Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

Filter by
Sorted by
Tagged with
11
votes
2answers
2k views

Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term ...
1
vote
1answer
145 views

SVP algorithms and complexity

I took image from Simons Institute's presentation. Complexity classes of Approximate SVP problem according to approximation factors are given in the table. My question is, What is the meaning of blue ...
2
votes
0answers
53 views

How to associate a post-quantum public key with a pre-quantum one in blockchains?

As a layperson, I'm curious if a cryptocurrency could fork to a quantum-resistant algorithm without people losing access to their wallets. Is it possible to generate a quantum-resistant public key ...
1
vote
1answer
57 views

Expansion Factors

There seems to be a quantity, often denoted $\gamma$, such that the $l_2$ norm of a product of two polynomials can be written as the product of the norms, up to multiplication by $\gamma$. For ...
2
votes
0answers
33 views

Trade-offs for more parties in PICNIC multi-computation

In the PICNIC post-quantum signature scheme, a zero-knowledge proof of the secret key for a symmetric encryption is produced by implementing the encryption as a Yao garbled circuit of a three-party ...
1
vote
0answers
17 views

Non-causal private keys in PICNIC

I've been thinking about PICNIC, the tier 2 NIST post-quantum signature scheme. Leaving aside the innovative multi-party computation zero-knowledge proof structure, the private key is an $n$-bit key ...
2
votes
1answer
67 views

Understanding Unique-SVP and Kannan's Embedding

I am trying to understand the Kannan embedding technique. But I am confused about the formation of the B' and the finding of the short vector inside that basis. How does this basis matrix in the ...
0
votes
1answer
41 views

Leighton-Micali Hash-Based Signature key sizes

I am working with the RFC for Leighton-Micali Hash-Based Signatures: RFC-8554. The question is if I understood it correctly and my calculations of the key sizes are correct. Basically, LMS uses ...
1
vote
0answers
36 views

Implementing LMS

I already created my own version of the hash based signature scheme LMS, but my signing results do not match the test vectors provided in the RFC. I am not sure what I do wrong, thus I wanted to try ...
1
vote
0answers
35 views

Speed of NTRU-HPS-2048-509

NTRU-HPS-2048-509 is one of the 3 algorithms that we can find in Open Quantum Safe Project. I would like to know why NTRU-HPS-2048-509 key generation is so slow in comparison to the others.
6
votes
2answers
159 views

LWE: Round a continuous Gaussian to a true Discrete Gaussian

Short version: how is it possible to round a continuous Gaussian into a true discrete Gaussian (usually denoted $\mathcal{D}_{\mathbb{Z},\alpha q}$)? The goal is to obtain a reduction from continuous ...
0
votes
1answer
61 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
0
votes
1answer
63 views

Soundness of Trevisan’s Extractor Against Quantum Side Information

I wonder how sound Trevisan's extractor can be against quantum side information. I checked many papers. And all of these papers were aiming to explain how sound Trevisan's Extractor is against quantum ...
0
votes
0answers
34 views

Is the NTRU Challenge still ongoing?

In 2016, security innovation released the NTRU challenge. I understand that NTRU is now patent free and it seems like most of the documents related to the NTRU challenge on security innovation's ...
1
vote
1answer
46 views

What is the NTRU parameter equivalent to security level 112, 128 and 192?

I came across this paper which mentions this table, which states that NTRU 347 is equivalent to 112 bit security level However, in this paper, Choosing parameters for NTRU mentions that NTRU-401 is ...
2
votes
1answer
27 views

Using XMSS with Blake2

Since XMSS only requires a 2nd preimage resistant hash function, is using Blake2 in XMSS possible? It is not in standard, but Blake2 seems to be faster than SHA256
0
votes
1answer
63 views

Implementation of Leighton-Micali Hash-Based Signatures

I am trying to follow the RFC instructions but am not sure if I understand it. In the RFC there are also some test cases given, although my implementation yields different results. Test Cases: https://...
2
votes
0answers
29 views

What is the extra defense that McEliece 6960119 and 6688128 have that 8192128 does not?

From https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf The 8192128 parameter set is bigger, but the ...
2
votes
1answer
42 views

Post quantum security of the BLAKE family

Is there any proof that BLAKE (including 2 and 3) is post-quantum secure? We know that as Merkle–Damgård (with proper padding) preserves collapse sha2 is post-quantum secure. I know that the sponge-...
0
votes
1answer
48 views

How secure is LMS?

LMS is a hash-based digital signature scheme. It is a standard alongside of XMSS, which has it's bit-security stated in the paper(about 200bit-security for standard parameters). LMS security ...
3
votes
1answer
71 views

What is the largest parameter broken for NTRU?

The original secure parameters for NTRU shown below are from the original HPS98 paper. This is vastly different from the current secure suggested parameters in the NIST PQC round 3 submission. ...
2
votes
1answer
50 views

How to encode and decode message into polynomial form on NTRU

This question is based on a previously asked question. How to make a message into a polynomial on NTRU encryption? I am tasked to implement NTRU with toy parameters such as $N=7$ or $N=11$ and I have ...
1
vote
2answers
75 views

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ...
0
votes
1answer
35 views

Speeding up XMSS

To compute the XMSS Tree root, one needs to compute all the 2^h keys and hash them together. The higher the height of the tree, the more keys there are and the longer the KeyGen computation. The ...
1
vote
1answer
31 views

What is the security strength of McEliece variants?

