An Algorithm for NTRU Problems and Cryptanalysis of the GGH Multilinear Map without an encoding of zero

Let h and g be polynomials of bounded Euclidean norm in the ring Z[X]/⟨X+1⟩. Given polynomial [h/g]q ∈ Zq[X]/⟨X+1⟩, the NTRU problem is to find a, b ∈ Z[X]/⟨X + 1⟩ with small Euclidean norm such that [a/b]q = [h/g]q. We propose an algorithm to solve the NTRU problem which runs in 2 2 q) time when ∥g∥, ∥h∥ and ∥g−1∥ are in some range. The main technique of our algorithm is to reduce a problem on a field to one in a subfield. Recently, the GGH scheme, the first candidate of a (approximate) multilinear map, was known to be insecure by the Hu-Jia attack using encodings of zero, but no polynomial time attack was known without them. Our algorithm can be directly applied to construct level-0 encodings of zero and so utilized to attack the GGH scheme without encodings of zero in polynomial time of its security parameter.