Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

learn more… | top users | synonyms

2
votes
1answer
516 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
0
votes
0answers
86 views

Question Error Correcting Codes

Let $C$ be a code over the finite field $GF(2)$ with generator matrix $G$ and parity matrix $H$. Let $e+C=C'$ be a coset of code $C$. Let $S$ be a non-singular matrix and $H'=H\times S$. Finally, let ...
3
votes
2answers
316 views

Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?

Can hash trees provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key?
8
votes
1answer
352 views

Did NIST verify “post-quantum” claims in the SHA3 proposal papers?

I have been reading Bernstein’s “Quantum attacks against Blue Midnight Wish, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Shabal, SHAvite-3, SIMD, and Skein” paper from 2010… This document disproves ...
3
votes
3answers
238 views

Can one use a Cryptographic Accumulator to efficiently store Lamport public keys without the need of a Merkle Tree?

One of the problems of one-time Lamport signatures is that public keys are disposed after use, so you must generate many keys and store them in a Merkle tree. The root is the "real" public key and ...
1
vote
0answers
86 views

Can you provide an example in relation to Hidden Field Equations Multivariate?

I'm reading about Hidden Field Equations Multivariate scheme. My lecture states that the central map is a univariate polynomial $$P(X)=\sum_{i=0}^{r-1}\sum_{j=0}^{r-1}p_{ij}x^{q^i+q^j} \in K[X]$$ ...
0
votes
2answers
131 views

Why use two affine transformations in Multivariate Cryptography?

I'm reading Multivariate Cryptography and would like to know why we use two affine transformations to scramble the central map? Why not use only one?
1
vote
1answer
235 views

What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
0
votes
1answer
93 views

Sematically Secure McEliece

I am read the Lemma 2 (pp13) in the paper "Kazukuni Kobara and Hideki Imai: Semantically Secure McEliece Public-Key Cryptosystems –Conversions for McEliece PKC– (PKC 2001)". Related to the question ...
4
votes
2answers
119 views

post-quantum threshold secret sharing

I am looking for a references for post-quantum threshold secret sharing schemes. I am especially interested in knowing whether any one based on one-way compressor functions or cryptographic hashes ...
2
votes
5answers
2k views

Using one-way hash functions as the encryption method

Suppose two parties want to communicate securely with each other (Bob and Alice) using a simple messaging system in English. There are approximately 180,000 currently used words in the English ...
3
votes
1answer
256 views

Quantum resistance of Lamport signatures

The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?
4
votes
2answers
216 views

Fractal Merkle Traversal

I am studying Fractal Merkle Tree Traversal algorithm in this book. In the [pag. 54] I don't understand this paragraph: We may determine the number of pebbles returned at these times by ...
4
votes
2answers
338 views

Is there any research about cryptography on nondeterministic Turing machines?

I know it's a highly theoretical topic, but I was wondering if there was any research out there about what cryptography would be like assuming that we had access to nondeterministic Turing machines. ...
1
vote
0answers
118 views

Merkle path authentication

In point 4 of the Algorithm 4.2 (Classic Merkle Tree Traversal) of *"Post_Quantum_Cryptography.pdf"* shows *"Stack_h.update(2)"* each stack receives two updates. I am trying understand to understand ...
-2
votes
1answer
1k views

University for Crypto grad study [closed]

(I thought twice before asking this question and quite reluctant to type as well, but I think this would be helpful). I am an undergrad student and choose theoretical computer science as my major. ...
6
votes
3answers
1k views

McEliece Cryptosystem Implementations

Are there any current implementations (language irrelevant) of the McEliece Cryptosystem? I have been hunting around all day, and yet, have only found a few mathematical equations pertaining to the ...
2
votes
0answers
87 views

PKC McEliece + $S$ + $P$ [closed]

I am trying implement the McEliece crytosystem in SAGE. My question is How I will be able to choose the appropriate matrix $S$ and $P$?. I ask this because when I trying obtain the vector $\hat{m}=mS$ ...
5
votes
1answer
142 views

Using encryption schemes for identification

I've been researching how to implement a post-quantum SSL-like connection authentication, especially correct identification&authentization of the server/client. Because good post-quantum digital ...
4
votes
1answer
175 views

Which MAC scheme is quantum resistant?

will HMAC survive Grover algorithm ? if not then which MAC scheme provide post-quantum security ?
7
votes
1answer
2k views

Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$). That explains why we are using 256 bit ...
1
vote
1answer
336 views

What are some different cryptography methods?

Some of the most effective cryptography methods and algorithms are based of factoring large prime numbers (e.g. RSA). I'm curious whether there are some other cryptography methods. Somethings that is ...
13
votes
4answers
2k views

What is the post-quantum cryptography alternative to Diffie-Hellman?

Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption ...
4
votes
1answer
251 views

Does Grover's algorithm effect block size or only key size?

We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security). I heard somewhere ...
2
votes
1answer
454 views

using Post-quantum asymmetric ciphers instead of RSA

We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks ...
2
votes
1answer
545 views

Diffie-Hellman is Post-quantum secured?

If Alice and bob have a secure channel for key-exchange and mallory don't man-in-the-middle attack them but in the future eavesdrop connection and see the key exchanged, can mallory break it like RSA ...
12
votes
3answers
653 views

What exactly is the impact of the hidden subgroup problem on cryptography?

I understand my group theory (allegedly), so I can make partial sense of The Hidden Subgroup problem: Given a group $G$, a subgroup $H \leq G$, and a set $X$, we say a function $f : G \Rightarrow ...
8
votes
3answers
593 views

Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?

A recent paper showed that the McEliece cryptosystem is not, unlike RSA and other cryptosystems, weakened as drastically by quantum computing because strong Fourier sampling cannot solve the hidden ...