Most RLWE-based key encapsulation mechanisms (KEMs) use power-of-two cyclotomic rings to be compatible with the number theoretic transform (NTT), however, which causes a jump in the security strength. In this work, we construct a novel RLWE-based KEM scheme, named Amoeba, which employs a more general cyclotomic ring \(\mathbb {Z}_{q}[X]/(X^{kn} - X^{kn/2} + 1)\) and achieves smooth transitions to 128, 192, and 256-bit security levels by setting k to 2, 3, and 4, respectively. Furthermore, we employ Nussbaumer’s trick to provide an efficient and reusable NTT implementation over a common ring \(\mathbb {Z}_{q}[Y]/(Y^{n}-Y^{n/2}+1)\) for different security levels. In the standard C/C++ implementation, key generation is up to 112.9% faster than Kyber’s due to the lightweight Keccak invocation.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Amoeba: More Flexible RLWE-Based KEM

  • Qingfeng Wang,
  • Li-Ping Wang

摘要

Most RLWE-based key encapsulation mechanisms (KEMs) use power-of-two cyclotomic rings to be compatible with the number theoretic transform (NTT), however, which causes a jump in the security strength. In this work, we construct a novel RLWE-based KEM scheme, named Amoeba, which employs a more general cyclotomic ring \(\mathbb {Z}_{q}[X]/(X^{kn} - X^{kn/2} + 1)\) and achieves smooth transitions to 128, 192, and 256-bit security levels by setting k to 2, 3, and 4, respectively. Furthermore, we employ Nussbaumer’s trick to provide an efficient and reusable NTT implementation over a common ring \(\mathbb {Z}_{q}[Y]/(Y^{n}-Y^{n/2}+1)\) for different security levels. In the standard C/C++ implementation, key generation is up to 112.9% faster than Kyber’s due to the lightweight Keccak invocation.