Skip to content

Commit 59bf831

Browse files
saitomstsaitomst
authored
Add NTRU back (open-quantum-safe#2176)
This commit includes following changes: * Revert "Removed NTRU. (open-quantum-safe#1335)" * Replace the uses of malloc with OQS_MEM_malloc * Add a derandomized keypair function * Add "all" entries of NTRU algorithms to the KATs file * Fix reflecting the removal of NTRU from PQClean * Update NTRU documents with the latest manners * Change the CODEOWNERS of NTRU KEM Signed-off-by: Saito Masataka <saitomst@intellilink.co.jp>
1 parent f58b45a commit 59bf831

295 files changed

Lines changed: 249530 additions & 10 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.CMake/alg_support.cmake‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,38 @@ if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS))
113113
endif()
114114
endif()
115115

116+
option(OQS_ENABLE_KEM_NTRU "Enable ntru algorithm family" ON)
117+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hps2048509 "" ON "OQS_ENABLE_KEM_NTRU" OFF)
118+
if(CMAKE_SYSTEM_NAME MATCHES "Linux|Darwin")
119+
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_BMI2_INSTRUCTIONS))
120+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hps2048509_avx2 "" ON "OQS_ENABLE_KEM_ntru_hps2048509" OFF)
121+
endif()
122+
endif()
123+
124+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hps2048677 "" ON "OQS_ENABLE_KEM_NTRU" OFF)
125+
if(CMAKE_SYSTEM_NAME MATCHES "Linux|Darwin")
126+
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_BMI2_INSTRUCTIONS))
127+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hps2048677_avx2 "" ON "OQS_ENABLE_KEM_ntru_hps2048677" OFF)
128+
endif()
129+
endif()
130+
131+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hps4096821 "" ON "OQS_ENABLE_KEM_NTRU" OFF)
132+
if(CMAKE_SYSTEM_NAME MATCHES "Linux|Darwin")
133+
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_BMI2_INSTRUCTIONS))
134+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hps4096821_avx2 "" ON "OQS_ENABLE_KEM_ntru_hps4096821" OFF)
135+
endif()
136+
endif()
137+
138+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hps40961229 "" ON "OQS_ENABLE_KEM_NTRU" OFF)
139+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hrss701 "" ON "OQS_ENABLE_KEM_NTRU" OFF)
140+
if(CMAKE_SYSTEM_NAME MATCHES "Linux|Darwin")
141+
if(OQS_DIST_X86_64_BUILD OR (OQS_USE_AVX2_INSTRUCTIONS AND OQS_USE_BMI2_INSTRUCTIONS))
142+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hrss701_avx2 "" ON "OQS_ENABLE_KEM_ntru_hrss701" OFF)
143+
endif()
144+
endif()
145+
146+
cmake_dependent_option(OQS_ENABLE_KEM_ntru_hrss1373 "" ON "OQS_ENABLE_KEM_NTRU" OFF)
147+
116148
##### OQS_COPY_FROM_UPSTREAM_FRAGMENT_ADD_ENABLE_BY_ALG_START
117149
option(OQS_ENABLE_KEM_CLASSIC_MCELIECE "Enable classic_mceliece algorithm family" ON)
118150
cmake_dependent_option(OQS_ENABLE_KEM_classic_mceliece_348864 "" ON "OQS_ENABLE_KEM_CLASSIC_MCELIECE" OFF)

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
/src/kem/kyber @bhess
1313
/src/kem/kyber/libjade* @praveksharma
1414
/src/kem/ml_kem @bhess
15+
/src/kem/ntru @saitomst
1516
/src/sig/cross @alexrow
1617
/src/sig/dilithium @bhess
1718
/src/sig/mayo @bhess

