K-PKE

[jnsiemer]

Description

This PR implements...

• K-PKE, the PKE below ML-KEM in a naive way without compression / decompression techniques nor NTT, i.e. not according to the specification in FIPS 203
• benchmarks for K-PKE

Testing

• I added basic working examples (possibly in doc-comment)

Checklist:

• I have performed a self-review of my own code
  • The code provides good readability and maintainability s.t. it fulfills best practices like talking code, modularity, ...
    • The chosen implementation is not more complex than it has to be
  • My code should work as intended and no side effects occur (e.g. memory leaks)
  • The doc comments fit our style guide

Performance results on my laptop

K-PKE cycle 512         time:   [490.95 µs 491.86 µs 492.86 µs]

K-PKE gen 512           time:   [208.65 µs 208.93 µs 209.23 µs]

K-PKE enc 512           time:   [241.94 µs 242.25 µs 242.63 µs]

K-PKE dec 512           time:   [43.996 µs 44.099 µs 44.189 µs]

K-PKE cycle 768         time:   [770.62 µs 771.46 µs 772.51 µs]

K-PKE gen 768           time:   [351.74 µs 352.17 µs 352.75 µs]

K-PKE enc 768           time:   [364.52 µs 365.25 µs 365.99 µs]

K-PKE dec 768           time:   [55.010 µs 55.263 µs 55.557 µs]

K-PKE cycle 1024        time:   [1.1052 ms 1.1073 ms 1.1096 ms]

K-PKE gen 1024          time:   [531.46 µs 532.08 µs 532.75 µs]

K-PKE enc 1024          time:   [509.15 µs 509.76 µs 510.45 µs]

K-PKE dec 1024          time:   [65.892 µs 65.950 µs 66.010 µs]

[Marvin-Beckmann]

looks good, just a few comments that could be added in my opinion

[Marvin-Beckmann]

sampling in NTT transform and plain coefficients is not necessarily the same. For uniform it is the same - maybe add a small comment or sth

[Marvin-Beckmann]

We should however add a comment, that we leave out the NTT here for simplicitly, because in formal algorithm 14 for K-PKE, the Matrix A is in NTT transform, so, maybe we should add a specific comment that A is not in NTT-form, as this might otherwise be quite confusing, similarly s and e

[Marvin-Beckmann]

you could link the document in the same fashion we have done it so far for papers