QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems.

I am looking for a post-quantum key exchange algorithm with the following properties:

  • Fast (Lattice-based)
  • IND-CCA2
  • The chosen key depends on randomness from both parties (this is important for many uses of channel binding).
  • $\begingroup$ I believe Supersingular isogeny key exchange meets the criteria that it's fast, post-quantum-secure and is random. I couldn't find any references to IND-CCA2 for Supersingular isogeny key exchange, though - which is why I wrote this comment instead of an answer. $\endgroup$ – AleksanderRas Oct 1 '18 at 14:31
  • $\begingroup$ @AleksanderRassasse CCA2 ist a security notion for public key encryption anyways. Chances are a IES style construction will work to construct one. $\endgroup$ – SEJPM Oct 1 '18 at 15:57
  • $\begingroup$ @SEJPM Did you mean "CCA2 is not a security notion for public key encryption"? If so, why is that? PS: not sure if this should be a separate question :) $\endgroup$ – zoresvit Oct 2 '18 at 6:08
  • 2
    $\begingroup$ @zoresvit I meant exactly what I said. CCA2 is a security notion for (public-key) encryption. Key-Exchange algorithms themselves are not directly encryption algorithms, thus CCA2 doesn't apply to them (case in point: Diffie-Hellman). But using an IES-style approach we can probably construct a CCA2-secure encryption scheme from the key exchange. $\endgroup$ – SEJPM Oct 2 '18 at 8:43
  • $\begingroup$ Now I'm clear, thanks for the explanation! PS: The reason I asked was that I wasn't sure if "ist" was a typo of "is" or "isn't", and additional context also helped. $\endgroup$ – zoresvit Oct 2 '18 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.