7
$\begingroup$

QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems.

I am looking for a post-quantum key exchange algorithm with the following properties:

  • Fast (Lattice-based)
  • IND-CCA2
  • The chosen key depends on randomness from both parties (this is important for many uses of channel binding).
Improve this question
$\endgroup$
8
  • $\begingroup$ I believe Supersingular isogeny key exchange meets the criteria that it's fast, post-quantum-secure and is random. I couldn't find any references to IND-CCA2 for Supersingular isogeny key exchange, though - which is why I wrote this comment instead of an answer. $\endgroup$
    – AleksanderCH
    Commented Oct 1, 2018 at 14:31
  • $\begingroup$ @AleksanderRassasse CCA2 ist a security notion for public key encryption anyways. Chances are a IES style construction will work to construct one. $\endgroup$
    – SEJPM
    Commented Oct 1, 2018 at 15:57
  • $\begingroup$ @SEJPM Did you mean "CCA2 is not a security notion for public key encryption"? If so, why is that? PS: not sure if this should be a separate question :) $\endgroup$
    – rkiyanchuk
    Commented Oct 2, 2018 at 6:08
  • 2
    $\begingroup$ @zoresvit I meant exactly what I said. CCA2 is a security notion for (public-key) encryption. Key-Exchange algorithms themselves are not directly encryption algorithms, thus CCA2 doesn't apply to them (case in point: Diffie-Hellman). But using an IES-style approach we can probably construct a CCA2-secure encryption scheme from the key exchange. $\endgroup$
    – SEJPM
    Commented Oct 2, 2018 at 8:43
  • $\begingroup$ Now I'm clear, thanks for the explanation! PS: The reason I asked was that I wasn't sure if "ist" was a typo of "is" or "isn't", and additional context also helped. $\endgroup$
    – rkiyanchuk
    Commented Oct 2, 2018 at 17:05

1 Answer 1

Reset to default
1
$\begingroup$

NewHope is a key-exchange protocol based on the Ring-Learning-with-Errors (Ring-LWE) problem.

NewHope512-CCA-KEM and NewHope1024-CCA-KEM are IND-CCA-secure key encapsulation mechanisms that target level 1 and level 5, respectively, (matching or exceeding the brute-force security of AES-128 and AES-256, respectively).

Google is working on deploying post-quantum key-agreement in TLS by combining NewHope with an existing key-agreement (X25519)as the combination CECPQ1. Please find a GoLang implementation of NewHope in GitHub.

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ KEM is not really key agreement, it's key establishment. Does it comply to "The chosen key depends on randomness from both parties (this is important for many uses of channel binding)." ? $\endgroup$
    – Maarten Bodewes ♦
    Commented May 3, 2021 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.