Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

learn more… | top users | synonyms

1
vote
0answers
35 views

One-Time-Signature based codes

I'm trying to understand the sentence in bold, in the follow paragraph of A new one-time signature scheme from syndrome decoding Keygen: Given a security parameter $\lambda$, choose a suitable ...
0
votes
1answer
20 views

Stern identification scheme to signature scheme

I'm trying to understand the comment in the page 103 of the book Postquantum Cryptography. about convert the identification Stern procedure for signing. Can you write an example of signature of this ...
0
votes
0answers
15 views

DSSP reduction to DSSI

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies" by DeFeo, Jao and Plut (PDF), there is a reduction from the Decisional Supersingular Product (DSSP) problem to ...
2
votes
1answer
54 views

Parameter choice Supersingular Isogeny DH

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies” by DeFeo, Jao and Plut (PDF), the public parameters are defined as: Supersingular curve $E$, and bases $P, Q$ ...
3
votes
1answer
60 views

Can there be a need for 1024-bit (symmetric) encryption?

I think we are all aware of the CAESAR-competition. Now the aim of this competition is to select a (portfolio of) winner(s) which provide authenticated encryption. I'll now assume that the results ...
4
votes
1answer
101 views

Quantum computing vs AES s-box equation

Do quantum computers have any affect on the ability to solve the non-linear AES s-box algebraic expression, or does solving it still fall under search algorithms (Grover's)? If quantum computer do ...
2
votes
1answer
48 views

Security of MSS

I have started reading about the Merkle Signature Scheme. I am a little confused about why it is believed to be secure against quantum attacks, couldn't the hash function be attacked? What would make ...
0
votes
1answer
48 views

Supersingular Isogeny Key Exchange Software [closed]

Are there any optimised implementations of the Supersingular Isogeny Key Exchange by Defeo, Jao, and Plut. It seems like this would be a great drop-in replacement for Diffie-Hellman in both OpenSSL ...
0
votes
0answers
16 views

CMSS key sizes flexiprovider

I am study the implementation of the Coronado Merkle Signature Scheme using flexiprovider. I want to verify the Table 1 of its paper. Using the flexiprovider, I have written a example for ...
0
votes
2answers
51 views

PQ Key Exchange based on Elliptic Curve Isogenies

I was reading the Wikipedia article on Post Quantum Cryptography and was interested in opinions as to whether the Supersingular Elliptic Curve Isogeny Diffie-Hellman listed there would be a good Post ...
1
vote
1answer
39 views

Winternitz Signature Scheme Verfication

I am reading page 39 in this "Post Quantum Cryptography" book. Why does equation 15 hold? There is no further knowledge about f and you definitely cannot use any power laws. So, why is ...
0
votes
0answers
65 views

Name of this attack?

I am studying Merkle tree signature. Let $\sigma=(s,Y_s,\sigma_{\text{OTS}},As)$ be a signature of certain document. Here $s$ is the index of leaf, $Y_s$ is the respectively OTS public key and $A_s$ ...
2
votes
2answers
84 views

Post-quantum authenticated encryption

It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong. However, these statements are always made ...
1
vote
2answers
149 views

Are there any quantum-resistant symmetric encryption schemes?

It seems that quite a few currently available encryption schemes will possibly be broken by quantum computing. Are there any symmetric encryption schemes that will remain unbroken (either because of ...
7
votes
1answer
107 views

Can Grover's algorithm be parallelized?

Using a quantum computer, Grover's algorithm can search an unordered list of length $N$ in time $\sqrt{N}$. Applied to cryptography this means that it can recover $n$ bit keys and find preimages for ...
1
vote
1answer
93 views

What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?

This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based ...
1
vote
2answers
126 views

NTRU key generation

I've been experimenting with an NTRU open-source C implementation here I've noticed something (potentionally) strange with a certain set of params: NTRU_EES1087EP2 (defined here). When generating ...
0
votes
0answers
119 views

Preventing Quantum Attacks on Cryptography [duplicate]

With the advancement of technology in quantum computing, it's becoming more evident that we need to start thinking about protecting the future integrity of our cryptographic standards. What can we do ...
0
votes
1answer
65 views

Post-quantum hybrid encryption

Assume the following simplified protocol: seed = curve25519SharedKey(theirPublicKey, myPrivateKey) sharedKey = scrypt(seed, salt, sufficientlyHardWorkFactors...) cipherText = aes256(sharedKey, ...
4
votes
1answer
196 views

Are post-quantum cryptographic ciphers *also* secure if the P=NP conjecture holds true?

First of all, I only understand the P versus NP debate on a rather shallow level as I am not a computer scientist. So perhaps the answer to the question is straightforward but if not, I would be ...
2
votes
4answers
462 views

Alternative to NSA encryption algorithm

I am looking for a strong alternative to elliptic curve cryptography. It should be something that could face quantum computing attacks, but nothing created by the NSA. I heard about isogeny key ...
0
votes
3answers
159 views

Does NTRU provide Perfect Forward Secrecy?

