{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T12:24:01Z","timestamp":1783513441970,"version":"3.55.0"},"reference-count":121,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T00:00:00Z","timestamp":1783468800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Embed. Comput. Syst."],"published-print":{"date-parts":[[2026,7,31]]},"abstract":"<jats:p>The Learning with Rounding (LWR) problem, introduced as a deterministic variant of Learning with Errors (LWE), has become a promising foundation for post-quantum cryptography. This Systematization of Knowledge (SoK) article presents a comprehensive survey of the theoretical foundations, algorithmic developments, and practical implementations of LWR-based cryptographic schemes. We introduce LWR within the broader landscape of lattice-based cryptography and post-quantum security, highlighting its advantages such as reduced randomness, improved efficiency, and enhanced side-channel resistance. We explore the evolution of security reductions from LWR to LWE, including recent advances that support practical parameter regimes and address challenges in both bounded and unbounded sample settings. This article systematically reviews existing LWR-based schemes \u2014 including Saber, Lizard, Florete, Espada, Sable, and SMAUG \u2014 analyzing their design choices, parameter sets, and performance tradeoffs. Furthermore, we examine the impact of LWR on side-channel resistance, failure probabilities, and masking efficiency, demonstrating its suitability for secure and efficient implementations. By consolidating the research spanning theory and practice, this SoK aims at guiding future cryptographic design and standardization efforts leveraging LWR.<\/jats:p>","DOI":"10.1145\/3807514","type":"journal-article","created":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T11:25:32Z","timestamp":1775647532000},"page":"1-33","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Using Learning with Rounding to Instantiate Post-Quantum Cryptographic Algorithms"],"prefix":"10.1145","volume":"25","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3270-1069","authenticated-orcid":false,"given":"Andrea","family":"Basso","sequence":"first","affiliation":[{"name":"IBM","place":["Z\u00fcrich, Switzerland"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1010-8157","authenticated-orcid":false,"given":"Joppe","family":"Bos","sequence":"additional","affiliation":[{"name":"NXP Semiconductors","place":["Leuven, Belgium"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9675-7988","authenticated-orcid":false,"given":"Jan-Pieter","family":"D\u2019Anvers","sequence":"additional","affiliation":[{"name":"Belfort","place":["Leuven, Belgium"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2594-588X","authenticated-orcid":false,"given":"Angshuman","family":"Karmakar","sequence":"additional","affiliation":[{"name":"Indian Institute of Technology Kanpur","place":["Kanpur, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0457-5728","authenticated-orcid":false,"given":"Jose","family":"Bermudo Mera","sequence":"additional","affiliation":[{"name":"PQShield","place":["Oxford, United Kingdom of Great Britain and Northern Ireland"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1884-6330","authenticated-orcid":false,"given":"Joost","family":"Renes","sequence":"additional","affiliation":[{"name":"NXP Semiconductors","place":["Austin, United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9805-5389","authenticated-orcid":false,"given":"Sujoy","family":"Roy","sequence":"additional","affiliation":[{"name":"Graz University of Technology","place":["Graz, Austria"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7208-9599","authenticated-orcid":false,"given":"Frederik","family":"Vercauteren","sequence":"additional","affiliation":[{"name":"imec-COSIC, KU Leuven","place":["Leuven, Belgium"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8003-4686","authenticated-orcid":false,"given":"Peng","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cryptology, University of the Chinese Academy of Sciences","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-5170-1253","authenticated-orcid":false,"given":"Yuewu","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cryptology, University of the Chinese Academy of Sciences","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-4049-8491","authenticated-orcid":false,"given":"Shicong","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cryptology, University of the Chinese Academy of Sciences","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-8143-319X","authenticated-orcid":false,"given":"Chenxin","family":"Zhong","sequence":"additional","affiliation":[{"name":"School of Cryptology, University of the Chinese Academy of Sciences","place":["Beijing, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,8]]},"reference":[{"key":"e_1_3_2_2_2","volume-title":"eBACS: ECRYPT Benchmarking of Cryptographic Systems","author":"Bernstein Daniel J.","year":"2025","unstructured":"Daniel J. Bernstein and Tanja Lange (Eds.). 2025. eBACS: ECRYPT Benchmarking of Cryptographic Systems. Retrieved from https:\/\/bench.cr.yp.to\/"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2023.i3.366-390"},{"key":"e_1_3_2_4_2","first-page":"99","volume-title":"Proceedings of the 28th ACM STOC","author":"Ajtai Mikl\u00f3s","year":"1996","unstructured":"Mikl\u00f3s Ajtai. 1996. Generating hard instances of lattice problems (extended abstract). In Proceedings of the 28th ACM STOC. ACM,99\u2013108. DOI:10.1145\/237814.237838"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1515\/jmc-2015-0016"},{"key":"e_1_3_2_6_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1007\/978-3-642-40041-4_4","volume-title":"Proceedings of the CRYPTO 2013","volume":"8042","author":"Alwen Jo\u00ebl","year":"2013","unstructured":"Jo\u00ebl Alwen, Stephan Krenn, Krzysztof Pietrzak, and Daniel Wichs. 