NTRU ⇒ IND-CCA KEM

Random oracle model · HRSS17

Statement

If NTRU encryption is one-way for parameters chosen so that decryption is perfectly correct, there is an IND-CCA-secure KEM in the quantum random-oracle model: textbook NTRU encryption lifted to a KEM by a generic transform — HRSS17.

Notes

• The proposed parameters take $p=3$, $q$ the smallest power of two for which decryption is perfectly correct, and $n=701$, the largest prime $n$ with ${\Phi }_n$ irreducible modulo $2$ and $3$ for which that $q$ is $8192$; they target 128-bit post-quantum security — HRSS17.