What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation?
Round 1 - NTRU Encrypt, NTRU-HRSS-KEM, NTRU Prime
Round 2 - NTRU (Merger of NTRU Encrypt and NTRU-HRSS-KEM), NTRU Prime
For example, NTRU Encrypt in round 1 uses NAEP padding as compared to HPS98.
Paper by Schnack on "Comparison of NTRU Variants" talks more about the size/security rather than implementation itself. What other differences are there between HPS98 and the different NTRU Candidates?
