What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation?

Round 1 - NTRU Encrypt, NTRU-HRSS-KEM, NTRU Prime

Round 2 - NTRU (Merger of NTRU Encrypt and NTRU-HRSS-KEM), NTRU Prime

For example, NTRU Encrypt in round 1 uses NAEP padding as compared to HPS98.

Paper by Schnack on "Comparison of NTRU Variants" talks more about the size/security rather than implementation itself. What other differences are there between HPS98 and the different NTRU Candidates?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.