QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems.

I am looking for a post-quantum key exchange algorithm with the following properties:

  • Fast (Lattice-based)
  • IND-CCA2
  • The chosen key depends on randomness from both parties (this is important for many uses of channel binding).
  • $\begingroup$ I believe Supersingular isogeny key exchange meets the criteria that it's fast, post-quantum-secure and is random. I couldn't find any references to IND-CCA2 for Supersingular isogeny key exchange, though - which is why I wrote this comment instead of an answer. $\endgroup$ Oct 1 '18 at 14:31
  • $\begingroup$ @AleksanderRassasse CCA2 ist a security notion for public key encryption anyways. Chances are a IES style construction will work to construct one. $\endgroup$
    – SEJPM
    Oct 1 '18 at 15:57
  • $\begingroup$ @SEJPM Did you mean "CCA2 is not a security notion for public key encryption"? If so, why is that? PS: not sure if this should be a separate question :) $\endgroup$
    – rkiyanchuk
    Oct 2 '18 at 6:08
  • 2
    $\begingroup$ @zoresvit I meant exactly what I said. CCA2 is a security notion for (public-key) encryption. Key-Exchange algorithms themselves are not directly encryption algorithms, thus CCA2 doesn't apply to them (case in point: Diffie-Hellman). But using an IES-style approach we can probably construct a CCA2-secure encryption scheme from the key exchange. $\endgroup$
    – SEJPM
    Oct 2 '18 at 8:43
  • $\begingroup$ Now I'm clear, thanks for the explanation! PS: The reason I asked was that I wasn't sure if "ist" was a typo of "is" or "isn't", and additional context also helped. $\endgroup$
    – rkiyanchuk
    Oct 2 '18 at 17:05

NewHope is a key-exchange protocol based on the Ring-Learning-with-Errors (Ring-LWE) problem. NewHope512-CCA-KEM and NewHope1024-CCA-KEM are IND-CCA-secure key encapsulation mechanisms which target level 1 and level 5, respectively, (matching or exceeding the brute-force security of AES-128 and AES-256, respectively). Google is working on deploying post-quantum key-agreement in TLS by combining NewHope with an existing key-agreement (X25519)as the combination CECPQ1. Please find a GoLang implementation of NewHope in GitHub.

  • 1
    $\begingroup$ KEM is not really key agreement, it's key establishment. Does it comply to "The chosen key depends on randomness from both parties (this is important for many uses of channel binding)." ? $\endgroup$
    – Maarten Bodewes
    May 3 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.