Cryptology ePrint Archive: Report 2017/959

Choosing Parameters for the Subfield Lattice Attack against overstretched NTRU

Dung Hoang Duong and Masaya Yasuda and Tsuyoshi Takagi

Abstract: Albrecht et al. at Crypto 2016 and Cheon et al. at ANTS 2016 independently presented a subfield attack on overstretched NTRU problem. Their idea is to map the public key down to the subfield (by norm and trace map respectively) and hence obtain a lattice of smaller dimension for which a lattice reduction algorithm is efficiently applicable. At Eurocrypt 2017, Kirchner and Fouque proposed another variant attack which exploits the presence of orthogonal bases within the cyclotomic number rings and instead of using the matrix of the public key in the subfield, they use the multiplication matrix by the public key in the full field and apply a lattice reduction algorithm to a suitable projected lattice of smaller dimension. They also showed a tight estimation of the parameters broken by lattice reduction and implementation results that their attack is better than the subfield attack.

In this paper, we exploit technical results from Kirchner and Fouque for the relative norm of field elements in the subfield and we use Hermite factor for estimating the output of a lattice basis reduction algorithm in order to analyze general choice of parameters for the subfield attack by Albrecht et al. As a result, we obtain the estimation for better choices of the subfields for which the attack works with smaller modulus. Our experiment results show that we can attack overstretched NTRU with modulus smaller than that of Albrecht et al. and of Kirchner and Fouque.

Category / Keywords:

Original Publication (with minor differences): to appear in Proceedings of ISC 2017

Date: received 28 Sep 2017, last revised 29 Sep 2017

Contact author: duong at imi kyushu-u ac jp

Available format(s): PDF | BibTeX Citation

Version: 20170930:014306 (All versions of this report)

Short URL: ia.cr/2017/959

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]