Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

Filter by
Sorted by
Tagged with
1 vote
1 answer
32 views

Classical vs Quantum-Safe Algorithms and Protocols / Application Approach

Various proposals are being explored for X509 V3 certificates in a Post Quantum Cryptography (PQC) world. Currently, these include just having a certificate for classical and PQ, having a hybrid ...
user avatar
  • 133
0 votes
0 answers
39 views

Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret

I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
user avatar
0 votes
0 answers
21 views

How $f(x)$ set in ring-lattice crypto?

I want to clear out some confusions I have about Lattice crypto. As discussed in this talk Signatures, Commitments, Zero-Knowledge, and Applications For ring $Z_q[x]/f(x)$, I want to understand ...
user avatar
1 vote
1 answer
44 views

Errors for $\mathsf{LWE}$

Why do we take Gaussian-like errors in $\mathsf{LWE}$? Why for example we don't take uniform errors?
user avatar
  • 345
0 votes
1 answer
25 views

Solving $\mathsf{SVP}_{\gamma}$ in worst-case

What does it mean to solve $\mathsf{SVP}_{\gamma}$ in worst-case? Does it mean that the problem is solvable for any lattice we choose?
user avatar
  • 345
0 votes
0 answers
40 views

Comparing the performance of ECC/RSA with post quantum protocols

I wanted to compare the performance of different cryptographic systems. There is a pretty good paper comparing the 3rd round finalists of the NIST competition. I was wondering if there are good ...
user avatar
  • 1,482
1 vote
1 answer
108 views

Comparison of Post Quantum Algorithms in Nist 3rd round

I'm interested in the Post Quantum Algorithms of the 3rd round of the NIST standardization competition. The algorithms for KEM are Classic McEliece, CRYSTALS-KYBER, NTRU, SABER and their 5 ...
user avatar
  • 1,482
1 vote
1 answer
164 views

Models and assumptions in the post quantum world

I'm currently trying to get an overview of post-quantum cryptography. Now I'm struggling with correlations and adjustments of the PQ-world and the Modern-world of cryptography. My Questions: Can you ...
user avatar
  • 1,482
1 vote
1 answer
67 views

Tree Parity Machines (neural cryptography) advantages

It seems that neural cryptography is an interesting research topic and there are some important contributions published in the last years. The proposed algorithms are suitable for symmetric key ...
user avatar
  • 21
1 vote
1 answer
242 views

Is the combination of X25519 ECDH and NTRU in OpenSSH 9.X secure against quantum attacks?

Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks? Why is it believed that this combination is secure?
user avatar
4 votes
1 answer
143 views

What is the effect of low rank dual sublattices on the dual lattice attack on LWE?

In the dual lattice attack of Espitau, Joux and Kharchenko (On a dual/hybrid approach to small secret LWE), the authors propose distinguishing (and subsequently recovering secret values) of LWE ...
user avatar
  • 9,576
1 vote
0 answers
21 views

On the effectiveness of Sidelnikov-Shestakov attack under a bad guess

I have been studying Wieschebrink paper "Cryptanalysis of the Niederreiter Public Key Scheme Based on GRS Codes". In the paper a cryptosystem using GRS codes is exhibited with an attack ...
user avatar
12 votes
1 answer
2k views

Current Consensus on Security of Lattice Based Cryptography?

In an edit to an answer by user forest, it was mentioned that there has been a new attack developed for lattice-based cryptography. I thought lattice-based cryptography is a fairly well established ...
user avatar
4 votes
2 answers
324 views

Difference between FFT and NTT

What are the main differences between the Fast Fourier Transform (FFT) and the Number Theoretical Transform (NTT)? Why do we use the NTT and not the FFT in cryptographic applications? Which one is a ...
user avatar
  • 345
2 votes
2 answers
144 views

Are PKI PQC algorithms slower than their nonPQ counterparts? (e.g. NTRU vs RSA)

Are the methodologies (hard problems being used to secure the encryption) in post-quantum algorithms inherently slower than what we have right now? If not, why weren't they used initially?
user avatar
  • 143
3 votes
0 answers
104 views

Is Ntru-Encrypt still secure in 2022

I'm going to use NTRU as post-quantum public-key encryption algo in my project. I've googled attacks on NTRU and found a lot of them but since I'm new to NTRU and don't understand the math used, and ...
user avatar
  • 31
2 votes
1 answer
32 views

Duality Results for Some Module Lattices

Let $R$ be the ring of integers of a cyclotomic field $\mathbb{Q}(\zeta_n)$, where $n$ is a power of two, and $\boldsymbol{a} \in R_{q}^{m}$, for $m\in\mathbb{Z}^+$, $q\in\mathbb{Z}_{\geq2}$ prime. ...
user avatar
  • 349
1 vote
1 answer
50 views

Why do we need both bitmasks and keyed hash in SPHINCS+

I think one of them is related to multitarget attacks and the other is related to collision attacks. But I cannot find how hash based crypto related to hash collisions. 1-) Consider the following ...
user avatar
  • 73
1 vote
1 answer
38 views

Message Hiding Using Keyed Steganography

i would like to know what are the danger can be occur by performing steganography without a key? Please kindly explain to me.
user avatar
2 votes
1 answer
46 views

What is $z$ in specification of Classic Mceliece?

