1
$\begingroup$

Is the SWIFFT hash function described in:

https://en.wikipedia.org/wiki/SWIFFT

still considered a provably secure one way function? Is it also considered secure against attacks by a quantum computer? Would it be a good candidate for a post-quantum (quantum safe) hash?

$\endgroup$
  • $\begingroup$ Note: There is currently no reason to believe that standard hash functions such as SHA2/SHA3 are broken by quantum computers beyond the speedup provided by Grover's algorithm, hence those are "good candidates for a post-quantum hash". $\endgroup$ – yyyyyyy May 13 '17 at 9:19
1
$\begingroup$

You have to be a bit careful here, I think.

The SWIFFT hash function is linear and does not behave like a random oracle. It is second pre-image resistant in an asymptotic sense. The fact that this property seems to depend on "a relatively mild assumption about the worst-case difficulty of finding short vectors in cyclic/ideal lattices" would seem to suggest (subject to verification) it might be post quantum secure (like NTRU which is also based on cyclic/ideal lattices).

However, the SWIFFT function is defined for fixed input length. Hence it cannot be directly used as a one way hash function for arbitrary length inputs, maybe it could be a building block for a post quantum secure one way hash function, I am not sure.

$\endgroup$
  • 1
    $\begingroup$ I wouldn't place a tremendous amount of trust in the post-quantum security of ideal lattice assumptions. The area is basically brand new and some quantum attacks have already been demonstrated on special cases. The fixed input length thing, meh. A literature search would probably turn up a provably-secure domain extension transform to allow you to get to arbitrary-length inputs. $\endgroup$ – pg1989 May 13 '17 at 4:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.