Most PQC schemes remain too resource-intensive for ultra-constrained 8-bit AVR wireless sensor nodes. In this work, we present a comprehensive approach to practical lightweight PQC for such devices, covering scheme design, implementation optimization, and protocol integration. Our contributions are threefold: (i) We propose CTRU-Light, a lattice-based KEM specifically tailored for IoT sensor nodes. It combines small moduli, low-degree polynomials, and NTT-friendly arithmetic for high efficiency, with ASCON used for lightweight symmetric operations. (ii) We explore NTT-friendly moduli for the first time to accelerate modular multiplication on 8-bit AVR platforms and design optimized variants of Montgomery and Barrett multiplication. We show that K-RED2X multiplication exhibits approximate equivalence to Montgomery multiplication under small NTT-friendly moduli. We apply these optimizations to the latest implementations of Kyber (ASIACCS 2025) and Saber (CHES 2025), achieving significant improvements in both speed and code size. Furthermore, we present a highly optimized AVR assembly implementation of CTRU-Light that delivers high efficiency and low stack usage. (iii) We design a Hybrid KEM–MQTT protocol that integrates classical ECDH with post-quantum KEMs. We present the first implementation of this protocol and provide a detailed empirical analysis of its performance. Experiments show that CTRU-Light is the only scheme capable of supporting both pure PQ and hybrid KEM–MQTT on 8-bit WSNs, achieving lower handshake latency than Kyber-512 and LightSaber.

In this work, we make systematic optimizations of key encapsulation mechanisms based on Module Learning-with-Errors, covering algorithmic design, fundamental operation of the Number Theoretic Transform (NTT), approaches to expanding the encapsulated key size, and AVX2/ARM implementations. We observe that decryption can be simplified, leading to a both faster and less error-prone decryption process. Based on a systematic study of variants of NTT, we present a new variant named hybrid-NTT that combines the advantages of existing NTT methods, and derive its optimality in computational complexity. We analyze and compare the different approaches to expand the size of the key to be encapsulated and conclude with the most economic approach. Each above optimization technique is of independent value, and we apply all of them to KYBER and Aigis, resulting in new scheme variants named OSKR and OKAI, respectively. For all new schemes proposed in this work, we provide optimized AVX2 and ARM Cortex-M4 implementations and present the performance benchmarks. Our AVX2 implementation provides up to 19.7% and 26.4% speedups compared with KYBER and Aigis, respectively. Meanwhile, with our new parameter set and optimization techniques, we show up to a 17% improvement compared with KYBER on the ARM Cortex-M4 platform.

The advent of quantum computers poses a significant threat to existing cryptographic systems, thereby affecting the confidentiality and integrity of communications. Among various post-quantum cryptographic schemes, those based on NTRU lattices have achieved considerable success. For example, NTRU-Prime has been implemented in network security protocols such as OpenSSH and OpenBSD, becoming a de facto standard. However, traditional NTRU key encapsulation mechanisms still suffer from poor computational efficiency, inability to compress ciphertexts, and a narrow range of secret values. To address these challenges, an optimization of NTRU-Prime–FPTRU (Fast Prime NTRU) constructed on LPPNF (large-Galois-group prime-degree prime-ideal number field) is presented. It provides enhanced security assurances and support for lossy compression of ciphertexts. Pseudo-Mersenne reduction and pseudo-Mersenne incomplete NTT are used to accelerate polynomial multiplication in LPPNF. Considering the situation of batch key generation in practical applications, we apply Montgomery inversion to key generation of FPTRU and explore the optimal batch size. With a batch size of 32, FPTRU-761 achieves a 4.7 × efficiency improvement over serial key generation and an 80.7 × improvement over SNTRU-Prime-761 batch key generation. FPTRU-653 matches the classical and quantum security of SNTRU-Prime-761. Integrated into OpenSSL, FPTRU-653 outperforms SNTRU-Prime-761 in various network conditions. For example, with 15.458 ms latency and 15% packet loss, FPTRU-653 completes 1.2 × more handshakes than SNTRU-Prime-761.

