I'm interested in the Post Quantum Algorithms of the 3rd round of the NIST standardization competition. The algorithms for KEM are Classic McEliece, CRYSTALS-KYBER, NTRU, SABER and their 5 alternatives. The signature algorithms are CRYSTALS-DILITHIUM, FALCON, Rainbow and the 3 alternatives. I was looking for a comparison of those algorithms regarding key length (mainly for level 1 NIST security) and runtime. Sadly I couldn't find a good source for that. Can you help me?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ There was a question about this a year ago... need to find... $\endgroup$– kelalakaCommented Apr 26, 2022 at 16:45
-
1$\begingroup$ This covers half of your question What are the public key and output sizes for the four remaining PQC KEM candidates?. Of course, there are some advancements. Your question is too broad in the sense that include two different subject to cover. $\endgroup$– kelalakaCommented Apr 26, 2022 at 18:24
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
You can find the full sets of parameters and run times for all propositions in their relevant algorithm specifications and supporting documents:
- parameter sets - page 9
- runtimes - page 15
- parameter sets - page 19
- runtimes - page 33
- parameter sets - page 5
- runtimes - page 29
- parameter sets - page 11
- runtimes - page 14
All of these and more files such as the test implementations these times are generated from can be found from the NIST round 3 submissions page.
edit: As @kelalaka has said in their comment, this question more succinctly answers the question regarding key length
edit 2: I found this paper which quite nicely compares the key length and performance of the round 3 submissions.
-
$\begingroup$ Welcome to Cryptography.SE. This is not comparison. $\endgroup$– kelalakaCommented Apr 26, 2022 at 18:22
-
$\begingroup$ I don't understand how to give a comparison better than this - the runtime tables show cpu cycles taken for the given operations on the same processor, and the security of the schemes is not necessarily dependant on the length of the key but the parameters chosen. $\endgroup$– supinieCommented Apr 26, 2022 at 18:36
-
$\begingroup$ See my comment under the question... $\endgroup$– kelalakaCommented Apr 26, 2022 at 19:13
-
$\begingroup$ I see, I do agree that link does provide a more clear answer for key length and have added it as an edit, I still believe my answer gives comparison for runtimes. $\endgroup$– supinieCommented Apr 26, 2022 at 19:56