Research on Lattice-Based Cryptographic Algorithms

doi:10.19678/j.issn.1000-3428.0252663

Abstract

Abstract:

The security of classical public-key cryptosystems, which operate based on the computational intractability of integer factorization and discrete logarithm problems, is profoundly threatened by the rapid development of quantum computing. Post-Quantum Cryptography (PQC) has been proposed to improve security against quantum attacks. Lattice-based cryptography is widely regarded as one of the most promising PQC method because of its proven security, efficient implementation, and functional versatility, and it has achieved significant progress in both algorithmic design and engineering implementation in recent years. This paper presents a systematic survey of the status of research on lattice-based cryptographic algorithms. First, the fundamental theory of lattices and their core hard problems are discussed. Next, the technical characteristics and performance of encryption and key encapsulation mechanisms, digital signature schemes, and key exchange protocols constructed based on lattice hard problems are reviewed and compared. Subsequently, the principles and optimization paths of two key technologies for lattice cryptography implementation, namely polynomial multiplication using the fast Number Theoretic Transform (NTT) and pre-image sampling algorithms, are discussed. Finally, considering the PQC standardization process of the National Institute of Standards and Technology (NIST), an outlook on future research directions for lattice-based cryptography is presented. The research directions include the development of more "succinct" fundamental hard problems, strengthening security proofs, improving algorithm efficiency, and countering novel attacks. This review serves as a reference for promoting the practical deployment and further research of lattice-based cryptography.

Key words: Post-Quantum Cryptography (PQC), lattice-based cryptography, key encapsulation, digital signature, key exchange, fast Number Theoretic Transform (NTT), preimage sampling

摘要：

经典公钥密码体系所依赖的大整数分解与离散对数难题, 在量子计算迅猛发展的背景下正面临严峻挑战。为应对此威胁, 能够抵抗量子攻击的后量子密码(PQC)应运而生。其中, 基于格的密码因具备可证明的安全性、高效的执行效率以及良好的功能通用性等优势, 被广泛视为最具应用前景的后量子密码候选方案之一, 近年来在算法设计与工程实现上均取得了显著进展。本文系统综述了基于格的密码算法研究现状。首先, 阐述了格基础理论及其核心困难问题; 接着, 重点梳理并对比分析了基于格难题构造的加密与密钥封装机制、数字签名方案以及密钥交换协议的技术特点与性能表现; 然后, 深入剖析了基于格的密码实现中的两项关键技术——快速数论变换(NTT)多项式乘法和原像采样算法的原理与优化路径; 最后, 结合美国国家标准与技术研究院(NIST)后量子密码标准化进程, 对基于格的密码未来在发展更"简洁"的基础困难问题、强化安全归约、提升算法效率以及应对新型攻击等研究方向进行了展望, 以期为推动基于格的密码的实用化部署与后续研究提供参考。

关键词: 后量子密码, 基于格的密码, 密钥封装, 数字签名, 密钥交换, 快速数论变换, 原像采样

WU Kun, TANG Jinyi, LI Peiqi, WANG Xiaorui, WANG Xiaoyu. Research on Lattice-Based Cryptographic Algorithms[J]. Computer Engineering, 2026, 52(9): 31-48.

吴昆, 唐金艺, 李培琦, 汪晓睿, 王晓宇. 基于格的密码算法研究[J]. 计算机工程, 2026, 52(9): 31-48.

