Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [kyber]

Kyber is a Key Encapsulation Mechanism (KEM) based on the Module Learning with Errors (MLWE) problem. It is an example of lattice-based cryptography and is part of the Crystals family together with the signature scheme Dilithium. It was selected for standardisation as part of the NIST post-quantum cryptography process in 2022. The standard is in progress.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

X25519Kyber768Draft00 Key Exchange still in use, even after GPO/Registry to disable

I am trying to find out if there is another place to disable the Post-Quantum key exchange options other than what has been published Chrome/MS for browsers. The X25519Kyber768Draft00 Key Exchange ...
Chris S's user avatar
0 votes
1 answer
86 views

Kyber and Classic McEliece as Public Key Encryption algorithms

Can Crystal Kyber and Classic McEliece be used as public key encryption (PKE) algorithms?. Is there any problem with using these KEM algorithms as PKE for some reason, e.g., doing some holomorphic ...
Anas Ahmad's user avatar
1 vote
1 answer
133 views

Why did NIST Post Quantum Standardization have 2 schemes?

NISTs Post Quantum Standardization process selected Kyber as the KEM scheme. I'm a bit confused over why NIST would standardize for a 'scheme' and not just a 'cipher'. Does Crystals-Dilithium use a ...
keithRozario's user avatar
1 vote
0 answers
65 views

Kyber implementation possible overflow in the NTT subroutine?

I took a look at the code from Kyber, which I would like to quote here: ...
P_Gate's user avatar
  • 413
0 votes
0 answers
59 views

SampleNTT in Kyber [duplicate]

I was going through Kyber specification mentioned here - https://csrc.nist.gov/pubs/fips/203/ipd The SampleNTT is an algo used for matrix A calculation that takes XOF(p,i,j) as input. If the input is ...
Gappu's user avatar
  • 31
1 vote
1 answer
114 views

In x25519kyber768 what is the use of the server kyber keys if only the client public kyber key is used for encapsulation in kem?

In x25519kyber768 what is the use of the server kyber keys if only the client public kyber key is used for encapsulation of the kyber shared secret in kem?
Shekhar Sivaraman's user avatar
3 votes
1 answer
169 views

Confusion in the security level offered by KYBER

I was looking at security level offered by KYBER. I have attached the table for the reference. I am little bit confused regarding the security level offered by KYBER. By definition, Level 1 in the ...
VIKAS SRIVASTAVA's user avatar
2 votes
0 answers
65 views

Matrix-vector multiplication in Kyber implementation

I took a look at the implementation of Kyber, which can be found in this GitRepo. I made a small discovery in the indcpa.c in the function indcpa_keypair, starting ...
TreeBook1's user avatar
  • 117
2 votes
1 answer
316 views

Core-SVP Hardness of Kyber

This question is with reference to the python file model_BKZ.py provided in the GitHub repository https://github.com/pq-crystals/security-estimates/blob/master/...
VIKAS SRIVASTAVA's user avatar
3 votes
1 answer
135 views

High Hamming Weight Attack on Kyber

I was reading LAC (https://eprint.iacr.org/2018/1009.pdf). They mention about high-hamming weight attacks on the Centered Binomial Distribution (CBD). To counter this, they propose CBD with fixed ...
VIKAS SRIVASTAVA's user avatar
2 votes
1 answer
74 views

Kyber - Compression and Decompression Implementation Example

I have a question about the implementation of the functions $$Compress_q(x,d) = \left\lfloor (2^d/q)\cdot x\right\rceil mod^{+}2^d$$ and $$Decompress_q(x,d) = \left\lfloor (q/2^d)\cdot x\right\rceil$$ ...
TreeBook1's user avatar
  • 117
2 votes
1 answer
112 views

Question on the Implementation of Kyber's NTT in the Reference

As defined in Kyber's specification 1, the NTT consists of two formulas: $$\hat{f}_{2i} = \sum_{j=0}^{127} f_{2j} \zeta^{(2 \cdot \text{br}_7(i)+1)\cdot j}$$ $$\hat{f}_{2i+1} = \sum_{j=0}^{127} f_{2j+...
TreeBook1's user avatar
  • 117
1 vote
0 answers
88 views

