Reducing ML-KEM-768 encapsulation key sizes by 24 octets
The article discusses a method to reduce the size of ML-KEM-768 public keys by 24 octets through coefficient compression, improving efficiency in network transmission. By packing groups of four coefficients into fewer bits using arithmetic encoding, the key size is reduced from 1184 to 1160 octets. This technique draws from prior work on NTRU Prime and aims to optimize post-quantum cryptographic key transmission within constrained packet sizes.
- ▪ML-KEM-768 public keys are 1184 octets long, leaving limited space in IPv6 UDP packets with a 1280-octet minimum MTU.
- ▪Each coefficient in the key uses 12 bits, but since log₂(3329) ≈ 11.7, about 0.3 bits per coefficient are wasted.
- ▪The proposed method compresses groups of 4 coefficients into 47 bits, reducing the total key size by 24 octets to 1160.
- ▪The compression technique is based on methods described in 'NTRU Prime: reducing attack surface at low cost' (eprint 2016/461).
- ▪While larger compression is possible with groups of 24, groups of 4 are used for simpler and safer implementation.
Opening excerpt (first ~120 words) tap to expand
Disclaimer: I am not a cryptographer. There may be serious bugs or side channels! The minimum MTU for IPv6 is 1280 octets; if you subtract the 40-octet IPv6 header and the 8-octet UDP header, you get 1232 usable octets. ML-KEM-768 public keys are 1184 octets long, leaving little space for other protocol material that you might want to stuff into a single UDP packet. Can you compress ML-KEM-768 public keys? Note that, in the standard ML-KEM-768 public key layout, octets [0,1152)\left[0, 1152\right) are three polynomials, each with 256 coefficients, each 12 bits. Octets [1152,1184)\left[1152, 1184\right) are the seed ρ\rho which is considered to be indistinguishable from random. But wait. q=3329q = 3329, and log2q≈11.70087316\log_2 q \approx 11.70087316.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Lobsters.