/ Recommend / Download Citations

URL: https://www.ecice06.com/EN/10.19678/j.issn.1000-3428.0252663

https://www.ecice06.com/EN/Y2026/V52/I9/31

Figures/Tables 6

References 117

1	SHOR P W . Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Review, 1999, 41 (2): 303- 332. doi: 10.1137/S0036144598347011
2	GROVER L K. A fast quantum mechanical algorithm for database search[C]//Proceedings of the 28th Annual ACM Symposium on Theory of Computing. New York, USA: ACM Press, 1996: 212-219.
3	吴昆, 胡现刚. 后量子密码技术研究综述. 计算机科学, 2025, 52 (2): 8- 19.
	WU K , HU X G . Overview of research on post-quantum cryptography technology. Computer Science, 2025, 52 (2): 8- 19.
4	CHEN L , JORDAN S , LIU Y K , et al. Report on post-quantum cryptography. Gaithersburg, USA: US Department of Commerce, National Institute of Standards and Technology, 2016.
5	DAM D T , TRAN T H , HOANG V P , et al. A survey of post-quantum cryptography: start of a new race. Cryptography, 2023, 7 (3): 40. doi: 10.3390/cryptography7030040
6	NIST releases first 3 finalized post-quantum encryption standards[EB/OL]. [2025-05-23]. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards.
7	AJTAI M. Generating hard instances of lattice problems[C]//Proceedings of the 28th Annual ACM Symposium on Theory of Computing. New York, USA: ACM Press, 1996: 99-108.
8	REGEV O. On lattices, learning with errors, random linear codes, and cryptography[C]//Proceedings of the 37th Annual ACM Symposium on Theory of Computing. New York, USA: ACM Press, 2005: 84-93.
9	LYUBASHEVSKY V, PEIKERT C, REGEV O. On ideal lattices and learning with errors over rings[C]//Proeedings of EUROCRYPT 2010. Berlin, Germany: Springer, 2010: 1-23.
10	LANGLOIS A , STEHLÉ D . Worst-case to average-case reductions for module lattices. Designs, Codes and Cryptography, 2015, 75 (3): 565- 599. doi: 10.1007/s10623-014-9938-4
11	BRAKERSKI Z , GENTRY C , VAIKUNTANATHAN V . (leveled) fully homomorphic encryption without bootstrapping. ACM Transactions on Computation Theory, 2014, 6 (3): 1- 36.
12	王旭阳, 胡爱群. 格困难问题的复杂度分析. 密码学报, 2015, 2 (1): 1- 16.
	WANG X Y , HU A Q . Complexity analysis of lattice hard problems. Journal of Cryptologic Research, 2015, 2 (1): 1- 16.
13	王小云, 刘明洁. 格密码学研究. 密码学报, 2014, 1 (1): 13- 27.
	WANG X Y , LIU M J . Survey of lattice-based cryptography. Journal of Cryptologic Research, 2014, 1 (1): 13- 27.
14	LENSTRA A K , LENSTRA H W , LOVASZ L . Factoring polynomials with rational coefficients. Mathematische Annalen, 1982, 261 (4): 515- 534. doi: 10.1007/BF01457454
15	SCHNORR C P , EUCHNER M . Lattice basis reduction: Improved practical algorithms and solving subset sum problems. Mathematical Programming, 1994, 66 (1): 181- 199.
16	CHEN Y M, NGUYEN P Q. BKZ 2.0: better lattice security estimates[C]//Procedings of ASIACRYPT 2011. Berlin, Germany: Springer, 2011: 1-20.
17	GAMA N, NGUYEN P Q. Finding short lattice vectors within Mordell's inequality[C]//Proceedings of the 40th Annual ACM Symposium on Theory of Computing. New York, USA: ACM Press, 2008: 207-216.
18	BLUM A , KALAI A , WASSERMAN H . Noise-tolerant learning, the parity problem, and the statistical query model. Journal of the ACM, 2003, 50 (4): 506- 519. doi: 10.1145/792538.792543
19	ARORA S, GE R. New algorithms for learning in presence of errors[C]//Proceedings of the International Conference on Automata, Languages and Programming. Berlin, Germany: Springer, 2011: 403-415.
20	BAI S, GALBRAITH S D. Lattice decoding attacks on binary LWE[C]//Proceedings of the 19th Australasian Conference on Information Security and Privacy. Berlin, Germany: Springer, 2014: 322-337.
21	DUCAS L , KILTZ E , LEPOINT T , et al. CRYSTALS-Dilithium: a lattice-based digital signature scheme. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2018 (1): 238- 268.
