2
$\begingroup$

Recently, I've been researching and implementing a bit of post-quantum cryptography, and I came across two RLWE-KEX algorithm for key exchange.

The first one, which I implement in my software, is the one by V.Singh http://eprint.iacr.org/2015/138 which provides 2 practical parameter sets. I find this one simple and easy to implement.

However, this paper seems to get little attention and few citation compared to NEWHOPE http://eprint.iacr.org/2015/1092 by L.Dacus et al. It provides only 1 set of practical parameters, but seems to get more attention. I remember seeing another stackexchanger recommending it to a fellow, and there are several proposals for improvements out there (although I feel these improvements also apply to the VS scheme back there).

So, should I switch? I do remember NIST saying they don't expect to "pick a winner", so I guess I could stick to my choice. Or is there an inherent advantage within NEWHOPE over the VS scheme?

Improve this question
$\endgroup$
3
  • $\begingroup$ @chris-peikert may I be graced with your attention? $\endgroup$
    – DannyNiu
    Commented Jul 21, 2016 at 5:46
  • 2
    $\begingroup$ Among existing implementations, and modulo some concerns about their error distributions, NewHope or Frodo look best to me so far. I wouldn't use one of these alone, but would properly combine it with an established classical KEX as Google has done, so that an attacker must break both protocols in order to win. $\endgroup$
    – Chris Peikert
    Commented Jul 25, 2016 at 0:51
  • $\begingroup$ The latest PQCrypto publication has a paper that demonstrates how researchers can simulate entire sessions against certain R-LWE instances. "Cryptanalysis of RLWE-Based One-Pass Authenticated Key Exchange" by B. Gong and Y. Zhao. I believe this attack applies to New Hope. $\endgroup$
    – floor cat
    Commented Aug 18, 2017 at 20:51

2 Answers 2

Reset to default
1
$\begingroup$

As NEWHOPE builds its security proof based upon previous works, and that Google has been experimenting with it, I think I should read the paper more thoroughly and hop along.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Technically, NEWHOPE counts as an improvement over the proposal of C.Peikert, while V.Singh merely gave a set of parameters. $\endgroup$
    – DannyNiu
    Commented Jul 24, 2016 at 1:43
  • $\begingroup$ The BCNS ring-LWE key exchange protocol BCNS15 is also worthy of attention. You can see the performance of these PQ key exchanges in this paper as well. $\endgroup$
    – Hamidreza
    Commented May 20, 2017 at 9:41
  • $\begingroup$ 2020 update: NewHope got eliminated in Round 3 NIST PQC Project. $\endgroup$
    – DannyNiu
    Commented Dec 15, 2020 at 12:02
1
$\begingroup$

Use NewHope Simple. It's easier to understand and easier to implement as NewHope. On the other hand, the communication overhead is only marginal.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.