# Is the IEEE 1363.1 standard of NTRU post-quantum secure?

I have a question regarding the IEEE 1363.1 standard for NTRU with padding, which offers CCA security. Does the IEEE standardized implementation offer post-quantum security as well?

Also, what are the major differences between the IEEE 1363.1 NTRU standard vs. the NTRUEncrypt NIST PQ submission here: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Round-1-Submissions

Or, is the NTRUEncrypt submission to the NIST PQ competition exactly the same as in the IEEE 1363.1 standard? Is there a difference in the parameter sets to enable PQ security vs. the parameters in IEEE 1363.1?

Is it correct to claim that the IEEE 1363.1 is PQ secure as well?

Thank you!

Actually, it turns out that certain parameter sets of the previous version of NTRU could be attacked easier than expected; this attack is not against the NTRU problem itself, but against the NAEP padding. See this paper for details; there is also this paper (however, I believe that is against an earlier version of NTRU.

When Security Innovations made their submission to NIST, they updated the NAEP padding to account for this attack. Because of this, the NIST submission is not precisely the same as the IEEE version (even beyond the different parameter sets).

If quantum security is in question, it would certainly make sense to use the latest version. It's not clear whether these attacks were ever a real threat; however with the latest version, we know they are not.

what are the major differences between the IEEE 1363.1 NTRU standard vs. the NTRUEncrypt NIST PQ submission

The only differences would be the parameters that are standardized. This answer gives one parameter set, specifically EES1087EP2. Unfortunately, the IEEE Std 1363.1-2008 document itself is behind a paywall, so I am unable to view the other parameter sets. It seems like at least some of the parameters are the same. In particular, NTRU-743 from the design document submitted to NIST has $N = 743, q = 2048, p = 3, d = 247$ (see table 1), which is the same parameter set as one standardized in 1363.1, according to an analysis of parameter sets (see table 3).

On the upside, there are public implementations which use the standardized parameters, so those can be consulted. It looks like the version of NTRU submitted to the competition comes with only a few parameter sets for evaluation, which may change later on in the contest. The IEEE, on the other hand, standardizes a large number of parameter sets for NTRU.

Is there a difference in the parameter sets to enable PQ security vs. the parameters in IEEE 1363.1?

The parameter sets are chosen to maximize security, not to maximize post-quantum security in particular. Secure parameters will be secure against both classic and quantum algorithms. I do not believe you can construct parameters for NTRU that are secure against classical computers, but insecure against hypothetical cryptoanalytic quantum computers.

Table 5 in the above-linked design document compares the lattice strength for various parameter sets under the best known classical and quantum sieving algorithms.

Is it correct to claim that the IEEE 1363.1 is PQ secure as well?

Yes. All unbroken versions of NTRU use lattice-based cryptography, which involves mathematical problems that are not known to be solvable using a quantum computer. If the IEEE version is PQ secure, then the NIST PQ submission should be as well, and vice versa.