‎CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,6 +243,9 @@ endif()
243243
if(OQS_ENABLE_KEM_NTRUPRIME)
244244
set(PUBLIC_HEADERS ${PUBLIC_HEADERS} ${PROJECT_SOURCE_DIR}/src/kem/ntruprime/kem_ntruprime.h)
245245
endif()
246+
if(OQS_ENABLE_KEM_NTRU)
247+
set(PUBLIC_HEADERS ${PUBLIC_HEADERS} ${PROJECT_SOURCE_DIR}/src/kem/ntru/kem_ntru.h)
248+
endif()
246249
##### OQS_COPY_FROM_UPSTREAM_FRAGMENT_INCLUDE_HEADERS_START
247250
if(OQS_ENABLE_KEM_CLASSIC_MCELIECE)
248251
set(PUBLIC_HEADERS ${PUBLIC_HEADERS} ${PROJECT_SOURCE_DIR}/src/kem/classic_mceliece/kem_classic_mceliece.h)

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ All names other than `ML-KEM` and `ML-DSA` are subject to change. `liboqs` makes
6262
- **HQC**: HQC-128, HQC-192, HQC-256
6363
- **Kyber**: Kyber512, Kyber768, Kyber1024
6464
- **ML-KEM**: ML-KEM-512, ML-KEM-768, ML-KEM-1024
65+
- **NTRU**: NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS-701, NTRU-HRSS-1373
6566
- **NTRU-Prime**: sntrup761
6667
<!--- OQS_TEMPLATE_FRAGMENT_LIST_KEXS_END -->
6768

@@ -217,6 +218,7 @@ liboqs includes some third party libraries or modules that are licensed differen
217218
- `src/kem/kyber/pqclean_*`: public domain (CC0), and public domain (CC0) or Apache License v2.0, and public domain (CC0) or MIT, and MIT
218219
- `src/kem/kyber/libjade_*` public domain (CC0) or Apache License v2.
219220
- `src/kem/ml_kem/mlkem-native_*`: MIT or Apache License v2.0 or ISC License
221+
- `src/kem/ntru/pqclean_*`: public domain (CC0)
220222
- `src/sig/dilithium/pqcrystals-*`: public domain (CC0) or Apache License v2.0
221223
- `src/sig/dilithium/pqclean_*`: public domain (CC0), and public domain (CC0) or Apache License v2.0, and public domain (CC0) or MIT, and MIT
222224
- src/sig/falcon/pqclean_\*\_aarch64 : Apache License v2.0