22	AJTAI M, DWORK C. A public-key cryptosystem with worst-case/average-case equivalence[C]//Proceedings of the 29th Annual ACM Symposium on Theory of Computing. New York, USA: ACM Press, 1997: 284-293.
23	NGUYEN P, STERN J. Cryptanalysis of the ajtai-dwork cryptosystem[C]//Proceedings of CRYPTO '98. Berlin, Germany: Springer, 1998: 223-242.
24	GOLDREICH O, GOLDWASSER S, HALEVI S. Public-key cryptosystems from lattice reduction problems[C]//Proceedings of CRYPTO 1997. Berlin, Germany: Springer, 1997: 112-131.
25	HOFFSTEIN J, PIPHER J, SILVERMAN J H. NTRU: a ring-based public key cryptosystem[C]//Proceedings of International Algorithmic Number Theory Symposium. Berlin, Germany: Springer, 1998: 267-288.
26	OKAMOTO T, POINTCHEVAL D. REACT: rapid enhanced-security asymmetric cryptosystem transform[C]//Proceedings of CT-RSA 2001. Berlin, Germany: Springer, 2001: 159-174.
27	JEAN-SÉBASTIEN C, HANDSCHUH H, JOYE M, et al. GEM: a generic chosen-ciphertext secure encryption method[C]//Proceedings of CT-RSA 2002. Berlin, Germany: Springer, 2002: 263-276.
28	FUJISAKI E, OKAMOTO T. Secure integration of asymmetric and symmetric encryption schemes[C]//Proceedings of CRYPTO' 99. Berlin, Germany: Springer, 1999: 537-554.
29	PEIKERT C. Public-key cryptosystems from the worst-case shortest vector problem: extended abstract[C]// Proceedings of the 41st Annual ACM Symposium on Theory of Computing. New York, USA: ACM Press, 2009: 333-342.
30	HOFHEINZ D, HÖVELMANNS K, KILTZ E. A modular analysis of the fujisaki-okamoto transformation[C]//Proceedings of Theory of Cryptography Conference. Berlin, Germany: Springer, 2017: 341-371.
31	LINDNER R, PEIKERT C. Better key sizes (and attacks) for LWE-based encryption[C]//Proceedings of CT-RSA 2011. Berlin, Germany: Springer, 2011: 319-339.
32	NAEHRIG M, ALKIM E, BOS J, et al. FrodoKEM[EB/OL]. [2025-05-23]. https://frodokem.org/.
33	ALKIM E, AVANZI R, BOS J, et al. NewHope[EB/OL]. [2025-05-23]. https://www.newhopecrypto.org/.
34	AVANZI R, BOS J, DUCAS L, et al. Crystals-Kyber[EB/OL]. [2025-05-23]. https://pq-crystals.org/kyber/.
35	吕顺森, 李斌, 翟嘉琪, 等. Crystal-Kyber算法的FPGA高效并行优化. 电子学报, 2024, 52 (5): 1679- 1689.
	LV S S , LI B , ZHAI J Q , et al. FPGA efficient parallel optimization of Crystal-Kyber. Acta Electronica Sinica, 2024, 52 (5): 1679- 1689.
36	NGUYEN T H , KIEU-DO-NGUYEN B , PHAM C K , et al. High-speed NTT accelerator for CRYSTAL-kyber and CRYSTAL-Dilithium. IEEE Access, 2024, 12, 34918- 34930. doi: 10.1109/ACCESS.2024.3371581
37	赵毅强, 孔金笛, 付玉成, 等. 面向模块化格基密钥封装机制(ML-KEM)算法多项式乘法的侧信道安全防护关键技术研究. 电子与信息学报, 2025, 47 (9): 3126- 3136.
	ZHAO Y Q , KONG J D , FU Y C , et al. Research on key technologies of side-channel security protection for polynomial multiplication in ML-KEM/Kyber algorithm. Journal of Electronics & Information Technology, 2025, 47 (9): 3126- 3136.
38	CHEN C, DANBA O, HOFFSTEIN J, et al. NTRU[EB/OL]. [2025-05-23]. https://www.ntru.org/.
39	HOFFSTEIN J, PIPHER J, SCHANCK J M, et al. NTRUEncrypt: a lattice based encryption algorithm[EB/OL]. [2025-05-23]. https://csrc.nist.gov/Projects/post-quantum-cryptography/post-quantum-cryptography-standardization/round-1-submissions.
40	HVLSING A, RIJNEVELD J, SCHANCK J M, et al. NTRU-HRSS-KEM[EB/OL]. [2025-05-23]. https://cryptojedi.org/papers/ntrunistr1-20171130.pdf.
41	TARGHI E E, UNRUH D. Post-quantum security of the fujisaki-okamoto and OAEP transforms[C]//Proceedings of the 14th International Conference on Theory of Cryptography. Berlin, Germany: Springer, 2016: 192-216.
42	DENT A W. A designer's guide to KEMs[C]//Proceedings of the IMA International Conference on Cryptography and Coding. Berlin, Germany: Springer, 2003: 133-151.