2013. Learning with rounding, revisited - new reduction, properties and applications. In Proceedings of the CRYPTO 2013, Ran Canetti and Juan A. Garay (Eds.). LNCS, Vol. 8042,Springer, Berlin, 57\u201374. DOI:10.1007\/978-3-642-40041-4_4"},{"key":"e_1_3_2_7_2","doi-asserted-by":"crossref","first-page":"189","DOI":"10.1007\/978-3-030-44223-1_11","volume-title":"Proceedings of the 11th International Conference on Post-Quantum Cryptography","author":"Amiet Dorian","year":"2020","unstructured":"Dorian Amiet, Andreas Curiger, Lukas Leuenberger, and Paul Zbinden. 2020. Defeating newhope with a single trace. In Proceedings of the 11th International Conference on Post-Quantum Cryptography, Jintai Ding and Jean-Pierre Tillich (Eds.). Springer, Cham, 189\u2013205. DOI:10.1007\/978-3-030-44223-1_11"},{"key":"e_1_3_2_8_2","first-page":"159","volume-title":"Proceedings of the International Conference on Applied Cryptography and Network Security.","author":"Backlund Linus","year":"2023","unstructured":"Linus Backlund, Kalle Ngo, Joel G\u00e4rtner, and Elena Dubrova. 2023. Secret key recovery attack on masked and shuffled implementations of CRYSTALS-Kyber and saber. In Proceedings of the International Conference on Applied Cryptography and Network Security.Springer-Verlag, Berlin, 159\u2013177. DOI:10.1007\/978-3-031-41181-6_9"},{"key":"e_1_3_2_9_2","series-title":"LNCS","first-page":"747","volume-title":"Proceedings of the EUROCRYPT 2019","volume":"11477","author":"B\u0103etu Ciprian","year":"2019","unstructured":"Ciprian B\u0103etu, F. Bet\u00fcl Durak, Lo\u00efs Huguenin-Dumittan, Abdullah Talayhan, and Serge Vaudenay. 2019. Misuse attacks on post-quantum cryptosystems. In Proceedings of the EUROCRYPT 2019, Yuval Ishai and Vincent Rijmen (Eds.). LNCS, Vol. 11477,Springer, Cham, 747\u2013776. DOI:10.1007\/978-3-030-17656-3_26"},{"key":"e_1_3_2_10_2","series-title":"LNCS","first-page":"719","volume-title":"Proceedings of the EUROCRYPT 2012","volume":"7237","author":"Banerjee Abhishek","year":"2012","unstructured":"Abhishek Banerjee, Chris Peikert, and Alon Rosen. 2012. Pseudorandom functions and lattices. In Proceedings of the EUROCRYPT 2012, David Pointcheval and Thomas Johansson (Eds.). LNCS, Vol. 7237, Springer, Berlin, 719\u2013737. DOI:10.1007\/978-3-642-29011-4_42"},{"key":"e_1_3_2_11_2","first-page":"1285","volume-title":"Proceedings of the 58th ACM\/IEEE Design Automation Conference","author":"Basso Andrea","year":"2021","unstructured":"Andrea Basso and Sujoy Sinha Roy. 2021. Optimized polynomial multiplier architectures for post-quantum KEM saber. In Proceedings of the 58th ACM\/IEEE Design Automation Conference. IEEE, 1285\u20131290. DOI:10.1109\/DAC18074.2021.9586219"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/3429983"},{"key":"e_1_3_2_13_2","series-title":"LNCS","first-page":"235","volume-title":"Proceedings of the SAC 2017","volume":"10719","author":"Bernstein Daniel J.","year":"2017","unstructured":"Daniel J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange, and Christine van Vredendaal. 2017. NTRU prime: Reducing attack surface at low cost. In Proceedings of the SAC 2017, Carlisle Adams and Jan Camenisch (Eds.). LNCS, Vol. 10719,Springer, Cham, 235\u2013260. DOI:10.1007\/978-3-319-72565-9_12"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2021.i3.334-359"},{"key":"e_1_3_2_15_2","series-title":"LNCS","first-page":"61","volume-title":"Proceedings of the TCC 2019","volume":"11892","author":"Bindel Nina","year":"2019","unstructured":"Nina Bindel, Mike Hamburg, Kathrin H\u00f6velmanns, Andreas H\u00fclsing, and Edoardo Persichetti. 2019. Tighter proofs of CCA security in the quantum random oracle model. In Proceedings of the TCC 2019, Dennis Hofheinz and Alon Rosen (Eds.). LNCS, Vol. 11892, Springer, Cham, 61\u201390. DOI:10.1007\/978-3-030-36033-7_3"},{"key":"e_1_3_2_16_2","doi-asserted-by":"crossref","first-page":"206","DOI":"10.1007\/978-3-030-44223-1_12","volume-title":"Proceedings of the 11th International Conference on Post-quantum Cryptography","author":"Bindel Nina","year":"2020","unstructured":"Nina Bindel and John M. Schanck. 2020. Decryption failure is more likely after success. In Proceedings of the 11th International Conference on Post-quantum Cryptography, Jintai Ding and Jean-Pierre Tillich (Eds.). Springer, Cham, 206\u2013225. DOI:10.1007\/978-3-030-44223-1_12"},{"key":"e_1_3_2_17_2","series-title":"LNCS","first-page":"209","volume-title":"Proceedings of the TCC 2016-A","volume":"9562","author":"Bogdanov Andrej","year":"2016","unstructured":"Andrej Bogdanov, Siyao Guo, Daniel Masny, Silas Richelson, and Alon Rosen. 2016. On the hardness of learning with rounding over small modulus. In Proceedings of the TCC 2016-A, Eyal Kushilevitz and Tal Malkin (Eds.). LNCS, Vol. 9562,Springer, Berlin, Heidelberg, 209\u2013224. DOI:10.1007\/978-3-662-49096-9_9"},{"key":"e_1_3_2_18_2","series-title":"LNCS","first-page":"91","volume-title":"Proceedings of the ASIACRYPT 2019","volume":"11922","author":"Bolboceanu Madalina","year":"2019","unstructured":"Madalina Bolboceanu, Zvika Brakerski, Renen Perlman, and Devika Sharma. 2019. Order-LWE and the hardness of ring-LWE with entropic secrets. In Proceedings of the ASIACRYPT 2019, Steven D. Galbraith and Shiho Moriai (Eds.). LNCS, Vol. 11922,Springer, Cham, 91\u2013120. DOI:10.1007\/978-3-030-34621-8_4"},{"key":"e_1_3_2_19_2","first-page":"353","volume-title":"Proceedings of the 2018 IEEE European Symposium on Security and Privacy","author":"Bos J.","year":"2018","unstructured":"J. Bos, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, J. M. Schanck, P. Schwabe, G. Seiler, and D. Stehle. 2018. CRYSTALS - Kyber: A CCA-secure module-lattice-based KEM. In Proceedings of the 2018 IEEE European Symposium on Security and Privacy. 353\u2013367."},{"key":"e_1_3_2_20_2","first-page":"353","volume-title":"Proceedings of the 2018 IEEE European Symposium on Security and Privacy","author":"Bos Joppe W.","year":"2018","unstructured":"Joppe W. Bos, L\u00e9o Ducas, Eike Kiltz, Tancr\u00e8de Lepoint, Vadim Lyubashevsky, John M. Schanck, Peter Schwabe, Gregor Seiler, and Damien Stehl\u00e9. 2018. CRYSTALS - Kyber: A CCA-secure module-lattice-based KEM. In Proceedings of the 2018 IEEE European Symposium on Security and Privacy. IEEE Computer Society Press, 353\u2013367. DOI:10.1109\/EuroSP.2018.00032"},{"key":"e_1_3_2_21_2","first-page":"309","volume-title":"Proceedings of the ITCS 2012","author":"Brakerski Zvika","year":"2012","unstructured":"Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. 