Advice for a high schooler intending to read about post-quantum crptography

Question

I'm a high schooler who is interested in learning about post-quantum cryptography.

I would like to read some papers of post-quantum public key algorithms, shortlisted by NIST: https://csrc.nist.gov/projects/post-quantum-cryptography/round-2-submissions.

I have a basic understanding of abstract algebra, number theory, etc. I'm more than willing to learn more mathematical topics as necessary in order to understand the mechanics behind the algorithms I read.

Which paper(s) from the 17 shortlisted post-quantum public key algorithms would members of the Cryptography Stack Exchange Community consider the most accessible for a post-quantum newbie?

The overall aim of my personal project is to implement the algorithm on Python (that's the only language I know), then test it against a quantum computer stimulator.

I'd really appreciate the community's thoughts on the feasibility of my undertaking.

Answer 1

A couple of thoughts. For one, what is your objective? Is it to implement (and test) some postquantum crypto, or is it to understand what it is doing? The later will be considerably more difficult.

For one, you might find that just going through the NIST submissions a fairly heavy slog - they were written for someone who is familiar with mathematical notation and concepts; while your familiarity with abstract algebra is certainly a start, I don't know if it'll be enough.

If you're looking at the "simplest" submission, well, I suspect that Sphincs+ would be the more approachable - IMHO, it uses the fewest advanced concepts, and so they will likely to be less of a learning curve. On the other hand, it won't really serve as a jumping off point to other postquantum algorithms - the concepts used within Sphincs+ aren't used elsewhere (other than other hash-based signatures).

If you want something that isn't too complex, and would lead you to other primitives, I would suggest FrodoKEM - I just glanced through various NIST proposals, and the documentation would appear to be more approachable than most (and, being a Lattice system, it would have some similarity to other Lattice systems).

And, as a last comment, as fgrieu said, there isn't much point in trying to attack the system with a Quantum simulator - any Quantum simulator would have strict bounds on the number of qubits available; far less than any attack...

Answer 2

Up to and excluding the point "test it against a quantum computer stimulator (sic)", the question is about a feasible endeavor, though first implementing a more classical algorithm could be a useful warmup.

But I see a giant gap at said point: a quantum computer simulator attempts to simulate a quantum computer running a quantum algorithm, which (in the context) would be one attacking a cryptographic algorithm of the NIST PQC Round 2 (intended to run on classical computer). And by standard definition of security in PQC, there should be no known (sub-exponential or otherwise practical) algorithm that can attack a PQC algorithm. Therefore, finding an algorithm that is interesting to simulate would be extremely difficult. It's also very unlikely that the simulator would be powerful enough.

Among the NIST PQC Round 2 encryption algorithms, my feeling is that Classic McEliece is not the harder to grasp; but I've not studied them all, and on PQC I'd rather follow poncho's feelings than mine. As he pointed in comment, signature algorithms are also worth consideration.

If you do not have a clear understanding of the difference between encryption and signature, well I suggest to deffer working on PQC until you know more about asymmetric cryptography as currently practiced. That's hard enough.