NTRU Lattice Research Articles

Compact and efficient KEMs over NTRU lattices

The NTRU lattice is a promising candidate to construct practical cryptosystems, in particular key encapsulation mechanism (KEM), resistant to quantum computing attacks. Nevertheless, there are still some inherent obstacles to NTRU-based KEM schemes when considering integrated performance, taking security, bandwidth, error probability, and computational efficiency as a whole, that is as good as and even better than their {R,M}LWE-based counterparts. In this work, we address the challenges by presenting a new family of NTRU-based KEM schemes, denoted as CTRU and CNTR. By bridging low-dimensional lattice codes and high-dimensional NTRU-lattice-based cryptography with careful design and analysis, to the best of our knowledge, CTRU and CNTR are the first NTRU-based KEM schemes featuring scalable ciphertext compression via only one single ciphertext polynomial, and are the first that can outperform {R,M}LWE-based KEM schemes in terms of integrated performance. For instance, when compared to Kyber, the only KEM scheme currently standardized by NIST, our recommended parameter set CNTR-768 exhibits approximately 12% smaller ciphertext size, when its security is strengthened by (8,7) bits for classical and quantum security respectively, with a significantly lower error probability (2−230 for CNTR-768 vs. 2−164 for Kyber-768). In terms of the state-of-the-art AVX2 implementation of Kyber-768, CNTR-768,achieves a speedup of 2.7X in KeyGen, 3.3X in Encaps, and 1.6X in Decaps, respectively. When compared to the NIST Round 3 finalist NTRU-HRSS, CNTR-768,features 15% smaller ciphertext size, coupled with an improvement of (55,49) bits for classical and quantum security respectively. As for the AVX2 implementation, CNTR-768,outperforms NTRU-HRSS by 26X in KeyGen, 3.0X in Encaps, and 2.2X in Decaps, respectively. Along the way, we develop new techniques for more accurate error probability analysis, and a unified number theoretic transform (NTT) implementation for multiple parameter sets, which may be of independent interest.

Identity-Based Proxy Signature with Message Recovery over NTRU Lattice

Proxy signature is one of the important primitives of public-key cryptography and plays an essential role in delivering security services in modern communications. However, existing post quantum proxy signature schemes with larger signature sizes might not be fully practical for some resource-constrained devices (e.g., Internet of Things devices). A signature scheme with message recovery has the characteristic that part or all of the message is embedded in the signature, which can reduce the size of the signature. In this paper, we present a new identity-based proxy signature scheme over an NTRU lattice with message recovery (IB-PSSMR), which is more efficient than the other existing identity-based proxy signature schemes in terms of the size of the signature and the cost of energy. We prove that our scheme is secure under a Short Integer Solution (SIS) assumption that is as hard as approximating several worst-case lattice problems in the random oracle model. We also discussed some application scenarios of IB-PSSMR in blockchain and Internet of Things (IOT). This paper provides a new idea for the design of lattice signature schemes in low resource constrained environments.

Post quantum blockchain architecture for internet of things over NTRU lattice.

The Internet of Things (IoT) and blockchain, the hottest frontier technologies in recent years, are expected to lead the next technological revolution. Blockchain promises to solve the current challenges encountered by the IoT. However, most of the proposed blockchain-based IoT architectures, which are based on discrete logarithm or large integer factorization problems, are susceptible to quantum attacks. Several quantum-resistant blockchain schemes have recently been proposed. However, the efficiency of their construction or the equipment required is not satisfactory. In this paper, to construct a more efficient postquantum blockchain infrastructure, we propose blockchain architecture for the IoT over the NTRU lattice and provide a cryptographic security proof of the scheme. Attributed to the more efficient underlying lattice structure, our scheme has excellent performance when compared to the existing quantum-resistant blockchain scheme, and we reduce the transaction size from hundreds of megabytes to several kilobytes. To further improve the blockchain's performance, we present the general framework of segregated witnesses and aggregate signatures over the NTRU lattice. Our scheme promises a blockchain solution for resource-constrained environments.