In this paper, we propose GSR-NTT and demonstrate that K-NTT, H-NTT, and G3-NTT are specific instances of GSR-NTT. We introduce a succinct methodology for complexity analysis, and utilize our GSR-NTT to accelerate polynomial multiplications in NTTRU and power-of-three cyclotomic rings.

The NTRU lattice is a promising candidate to construct practical cryptosystems, in particular key encapsulation mechanism (KEM), resistant to quantum computing attacks. Nevertheless, there are still some inherent obstacles to NTRU-based KEM schemes when considering integrated performance, taking security, bandwidth, error probability, and computational efficiency as a whole, that is as good as and even better than their {R,M}LWE-based counterparts. In this work, we address the challenges by presenting a new family of NTRU-based KEM schemes, denoted as CTRU and CNTR. By bridging low-dimensional lattice codes and high-dimensional NTRU-lattice-based cryptography with careful design and analysis, to the best of our knowledge, CTRU and CNTR are the first NTRU-based KEM schemes featuring scalable ciphertext compression via only one single ciphertext polynomial, and are the first that can outperform {R,M}LWE-based KEM schemes in terms of integrated performance. For instance, when compared to Kyber, the only KEM scheme currently standardized by NIST, our recommended parameter set CNTR-768 exhibits approximately 12% smaller ciphertext size, when its security is strengthened by (8,7) bits for classical and quantum security respectively, with a significantly lower error probability (2−230 for CNTR-768 vs. 2−164 for Kyber-768). In terms of the state-of-the-art AVX2 implementation of Kyber-768, CNTR-768,achieves a speedup of 2.7X in KeyGen, 3.3X in Encaps, and 1.6X in Decaps, respectively. When compared to the NIST Round 3 finalist NTRU-HRSS, CNTR-768,features 15% smaller ciphertext size, coupled with an improvement of (55,49) bits for classical and quantum security respectively. As for the AVX2 implementation, CNTR-768,outperforms NTRU-HRSS by 26X in KeyGen, 3.0X in Encaps, and 2.2X in Decaps, respectively. Along the way, we develop new techniques for more accurate error probability analysis, and a unified number theoretic transform (NTT) implementation for multiple parameter sets, which may be of independent interest.

In order to resist the security risks caused by quantum computing, post-quantum cryptography (PQC) has been a research focus. Constructing a key encapsulation mechanism (KEM) based on lattices is one of the promising PQC routines. The algebraically structured learning with errors (LWE) problem over power-of-two cyclotomics has been one of the most widely used hardness assumptions for lattice-based cryptographic schemes. However, power-of-two cyclotomic rings may be exploited in the inflexibility of selecting parameters. Recently, trinomial cyclotomic rings of the form Zq[x]/(xn−xn/2+1), where n=2k3l, k≥1,l≥0, have received widespread attention due to their flexible parameter selection. In this paper, we propose Tyber, a variant scheme of the NIST-standardized KEM candidate Kyber over trinomial cyclotomic rings. We provide three parameter sets, aiming at the quantum security of 128, 192, and 256 bits (actually achieving 129, 197, and 276 bits) with matching and negligible error probabilities. When compared to Kyber, our Tyber exhibits stronger quantum security, by 22, 31, and 44 bits, than Kyber for three security levels.

