{"paper":{"title":"Explicit cost analysis of Toom-4 multiplication for incomplete NTT in lattice-based cryptography","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Explicit addition-chain counts for Toom-4 produce a cost model that identifies parameter ranges where it outperforms Karatsuba inside incomplete-NTT hybrids for lattice cryptography.","cross_cats":["cs.SC","math.NT"],"primary_cat":"cs.CR","authors_text":"Momonari Kudo, Sakura Oku","submitted_at":"2026-05-17T15:34:27Z","abstract_excerpt":"Polynomial multiplication is fundamental in lattice-based cryptography. While the Number Theoretic Transform (NTT) enables fast multiplication, it imposes constraints on the modulus of the coefficient field. Hafiz et al. (2025) addressed this limitation by analyzing the incomplete NTT, which combines a truncated NTT with conventional multiplication methods In this work, we revisit Toom-4 multiplication in the context of incomplete NTT. Although Toom-4 is asymptotically faster than Karatsuba, its precise cost has not been expressed in a form compatible with the incomplete NTT framework. We pres"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"We present a concrete Toom-4 implementation and derive explicit operation counts that separate additions/subtractions and multiplications over the coefficient field. Our analysis based on addition chains yields a simple cost model for incomplete NTT. Using this model, we analyze hybrid strategies combining Toom-4, Karatsuba, and incomplete NTT. We identify parameter ranges where Toom-4 is advantageous and validate the predicted behavior experimentally.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"The addition-chain-derived cost model for Toom-4 accurately reflects the dominant operations in an actual incomplete-NTT implementation across the tested parameter ranges, with no significant hidden costs from memory access or modular reduction that would alter the identified advantage regions.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Derives explicit Toom-4 cost model for incomplete NTT and evaluates hybrid multiplication strategies with experimental validation for lattice crypto.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Explicit addition-chain counts for Toom-4 produce a cost model that identifies parameter ranges where it outperforms Karatsuba inside incomplete-NTT hybrids for lattice cryptography.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"8c51b6c4728fc033dfa22bcd4b40e097f7b546a2e030e729b208df8206a10a5f"},"source":{"id":"2605.17505","kind":"arxiv","version":1},"verdict":{"id":"6ce1254a-024b-4fca-8c35-5c526d913387","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-19T23:13:06.694407Z","strongest_claim":"We present a concrete Toom-4 implementation and derive explicit operation counts that separate additions/subtractions and multiplications over the coefficient field. Our analysis based on addition chains yields a simple cost model for incomplete NTT. Using this model, we analyze hybrid strategies combining Toom-4, Karatsuba, and incomplete NTT. We identify parameter ranges where Toom-4 is advantageous and validate the predicted behavior experimentally.","one_line_summary":"Derives explicit Toom-4 cost model for incomplete NTT and evaluates hybrid multiplication strategies with experimental validation for lattice crypto.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"The addition-chain-derived cost model for Toom-4 accurately reflects the dominant operations in an actual incomplete-NTT implementation across the tested parameter ranges, with no significant hidden costs from memory access or modular reduction that would alter the identified advantage regions.","pith_extraction_headline":"Explicit addition-chain counts for Toom-4 produce a cost model that identifies parameter ranges where it outperforms Karatsuba inside incomplete-NTT hybrids for lattice cryptography."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.17505/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"doi_title_agreement","ran_at":"2026-05-19T23:31:19.872185Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_compliance","ran_at":"2026-05-19T23:20:55.472720Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"claim_evidence","ran_at":"2026-05-19T21:41:57.662026Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"ai_meta_artifact","ran_at":"2026-05-19T21:33:23.634009Z","status":"skipped","version":"1.0.0","findings_count":0}],"snapshot_sha256":"54cdfd7e5e6f7bb13894b471e59c33ced1c8c2d3bf639f29cb75f263039a1720"},"references":{"count":15,"sample":[{"doi":"","year":2024,"title":"Modul e-Lattice-Based Key- Encapsulation Mechanism Standard","work_id":"3f8c4763-d369-477e-9108-52a9c42a284b","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2024,"title":"Modul e-Lattice-Based Digital Signature Standard","work_id":"f0236387-2401-4bb8-9ca7-8f10fc54479a","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":1974,"title":"Fast Convolution using fermat number transforms with ap- plications to digital filtering","work_id":"ff367855-19d6-469f-ae7d-b343829e23f8","ref_index":3,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2007,"title":"Towards optimal Toom–Cook multiplication for univariate and multivariate polynomials in characteristic 2 and 0","work_id":"e978fc4e-f77a-4d79-8d8b-49419417576e","ref_index":4,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2007,"title":"Integer and polynomial multip lication: towards optimal Toom– Cook matrices","work_id":"5a9e610e-5b7a-4424-9d40-8ce40be23211","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":15,"snapshot_sha256":"b7341652c905a6bacbb8ebf25258dd9b72bf166e8b423d5f5d55bccc5f17958c","internal_anchors":0},"formal_canon":{"evidence_count":2,"snapshot_sha256":"da39cc7e33b6b9cd7f24b7ce5756b01a3c7d6a933f4c8905049634c681721979"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"}