Although there are several proposals of ID-based PKC based on lattices, multivariate cryptography, I want to know why identity (ID) based PKC is not included in the NIST post-quantum competition.

Is there any cryptographic standard of NIST that endorses ID-based PKC?

Please explain.


1 Answer 1


I want to know the reason that why identity (ID) based PKC are not included in NIST post quantum competition.

Although I can't put my hand on the quote, I'm pretty sure I heard NIST say that at this point they are just focusing on the basic primitives: public key encryption, key exchange and signatures (what we currently use RSA, DH and ECC for). That in itself is a fairly tall order, and evaluating the candidates is certainly not easy (especially as one of the criteria they are being evaluated against is an attack by a Quantum Computer, and we have (to put in mildly) only a rough guess about the relative costs that will be involved (e.g. number of qubits vs. number of operations (of various types) vs. circuit depth vs. the cost of quantum memory). Due to this uncertainty, NIST is proceeding cautiously.

I expect that, until they have a good handle on these basics, they would not be interested in pursuing more advanced primitives, such as IBE, PAKEs and homomorphic encryption.

Is there any cryptographic standard of NIST that endorse ID based PKC?

No, I don't believe that NIST has approved any such scheme.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.