The Role of Discrete Fourier Transform (DFT) and Number Theoretic Transform (NTT) in Kyber and Falcon: Seeking Clarification

In exploring post-quantum cryptography algorithms like Kyber and Falcon, I've come across their utilization of Discrete Fourier Transform (DFT) and Number Theoretic Transform (NTT), but I'm seeking ...
albert's user avatar
  • 31
1 vote
1 answer
169 views

Centred Binomial Distribution and its effects on security in Kyber

I want to concretely understand how exactly choice of error distribution effect the security of KEM in the context of Lattice Based Cryptography. For example, I would like to know the concrete ...
Random Bits's user avatar
1 vote
1 answer
74 views

How zetas are computed in CRYSTALS-Kyber?

As shown below it explains how generate zetas table and use it. But curious thing is that how KYBER_ROOT_OF_UNITY constant is generated ? I've tried multiple ways to generated it and cannot explain ...
Ali ÜSTÜN's user avatar
2 votes
2 answers
187 views

CRYSTALS-Kyber Compress and Decompress function role

I was reading CRYSTALS-Kyber design. They have used compress_q(x,d) to scale an element of $\mathbb{Z}_q$ to $[ 0,1,...,2^d-1 ]$. The definitions of ...
ABCD's user avatar
  • 23
1 vote
1 answer
321 views

Recursive NTT for Kyber

since the NTT is a variant of the DFT respectively FFT, it seems possible to implement a recursive algorithm for the NTT of Kyber with a divide-and-conquer concept. This is the reason for my question ...
TreeBook1's user avatar
  • 117
1 vote
2 answers
177 views

What scheme is the best for combining two shared secrets?

I'm developing a program that uses a hybrid Key Encapsulation Mechanism (KEM) scheme, employing Kyber and X25519, with each producing a 32-byte shared secret. What would be the best scheme to combine ...
Zola Gonano's user avatar
2 votes
1 answer
227 views

NTT - Transformation of Polynomials in Kyber

In Kyber with $q=3329$, we end up with a field that das 256th roots of unity, when we apply the chinese remainder theorem (CRT) for such a field, it may look like, according to a post here: $$\mathbb{...
TreeBook1's user avatar
  • 117
1 vote
1 answer
217 views

Is it safe to derive Ed25519 and Kyber private keys from the same seed?

I am designing a Hybrid Key exchange library using x25519 and Kyber, and the scheme I have in mind is as follows: Alice sending a file/message to Bob: ...
Zola Gonano's user avatar
1 vote
1 answer
150 views

Parse Algorithm in Kyber Specification

In the Kyber specification there is an algorithm "Parse", which receives a byte stream as input and from this the NTT representation $\hat{a} = \hat{a}_0+\hat{a}_1X + ... + \hat{a}_{n-1}X^{n-...
TreeBook1's user avatar
  • 117
3 votes
1 answer
171 views

Implementation of centered binomial distribution in Kyber Key Encapsulation Mechanism?

In the implementation of centered binomial distribution of crystals-kyber, the authors load 24-bits of buffer to a 32 bit integer and then they and the answer with 0x00249249. The complete operations ...
Muhammad Awais's user avatar
0 votes
1 answer
96 views

Primal attack On Kyber algorithm specifications

In the Kyber Algorithm specifications document, chapter 5.1.2 primal attack, it says that: Given the matrix LWE instance $(A,b=As+e)$, one builds the lattice $\Lambda = \{x\in \mathbb{Z}^{m+kn+1}:(A\...
qiuxicj's user avatar
1 vote
0 answers
91 views

Estimating BKZ block size in Kyber

In Section 5.2.1 of the Kyber documentation, it states that the BKZ block size of 413 was chosen using the tool from this paper, i.e., this tool. How was the block size derived from this? Currently, ...
Sam Jaques's user avatar
  • 1,202
0 votes
0 answers
98 views

Kyber and Dilithium usage limits?

