Lattice-based Public-key Cryptosystem Research Articles

Polynomial equation in algebraic attack on NTRU-HPS and NTRU-HRSS

NTRU is a lattice-based public-key cryptosystem designed by Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman in 1996. NTRU published on Algorithmic Number Theory Symposium (ANTS) in 1998. The ANTS’98 NTRU became the IEEE standard for public key cryptographic techniques based on hard problems over lattices in 2008. NTRU was later redeveloped by NTRU Inc. since 2018 and became one of the finalists in round 3 of the PQC (Post-Quantum Cryptography) standardization process organized by NIST in 2020. There are two types of NTRU algorithms proposed by NTRU Inc., which are classified based on parameter determination, NTRU-HPS (Hoffstein, Pipher, Silverman) and NTRU-HRSS (Hulsing, Rijnveld, Schanck, Schwabe). Algebraic attacks on ANTS’98 NTRU had previously been carried out in 2009 and 2012. In this paper, algebraic attack is performed on the renewed NTRU submitted to the third round of NIST PQC standardization in 2020. This study aims to obtain system of polynomial equations representing plaintext bits of NTRU-HPS and NTRU-HRSS which can be used to find the private key in the next study. As a result, some polynomial equations with unknown variables were obtained.

Lightweight Computational Complexity Stepping Up the NTRU Post-Quantum Algorithm Using Parallel Computing

The Nth-degree Truncated polynomial Ring Unit (NTRU) is one of the famous post-quantum cryptographic algorithms. Researchers consider NTRU to be the most important parameterized family of lattice-based public key cryptosystems that has been established to the IEEE P1363 standards. Lattice-based protocols necessitate operations on large vectors, which makes parallel computing one of the appropriate solutions to speed it up. NTRUEncrypt operations contain a large amount of data that requires many repetitive arithmetic operations. These operations make it a strong candidate to take advantage of the high degree of parallelism. The main costly operation that is repeated in all NTRU algorithm steps is polynomial multiplication. In this work, a Parallel Post-Quantum NTRUEncrypt algorithm called PPQNTRUEncrypt is proposed. This algorithm exploits the capabilities of parallel computing to accelerate the NTRUEncrypt algorithm. Both analytical and Apache Spark simulation models are used. The proposed algorithm enhanced the NTRUEncrypt algorithm by approximately 49.5%, 74.5%, 87.6%, 92.5%, 93.4%, and 94.5%, assuming that the number of processing elements is 2, 4, 8, 12, 16, and 20 respectively.

ALGEBRAIC CRYPTANALYSIS ON NTRU-HPS AND NTRU-HRSS

NTRU is a lattice-based public-key cryptosystem designed by Hoffstein, Pipher, and Silverman in 1996. NTRU published on Algorithmic Number Theory Symposium (ANTS) in 1998. The ANTS’98 NTRU became the IEEE standard for public key cryptographic techniques based on hard problems over lattices in 2008. NTRU was later redeveloped by NTRU Inc. in 2018 and became one of the finalists in round 3 of the PQC (Post-Quantum Cryptography) standardization process organized by NIST in 2020. There are two types of NTRU algorithms proposed by NTRU Inc., which are classified based on parameter determination, NTRU-HPS (Hoffstein, Pipher, Silverman) and NTRU-HRSS (Hulsing, Rijnveld, Schanck, Schwabe). Algebraic cryptanalysis on ANTS’98 NTRU had previously been carried out in 2009 and 2012. In this paper, algebraic cryptanalysis is performed on NTRU-HPS with q=2048, n=509 (ntruhps2048509) and NTRU-HRSS with n=701 (ntruhrss701). This research aims to evaluate the resistance of NTRU-HPS and NTRU-HRSS algorithms against algebraic cryptanalysis by reconstructing the private key value. As a result, NTRU-HPS and NTRU-HRSS resistance to algebraic cryptanalysis.

