NTRU+: Compact Construction of NTRU Using Simple Encoding Method

NTRU was the first practical public key encryption scheme constructed on a lattice over a polynomial-based ring and has been considered secure against significant cryptanalytic attacks over the past few decades. However, NTRU and its variants suffer from several drawbacks, including difficulties in achieving worst-case correctness error in a moderate modulus, inconvenient sampling distributions for messages, and relatively slower algorithms compared to other lattice-based schemes. In this work, we propose a new NTRU-based key encapsulation mechanism (
$\mathsf {KEM}$
), called
$\mathsf {NTRU+}$
, which overcomes nearly all existing drawbacks.
$\mathsf {NTRU+}$
is constructed based on two new generic transformations:
$\mathsf {ACWC}_{2}$
and
$\overline {\mathsf {FO}}^{\perp }$
(a variant of the Fujisaki-Okamoto transform).
$\mathsf {ACWC}_{2}$
is used to easily achieve worst-case correctness error, while
$\overline {\mathsf {FO}}^{\perp }$
is used to achieve chosen-ciphertext security without re-encryption. Both
$\mathsf {ACWC}_{2}$
and
$\overline {\mathsf {FO}}^{\perp }$
are defined using a randomness-recovery algorithm and an encoding method. In particular, our simple encoding method, the semi-generalized one-time pad (
$\mathsf {SOTP}$
), allows us to sample a message from a natural bit-string space with an arbitrary distribution. We provide four parameter sets for
$\mathsf {NTRU+}$
and present implementation results using NTT-friendly rings over cyclotomic trinomials.