# Encrypt your ECDSA signature with NTRU to make them quantum secure, does that work?

I have a general question about quantum security. ECDSA is suppose to be broken by quantum computers. Whilst something like NTRU is suppose to be secure.

My question is: if we sign with ECDSA and encrypt the signature NTRU. Does that make the signature safe? Because I can expose both ECDSA and NTRU public keys but if either of them is compromised it shouldn't compromise.

Is this a correct statement or am I missing something?

• What's the point of a signature if nobody can verify it? (They would have to decrypt the outer NTRU layer first.) Oct 3 '18 at 11:45
• That is indeed the case. So it is verifiable but you need two keys. Oct 3 '18 at 12:22
• So you're handing out an NTRU private key and an ECDSA public key as your verification key? That means any quantum attacker who can verify can also forge signatures, since giving out the NTRU private key essentially degrades the encryption to an encoding. Oct 3 '18 at 13:11
• In a public-key encryption scheme (such as NTRU), you cannot "decrypt with the public key." The public key is used to encrypt; only the private key holder can decrypt. Oct 3 '18 at 13:21
• I automatically assumed that you would encrypt with the public key of the receiver. In that case kelalaka's answer would be correct I suppose. It would be tricky to attack an unknown signature value. Oct 3 '18 at 14:16

So you want to encrypt the message's ECDSA signature with NTRU.

Firstly, if the NTRU is secure against the quantum computers, then anything under NTRU encryption is secure against the quantum computers.

Secondly, NTRU has also digital signature, instead of ECDSA use NTRUSign.

Depending on different mathematical and computational problems are not considered a good practice.

update: by the comments of Maarten Bodewes

Remember that, public key encryption and signature require two separate keys; public key and private key. In your case;

• the public encryption keys generated by the receiver as $$PK_{rec},SK_{rec}$$
• the digital signature keys are generated by the signer as $$PK_{sign},PK_{sign}$$.

As a result, the two public keys, $$PK_{rec}$$ and $$PK_{sign}$$, are generated by different people.

• Thanks for your answer. The problem with NTRUSign is that is still patented while NTRUEncrypt isn't. Oct 3 '18 at 12:21
• It would probably be a good idea to explain that encryption requires a separate key pair generated by the receiver in addition to your answer. Oct 4 '18 at 19:45