DTRU
Lattices · NTRU/RLWE · niccs.org.cn(opens in a new tab)
- Programmes
- NGCC R1
- Status
- NGCC round 1
- Security flags
- Implementation findings (all sets)
Third-party findings: full report on ngcc.dev(opens in a new tab).
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| DTRU-648 Recommended Implementation findings | 128-bit | 972 | 729 | 1,701 | 78.4 µs | 42.0 µs | 82.7 µs |
| DTRU-Light Implementation findings | 128-bit | 640 | 512 | 1,152 | 29.0 µs | 24.9 µs | 48.5 µs |
| DTRU-1024 Recommended Implementation findings | 256-bit | 1,536 | 1,280 | 2,816 | 84.8 µs | 57.0 µs | 111.8 µs |
| DTRU-Prime Implementation findings | 256-bit | 1,495 | 1,359 | 2,854 | 3.59 ms | 42.5 µs | 88.9 µs |
| DTRU-1536 Recommended Implementation findings | 384-bit | 2,304 | 1,920 | 4,224 | 104.7 µs | 94.3 µs | 180.3 µs |
| DTRU-2048 Recommended Implementation findings | 512-bit | 3,072 | 2,560 | 5,632 | 193.8 µs | 126.9 µs | 244.4 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Implementation findings (all parameter sets): A caller-supplied ciphertext length overflows a stack buffer in the submitted decapsulation (Saarinen). Full findings report(opens in a new tab)
History
- added to site Update
Where a specification lists alternative or additional parameter sets next to its main ones, the main sets are now marked, so the Recommended filter hides the alternatives: SNOVA, MAYO, QR-UOV, SQIsign and FAEST (FAEST-EM is the specification's alternative variant), and the NGCC KEMs DTRU (DTRU-Light and DTRU-Prime are the alternatives to the primary tricyclotomic sets) and MAMBA-Frost (the compact-ciphertext CC variants are additional to the default sets). The round-3 specifications of SNOVA (Table 6), MAYO (Table 2.2), QR-UOV (Appendix B) and SQIsign (Appendix P) also list alternative or additional parameter sets; these are now shown under All parameter sets, with sizes from the specifications. The six odd-characteristic SNOVA alternatives are marked broken by Beullens & Hess's vinegar-bias attack.