Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

PQC schemes & theory on academic courses

This question doesn't cover any technical aspects of PQC but I would want to know if undergraduate computer scientists study at a good level any of the available PQC schemes in literature during their ...
0
votes
2answers
87 views

Advice for a high schooler intending to read about post-quantum crptography

I'm a high schooler who is interested in learning about post-quantum cryptography. I would like to read some papers of post-quantum public key algorithms, shortlisted by NIST: https://csrc.nist.gov/...
5
votes
1answer
67 views

Is LPN not as important as LWE and SVP?

I've been learning about lattice cryptography and have noticed that most resources such as this survey by Chris Peikart, the Winter School on Lattice Cryptography etc don't include material on LPN, ...
0
votes
0answers
50 views

recommended encryption algorithms to create an encrypted communication application

I have just turned 17 and I have been developing in Java for a few years. Recently I have been interested in a language called rust, I have also been made aware of privacy issues by some of my friends....
3
votes
1answer
90 views

Multivariate cryptography - easily invertible quadratic map

I am reading through multivariate cryptography and in every source I have seen, the secret map $P$ is described as "easily invertible" or "easy to invert". What exactly does it mean "easily ...
2
votes
1answer
173 views

Do any NIST PQC have “homomorphic” public keys, in the sense that any two pubkeys derive a combination pubkey?

Background: The MathMesh crypto platform (refs at the bottom) is a newly-proposed technology stack which has been somewhat cheekily called a "Grand Unified Theory of Security on the Internet". Its "...
1
vote
1answer
78 views

Why does solving the underlying polynomial system “break” the multivariate cryptosystem

I was wondering why exactly does solving a polynomial system (directly or indirectly) "break" a multivariate cryptosystem as a digital signature. I realize that the exact reason differs from system ...
2
votes
1answer
155 views

Transition to post-quantum cryptography

Classical asymmetric cryptography is commonly based on the Discrete Logarithm Problem and Integer Factorization, which are known to be solvable with a quantum computer if it has the ability to run ...
1
vote
0answers
68 views

How to find kernel of isogeny from the dual isogeny

Let $E$ be a supersingular elliptic curve over $\mathbb{F}_{p^2}$, where $p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$ for some primes $\ell_A, \ell_B$. Let $R \in E[\ell_A^{e_A}]$ be a point of order $\...
1
vote
0answers
26 views

McEliece crytography Example [closed]

Please could someone kindly give an example of McEliece cryptosystem with a detailed explanation, most especially, the decoding aspect
2
votes
2answers
280 views

After Google's breakthrough: When will quantum computers break today's encryption?

Google announced a breakthrough on the way to building usable and useful quantum computers. Since I'm not a cryptographer, I wanted to ask when quantum computers will be able to break the crypto ...
0
votes
1answer
60 views

Post-Quantum Public Key Cryptography with EC math properties

Is there any quantum resistant public key cryptography with similar properties of elliptic curves? Assuming lowercase for scalars and uppercase for points. The properties I'm interested are: Reusing ...
2
votes
0answers
36 views

Post-quantum aggregate / multi signatures

Are there any practical post-quantum aggregate / multi signatures? Currently, the aggregate / multi signature schemes seem to be limited to pre-quantum elliptic curve assumptions only, e.g., [BDN18], [...
2
votes
0answers
37 views

Why round off vector sampling from continuous Gaussian distribution not directly sample from discrete Gaussian distribution

For any vector $\mathbf{c}$, real $s > 0$, and lattice $\Lambda$, define the probability distribution $D_{\Lambda, s,\mathbf{c}}$ over $\Lambda$ by $$D_{\Lambda, s,\mathbf{c}}(\mathbf{x})=\frac{...
0
votes
1answer
92 views

Is CECPQ2 forward secure?

Is the CECPQ2 key exchange, as deployed by Google[1] and Cloudflare[2] in TLS 1.3 forward secure against quantum computers? I know that it is using HRSS+SKY as the post-quantum part of the key ...
2
votes
1answer
108 views

Post-Quantum security of Pseudo-Random Functions

I am wondering what is the exact post-quantum security of a PRF. I know that for most symmetric mechanisms, it is assumed it is sufficient to double the key size, but I am looking for a more precise ...
1
vote
1answer
42 views

Explanation of the tables found in Kyber round1 code?

