NTRU+
Lattices · NTRU · ntruplus.org(opens in a new tab)
- Programmes
- KpqC selected
- Status
- KpqC standard
- Security flags
- None on current sets
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| NTRU+768 Note | 1 | 1,152 | 1,152 | 2,304 | 7.4 µs | 9.2 µs | 6.3 µs |
| NTRU+864 Note | 3 | 1,296 | 1,296 | 2,592 | 8.1 µs | 10.5 µs | 7.5 µs |
| NTRU+1152 Note | 5 | 1,728 | 1,728 | 3,456 | 11.8 µs | 13.2 µs | 9.2 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Note (all parameter sets): NTT-friendly NTRU variant (Kim, Park) selected as a final algorithm in Korea's KpqC competition. Uses a new ACWC2+FO⊥ transform chain that avoids re-encryption during decapsulation, unlike most FO-transformed KEMs. Public key and ciphertext are the same size.
History
- Update
Added NTRU+ (finalist algorithm selected in Korea's KpqC competition) to the KEMs comparison page, with benchmarked keygen/encaps/decaps timings for NTRU+768, NTRU+864, and NTRU+1152.
- added to site Milestone
KpqC announced its final algorithms: AIMer and HAETAE (signatures), NTRU+ and SMAUG-T (KEMs). AIMer was then at v2.1.