43	BERNSTEIN D J, CHUENGSATIANSUP C, LANGE T, et al. NTRU Prime: round 3[EB/OL]. [2025-05-23]. https://zenodo.org/records/13983972.
44	LIANG Z C , FANG B Y , ZHENG J Y , et al. Compact and efficient KEMs over NTRU lattices. Computer Standards & Interfaces, 2024, 89, 103828.
45	密码行业标准化技术委员会. 2023年度密码行业标准制修订任务(商用密码领域)[R]. 北京: 密码行业标准化技术委员会, 2023.
	Cryptography Standardization Technical Committee. 2023 annual standardization tasks for the cryptography industry (commercial cryptography)[R]. Beijing: Cryptography Standardization Technical Committee, 2023. (in Chinese)
46	STEHLÉ D, STEINFELD R. Making NTRU as secure as worst-case problems over ideal lattices[C]//Proceedings of EUROCRYPT 2011. Berlin, Germany: Springer, 2011: 27-47.
47	PELLET-MARY A, STEHLÉ D. On the hardness of the NTRU problem[C]//Proceedings of International Conference on the Theory and Application of Cryptology and Information Security. Berlin, Germany: Springer, 2021: 3-35.
48	FELDERHOFF J, PELLET-MARY A, STEHLÉ D. On module unique-SVP and NTRU[C]//Proceedings of ASIACRYPT 2022. Berlin, Germany: Springer, 2022: 709-740.
49	HOFFSTEIN J, HOWGRAVE-GRAHAM N, PIPHER J, et al. NTRUSign: digital signatures using the NTRU lattice[C]//Proceedings of CT-RSA 2003. Berlin, Germany: Springer, 2003: 122-140.
50	GENTRY C, PEIKERT C, VAIKUNTANATHAN V. Trapdoors for hard lattices and new cryptographic constructions[C]//Proceedings of the 40th Annual ACM Symposium on Theory of Computing. New York, USA: ACM Press, 2008: 197-206.
51	STEHLÉ D, STEINFELD R. Making NTRU as secure as worst-case problems over ideal lattices[C]//Proceedings of EUROCRYPT 2011. Berlin, Germany: Springer, 2011: 27-47.
52	MICCIANCIO D, PEIKERT C. Trapdoors for lattices: simpler, tighter, faster, smaller[C]//Proceedings of Annual International Conference on the Theory and Applications of Cryptographic Techniques. Berlin, Germany: Springer, 2012: 700-718.
53	DUCAS L, LYUBASHEVSKY V, PREST T. Efficient identity-based encryption over NTRU lattices[C]//Proceedings of ASIACRYPT 2014. Berlin, Germany: Springer, 2014: 22-41.
54	PREST T, FOUQUE P A, HOFFSTEIN J, et al. Falcon: fast-Fourier lattice-based compact signatures over NTRU[EB/OL]. [2025-05-23]. https://www.semanticscholar.org/paper/Falcon:-Fast-Fourier-Lattice-based-Compact-over-Fouque-Hoffstein/423e31b1b96ffa0559078961963baeeb98f01e19.
55	DUCAS L, POSTLETHWAITE E W, PULLES L N, et al. Hawk: module LIP makes lattice signatures fast, compact and simple[C]//Proceedings of ASIACRYPT 2022. Berlin, Germany: Springer, 2022: 65-94.
56	ESPITAU T, NIOT G, SUN C, et al. SQUIRRELS—square unstructured integer Euclidean lattice signature[EB/OL]. [2025-05-23]. https://www.maths.ox.ac.uk/system/files/inline-files/squirrels.pdf.
57	ESPITAU T, FOUQUE P A, GÉRARD F, et al. Mitaka: a simpler, parallelizable, maskable variant of Falcon[C]//Proceedings of EUROCRYPT 2022. Berlin, Germany: Springer, 2022: 222-253.
58	LEE Y , YOUN J , NAM K , et al. An efficient hardware/software co-design for FALCON on low-end embedded systems. IEEE Access, 2024, 12, 57947- 57958. doi: 10.1109/ACCESS.2024.3387489
59	DVZLV S, FIEDLER R, FISCHLIN M. BUFFing FALCON without increasing the signature size[C]//Proceedings of SAC 2024. Berlin, Germany: Springer, 2024: 131-150.
60	ZHANG Z, CHEN C, HOFFSTEIN J, et al. pqNTRUSign[EB/OL]. [2025-05-23]. https://csrc.nist.gov/Projects/post-quantum-cryptography/round-1-submissions.
61	YU Y, JIA H W, LI L B, et al. HuFu: hash-and-sign signatures from powerful gadgets[EB/OL]. [2025-05-23]. https://csrc.nist.gov/csrc/media/Projects/pqc-dig-sig/documents/round-1/spec-files/HuFu-spec-web.pdf.
