One could use Falcon-512 for establishing a private and public key for an asymmetric context. Whereas in a symmetric context, we could use firesaber/saber/variants in order to obtain a shared secret that can later be used in an AES-GCM context. My question is: what encryption algorithm do we use when we want to encrypt plaintext when using a public key instead of a shared key? What post-quantum encryption algorithms (i.e., a map from plaintext to ciphertext) exist that are compatible with asymmetric schemes such as falcon? If I were to try using the public key to encrypt data, using the private key to decrypt would fail if using a symmetric encryption algorithm such as AES-GCM
1
-
$\begingroup$ If you are interested, this is how I plan to implement my system. crypto.stackexchange.com/questions/106423/…. AES encryption has not been broken by quantum computing, but key negotiation/exchange algorithms have. If you plan to use Quantum Encryption algorithms, it is suggested it be used in combination with classical cryptography algorithms such as RSA - considering a large enough key size. $\endgroup$– Jake NelsonMay 6 at 19:20
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
7
The NIST post-quantum schemes mainly consist of KEMs and signature schemes due to the fact that quantum computers don't break all existing cryptography.
As per Daniel Bernstein :
...there is no justification for the leap from “quantum computers destroy RSA and DSA and ECDSA” to “quantum computers destroy cryptography.”
As such, there is less desire to replace AES than there is to replace RSA/DSA/ECDSA, or whatever is broken by quantum computers.
Meanwhile DJB's tone suggests he doesn't think it's a priority:
Evidently these unnamed “experts” believe—and Magiq would like you to believe—that quantum computers will break AES, and dozens of other wellknown secret-key ciphers, and Merkle’s hash-tree signature system, and McEliece’s hidden-Goppa-code encryption system, and Patarin’s HFEv− signature system, and NTRU, and all of the other cryptographic systems discussed in this book. Time will tell whether this belief was justified!
-
$\begingroup$ AES should be fine for awhile, but from multiple sources, RSA/DSA/ECDSA are at risk of being broken in an unknown period of time. Furthermore, foreign actors who plan on using retroactive decryption means that irreversible damage has already been done (e.g., an adversary can capture ciphertext packets, then sometime in the future once quantum computers mature, retroactively decrypt the ciphertext to obtain the potentially time-independent plaintext). Finally, we don't know what the true capabilities of our technology are (militaries/top-secret), so we should assume schemes are compromised $\endgroup$ Dec 18, 2020 at 15:46
-
$\begingroup$ So, based on your comment, is there currently no asymmetric encryption scheme for post-quantum crypto? $\endgroup$ Dec 18, 2020 at 15:47
-
1$\begingroup$ Yeah that's why post-quantum schemes are looking to replace RSA/DSA/ECDSA, as I mentioned. Generally those are currently used for key exchange or signing. They aren't currently used for encryption generally. This candidate could be used for encryption. I'm sure you could do it with a few of the schemes but it'd be like using RSA for encryption. Slow, unnecessary and pointless. $\endgroup$ Dec 18, 2020 at 15:58
-
$\begingroup$ Ther result ob combining a KEM with a symmetric encryption scheme, also called hybrid encryption, is a public key encryption scheme. Why do those not suit your needs? $\endgroup$– MaeherDec 18, 2020 at 16:32
-
$\begingroup$ @Maeher I want to be able to encrypt data using a public key, and decrypting using a private key. This wouldn't be do-able in a symmetric context, am I right? $\endgroup$ Dec 18, 2020 at 16:44