Algorithmic Views of Vectorized Polynomial Multipliers – NTRU Prime

Abstract

In this paper, we explore the cost of vectorization for multiplying polynomials with coefficients in $\mathbb {{Z}}_q$ for an odd prime q, as exemplified by NTRU Prime, a postquantum cryptosystem that found early adoption due to its inclusion in OpenSSH.

If there is a large power of two dividing $q - 1$, we can apply radix-2 Cooley–Tukey fast Fourier transforms to multiply polynomials in $\mathbb {{Z}}_q[x]$. The radix-2 nature admits efficient vectorization. Conversely, if 2 is the only power of two dividing $q - 1$, we can apply Schönhage’s and Nussbaumer’s FFTs to craft radix-2 roots of unity, but these double the number of coefficients.

We show how to avoid the doubling while maintaining the vectorization friendliness with Good–Thomas, Rader’s, and Bruun’s FFTs. In particular, in sntrup761, the most common instance of NTRU Prime we have $q=4591$, and we exploit the existing Fermat-prime factor of $q - 1$ for Rader’s FFT and power-of-two factor of $q + 1$ for Bruun’s FFT.

Polynomial multiplications in $\mathbb {{Z}}_{4591}[x]/\left\langle {x^{761}-x-1} \right\rangle$ is still a worthwhile target because while out of the NIST PQC competition, sntrup761 is still going to be used with OpenSSH by default in the near future.

Our polynomial multiplication outperforms the state-of-the-art vector-optimized implementation by $6.1 \times$. For ntrulpr761, our keygen, encap, and decap are $2.98 \times$, $2.79 \times$, and $3.07 \times$ faster than the state-of-the-art vector-optimized implementation. For sntrup761, we outperform the reference implementation significantly.

A Detailed Performance Numbers