Efficient NTRU+ Implementations on Cortex-M

What it is

A preprint (ePrint 2026/2568, received 20 October 2026) by Subeen Cho, Minjoo Sim, Seungwon Lee, Anupam Chattopadhyay, Wai Kong Lee and Hwajeong Seo. It implements the NTRU+ KEM on Arm Cortex-M0+, M3, M4 and M7. NTRU+ uses 3-way NTTs, which mix radix-3 and radix-2 layers. The authors say such implementations are scarce next to the well-studied 2-way NTTs over power-of-two cyclotomic rings used by most lattice KEMs.

How it works

For each parameter set and core, the authors tune three things in the 3-way NTT: layer fusion, modular arithmetic and instruction scheduling. They also add "ω-folded front layers". These compute the first two layers of the forward NTT on ternary inputs without modular reduction.

The two builds trade time against memory differently:

flowchart TD
    A[NTRU+ on Cortex-M] --> B[Speed-optimized]
    A --> C[Memory-optimized]
    B --> D[Operands kept as full polynomial arrays]
    C --> E[One shared polynomial workspace]
    E --> F[Operands regenerated per radix-3 block]

What to do

Choose by constraint, using the paper's measurements on physical boards, compared with the official optimized C implementation:

• Speed-optimized: execution time falls by up to 52.43%.
• Memory-optimized: peak stack falls by up to 82.60%, and every KEM operation still runs faster than the official optimized C code.

Treat the speed and memory builds as separate choices per core. A controlled NTT-replacement experiment and per-technique comparisons show the same technique can help or hurt depending on the core's instruction set and pipeline. Do not carry a tuning from one Cortex-M core to another without measuring.

Caveats

The page gives only the abstract, so per-core cycle counts, parameter sets and the "up to" baselines are not visible here. It does not mention a code repository or constant-time and side-channel analysis. The work is a preprint without peer review.