1
$\begingroup$

What are the post quantum cryptography protocols that have been proposed until now?

I know about McEliece cryptosystem, and LWE scheme. What are the others? Can you provide me a list or a website containing such list?

$\endgroup$

closed as off-topic by SEJPM, otus, yyyyyyy, e-sushi Mar 8 '16 at 20:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ code based, (R)LWE based, lattice based and hash based. Those are the four core problems of most PQ crypto schemes. $\endgroup$ – SEJPM Mar 7 '16 at 17:21
  • 2
    $\begingroup$ I'm sorry, but I have to vote to close this question. The question asks for a reference recommendation which may get outdated rather soon and thus will be an invaluable or even misleading ressource for others looking for the same thing in the future, especially as this field seems to get some traction now after the NSA said that they now move to PQ crypto for Suite B. $\endgroup$ – SEJPM Mar 7 '16 at 17:23
  • $\begingroup$ @SEJPM: There's also Multivariate and Elliptic Curve Isogeny. In addition, (R)LWE is a subset of "Lattice based" $\endgroup$ – poncho Mar 7 '16 at 17:34
  • $\begingroup$ @SEJPM it appears illogical but in English 'invaluable' is actually extremely good. You want 'valueless' or 'worthless'; or perhaps 'unhelpful'. $\endgroup$ – dave_thompson_085 Mar 9 '16 at 0:52
3
$\begingroup$

First, a pedantic point: be careful with terminology: there currently are no Post-Quantum "protocols" (TLS, S/MIME, CMP, etc). From your question, I'm assuming you are interested in PQ "schemes", or PQ "primitives" (XMSS, R-LWE, etc). This may seem like nit-picking, but we can expect NIST to standardize primitives in the next 3 - 5 years, protocols will take longer than that!


Now for your actual question. As @SEJPM points out, the research is still very young and is rapidly changing, so any links to actual schemes will very quickly go out of date. What I will do instead is link to the organizations that you should be following.

NIST

  • Link to their talk from the recent PQCrypto2016 conference outlining their upcoming call for applications for candidate PQ signature and encryption schemes.
  • See their February 2016 report, basically a "What we know at this point".
  • pqc-forum@nist.gov is the mail-list for discussion of post-quantum schemes and their standardization. This went live very recently so I can't find any references to it online, but you can get yourself onto it by sending an empty email to pqc-forum-request@nist.gov with subject:subscribe

NSA

PQCrypto Project

  • Group funded by the European Union to research and recommend PQ schemes.
  • pqcrypto.eu.org

IETF / IRTF's Crypto Forum Research Group (CFRG)

$\endgroup$
1
$\begingroup$

This is probably fairly thorough.. http://csrc.nist.gov/publications/drafts/nistir-8105/nistir_8105_draft.pdf

$\endgroup$
  • $\begingroup$ @all: Please see Mike Ounsworth's answer for a more complete discussion of this same topic. $\endgroup$ – Daniel Apon Jun 16 '17 at 17:44
1
$\begingroup$

In public key cryptography,three schemes are quantum-secure:

  1. Lattice based cryptography like NTRUEncrypt and LWE; based on lattices
  2. code-based cryptography like McEliece cryptosystem; based on information theory
  3. multivariate cryptography like Hidden Fields Equations

and in symmetric encryption like AES,if you choose a long key;you are safe against quantum computer and NSA!

for future reading:Quanta magazine link and post-quantum cryptography book

$\endgroup$
  • 2
    $\begingroup$ you're missing at least "hash based" (for signatures) and "elliptic curve isogeny based" (for encryption), additionally to all those reference problems introduced with all the FHE schemes... $\endgroup$ – SEJPM Mar 7 '16 at 18:47
  • 1
    $\begingroup$ Also missing "braid group based". @SEJPM: Also "isogeny based" will most likely never make it to a protocol, since underlying assumptions are supposed to be to weak. This may only have pedagogical interest (as stated by the authors). $\endgroup$ – Fleeep Mar 8 '16 at 4:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.