Fast Implementation of Multiplication on Polynomial Rings

Multiplication on polynomial rings has been widely used in public-key cryptographic schemes based on ideal lattices. It is an important module that significantly affects the efficiency of the schemes. Improved Preprocess-then-NTT (IPtNTT) is an algorithm which can fast realize multiplication on polynomial rings. Compared with the Number Theoretic Transform (NTT), the IPtNTT weakens the parameter restriction of lattice-based public-key cryptographic schemes. By optimizing the IPtNTT with the AVX2 instruction set, we reduce the clock cycles consumed by multiplication on polynomial rings to 15%–22%. According to the experimental results, we give specific suggestions on using AVX2 optimized IPtNTT to realize multiplication on polynomial rings with different parameters chosen in lattice-based public-key cryptosystems.

Dynamic keys generation for internet of things

<span>In several aspects, interest in IoT has become considerable by researchers and academics in recent years. Data security becomes one of the important challenges facing development of IoT environment. Many algorithms were proposed to secure the IoT applications. The traditional public key cryptographic are inappropriate because it requires high computational. Therefore, lattice-based public-key cryptosystem (LB-PKC) is a favorable technique for IoT security. NTRU is one of a LB-PKC that based on truncated polynomial ring, it has good features, which make it to be an effective alternative to the RSA and ECC algorithms. But, there is LLL algorithm can success to attack it under certain conditions. This paper proposes modifications to NTRU public key cryptosystem to be secure against the lattice-based attack by using LLL algorithm, as well as a method for generating a new keys sequence dynamically. The results from simulations show that the performance of these modifications gives more secure from NTRU. </span>

Practical $$\mathsf {MP} \text{- }\mathsf {LWE} $$-based encryption balancing security-risk versus efficiency

Middle-product learning with errors ( $$\mathsf {MP} \text{- }\mathsf {LWE} $$ ) is a variant of the $$\mathsf {LWE}$$ problem introduced at CRYPTO 2017 by Rosca et al. (Advances in cryptology—CRYPTO, Springer, Berlin, 2017). Asymptotically, the theoretical results of Rosca et al. (2017) suggest that $$\mathsf {MP} \text{- }\mathsf {LWE} $$ gives lattice-based public-key cryptosystems offering a ‘security-risk vs. efficiency’ trade-off: higher performance than cryptosystems based on unstructured lattices ( $$\mathsf {LWE}$$ problem) and lower risk than cryptosystems based on structured lattices (Polynomial/Ring $$\mathsf {LWE}$$ problem). However, although promising in theory, Rosca et al. (2017) left the practical implications of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ for lattice-based cryptography unclear. In this paper, we show how to build practical public-key cryptosystems with strong security guarantees based on $$\mathsf {MP} \text{- }\mathsf {LWE} $$ . On the implementation side, we present optimised fast algorithms for computing the middle-product operation over polynomial rings $${\mathbb {Z}}_q[x]$$ , the dominant computation for $$\mathsf {MP} \text{- }\mathsf {LWE} $$ -based cryptosystems. On the security side, we show how to obtain a nearly tight security proof for $$\mathsf {MP} \text{- }\mathsf {LWE} $$ from the hardest Polynomial LWE problem over a large family of rings, improving on the loose reduction of Rosca et al. (2017). We also show and analyze an optimised cryptanalysis of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ that narrows the complexity gap between best known attacks on $$\mathsf {MP} \text{- }\mathsf {LWE} $$ and Polynomial $$\mathsf {LWE}$$ . To evaluate the practicality of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ , we apply our results to construct, implement and optimise parameters for a practical $$\mathsf {MP} \text{- }\mathsf {LWE} $$ -based public-key cryptosystem, $$\mathsf {Titanium} $$ , and compare its benchmarks to other lattice-based systems. Our results show that $$\mathsf {MP} \text{- }\mathsf {LWE} $$ offers a new ‘security-risk vs. efficiency’ trade-off in lattice-based cryptography in practice, not only asymptotically in theory.