量子计算机的发展对现有公钥体系的影响是实质性的.在众多后量子密码流派中,格基密码方案因其安全性、高效性等优良特点而成为了主流技术路线.密码算法在各实现平台的运行效率是后量子算法评估进程中的重要指标.FPGA(Field Programmable Gate Array)具有并行性架构,是密码体系实际部署时的重要硬件平台.近年来,后量子算法的硬件优化实现研究吸引了越来越多的关注.针对格基密码算法中计算复杂度最高、耗时最长的操作——环上多项式乘法计算,本文对主流的加速技术——数论变换技术(Number-Theoretic Transform,NTT)进行了系统研究,根据参数不同将其分为标准NTT(Standard-NTT,SNTT)、删减NTT(Truncated-NTT,TNTT)、混合NTT(Hybrid-NTT,HNTT).为了提高适用性,设计了一种统一型、可常数时间执行、支持多参数的硬件电路,支持三种NTT架构,结合Karatsuba技巧,将对应系数相乘中乘法次数减少20%.针对NTT的核心操作——蝴蝶变换,设计了一种紧凑型、低时延的电路结构,可实现正向NTT、对应系数相乘、逆向NTT功能,同时支持Cooley-Tukey和Gentleman-Sande两种结构;提出一种新的系数访存模式,采用"交叉存储型"结构,使用双口BRAM将计算后的系数"对角交叉"变换位置后存储在原地址,利用双Bank存储模式满足蝴蝶变换单元的数据吞吐量;对Bar-rett约减算法进行修改,提出一种适用于多模值的模约减硬件单元,用加法和移位代替其中的乘法操作,减少乘法器资源的消耗.本方案使用Verilog HDL语言在Xilinx公司Artix-7系列XC7A200TFBG484-2型号FPGA芯片上进行了纯硬件优化实现.与当前研究相比,本设计在面积上减少12%-62.6%,时间上提升5.5%-49.8%.此外,我们还对高吞吐量的并行设计进行了优化实现,优化后的二并行、四并行架构时间上分别加速两倍、四倍,面积消耗仅为单结构的1.45倍、2.58倍.

Number theoretic transform (NTT) is the most efficient method for multiplying two polynomials of high degree with integer coefficients, due to its series of advantages in terms of algorithm and implementation, and is consequently widely-used and particularly fundamental in the practical implementations of lattice-based cryptographic schemes. Especially, recent works have shown that NTT can be utilized in those schemes without NTT-friendly rings, and can outperform other multiplication algorithms. In this paper, we first review the basic concepts of polynomial multiplication, convolution and NTT. Subsequently, we systematically introduce basic radix-2 fast NTT algorithms in an algebraic way via Chinese Remainder Theorem. And then, we elaborate recent advances about the methods to weaken restrictions on parameter conditions of NTT. Furthermore, we systematically introduce how to choose appropriate strategy of NTT algorithms for the various given rings. Later, we introduce the applications of NTT in the lattice-based cryptographic schemes of NIST post-quantum cryptography standardization competition. Finally, we try to present some possible future research directions.

格密码因其在安全性、密文尺寸和计算效率等方面性能均衡,同时具有构造简单和通用性强等优点,被认为是最有前景的后量子密码技术路线之一.基于模格MLWR的Saber密钥封装方案是NIST后量子密码标准征集第三轮公布的七个决赛算法之一,对Saber方案的优化和高效实现有重要的现实意义.本文针对Saber通过大量测试提出一组新参数,所提出的新参数可以在安全强度、错误率和带宽方面取得更好的平衡.为了提升实现效率,我们将数论变换(NTT)和显式中国剩余定理(CRT)应用于其中基础且耗时的多项式乘法,并根据新参数(向量维数、多项式维度、模数和中心二项分布参数)的具体取值,最终选取两个NTT友好素数:q1=7681和q2=3329.接下来,本文基于256位高级向量扩展(AVX2)对Saber新参数的关键模块进行了较为系统的实现和优化,包括:约减模块、多项式运算模块、中心二项分布模块、私钥序列化模块、并行压缩模块以及并行编码/解码模块等.性能测试结果表明,本文在多项式乘法模块相比于目前存在的Saber实现算法性能平均提升约37％.相比于Saber Round3的AVX2实现,我们密钥生成算法性能提升约21％,密钥封装算法提升约23％,密钥解封装算法提升约23％.本文工作对后量子密码算法的优化和实际应用具有现实意义.

