Transcript Distribution of Raw NTRUSign

(i.e. Without Countermeasure)

Each signature gives a point in Rn

The point distribution is not independent of the secret key