I came across this paper which mentions this table, which states that NTRU 347 is equivalent to 112 bit security level

PKC standards comparison

However, in this paper, Choosing parameters for NTRU mentions that NTRU-401 is equivalent to 112 bit security NTRU Parameters

Thus, I would like to ask what parameter of NTRU is equivalent to 112, 128, 192 bit security level

  • $\begingroup$ When reading such a paper first note which comparison they use keylength.com/en/compare otherwise this is a blind comparison. Actullay better comparison with security levels. $\endgroup$ – kelalaka Mar 5 at 10:29
  • $\begingroup$ It seems that the first one uses the NIST's recommendation. If we assume that those tables uses the same comparison, then the parameters on the second table. So what is the question, then? $\endgroup$ – kelalaka Mar 5 at 10:30
  • $\begingroup$ Yup, a better phrasing of my question would be what is the NTRU parameter corresponding to 112, 128 and 192 security levels $\endgroup$ – evernal Mar 5 at 10:31
  • $\begingroup$ Doesn't the second table provides the parameters? $\endgroup$ – kelalaka Mar 5 at 10:33
  • $\begingroup$ The question is that the NTRU parameters for 112 bit security is different for both tables. First table says NTRU-251 is 112 bit security, while second table says NTRU-401 is 112 bit security. So which is correct? $\endgroup$ – evernal Mar 5 at 10:34

The answer is not easy. There is an estimator by John Schanck. You can use this estimator to derive according to your requirements.

For example

NTRU Core-SVP (tuple Sieving) Hybrid
443 ~93 ~89
743 ~176 ~172

I've omitted the variant of the Core-SVP, for example, the core belongs to the Tuple lattice sieving. They are both used in the Core-SVP and in the Hybrid.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.