In the original NTRU paper:NTRU: A Ring-Based Public Key Cryptosystem,1996, the author proposes 3 choices of implementation parameters: moderate, high and highest. Let's take moderate security level as an example:
I understand the calculation of the public key size: $len_{pk} = N\cdot \log(q)=107 \cdot 6=642$ bits, but why is the private key size 340 bits?