3
$\begingroup$

I've seen that lattice-based cryptography works well with public key cryptography as well as cryptographic hashing algorithms, but does it apply to symmetric key cryptography?

$\endgroup$
3
$\begingroup$

No, it is not, assuming you are talking about symmetric ciphers, pseudorandom generators, and hash algorithms.* Symmetric cryptography does not need to use any mathematical hardness problem to be secure, and there is no need to have a security reduction to one. It is technically possible to design a symmetric algorithm out of a core construct that is normally used for asymmetric cryptography, as in the very slow Blum Blum Shub or the backdoored Dual_EC_DRBG pseudorandom generators, but that's rare. Such constructions have no real advantages over typical symmetric ones.

Note that you do not need dedicated post-quantum cryptography to protect your symmetric encryption keys. The quantum Grover's algorithm does not hit symmetric cryptography nearly as hard as Shor's algorithm hits asymmetric cryptography. Even with extremely high-speed and low-latency quantum computers, it would suffice to double your key length from 128 to 256 to remain safe.

* If you consider homomorphic encryption to be symmetric, then the answer might very well be yes.

$\endgroup$
  • $\begingroup$ Interesting! Thank you for your answer! $\endgroup$ – Steve Mucci Jun 23 at 6:50
1
$\begingroup$

I suspect the answer is no, but I'm not certain to the last fraction of percentage.

Lattice-based cryptography are usually linear, and are based on linear hard problems such as "learning with error", and "short integer solution", etc.

Symmetric-key primitives such as block cipher, needs to defend against linear analysis, so lattices have little application here other than it may be useful for providing diffusion.

I assume you mean SWIFFT when you mentioned "hash function". As for that, I've a question regarding its suitability in HKDF (HMAC-based key derivation function) you might be interested in.

$\endgroup$
  • $\begingroup$ I checked out your question, its a shame that we have to finagle so much with post-quantum cryptography in order to get the cryptographic primitives we want. Se la vie. $\endgroup$ – Steve Mucci Jun 22 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.