The first version of the system, which was called NTRU, was developed in 1996 by mathematicians Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman. That same year, the developers of NTRU joined with Daniel Lieman and founded the NTRU Cryptosystems, Inc., and were given a patent on the cryptosystem. In 2009, the company was acquired by Security Innovation, a software security company. In 2013, Damien Stehle and Ron Steinfeld created a provably secure version of NTRU which is being studied by a post quantum crypto group chartered by the European Commission. In May 2016, Daniel Bernstein, Chitchanok Chuengsatiansup, Tanja Lange and Christine van Vredendaal released NTRU Prime, which adds defenses against potential attack to NTRU by eliminating algebraic structure they considered worrisome. However, after more than 20 years of scrutiny, no concrete approach to attack the original NTRU exploiting its algebraic structure has been found so far. Both NTRU and NTRU Prime have advanced into the 2nd round of the Post-Quantum Cryptography Standardization project.
Performance
At equivalent cryptographic strength, NTRU performs costly private key operations much faster than RSA does. The time of performing an RSA private operation increases as the cube of the key size, whereas that of an NTRU operation increases quadratically. According to the Department of Electrical Engineering, University of Leuven, " a modern GTX280 GPU, a throughput of up to 200 000 encryptions per second can be reached at a security level of 256 bits. Comparing this to a symmetric cipher, this is only around 20 times slower than a recent AES implementation."
Resistance to quantum-computer-based attacks
Unlike RSA and Elliptic Curve Cryptography, NTRU is not known to be vulnerable to quantum computer based attacks. The National Institute of Standards and Technology wrote in a 2009 survey that " are viable alternatives for both public key encryption and signatures that are not vulnerable to Shor’s Algorithm” and “ the various lattice based cryptographic schemes that have been developed, the NTRU family of cryptographic algorithms appears to be the most practical". The European Union's PQCRYPTO project is evaluating the provably secure Stehle–Steinfeld version of NTRU as a potential European standard. However the Stehle-Steinfeld version of NTRU is "significantly less efficient than the original scheme."
Standardization
The standard IEEE Std 1363.1, issued in 2008, standardizes lattice-based public key cryptography, especially NTRUEncrypt.
The standard X9.98 standardizes lattice-based public key cryptography, especially NTRUEncrypt, as part of the standards for the financial services industry.
The PQCRYPTO project of the European Commission is considering standardization of the provably secure Stehle-Steinfeld version of NTRU
Implementations
Originally, NTRU was only available as a proprietary, for-pay library and open source authors were threatened with legal action. It was not until 2011 that the first open-source implementation appeared, and in 2013, Security Innovation exempted open source projects from having to get a patent license, and released an NTRU reference implementation under the GPL v2. Five open-source NTRU implementations now exist - Each is available in Java and C:
The GPL-licensed reference implementation
A BSD-licensed library
bouncycastle
GoldBug Messenger was the first Chat- and E-Mail client with NTRU Algorithm under open source license, which is based on the Spot-On Encryption Suite Kernels.
Additionally, wolfSSL provides support for NTRU cipher suites in a lightweight C implementation.
