# NTRU less secure than previously thought?

A new paper (https://eprint.iacr.org/2015/552.pdf) says:

This makes it possible to asymptotically and heuristically break the NTRU cryptosystem in subexponential time (without contradicting its security assumption).

Does this mean NTRU is less secure now? By how much?

• The attack in this paper is not as efficient as existing lattice-based attacks on practical parameters, so it does not affect the concrete parameters for NTRU (see the bottom of page 2). However, it is an asymptotic improvement over previous attacks, so it may lead to concretely lower security in the future. Note also that the attack requires nearly an exponential amount of space, which can make it hard to run in reality. Jun 24, 2015 at 19:17

In addition, while it is subexponential, it's just barely so; they estimate the time as $2^{ (\ln 2/2+o(1))n/ \log \log n}$; even if we ignore the $o(1)$ term, this grows just slightly slower than an exponential function.