I downloaded the 1st-round NTRUEncrypt submission from NIST website, the spec mentions the mask generation function MGF1 in ASN.1 definition but not in algorithm description.

Does the EESS#1 NTRUEncrypt use the MGF1 specified in PKCS#1 at all?

  • $\begingroup$ The more I read it, the more I get convinced that it is a copy / paste issue, as XOF either SHAKE or AES in counter mode is used. $\endgroup$
    – Maarten Bodewes
    Commented Jul 30, 2021 at 22:21


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.