def __init__(self, n):
"""Initialize a secret key."""
# Public parameters
self.n = n
self.sigma = Params[n]["sigma"]
self.sigmin = Params[n]["sigmin"]
self.signature_bound = Params[n]["sig_bound"]
self.sig_bytelen = Params[n]["sig_bytelen"]
# Compute NTRU polynomials f, g, F, G verifying fG - gF = q mod Phi
self.f, self.g, self.F, self.G = ntru_gen(n)
# From f, g, F, G, compute the basis B0 of a NTRU lattice
# as well as its Gram matrix and their fft's.
B0 = [[self.g, neg(self.f)], [self.G, neg(self.F)]]
G0 = gram(B0)
self.B0_fft = [[fft(elt) for elt in row] for row in B0]
G0_fft = [[fft(elt) for elt in row] for row in G0]
self.T_fft = ffldl_fft(G0_fft)
# Normalize Falcon tree
normalize_tree(self.T_fft, self.sigma)
# The public key is a polynomial such that h*f = g mod (Phi,q)
self.h = div_zq(self.g, self.f)
def __init__(self, n):
"""Initialize a secret key."""
"""Public parameters"""
self.n = n
self.q = q
self.hash_function = hashlib.shake_256
"""Private key part 1: NTRU polynomials f, g, F, G verifying fG - gF = q mod Phi"""
self.f, self.g, self.F, self.G = ntru_gen(n)
"""Private key part 2: fft's of f, g, F, G"""
self.f_fft = fft(self.f)
self.g_fft = fft(self.g)
self.F_fft = fft(self.F)
self.G_fft = fft(self.G)
"""Private key part 3: from f, g, F, G, compute the basis B0 of a NTRU lattice as well as its Gram matrix and their fft's"""
self.B0 = [[self.g, neg(self.f)], [self.G, neg(self.F)]]
self.G0 = gram(self.B0)
self.B0_fft = [[fft(elt) for elt in row] for row in self.B0]
self.G0_fft = [[fft(elt) for elt in row] for row in self.G0]
# self.T = ffldl(self.G0)
self.T_fft = ffldl_fft(self.G0_fft)
"""Private key part 4: compute sigma and signature bound."""
sq_gs_norm = gs_norm(self.f, self.g, q)
self.sigma = 1.28 * sqrt(sq_gs_norm)
self.signature_bound = 2 * self.n * (self.sigma**2)
"""Private key part 5: set leaves of tree to be the standard deviations."""
normalize_tree(self.T_fft, self.sigma)
"""Public key: h such that h*f = g mod (Phi,q)"""
self.h = div_zq(self.g, self.f)
def test_ntt(n, q, iterations=10):
"""Test the NTT."""
for i in range(iterations):
f = [randint(0, q - 1) for j in range(n)]
g = [randint(0, q - 1) for j in range(n)]
h = mul_zq(f, g, q)
try:
k = div_zq(h, f, q)
if k != g:
print("(f * g) / f =", k)
print("g =", g)
print("mismatch")
return False
except ZeroDivisionError:
continue
return True
def ntru_gen(n):
"""Implement the algorithm 9 (NTRUGen) of Falcon's documentation.
At the end of the function, polynomials f, g, F, G in Z[x]/(x ** n + 1)
are output, which verify f * G - g * F = 1 mod (x ** n + 1).
"""
while True:
sigma = 1.17 * sqrt(q / (2. * n))
f = [int(round(gauss(0, sigma))) for i in range(n)]
g = [int(round(gauss(0, sigma))) for i in range(n)]
try:
h = div_zq(g, f)
F, G = ntru_solve(f, g)
if gs_norm(f, g, q) < (1.17**2) * q:
return f, g, [int(coef)
for coef in F], [int(coef) for coef in G]
# If f is not invertible, a ZeroDivisionError is raised
# If the NTRU equation cannot be solved, a ValueError is raised
# In both cases, we start again
except (ZeroDivisionError, ValueError):
continue
def module_ntru_gen(d, q, m):
"""
Take as input system parameters, and output two "module-NTRU" matrices A and B such that:
- B * A = 0 [mod q]
- B has small polynomials
- A is in Hermite normal form
Also compute the inverse of B (over the field K = Q[x] / (x ** d + 1)).