62	YU Y, JIA H W, WANG X Y. Compact lattice gadget and its applications to hash-and-sign signatures[C]//Proceedings of CRYPTO 2023. Berlin, Germany: Springer, 2023: 390-420.
63	LYUBASHEVSKY V. Fiat-Shamir with Aborts: applications to lattice and factoring-based signatures[C]//Proceedings of ASIACRYPT 2009. Berlin, Germany: Springer, 2009: 598-616.
64	LYUBASHEVSKY V. Lattice signatures without trapdoor[C]// Proceedings of EUROCRYPT 2012. Berlin, Germany: Springer, 2012: 738-755.
65	DUCAS L, DURMUS A, LEPOINT T, et al. Lattice signatures and bimodal Gaussians[C]//Proceedings of CRYPTO 2013. Berlin, Germany: Springer, 2013: 40-56.
66	BAI S, GALBRAITH S D. An improved compression technique for signatures based on learning with errors[C]//Proceedings of CT-RSA 2014. Berlin, Germany: Springer, 2014: 28-47.
67	BAI S, DUCAS L, KILTZ E, et al. Crystals-Dilithium[EB/OL]. [2025-05-23]. https://pq-crystals.org/dilithium/data/dilithium-specification-round3-20210208.pdf.
68	CHEON J H , CHOE H , DEVEVEY J , et al. HAETAE: shorter lattice-based Fiat-Shamir signatures. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2024 (3): 25- 75.
69	胡跃, 赵旭阳, 王威, 等. 基于FPGA的格基数字签名算法硬件优化. 软件学报, 2025, 36 (10): 4461- 4482.
	HU Y , ZHAO X Y , WANG W , et al. Hardware optimization of lattice-based digital signature algorithm based on FPGA. Journal of Software, 2025, 36 (10): 4461- 4482.
70	王后珍, 段小超, 文嘉明, 等. Olithium: 基于格的无陷门在线/离线签名方案. 计算机学报, 2025, 48 (4): 877- 892.
	WANG H Z , DUAN X C , WEN J M , et al. Olithium: a lattice-based online/offline signature scheme without trapdoors. Chinese Journal of Computers, 2025, 48 (4): 877- 892.
71	NGUYEN H, CAMBOU B, NGUYEN T T. A GPU-accelerated high-performance design for CRYSTALS-dilithium digital signature[C]//Proceedings of the IEEE International Conference on Consumer Electronics (ICCE). Washington D.C., USA: IEEE Press, 2025: 1-4.
72	张江, 郁昱, 范淑琴. 埃奎斯: 一类基于非对称(M)LWE和(M)SIS的数字签名和密钥封装机制[EB/OL]. [2025-05-23]. https://fishinshallowpond.github.io/lab/1.Aigis-sig%E7%AE%97%E6%B3%95%E8%AE%BE%E8%AE%A1%E6%96%87%E6%A1%A3.pdf.
	ZHANG J, YU Y, FAN S Q. Aigis: a family of signatures and key encapsulation mechanisms from asymmetric (M)LWE and (M)SIS[EB/OL]. [2025-05-23]. https://fishinshallowpond.github.io/lab/1.Aigis-sig%E7%AE%97%E6%B3%95%E8%AE%BE%E8%AE%A1%E6%96%87%E6%A1%A3.pdf. (in Chinese)
73	周朕, 何德彪, 罗敏, 等. 紧凑的Aigis-sig数字签名方案软硬件协同实现方法. 网络与信息安全学报, 2021, 7 (2): 64- 76.
	ZHOU Z , HE D B , LUO M , et al. Compact software/hardware co-design and implementation method of Aigis-sig digital signature scheme. Chinese Journal of Network and Information Security, 2021, 7 (2): 64- 76.
74	李岩, 孙久兴, 陈昕, 等. 紧凑的Aigis数字签名和密钥封装的软硬件协同实现. 计算机工程, 2026, 52 (7): 277- 286. doi: 10.19678/j.issn.1000-3428.0070542 URL
	LI Y , SUN J X , CHEN X , et al. Compact hardware and software cooperative implementation of Aigis digital signature and key encapsulation. Computer Engineering, 2026, 52 (7): 277- 286. doi: 10.19678/j.issn.1000-3428.0070542 URL
75	DING J, XIE X, LIN X. A simple provably secure key exchange scheme based on the learning with errors problem[EB/OL]. [2025-05-23]. https://eprint.iacr.org/2012/688.
76	PEIKERT C. Lattice cryptography for the Internet[C]//Proceedigns of International Workshop on Post-Quantum Cryptography. Berlin, Germany: Springer, 2014: 197-219.
77	BOS J W, COSTELLO C, NAEHRIG M, et al. Post-quantum key exchange for the TLS protocol from the ring learning with errors problem[C]//Proceedings of the IEEE Symposium on Security and Privacy. Washington D.C., USA: IEEE Press, 2015: 553-570.
78	ALKIM E, DUCAS L, PÖPPELMANN T, et al. Post-quantum key exchange: a new hope[C]//Proceedings of the 25th USENIX Security Symposium (USENIX Security 16). Berkeley, USA: USENIX Association, 2016: 327-343.
