1
$\begingroup$

I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-SHA512 if I use post quantum digital signatures?

In my program a post quantum key exchange will ensure exchange of shared secret which will be used as session key for AES , I am planning to sign plaintext and then encrypt plaintext along with digital signature. will I need MAC .

Improve this question
$\endgroup$
5
  • 3
    $\begingroup$ "AES-GCM and ChaCha20Poly1305 aren't post quantum secure"; that is actually not true, or rather, true in an extremely narrow sense. The scenario where they aren't 'postquantum' is one where the crypto implementation is willing to take quantum-entangled inputs, and respond with quantum-entangled results (being extremely careful to maintain the entanglement during the crypto processing). I rather doubt that your PGP-like implementation will do that; actually, it would be a major advancement in Quantum Computing if you did in fact manage that... $\endgroup$
    – poncho
    Jul 19, 2022 at 15:04
  • $\begingroup$ Without the actual protocol or scheme it will be hard to tell if you need HMAC or not. Generally you would not pair it directly with digital signatures of course, but maybe the signatures are only used to authenticate a key agreement and end-entity? I mean, HMAC has been used in TLS for a long time alongside signature generation. $\endgroup$
    – Maarten Bodewes ♦
    Jul 19, 2022 at 21:53
  • $\begingroup$ @MaartenBodewes i am thinking of creating a minimalistic PGP like implementation , i thought since digital signatures provide authentication , i need no HMAC for integrity of ciphertext, i do follow sign-then-encrypt scheme but got confused as most people recommend using HMAC $\endgroup$
    – ANISH M 18CS006
    Jul 20, 2022 at 3:43
  • $\begingroup$ @poncho in case my implementation is willing to take quantum-entangled inputs and respond with quantum-entangled results and I am using AES-GCM will it affect confidentiality of ciphertext or its integrity or both? Sorry if this question is dumb i am just curious. $\endgroup$
    – ANISH M 18CS006
    Jul 20, 2022 at 8:37
  • 1
    $\begingroup$ @ANISHM18CS006: I believe that it is integrity; an application of Simon's algorithm would allow you to recover the internal H value, which would allow you to make arbitrary modifications to encrypted ciphertexts $\endgroup$
    – poncho
    Jul 20, 2022 at 12:32

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.