Lattice-Based Public Key Cryptosystem for Internet of Things Environment: Challenges and Solutions

Due to its widespread popularity and usage in many applications (smart transport, energy management, ${e}$ -healthcare, smart ecosystem, and so on), the Internet of Things (IoT) has become popular among end users over the last few years. However, with an exponential increase in the usage of IoT technologies, we have been witnessing an increase in the number of cyber attacks on the IoT environment. An adversary can capture the private key shared between users and devices and can launch various attacks, such as IoT ransomware, Mirai botnet, man-in-the-middle, denial of service, chosen plaintext, and chosen ciphertext. To mitigate these security attacks on the IoT environment, the traditional public key cryptographic primitives are inadequate because of their high computational and communication costs. Therefore, lattice-based public-key cryptosystem (LB-PKC) is a promising technique for secure communication. We discuss the taxonomy of two major problems, namely, the shortest path and the closest path problems with respect to the applicability of lattice-based cryptographic primitives for IoT devices. Moreover, we also discuss various LB-PKC techniques, such as NTRU, learning with errors (LWEs), and ring-LWE (R-LWE) which are often used to solve shortest path and lattice NP-hard problems in a polynomial time. We further classify the R-LWE into three categories, namely identity-based encryption, homomorphic encryption, and secure authentication key exchange. We describe the operations and algorithms adopted in each of these encryption mechanisms. Finally, we discuss the challenges, open issues, and future directions for applying LB-PKC in the IoT environment.

Sampling from discrete Gaussians for lattice-based cryptography on a constrained device

Modern lattice-based public-key cryptosystems require sampling from discrete Gaussian (normal) distributions. The paper surveys algorithms to implement such sampling efficiently, with particular focus on the case of constrained devices with small on-board storage and without access to large numbers of external random bits. We review lattice encryption schemes and signature schemes and their requirements for sampling from discrete Gaussians. Finally, we make some remarks on challenges and potential solutions for practical lattice-based cryptography.

On Ideal Lattices and Learning with Errors over Rings

The “learning with errors” (LWE) problem is to distinguish random linear equations, which have been perturbed by a small amount of noise, from truly uniform ones. The problem has been shown to be as hard as worst-case lattice problems, and in recent years it has served as the foundation for a plethora of cryptographic applications. Unfortunately, these applications are rather inefficient due to an inherent quadratic overhead in the use of LWE. A main open question was whether LWE and its applications could be made truly efficient by exploiting extra algebraic structure, as was done for lattice-based hash functions (and related primitives). We resolve this question in the affirmative by introducing an algebraic variant of LWE called ring-LWE , and proving that it too enjoys very strong hardness guarantees. Specifically, we show that the ring-LWE distribution is pseudorandom, assuming that worst-case problems on ideal lattices are hard for polynomial-time quantum algorithms. Applications include the first truly practical lattice-based public-key cryptosystem with an efficient security reduction; moreover, many of the other applications of LWE can be made much more efficient through the use of ring-LWE.

Strengthening hardware implementations of NTRUEncrypt against fault analysis attacks

NTRUEncrypt is a parameterized family of lattice-based public key cryptosystems. Similar to other public key systems, it is susceptible to fault analysis attacks. In this paper, we investigate several techniques to strengthen hardware implementations of NTRUEncrypt against this class of attacks. In particular, by utilizing the algebraic structure of the cipher, we propose several countermeasures based on error detection checksum codes, and spatial/temporal redundancies. The error detection capabilities of these countermeasures, as well as their impact on the decryption throughput and area, are also presented.

Efficient Implementations of NTRU in Wireless Network

NTRU is a lattice-based public key cryptosystem featuring reasonably short, easily created keys, high speed, and low memory requirements, seems viable for wireless network. This paper presents two optimized designs based on the enhanced NTRU algorithm. One is a light-weight and fast NTRU core, it performs encryption only. This work has a gate-count of 1175 gates and a power consumption of 1.51 μW. It can finish the whole encryption process in 1498 μs at 500 kHz. As such, it is perfect for wireless sensor network. Another high-speed NTRU core is capable of both encryption and decryption, with delays of 16,064 μs and 128,010 μs in encryption and decryption respectively. Moreover, it consists of 25,758 equivalent gates and has a total power consumption of 59.2 μW (it will be reduced greatly if low power methods were adopted). This core is recommended to be used in base stations or servers in wireless network.

A Ciphertext-Only Attack Against the Cai-Cusick Lattice-Based Public-Key Cryptosystem

In 1998, Cai and Cusick proposed a lattice-based public-key cryptosystem based on the similar ideas of the Ajtai-Dwork cryptosystem, but with much less data expansion. However, they didn't give any security proof. In our paper, we present an efficient ciphertext-only attack which runs in polynomial time against the cryptosystem to recover the message, so the Cai-Cusick lattice-based public-key cryptosystem is not secure.