BAT: Small and Fast KEM over NTRU Lattices. (2022). IACR Transactions on Cryptographic Hardware and Embedded Systems, 2022(2), 240-265. https://doi.org/10.46586/tches.v2022.i2.240-265