$ were encrypted with the same $r$ (resulting in ciphertexts $c_0, c_1$), we would have:

$$m_0 - m_1 = c_0 - c_1$$

This would allow the attacker to directly rederive many of the bits of $m_0, m_1$ (and it gets a lot worse if more than two messages were encrypted with the same $r$.

In addition, if the attacker recovered one of the messages, he can immediately rederive the other.

Bottom line: don't do it.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.