2012. (Leveled) fully homomorphic encryption without bootstrapping. In Proceedings of the ITCS 2012, Shafi Goldwasser (Ed.). ACM, 309\u2013325. DOI:10.1145\/2090236.2090262"},{"key":"e_1_3_2_22_2","series-title":"LNCS","first-page":"16","volume-title":"Proceedings of the CHES 2004","volume":"3156","author":"Brier Eric","year":"2004","unstructured":"Eric Brier, Christophe Clavier, and Francis Olivier. 2004. Correlation power analysis with a leakage model. In Proceedings of the CHES 2004, Marc Joye and Jean-Jacques Quisquater (Eds.). LNCS, Vol. 3156,Springer, Berlin16\u201329. DOI:10.1007\/978-3-540-28632-5_2"},{"key":"e_1_3_2_23_2","series-title":"LNCS","first-page":"13","volume-title":"Proceedings of the CHES 2002","volume":"2523","author":"Chari Suresh","year":"2003","unstructured":"Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. 2003. Template attacks. In Proceedings of the CHES 2002, Burton S. Kaliski, Jr., \u00c7etin Kaya Ko\u00e7, and Christof Paar (Eds.). LNCS, Vol. 2523,Springer, Berlin, 13\u201328. DOI:10.1007\/3-540-36400-5_3"},{"key":"e_1_3_2_24_2","series-title":"LNCS","first-page":"1","volume-title":"Proceedings of the ASIACRYPT 2011","volume":"7073","author":"Chen Yuanmi","year":"2011","unstructured":"Yuanmi Chen and Phong Q. Nguyen. 2011. BKZ 2.0: Better lattice security estimates. In Proceedings of the ASIACRYPT 2011, Dong Hoon Lee and Xiaoyun Wang (Eds.). LNCS, Vol. 7073,Springer, Berlin, 1\u201320. DOI:10.1007\/978-3-642-25385-0_1"},{"key":"e_1_3_2_25_2","series-title":"LNCS","first-page":"127","volume-title":"Proceedings of the SAC 2023","volume":"14201","author":"Cheon Jung Hee","year":"2024","unstructured":"Jung Hee Cheon, Hyeongmin Choe, Dongyeon Hong, and MinJune Yi. 2024. SMAUG: Pushing lattice-based key encapsulation mechanisms to the limits. In Proceedings of the SAC 2023, Claude Carlet, Kalikinkar Mandal, and Vincent Rijmen (Eds.). LNCS, Vol. 14201,Springer, Cham, 127\u2013146. DOI:10.1007\/978-3-031-53368-6_7"},{"key":"e_1_3_2_26_2","series-title":"LNCS","first-page":"160","volume-title":"Proceedings of the SCN 18","volume":"11035","author":"Cheon Jung Hee","year":"2018","unstructured":"Jung Hee Cheon, Duhyeong Kim, Joohee Lee, and Yongsoo Song. 2018. Lizard: Cut off the tail! a practical post-quantum public-key encryption from LWE and LWR. In Proceedings of the SCN 18, Dario Catalano and Roberto De Prisco (Eds.). LNCS, Vol. 11035,Springer, Cham, 160\u2013177. DOI:10.1007\/978-3-319-98113-0_9"},{"key":"e_1_3_2_27_2","volume-title":"Lizard","author":"Cheon Jung Hee","year":"2017","unstructured":"Jung Hee Cheon, Sangjoon Park, Joohee Lee, Duhyeong Kim, Yongsoo Song, Seungwan Hong, Dongwoo Kim, Jinsu Kim, Seong-Min Hong, Aaram Yun, et\u00a0al. 2017. Lizard. Technical Report. National Institute of Standards and Technology. Retrieved July 1, 2025 from https:\/\/csrc.nist.gov\/projects\/post-quantum-cryptography\/post-quantum-cryptography-standardization\/round-1-submissions"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2021.i2.159-188"},{"key":"e_1_3_2_29_2","volume-title":"On The Minimum Computation Time of Functions","author":"Cook S.","year":"1966","unstructured":"S. Cook. 1966. On The Minimum Computation Time of Functions. Ph. D. Dissertation. Harvard University."},{"key":"e_1_3_2_30_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"329","DOI":"10.1007\/978-3-030-56880-1_12","volume-title":"Proceedings of the CRYPTO 2020","volume":"12171","author":"Dachman-Soled Dana","year":"2020","unstructured":"Dana Dachman-Soled, L\u00e9o Ducas, Huijing Gong, and M\u00e9lissa Rossi. 2020. LWE with side information: Attacks and concrete security estimation. In Proceedings of the CRYPTO 2020, Daniele Micciancio and Thomas Ristenpart (Eds.). LNCS, Vol. 12171,Springer, Cham, 329\u2013358. DOI:10.1007\/978-3-030-56880-1_12"},{"key":"e_1_3_2_31_2","series-title":"LNCS","first-page":"3","volume-title":"Proceedings of the PKC 2022","volume":"13177","author":"D\u2019Anvers Jan-Pieter","year":"2022","unstructured":"Jan-Pieter D\u2019Anvers and Senne Batsleer. 2022. Multitarget decryption failure attacks and their application to saber and kyber. In Proceedings of the PKC 2022, Goichiro Hanaoka, Junji Shikata, and Yohei Watanabe (Eds.). LNCS, Vol. 13177,Springer, Cham, 3\u201333. DOI:10.1007\/978-3-030-97121-2_1"},{"key":"e_1_3_2_32_2","series-title":"LNCS","first-page":"565","volume-title":"Proceedings of the PKC 2019","volume":"11443","author":"D\u2019Anvers Jan-Pieter","year":"2019","unstructured":"Jan-Pieter D\u2019Anvers, Qian Guo, Thomas Johansson, Alexander Nilsson, Frederik Vercauteren, and Ingrid Verbauwhede. 2019. Decryption failure attacks on IND-CCA secure lattice-based schemes. In Proceedings of the PKC 2019, Dongdai Lin and Kazue Sako (Eds.). LNCS, Vol. 11443,Springer, Cham, 565\u2013598. DOI:10.1007\/978-3-030-17259-6_19"},{"key":"e_1_3_2_33_2","series-title":"LNCS","first-page":"282","volume-title":"Proceedings of the AFRICACRYPT 18","volume":"10831","author":"D\u2019Anvers Jan-Pieter","year":"2018","unstructured":"Jan-Pieter D\u2019Anvers, Angshuman Karmakar, Sujoy Sinha Roy, and Frederik Vercauteren. 2018. Saber: Module-LWR based key exchange, CPA-secure encryption and CCA-secure KEM. In Proceedings of the AFRICACRYPT 18, Antoine Joux, Abderrahmane Nitaj, and Tajjeeddine Rachidi (Eds.). LNCS, Vol. 10831,Springer, Cham, 282\u2013305. DOI:10.1007\/978-3-319-89339-6_16"},{"key":"e_1_3_2_34_2","volume-title":"SABER","author":"D\u2019Anvers Jan-Pieter","year":"2020","unstructured":"Jan-Pieter D\u2019Anvers, Angshuman Karmakar, Sujoy Sinha Roy, Frederik Vercauteren, Jose Maria Bermudo Mera, Michiel Van Beirendonck, and Andrea Basso. 2020. SABER. Technical Report. National Institute of Standards and Technology. Retrieved July 1, 2025 from https:\/\/csrc.nist.gov\/projects\/post-quantum-cryptography\/post-quantum-cryptography-standardization\/round-3-submissions"},{"key":"e_1_3_2_35_2","series-title":"LNCS","first-page":"3","volume-title":"Proceedings of the EUROCRYPT 2020","volume":"12107","author":"D\u2019Anvers Jan-Pieter","year":"2020","unstructured":"Jan-Pieter D\u2019Anvers, M\u00e9lissa Rossi, and Fernando Virdia. 