Порівняльний аналіз алгоритмів шифрування NTRUEncrypt та NTRUCipher

Abstract

The asymmetric encryption scheme NTRUEncrypt proposed in 1996 and is one of the fastest post-quantum encryption schemes. It is included in the ANSI X9.98-2010 standard and is the prototype of cryptosystems’ wide class with the same name, which security is based on the difficulty of finding short vectors in some lattices. The cryptographic properties of NTRUEncrypt encryption scheme are sufficiently explored and its latest modifications are presented at the current NIST competition to standardize post-quantum asymmetric encryption, key encapsulation and digital signature.One of the most important problem in the field of cryptology is the design of symmetric encryption schemes, whose security, similarly to the asymmetric one, is based on the complexity of solving only one particular problem (for example, for RSA this is the problem of factorization of numbers). Due to this, in 2017 the symmetric encryption scheme NTRUCipher based on NTRUEncrypt was proposed. For it, a preliminary security analysis was performed and a parameter selection algorithm was proposed. At the same time, there are essential errors in the proof of CPA-se­curity of the encryption algorithm NTRUCipher. Moreover, the problem of comparative analysis of NTRUCipher and NTRUEncrypt encryption schemes is not solved for security and practicality.The purpose of this article is to conduct a comparative analysis of the abovementioned encryption schemes and to prove correctly the conditions that ensure the CPA-security of the NTRUCipher encryption scheme. A certain result is analytical bounds of decryption failure probability in NTRUCipher encryption scheme. This result is important for the proper parameters’ choice of the encryption scheme in its practical implementation. It is shown that the decryption failure probability in the NTRUCipher varies from to while the value of this probability for the NTRUEncrypt encryption scheme varies from to . In addition, the obtained bounds are not based on any heuristic assumptions.