# Tag Info

### Which attacks are possible against raw/textbook NTRU encryption?

Without a well-designed padding system it may be possible to craft a ciphertext that the decryptor may or may not be able to decrypt properly. Whether the decryptor is able to do so will depend on the ...
• 133k
Accepted

### NTRU Backdoor and NewHope TLS Protocol

My name is Zhenfei Zhang. I work for Security Innovation Inc., which acquired NTRU Inc. in 2010. The R-LWE based key exchange [1] uses a public matrix $a$ which may be manipulated. For instance, if $a$...

### Which attacks are possible against raw/textbook NTRU encryption?

I am a cryptographic researcher at Security Innovation, which acquired NTRU. Apart from the aforementioned attack, there are two significant attacks, namely a chosen plaintext attack (CPA) and a ...
Accepted

### Is reverse NTRU still secure? (Looking for a signature scheme)

No, this system is not secure. Knowledge of the private key immediately gives enough of the public key that we can immediately encrypt an arbitrary message. The NTRU decryption key includes a ...
• 133k
Accepted

### Multiple NTRU public keys for the same private key?

According to current knowledge, handing out multiple public keys (with independent numerators) for the same private key $f$ is not insecure, as long as the parameters are instantiated appropriately. ...
• 5,662
Accepted

### Secure, patent-free alternative to NTRU

I work for Security Innovation, which owns the NTRU patents. All NTRU-related patents are freely usable under GPL 2.0 and 3.0 -- in other words, they should fit in with your license requirement as ...

### Does NTRU provide Perfect Forward Secrecy?

Properly speaking, forward secrecy is a property of a protocol. The protocol is forward secret if compromise of the long term keys does not allow an attacker to decipher any past communications. (...
• 31.3k
Accepted

### Why does NTRUEncrypt lack a formal security proof?

NTRU, as it was originally introduced, is based on what people now call the "NTRU assumption", which really just assumes that it is difficult to break NTRU. Annoyingly circular, but that's how it is. ...
• 1,245
Accepted

### NTRU key size (confused)

I've thourgh that 439 would represent the key size in bits. No, NTRU doesn't measure things like that. Instead, it's the number of elements in a ring. In addition, with the current parameter sets, ...
• 133k
Accepted

### Explain: An NTRU key for a lattice of dimension $d$ has size only $O(d\log{d})$

An NTRU public key is a polynomial of degree $d-1$ whose coefficients are elements in $\mathbb{Z}_q$. So the number of bits you need to represent it is $d\log{q}$. If q is of the same order as d, ...
• 1,126
Accepted

### what are the NTRU keysize and application in industry?

Usually, in public-key cryptography, the "key size" is implicitly referred to the size of the public key. In the case of NTRU, both public and private keys are conveyed by the same thing: polynomials ...
• 4,832

### Lightweight Asymmetric encryption algorithm

When an embedded device needs asymmetric crypto to encrypt, (e.g. measurements it makes) or check authenticity (e.g. of commands or firmware updates it receives), there is no need for a private key or ...
• 125k

### NTRU key size (confused)

Poncho's explanation is correct: the size is $N \log_2(q)$ rather than just $N$. A better open-source implementation to use is here: https://github.com/NTRUOpenSourceProject/ntru-crypto -- this is ...
Accepted

### How to decide if an element is a public key in NTRU encryption scheme?

You can't under a standard assumption known as the "Decisional NTRU Assumption". This is essentially the statement that NTRU public keys are pseudorandom. The following is definition 4.4.4 ...
• 8,677

### What is the most efficient attack on NTRU?

I am a cryptographic researcher at Security Innovation, which acquired NTRU Cryptosystems. Now, I wonder what is the most efficient attack one could do? Does it have to be comprehensive like the ...

### Is the IEEE 1363.1 standard of NTRU post-quantum secure?

what are the major differences between the IEEE 1363.1 NTRU standard vs. the NTRUEncrypt NIST PQ submission The only differences would be the parameters that are standardized. This answer gives one ...
• 13.5k
Accepted

### Is the combination of X25519 ECDH and NTRU in OpenSSH 9.X secure against quantum attacks?

Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks? Actually, that version of OpenSSH uses NTRU Prime, rather than NTRU. However, that does not change the ...
• 133k
Accepted

### In NTRU digital envelope, do everyone know the hash function $H$ used?

Yes, these are public parameters of the system. Note that NTRU is not implemented exactly this way any more. The most up-to-date current spec is EESS#1, which can be obtained from https://github.com/...
Accepted

### What is the most common encoding of messages to polynomials?

In NTRUEncrypt, a raw message m of octet string of length l octets is encoded through the following steps: Padded it with a random salt of b byte and a few extra information to form the actual octet ...
Accepted

### NTRU less secure than previously thought?

No, this result (as it stands) is of no practical use against NTRU as typically used. To quote the paper: Note that there is a large value hidden in the o(1) term, so that our algorithm does not ...
• 133k

### NTRU and one failed example

I've searched about this problem these two days, considering the paper cygnusv mentioned, and finally after reading the problem related to the pqc implementation, I guess that's the condition which is ...
• 457

### Layered encryption in mixnets with post-quantum cryptography

Might I suggest using traditional hybrid cryptography to cut down on the ciphertext growth size? This is the straight-forward approach where you don't directly encrypt the message with the public key;...
• 133k
Accepted

• 8,677

### Convert message to polynomial NTRU

What you are looking for is explicitly specified in the IEEE Standard 1363.1 [1], which covers NTRU. In particular, encoding a bit string into a polynomial is done in the following manner: Once you ...
• 4,832

### Does NTRU provide Perfect Forward Secrecy?

Yes. I'm not sure why others are saying "no". Forward secrecy is usually done by simply creating ephemeral keys for each connection. Thus, you will simply require a different NTRU keypair for each ...
• 225

Only top scored, non community-wiki answers of a minimum length are eligible