2020. (One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes. In Proceedings of the EUROCRYPT 2020, Anne Canteaut and Yuval Ishai (Eds.). LNCS, Vol. 12107, Springer, Cham, 3\u201333. DOI:10.1007\/978-3-030-45727-3_1"},{"key":"e_1_3_2_36_2","article-title":"Saber: Module-LWR Based Key Exchange, CPA-Secure Encryption and CCA-Secure KEM","author":"D\u2019Anvers Jan-Pieter","year":"2018","unstructured":"Jan-Pieter D\u2019Anvers, Angshuman Karmakar Sujoy Sinha Roy, and Frederik Vercauteren. 2018. Saber: Module-LWR Based Key Exchange, CPA-Secure Encryption and CCA-Secure KEM. Cryptology ePrint Archive, Report 2018\/230. Retrieved from https:\/\/eprint.iacr.org\/2018\/230","journal-title":"Cryptology ePrint Archive, Report 2018\/230"},{"key":"e_1_3_2_37_2","first-page":"2","volume-title":"Proceedings of the Workshop on Theory of Implementation Security Workshop.","author":"D\u2019Anvers Jan-Pieter","year":"2019","unstructured":"Jan-Pieter D\u2019Anvers, Marcel Tiepelt, Frederik Vercauteren, and Ingrid Verbauwhede. 2019. Timing attacks on error correcting codes in post-quantum schemes. In Proceedings of the Workshop on Theory of Implementation Security Workshop.Association for Computing Machinery, New York, NY, USA, 2\u20139. DOI:10.1145\/3338467.3358948"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","unstructured":"Jan-Pieter D\u2019Anvers Frederik Vercauteren and Ingrid Verbauwhede. 2019. The impact of error dependencies on ring\/Mod-LWE\/LWR based schemes. In Proceedings of the 10th International Conference on Post-Quantum Cryptography Jintai Ding and Rainer Steinwandt (Eds.). Springer Cham 103\u2013115. DOI:10.1007\/978-3-030-25510-7_6","DOI":"10.1007\/978-3-030-25510-7_6"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.13154\/tches.v2018.i1.238-268"},{"key":"e_1_3_2_40_2","first-page":"2722","volume-title":"Proceedings of the ACM CCS 2021","author":"Duman Julien","year":"2021","unstructured":"Julien Duman, Kathrin H\u00f6velmanns, Eike Kiltz, Vadim Lyubashevsky, and Gregor Seiler. 2021. Faster lattice-based KEMs via a generic fujisaki-okamoto transform using prefix hashing. In Proceedings of the ACM CCS 2021, Giovanni Vigna and Elaine Shi (Eds.). ACM,2722\u20132737. DOI:10.1145\/3460120.3484819"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2022.i1.414-460"},{"key":"e_1_3_2_42_2","series-title":"LNCS","first-page":"537","volume-title":"Proceedings of the CRYPTO\u201999","volume":"1666","author":"Fujisaki Eiichiro","year":"1999","unstructured":"Eiichiro Fujisaki and Tatsuaki Okamoto. 1999. Secure integration of asymmetric and symmetric encryption schemes. In Proceedings of the CRYPTO\u201999, Michael J. Wiener (Ed.). LNCS, Vol. 1666,Springer, Berlin, 537\u2013554. DOI:10.1007\/3-540-48405-1_34"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-011-9114-1"},{"key":"e_1_3_2_44_2","series-title":"LNCS","first-page":"89","volume-title":"Proceedings of the PKC 2007","volume":"4450","author":"Gama Nicolas","year":"2007","unstructured":"Nicolas Gama and Phong Q. Nguyen. 2007. New chosen-ciphertext attacks on NTRU. In Proceedings of the PKC 2007, Tatsuaki Okamoto and Xiaoyun Wang (Eds.). LNCS, Vol. 4450, Springer, Berlin, 89\u2013106. DOI:10.1007\/978-3-540-71677-8_7"},{"key":"e_1_3_2_45_2","series-title":"LNCS","first-page":"257","volume-title":"Proceedings of the EUROCRYPT 2010","volume":"6110","author":"Gama Nicolas","year":"2010","unstructured":"Nicolas Gama, Phong Q. Nguyen, and Oded Regev. 2010. Lattice enumeration using extreme pruning. In Proceedings of the EUROCRYPT 2010, Henri Gilbert (Ed.). LNCS, Vol. 6110,Springer, Berlin, 257\u2013278. DOI:10.1007\/978-3-642-13190-5_13"},{"key":"e_1_3_2_46_2","series-title":"LNCS","first-page":"359","volume-title":"Proceedings of the CRYPTO 2020","volume":"12171","author":"Guo Qian","year":"2020","unstructured":"Qian Guo, Thomas Johansson, and Alexander Nilsson. 2020. A key-recovery timing attack on post-quantum primitives using the Fujisaki-Okamoto transformation and its application on FrodoKEM. In Proceedings of the CRYPTO 2020, Daniele Micciancio and Thomas Ristenpart (Eds.). LNCS, Vol. 12171,Springer, Cham, 359\u2013386. DOI:10.1007\/978-3-030-56880-1_13"},{"key":"e_1_3_2_47_2","series-title":"LNCS","first-page":"82","volume-title":"Proceedings of the ASIACRYPT 2019","volume":"11921","author":"Guo Qian","year":"2019","unstructured":"Qian Guo, Thomas Johansson, and Jing Yang. 2019. A novel CCA attack using decryption errors against LAC. In Proceedings of the ASIACRYPT 2019, Steven D. Galbraith and Shiho Moriai (Eds.). LNCS, Vol. 11921,Springer, Cham, 82\u2013111. DOI:10.1007\/978-3-030-34578-5_4"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3511346"},{"key":"e_1_3_2_49_2","series-title":"LNCS","first-page":"341","volume-title":"Proceedings of the TCC 2017","volume":"10677","author":"Hofheinz Dennis","year":"2017","unstructured":"Dennis Hofheinz, Kathrin H\u00f6velmanns, and Eike Kiltz. 2017. A modular analysis of the Fujisaki-Okamoto transformation. In Proceedings of the TCC 2017, Yael Kalai and Leonid Reyzin (Eds.). LNCS, Vol. 10677,Springer, Cham, 341\u2013371. DOI:10.1007\/978-3-319-70500-2_12"},{"key":"e_1_3_2_50_2","series-title":"LNCS","first-page":"414","volume-title":"Proceedings of the ASIACRYPT 2022","volume":"13794","author":"H\u00f6velmanns Kathrin","year":"2022","unstructured":"Kathrin H\u00f6velmanns, Andreas H\u00fclsing, and Christian Majenz. 2022. Failing gracefully: Decryption failures and the Fujisaki-Okamoto transform. In Proceedings of the ASIACRYPT 2022, Shweta Agrawal and Dongdai Lin (Eds.). LNCS, Vol. 13794,Springer, Cham, 414\u2013443. DOI:10.1007\/978-3-031-22972-5_15"},{"key":"e_1_3_2_51_2","series-title":"LNCS","first-page":"389","volume-title":"Proceedings of the PKC 2020","volume":"12111","author":"H\u00f6velmanns Kathrin","year":"2020","unstructured":"Kathrin H\u00f6velmanns, Eike Kiltz, Sven Sch\u00e4ge, and Dominique Unruh. 