Please help me understand the security strength of McEliece variants prepared for Round 3. I looked at the specifications - https://classic.mceliece.org/nist/mceliece-20201010.pdf - it doesn't have ...
1
vote
1answer
69 views

Meaning of Dilithium-1024x768 or Dilithium2

Can someone explain me the meaning of 1024 and 768 in Dilithium-1024x768 in the algorithm? And the meaning of 2 in Dilithium2 in the algorithm?
2
votes
1answer
27 views

XMSS - creation of authentication path

The reference uses treeHash algorithm everytime a signature is generated, thus generating authentication path AND the root, which is not necessary, as the root has only to be generated once. ...
0
votes
0answers
33 views

Authentication tag length and post-quantum security

The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum ...
0
votes
0answers
16 views

Performance comparison of SPHINCS+ and XMSS or LMS

Is there a comparison of the performance between SPHINCS+ and XMSS(MT) or LMS? I am aware of this paper that compares LMS and XMSS but nothing that compares either of them to SPHINCS+. I ask because I ...
2
votes
1answer
59 views

Computational LWE-Trapdoor without tag

In the paper Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller, Micciancio and Peikert mention that it is possible to save an additive $n$ term in the dimension $\bar{m}$ in paragraph $\...
28
votes
7answers
5k views

Does Terra Quantum AG break AES and Hash Algorithms?

According to this Bloomberg article: A Swiss Company Says It Found Weakness That Imperils Encryption Terra Quantum AG has a team of about 80 quantum physicists, cryptographers and mathematicians, who ...
0
votes
0answers
30 views

GSW and homomorphic addition on integers

Is it possible to use the GSW scheme (Gentry, Sahai, Waters) also on integer values and not just single bits? If not, are there any schemes that support integer arithmetic with the same nice property ...
0
votes
0answers
38 views

GSW13 scheme and integer arithmetic

I'm new to lattice-based cryptography and have trouble understanding if the GSW13 (Gentry, Sahai, Waters) scheme works only on single bits. But is it also possible to encrypt integers with this scheme ...
1
vote
1answer
58 views

Algebraic Variants of NTRU

There are a large number of algebraic NTRU variants: for example, in some (such as ETRU), the underlying ring has been changed to the ring of integers of a certain number field; there is GR-NTRU, ...
1
vote
1answer
35 views

The mathematical similarity and difference between code-based PKE and multivariate DSS

In code-based public key encryption schemes, a public key is formed by matrix-multiplying 2 linear matrices to the left and right side of a easily decodeable error-correcting code, so that it'll be ...
0
votes
1answer
33 views

XMSS WOTS+ private keys vs XMSS private keys

The length of WOTS+ private key is an array of length "len" of n-Byte strings. Meaning, for w=16 and n=32, the len is 72. So the WOTS+ max length of the private key is 72, meaning only 72 ...
0
votes
1answer
36 views

Message length in XMSS

I read that XMSS generates many private keys and one key must sign only one message. Does it mean though that I sign many different messages, or do I sign one message, which, if its longer than 256bit,...
3
votes
1answer
83 views

Significance of parameter q in NTRU lattice attack

In NTRU (N,p,q,d), N is usually chosen to be prime and q be a power of 2. Why is it that if I increase the parameter q, the probability of finding a key or spurious key that can decrypt the message is ...
2
votes
0answers
31 views

NTRU HPS98 vs NTRU-HRSS-KEM vs new NTRU

What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation? Round 1 - ...
0
votes
0answers
24 views

PQC: XMSS L-Trees

I understand how WOTS+ signing works: I create a secret key and put it into leaves of my binary tree and hash it with some random values in the binary tree with my chaining function until the root is ...
1
vote
0answers
21 views

Sampling polinomials in NTRUEncrypt

Some time ago I read an explanation of the key generation process of NTRUEncrypt, where it was stated that a polynomial $f$ should have "small" coefficients. It defined the number $df$, ...
0
votes
0answers
12 views

Sources about NTRUEncrypt implementations

I'm looking for any source that explains the final implementation of NTRUEncrypt for the NIST's third round as simple as possible. I have been trying to understand it directly from the submitted code ...
1
vote
1answer
96 views

Identification Schemes and Internet of Things

I was reading an article titled "A Novel Method for Polar Form of Any Degree of Multivariate Polynomials with Applications in IoT" (doi:10.3390/s19040903) I read the following statement: &...
4
votes
0answers
64 views

Challenging $O(2^{n/2})$ for hash collisions using quantum computers

In "Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound" the authors Akinori Hosoyamada and Yu Sasaki state that it may ...
1
vote
5answers
318 views

Is it theoretically possible to create an unbreakable cipher?

I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
1
vote
3answers
227 views

I need a pathway for studying Lattice-Based Cryptography

I realize that I need a study pathway for post-quantum cryptography. I started to study post-quantum crypto by reading NIST PQC 3rd-round submissions of the lattice-based schemes (let's start with the ...
-1
votes
1answer
101 views

Submission to NIST

I have a paper on post quantum cryptography about Key-establishment Algorithms, that I wish to submit it to the National Institute of Standards and Technology (NIST) I found on their website that the ...
2
votes
1answer
40 views

Differences between Extractors and Privacy Amplification for Quantum Random Generators

We know that for the last step of QRNG: we need to separate quantum and classical noises from each other so we use extractors, after extractor we need privacy amplification step. At this point: if ...
5
votes
1answer
173 views

What are the public key and output sizes for the four remaining PQC KEM candidates?

Currently there are only 4 direct candidates left that provide KEM. Generally performance seems to be "OK" for those candidates. However, the key and encapsulated key sizes (i.e. the output ...
0
votes
1answer
41 views

How to deal with concrete security against lots of queries?

In general, $O(1/\epsilon^2)$ queries are required to distinguish between two distributions that are statistically close at most $\epsilon$. This informal state deals with the required number of ...

1
2 3 4 5
10