The NTRU crypto system requires quite long keys. For example with parameters N=439 and q=2048 the security is 128 bits and the key_size is 4829 bits. When the private key is encrypted with AES-256 and the ciphertext is made public, can an attacker learn something from that? Or is the 128 bit security of NTRU reduced by doing this?
1 Answer
$\begingroup$
$\endgroup$
No, 128-bit NTRU private key will retain its security when encrypted by AES-256 using a properly generated/derived key.
Suppose 2 ciphertexts, 1 NTRU, 1 IES-ECC, both are 128-bit secure, what you have right now is 2 ciphertexts requiring $2^{128}$ work to recover the plaintext without having the corresponding private key. This is true even if the encoded private key is longer than 128 bits (because of non-generic attacks such as lattice-reduction or Pollard's rho algorithm)
Now suppose the keys are encrypted with a 256-bit cipher, this doesn't reduce the security nor increase it. This is because one can always attempt recover the private key from the already known public key without attacking the encrypted private key anyway.
