---
title: 'NTRU-GKP Cryptosystem: Quantum-Resilient Encryption'
url: https://www.emergentmind.com/topics/ntru-gkp-cryptosystem
type: topic
---

# NTRU-GKP Cryptosystem: Quantum-Resilient Encryption

The NTRU-GKP cryptosystem is a public-key quantum communication protocol that merges the security of the NTRU cryptosystem with the bosonic quantum error correction capabilities of Gottesman-Kitaev-Preskill (GKP) codes. This construction establishes a direct equivalence between syndrome decoding in a class of GKP codes and decrypting the NTRU cryptosystem, thereby linking quantum error correction with post-quantum cryptography. The NTRU-GKP codes achieve constant rate and average minimum distance scaling as $\Delta \propto \sqrt{n}$ with high probability, paralleling the optimal scaling of concatenated GKP qubit codes. Every random instance of an NTRU-GKP code features an efficient decoder derived from the NTRU trapdoor, with public-key security inherited from the computational hardness conjectures underlying NTRU [2303.02432].

## 1. Code Construction and Formal Specification

The NTRU-GKP cryptosystem is parameterized by the ring/lattice dimension $n$, modulus polynomials $\Phi(x)$ (typically $x^n - 1$ or $x^n + 1$), a large modulus $q$, a small plaintext modulus $p \ll q$, and trapdoor weight $d \approx n/3$. The construction begins in the ring $R = \mathbb{Z}[x]/\Phi(x)$.

**Key Generation:**
- Sample "small" polynomials $\tilde{f}, \tilde{g} \leftarrow D(d, d)$ in $R$ with $d$ coefficients $+1$, $d$ coefficients $-1$.
- Form secret key polynomials as $f = 1 + p \cdot \tilde{f}\in R_q^\times$, $g = p \cdot \tilde{g} \in R_q$, ensuring $f \equiv 1 \pmod{p}$ and $g \equiv 0 \pmod{p}$.
- Compute the public key $h = g f^{-1}$ in $R_q$.

**Lattice Embedding:**
Define the circulant embedding $C: R \rightarrow \mathbb{Z}^{n \times n}$, mapping $f$ to its circulant matrix. The public NTRU lattice in $\mathbb{Z}^{2n}$ is generated by
\[
H_{\mathrm{pub}} = \begin{pmatrix} I_n & C(h) \\ 0 & qI_n \end{pmatrix}
\]
with $\det H_{\mathrm{pub}} = q^n$. The set of short vectors in this lattice encodes the NTRU secret.

**Symplectic (GKP) Basis and Code Lattice:**
A $q$-symplectic generator $M$ (i.e., $MJM^T = qJ$ for $J = \begin{pmatrix}0 & I_n \\ -I_n & 0\end{pmatrix}$) is constructed by rotating the public basis:
\[
H = \begin{pmatrix}
    I_n & A(h) \\
    0 & q I_n
\end{pmatrix}, \quad A(h) = C(h) R_n
\]
where $R_n$ is the anti-diagonal permutation. Choosing an integer scaling $\lambda$ (often $\lambda=2$), the GKP code lattice is
\[
M_{\mathrm{GKP}} = \sqrt{\frac{\lambda}{q}} H
\]
and its stabilizer group is generated by the $2n$ displacement operators corresponding to the rows of $M_{\mathrm{GKP}}$.

## 2. Encoding, Quantum Encryption, and Decoding

**Encoding (Quantum Encryption):**
A logical GKP code state $|\bar{\psi}\rangle$ is any simultaneous $+1$ eigenstate of the code's stabilizer operators. To encrypt $|\bar{\psi}\rangle$ under Gaussian shift noise, a sender selects random elements $m, r \in R_p$ and applies the displacement
\[
D\left(e_0\right), \quad e_0 = \frac{1}{\sqrt{\lambda q}}(-r,\, m)
\]
The resulting displacement, in $Z/X$ split, yields $q s_1 = m + A(h) r$, which precisely corresponds to NTRU encryption in syndrome form. The displaced codeword $D(e_0)|\bar{\psi}\rangle$ is transmitted.

**Decoding (Quantum Decryption):**
The receiver measures the $2n$ stabilizers, correcting the trivial hypercubic GKP syndrome, and computes the residual error syndrome
\[
s = \frac{1}{q} (v - A(h) u)
\]
where the phase-space shift is $e = (u / \sqrt{\lambda q}, v / \sqrt{\lambda q})$. Standard NTRU decryption recovers $(u, v) \mod q$ as $(r, m)$:
\[
c := q s_1 = v - A(h) u \mod q, \quad u = \mathrm{decrypt}_{\mathrm{NTRU}}(h, c) \Leftrightarrow r
\]
The correct shift $e_0$ is subtracted, returning to the code space.

