javaencryptionbouncycastlentruencrypt

How to get NTRU parameters


I'm using bouncycastle's implimentation of NTRU, here is my code:

NTRUEncryptionKeyGenerationParameters ntruEncryptionKeyGenerationParameters = NTRUEncryptionKeyGenerationParameters.EES1087EP2;
NTRUEncryptionKeyPairGenerator ntruEncryptionKeyPairGenerator = new NTRUEncryptionKeyPairGenerator();
ntruEncryptionKeyPairGenerator.init(ntruEncryptionKeyGenerationParameters);
AsymmetricCipherKeyPair asymmetricCipherKeyPair = ntruEncryptionKeyPairGenerator.generateKeyPair();
NTRUEncryptionPrivateKeyParameters ntruEncryptionPrivateKeyParameters = (NTRUEncryptionPrivateKeyParameters) asymmetricCipherKeyPair.getPrivate();

NTRUEncryptionPublicKeyParameters ntruEncryptionPublicKeyParameters = (NTRUEncryptionPublicKeyParameters) asymmetricCipherKeyPair.getPublic();
NTRUEngine ntruEngine = new NTRUEngine();
ntruEngine.init(true, ntruEncryptionPublicKeyParameters);

The question is how can I get f polynomial and basis, because I've found only fp(inverse of f, and they don't have inverse methods) and Basis? I've looked up javadocs but no result.


Solution

  • You can find it from the class NTRUEncryptionKeyPairGenerator

    public AsymmetricCipherKeyPair generateKeyPair()
    {
        int N = params.N;
        int q = params.q;
        int df = params.df;
        int df1 = params.df1;
        int df2 = params.df2;
        int df3 = params.df3;
        int dg = params.dg;
        boolean fastFp = params.fastFp;
        boolean sparse = params.sparse;
    
        Polynomial t;
        IntegerPolynomial fq;
        IntegerPolynomial fp = null;
    
        // choose a random f that is invertible mod 3 and q
        while (true)
        {
            IntegerPolynomial f;
    
            // choose random t, calculate f and fp
            if (fastFp)
            {
                // if fastFp=true, f is always invertible mod 3
                t = params.polyType == NTRUParameters.TERNARY_POLYNOMIAL_TYPE_SIMPLE ? Util.generateRandomTernary(N, df, df, sparse, params.getRandom()) : ProductFormPolynomial.generateRandom(N, df1, df2, df3, df3, params.getRandom());
                f = t.toIntegerPolynomial();
                f.mult(3);
                f.coeffs[0] += 1;
            }
            else
            {
                t = params.polyType == NTRUParameters.TERNARY_POLYNOMIAL_TYPE_SIMPLE ? Util.generateRandomTernary(N, df, df - 1, sparse, params.getRandom()) : ProductFormPolynomial.generateRandom(N, df1, df2, df3, df3 - 1, params.getRandom());
                f = t.toIntegerPolynomial();
                fp = f.invertF3();
                if (fp == null)
                {
                    continue;
                }
            }
    
            fq = f.invertFq(q);
            if (fq == null)
            {
                continue;
            }
            break;
        }
    
        // if fastFp=true, fp=1
        if (fastFp)
        {
            fp = new IntegerPolynomial(N);
            fp.coeffs[0] = 1;
        }
    
        // choose a random g that is invertible mod q
        DenseTernaryPolynomial g;
        while (true)
        {
            g = DenseTernaryPolynomial.generateRandom(N, dg, dg - 1, params.getRandom());
            if (g.invertFq(q) != null)
            {
                break;
            }
        }
    
        IntegerPolynomial h = g.mult(fq, q);
        h.mult3(q);
        h.ensurePositive(q);
        g.clear();
        fq.clear();
    
        NTRUEncryptionPrivateKeyParameters priv = new NTRUEncryptionPrivateKeyParameters(h, t, fp, params.getEncryptionParameters());
        NTRUEncryptionPublicKeyParameters pub = new NTRUEncryptionPublicKeyParameters(h, params.getEncryptionParameters());
        return new AsymmetricCipherKeyPair(pub, priv);
    }
    

    f is the polynomial you are after. What do you mean by the basis?

    The inverse method is described in NTRU Report 014: Almost Inverses and Fast NTRU Key Creation

    https://www.securityinnovation.com/uploads/Crypto/NTRUTech014.pdf

    It is done via several steps for optimization

    1. find inverse of f over Z/2Z/(x^N-1)

    2. lift it to Z/2^rZ/(x^N-1)

    3. repeat until 2^r = q