org.bouncycastle.pqc.crypto.test
Class NTRUPlusTest

java.lang.Object
  junit.framework.Assert
      junit.framework.TestCase
          org.bouncycastle.pqc.crypto.test.NTRUPlusTest

All Implemented Interfaces:

junit.framework.Test

public class NTRUPlusTest

extends junit.framework.TestCase

Constructor Summary

NTRUPlusTest()

Method Summary

static void	main(java.lang.String[] args)
void	testRejectedEncapsulation() NTRU+ rejects explicitly: an encapsulation that does not re-encrypt has no secret, so extractSecret must refuse it rather than return one.
void	testTestVectors()

Methods inherited from class junit.framework.TestCase

countTestCases, createResult, getName, run, run, runBare, runTest, setName, setUp, tearDown, toString

Methods inherited from class junit.framework.Assert

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

NTRUPlusTest

public NTRUPlusTest()

Method Detail

main

public static void main(java.lang.String[] args)
                 throws java.lang.Exception

Throws:

java.lang.Exception

testTestVectors

public void testTestVectors()
                     throws java.lang.Exception

Throws:

java.lang.Exception

testRejectedEncapsulation

public void testRejectedEncapsulation()

NTRU+ rejects explicitly: an encapsulation that does not re-encrypt has no secret, so extractSecret must refuse it rather than return one. It used to return a secret of all zero bytes, the same for every rejected encapsulation, and when the message decoding failed it returned the real K' with only the low bit of each byte cleared - either way telling an attacker whether, or to what, a chosen ciphertext decrypts.

The perturbations add +-1 to one packed NTT coefficient, mod q, so each tampered ciphertext is still canonical and goes through decryption rather than the encoding check.