Introduction
The concept of NTRU was introduced in 1996 by Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman. Since its inception, it has undergone significant development by numerous researchers, resulting in multiple variants. The NTRU Key Encapsulation Mechanism (KEM) outlined in this document is based on the Round 3 submission of NIST’s Post-Quantum Cryptography project. The term NTRU, in this context, refers to the specific variants on which the KEM is based—namely, NTRU-HPS and NTRU-HRSS. NTRU is constructed using a generic transformation from a deterministic public key encryption (DPKE) scheme into a KEM, achieving a tight IND-CCA security proof in both classical and quantum random oracle model.