postquantum.wiki

NTRU

GlossaryUpdated July 11, 2026164 words2 sources

NTRU is a lattice-based public-key cryptosystem built on arithmetic in a truncated polynomial ring, proposed by Jeffrey Hoffstein, Jill Pipher, and Joseph Silverman in 1998. It is the oldest practical lattice-based scheme still in use, predating Learning With Errors, and its security rests on finding short vectors in the NTRU lattice.

How it works

A public key is the ratio of two small secret polynomials modulo q. Encryption adds a small message-dependent perturbation that only the holder of the short secret can remove (Hoffstein, Pipher, Silverman, 1998). Because the operations are polynomial multiplications, NTRU is fast and its keys are compact.

Descendants and standardization

NTRU seeded a family of schemes. The NTRU KEM reached the finalist round of NIST standardization (NIST IR 8413), and the signature scheme Falcon, standardized as FN-DSA / Falcon, samples short vectors over NTRU lattices. Later ring assumptions such as Ring-LWE and Module-LWE added the worst-case hardness reductions that classic NTRU lacked.

Sources

  1. NTRU: A Ring-Based Public Key Cryptosystem (Springer (ANTS III), 1998)
  2. NIST IR 8413, Status Report on the Third Round of the PQC Standardization Process (NIST, 2022)

latticentrupublic-keypqc

Cite this entry
"NTRU." postquantum.wiki. Updated July 11, 2026. https://postquantum.wiki/ntru@misc{pqwiki-ntru, title = {NTRU}, howpublished = {\url{https://postquantum.wiki/ntru}}, year = {2026}, note = {postquantum.wiki, updated 2026-07-11} }

Related entries

Lattice-based cryptography

Lattice-based cryptography builds encryption and signatures on hard lattice problems such as LWE and underpins the NIST standards ML-KEM and ML-DSA.

Foundations

FN-DSA / Falcon

FN-DSA is the planned FIPS 206 standard for the Falcon signature scheme, an NTRU-lattice design with the smallest keys and signatures among NIST selections.

Standards

Ring Learning With Errors (Ring-LWE)

Ring-LWE is the polynomial-ring variant of Learning With Errors, trading extra algebraic structure for the compact keys and fast arithmetic PQ schemes need.

Glossary

ML-KEM (FIPS 203)

ML-KEM is the module-lattice key-encapsulation mechanism of FIPS 203, formerly CRYSTALS-Kyber, and the default post-quantum key establishment method.

Standards

Module Learning With Errors (Module-LWE)

Module-LWE is the structured lattice assumption behind ML-KEM and ML-DSA, tuning algebraic structure by module rank to reach each NIST security level.

Glossary