What are the theoretical usage limits of Kyber and Dilithium? Are there any sources to back this up? Maximum number of encryptions/signatures allowed per key, etc.?
Joe's user avatar
  • 73
1 vote
0 answers
85 views

Two-party randomness for KEM

As indicated in an earlier Q / A, KEM's do not necessarily directly encrypt a pre-generated random value. However, it is clear that some KEM's do actually do this, with RSA-KEM being an obvious ...
Maarten Bodewes's user avatar
3 votes
1 answer
234 views

Kyber-CCA-KEM - Deterministic implicit rejection

In Kyber-CCA-KEM, there's a step in the Fujisaki-Okamoto transformation, where decryption failure results in a random shared secret returned from the decapsulation call. I have a C language project ...
DannyNiu's user avatar
  • 9,399
1 vote
1 answer
52 views

Composition of ciphertexts in post quantum schemes Kyber and Frodo

I took a look at the Kyber and Frodo procedures and found that the ciphertext consists of two components. In Kyber these are the lines 5-7 in algorithm 2 $c := (\mathbf{u},v)$ and in Frodo line 8 of ...
Zpeed78's user avatar
  • 95
0 votes
1 answer
121 views

Hybrid Approaches: ECIES-Kyber768 [closed]

I am considering using a hybrid approach by combining ECIES (Elliptic Curve Integrated Encryption Scheme) with Kyber KEX (Kyber Key Exchange) for secure communication. Instead of using the traditional ...
dsfddg dggd's user avatar
0 votes
0 answers
62 views

Bound for quantum adversary in CRYSTALS-Kyber

In Kyber the following estimation is given for a quantum adversary: Theorem 4. For any quantum adversary $A$ that makes at most $q_{RO}$ many queries to quantum random oracles $H$ and $G$, and at ...
P_Gate's user avatar
  • 413
3 votes
1 answer
301 views

KYBER.CPAPKE: IND-CCA Security of Lyubashevsky, Peikert, Regev (LPR) Encryption

The NIST Kyber KEM spec. defines an encryption scheme, KYBER.CPAPKE, that's a variant of the so called Lyubashevsky, Peikert, Regev ("LPR") encryption scheme [1]. While LPR encryption is ...
Rohit Khera's user avatar
2 votes
1 answer
184 views

Authenticated Key Exchange of Kyber.AKE

I have some questions about the setting of the one-way authenticated key exchange of Kyber.AKE as defined in section 5 of the paper. How does $P_2$ authenticate itself to $P_1$? It is not obvious to ...
P_Gate's user avatar
  • 413
2 votes
1 answer
54 views

Two way key transport?

For a KEM mechanism like RSA, Kyber, etc. is there it usually worth doing key trapping/key encapsulation both directions in a key exchange? By this I mean: Alice wraps a symmetric key and sends it to ...
Joe's user avatar
  • 73
4 votes
1 answer
145 views

Questions on difference distribution in Kyber

I have two elementary questions related to the special distribution $|x'-x \text{ mod}^{\pm} \, q| \leq B_q := \left\lceil \frac{q}{2^{d+1}} \right\rfloor$ in Kyber. The first question is about the ...
P_Gate's user avatar
  • 413
1 vote
1 answer
431 views

How long time per operation to crack Kyber1024 compared to AES256 for quantum computers?

How long time does quantum computers take per operation when search the key of Kyber? Grover's algorithm weakens 256-bit AES to 128-bit security, quantum computers at most take 2^128 operations to ...
Flan1335's user avatar
  • 361
3 votes
0 answers
216 views

CRYSTALS-Kyber - Decryption and Decoding

I have a question about the decryption in Kyber [1]. I will first give important statements of the paper and then ask my actual question with an example. In the paper it is stated: ... decrypt to a ...
P_Gate's user avatar
  • 413
1 vote
1 answer
39 views

LWE KEMs and message coding

In many proposed lattice PKE schemes, the plaintext is encoded or modulated in a simple fashion, e.g. using Kyber-ish notation: key gen: $pk=(A, t=As+e)$, $\quad sk=s\quad$ ($A$ random, $s$, $e$ ...
yoyo's user avatar
  • 420
3 votes
0 answers
101 views

