. 2023 May 26;9:e1391. doi: 10.7717/peerj-cs.1391

Table 5. The parameter comparison for the NTRU/D-NTRU-based IND-CCA2 KEM schemes.

	ntruhps (Chen et al., 2022)	Ours
Assumption	NTRU	D-NTRU
Lattice dimension (N)	Prime	Prime
Modulo value (q)	$2^{k}$	gcd( $q_{1}, q_{2}$ ) = 1 gcd( $q_{1}, p$ ) = 1 $q_{1} \to$ prime
Error bound	$\frac{q}{8} - 2 \geq \frac{2 N}{3}$	$q_{1} > ϕ$
SPD ( $L_{f}$ )	T	$L (d, d - 1)$
RPD ( $L_{g}$ )	$T (q / 8 - 2)$	$L (d, d - 1)$
RPD ( $L_{r}$ )	T	$L (d, d) \times R_{p}$
Message distribution	T	$R_{p}$
IND-CCA2 structure	NAEP padding	One-way encryption function

Note:

SPD, secret polynomial distribution; RPD, random polynomial distribution; T, ternary polynomials; $T (q)$ , the subset of $T$ . $q / 2$ coefficient of $T (q)$ is equal to 1, the remaining $q / 2$ coefficient is equal to −1.