How does NTRUEncrypt cope with SPA-based attacks?
[Glossary: SPA = Simple Power Analysis; DPA = Differential Power Analysis; both are ways of extracting cryptographic data from a device by measuring the power it consumes. The difference between SPA and DPA is that DPA, which is by and large more powerful, averages results over a large number of runs.] The core NTRU convolution is relatively easy to blind against SPA attacks. The operations are simply adds and reductions modulo a power of two. We would be happy to collaborate with interested device vendors on constructing an NTRU implementation that is entirely immune to SPA attacks. Full NTRU encryption requires the use of a hash function, typically SHA-1. This would need to be blinded against DPA and SPA to protect individual messages. It does not seem, however, that an SPA-based attack on the hash algorithm would endanger the private key.
