Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

learn more… | top users | synonyms

3
votes
1answer
80 views

Why is 128-bit considered “medium term” security?

Why is 128-bit encryption considered good enough for medium term security only? How is expected to be eventually broken? Quantum computing or brute force attack?
3
votes
2answers
377 views

Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?

Can hash trees provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key?
3
votes
1answer
55 views

Truncating ciphertexts on ring-LWE schemes

On the section 5.4 of the paper Improved Security for a Ring-Based Fully Homomorphic Encryption Scheme, the authors explain how to discard some bits of the ciphertexts to get smaller ciphertexts and ...
3
votes
1answer
222 views

Can there be a need for 1024-bit (symmetric) encryption?

I think we are all aware of the CAESAR-competition. Now the aim of this competition is to select a (portfolio of) winner(s) which provide authenticated encryption. I'll now assume that the results ...
3
votes
3answers
182 views

Supersingular Isogeny Key Exchange broken?

Found this report detailing a quantum algorithm for computing isogenies between supersingular elliptic curves. http://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf with the quote ...
3
votes
2answers
828 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
3
votes
1answer
43 views

Practical lattice based signatures and key exchange with strong security reduction

I am looking for practical lattice-based signatures and key exchange with strong security reductions. Specifically: Provable security under the relevant standard assumptions. Fast in software while ...
3
votes
1answer
136 views

What is the quantum-resistant signature scheme with the smallest signature + pubkey?

After playing cat and mouse with an number of quantum-resistant signature schemes and coming up with nothing with small enough signatures, I'm turning to Crypto.SE. I need a quantum-resistant ...
3
votes
1answer
308 views

Quantum resistance of Lamport signatures

The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?
3
votes
1answer
81 views

Parameter choice Supersingular Isogeny DH

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies” by DeFeo, Jao and Plut (PDF), the public parameters are defined as: Supersingular curve $E$, and bases $P, Q$ ...
3
votes
3answers
224 views

Asymmetric algorithm for one time signing of small cleartext

I want to generate a key pair such that the private key can be used once to sign a small message (1024 bytes) at some indeterminate point in the future and the public key can be used to verify that ...
3
votes
1answer
130 views

Why is Lamport-Diffie secure?

Why is Lamport-Diffie secure? I note that there is a demonstration based on onewayness (in the book postquantum cryptography). But a one way function is not sufficient to ensure that it can not infer ...
3
votes
0answers
33 views

Is an instruction similar to PCLMULQDQ valuable in post quantum key exchange?

This paper describes a Quantum Key Exchange based on the Ring Learning With Errors problem. When used with ECC, there is only a slight performance impact. Assuming this is the popularized approach ...
3
votes
0answers
33 views

Best Attack Against HFE cryptosystem

I am looking for the best know attack against HFE cryptosystem. Reading this paper DEGREE OF REGULARITY FOR HFE I found the next claim However, Faugere and Joux demonstrated that we can solve and ...
3
votes
0answers
36 views

Would LWE problem be still secure if error were like this $e=2e_1$?

In the Learning with error problem, if the error term $e$ from equation $b=<a,s>/q+e$ were of this kind $e=2e_1$, where $e_1$ is chosen according to the probability distribution for the LWE ...
3
votes
2answers
143 views

Basic attacks on McEliece; finding S and P

Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
3
votes
0answers
60 views

space complexity of quantum collision search

Is there a known way to reduce the space complexity of quantum collision search beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below what ...
3
votes
0answers
132 views

FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?

I was reading the paper Fully Homomorphic Encryption over the Integers, and started wondering if there is a known quantum attack on their main scheme, because There is an efficient quantum attack ...
2
votes
5answers
2k views

Using one-way hash functions as the encryption method

Suppose two parties want to communicate securely with each other (Bob and Alice) using a simple messaging system in English. There are approximately 180,000 currently used words in the English ...
2
votes
1answer
763 views

Diffie-Hellman is Post-quantum secured?

If Alice and bob have a secure channel for key-exchange and mallory don't man-in-the-middle attack them but in the future eavesdrop connection and see the key exchanged, can mallory break it like RSA ...
2
votes
1answer
40 views

Winternitz Signature in standard model

I am studying the Winternitz signature and I describe its algorithms in the next W-OTS Key Generation. Select the parameter $w\geq 2$ that is the bit size of the partitions of the message to be ...
2
votes
2answers
245 views

McEliece key size

There's a lot of references about McEliece key size being the barrier for proper usage of the algorithm, exactly (or roughly) how large are the keys?
2
votes
1answer
115 views

What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?

This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based ...
2
votes
1answer
581 views

using Post-quantum asymmetric ciphers instead of RSA

We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks ...
2
votes
1answer
63 views

Understanding the Hidden Subgroup Problem specific to Integer Factorization

I've been reading about the Hidden Subgroup Problem (HSP), specifically trying to understand how it is related to the integer factorization problem. I've read What exactly is the impact of the hidden ...
2
votes
1answer
57 views

Security of MSS

I have started reading about the Merkle Signature Scheme. I am a little confused about why it is believed to be secure against quantum attacks, couldn't the hash function be attacked? What would make ...
2
votes
1answer
210 views

Generalized Merkle Signatures, SHA-3 and Sakura

Sakura specifies a tree hash mode for e.g. Keccak (SHA-3). Are there any reasons to use the Sakura tree hash mode in a Generalized Merkle Signature Scheme? It seems to me Sakura primarily solves a ...
2
votes
1answer
43 views

Why are the bit lengths of keys and digests equal in Lamport signatures?