I have a question about $z$ in Classic Mceliece Algorithm specification. I have no idea about this $z$! In parameter set kem/mceliece348864, Field polynomial $f(z) = z^{12} + z^3 + 1$. is this $z$ in ...
user avatar
  • 21
2 votes
1 answer
150 views

Is there a quantum algorithm to find SHA256 collisions?

As I understand, the Bitcoin network can be seen as a supercomputer looking for SHA256 collisions. It hasn't found one yet (March 2022). Also, in the post-quantum cryptography era, you would be ...
user avatar
5 votes
2 answers
240 views

In multivariate public key cryptography, why can not we use the same public key for both signature and encryption?

In multivariate public key cryptography, why can not we use the same public key for both signature and encryption? I read that for signatures the public polynomial $P:\mathbb{F}^n\rightarrow \mathbb{F}...
user avatar
0 votes
0 answers
55 views

How to map output of SHA to $\mathbb{F}_q^n$

I have an arbitrary string. I want to know how to implement a hash function $H: \{0,1\}^* \to \mathbb F_q^n$ which takes arbitrary strings to an element of $\mathbb{F}_q^n$. Here $\mathbb{F}_q$ ...
user avatar
4 votes
0 answers
154 views

Is there a good rundown anywhere on the NIST vs CNRS patent disputes on lattice cryptography?

As I understand it from web conference hearsay, the Kyber and Saber entries to the NIST post quantum cryptography competition have been subject to a patent claim from the CNRS. The creators of the ...
user avatar
  • 161
1 vote
0 answers
32 views

Performance of elliptic curve Diffie-Hellman vs NIST-PQC finalist KEMS

I am looking for performance measurements in cycle counts for an implementation of the elliptic curve Diffie-Hellman for curve, ed25519. Ideally, the cycle counts ...
user avatar
1 vote
1 answer
56 views

Reducing a lattice basis with too many basis vectors

Suppose I have a basis $B$ of an $n$-dimensional lattice $L\subseteq\mathbb{Z}^n$ and $B$ has $n$ vectors. Now I take another $v\in \mathbb{Z}^n\setminus L$ and I define a new lattice $L'=L+\mathbb{Z}...
user avatar
1 vote
1 answer
48 views

RLWE with invertible elements

Let $R = \mathcal{O}_K$ be the ring of ingtegers of $K$, where $K$ is an algebraic number field, and $q$ a modulus. Let $\chi$ be some error distribution used to sample an element $e$. A primal RLWE ...
user avatar
  • 349
0 votes
2 answers
128 views

How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?

How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general? I ...
user avatar
  • 859
0 votes
1 answer
46 views

Randomness space of encryption function

I was reading the definition of Fujisaki-Okamoto transform, and I found this: What does it mean the "randomness space" of the function Enc in the PKE setting?
user avatar
  • 345
1 vote
0 answers
28 views

How to calculate bit-security with Root Hermite factor?

I want to know relationship between bit security and Root Hermite factor. How can I calculate bit security from Root Hermite factor. (I want to know 1.00395, 1.00499, 1.00215, 1.00265 each)
user avatar
2 votes
1 answer
57 views

The significance of duals in RLWE

In an algebraic number field, an ideal $I$ in the ring of integers $\mathcal{O}_K$ has dual $I^\vee = \{x\in\mathcal{O}_K\text{ : }T_{K/\mathbb{Q}}(xy)\in\mathbb{Z}\text{ for all }y\in I\}$, where $T_{...
user avatar
  • 349
0 votes
0 answers
19 views

Block Ciphers using Matrix Representation of quasigroups

This paper says that, each quasigroup of order 4 can be represented in matrix form using the following equation, \begin{equation} x \ast y \equiv m^T +Ax^T +By^T +CA\cdot x^T \circ CB\cdot y^T \end{...
user avatar
  • 1
1 vote
0 answers
37 views

Post quantum deterministic strongly EUF-CMA secure signature scheme?

I am trying to figure out if there is a known construction of a post quantum secure EUF-CMA secure signature scheme for which the signature procedure is deterministic. It seems that it is possible to &...
user avatar
3 votes
0 answers
47 views

Why is WalnutDSA specified for COSE?