79	BOS J, COSTELLO C, DUCAS L, et al. Frodo: take off the ring! practical, quantum-secure key exchange from LWE[C]//Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. New York, USA: ACM Press, 2016: 1006-1018.
80	赵运磊, 程蕾晓, 金正中, 等. OKCN: 基于格的通用和模块化的密钥协商[Z]. 北京: 全国密码算法设计竞赛, 2019.
	ZHAO Y L, CHENG L X, JIN Z Z, et al. OKCN: generic and practical key establishment from lattice[Z]. Beijing: National Cryptographic Algorithm Design Competition, 2019. (in Chinese)
81	GÜNEYSU T, LYUBASHEVSKY V, PÖPPELMANN T. Practical lattice-based cryptography: a signature scheme for embedded systems[C]//Proceedings of CHES 2012. Berlin, Germany: Springer, 2012: 530-547.
82	KARATSUBA A , OFMAN Y . Multiplication of multidigit numbers on automata. Soviet Physics Doklady, 1963, 7, 595.
83	TOOM A L . The complexity of a scheme of functional elements realizing the multiplication of integers. Soviet Mathematics Doklady, 1963, 3 (4): 714- 716.
84	D'ANVERS J P, KARMAKAR A, ROY S S, et al. SABER: Mod-LWR based KEM[EB/OL]. [2025-05-23]. https://www.esat.kuleuven.be/cosic/pqcrypto/saber/files/saberspecround3.pdf.
85	WINKLER F . Introduction. Berlin, Germany: Springer, 1996.
86	ALKIM E, DUCAS L, PÖPPELMANN T, et al. Post-quantum key exchange: a new hope[C]//Proceedings of the 25th USENIX Conference on Security Symposium (USENIX Security 16). Berkeley, USA: USENIX Association, 2016: 327-343.
87	MONTGOMERY P L . Modular multiplication without trial division. Mathematics of Computation, 1985, 44 (170): 519- 521. doi: 10.1090/S0025-5718-1985-0777282-X
88	BARRETT P. Implementing the rivest Shamir and Adleman public key encryption algorithm on a standard digital signal processor[C]//Proceedings of CRYPTO' 86. Berlin, Germany: Springer, 1986: 311-323.
89	PÖPPELMANN T , GÜNEYSU T . Towards efficient arithmetic for lattice-based cryptography on reconfigurable hardware. Berlin, Germany: Springer, 2012.
90	ZHOU S , XUE H Y , ZHANG D D , et al. Preprocess-then-NTT technique and its applications to kyber and NewHope. Berlin, Germany: Springer, 2019.
91	ZHU Y M, LIU Z, PAN Y B. When NTT meets karatsuba: preprocess-then-NTT technique revisited[C]//Proceedings of International Conference on Information and Communications Security. Berlin, Germany: Springer, 2021: 249-264.
92	MOENCK R T. Practical fast polynomial multiplication[C]//Proceedings of the 3rd ACM Symposium on Symbolic and Algebraic Computation. New York, USA: ACM Press, 1976: 136-148.
93	LIANG Z C, SHEN S Y, SHI Y T, et al. Number theoretic transform: generalization, optimization, concrete analysis and applications[C]//Proceedings of the Information Security and Cryptology Conference. Berlin, Germany: Springer, 2020: 415-432.
94	BOTROS L, KANNWISCHER M J, SCHWABE P. Memory-efficient high-speed implementation of kyber on cortex-M4[C]//Proceedings of the AFRICACRYPT 2019. Berlin, Germany: Springer, 2019: 209-228.
95	NGUYEN D T, GAJ K. Fast NEON-based multiplication for lattice-based NIST post-quantum cryptography finalists[C]//Proceedings of the International Conference on Post-Quantum Cryptography. Berlin, Germany: Springer, 2021: 234-254.
96	赵新颖, 袁峰, 赵臻, 等. 环上多项式乘法在GPU上的优化实现. 密码学报(中英文), 2024, 11 (4): 830- 844.
	ZHAO X Y , YUAN F , ZHAO Z , et al. Optimal implementation of multiplication over polynomial rings on GPUs. Journal of Cryptologic Research, 2024, 11 (4): 830- 844.
97	别梦妮, 李伟, 付秋兴, 等. 高能效格基后量子密码并行采样算法与硬件结构研究. 电子学报, 2025, 53 (2): 420- 430.
	BIE M N , LI W , FU Q X , et al. Research on energy-efficient parallel sampling algorithm and hardware architecture for lattice-based post-quantum ciphers. Acta Electronica Sinica, 2025, 53 (2): 420- 430.
