Amoeba: More Flexible RLWE-Based KEM
摘要
Most RLWE-based key encapsulation mechanisms (KEMs) use power-of-two cyclotomic rings to be compatible with the number theoretic transform (NTT), however, which causes a jump in the security strength. In this work, we construct a novel RLWE-based KEM scheme, named Amoeba, which employs a more general cyclotomic ring \(\mathbb {Z}_{q}[X]/(X^{kn} - X^{kn/2} + 1)\) and achieves smooth transitions to 128, 192, and 256-bit security levels by setting k to 2, 3, and 4, respectively. Furthermore, we employ Nussbaumer’s trick to provide an efficient and reusable NTT implementation over a common ring \(\mathbb {Z}_{q}[Y]/(Y^{n}-Y^{n/2}+1)\) for different security levels. In the standard C/C++ implementation, key generation is up to 112.9% faster than Kyber’s due to the lightweight Keccak invocation.