Revisiting lower dimension lattice attacks on NTRU

Vectors are called short vectors when the Euclidean norm of vectors is relatively small. By now, some researches have been done to find sufficient short vectors in certain variants of NTRU lattice to analyze the security of NTRU systems. These variants are all taking advantage of the property of NTRU cryptosystem to modify the standard NTRU lattice. Related variants include zero-run lattices with dimension 2N, zero-forced lattices with dimension 2(N−r), r<N, and IN-lattices with dimension N.Motivated by different constructions, we revisit related variants and develop some techniques to further reduce the dimension of IN-lattice, such that the expected breaking time can be decreased significantly. Firstly, by working with the cyclic matrix associated with the NTRU public key h, shifts of the private vector f can be accommodated. Hence, t randomly chosen coefficients in a shift of the private vector f can be forced to equal zero. This not only results in a new lattice with a lower dimension but also creates an environment to utilize parallel mechanisms to improve the probability of success. Finally, experiments have demonstrated that our approach outperforms the previous methods.

Analysis of the Falcon signature compared to other signatures. GPV and Rabin frameworks

The article discusses the analysis of the essence and protection possibilities of the Falcon post-quantum signature. The main properties of the Falcon signature are considered. An estimate of what resources and computing power is required to use successfully the Falcon signature. A structural analysis of the Falcon signature is performed. The GPV and Rabina frameworks are analyzed. Detailed conclusions are made regarding the conducted analyses. The stability and complexity of the GPV and Rabin frameworks are evaluated, the main structures and protocols of these frameworks are considered. A detailed analysis of the main properties of NTRU lattices is carried out, the main rules of factorization of the GPV and Rabin frameworks are considered. Fast Fourier sampling is investigated. Conclusions are made regarding each conducted study.

A novel identity-based multi-signature scheme over NTRU lattices

Multi-signature is an important technology to compress multiple signatures on the common message into a compact one, thereby reducing the consumption of storage space and transmission bandwidth. Such a cryptographic primitive is widely used in financial applications such as blockchain which requires multiple keys to authorize a transaction. With the advent of quantum computers, traditional multi-signature schemes may no longer be secure as their underlying security assumptions (e.g. RSA or discrete logarithm problems) may not hold anymore. In this paper, we propose a novel identity-based multi-signature (IBMS) scheme over NTRU lattices, which is secure against the attacks of quantum computers. To the best of our knowledge, it is the first lattice-based IBMS scheme. We show that our scheme is provably secure in the random oracle model based on the ring version of the short integer solution assumption (Ring-SIS). Compared with the closely related works in the literature, our scheme enables the signer to select its system identity (such as email address, physical IP address, and etc.) as the public key, which effectively alleviates the certificate management problem in the PKI setting, and takes the advantage of discrete Gaussian distribution instead of uniform distribution to generate secret signing keys and multi-signatures. Besides, our scheme does not require all the system users to setup a trusted common string, which further simplifies the deployment of our scheme in practice.

A Mathematical Perspective on Post-Quantum Cryptography

In 2016, the National Institute of Standards and Technology (NIST) announced an open competition with the goal of finding and standardizing suitable algorithms for quantum-resistant cryptography. This study presents a detailed, mathematically oriented overview of the round-three finalists of NIST’s post-quantum cryptography standardization consisting of the lattice-based key encapsulation mechanisms (KEMs) CRYSTALS-Kyber, NTRU and SABER; the code-based KEM Classic McEliece; the lattice-based signature schemes CRYSTALS-Dilithium and FALCON; and the multivariate-based signature scheme Rainbow. The above-cited algorithm descriptions are precise technical specifications intended for cryptographic experts. Nevertheless, the documents are not well-suited for a general interested mathematical audience. Therefore, the main focus is put on the algorithms’ corresponding algebraic foundations, in particular LWE problems, NTRU lattices, linear codes and multivariate equation systems with the aim of fostering a broader understanding of the mathematical concepts behind post-quantum cryptography.

