Paper 2023/105

Gate-Level Masking of Streamlined NTRU Prime Decapsulation in Hardware

Georg Land, Ruhr University Bochum
Adrian Marotzke, Hamburg University of Technology, NXP (Germany)
Jan Richter-Brockmann, Ruhr University Bochum
Tim Güneysu, Ruhr University Bochum, German Research Centre for Artificial Intelligence

Streamlined NTRU Prime is a lattice-based Key Encapsulation Mechanism (KEM) that is, together with X25519, currently the default algorithm in OpenSSH 9. Being based on lattice assumptions, it is assumed to be secure also against attackers with access to large-scale quantum computers. While Post-Quantum Cryptography (PQC) schemes have been subject to extensive research in the recent years, challenges remain with respect to protection mechanisms against attackers that have additional side-channel information such as the power consumption of a device processing secret data. As a countermeasure to such attacks, masking has been shown to be a promising and effective approach. For public-key schemes, including any recent PQC schemes, usually a mixture of Boolean and arithmetic approaches are applied on an algorithmic level. Our generic hardware implementation of Streamlined NTRU Prime decapsulation, however, follows an idea that until now was assumed to be only applicable to symmetric cryptography: gate-level masking. There, a hardware design that consists of logic gates is transformed into a secure implementation by replacing each gate with a composably secure gadget that operates on uniform random shares of secret values. In our work, we show the feasibility of applying this approach also to PQC schemes and present the first Public-Key Cryptography (PKC) – pre- and post-quantum – implementation masked at gate level considering several trade-offs and design choices. We synthesize our implementation both for Artix-7 Field-Programmable Gate Arrays (FPGAs) and 45 nm Application-Specific Integrated Circuits (ASICs), yielding practically feasible results regarding area, randomness demand and latency. Finally, we also analyze the applicability of our concept to Kyber which will be standardized by the National Institute of Standards and Technology (NIST).

Available format(s)
Publication info
PQCMaskingFPGAASICStreamlined NTRU PrimeHigher-order MaskingGate-level Masking
Contact author(s)
georg land @ rub de
adrian marotzke @ tuhh de
jan richter-brockmann @ rub de
tim gueneysu @ rub de
2023-01-28: approved
2023-01-27: received
See all versions
Short URL
Creative Commons Attribution


      author = {Georg Land and Adrian Marotzke and Jan Richter-Brockmann and Tim Güneysu},
      title = {Gate-Level Masking of Streamlined NTRU Prime Decapsulation in Hardware},
      howpublished = {Cryptology ePrint Archive, Paper 2023/105},
      year = {2023},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.