2
$\begingroup$

Recently, I've been researching and implementing a bit of post-quantum cryptography, and I came across two RLWE-KEX algorithm for key exchange.

The first one, which I implement in my software, is the one by V.Singh http://eprint.iacr.org/2015/138 which provides 2 practical parameter sets. I find this one simple and easy to implement.

However, this paper seems to get little attention and few citation compared to NEWHOPE http://eprint.iacr.org/2015/1092 by L.Dacus et al. It provides only 1 set of practical parameters, but seems to get more attention. I remember seeing another stackexchanger recommending it to a fellow, and there are several proposals for improvements out there (although I feel these improvements also apply to the VS scheme back there).

So, should I switch? I do remember NIST saying they don't expect to "pick a winner", so I guess I could stick to my choice. Or is there an inherent advantage within NEWHOPE over the VS scheme?

$\endgroup$
  • $\begingroup$ @chris-peikert may I be graced with your attention? $\endgroup$ – DannyNiu Jul 21 '16 at 5:46
  • 2
    $\begingroup$ Among existing implementations, and modulo some concerns about their error distributions, NewHope or Frodo look best to me so far. I wouldn't use one of these alone, but would properly combine it with an established classical KEX as Google has done, so that an attacker must break both protocols in order to win. $\endgroup$ – Chris Peikert Jul 25 '16 at 0:51
  • $\begingroup$ The latest PQCrypto publication has a paper that demonstrates how researchers can simulate entire sessions against certain R-LWE instances. "Cryptanalysis of RLWE-Based One-Pass Authenticated Key Exchange" by B. Gong and Y. Zhao. I believe this attack applies to New Hope. $\endgroup$ – nonce Aug 18 '17 at 20:51
1
$\begingroup$

As NEWHOPE builds its security proof based upon previous works, and that Google has been experimenting with it, I think I should read the paper more thoroughly and hop along.

$\endgroup$
  • $\begingroup$ Technically, NEWHOPE counts as an improvement over the proposal of C.Peikert, while V.Singh merely gave a set of parameters. $\endgroup$ – DannyNiu Jul 24 '16 at 1:43
  • $\begingroup$ The BCNS ring-LWE key exchange protocol BCNS15 is also worthy of attention. You can see the performance of these PQ key exchanges in this paper as well. $\endgroup$ – Hamidreza May 20 '17 at 9:41
1
$\begingroup$

Use NewHope Simple. It's easier to understand and easier to implement as NewHope. On the other hand, the communication overhead is only marginal.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.