Transcript Distribution of Raw NTRUSign

(i.e. Without Countermeasure)

In fact, the distribution is uniform over some parallelepiped

The secret key is the basis spanning that parallelepiped