![](bg2.png)
We search for those splits of f, which lead to a g = fH
with the first positions zero. This can be done by gen-
erating first a list of vectors of weight one fourth of
the weight of f with the first ℓ
[1]
positions zero via
the birthday approach. Then, we can search the sum
of pairs of such vectors, which are zero on the first
ℓ > ℓ
[1]
positions and have the half weight of f. In
the last part of the attack, we can relax the “birthday”
property, searching for those pairs of the latter vec-
tors, which sum to a vector with the first ℓ + µ posi-
tions binary. Balancing ℓ
[1]
,ℓ and µ, we can be sure,
that the correct f is among the generated vectors. This
way we obtain sets of almost the same size at each it-
eration and thus an attack, which requires much less
memory than Odlyzko’s attack. Further, such an at-
tack is competitive with the fastest known NTRU at-
tack (Howgrave-Graham,2007) in terms of product of
time and space and even better than the space reduced
variant presented in the same paper.
1.2 Related Work
At CRYPTO 2007, N. Howgrave-Graham showed
that the security level for the NTRU parameters
proposed in (P1363.1/D9, 2003) is lower than in-
tended (Howgrave-Graham, 2007). For his attack,
Howgrave-Graham used a hybrid lattice-reduction
and combinatorial attack against NTRU. By heuris-
tic arguments he concludes, that he can attack the
ees251ep6
parameter set in 2
76.2
modular additions
on a machine with 2
65.6
bits of memory or in 2
89.2
modular additions on a machine with 2
53.6
bits of
memory. Unfortunately, so far we are not able to com-
bine both approaches since Howgrave-Graham uses
the concept of s-admissible vectors, which prevents
an iterative birthday approach in the search part of his
attack.
1.3 Organization
In the next section we recall NTRU and the basic nota-
tions. Then, we revise the generalized birthday para-
dox and view it’s application to NTRU. To conclude,
we give numbers and a comparison to the other at-
tacks on NTRU.
2 PRELIMINARIES
In this paper we view only integer lattices, i.e. sub-
vector spaces of Z
N
. We will call wt(f) the (Ham-
ming) weight of a vector f ∈ Z
N
, which corresponds
to the number of non-zero entries in f. If J is a sub-
set of the positions of f, we write f
J
= (f
i
)
i∈J
. For an
introduction into lattice theory see (Micciancio and
Goldwasser, 2002).
NTRU according to (P1363.1/D9, 2003) works as
follows: System parameters are three primes N,q and
p = 2. NTRU uses the ring R = Z[X]/(X
N
− 1). The
elements of that ring are identified with their unique
representations in Z[X] of degree less than N. We will
denote as weight wt( f) of a polynomial f ∈ R the
number of non-zero coefficients. The NTRU secret
key are two binary polynomials f, g ∈ R of weight
d
f
,d
g
respectively. There are various variants of
NTRU. In this paper we concentrate on the one, where
the public key is given as h = ( f
−1
g mod q), where
“mod q” means reduction of the coefficients modulo
q. All attacks on one variant of NTRU may usually be
adapted for other variants.
A description how NTRU en- and decryption
work can be found, e.g., in (Hoffstein et al., 1998;
Howgrave-Graham et al., 2003). However, since at-
tacks on NTRU ciphertexts usually can be adapted to
attack the secret keys and vice versa, this paper deals
with attacks on the secret NTRU keys, only. We thus
omit giving details on en- and decryption.
The NTRU lattice is obtained from a matrix rep-
resentation of multiplications in R . We can easily
deduce a (cyclic) matrix H ∈ F
N×N
q
representing the
multiplication of polynomials with h in R . With the
N-dimensional identity matrix Id
N
we obtain:
C
NTRU
:= f
Id
N
H
≡ (f,g) mod q (1)
for the coefficient vectors f, g of f and g. Note
that
Id
N
H
defines a double-cyclic code over
F
q
. To obtain the NTRU lattice out of the matrix
Id
N
H
, vectors allowing the reduction of fH
modulo q are added and in some cases, f is scaled
by an α:
L
NTRU
:=
αId
N
H
0 qId
N
(2)
According to the Gauss-heuristic, (αf,g) can be as-
sumed to be the shortest vector in the NTRU lattice
if α is properly chosen (up to double-cyclic shifts).
Most attacks aim to find this vector either by lattice
reduction or by a combinatorial approach. In the fol-
lowing we will take α = 1, as this is a suitable value.
3 THE GENERALIZED
BIRTHDAY PARADOX
Many combinatorial attacks could be sped-up by
Wagner’s solution for the generalized Birthday para-
SECRYPT 2008 - International Conference on Security and Cryptography
238