2020. Generic authenticated key exchange in the quantum random oracle model. In Proceedings of the PKC 2020, Aggelos Kiayias, Markulf Kohlweiss, Petros Wallden, and Vassilis Zikas (Eds.). LNCS, Vol. 12111, Springer, Cham, 389\u2013422. DOI:10.1007\/978-3-030-45388-6_14"},{"key":"e_1_3_2_52_2","doi-asserted-by":"crossref","first-page":"245","DOI":"10.1007\/978-3-031-62746-0_11","volume-title":"Proceedings of the International Conference on Post-Quantum Cryptography","author":"H\u00f6velmanns Kathrin","year":"2024","unstructured":"Kathrin H\u00f6velmanns and Christian Majenz. 2024. A note on failing gracefully: Completing the picture for explicitly rejecting Fujisaki-Okamoto transforms using worst-case correctness. In Proceedings of the International Conference on Post-Quantum Cryptography, Markku-Juhani Saarinen and Daniel Smith-Tone (Eds.). Springer, Cham, 245\u2013265. DOI:10.1007\/978-3-031-62746-0_11"},{"key":"e_1_3_2_53_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"226","DOI":"10.1007\/978-3-540-45146-4_14","volume-title":"Proceedings of the CRYPTO 2003","volume":"2729","author":"Howgrave-Graham Nick","year":"2003","unstructured":"Nick Howgrave-Graham, Phong Q. Nguyen, David Pointcheval, John Proos, Joseph H. Silverman, Ari Singer, and William Whyte. 2003. The impact of decryption failures on the security of NTRU encryption. In Proceedings of the CRYPTO 2003, Dan Boneh (Ed.). LNCS, Vol. 2729,Springer, Berlin, 226\u2013246. DOI:10.1007\/978-3-540-45146-4_14"},{"key":"e_1_3_2_54_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"622","DOI":"10.1007\/978-3-031-15802-5_22","volume-title":"Proceedings of the CRYPTO 2022","volume":"13507","author":"H\u00fclsing Andreas","year":"2022","unstructured":"Andreas H\u00fclsing, Matthias Meijers, and Pierre-Yves Strub. 2022. Formal verification of saber\u2019s public-key encryption scheme in EasyCrypt. In Proceedings of the CRYPTO 2022, Yevgeniy Dodis and Thomas Shrimpton (Eds.). LNCS, Vol. 13507,Springer, Cham, 622\u2013653. DOI:10.1007\/978-3-031-15802-5_22"},{"key":"e_1_3_2_55_2","unstructured":"Institute of Commercial Cryptography Standards (ICCS). 2025. Evaluation Criteria for Public-Key Cryptographic Algorithms. Retrieved July 1 2025 from https:\/\/www.niccs.org.cn\/niccs\/Notice\/1975896137741635584\/tT7TSQiz.pdf"},{"key":"e_1_3_2_56_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1007\/3-540-44598-6_2","volume-title":"Proceedings of the CRYPTO 2000","volume":"1880","author":"Jaulmes \u00c9liane","year":"2000","unstructured":"\u00c9liane Jaulmes and Antoine Joux. 2000. A chosen-ciphertext attack against NTRU. In Proceedings of the CRYPTO 2000, Mihir Bellare (Ed.). LNCS, Vol. 1880, Springer, Berlin, 20\u201335. DOI:10.1007\/3-540-44598-6_2"},{"key":"e_1_3_2_57_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1007\/978-3-319-96878-0_4","volume-title":"Proceedings of the CRYPTO 2018","volume":"10993","author":"Jiang Haodong","year":"2018","unstructured":"Haodong Jiang, Zhenfeng Zhang, Long Chen, Hong Wang, and Zhi Ma. 2018. IND-CCA-secure key encapsulation mechanism in the quantum random oracle model, revisited. In Proceedings of the CRYPTO 2018, Hovav Shacham and Alexandra Boldyreva (Eds.). LNCS, Vol. 10993,Springer, Cham, 96\u2013125. DOI:10.1007\/978-3-319-96878-0_4"},{"key":"e_1_3_2_58_2","article-title":"pqm4: Benchmarking NIST Additional Post-Quantum Signature Schemes on Microcontrollers","author":"Kannwischer Matthias J.","year":"2024","unstructured":"Matthias J. Kannwischer, Markus Krausz, Richard Petri, and Shang-Yi Yang. 2024. pqm4: Benchmarking NIST Additional Post-Quantum Signature Schemes on Microcontrollers. Cryptology ePrint Archive, Report 2024\/112. Retrieved July 1, 2025 from https:\/\/eprint.iacr.org\/2024\/112","journal-title":"Cryptology ePrint Archive, Report 2024\/112"},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.13154\/tches.v2020.i3.243-268"},{"key":"e_1_3_2_60_2","unstructured":"Matthias J. Kannwischer Richard Petri Joost Rijneveld Peter Schwabe and Ko Stoffelen. [n. d.]. PQM4: Post-quantum crypto library for the ARM Cortex-M4. Retrieved July 1 2025 from https:\/\/github.com\/mupq\/pqm4"},{"key":"e_1_3_2_61_2","article-title":"pqm4: Testing and Benchmarking NIST PQC on ARM Cortex-M4","author":"Kannwischer Matthias J.","year":"2019","unstructured":"Matthias J. Kannwischer, Joost Rijneveld, Peter Schwabe, and Ko Stoffelen. 2019. pqm4: Testing and Benchmarking NIST PQC on ARM Cortex-M4. Cryptology ePrint Archive, Report 2019\/844. Retrieved July 1, 2025 from https:\/\/eprint.iacr.org\/2019\/844","journal-title":"Cryptology ePrint Archive, Report 2019\/844"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.13154\/TCHES.V2018.I3.243-266"},{"key":"e_1_3_2_63_2","doi-asserted-by":"crossref","first-page":"203","DOI":"10.1090\/S0025-5718-1987-0866109-5","article-title":"Elliptic curve cryptosystems","volume":"48","author":"Koblitz N.","year":"1987","unstructured":"N. Koblitz. 1987. Elliptic curve cryptosystems. Mathematics of Computation 48 (1987), 203\u2013209.","journal-title":"Mathematics of Computation"},{"key":"e_1_3_2_64_2","series-title":"LNCS","first-page":"388","volume-title":"Proceedings of the CRYPTO\u201999","volume":"1666","author":"Kocher Paul C.","year":"1999","unstructured":"Paul C. Kocher, Joshua Jaffe, and Benjamin Jun. 1999. Differential power analysis. In Proceedings of the CRYPTO\u201999, Michael J. Wiener (Ed.). LNCS, Vol. 1666,Springer, Berlin, 388\u2013397. DOI:10.1007\/3-540-48405-1_25"},{"key":"e_1_3_2_65_2","series-title":"LNCS","first-page":"703","volume-title":"Proceedings of the EUROCRYPT 2020","volume":"12107","author":"Kuchta Veronika","year":"2020","unstructured":"Veronika Kuchta, Amin Sakzad, Damien Stehl\u00e9, Ron Steinfeld, and Shifeng Sun. 2020. Measure-rewind-measure: Tighter quantum random oracle model proofs for one-way to hiding and CCA security. In Proceedings of the EUROCRYPT 2020, Anne Canteaut and Yuval Ishai (Eds.). LNCS, Vol. 12107,Springer, Cham, 703\u2013728. DOI:10.1007\/978-3-030-45727-3_24"},{"key":"e_1_3_2_66_2","series-title":"LNCS","first-page":"93","volume-title":"Proceedings of the SCN 22","volume":"13409","author":"Kundu Suparna","year":"2022","unstructured":"Suparna Kundu, Jan-Pieter D\u2019Anvers, Michiel van Beirendonck, Angshuman Karmakar, and Ingrid Verbauwhede. 