Input:
d The degree of the underlying ring R = Z[x] / (x ** d + 1)
q An integer
m An integer
Output:
A A matrix in R ^ ((m + 1) x 1)
B A matrix in R ^ ((m + 1) x (m + 1))
inv_B A matrix in K ^ ((m + 1) x (m + 1))
sq_gs_norm A real number, the square of the Gram-Schmidt norm of B
Format: Coefficient
"""
if m == 1:
magic_constant = [1.15]
gs_slack = 1.17
elif m == 2:
magic_constant = [1.07, 1.14]
gs_slack = 1.17
elif m == 3:
magic_constant = [1.21, 1.10, 1.06]
gs_slack = 1.24
else:
print("No parameters implemented yet for m = {m}".format(m=m))
return
max_gs_norm = gs_slack * (q ** (1 / (m + 1)))
while True:
# We generate all rows of B except the last
B = [[None for j in range(m + 1)] for i in range(m + 1)]
for i in range(m):
for j in range(m + 1):
# Each coefficient B[i][j] is a polynomial
sigma = magic_constant[i] * (q ** (1 / (m + 1))) # ==> ||bi~|| = gs_slack * q^(1/(m+1))
sig = sqrt(1 / (d * (m + 1 - i))) * sigma # sig = stdv. dev. des coef de bi
B[i][j] = [int(round(gauss(0, sig))) for k in range(d)]
# We check that the GS norm is not larger than tolerated
Bp_fft = [[fft(poly) for poly in row] for row in B[:-1]]
Gp = gram_fft(Bp_fft)
[Lp_fft, Dp_fft] = ldl_fft(Gp)
Dp = [[[0] * d for col in range(m)] for row in range(m)]
for i in range(m):
Dp[i][i] = ifft(Dp_fft[i][i])
prod_di = [1] + [0] * (d - 1)
for i in range(m):
prod_di = mul(prod_di, Dp[i][i])
last = div([q ** 2] + [0] * (d - 1), prod_di)
norms = [Dp[i][i][0] for i in range(m)] + [last[0]]
# If the GS norm is too large, restart
if sqrt(max(norms)) > max_gs_norm:
continue
# Try to solve the module-NTRU equation
f = submatrix(B, m, 0)
f = [[neg(elt) for elt in row] for row in f]
g = [B[j][0] for j in range(m)]
fp = my_det(f)
adjf = my_adjugate(f)
gp = [0] * d
for i in range(m):
gp = add(gp, karamul(adjf[0][i], g[i]))
try:
# Compute f^(-1) mod q
fp_q = [elt % q for elt in fp]
inv_f = [[elt[:] for elt in row] for row in adjf]
for i in range(m):
for j in range(m):
inv_f[i][j] = [elt % q for elt in inv_f[i][j]]
inv_f[i][j] = div_zq(inv_f[i][j], fp_q, q)
# Compute h = f^(-1) * g mod q and A = [1 | h]
h = [None] * m
for i in range(m):
elt = [0] * d
for j in range(m):
elt = add_zq(elt, mul_zq(inv_f[i][j], g[j], q), q)
h[i] = elt
one = [1] + [0 for _ in range(1, d)]
A = [one] + h
Fp, Gp = ntru_solve(fp, gp, q)
B[m][0] = Gp
B[m][1] = [- coef for coef in Fp]
for i in range(2, m + 1):
B[m][i] = [0 for _ in range(d)]
# Compute the inverse of B
det_B = my_det(B)
inv_B = my_adjugate(B)
inv_B = [[div(poly, det_B) for poly in row] for row in inv_B]
return A, B, inv_B, max(norms)
# If any step failed, restart
except (ZeroDivisionError, ValueError):
continue
