Timing Attacks on NTRUEncrypt Via Variation in the Number of Hash Calls

摘要: This report studies timing attacks on NTRUEncrypt based variation in the number of hash calls made decryption. The apply to parameter sets [8,6]. To mount attacker, an attacker performs a variable amount precomputation, then submits relatively small specially constructed ciphertexts for decryption and measures times. Comparison times with precomputed data allows recover key greatly reduced time compared standard NTRUEncrypt. can be used all keys generated specific set tradeoffs exist that increase precomputation order decrease required individual key. For [3] claim k-bit security but are vulnerable this attack, we find typically single about k/2 bits effort. Finally, describe simple means prevent these by ensuring operations take constant SHA calls. recommended countermeasure does not break interoperability [8,6] has only slight effect performance.