The precomp.c file in Kyber NIST round 1 submission has three tables, could you please let me know how to generate these three tables? If I want to understand how ...
4
votes
1answer
163 views

Are there post-quantum cryptosystems with a gap between classical and quantum security?

Is there a gap between classical attacks and quantum attacks against some post-quantum security assumptions? (I'm particularly interested in asymmetric cryptography.) I understand that there is no ...
0
votes
1answer
41 views
3
votes
0answers
60 views

Lattice Based Cryptography domain

Some cryptosystems operate on the domain of the form $\mathbb{Z}_q[x]/\langle x^n-1\rangle$ and others operate on $\mathbb{Z}_q[x]/\langle x^n+1\rangle$. What's the security impact of the two forms?
4
votes
1answer
76 views

Why is the vector sampled from Gaussian or Subgaussian distribution in lattice-based cryptography? [duplicate]

I have known that the vector is sampled from Gaussian distribution in lattice-based cryptography because the distribution of the vector $\mod{\mathcal{P}(\mathbf{B})}$ approximates to uniform ...
2
votes
0answers
87 views

A proposal for randomization of Niederreiter cryptosystem

The Niederreiter cryptosystem is a public key cryptosystem using Goppa code. Unfortunately it it is insecure unless it is a binary code. So I thought I could insert random linear codes into randomly ...
1
vote
0answers
85 views

Canonical embedding vs. plaintext slots in Ring-LWE

I'm working on the canonical embedding mentioned in [LPR10] and [LPR13]. What confuses me is that the difference and the relationship between the canonical embedding and the concept of ''plaintext ...
1
vote
0answers
34 views

Precise Definition of 1-out-of-2 Oblivious Transfer

What's the precise definition for 1-out-of-2 OT? and what's the best way to show that it can't be achieved under unconditionally secure setting? I am reading about it and just couldn't get my head ...
0
votes
1answer
53 views

Public points in SIDH

I was going through a presentation titled "SIKE in Hardware" by professor Reza Azarderakhsh. On the page $10$ of the presentation he introduces a variable $w$. Could you please explain what the ...
2
votes
1answer
91 views

How secure is a hash based signature scheme after signing assuming quantum computers?

Consider a hash based signature scheme that requires taking the $k$-bit hash of an arbitrary length message to be signed (e.g. Lamport one-time signature scheme). My understanding is, assuming that ...
3
votes
0answers
84 views

Check validity of generated parameters for SIDH

In section 4.1 of the paper Towards Quantum-Resistant Cryptosystems From Supersingular Elliptic Curve Isogenies by Feo, Jao and Plût it is described how you generate valid parameters for the SIDH ...
2
votes
1answer
70 views

Post-quantum alternative to ElGamal? (public key verifiability)

Are there any alternatives to ElGamal that would be resistant/annoying to quantum machines? I would like to preserve public key derivability/verifiability -- ability to ensure existence of ...
3
votes
1answer
182 views

What's the difference beteween SIDH and SIKE?

I'm a semi newbie in crypto (I've had that uni course of discrete math that includes basic cryptography principles) and wanted to go a bit further in isogeny graphs. I have downloaded the C ...
2
votes
1answer
45 views

Calculation of failure probability in basic Ring-LWE-DH key agreement

This is the basic unauthenticated Ring-LWE-based Diffie-Hellman key exchange, based on Peikert's Ring-LWE KEM: (from BCNS15) Alice and Bob have shared public polynomial $a$ randomly drawn from $R_q = ...
4
votes
1answer
117 views

Is McEliece secure with non-binary Goppa codes?

A binary Goppa code with codewords of length $n$ bits that can fix $t$ errors with a polynomial over $GF(2^m)$ can encode $k = n - mt$ bits long data. That is one needs to add $mt$ check bits to fix $...
4
votes
1answer
172 views

Complete Attack on RLWE Key Exchange with reused keys, without signal leakage

I am studying a research paper "Complete Attack on RLWE Key Exchange with reused keys, without signal leakage" . On page number 21 to 28, there is toy example explaining the scheme. I am unable to ...
2
votes
1answer
99 views

SIDH: key agreement - why does it work?

