Algebraic Variants of NTRU There are a large number of algebraic NTRU variants: for example, in some (such as ETRU), the underlying ring has been changed to the ring of integers of a certain number field; there is GR-NTRU, which is over group rings; there is NTRU over quaternions, and octonions, and even sedenions; and there are various other non-commutative and non-associative schemes. I am aware that non-commutativity helps avoid an attack of Coppersmith and Shamir, but my question is the following: are any of these variants considered essentially superior to standard NTRUEncrypt? Is the more exotic algebraic structure of these variants considered preferable by experts, or are these schemes academically interesting but impractical/not trusted for real world use?
If one expands the discussion to include LWE-type schemes, isn't Module-LWE naturally a &quot;non-commutative&quot; hardness assumption which has practical applications? For example, the Kyber NIST PQC candidate is an MLWE scheme, and is a round 3 finalist.
In general though, I mostly see lattices over &quot;exotic&quot; (at least more so than things like RLWE/MLWE) algebraic structures discussed by coding theorists (two specific examples are Fredrique Oggier and Cong Ling). As there seems to be a larger theoretical basis of research on &quot;that side&quot; of things, it might be easier to search for practical applications.