1. NTRUSign Parameters Challenge
William Whyte
NTRU Cryptosystems, Inc.

2. Ground Rules What’s a break? Cash prizes for break:
We’re going to say things have a certain security level.
Anything below that IS A BREAK.
If we say 80 bits and it’s 79 bits, that’s a break.
Cash prizes for break:
There are no cash prizes for a break.

3. NTRUSign Pick two short polynomials (f, g) in ring R = Z[X]/(XN-1)
Find (F, G) s. t. f*G – g*F = q, q an integer (power of 2)
Then is an R-module / lattice with det q and a basis vectors of length N1/2, N: private key
And , h = g/f mod q, is an R-module / lattice with a basis of vectors of length N3/2: public key
Signing: message is point, solve CVP for this point using good basis.
Verification: check signature is in lattice (using bad basis) and close to message point.

4. Lattice Reduction
Speed of lattice reduction depends on size of good basis v expected size of short vector in lattice with given determinant.
For ((f g) (F G)) lattice, N = 251 gives 80-bit security.
But if we swap g and F:
Determinant is still fG-gF = q, but (f F) is much bigger than (f g)
Get greater lattice security at lower dimensions!
For free!
(remember: no cash prizes)

5. Improved Parameter Sets
Up now at
k: security level; d: f consists of d+1 +1s, d -1s, and (N-2d-1) 0s; \beta: signature normalization factor; Norm: how close you have to be for a signature to pass
\tau: attacker requires >> 2\tau signatures to recover private key.
Have at them!
k N d q \beta Norm \tau