Does NTRU provide Perfect Forward Secrecy if the world would use it in an HTTPS connection?
-2
votes
1answer
159 views

Why are we advising PKI if we know that quantum computers will break them? [closed]

DNSSEC, ECDHE, RSA, even SSH and all other important specifications, protocols that we rely on and advise people to use them, they use Public key infrastructure. Question: Why do we still use, ...
0
votes
1answer
44 views

FSB Hash Functions and Convetional hash Functions

I'm reading FSB cryptographic hash function and the authors say that security of this function depends on NP-Complete Problem: "Decoding Linear Code Unlike most other cryptographic hash functions in ...
3
votes
3answers
187 views

Asymmetric algorithm for one time signing of small cleartext

I want to generate a key pair such that the private key can be used once to sign a small message (1024 bytes) at some indeterminate point in the future and the public key can be used to verify that ...
9
votes
1answer
266 views

How dead is braid based cryptography

Braid groups has drawn the attention of cryptographers for a few years, as a promising platform for post-quantum cryptographic protocols. The security of the proposed schemes mostly relied on ...
5
votes
1answer
157 views

Is SRP post-quantum secure?

Is SRP-6a post-quantum secure? If it is not post-quantum secure, do any post-quantum secure alternatives similar to SRP-6a exist?
2
votes
1answer
144 views

Generalized Merkle Signatures, SHA-3 and Sakura

Sakura specifies a tree hash mode for e.g. Keccak (SHA-3). Are there any reasons to use the Sakura tree hash mode in a Generalized Merkle Signature Scheme? It seems to me Sakura primarily solves a ...
4
votes
1answer
126 views

McEliece and cryptanalysis

What is the computational time to break McEliece on a quantum computer? I've seen that polynomial time algorithms exist, but for special conditions. What about the general case?
4
votes
1answer
130 views

Deterministic Rand function for Winternitz One Time Signatures

Suppose you are implementing a Generalized Merkle Signature Scheme, using the Winternitz One-Time Signature Scheme for the node signatures. Furthermore, suppose the implementation is to be stateless ...
3
votes
1answer
130 views

What is the quantum-resistant signature scheme with the smallest signature + pubkey?

After playing cat and mouse with an number of quantum-resistant signature schemes and coming up with nothing with small enough signatures, I'm turning to Crypto.SE. I need a quantum-resistant ...
3
votes
2answers
128 views

Basic attacks on McEliece; finding S and P

Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
3
votes
0answers
56 views

space complexity of quantum collision search

Is there a known way to reduce the space complexity of quantum collision search beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below what ...
3
votes
0answers
109 views

FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?

I was reading the paper Fully Homomorphic Encryption over the Integers, and started wondering if there is a known quantum attack on their main scheme, because There is an efficient quantum attack ...
4
votes
3answers
337 views

Stateless hash based public key cryptography?

Merkle-Winternitz signatures based on fractal hash trees are an attractive alternative to other post-quantum cryptographic schemes, in particular since they are conceptually simple, the security ...
4
votes
1answer
379 views

For a one-time pad, which MAC method is information-theoretically secure?

In the the main post about MAC methods it mentions a few methods: Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
3
votes
1answer
142 views

McEliece information set decoding attack vulnerability

Wikipedia states that McEliece is open to "information set decoding attack". What is an "information set decoding attack" and how serious is the vulnerability? (is it just a matter of choosing proper ...
1
vote
2answers
143 views

McEliece key size

There's a lot of references about McEliece key size being the barrier for proper usage of the algorithm, exactly (or roughly) how large are the keys?
4
votes
1answer
221 views

Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse

Tony Arcieri makes an interesting point in his Imperfect Forward Secrecy article which basically boils down to: large entities such as NSA are storing encrypted internet traffic, also what's to stop ...
1
vote
2answers
339 views

How can I simulate and measure brute force hacking using RSA?

I want to implement brute force hacking using RSA. How can I simulate and measure time duration? What software (or software-based simulator) would be needed?
8
votes
1answer
156 views

Is the Couvreur et al. polynomial time attack on McEliece practical?

There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan: ...
0
votes
0answers
86 views

Question Error Correcting Codes

Let $C$ be a code over the finite field $GF(2)$ with generator matrix $G$ and parity matrix $H$. Let $e+C=C'$ be a coset of code $C$. Let $S$ be a non-singular matrix and $H'=H\times S$. Finally, let ...
3
votes
3answers
251 views

Can one use a Cryptographic Accumulator to efficiently store Lamport public keys without the need of a Merkle Tree?

One of the problems of one-time Lamport signatures is that public keys are disposed after use, so you must generate many keys and store them in a Merkle tree. The root is the "real" public key and ...
1
vote
0answers
90 views

Can you provide an example in relation to Hidden Field Equations Multivariate?

I'm reading about Hidden Field Equations Multivariate scheme. My lecture states that the central map is a univariate polynomial $$P(X)=\sum_{i=0}^{r-1}\sum_{j=0}^{r-1}p_{ij}x^{q^i+q^j} \in K[X]$$ ...
8
votes
1answer
357 views

Did NIST verify “post-quantum” claims in the SHA3 proposal papers?

I have been reading Bernstein’s “Quantum attacks against Blue Midnight Wish, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Shabal, SHAvite-3, SIMD, and Skein” paper from 2010… This document disproves ...
0
votes
2answers
131 views

Why use two affine transformations in Multivariate Cryptography?

I'm reading Multivariate Cryptography and would like to know why we use two affine transformations to scramble the central map? Why not use only one?
3
votes
1answer
122 views

Why is Lamport-Diffie secure?

Why is Lamport-Diffie secure? I note that there is a demonstration based on onewayness (in the book postquantum cryptography). But a one way function is not sufficient to ensure that it can not infer ...
1
vote
1answer
248 views

What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
3
votes
2answers
162 views

Merkle Tree High Tree

I'm reading Merkle tree signatures and I like know if the security of the that scheme depends, also, of the high of the tree or only depends that hash function is resistant to collision?