# Tag Info

## Hot answers tagged post-quantum-cryptography

7

Post-quantum crypto is a very young field and is still changing quite rapidly. If you just want a reading list to introduce you to the topics, I would recommend the March 2015 report released by the EU's PQCrypto Project, and the April 2016 report from NIST. As of today, here's an (incomplete) list of candidate algorithms for post-quantum cryptography ...

5

How many qubits are required for breaking RSA 2048 and RSA 4096 in real-time with a quantum computer? Like the answer you linked to shows, about $\log(N^2) = 2 \log(N)$. So 4096 for 2048-bit RSA, double that for 4096-bit. This paper (pdf) has an algorithm using $2n+3$ qubits, where $n=\log N$. How many qubits are required to break ...

4

Yes the Bernstein attack is applicable but the impact of the attack is reduced because the party generating the parameter is also going to be a legitimate participant of the key exchange. Here is why the attack does indeed apply. Consider a case where Bob and Alice wish to conduct a key exchange using the New Hope Lattice-Based Key Exchange. Bob will be ...

4

What we traditionally call Elliptic Curve Cryptography (working in the group of points on an elliptic curve over a finite field) is vulnerable to an attack by a quantum computer running Shor's algorithm and is thus not considered a Quantum-Safe or Post Quantum Cryptographic algorithm. However there is an true Post Quantum Key Exchange algorithm which uses ...

3

There is a variant of the Neiderreiter system by Courtois, Finiasz, and Sendrier found in their paper: "How to achieve a McEliece-based Digital Signature Scheme" from Asiacrypt 2001. The Wikipedia article on the Neiderreiter Cryptosystem provides a brief introduction to this signature. There is an element of trial and error in the signing process that is ...

2

If we assume that Alice is the one sending the photons, and Bob is the one receiving them, then Bob selects random bases to take the measurements, and then announces them (both to Alice and any potential attacker) after he has taken those measurements. An attacker cannot use that announcement to decide how to take measurements himself, as he doesn't hear it ...

2

As @Raoul722 pointed out the polynomial should be irreducible. One should also add the fact that in the original Ring-LWE article security proofs hold by sampling the error with a spherical distribution and the poly $f=x^{2^n}+1$. In How (Not) to Instantiate Ring-LWE, from Invulnerability instantiations subsection it's specified that you could in fact ...

1

Definition: An element $\alpha$ in a finite field $F_q$ is called a primitive element (or generator) of $F_q$ if $F_q =\{0,\alpha,\alpha^2,...,\alpha^{q-1}\}$. Let $\alpha$ be an element of $F_{q^m}$ then $\alpha$ is a root of $x^{q^m} − x=x(x^{q^m-1} − 1)$, so, this polynomial is a good tool for extending fields. Also, choosing $x^n+1$ make modular ...

1

While there is a sub-exponential attack to compute isogenies on ORDINARY elliptic curves (the basis for the Rostovev and Stulbunov paper that you reference) there is not (yet at least) a sub-exponential attack to compute isogenies on SUPERSINGULAR elliptic curves. The cryptosystem proposed by DeFeo, Jao, and Plut back in 2011 is based on Supersingular ...

Only top voted, non community-wiki answers of a minimum length are eligible