Comparison of the quality of sampling algorithms from discrete normal distribution on NTRU lattices

Post-quantum cryptography is a field of research that studies cryptographic transformations protected against attacks using quantum computers. For many years, lattice-based cryptography has become one of the most promising solutions to protect against the threat of quantum computing. An important feature of the post-quantum period in cryptography is the significant uncertainty about the source data for cryptanalysis and countermeasures in the capabilities of quantum computers, their mathematical support and software, as well as the application of quantum cryptanalysis to existing cryptocurrencies and cryptoprotocol. The main methods are mathematical methods of electronic signature, which have undergone significant analysis and justification in the process of extensive research by cryptologists and mathematicians at the highest level. The security of signature schemes depends strongly on the standard deviation of the discrete Gaussian distribution, which has a sampling algorithm. In this paper, the most common variants of sampling algorithms were considered and analyzed, because the quality of all algorithms depends significantly on the structure of the lattice for which sampling takes place. A comparison of the quality of lattice sampling algorithms is highlighted. In particular, the paper considers Klein's algorithms (its modification is the Thomas Prest and Dukas algorithm), Peikert's algorithm and the floating-point sampling algorithm. Klein's sampling algorithm, in particular its modification, namely, the Dukas-Prest algorithm, gives the smallest vectors. Theoretically, it is much better than Klein's algorithm on NTRU lattices, but it requires the use of floating-point arithmetic, which complicates greatly the analysis of its security and tocreation of software or hardware implementation.

Efficient Linkable Ring Signature Scheme over NTRU Lattice with Unconditional Anonymity.

In cloud and edge computing, senders of data often want to be anonymous, while recipients of data always expect that the data come from a reliable sender and they are not redundant. Linkable ring signature (LRS) can not only protect the anonymity of the signer, but also detect whether two different signatures are signed by the same signer. Today, most lattice-based LRS schemes only satisfy computational anonymity. To the best of our knowledge, only the lattice-based LRS scheme proposed by Torres et al. can achieve unconditional anonymity. But the efficiency of signature generation and verification of the scheme is very low, and the signature length is also relatively long. With the preimage sampling, trapdoor generation, and rejection sampling algorithms, this study proposed an efficient LRS scheme with unconditional anonymity based on the e-NTRU problem under the random oracle model. We implemented our scheme and Torres et al.'s scheme, as well as other four efficient lattice-based LRS schemes. It is shown that under the same security level, compared with Torres et al.'s scheme, the signature generation time, signature verification time, and signature size of our scheme are reduced by about 94.52%, 97.18%, and 58.03%, respectively.

BAT: Small and Fast KEM over NTRU Lattices

We present BAT – an IND-CCA secure key encapsulation mechanism (KEM) that is based on NTRU but follows an encryption/decryption paradigm distinct from classical NTRU KEMs. It demonstrates a new approach of decrypting NTRU ciphertext since its introduction 25 years ago. Instead of introducing an artificial masking parameter p to decrypt the ciphertext, we use 2 linear equations in 2 unknowns to recover the message and the error. The encryption process is therefore close to the GGH scheme. However, since the secret key is now a short basis (not a vector), we need to modify the decryption algorithm and we present a new NTRU decoder. Thanks to the improved decoder, our scheme works with a smaller modulus and yields shorter ciphertexts, smaller than RSA-4096 for 128-bit classical security with comparable public-key size and much faster than RSA or even ECC. Meanwhile, the encryption and decryption are still simple and fast in spite of the complicated key generation. Overall, our KEM has more compact parameters than all current lattice-based schemes and a practical efficiency. Moreover, due to the similar key pair structure, BAT can be of special interest in some applications using Falcon signature that is also the most compact signature in the round 3 of the NIST post-quantum cryptography standardization. However, different from Falcon, our KEM does not rely on floating-point arithmetic and can be fully implemented over the integers.

Identity-Based Linkable Ring Signature on NTRU Lattice

Although most existing linkable ring signature schemes on lattice can effectively resist quantum attacks, they still have the disadvantages of excessive time and storage overhead. This paper constructs an identity-based linkable ring signature (LRS) scheme over NTRU lattice by employing the technologies of trapdoor generation and rejection sampling. The security of this scheme relies on the small integer solution (SIS) problem on NTRU lattice. We prove that this scheme has unconditional anonymity, unforgeability, and linkability under the random oracle model (ROM). Through the performance analysis, this scheme has a shorter size of public/private keys, and when the number of ring members is small (such as N ≤ 8 ), this scheme has a shorter signature size compared with other existing latest lattice-based LRS schemes. The computational efficiency of signature has also been further improved since it only involves multiplication in the polynomial ring and modular operations of small integers. Finally, we implemented our scheme and other similar schemes, and it is shown that the time for the signature generation and verification of this scheme decreases roughly by 44.951% and 33.503%, respectively.

