Skip to content
Go to file

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


Implementations of the NewHope key-encapsulation mechanism specified in the submission to the NIST Post-Quantum Cryptography Standardization Project.

Build instructions

To obtain and build the code, run the following sequence of commands:

 git clone
 cd newhope/ref && make
 cd ../avx2 && make

This will build the binaries

  • ref/PQCgenKAT_cpakem512,
  • ref/PQCgenKAT_cpakem1024,
  • ref/PQCgenKAT_ccakem512,
  • ref/PQCgenKAT_ccakem1024,
  • ref/test_cpakem512,
  • ref/test_cpakem1024,
  • ref/test_ccakem512,
  • ref/test_ccakem1024,
  • ref/speed_cpakem512,
  • ref/speed_cpakem1024,
  • ref/speed_ccakem512,
  • ref/speed_ccakem1024,
  • avx2/PQCgenKAT_cpakem512,
  • avx2/PQCgenKAT_cpakem1024,
  • avx2/PQCgenKAT_ccakem512,
  • avx2/PQCgenKAT_ccakem1024,
  • avx2/test_cpakem512,
  • avx2/test_cpakem1024,
  • avx2/test_ccakem512,
  • avx2/test_ccakem1024,
  • avx2/speed_cpakem512,
  • avx2/speed_cpakem1024,
  • avx2/speed_ccakem512, and
  • avx2/speed_ccakem1024.

The PQCgenKAT binaries produce test-vector files as specified in the NIST submission requirements. The test binaries perform various key exchanges and output only the sizes of keys and ciphertexts if they are successful. The speed binaries perform benchmarks of key encapsulation and various subroutines. Binaries containing the string cpakem implement KEM variant without CCA security; binaries containing the string ccakem implement KEM variant with CCA security. Binaries ending on 512 implement the NewHope512 parameter set; binaries ending on 1024 implement the NewHope1024 parameter set.


All code in this repository is in the public domain, except for the files PQCgenKAT.c, rng.c and rng.h, which are copyrighted by NIST with "All rights reserved". For Keccak, we are using public-domain code from sources and by authors listed in comments on top of the respective files.

You can’t perform that action at this time.