Scott Fluhrer edited section_Abstract_This_paper_explores__.tex  almost 9 years ago

Commit id: 13389f50ee872e5a42109c63eddbf6a161ee9d5a

deletions | additions      

       

The second strategy would be to define alternative parameter sets that are designed to be Quantum-Resistant. These alternative parameter sets might use the same polynomials as the current sets; however we would modify the primitives used using the NAEP padding method; they would use wider hash functions, and larger $b$ values. The costs here would be that the new parameter sets would be incompatible with libraries that only understood the old sets, plus a minor decrease in the amount of plaintext that NTRU could encrypt in a single message (because $b$ is now larger).  The third way of addressing this is to question whether this is actually a threat after all. $O(2^{80})$ work may sound like a conceivable amount of work; however that notation conceals a constant of proportionality, and that constant might be of significant size. In both of these attacks, the amount of work involves is actually $O(2^{80})$ encryption operations; in addition, each operation is done on a Quantum Computer (using entangled states). It would appear plausible that such an operation may be more expensive than the corresponding operation on a classical computer. However, we don't have a working Quantum Computer, and so we can't be certain how much more expensive these operations would be. Because of this uncertainty, while this line of argument may sound promising, our opinion is that we rely only on that; we recommend one of the previous two strategies. strategies (especially given their relatively low cost).