2022. Higher-order masked saber. In Proceedings of the SCN 22, Clemente Galdi and Stanislaw Jarecki (Eds.). LNCS, Vol. 13409,Springer, Cham, 93\u2013116. DOI:10.1007\/978-3-031-14791-3_5"},{"key":"e_1_3_2_67_2","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"162","DOI":"10.1007\/978-3-031-51583-5_10","volume-title":"Proceedings of the 13th International Conference on Security, Privacy, and Applied Cryptography Engineering","volume":"14412","author":"Kundu Suparna","year":"2023","unstructured":"Suparna Kundu, Angshuman Karmakar, and Ingrid Verbauwhede. 2023. On the masking-friendly designs for post-quantum cryptography. In Proceedings of the 13th International Conference on Security, Privacy, and Applied Cryptography Engineering, Francesco Regazzoni, Bodhisatwa Mazumdar, and Sri Parameswaran (Eds.). Lecture Notes in Computer Science, Vol. 14412, Springer, 162\u2013184. DOI:10.1007\/978-3-031-51583-5_10"},{"key":"e_1_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.1145\/3696208"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10623-014-9938-4"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-001-0009-4"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2022.i4.285-310"},{"key":"e_1_3_2_72_2","series-title":"LNCS","first-page":"55","volume-title":"Proceedings of the SAC 2011","volume":"7118","author":"Loftus Jake","year":"2012","unstructured":"Jake Loftus, Alexander May, Nigel P. Smart, and Frederik Vercauteren. 2012. On CCA-secure somewhat homomorphic encryption. In Proceedings of the SAC 2011, Ali Miri and Serge Vaudenay (Eds.). LNCS, Vol. 7118,Springer, Berlin, 55\u201372. DOI:10.1007\/978-3-642-28496-0_4"},{"key":"e_1_3_2_73_2","volume-title":"LAC","author":"Lu Xianhui","year":"2019","unstructured":"Xianhui Lu, Yamin Liu, Dingding Jia, Haiyang Xue, Jingnan He, Zhenfei Zhang, Zhe Liu, Hao Yang, Bao Li, and Kunpeng Wang. 2019. LAC. Technical Report. National Institute of Standards and Technology. Retrieved July 1, 2025 from https:\/\/csrc.nist.gov\/projects\/post-quantum-cryptography\/post-quantum-cryptography-standardization\/round-2-submissions"},{"key":"e_1_3_2_74_2","series-title":"LNCS","first-page":"1","volume-title":"Proceedings of the EUROCRYPT 2010","volume":"6110","author":"Lyubashevsky Vadim","year":"2010","unstructured":"Vadim Lyubashevsky, Chris Peikert, and Oded Regev. 2010. On ideal lattices and learning with errors over rings. In Proceedings of the EUROCRYPT 2010, Henri Gilbert (Ed.). LNCS, Vol. 6110, Springer, Berlin, 1\u201323. DOI:10.1007\/978-3-642-13190-5_1"},{"key":"e_1_3_2_75_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2021.i4.474-509"},{"key":"e_1_3_2_76_2","first-page":"1","volume-title":"Proceedings of the 57th ACM\/IEEE Design Automation Conference","author":"Mera Jose Maria Bermudo","year":"2020","unstructured":"Jose Maria Bermudo Mera, Furkan Turan, Angshuman Karmakar, Sujoy Sinha Roy, and Ingrid Verbauwhede. 2020. Compact domain-specific co-processor for accelerating module lattice-based KEM. In Proceedings of the 57th ACM\/IEEE Design Automation Conference. IEEE, 1\u20136. DOI:10.1109\/DAC18072.2020.9218727"},{"key":"e_1_3_2_77_2","series-title":"LNCS","first-page":"238","volume-title":"Proceedings of the CHES 2000","volume":"1965","author":"Messerges Thomas S.","year":"2000","unstructured":"Thomas S. Messerges. 2000. Using second-order power analysis to attack DPA resistant software. In Proceedings of the CHES 2000, \u00c7etin Kaya Ko\u00e7 and Christof Paar (Eds.). LNCS, Vol. 1965,Springer, Berlin, 238\u2013251. DOI:10.1007\/3-540-44499-8_19"},{"key":"e_1_3_2_78_2","first-page":"92","volume-title":"Proceedings of the 39th FOCS","author":"Micciancio Daniele","year":"1998","unstructured":"Daniele Micciancio. 1998. The shortest vector in a lattice is hard to approximate to within some constant. In Proceedings of the 39th FOCS. IEEE Computer Society Press, 92\u201398. DOI:10.1109\/SFCS.1998.743432"},{"key":"e_1_3_2_79_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"344","DOI":"10.1007\/978-3-030-21568-2_17","volume-title":"Proceedings of the ACNS 19th International Conference on Applied Cryptography and Network Security","volume":"11464","author":"Migliore Vincent","year":"2019","unstructured":"Vincent Migliore, Beno\u00eet G\u00e9rard, Mehdi Tibouchi, and Pierre-Alain Fouque. 2019. Masking dilithium - efficient implementation and side-channel evaluation. In Proceedings of the ACNS 19th International Conference on Applied Cryptography and Network Security, Robert H. Deng, Val\u00e9rie Gauthier-Uma\u00f1a, Mart\u00edn Ochoa, and Moti Yung (Eds.). LNCS, Vol. 11464,Springer, Cham, 344\u2013362. DOI:10.1007\/978-3-030-21568-2_17"},{"key":"e_1_3_2_80_2","series-title":"LNCS","first-page":"417","volume-title":"Proceedings of the CRYPTO\u201985","volume":"218","author":"Miller Victor S.","year":"1986","unstructured":"Victor S. Miller. 1986. Use of elliptic curves in cryptography. In Proceedings of the CRYPTO\u201985, Hugh C. Williams (Ed.). LNCS, Vol. 218, Springer, Berlin, 417\u2013426. DOI:10.1007\/3-540-39799-X_31"},{"key":"e_1_3_2_81_2","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.FIPS.203"},{"key":"e_1_3_2_82_2","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.FIPS.204"},{"key":"e_1_3_2_83_2","doi-asserted-by":"publisher","DOI":"10.1145\/3569420"},{"key":"e_1_3_2_84_2","doi-asserted-by":"publisher","DOI":"10.1145\/3569420"},{"key":"e_1_3_2_85_2","volume-title":"Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process","author":"Technology National Institute of Standards and","year":"2016","unstructured":"National Institute of Standards and Technology. 2016. Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process. Call for Proposals. National Institute of Standards and Technology (NIST). Retrieved July 1, 2025 from https:\/\/csrc.nist.gov\/CSRC\/media\/Projects\/Post-Quantum-Cryptography\/documents\/call-for-proposals-final-dec-2016.pdf"},{"key":"e_1_3_2_86_2","unstructured":"National Institute of Standards and Technology. 