Reaction attacks in the matrix scheme of NTRU cryptosystem

Abstract

An attacker produces a sequence of encrypted messages E, each of which has a distinct probability, however small, of decrypting into a valid message and also a probability of decrypting into an invalid message. The smallest modification that an attacker can make to the cipher-text and can still decrypt it correctly, gives information about the private key used to encrypt the message. In this paper we assume that the attacker knows or the gets hold of intermediate text which arises during the process of decryption. © 2011 Springer-Verlag.