We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks break with 2^60.55 bit operations..
$\begingroup$
$\endgroup$
2
-
1$\begingroup$ You'll need a source for your McEliece statement. I'd expect the number of operations to depend on key sizes. If you're willing to use a large key, you should be able to reach any security level you like. $\endgroup$– CodesInChaosCommented Dec 7, 2012 at 11:14
-
1$\begingroup$ Related question: What is the post-quantum cryptography alternative to Diffie-Hellman? $\endgroup$– CodesInChaosCommented Dec 7, 2012 at 12:31
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
7
My impression is that there is no production ready post quantum scheme ATM.
NTRU seems to be decent (complete spec, reasonable parameter-sizes and performance), but I think it's patented. No idea about the licensing terms.
But whatever scheme you choose, don't use it instead of a conventional scheme(RSA, DH, ECDH) but in addition to a conventional scheme. If you use a good construction, your protocol will be as secure as the stronger of the schemes.
answered Dec 7, 2012 at 11:31
-
1$\begingroup$ Hasn't NTRU been broken several time by Faugère's work on Gröbner basis ? $\endgroup$ Commented Dec 7, 2012 at 11:48
-
$\begingroup$ @AlexandreYamajako No idea. I don't really trust any of these new schemes, that's why I recommended using it in addition to a conventional scheme. $\endgroup$ Commented Dec 7, 2012 at 12:16
-
$\begingroup$ @CodeInChaos what construction were you thinking about ? I don't think composition is a terrible idea but there are exemples in which it breaks. Maybe pick $r$ at random then $m_0\gets r\oplus m$ and $m_1 \gets r$ ? $\endgroup$ Commented Dec 7, 2012 at 13:38
-
$\begingroup$ @AlexandreYamajako The choice of construction depends on the application requirements. But if you just need a symmetric key, you could for example choose two random keys, encrypt each one with a different scheme, and use the hash of both as your symmetric key. $\endgroup$ Commented Dec 7, 2012 at 13:39
-
1$\begingroup$ Or you could avoid avoid needing to rely on "random oracle"ness of the hash, and $\hspace{1.4 in}$ just use the xor of both as your symmetric key. $\:$ $\endgroup$– user991Commented Dec 7, 2012 at 22:41