‎docs/algorithms/kem/ntru.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# NTRU
2+
3+
- **Algorithm type**: Key encapsulation mechanism.
4+
- **Main cryptographic assumption**: NTRU in Z[x]/(q, x^n-1) with prime n and power-of-two q.
5+
- **Principal submitters**: John M. Schanck.
6+
- **Auxiliary submitters**: Cong Chen, Oussama Danba, Jeffrey Hoffstein, Andreas Hülsing, Joost Rijneveld, Tsunekazu Saito, Peter Schwabe, William Whyte, Keita Xagawa, Takashi Yamakawa, Zhenfei Zhang.
7+
- **Authors' website**: https://ntru.org/
8+
- **Specification version**: NIST Round 3 submission.
9+
- **Primary Source**<a name="primary-source"></a>:
10+
- **Source**: https://github.com/PQClean/PQClean/commit/4c9e5a3aa715cc8d1d0e377e4e6e682ebd7602d6
11+
- **Implementation license (SPDX-Identifier)**: CC0-1.0
12+
- **Ancestors of primary source**:
13+
- https://github.com/jschanck/ntru/tree/a43a4457
14+
15+
## Parameter set summary
16+
17+
| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Ciphertext size (bytes) | Shared secret size (bytes) | Keypair seed size (bytes) |
18+
|:------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|--------------------------:|-----------------------------:|:----------------------------|
19+
| NTRU-HPS-2048-509 | NA | IND-CCA2 | 1 | 699 | 935 | 699 | 32 | NA |
20+
| NTRU-HPS-2048-677 | NA | IND-CCA2 | 3 | 930 | 1234 | 930 | 32 | NA |
21+
| NTRU-HPS-4096-821 | NA | IND-CCA2 | 5 | 1230 | 1590 | 1230 | 32 | NA |
22+
| NTRU-HPS-4096-1229 | NA | IND-CCA2 | 5 | 1842 | 2366 | 1842 | 32 | NA |
23+
| NTRU-HRSS-701 | NA | IND-CCA2 | 3 | 1138 | 1450 | 1138 | 32 | NA |
24+
| NTRU-HRSS-1373 | NA | IND-CCA2 | 5 | 2401 | 2983 | 2401 | 32 | NA |
25+
26+
## NTRU-HPS-2048-509 implementation characteristics
27+
28+
| Implementation source | Identifier in upstream | Supported architecture(s) | Supported operating system(s) | CPU extension(s) used | No branching-on-secrets claimed? | No branching-on-secrets checked by valgrind? | Large stack usage?‡ |
29+
|:---------------------------------:|:-------------------------|:----------------------------|:--------------------------------|:------------------------|:-----------------------------------|:-----------------------------------------------|:----------------------|
30+
| [Primary Source](#primary-source) | clean | All | All | None | True | True | False |
31+
| [Primary Source](#primary-source) | avx2 | x86\_64 | Linux,Darwin | AVX2,BMI2 | True | True | False |
32+
33+
Are implementations chosen based on runtime CPU feature detection? **Yes**.
34+
35+
‡For an explanation of what this denotes, consult the [Explanation of Terms](#explanation-of-terms) section at the end of this file.
36+
37+
## NTRU-HPS-2048-677 implementation characteristics
38+
39+
| Implementation source | Identifier in upstream | Supported architecture(s) | Supported operating system(s) | CPU extension(s) used | No branching-on-secrets claimed? | No branching-on-secrets checked by valgrind? | Large stack usage? |
40+
|:---------------------------------:|:-------------------------|:----------------------------|:--------------------------------|:------------------------|:-----------------------------------|:-----------------------------------------------|:---------------------|
41+
| [Primary Source](#primary-source) | clean | All | All | None | True | True | False |
42+
| [Primary Source](#primary-source) | avx2 | x86\_64 | Linux,Darwin | AVX2,BMI2 | True | True | False |
43+
44+
Are implementations chosen based on runtime CPU feature detection? **Yes**.
45+
46+
## NTRU-HPS-4096-821 implementation characteristics
47+
48+
| Implementation source | Identifier in upstream | Supported architecture(s) | Supported operating system(s) | CPU extension(s) used | No branching-on-secrets claimed? | No branching-on-secrets checked by valgrind? | Large stack usage? |
49+
|:---------------------------------:|:-------------------------|:----------------------------|:--------------------------------|:------------------------|:-----------------------------------|:-----------------------------------------------|:---------------------|
50+
| [Primary Source](#primary-source) | clean | All | All | None | True | True | False |
51+
| [Primary Source](#primary-source) | avx2 | x86\_64 | Linux,Darwin | AVX2,BMI2 | True | True | False |
52+
53+
Are implementations chosen based on runtime CPU feature detection? **Yes**.
54+
55+
## NTRU-HPS-4096-1229 implementation characteristics
56+
57+
| Implementation source | Identifier in upstream | Supported architecture(s) | Supported operating system(s) | CPU extension(s) used | No branching-on-secrets claimed? | No branching-on-secrets checked by valgrind? | Large stack usage? |
58+
|:---------------------------------:|:-------------------------|:----------------------------|:--------------------------------|:------------------------|:-----------------------------------|:-----------------------------------------------|:---------------------|
59+
| [Primary Source](#primary-source) | clean | All | All | None | True | True | False |
60+
61+
Are implementations chosen based on runtime CPU feature detection? **Yes**.
62+
63+
## NTRU-HRSS-701 implementation characteristics
64+
65+
| Implementation source | Identifier in upstream | Supported architecture(s) | Supported operating system(s) | CPU extension(s) used | No branching-on-secrets claimed? | No branching-on-secrets checked by valgrind? | Large stack usage? |
66+
|:---------------------------------:|:-------------------------|:----------------------------|:--------------------------------|:------------------------|:-----------------------------------|:-----------------------------------------------|:---------------------|
67+
| [Primary Source](#primary-source) | clean | All | All | None | True | True | False |
68+
| [Primary Source](#primary-source) | avx2 | x86\_64 | Linux,Darwin | AVX2,BMI2 | True | True | False |
69+
70+
Are implementations chosen based on runtime CPU feature detection? **Yes**.
71+
72+
## NTRU-HRSS-1373 implementation characteristics
73+
74+
| Implementation source | Identifier in upstream | Supported architecture(s) | Supported operating system(s) | CPU extension(s) used | No branching-on-secrets claimed? | No branching-on-secrets checked by valgrind? | Large stack usage? |
75+
|:---------------------------------:|:-------------------------|:----------------------------|:--------------------------------|:------------------------|:-----------------------------------|:-----------------------------------------------|:---------------------|
76+
| [Primary Source](#primary-source) | clean | All | All | None | True | True | False |
77+
78+
Are implementations chosen based on runtime CPU feature detection? **Yes**.
79+
80+
## Explanation of Terms
81+
82+
- **Large Stack Usage**: Implementations identified as having such may cause failures when running in threads or in constrained environments.

