2
$\begingroup$

I have a general question about quantum security. ECDSA is suppose to be broken by quantum computers. Whilst something like NTRU is suppose to be secure.

My question is: if we sign with ECDSA and encrypt the signature NTRU. Does that make the signature safe? Because I can expose both ECDSA and NTRU public keys but if either of them is compromised it shouldn't compromise.

Is this a correct statement or am I missing something?

Improve this question
$\endgroup$
8
  • 2
    $\begingroup$ What's the point of a signature if nobody can verify it? (They would have to decrypt the outer NTRU layer first.) $\endgroup$
    – yyyyyyy
    Commented Oct 3, 2018 at 11:45
  • $\begingroup$ That is indeed the case. So it is verifiable but you need two keys. $\endgroup$
    – ovanwijk
    Commented Oct 3, 2018 at 12:22
  • $\begingroup$ So you're handing out an NTRU private key and an ECDSA public key as your verification key? That means any quantum attacker who can verify can also forge signatures, since giving out the NTRU private key essentially degrades the encryption to an encoding. $\endgroup$
    – yyyyyyy
    Commented Oct 3, 2018 at 13:11
  • 3
    $\begingroup$ In a public-key encryption scheme (such as NTRU), you cannot "decrypt with the public key." The public key is used to encrypt; only the private key holder can decrypt. $\endgroup$
    – yyyyyyy
    Commented Oct 3, 2018 at 13:21
  • 1
    $\begingroup$ I automatically assumed that you would encrypt with the public key of the receiver. In that case kelalaka's answer would be correct I suppose. It would be tricky to attack an unknown signature value. $\endgroup$
    – Maarten Bodewes ♦
    Commented Oct 3, 2018 at 14:16

1 Answer 1

Reset to default
1
$\begingroup$

So you want to encrypt the message's ECDSA signature with NTRU.

Firstly, if the NTRU is secure against the quantum computers, then anything under NTRU encryption is secure against the quantum computers.

Secondly, NTRU has also digital signature, instead of ECDSA use NTRUSign.

Depending on different mathematical and computational problems are not considered a good practice.

update: by the comments of Maarten Bodewes

Remember that, public key encryption and signature require two separate keys; public key and private key. In your case;

  • the public encryption keys generated by the receiver as $PK_{rec},SK_{rec}$
  • the digital signature keys are generated by the signer as $PK_{sign},PK_{sign}$.

As a result, the two public keys, $PK_{rec}$ and $PK_{sign}$, are generated by different people.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thanks for your answer. The problem with NTRUSign is that is still patented while NTRUEncrypt isn't. $\endgroup$
    – ovanwijk
    Commented Oct 3, 2018 at 12:21
  • 1
    $\begingroup$ It would probably be a good idea to explain that encryption requires a separate key pair generated by the receiver in addition to your answer. $\endgroup$
    – Maarten Bodewes ♦
    Commented Oct 4, 2018 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.