Title: Estimated Breaking times for Ntru Lattices

In this note we report on experiments with the lattices underlying the NTRU Public Key Cryptosystem. We present data for the time needed to nd a small vector and use this data to extrapolate expected breaking times for the NTRU PKCS for various parameter values. In particular, we nd that NTRU 167, NTRU 263, and NTRU 503 are at least as secure as RSA 512, RSA 1024, and RSA 2048 respectively. In this note we report on experiments with the lattices underlying the NTRU Public Key Cryptosystem. These experiments extend those described in 1]. We will concentrate entirely on the underlying lattices. For details of the NTRU public key cryptosystem, see 1]. x1. The Standard NTRU Lattice. Fix integers N, d f , and d g. (See Table 1 below for typical values of these parameters .) Let S d be the set of N-tuples with d coordinates equal to each of 1 and ?1 and with the remaining N ? 2d coordinates equal to 0. Similarly, let S 0 d be the set of N-tuples with d coordinates equal to 1, with d ? 1 coordinates equal to ?1, and with the remaining N ? 2d + 1 coordinates equal to 0. The Standard NTRU Lattice L NT is the lattice of dimension 2N generated by the row vectors of a matrix of the following form, where (h 0 ; : : :; h N?1) is a known list of integers: