I have a general question about quantum security. ECDSA is suppose to be broken by quantum computers. Whilst something like NTRU is suppose to be secure.

My question is: if we sign with ECDSA and encrypt the signature NTRU. Does that make the signature safe? Because I can expose both ECDSA and NTRU public keys but if either of them is compromised it shouldn't compromise.

Is this a correct statement or am I missing something?

  • 2
    $\begingroup$ What's the point of a signature if nobody can verify it? (They would have to decrypt the outer NTRU layer first.) $\endgroup$ – yyyyyyy Oct 3 '18 at 11:45
  • $\begingroup$ That is indeed the case. So it is verifiable but you need two keys. $\endgroup$ – ovanwijk Oct 3 '18 at 12:22
  • $\begingroup$ So you're handing out an NTRU private key and an ECDSA public key as your verification key? That means any quantum attacker who can verify can also forge signatures, since giving out the NTRU private key essentially degrades the encryption to an encoding. $\endgroup$ – yyyyyyy Oct 3 '18 at 13:11
  • 3
    $\begingroup$ In a public-key encryption scheme (such as NTRU), you cannot "decrypt with the public key." The public key is used to encrypt; only the private key holder can decrypt. $\endgroup$ – yyyyyyy Oct 3 '18 at 13:21
  • 1
    $\begingroup$ I automatically assumed that you would encrypt with the public key of the receiver. In that case kelalaka's answer would be correct I suppose. It would be tricky to attack an unknown signature value. $\endgroup$ – Maarten Bodewes Oct 3 '18 at 14:16

So you want to encrypt the message's ECDSA signature with NTRU.

Firstly, if the NTRU is secure against the quantum computers, then anything under NTRU encryption is secure against the quantum computers.

Secondly, NTRU has also digital signature, instead of ECDSA use NTRUSign.

Depending on different mathematical and computational problems are not considered a good practice.

update: by the comments of Maarten Bodewes

Remember that, public key encryption and signature require two separate keys; public key and private key. In your case;

  • the public encryption keys generated by the receiver as $PK_{rec},SK_{rec}$
  • the digital signature keys are generated by the signer as $PK_{sign},PK_{sign}$.

As a result, the two public keys, $PK_{rec}$ and $PK_{sign}$, are generated by different people.

  • $\begingroup$ Thanks for your answer. The problem with NTRUSign is that is still patented while NTRUEncrypt isn't. $\endgroup$ – ovanwijk Oct 3 '18 at 12:21
  • 1
    $\begingroup$ It would probably be a good idea to explain that encryption requires a separate key pair generated by the receiver in addition to your answer. $\endgroup$ – Maarten Bodewes Oct 4 '18 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.