In Lamport's one time signature scheme: One way function to convert a pseudo random number private key to a public key takes $\{0,1\}^n$ and returns $\{0,1\}^n$. Cryptographic hash function to ...
2
votes
0answers
37 views

DSSP reduction to DSSI

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies" by DeFeo, Jao and Plut, a reduction from the Decisional Supersingular Product (DSSP) problem to Decisional ...
2
votes
2answers
248 views

Post-quantum authenticated encryption

It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong. However, these statements are always made ...
2
votes
0answers
99 views

PKC McEliece + $S$ + $P$ [closed]

I am trying implement the McEliece crytosystem in SAGE. My question is How I will be able to choose the appropriate matrix $S$ and $P$?. I ask this because when I trying obtain the vector $\hat{m}=mS$ ...
1
vote
2answers
156 views

PQ Key Exchange based on Elliptic Curve Isogenies

I was reading the Wikipedia article on Post Quantum Cryptography and was interested in opinions as to whether the Supersingular Elliptic Curve Isogeny Diffie-Hellman listed there would be a good Post ...
1
vote
1answer
86 views

Efficiency of McEliece cryptography (ciphertext expansion)

Most of the sources say McEliece has never gained acceptance because of its large size of private and public keys. However I have never heard about the size (or length) of its ciphertext. ...
1
vote
1answer
120 views

Is there any restriction in using lossless compression algorithms for huge key sizes?

I'm studying McEliece and Multivariate Public Key cryptographic systems. The main problem here is the huge key size. Is there any restriction in using lossless compression algorithms to fix this ...
1
vote
1answer
176 views

Merkle Signature Generation

In the section 2 (page 42) of the book "Post Quantum Cryptography", it says: Then he generates the one-time signature $\sigma_{\text{OTS}}$ of the digest using the $s$-th one-time signature key ...
1
vote
1answer
37 views

McEliece variants that support signatures

Besides the Niederreiter cryptosystem, are there any other variants that support digital signatures? Can any of them sign arbitrary signatures unlike the Niederreiter cryptosystem? What are the key ...
1
vote
1answer
51 views

Winternitz Signature Scheme Verfication

I am reading page 39 in this "Post Quantum Cryptography" book. Why does equation 15 hold? There is no further knowledge about f and you definitely cannot use any power laws. So, why is ...
1
vote
2answers
173 views

NTRU key generation

I've been experimenting with an NTRU open-source C implementation here I've noticed something (potentionally) strange with a certain set of params: NTRU_EES1087EP2 (defined here). When generating ...
1
vote
1answer
42 views

BB84 quantum protocol

In BB84 protocol, when Alice and Bob make key distribution, what is the private thing? They select randomly bases and then make a measurement according to these bases. Used bases are private? I mean ...
1
vote
1answer
33 views

The security of Hidden Field Equations - sentence

I am reading this paper "The security of Hidden Field Equations (HFE)" and at the end of the page 3 the author wrote: The random oracle paradigm would be to ignore that the function formulae ...
1
vote
1answer
328 views

What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
1
vote
1answer
403 views

What are some different cryptography methods?

Some of the most effective cryptography methods and algorithms are based of factoring large prime numbers (e.g. RSA). I'm curious whether there are some other cryptography methods. Somethings that is ...
1
vote
3answers
32 views

Why the exponent is a power of 2 in Ring-LWE?

I was reading some papers on Ring-LWE. I found almost all of them talk to choose the polynomial modulo $x^n+1$ where $n$ is a power of $2$. I did not understand why this condition is necessary?
1
vote
1answer
381 views

Supersingular Isogeny Key Exchange Software [closed]

Are there any optimised implementations of the Supersingular Isogeny Key Exchange by Defeo, Jao, and Plut. It seems like this would be a great drop-in replacement for Diffie-Hellman in both OpenSSL ...
1
vote
2answers
187 views

Are there any quantum-resistant symmetric encryption schemes?

It seems that quite a few currently available encryption schemes will possibly be broken by quantum computing. Are there any symmetric encryption schemes that will remain unbroken (either because of ...
1
vote
2answers
441 views

How can I simulate and measure brute force hacking using RSA?

I want to implement brute force hacking using RSA. How can I simulate and measure time duration? What software (or software-based simulator) would be needed?
1
vote
1answer
119 views

Merkle signature + PRNG?

In the section 3 (page 44) of the book "Post Quantum Cryptography", it says: Then each one-time signature key must be generated twice, once for the MSS public key generation and once during the ...
1
vote
1answer
74 views

Quantum vs. regular computing time to break ECC?

How long exactly would it take for a regular computer to crack an elliptic curve public/private key via bruteforce, vs. a quantum computer using Shor's algorithm with a couple thousand qubits? Can ...
1
vote
3answers
131 views

List of post quantum cryptography protocols [closed]

What are the post quantum cryptography protocols that have been proposed until now? I know about McEliece cryptosystem, and LWE scheme. What are the others? Can you provide me a list or a website ...