## 3. Code Parameters and ‘Goodness’

\[
\begin{aligned}
\text{Ring/lattice dimension} & : n \text{ modes} \\
\text{Public modulus} & : q \\
\text{Sublattice} & : \lambda q \mathbb{Z}^{2n} \\
\text{Scaling parameter} & : \lambda \\
\text{Code rate} & : R = \log_2 \lambda \\
\text{Dimension of code space} & : D = \lambda^n \\
\text{Minimum distance} & : \Delta = \frac{\lambda_1(L_{\mathrm{NTRU}})}{\sqrt{\lambda q}}
\end{aligned}
\]

For $\lambda = 2$, $q = \mathcal{O}(n)$, and trapdoor weight $d = \lfloor n/3 \rfloor$, a random NTRU lattice yields a GKP code with $k=n$ encoded qubits and $\Delta \propto \sqrt{n}$, matching the scaling of "good" codes [2303.02432]. Proposition 1 asserts
\[
\Delta = \min\left\{\sqrt{\frac{0.14 n}{q}},\,\sqrt{\frac{q}{2}}\right\}
\]
for random NTRU lattices, ensuring distance-optimality for $q \sim n$. The code achieves constant rate and optimal distance scaling, satisfying the definition of a "good" GKP code.

## 4. Decoding and Computational Hardness

Minimum-energy decoding (MED) for GKP codes reduces to the closest vector problem (CVP) on the dual stabilizer lattice, which, in the NTRU-GKP setting, is the secret NTRU lattice:
\[
\Lambda_{f,g} = \{ (f \star a + q \star b,\; g \star a) : a, b \in \mathbb{Z}[x]/\Phi \}
\]
Bounded-distance decoding (BDD) with a trapdoor (the secret key) is efficiently solved via Babai’s nearest-plane method. Without the trapdoor, BDD is as hard as NTRU decryption—inverting the public key $h$—which underpins the post-quantum security of the cryptosystem. Lemma (eMLD $\geq$ MED): access to the theta-function-based maximum likelihood decoder for GKP codes decodes CVP exactly. Thus, decoding under Gaussian noise is computationally equivalent to NTRU decryption, and decoding GKP codes under this construction is generally $\# P$-hard [2303.02432].

## 5. Public-Key Quantum Communication Protocol

The protocol yields a "quantum one-time pad" realized in a public-key setting:
1. The recipient generates $(h; f, g)$, publishes $h$, keeps $(f, g)$ secret.
2. The sender prepares a GKP code state $|\bar{\psi}(h)\rangle$, samples random NTRU encryption $(r, m)$, applies $D(e_0)$ with $e_0 = (-r, m)/\sqrt{\lambda q}$, and transmits $D(e_0)|\bar{\psi}\rangle$.
3. The recipient measures syndromes and decodes using $(f, g)$, undoing $D(e_0)$ to recover $|\bar{\psi}\rangle$.

Any eavesdropper must solve NTRU decoding or CVP on $\Lambda_{f,g}$ to remove the encryption displacement, which is infeasible under the average-case hardness assumption for NTRU (including average-case hardness of factoring $h$, ring-LWE in cyclotomics, and quantum hardness of CVP).

## 6. Theoretical Results and Security Reductions

- **Proposition 1 (Goodness of NTRU–GKP):** For $\lambda = 2$, $d = \lfloor n/3 \rfloor$, $q = O(n)$, random NTRU lattices yield a GKP code with $k=n$, achieving $\Delta = \min\{\sqrt{0.14\,n/q}, \sqrt{q/2}\}$—thus, $\Delta \propto \sqrt{n}$ for $q \sim n$.
- **Conjecture 2–3:** Random public keys $h \in R_q$ produce good GKP codes with high probability, for both $\Phi = x^n-1$ and $\Phi = x^n+1$ (Stehlé-Steinfeld variant).
- **Lemmas:** MED, eMLD, and CVP decoding for GKP are computationally equivalent; decoding the Construction-A GKP code is equivalent to decoding the underlying qubit code.

The construction embeds the trapdoor-hardness of NTRU polynomial factorization and public-key structure directly into the phase-space lattice of a GKP code. This provides a unified framework for bosonic quantum error correction and post-quantum cryptography, with a public-key quantum channel whose security derives from quantum-hard NTRU assumptions [2303.02432].

Source: https://www.emergentmind.com/topics/ntru-gkp-cryptosystem