Post-quantum cryptography (PQC) is critical to the next generation of network security. The NTRU lattice is a promising candidate to construct practical cryptosystems resistant to quantum computing attacks, and particularly plays a leading role in the ongoing NIST post-quantum cryptography standardization. On the one hand, it is benefited from a strong security guarantee since it has essentially not been broken over 24 years. On the other hand, all the known patent threats against NTRU have expired, which is deemed a critical factor for consideration when deploying PQC algorithms in reality. Nevertheless, there are still some obstacles to the computational efficiency and bandwidth complexity of NTRU-based constructions of key encapsulation mechanisms (KEM). To address these issues, we propose a compact and efficient KEM based on the NTRU lattice, called CTRU, by introducing a scalable ciphertext compression technique. It demonstrates a new approach to decrypting NTRU ciphertext, where the plaintext message is recovered with the aid of our decoding algorithm in the scalable E 8 lattice (instead of eliminating the extra terms modulo 𝑝 in traditional NTRU-based KEM schemes). The instantiation of CTRU is over the NTT-friendly rings of the form Z 𝑞 [ 𝑥 ]/( 𝑥 𝑛 − 𝑥 𝑛 / 2 + 1 ) . We remark that the scalable ciphertext compression technique can also be applied to NTRU-based KEM schemes over other polynomial rings. In order to deal with the inconvenient issue that various NTT algorithms are needed for different 𝑛 ’s, we present a unified NTT methodology over Z 𝑞 [ 𝑥 ]/( 𝑥 𝑛 − 𝑥 𝑛 / 2 + 1 ) , 𝑛 ∈ { 512 , 768 , 1024 } , such that only one type of NTT computation is required for different 𝑛 ’s,

In this work, we make \emph{systematic} optimizations of key encapsulation mechanisms (KEM) based on module learning-with-errors (MLWE), covering algorithmic design, fundamental operation of number-theoretic transform (NTT), approaches to expanding encapsulated key size, and optimized implementation coding. We focus on Kyber (now in the Round-3 finalist of NIST PQC standardization) and Aigis (a variant of Kyber proposed at PKC 2020). By careful analysis, we first observe that the algorithmic design of Kyber and Aigis can be optimized by the mechanism of asymmetric key consensus with noise (AKCN) proposed in \cite{JZ16,JZ19}. Specifically, the decryption process can be simplified with AKCN, leading to a both faster and less error-prone decryption process. Moreover, the AKCN-based optimized version has perfect compatibility with the deployment of Kyber/Aigis in reality, as they can run on the same parameters, the same public key, and the same encryption process. We make a systematic study of the variants of NTT proposed in recent years for extending its applicability scope, make concrete analysis of their exact computational complexity, and in particular show their equivalence. We then present a new variant named hybrid-NTT (H-NTT), combining the advantages of existing NTT methods, and derive its optimality in computational complexity. The H-NTT technique not only has larger applicability scope but also allows for modular and unified implementation codes of NTT operations even with varying module dimensions. We analyze and compare the different approaches to expand the size of key to be encapsulated (specifically, 512-bit key for dimension of 1024), and conclude with the most economic approach. To mitigate the compatibility issue in implementations we adopt the proposed H-NTT method.

Number theoretic transform (NTT) is a basic mathematic operation, and is particularly fundamental to the practical implementations of cryptographic algorithms based on lattices with algebraic structures. In this work, we make a systematic and comprehensive study of NTT and its variants. We first review the NTT technique and the recent advances raised in the implementations of practical lattice-based cryptography. We clarify the relationship of some existing NTT variants, and prove their computational equivalence. We then make the generalizations of NTT, analyze their exact computational complexity, and derive the optimal bounds. Finally, we show the applications of our results to some prominent practical lattice-based algorithms.