2016. Submission Requirements and Evaluation Criteria for the Post-quantum Cryptography Standardization Process. Retrieved July 1 2025 from https:\/\/csrc.nist.gov\/CSRC\/media\/Projects\/Post-Quantum-Cryptography\/documents\/call-for-proposals-final-dec-2016.pdf"},{"key":"e_1_3_2_87_2","volume-title":"Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process","author":"Technology National Institute of Standards and","year":"2022","unstructured":"National Institute of Standards and Technology. 2022. Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process. Call for Proposals. National Institute of Standards and Technology (NIST). Retrieved from https:\/\/csrc.nist.gov\/csrc\/media\/Projects\/pqc-dig-sig\/documents\/call-for-proposals-dig-sig-sept-2022.pdf"},{"key":"e_1_3_2_88_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"805","DOI":"10.1007\/978-3-031-38554-4_26","volume-title":"Proceedings of the CRYPTO 2023","volume":"14085","author":"Newton Parker","year":"2023","unstructured":"Parker Newton and Silas Richelson. 2023. A lower bound for proving hardness of learning with rounding with polynomial modulus. In Proceedings of the CRYPTO 2023, Helena Handschuh and Anna Lysyanskaya (Eds.). LNCS, Vol. 14085,Springer, Cham, 805\u2013835. DOI:10.1007\/978-3-031-38554-4_26"},{"key":"e_1_3_2_89_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2021.i4.676-707"},{"key":"e_1_3_2_90_2","first-page":"51","volume-title":"Proceedings of the 5th Workshop on Attacks and Solutions in Hardware Security.","author":"Ngo Kalle","year":"2021","unstructured":"Kalle Ngo, Elena Dubrova, and Thomas Johansson. 2021. Breaking masked and shuffled CCA secure saber KEM by power analysis. In Proceedings of the 5th Workshop on Attacks and Solutions in Hardware Security.Association for Computing Machinery, New York, NY, USA, 51\u201361. DOI:10.1145\/3474376.3487277"},{"key":"e_1_3_2_91_2","article-title":"Side-Channel Attacks on Lattice-Based KEMs Are Not Prevented by Higher-Order Masking","author":"Ngo Kalle","year":"2022","unstructured":"Kalle Ngo, Ruize Wang, Elena Dubrova, and Nils Paulsrud. 2022. Side-Channel Attacks on Lattice-Based KEMs Are Not Prevented by Higher-Order Masking. Cryptology ePrint Archive, Report 2022\/919. Retrieved July 1, 2025 from https:\/\/eprint.iacr.org\/2022\/919","journal-title":"Cryptology ePrint Archive, Report 2022\/919"},{"key":"e_1_3_2_92_2","doi-asserted-by":"publisher","DOI":"10.13154\/tches.v2018.i1.142-174"},{"key":"e_1_3_2_93_2","series-title":"LNCS","first-page":"73","volume-title":"Proceedings of the ICICS 20","volume":"11999","author":"Okada Hiroki","year":"2020","unstructured":"Hiroki Okada, Atsushi Takayasu, Kazuhide Fukushima, Shinsaku Kiyomoto, and Tsuyoshi Takagi. 2020. A compact digital signature scheme based on the module-LWR problem. In Proceedings of the ICICS 20, Weizhi Meng, Dieter Gollmann, Christian Damsgaard Jensen, and Jianying Zhou (Eds.). LNCS, Vol. 11999,Springer, Cham, 73\u201390. DOI:10.1007\/978-3-030-61078-4_5"},{"key":"e_1_3_2_94_2","article-title":"TiGER: Tiny bandwidth key encapsulation mechanism for easy miGration based on RLWE(R)","author":"Park Seunghwan","year":"2022","unstructured":"Seunghwan Park, Chi-Gon Jung, Aesun Park, Joongeun Choi, and Honggoo Kang. 2022. TiGER: Tiny bandwidth key encapsulation mechanism for easy miGration based on RLWE(R). Cryptology ePrint Archive, Report 2022\/1651. Retrieved from https:\/\/eprint.iacr.org\/2022\/1651","journal-title":"Cryptology ePrint Archive, Report 2022\/1651"},{"key":"e_1_3_2_95_2","doi-asserted-by":"publisher","DOI":"10.1561\/0400000074"},{"key":"e_1_3_2_96_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-024-09508-3"},{"issue":"114","key":"e_1_3_2_97_2","doi-asserted-by":"crossref","first-page":"365","DOI":"10.1090\/S0025-5718-1971-0301966-0","article-title":"The fast Fourier transform in a finite field","volume":"25","author":"Pollard John M.","year":"1971","unstructured":"John M. Pollard. 1971. The fast Fourier transform in a finite field. Mathematics of Computation 25, 114 (1971), 365\u2013374.","journal-title":"Mathematics of Computation"},{"key":"e_1_3_2_98_2","doi-asserted-by":"crossref","first-page":"317","DOI":"10.26421\/QIC3.4-3","article-title":"Shor\u2019s discrete logarithm quantum algorithm for elliptic curves","volume":"3","author":"Proos J.","year":"2003","unstructured":"J. Proos and C. Zalka. 2003. Shor\u2019s discrete logarithm quantum algorithm for elliptic curves. Quantum Information and Computation 3 (2003), 317\u2013344. Retrieved from https:\/\/cds.cern.ch\/record\/602816","journal-title":"Quantum Information and Computation"},{"key":"e_1_3_2_99_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2023.i2.418-446"},{"key":"e_1_3_2_100_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3139268"},{"key":"e_1_3_2_101_2","doi-asserted-by":"publisher","DOI":"10.1145\/3603170"},{"key":"e_1_3_2_102_2","doi-asserted-by":"publisher","DOI":"10.13154\/tches.v2020.i3.307-335"},{"key":"e_1_3_2_103_2","first-page":"84","volume-title":"Proceedings of the 37th ACM STOC","author":"Regev Oded","year":"2005","unstructured":"Oded Regev. 2005. On lattices, learning with errors, random linear codes, and cryptography. In Proceedings of the 37th ACM STOC, Harold N. Gabow and Ronald Fagin (Eds.). ACM.84\u201393. DOI:10.1145\/1060590.1060603"},{"key":"e_1_3_2_104_2","first-page":"191","volume-title":"Proceedings of the IEEE Conference on Computational Complexity","author":"Regev Oded","year":"2010","unstructured":"Oded Regev. 2010. The learning with errors problem (invited survey). In Proceedings of the IEEE Conference on Computational Complexity. 191\u2013204. DOI:10.1109\/CCC.2010.26"},{"key":"e_1_3_2_105_2","series-title":"LNCS","first-page":"683","volume-title":"Proceedings of the CHES 2015","volume":"9293","author":"Reparaz Oscar","year":"2015","unstructured":"Oscar Reparaz, Sujoy Sinha Roy, Frederik Vercauteren, and Ingrid Verbauwhede. 