Polynomial Multiplication in NTRU Prime

Abstract

This paper proposes two different methods to perform NTT-based polynomial multiplication in polynomial rings that do not naturally support such a multiplication. We demonstrate these methods on the NTRU Prime key-encapsulation mechanism (KEM) proposed by Bernstein, Chuengsatiansup, Lange, and Vredendaal, which uses a polynomial ring that is, by design, not amenable to use with NTT. One of our approaches is using Good’s trick and focuses on speed and supporting more than one parameter set with a single implementation. The other approach is using a mixed radix NTT and focuses on the use of smaller multipliers and less memory. On a ARM Cortex-M4 microcontroller, we show that our three NTT-based implementations, one based on Good’s trick and two mixed radix NTTs, provide between 32% and 17% faster polynomial multiplication. For the parameter-set ntrulpr761, this results in between 16% and 9% faster total operations (sum of key generation, encapsulation, and decapsulation) and requires between 15% and 39% less memory than the current state-of-the-art NTRU Prime implementation on this platform, which is using Toom-Cook-based polynomial multiplication.

Faster Kyber and Dilithium on the Cortex-M4

“…It appears that the number-theoretic transforms are cores of all high-speed implementations of lattice-based crypto for the Cortex-M4. It is either prescribed in the specification of Dilithium, Falcon, and Kyber, or maintains to be the fastest polynomial multiplication methods in Saber, NTRU [CHK+21], and NTRU Prime [ACC+20].…”

“…While the techniques are already known, they have so far not been applied to Kyber and Dilithium. This includes (1) the use of Cooley-Tukey butterflies for the inverse NTT of both Kyber and Dilithium previously proposed for Saber in [ACC+21]; (2) the use of floating point registers for caching values in the NTT of Dilithium and Kyber which was first proposed in the context of NTTs for NTRU Prime in [ACC+20]. This allows to merge more layers of the NTT and reduce memory access time for loading twiddle factors; (3) we make use of the "asymmetric multiplication" proposed in [BHK+21] which eliminates some duplicate computation in the base multiplication of Kyber at the cost of extra stack usage; and (4) we use an idea from [CHK+21] to improve the accumulation in the matrix-vector product of Kyber by using a 32-bit accumulator allowing to eliminate some modular reductions at the cost of more stack usage.…”

A Novel JSF-Based Fast Implementation Method for Multiple-Point Multiplication

“…The superiority of safegcd has also provided new solution approaches for other algorithms. In [23], researchers proposed three polynomial multiplication methods based on NTT and implemented them on Cortex-M4 microcontrollers using safegcd. Similarly, researchers [24] have studied public key compression capabilities using safegcd.…”