I would have expected this info to be easier to Google Scholar for, but alas I'm asking here.

Partial answers:

NTRU key size (confused)

the public key consists of one ring, and so it takes up $11 \times 439 = 4829$ bits, which compresses to 604 bytes.

what are the NTRU keysize and application in industry?

For instance, with $N = 1171$ and $q = 2048$, which are recommended parameters, public and private keys are of size 1.57 KB.


  1. Those don't agree.

  2. What about the size of NTRUsign signatures?

  3. Have Bernstein, Lange, Chuengsatiansup, and van Vredendaal published a signature variant of NTRU Prime yet? (I only see encryption [1]), but in the paper:

Our public keys are field elements, easily squeezed into 1232 bytes.

Any idea what signature sizes of an NTRU Prime-based signature scheme would be?

[1]: NTRU Prime, 2016


1 Answer 1


The inconsistency of Ntru public key size is due to the fact that those are from two different parameter sets (targeting different security levels). The latest version of recommended parameter sets can be found from https://eprint.iacr.org/2015/708.pdf

Ntru prime does not have a signature scheme as far as I know.

NtruSign signature scheme is broken and is not recommended for use. The same group of people come up with a new scheme named pqNTRUsign which is secure against the transcript attack that breaks ntrusign. https://eprint.iacr.org/2014/457.pdf

The reference implementation of both Ntru and pqntrusign can be found from https://github.com/NTRUOpenSourceProject/ntru-crypto


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.