98	DUCAS L, PREST T. Fast Fourier orthogonalization[C]//Proceedings of the ACM on International Symposium on Symbolic and Algebraic Computation. New York, USA: ACM Press, 2016: 191-198.
99	ESPITAU T, TIBOUCHI M, WALLET A, et al. ShorterHash-and-SignLattice-based signatures[C]//Proceedings of CRYPTO 2022. Berlin, Germany: Springer, 2022: 245-275.
100	PEIKERT C. An efficient and parallel Gaussian sampler for lattices[C]//Proceedings of CRYPTO 2010. Berlin, Germany: Springer, 2010: 80-97.
101	GENISE N, MICCIANCIO D. Faster Gaussian sampling for trapdoor lattices with arbitrary modulus[C]//Proceedings of EUROCRYPT 2018. Berlin, Germany: Springer, 2018: 174-203.
102	CHEN Y L, GENISE N, MUKHERJEE P. Approximate trapdoors for lattices and smaller hash-and-sign signatures[C]//Proceedings of ASIACRYPT 2019. Berlin, Germany: Springer, 2019: 3-32.
103	柴惠哲, 唐春明, 贾惠文. 基于NTRU格上非球型离散高斯采样的优化. 广州大学学报(自然科学版), 2024, 23 (2): 57- 64.
	CHAI H Z , TANG C M , JIA H W . Optimization of non-spherical discrete Gaussian sampling based on NTRU lattice. Journal of Guangzhou University (Natural Science Edition), 2024, 23 (2): 57- 64.
104	CRAMER R , DUCAS L , WESOLOWSKI B . Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time. Journal of the ACM, 2021, 68 (2): 1- 26.
105	BERNSTEIN D J, LANGE T. Non-randomness of S-unit lattices[EB/OL]. [2025-05-23]. https://eprint.iacr.org/2021/1428.
106	BERNSTEIN D J, CHUENGSATIANSUP C, LANGE T, et al. NTRU prime: reducing attack surface at low cost[C]//Proceedings of SAC 2017. Berlin, Germany: Springer, 2017: 235-260.
107	SHIM K A, KIM J, AN Y. NCC-sign: a new lattice-based signature scheme using non-cyclotomic polynomials[EB/OL]. [2025-05-23]. https://kpqc.or.kr/images/pdf/NCC-Sign_Document.pdf.
108	CHEN Y L. Quantum algorithms for lattice problems[EB/OL]. [2025-05-23]. https://iacr.steepath.eu:80/2024/555-QuantumAlgorithmsforLatticeProblems.pdf.
109	KÖPPL T, ZANDER R, HENKEL L, et al. A parameter study for LLL and BKZ with application to shortest vector problems[EB/OL]. [2025-05-23]. https://arxiv.org/abs/2502.05160.
110	SU Y X, YANG Z Y, HUANG P Y, et al. Quantum algorithms for bandits with knapsacks with improved regret and time complexities[EB/OL]. [2025-05-23]. https://arxiv.org/abs/2507.04438.
111	DUBROVA E, NGO K, GÄRTNER J, et al. Breaking a fifth-order masked implementation of CRYSTALS-Kyber by copy-paste[C]//Proceedings of the 10th ACM Asia Public-Key Cryptography Workshop. New York, USA: ACM Press, 2023: 10-20.
112	DUCAS L, VAN WOERDEN W. On the lattice isomorphism problem, quadratic forms, remarkable lattices, andCryptography[C]//Proceedings of EUROCRYPT 2022. Berlin, Germany: Springer, 2022: 643-673.
113	张维, 孙明豪, 屈龙江. 子格筛法的两种优化方法. 密码学报, 2023, 10 (3): 476- 490.
	ZHANG W , SUN M H , QU L J . Two optimization methods of subsieve algorithm. Journal of Cryptologic Research, 2023, 10 (3): 476- 490.
114	KIM G , SEO E , LEE Y , et al. Lazy modular reduction for NTT. Electronics, 2024, 13 (24): 4887. doi: 10.3390/electronics13244887
115	穆嘉楠, 韩虎生, 叶靖. 格密码加速器构建方法, 装置, 设备及计算机可读介质: CN119070989A[P]. 2025-08-20.
	MU J N, HAN H S, YE J. Lattice cryptography accelerator construction method, device, equipment, and computer-readable medium: CN119070989A[P]. 2025-08-20. (in Chinese)
116	ZHENG Z Y , LIU F X , TIAN K . On the MacWilliams theorem over codes and lattices. IEEE Transactions on Information Theory, 2025, 71 (5): 3560- 3568. doi: 10.1109/TIT.2025.3550982
117	杨春艳. 全球首个!西电发布"玄知"密码大模型[EB/OL]. [2025-05-23]. https://www.xiancn.com/content/2025-08/18/content_7197085.htm.
	YANG C Y. World's first! Xidian University releases "Xuanzhi" cryptographic large model[EB/OL]. [2025-05-23]. https://www.xiancn.com/content/2025-08/18/content_7197085.htm. (in Chinese)

