Revisiting lower dimension lattice attacks on NTRU

Abstract

Vectors are called short vectors when the Euclidean norm of vectors is relatively small. By now, some researches have been done to find sufficient short vectors in certain variants of NTRU lattice to analyze the security of NTRU systems. These variants are all taking advantage of the property of NTRU cryptosystem to modify the standard NTRU lattice. Related variants include zero-run lattices with dimension 2N, zero-forced lattices with dimension 2(N−r), r<N, and IN-lattices with dimension N.Motivated by different constructions, we revisit related variants and develop some techniques to further reduce the dimension of IN-lattice, such that the expected breaking time can be decreased significantly. Firstly, by working with the cyclic matrix associated with the NTRU public key h, shifts of the private vector f can be accommodated. Hence, t randomly chosen coefficients in a shift of the private vector f can be forced to equal zero. This not only results in a new lattice with a lower dimension but also creates an environment to utilize parallel mechanisms to improve the probability of success. Finally, experiments have demonstrated that our approach outperforms the previous methods.