eprint.iacr.orgpaperHow Secure are NTRU+ Keys? Analysing the Best Module Attacks
ePrint 2026/2527 by Paola de Perthuis and Filip Trenkić analyses module-BKZ attacks on NTRU+, the South Korean KEM standard. It introduces relative canonical and coefficient embeddings and shows they agree up to scaling exactly when rad(c)/rad(ℓ) is 1 or 2. Simulation-based estimates show the best module attack saves 4 to 10 blocksizes, costing NTRU+ keys at most three bits of Core-SVP security. NTRU+ parameters stay safe in the overstretched regime.
TL;DR Shows module-BKZ key-recovery attacks cost NTRU+ at most three bits of Core-SVP security, leaving its parameters safe.
Organisations named here
- Core-SVP
- Filip Trenkić
- overstretched NTRU
- Paola de Perthuis
Technologies named here
- Module-BKZ
- BKZ
- Core-SVP model
- NTRU+
Related in other
eprint.iacr.orgpaperRerandomizable Garbling for Arithmetic Circuits
aseemshrey.inarticle