[1]	ZHOU Quan, XIE Shuting, ZENG Zhikang, CHEN Lili, LU Zichong. SM2-based Digital Signature Scheme Supporting Threshold Modification [J]. Computer Engineering, 2026, 52(7): 255-264.
[2]	LI Yan, SUN Jiuxing, CHEN Xin, XUE Yiming, LIU Jian. Compact Hardware and Software Cooperative Implementation of Aigis Digital Signature and Key Encapsulation [J]. Computer Engineering, 2026, 52(7): 277-286.
[3]	YANG Xingyu, ZHOU Hua, TIAN Youliang, YANG Kedi. Identity Security Authentication Scheme Based on Software━Hardware Collaboration for the Metaverse [J]. Computer Engineering, 2026, 52(6): 214-225.
[4]	XIE Jiaxing, PU Jinwei, FANG Weitian, ZHENG Xin, XIONG Xiaoming. Area-Efficient Polynomial Multiplication Hardware Implementation for Lattice-based Cryptography [J]. Computer Engineering, 2026, 52(1): 282-292.
[5]	DENG Miaolei, MA Qingyu, SONG Qing, ZHANG Chunyan, ZUO Zhibin. Enhanced Wireless Sensor Network Authentication Key Agreement Protocol [J]. Computer Engineering, 2025, 51(11): 186-193.
[6]	ZHAO Jiangdong, CHEN Hu, WANG Xiaoyi. Efficient Linkable Ring Signature Scheme [J]. Computer Engineering, 2025, 51(10): 203-212.
[7]	Douwei LEI, Debiao HE, Min LUO, Cong PENG. High-speed Parallel Implementation of Lattice-based Cryptography Based on AVX512 [J]. Computer Engineering, 2024, 50(2): 15-24.
[8]	LIU Qilie, CHEN Cheng. Anonymous Identity Authentication Scheme in V2G Based on Blockchain [J]. Computer Engineering, 2021, 47(11): 22-28.
[9]	ZHAO Zongqu, HUANG Lijuan, FAN Tao, MA Shaoti. KEM-based Authenticated Key Exchange Protocol on Lattice [J]. Computer Engineering, 2020, 46(7): 122-128.
[10]	LIAO Fangyuan, GAN Zhiwang. Vulnerability Analysis and Detection of Android System Signature [J]. Computer Engineering, 2019, 45(8): 25-30.
[11]	ZUO Liming,ZHOU Qing,CHEN Lanlan. A provably security and efficient certificateless short signature scheme [J]. Computer Engineering, 2019, 45(6): 193-198.
[12]	ZUO Liming, XIA Pingping, CHEN Zuosong. A Provably Secure Short Blind Signature Scheme [J]. Computer Engineering, 2019, 45(12): 114-118.
[13]	FENG Chaoyi,ZHAO Yiming. Ideal Lattice Based Justifiable Secure Digital Signature Scheme [J]. Computer Engineering, 2017, 43(5): 103-107.
[14]	LIU Yuyang,ZHAO Yiming. White-box Traceable Attribute Signature Scheme [J]. Computer Engineering, 2017, 43(4): 126-132,140.
[15]	JIAN Chunfu,XIE Jihua,JIN Junhua. Research and Application of Cloud Digital Signature Technology [J]. Computer Engineering, 2017, 43(12): 1-5.

Please choose a citation manager

Content to export