As many know, original NTRUSign is considered broken as signatures leak information about the private key.

It takes a number of signatures to accomplish a break though, with the original break paper claiming a few hundred.

Could this signature scheme still be used as a one-time or few-time signature scheme? What would its security be in this case? The advantage over WOTS would be that it's faster.

  • 3
    $\begingroup$ "The advantage over WOTS would be that it's faster"; you sure? Verifying a WOTS signature involves computing circa 2000 hashes (and can be reduced to perhaps 300 if you go with a one-time-signature scheme from RFC8554); is NTRUVerify faster than that? $\endgroup$
    – poncho
    May 9, 2019 at 20:24

1 Answer 1


To quote RFC4270

There is an old saying inside the US National Security Agency (NSA): “Attacks always get better; they never get worse.”

One of the main reason people avoid cryptographic protocols with known attacks is the above wisdom. Essentially, the attacks show there is an intrinsic weakness in the protocol, and often following works improve the effectiveness of the attack. If you really want to use a protocol with known weaknesses, you need both

  • to have good reasons to think the possible improvements on known attacks won’t come close to parameters were it would destroy your security. In your case it means being sure that there is no way to improve the number of signatures needed to the attack from a few hundred to a few, or at least that no one will find one in the relevant time frame.
  • to gain a very strong advantage, like speed.

Since the main practical interest of NTRU signature protocols is their post quantum security, it means that the time scale considered for improvement of attacks the decades needed for your adversaries to have a quantum computer useful for cryptanalysis (otherwise, use RSA !). Given past history of cryptanalysis, I really do not believe one could have any assurance more effective attacks against NTRUsign won’t be found over the next two decades !


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.