‎docs/algorithms/kem/ntru.yml‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
name: NTRU
2+
type: kem
3+
principal-submitters:
4+
- John M. Schanck
5+
auxiliary-submitters:
6+
- Cong Chen
7+
- Oussama Danba
8+
- Jeffrey Hoffstein
9+
- Andreas Hülsing
10+
- Joost Rijneveld
11+
- Tsunekazu Saito
12+
- Peter Schwabe
13+
- William Whyte
14+
- Keita Xagawa
15+
- Takashi Yamakawa
16+
- Zhenfei Zhang
17+
crypto-assumption: NTRU in Z[x]/(q, x^n-1) with prime n and power-of-two q
18+
website: https://ntru.org/
19+
nist-round: 3
20+
spec-version: NIST Round 3 submission
21+
upstream-ancestors:
22+
- https://github.com/jschanck/ntru/tree/a43a4457
23+
parameter-sets:
24+
- name: NTRU-HPS-2048-509
25+
claimed-nist-level: 1
26+
claimed-security: IND-CCA2
27+
length-public-key: 699
28+
length-ciphertext: 699
29+
length-secret-key: 935
30+
length-shared-secret: 32
31+
implementations-switch-on-runtime-cpu-features: true
32+
implementations:
33+
- upstream-id: clean
34+
supported-platforms: all
35+
common-crypto:
36+
- SHA3: liboqs
37+
no-secret-dependent-branching-claimed: true
38+
no-secret-dependent-branching-checked-by-valgrind: true
39+
large-stack-usage: false
40+
upstream: primary-upstream
41+
- upstream-id: avx2
42+
supported-platforms:
43+
- architecture: x86_64
44+
operating_systems:
45+
- Linux
46+
- Darwin
47+
required_flags:
48+
- avx2
49+
- bmi2
50+
common-crypto:
51+
- SHA3: liboqs
52+
no-secret-dependent-branching-claimed: true
53+
no-secret-dependent-branching-checked-by-valgrind: true
54+
large-stack-usage: false
55+
upstream: primary-upstream
56+
- name: NTRU-HPS-2048-677
57+
claimed-nist-level: 3
58+
claimed-security: IND-CCA2
59+
length-public-key: 930
60+
length-ciphertext: 930
61+
length-secret-key: 1234
62+
length-shared-secret: 32
63+
implementations-switch-on-runtime-cpu-features: true
64+
implementations:
65+
- upstream-id: clean
66+
supported-platforms: all
67+
common-crypto:
68+
- SHA3: liboqs
69+
no-secret-dependent-branching-claimed: true
70+
no-secret-dependent-branching-checked-by-valgrind: true
71+
large-stack-usage: false
72+
upstream: primary-upstream
73+
- upstream-id: avx2
74+
supported-platforms:
75+
- architecture: x86_64
76+
operating_systems:
77+
- Linux
78+
- Darwin
79+
required_flags:
80+
- avx2
81+
- bmi2
82+
common-crypto:
83+
- SHA3: liboqs
84+
no-secret-dependent-branching-claimed: true
85+
no-secret-dependent-branching-checked-by-valgrind: true
86+
large-stack-usage: false
87+
upstream: primary-upstream
88+
- name: NTRU-HPS-4096-821
89+
claimed-nist-level: 5
90+
claimed-security: IND-CCA2
91+
length-public-key: 1230
92+
length-ciphertext: 1230
93+
length-secret-key: 1590
94+
length-shared-secret: 32
95+
implementations-switch-on-runtime-cpu-features: true
96+
implementations:
97+
- upstream-id: clean
98+
supported-platforms: all
99+