Generalizing Lyubashevsky-Wichs trapdoor sampler for NTRU lattices

Generalizing Lyubashevsky-Wichs trapdoor sampler for NTRU lattices

Lattice Attacks on NTRU Revisited

NTRU cryptosystem was proposed by J. Hoffstein, J.Pipher and J.H. Silverman in 1996, whose security is related to the hardness of finding sufficient short vectors in NTRU lattice with dimension $2N$ . Many researchers conjecture that the private key vector is indeed the shortest vector in the lattice in most cases. However, no formal proof has been provided in the literature before to the best of our knowledge. In this paper, we revisit the lattice attack on NTRU and present a new dimension reduction attack on NTRU without considering the pattern of private polynomials. More precisely, we show that one can recover a group of equivalent private keys by solving shortest vector problem in a new dimension-reduced lattice with dimension $N+k, k , where $k$ is related to the specific parameters selected. As a corollary of our attack, we prove that the private key vector and its rotations are the shortest vectors of the original NTRU lattice with an overwhelming probability, which confirms the conjecture of the length of the shortest vector of the original NTRU lattice.

Identity-Based Proxy Re-encryption over NTRU Lattices for Cloud Computing

Identity-based proxy re-encryption (IB-PRE) is a kind of public key cryptography that allows a proxy to convert the ciphertext based on Alice’s identity into another ciphertext of the same message for Bob. It has important applications in cloud computing, distributed systems and secure e-mail forwarding. So far, the existing lattice-based IB-PRE schemes are designed on the general lattice and their security is based on the learning with errors (LWE) assumption. In this paper, we propose an IB-PRE scheme over NTRU lattices with the desirable properties of anonymity, unidirectionality, backward collusion safeness and multi-hop. Our IB-PRE scheme is provable secure under adaptive chosen-plaintext and adaptive chosen-identity attacks. And, in the random oracle model, the security of our scheme is based on the decisional Ring-LWE assumption. Besides, the key and ciphertext sizes of our IB-PRE scheme are short, only one or two ring elements, and our scheme could encrypt n bits in each encryption process.

Vulnerable Public Keys in NTRU Cryptosystem

In this paper the authors give an efficient bounded distance decoding (BDD for short) algorithm for NTRU lattices under some conditions about the modulus number q and the public key h. They then use this algorithm to give plain-text recovery attack to NTRU Encrypt and forgery attack on NTRU Sign. In particular the authors figure out a weak domain of public keys such that the recent transcript secure version of NTRU signature scheme NTRUMLS with public keys in this domain can be forged.

Efficient NTRU Lattice-Based Certificateless Signature Scheme for Medical Cyber-Physical Systems.

An electronic health (e-health) system, such as a medical cyber-physical system, offers a number of benefits (e.g. inform medical diagnosis). There are, however, a number of considerations in the implementation of the medical cyber-physical system, such as the integrity of medical / healthcare data (e.g. manipulated data can result in misdiagnosis). A number of digital signature schemes have been proposed in recent years to mitigate some of these challenges. However, the security of existing signatures is mostly based on conventional difficult mathematical problems, which are known to be insecure against quantum attacks. In this paper, we propose a certificateless signature scheme, based on NTRU lattice. The latter is based on the difficulty of small integer solutions on the NTRU lattice, and is known to be quantum attack resilience. Security analysis and performance evaluations demonstrate that our proposed scheme achieves significantly reduced communication and computation costs in comparison to two other competing quantum resilience schemes, while being quantum attack resilience.

