To quote RFC4270
There is an old saying inside
the US National Security Agency (NSA): “Attacks always get better;
they never get worse.”
One of the main reason people avoid cryptographic protocols with known attacks is the above wisdom. Essentially, the attacks show there is an intrinsic weakness in the protocol, and often following works improve the effectiveness of the attack. If you really want to use a protocol with known weaknesses, you need both
- to have good reasons to think the possible improvements on known attacks won’t come close to parameters were it would destroy your security. In your case it means being sure that there is no way to improve the number of signatures needed to the attack from a few hundred to a few, or at least that no one will find one in the relevant time frame.
- to gain a very strong advantage, like speed.
Since the main practical interest of NTRU signature protocols is their post quantum security, it means that the time scale considered for improvement of attacks the decades needed for your adversaries to have a quantum computer useful for cryptanalysis (otherwise, use RSA !). Given past history of cryptanalysis, I really do not believe one could have any assurance more effective attacks against NTRUsign won’t be found over the next two decades !