Scott Fluhrer edited section_Abstract_This_paper_explores__.tex  almost 9 years ago

Commit id: 3cc5b83be3fb0faf17ed683708adee84e656fbf1

deletions | additions      

       

NTRU does appear to be immune to Shor's algorithm (which allows the attacker to quickly factor numbers and compute discrete logarithms). However, a Quantum Computer also allows an attacker to run Grover's algorithm\cite{Grover_1996}, which is able to find a $n$ bit solution to a problem in $2^{n/2}$ time. The question we would like to look at is 'how can Grover's algorithm be used to advantage in attacking NTRU?'  There has been previous analysis of the Quantum Resistance of NTRU, such as by Wang, Ma and Ma\cite{Wang_2013}, however those works studied previously defined parameter sets (and in particular ones which did not use the balanced encoding of the current sets). sets.  This work is focusing on the parameter sets distributed with the current NTRU library. \section{NTRU Basics}  NTRU works in the ring of polynomials $Z[x]/x^N-1$, where $N$ is a prime. Computations in this ring are actually done modulo a prime power; NTRUEncrypt actually evaluates additions and multiplications modulo a prime power ($q$) and a small polynomial ($p$) during the course of its operation. However, all the operations that we'll examine are done modulo $q$ (where $q=2048$ is a typically choice), hence for the purposes of this paper, we can consider the ring to be $Z[x]/(x^N-1,q)$. In addition to the base NTRU operation, NTRUEncrypt uses a padding mechanism called NAEP\cite{Howgrave-Graham_2003} to protect the underlying NTRU primitive from the attacker being able to deduce information from decryption failures.