# NTRUEncrypt polynomial $r$ Uniqueness

During the encryption process in NTRU, a random polynomial $$r$$ of small coefficients is generated to bind to the message to obscure it, and this polynomial must be kept secret. Does this polynomial have to be unique per message?

Yes, if two messages $$m_0, m_1$$ were encrypted with the same $$r$$ (resulting in ciphertexts $$c_0, c_1$$), we would have:
$$m_0 - m_1 = c_0 - c_1$$
This would allow the attacker to directly rederive many of the bits of $$m_0, m_1$$ (and it gets a lot worse if more than two messages were encrypted with the same $$r$$.