A wrap error attack against NTRUEncrypt

Abstract

We present a chosen plaintext attack on the NTRU encryption system. We assume that the attacker can detect wrap errors, that the blinding polynomial is generated from three parts (as specified in the standards) and that the attacker has a large database of carefully selected plaintexts. The attack is based on the fact that wrap errors occur more frequently if blinding polynomials with larger coefficients are used.