NTRU Prime
Lattices · NTRU · ntruprime.cr.yp.to(opens in a new tab)
- Programmes
- NIST R3
- Status
- Round-3 alternate
- Security flags
- None on current sets
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| sntrup653 Note | 2 | 994 | 897 | 1,891 | 134.3 µs | 14.3 µs | 16.3 µs |
| sntrup761 Note | 2 | 1,158 | 1,039 | 2,197 | 174.3 µs | 15.8 µs | 17.3 µs |
| sntrup857 Note | 3 | 1,322 | 1,184 | 2,506 | 217.1 µs | 19.0 µs | 22.1 µs |
| sntrup953 Note | 4 | 1,505 | 1,349 | 2,854 | 262.2 µs | 20.0 µs | 22.8 µs |
| sntrup1013 Note | 4 | 1,623 | 1,455 | 3,078 | 310.9 µs | 20.7 µs | 23.4 µs |
| sntrup1277 Note | 5 | 2,067 | 1,847 | 3,914 | 445.7 µs | 27.6 µs | 27.4 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Note (all parameter sets): Streamlined NTRU Prime, a NIST round-3 alternate candidate that uses a large-Galois-group ring to avoid structure relied on by some attacks. Widely deployed (the sntrup761 hybrid is a default in OpenSSH). AVX2 from libntruprime.cr.yp.to. NTRU LPRime is not shown. Security categories follow the team's conservative Core-SVP estimates.
History
No events recorded for this scheme yet.