org.bouncycastle.pqc.crypto.test

Class NTRUPlusTest

java.lang.Object

junit.framework.Assert

junit.framework.TestCase

org.bouncycastle.pqc.crypto.test.NTRUPlusTest

All Implemented Interfaces:

junit.framework.Test

public class NTRUPlusTest
extends junit.framework.TestCase

Constructor Summary

Constructors

Constructor and Description
NTRUPlusTest()

Method Summary

Modifier and Type	Method and Description
static void	main(java.lang.String[] args)
void	testRejectedEncapsulation() NTRU+ rejects explicitly: an encapsulation that does not re-encrypt has no secret, so extractSecret must refuse it rather than return one.
void	testTestVectors()

Methods inherited from class junit.framework.TestCase

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, countTestCases, createResult, fail, fail, failNotEquals, failNotSame, failSame, format, getName, run, run, runBare, runTest, setName, setUp, tearDown, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

NTRUPlusTest

public NTRUPlusTest()

Method Detail

main

public static void main(java.lang.String[] args)
                 throws java.lang.Exception

Throws:

java.lang.Exception

testTestVectors

public void testTestVectors()
                     throws java.lang.Exception

Throws:

java.lang.Exception

testRejectedEncapsulation

public void testRejectedEncapsulation()

NTRU+ rejects explicitly: an encapsulation that does not re-encrypt has no secret, so extractSecret must refuse it rather than return one. It used to return a secret of all zero bytes, the same for every rejected encapsulation, and when the message decoding failed it returned the real K' with only the low bit of each byte cleared - either way telling an attacker whether, or to what, a chosen ciphertext decrypts.

The perturbations add +-1 to one packed NTT coefficient, mod q, so each tampered ciphertext is still canonical and goes through decryption rather than the encoding check.