Estimate All the {LWE, NTRU} Schemes

• Published in: Security and Cryptography for Networks Vol. 11035; pp. 351 - 367
• Main Authors: Albrecht, Martin R., Curtis, Benjamin R., Deo, Amit, Davidson, Alex, Player, Rachel, Postlethwaite, Eamonn W., Virdia, Fernando, Wunderer, Thomas
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer International Publishing AG 2018; Springer International Publishing
• Series: Lecture Notes in Computer Science
• DOI: 10.1007/978-3-319-98113-0_19
• ISBN: 9783319981123; 3319981129
• ISSN: 0302-9743

We consider all LWE- and NTRU-based encryption, key encapsulation, and digital signature schemes proposed for standardisation as part of the Post-Quantum Cryptography process run by the US National Institute of Standards and Technology (NIST). In particular, we investigate the impact that different estimates for the asymptotic runtime of (block-wise) lattice reduction have on the predicted security of these schemes. Relying on the “LWE estimator” of Albrecht et al., we estimate the cost of running primal and dual lattice attacks against every LWE-based scheme, using every cost model proposed as part of a submission. Furthermore, we estimate the security of the proposed NTRU-based schemes against the primal attack under all cost models for lattice reduction.