Proof on the bound of Compression and Decompression in CRYSTALS-Kyber

I am dealing with the bounding of compression and decompression functions in CRYSTALS-Kyber, see the lemma in this post or the original reference KYBER, section 2.2 topic "Compression and ...
P_Gate's user avatar
  • 413
2 votes
2 answers
169 views

Matrix parsing in Kyber

In the Kyber specification the parse function (algorithm 1 on page 6) takes as input a non-terminating byte stream. Although unlikely, an unlimited number of bytes ...
Daniel S's user avatar
  • 23.9k
1 vote
1 answer
420 views

Related to ntt implementation in crystal kyber

Recently I started implementing basic skeleton of crystal kyber. Right now I got stuck at NTT, where I am not able to understand how values has to be fed (twiddle factor, actual data which has to be ...
Rakmo's user avatar
  • 21
3 votes
0 answers
54 views

Why was A doubled in size

Why was the dimension of A doubled in kyber? LWE encryption uses a public matrix A of dimension K but kyber uses a double matrix A resulting in $A ^{ k * k * n }$ When deriving the results of the ...
Tarick Welling's user avatar
1 vote
1 answer
187 views

How is Crystal Kyber CPA-secure algorithms converted into a CCA-secure algorithm

In Crystal Kyber specification, page no10, there are 3 algorithms namely KYBER.CCAKEM for making the CPA-secure Kyber into CCA-secure one. Q1: How is the shared key K being generated in KYBER.CCAKEM....
Sujan SM's user avatar
1 vote
1 answer
81 views

How & where is concepts of Good basis and bad basis used in Crystal kyber?

I've read the documentation of Crystal Kyber, but nowhere it is mentioned about good basis and bad basis. Please explain how and where is the good basis and bad basis is used in crystal kyber.
Sujan SM's user avatar
1 vote
1 answer
182 views

Why predicting an error in Crystal Kyber is considered to be hard?

Hi I have started studying on crystal kyber recently. Gained some knowledge regarding its algorithm and how it works. My doubt is why it is tough for attacker to extract secret vector from pk itself ...
Rakmo's user avatar
  • 21
0 votes
1 answer
393 views

How is MLWE used for key generation in Kyber?

I've been reading about Crystal kyber, and i read that the in the key generation process, the public key pk is computed using secret key s in such a way that the ...
Sujan SM's user avatar
3 votes
1 answer
558 views

CRYSTALS-KYBER versus FrodoKEM, what makes each of them different than the other?

NIST's main recommendation for encryption/decryption mechanism is CRYSTALS-KYBER. Whereas, the BSI (German equivalent) chooses FrodoKEM. As far as my knowledge goes both these mechanisms use LWE ...
Chirag Parmar's user avatar
15 votes
4 answers
7k views

Kyber and Dilithium explained to primary school students?

Kyber and Dilithium are post-quantum cryptographic designs, but the resources are hard to understand. Is it possible to explain those ciphers to children?
Flan1335's user avatar
  • 361
3 votes
2 answers
694 views

Break Lattice-Based Cryptography with Variational Quantum Algorithm (only 25 k. Qbits for Kyber1024)?

I am currently writing a seminar paper on Kyber and other lattice-based methods. I was so excited about the lattice-based methods that I also currently searched quantum algorithms to solve the methods....
Max Weber's user avatar
3 votes
1 answer
219 views

Question about Theorem 2 in CRYSTALS-Kyber Paper

I have some questions about the Kyber paper, especially about Theorem 2 on page 6, which I would like to ask here. First of all I quote the following theorem from the paper and ask my questions ...
P_Gate's user avatar
  • 413
2 votes
1 answer
259 views

Question on the proof of correctness in CRYSTALS-Kyber

I am currently trying to follow the proof of correctness in the CRYSTALS-Kyber paper. The following is an excerpt of the proof: On the one hand, I am interested in how exactly one justifies/argues ...
P_Gate's user avatar
  • 413