NTRUSign (considered broken) as a one or few time PQ signature scheme

Question

As many know, original NTRUSign is considered broken as signatures leak information about the private key.

It takes a number of signatures to accomplish a break though, with the original break paper claiming a few hundred.

Could this signature scheme still be used as a one-time or few-time signature scheme? What would its security be in this case? The advantage over WOTS would be that it's faster.

Answer 1

To quote RFC4270

There is an old saying inside the US National Security Agency (NSA): “Attacks always get better; they never get worse.”

One of the main reason people avoid cryptographic protocols with known attacks is the above wisdom. Essentially, the attacks show there is an intrinsic weakness in the protocol, and often following works improve the effectiveness of the attack. If you really want to use a protocol with known weaknesses, you need both

• to have good reasons to think the possible improvements on known attacks won’t come close to parameters were it would destroy your security. In your case it means being sure that there is no way to improve the number of signatures needed to the attack from a few hundred to a few, or at least that no one will find one in the relevant time frame.
• to gain a very strong advantage, like speed.

Since the main practical interest of NTRU signature protocols is their post quantum security, it means that the time scale considered for improvement of attacks the decades needed for your adversaries to have a quantum computer useful for cryptanalysis (otherwise, use RSA !). Given past history of cryptanalysis, I really do not believe one could have any assurance more effective attacks against NTRUsign won’t be found over the next two decades !