2015. A masked ring-LWE implementation. In Proceedings of the CHES 2015, Tim G\u00fcneysu and Helena Handschuh (Eds.). LNCS, Vol. 9293,Springer, Berlin, 683\u2013702. DOI:10.1007\/978-3-662-48324-4_34"},{"key":"e_1_3_2_106_2","doi-asserted-by":"publisher","DOI":"10.1145\/359340.359342"},{"key":"e_1_3_2_107_2","series-title":"LNCS","doi-asserted-by":"crossref","first-page":"283","DOI":"10.1007\/978-3-319-63697-9_10","volume-title":"Proceedings of the CRYPTO 2017","volume":"10403","author":"Rosca Miruna","year":"2017","unstructured":"Miruna Rosca, Amin Sakzad, Damien Stehl\u00e9, and Ron Steinfeld. 2017. Middle-product learning with errors. In Proceedings of the CRYPTO 2017, Jonathan Katz and Hovav Shacham (Eds.). LNCS, Vol. 10403,Springer, Cham, 283\u2013297. DOI:10.1007\/978-3-319-63697-9_10"},{"key":"e_1_3_2_108_2","series-title":"LNCS","first-page":"146","volume-title":"Proceedings of the EUROCRYPT 2018","volume":"10820","author":"Rosca Miruna","year":"2018","unstructured":"Miruna Rosca, Damien Stehl\u00e9, and Alexandre Wallet. 2018. On the ring-LWE and polynomial-LWE problems. In Proceedings of the EUROCRYPT 2018, Jesper Buus Nielsen and Vincent Rijmen (Eds.). LNCS, Vol. 10820,Springer, Cham, 146\u2013173. DOI:10.1007\/978-3-319-78381-9_6"},{"key":"e_1_3_2_109_2","doi-asserted-by":"publisher","DOI":"10.13154\/TCHES.V2020.I4.443-466"},{"key":"e_1_3_2_110_2","series-title":"LNCS","first-page":"520","volume-title":"Proceedings of the EUROCRYPT 2018","volume":"10822","author":"Saito Tsunekazu","year":"2018","unstructured":"Tsunekazu Saito, Keita Xagawa, and Takashi Yamakawa. 2018. Tightly-secure key-encapsulation mechanism in the quantum random oracle model. In Proceedings of the EUROCRYPT 2018, Jesper Buus Nielsen and Vincent Rijmen (Eds.). LNCS, Vol. 10822,Springer, Cham, 520\u2013551. DOI:10.1007\/978-3-319-78372-7_17"},{"key":"e_1_3_2_111_2","doi-asserted-by":"publisher","DOI":"10.1007\/BF01581144"},{"key":"e_1_3_2_112_2","first-page":"124","volume-title":"Proceedings of the 35th FOCS","author":"Shor Peter W.","year":"1994","unstructured":"Peter W. Shor. 1994. Algorithms for quantum computation: Discrete logarithms and factoring. In Proceedings of the 35th FOCS. IEEE Computer Society Press, 124\u2013134. DOI:10.1109\/SFCS.1994.365700"},{"key":"e_1_3_2_113_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3029521"},{"key":"e_1_3_2_114_2","doi-asserted-by":"crossref","first-page":"617","DOI":"10.1007\/978-3-642-10366-7_36","volume-title":"Proceedings of the ASIACRYPT 2009","author":"Stehl\u00e9 Damien","year":"2009","unstructured":"Damien Stehl\u00e9, Ron Steinfeld, Keisuke Tanaka, and Keita Xagawa. 2009. Efficient public key encryption based on ideal lattices. In Proceedings of the ASIACRYPT 2009, Mitsuru Matsui (Ed.). Springer, Berlin, 617\u2013635. DOI:10.1007\/978-3-642-10366-7_36"},{"key":"e_1_3_2_115_2","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2023.i3.473-503"},{"key":"e_1_3_2_116_2","unstructured":"A. Toom. 1963. The complexity of a scheme of functional elements realizing the multiplication of integers. Soviet Mathematics-Doklady. 7 (1963) 714\u2013716."},{"key":"e_1_3_2_117_2","article-title":"Another NP-complete problem and the complexity of computing short vectors in a lattice","author":"Boas Peter van Emde","year":"1981","unstructured":"Peter van Emde Boas. 1981. Another NP-complete problem and the complexity of computing short vectors in a lattice. Tecnical Report, Department of Mathmatics, University of Amsterdam (1981).","journal-title":"Tecnical Report, Department of Mathmatics, University of Amsterdam"},{"key":"e_1_3_2_118_2","article-title":"Making Biased DL Models Work: Message and Key Recovery Attacks on Saber Using Amplitude-Modulated EM Emanations","author":"Wang Ruize","year":"2022","unstructured":"Ruize Wang, Kalle Ngo, and Elena Dubrova. 2022. Making Biased DL Models Work: Message and Key Recovery Attacks on Saber Using Amplitude-Modulated EM Emanations. Cryptology ePrint Archive, Paper 2022\/852. Retrieved from https:\/\/eprint.iacr.org\/2022\/852","journal-title":"Cryptology ePrint Archive, Paper 2022\/852"},{"key":"e_1_3_2_119_2","first-page":"488","volume-title":"Proceedings of the Conference on Digital System Design","author":"Wang Ruize","year":"2022","unstructured":"Ruize Wang, Kalle Ngo, and Elena Dubrova. 2022. Side-channel analysis of Saber KEM using amplitude-modulated EM emanations. In Proceedings of the Conference on Digital System Design. 488\u2013495. DOI:10.1109\/DSD57027.2022.00071"},{"key":"e_1_3_2_120_2","series-title":"LNCS","first-page":"196","volume-title":"Proceedings of the CT-RSA 2022","volume":"13161","author":"Wu Han","year":"2022","unstructured":"Han Wu and Guangwu Xu. 2022. More accurate geometric analysis on the impact of successful decryptions for IND-CCA secure Ring\/Mod-LWE\/LWR based schemes. In Proceedings of the CT-RSA 2022, Steven D. Galbraith (Ed.). LNCS, Vol. 13161,Springer, Cham, 196\u2013222. DOI:10.1007\/978-3-030-95312-6_9"},{"key":"e_1_3_2_121_2","series-title":"LNCS","first-page":"1","volume-title":"Proceedings of the SCN 12","volume":"7485","author":"Xie Xiang","year":"2012","unstructured":"Xiang Xie, Rui Xue, and Rui Zhang. 2012. Deterministic public key encryption and identity-based encryption from lattices in the auxiliary-input setting. In Proceedings of the SCN 12, Ivan Visconti and Roberto De Prisco (Eds.). LNCS, Vol. 7485,Springer, Berlin, 1\u201318. DOI:10.1007\/978-3-642-32928-9_1"},{"key":"e_1_3_2_122_2","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2021.3122997"}],"container-title":["ACM Transactions on Embedded Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3807514","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T12:00:40Z","timestamp":1783512040000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3807514"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,8]]},"references-count":121,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2026,7,31]]}},"alternative-id":["10.1145\/3807514"],"URL":"https:\/\/doi.org\/10.1145\/3807514","relation":{},"ISSN":["1539-9087","1558-3465"],"issn-type":[{"value":"1539-9087","type":"print"},{"value":"1558-3465","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,8]]},"assertion":[{"value":"2025-09-19","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-03-30","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-07-08","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}