We present a chosen plaintext attack on the NTRU encryption system. We assume that the attacker can detect wrap errors, that the blinding polynomial is generated from three parts (as specified in the standards) and that the attacker has a large database of carefully selected plaintexts. The attack is based on the fact that wrap errors occur more frequently if blinding polynomials with larger coefficients are used. (c) 2005 Elsevier B.V. All rights reserved.