Security Vulnerabilities of Four Signature Schemes From NTRU Lattices and Pairings

Certificateless cryptography solves the certificate management problem in public-key cryptography and the key-escrow problem in identity-based cryptography. Xie et al. proposed a certificateless signature scheme using NTRU lattices. They proved that their scheme was existential unforgeable for Type I and Type II adversaries under the intractability of the Small Integer Solution (SIS) problem on NTRU lattices in the random oracle model. Subsequently, Hung et al. proposed a revocable certificateless signature scheme on NTRU lattices that gave a revocation method via public channels to revoke illegal or compromised users. They also proved that their scheme was existential unforgeable for Type I, Type II and Type III adversaries under the intractability of the SIS problem. Recently, Wang et al. proposed a certificateless aggregate signature scheme from bilinear pairings and Rezaeibagha et al. proposed a new lightweight certificateless scheme for Industrial Internet of Things from bilinear pairings. The security of their schemes was proven for Type I and Type II adversaries under the intractability of some mathematical problems. In this paper, we show that the two schemes on NTRU lattices are insecure against Type I or Type II adversaries. We also point out invalidity of Wang et al. ’s scheme and vulnerability of Rezaeibagha et al. ’s scheme against Type I attacks. We then suggest some improvements to prevent our attacks.

Certificateless Sequential Aggregate Signature Scheme on NTRU Lattice

Having the advantages of certificateless signature and the aggregate signature at the same time, certificateless aggregate signature has been widely applied in e-business, e-government and software security since it was proposed in 2007. Although a number of certificateless aggregate signature schemes have been proposed, all of them are based on the classic number theory problem, which are no longer secure in the quantum era. In this paper, a certificateless sequential aggregate signature over number theory research unit lattice is proposed, which is proven to be secure in random oracle model. Moreover, we extend the new scheme into an efficient certificatebased sequential aggregate signature which is also secure in quantum era.

A New Self-Certified Signature Scheme Based on NTRUSing for Smart Mobile Communications

Smart mobile devices are critical component in the mobile communication, it has been acted as various services with the development of the mobile internet. For example, mobile payment has become universal in the mobile e-commerce, and it is widely attracting attention by most people. However, the extensive application of the mobile e-commerce would increase the security issue for mobile users who use the smart mobile devices, such as integrity and authentication protection for the transaction data and the user privacy. Furthermore, most smart mobile devices are designed with low power and resource constrained systems, it is not suitable for providing competent security levels through higher complexity cryptographic algorithms to resolve the above security issues. In this paper, we propose a new self-certified digital signature scheme based on NTRUSign which builded in the complexity of approximating the closest vector in NTRU lattices without certification for the smart mobile communication. In contrast to previous research, the result shows that the new scheme achieve such as efficiency that it may overcome the space obstacles and provide a real-world practical solution for some security issues in the smart mobile communication.

An efficient lattice reduction using reuse technique blockwisely on NTRU

In this paper, we propose a lattice reduction algorithm for use with NTRU lattices. Given an NTRU lattice as its input, the algorithm computes an LLL-reduced basis. The proposed lattice reduction algorithm is more efficient than the classical LLL algorithm. Recently, a lattice reduction algorithm for ideal lattices, named iLLL, was proposed by Plantard, Susilo, and Zhang. This algorithm is identical to that of the LLL except for the fact that it contains an additional subroutine, named Reuse. The subroutine serves to further reduce a set of short vectors that has already been computed by the algorithm prior to its initiation. As a result, the iLLL is able to output an LLL-reduced basis more efficiently than the LLL is able to do so. However, the iLLL cannot be directly applied to an NTRU lattice, because it is not an ideal lattice. Yet, from the fact that an NTRU lattice is also a module lattice (a generalization of an ideal lattice), we can adapt the main idea behind the iLLL blockwisely in our approach to NTRU lattices. We demonstrate that the proposed algorithm (containing a modified version of the aforementioned subroutine Reuse) is asymptotically n2 times faster at outputting an LLL-reduced basis than the LLL when applied to NTRU lattices of dimension n. In the case of small n, our experiments show that the proposed algorithm is slightly faster at outputting an LLL-reduced basis than the LLL. In addition, we present an example of how to recover a private key of an NTRU encryption scheme by using the proposed algorithm in the case of n=22.