Scott Fluhrer edited section_Abstract_This_paper_explores__.tex  almost 9 years ago

Commit id: 988169a6c629073cb2cd76aa765e97a848d5209b

deletions | additions      

       

Now, this approach has managed to recover the private key using fewer NTRU multiplications than expected. On the other hand, this approach is quite impractical (even beyond the number of operations involved); it assumes that we can practically check for the existence of an entry in a table with more than $2^{65}$ entries in constant time.  An obvious alternative approach would be to search for equalities between $F_1F_2H$ and $G-F_3H$ modulo 2; this would allow us to ignore the sign differences in the $F_1, F_2, F_3$ coefficients. coefficients (and avoids the possibility of the attack failing because of a wrap, as all have parameter sets in question has q being a power of 2).  However, this approach turns out not to work, because $G$ turns out to be relatively dense evaluated modulo 2, and so there's no good way to determine when we've detected a hit. the correct $F_1, F_2, F_3$ set.  \section{Conclusions and Recommendations}