common-crypto:
100+
- SHA3: liboqs
101+
no-secret-dependent-branching-claimed: true
102+
no-secret-dependent-branching-checked-by-valgrind: true
103+
large-stack-usage: false
104+
upstream: primary-upstream
105+
- upstream-id: avx2
106+
supported-platforms:
107+
- architecture: x86_64
108+
operating_systems:
109+
- Linux
110+
- Darwin
111+
required_flags:
112+
- avx2
113+
- bmi2
114+
common-crypto:
115+
- SHA3: liboqs
116+
no-secret-dependent-branching-claimed: true
117+
no-secret-dependent-branching-checked-by-valgrind: true
118+
large-stack-usage: false
119+
upstream: primary-upstream
120+
- name: NTRU-HPS-4096-1229
121+
claimed-nist-level: 5
122+
claimed-security: IND-CCA2
123+
length-public-key: 1842
124+
length-ciphertext: 1842
125+
length-secret-key: 2366
126+
length-shared-secret: 32
127+
implementations-switch-on-runtime-cpu-features: true
128+
implementations:
129+
- upstream-id: clean
130+
supported-platforms: all
131+
common-crypto:
132+
- SHA3: liboqs
133+
no-secret-dependent-branching-claimed: true
134+
no-secret-dependent-branching-checked-by-valgrind: true
135+
large-stack-usage: false
136+
upstream: primary-upstream
137+
- name: NTRU-HRSS-701
138+
claimed-nist-level: 3
139+
claimed-security: IND-CCA2
140+
length-public-key: 1138
141+
length-ciphertext: 1138
142+
length-secret-key: 1450
143+
length-shared-secret: 32
144+
implementations-switch-on-runtime-cpu-features: true
145+
implementations:
146+
- upstream-id: clean
147+
supported-platforms: all
148+
common-crypto:
149+
- SHA3: liboqs
150+
no-secret-dependent-branching-claimed: true
151+
no-secret-dependent-branching-checked-by-valgrind: true
152+
large-stack-usage: false
153+
upstream: primary-upstream
154+
- upstream-id: avx2
155+
supported-platforms:
156+
- architecture: x86_64
157+
operating_systems:
158+
- Linux
159+
- Darwin
160+
required_flags:
161+
- avx2
162+
- bmi2
163+
common-crypto:
164+
- SHA3: liboqs
165+
no-secret-dependent-branching-claimed: true
166+
no-secret-dependent-branching-checked-by-valgrind: true
167+
large-stack-usage: false
168+
upstream: primary-upstream
169+
- name: NTRU-HRSS-1373
170+
claimed-nist-level: 5
171+
claimed-security: IND-CCA2
172+
length-public-key: 2401
173+
length-ciphertext: 2401
174+
length-secret-key: 2983
175+
length-shared-secret: 32
176+
implementations-switch-on-runtime-cpu-features: true
177+
implementations:
178+
- upstream-id: clean
179+
supported-platforms: all
180+
common-crypto:
181+
- SHA3: liboqs
182+
no-secret-dependent-branching-claimed: true
183+
no-secret-dependent-branching-checked-by-valgrind: true
184+
large-stack-usage: false
185+
upstream: primary-upstream
186+
primary-upstream:
187+
spdx-license-identifier: CC0-1.0
188+
source: https://github.com/PQClean/PQClean/commit/4c9e5a3aa715cc8d1d0e377e4e6e682ebd7602d6

0 commit comments

Comments
 (0)