In SIDH both parties agree on the key in following way: Alice calculates a kernel $R = mPB + nQB$ Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$ She uses $\...
0
votes
1answer
165 views

Could a quantum computer recover files from ransomware if the attacker doubly encrypted them with RSA-4096?

How would a quantum computer decrypt a file (or find the keys to such a file) if it were encrypted with standard RSA 4096 encryption, but encrypted two times with different keys? The keys are known by ...
0
votes
2answers
84 views

SIDH cryptosystem question

I'm trying to understand the SIDH cryptosystem and got confused at this point: Alice fixes base $\{P_A,Q_A\}$ so that it generates $E_0[l_A^{e_A}]$. Then she chooses secret parameters $m_A,n_A$ and ...
3
votes
1answer
82 views

Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE. More precisely, it is said that the critical Hermite factor for ...
1
vote
0answers
147 views

RSA vs. Super Computer vs. Quantum Computer [closed]

I know that RSA is known to be secure in the current landscape of computing, and I know that RSA is known to be broken in the world of quantum computing and cryptography. I have two questions, can ...
2
votes
0answers
45 views

IETF Recommendations for preparation for PQC- clarify in what way they are referring to bits

Which bits are being referred to when it is said by the IETF, "Continue to avoid baking-in algorithms, either explicitly or implicitly (e.g. via maximum field sizes)" ? Does that mean leave enough ...
2
votes
0answers
75 views

Is NIST testing all the round 2 submissions to quantum-resistant crypto?

Is NIST confirming the self-published quantum-resistant crypto round 2 data and do they make that available to the public when they do?
1
vote
1answer
176 views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
1
vote
1answer
98 views

NTRUSign (considered broken) as a one or few time PQ signature scheme

As many know, original NTRUSign is considered broken as signatures leak information about the private key. It takes a number of signatures to accomplish a break though, with the original break paper ...
2
votes
1answer
135 views

How does the Signature Scheme in Picnic Works

I am trying to understand how signature scheme proposed to NIST, Picnic, works. The propossal uses ZKboo and ZKboo++ as their basis. I can see how the ZKPoK works, where the witness x is some key ...
3
votes
1answer
106 views

Does the block size of a symmetric cipher impact the security of the cipher itself? [duplicate]

Will a 128 bit block have some security implication in post-quantum cryptography?
2
votes
1answer
65 views

Can I connect the hardness of a linear short integer solution problem to that of SIS problem?

As we know, SIS problem is defined as: for a function $f_A(s)$=$As$, where $A$ is a fixed, randomly-chosen matrix in $\mathbb{Z}_q^{r \times n}$, it is hard to find elements $s \in \mathbb{Z}_q^{n}$ ...
4
votes
0answers
298 views

How does post quantum key exchange in OpenSSH 8 work?

OpenSSH 8 supports a post quantum KEX, namely sntrup4591761x25519-sha512@tinyssh.org It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how ...
0
votes
0answers
24 views

Minimal secure index of quasi-cyclic codes for code-based cryptography

It is well-known that keys (generator matrices) of code-based cryptography are very large for its practical usage. To reduce them scientists propose to use families of quasi-cyclic codes. I remind ...
0
votes
0answers
49 views

Regarding the isogeny path problem

Given two elliptic curves, it is hard to calculate an isogeny of large degree between them. Does this only apply to supersingular isogenies or to ordinary ones as well? Additionally, is the mapping ...
6
votes
1answer
155 views

Why doesn't “Classic McEliece” need scrambling?

The original McEliece scheme uses two random matrices S and P to scramble the generator matrix and uses $\mathsf S·\mathsf G·\mathsf P$ as the public key. The Niederreiter variant also does about the ...
0
votes
0answers
79 views

Dilithium signature scheme - Public key derivation

Good day! I am very new to Cryptography but I want to make sure I understand the concept of the scheme correctly before using it to our system. So I was looking at post quantum signature schemes, and ...
4
votes
0answers
69 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...