Abstract:Constructing post-quantum key encapsulation mechanisms based on Lattice (especially NTRU Lattice) is one of the popular research fields in Lattice-based cryptography. Commonly, most Lattice-based cryptographic schemes are constructed over cyclotomic rings, which, however, are vulnerable to some attacks due to their abundant algebraic structures. An optional and more secure underlying algebraic structure is the large-Galois-group prime-degree prime-ideal number field. NTRU-Prime is an excellent NTRU-based key encapsulation mechanism over the large-Galois-group prime-degree prime-ideal number field and has been widely adopted as the default in the OpenSSH standard. This study aims to construct a key encapsulation mechanism over the same algebraic structure but with better performance than NTRU-Prime. Firstly, this work studies the security risks of cyclotomic rings, especially the attacks on quadratic power cyclotomic rings, and demonstrates the security advantages of a large-Galois-group prime-degree prime-ideal number field in resisting these attacks. Next, an NTRU-based key encapsulation mechanism named CNTR-Prime over a large-Galois-group prime-degree prime-ideal number field is proposed, along with the corresponding detailed analysis and parameter sets. Then, a pseudo-Mersenne incomplete number theoretic transform (NTT) is provided, which can compute polynomial multiplication efficiently over a large-Galois-group prime-degree prime-ideal number field. In addition, an improved pseudo-Mersenne modular reduction algorithm is proposed, which is utilized in pseudo-Mersenne incomplete NTT. It is faster than Barrett reduction by 2.6% in software implementation and is 2 to 6 times faster than both Montgomery reduction and Barrett reduction in hardware implementation. Finally, a C-language implementation of CNTR-Prime is presented. When compared to SNTRU-Prime, CNTR-Prime has advantages in security, bandwidth, and implementation efficiency. For example, CNTR-Prime-761 has an 8.3% smaller ciphertext size, and its security is strengthened by 19 bits for both classical and quantum security. CNTR-Prime-761 is faster in key generation, encapsulation, and decapsulation algorithms by 25.3×, 10.8×, and 2.0×, respectively. The classical and quantum security of CNTR-Prime-653 is already comparable to that of SNTRU-Prime-761, with a 13.8% reduction in bandwidth, and it is faster in key generation, encapsulation, and decapsulation by 33.9×, 12.6×, and 2.3×, respectively. This study provides an important reference for subsequent research, analysis, and optimization of similar Lattice-based cryptographic schemes.