Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 1 down vote favorite

We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks break with 2^60.55 bit operations..

share|improve this question
1  
You'll need a source for your McEliece statement. I'd expect the number of operations to depend on key sizes. If you're willing to use a large key, you should be able to reach any security level you like. – CodesInChaos Dec 7 '12 at 11:14
1  

1 Answer

up vote 2 down vote

My impression is that there is no production ready post quantum scheme ATM.

NTRU seems to be decent (complete spec, reasonable parameter-sizes and performance), but I think it's patented. No idea about the licensing terms.

But whatever scheme you choose, don't use it instead of a conventional scheme(RSA, DH, ECDH) but in addition to a conventional scheme. If you use a good construction, your protocol will be as secure as the stronger of the schemes.

share|improve this answer
Hasn't NTRU been broken several time by Faugère's work on Gröbner basis ? – Alexandre Yamajako Dec 7 '12 at 11:48
@AlexandreYamajako No idea. I don't really trust any of these new schemes, that's why I recommended using it in addition to a conventional scheme. – CodesInChaos Dec 7 '12 at 12:16
@CodeInChaos what construction were you thinking about ? I don't think composition is a terrible idea but there are exemples in which it breaks. Maybe pick $r$ at random then $m_0\gets r\oplus m$ and $m_1 \gets r$ ? – Alexandre Yamajako Dec 7 '12 at 13:38
@AlexandreYamajako The choice of construction depends on the application requirements. But if you just need a symmetric key, you could for example choose two random keys, encrypt each one with a different scheme, and use the hash of both as your symmetric key. – CodesInChaos Dec 7 '12 at 13:39
1  
Or you could avoid avoid needing to rely on "random oracle"ness of the hash, and $\hspace{1.4 in}$ just use the xor of both as your symmetric key. $\:$ – Ricky Demer Dec 7 '12 at 22:41
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.