WalnutDSA was a 1st-round entrant in the NIST Post-Quantum Cryptography project. It had a significant cryptanalytic break close to almost breaking the security of the cryptosystem, only survived due ...
user avatar
  • 6,541
0 votes
2 answers
84 views

Hashing 64-bit counters with different keys and XORing to blocks of plaintext, multiple times: Some questions

Let's suppose I want a 2048-bit block encryption. I take a 512-bit hash funcion (as Blake2b), provide a counter and a key and hash the counter and so XOR the hashed value in a ciphertext block, and ...
user avatar
1 vote
1 answer
88 views

What is the security strength of XMSS according to NIST PQC categories?

In the context of the NIST PQC standardization process, NIST has defined the following five security categories: Any attack that breaks the relevant security definition must require computational ...
user avatar
  • 2,674
0 votes
1 answer
63 views

CTR and OFB block cipher modes and their post-quantum security. Some questions [duplicate]

It's said that quantum computers can break block ciphers with 2^(n/2) queries (being n the key size). I read this paper: https://eprint.iacr.org/2016/197 It says that CTR and OFB modes are safe ...
user avatar
2 votes
1 answer
64 views

Trapdoor recovery from lattice-based preimage sampling

[GPV] and [MP] (references below) give constructions of the trapdoor function defined by $$ f_{\mathbf A} (\mathbf x) = \mathbf A \mathbf x, $$ where $\mathbf A \in \mathbb Z_q^{n \times m}$ is ...
user avatar
  • 803
3 votes
1 answer
167 views

Why are the parameters (such as modulus and dimension) of homomorphic encryption so large?

Compared with the common lattice-based PQC schemes, the modulus $q$ and dimension $n$ of homomorphic encryption are so large. For example, in Kyber, $n=256, n \times k = \{512,768,1024\}$, $q = 12289$...
user avatar
0 votes
1 answer
245 views

Why are public keys derived from elliptic curve cryptography (ECC) and not from hashing?

I've just started studying Bitcoin and cryptocurrencies, so I might be wrong, but so far my understanding is that public keys are derived from private keys using ECDSA, in Bitcoin's case using ...
user avatar
  • 19
4 votes
2 answers
223 views

Testing of PQC NIST round3 submissions

I am new to this field and have some concerns regarding PQC; How does NIST do a comparison that a particular algorithm is efficient and its security can not be broken by future quantum attacks? I am ...
user avatar
5 votes
0 answers
124 views

Is qTesla Secure?

qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
user avatar
  • 349
1 vote
0 answers
43 views

Why can't we have AES512 or more? [duplicate]

Look I know AES256 is ridiculously secure but to keep aes secure even after quantum computers, I have a concern. Using the Grovers theorem aes can be reduced from 256 to 128 bits for brute force ...
user avatar
  • 11
5 votes
2 answers
686 views

Post-quantum algorithms and side channel attacks

I am studying finalist algorithms of NIST Post-Quantum Cryptography Standardization. I noticed that almost all third party cryptanalysis papers consist of side-channel attacks. Why are classical ...
user avatar
  • 370
0 votes
1 answer
44 views

How does knowing the factors of the key help me decrypt?

I recently started learning about cryptography and its Quantum aspect and I came across Shor's Algorithm (which solves the following problem: "Given an integer N, find its prime factors"). I ...
user avatar
  • 3
1 vote
3 answers
473 views

Post quantum security experiment

In cryptography there are 4 basic attack classifications: Ciphertext-Only Attack Known-Plaintext Attack Chosen-Plaintext Attack Chosen-Ciphertext Attack In Katz & Lindell's textbook (2nd edition)...
user avatar
  • 1,482
1 vote
1 answer
66 views

Use of irreducible Goppa codes in McEliece scheme

Is there a cryptographic reason for using an irreducible Goppa polynomial $g$ in the McEliece scheme? One doesn't need irreducibility to define a usable code, so I assume there is some structural ...
user avatar
  • 165
3 votes
0 answers
37 views

CCA security in QROM for symmetric schemes

Assume that we have a symmetric encryption scheme $\Pi_s$ that is IND-CCA secure in the standard model. Does this imply that $\Pi_s$ is IND-CCA in QROM?
user avatar
  • 31
-1 votes
1 answer
102 views

What would be the benefits of using a faster cryptographic system with the same level of security as AES

Essentially I'm asking, what if I have designed a quantum-proof stream cipher that is faster than AES-256? Will using less computational power for encryption/decryption be valuable to companies or ...
user avatar
8 votes
1 answer
571 views

NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?

Recently, the NSA (re-published?) their CNSA guidelines and some information on post-quantum computers (per the title of the document). Here's the link for convenience (document is titled, 'Quantum ...
user avatar
  • 115

1
2 3 4 5
12