Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

Filter by
Sorted by
Tagged with
3 votes
1 answer
374 views

What asymmetric encryption to use that is safe against quantum computers?

i am currently searching for a post-quantum, asymmetric encryption since I need to keep a few files safe for the next decades. AES 256 is what I am using currently, but I would like to leverage the ...
0 votes
0 answers
52 views

When will $R_q=\mathbb{Z}[X]/\langle X^n+1\rangle$ be a field? [closed]

When will $R_q=\mathbb{Z}[X]/\langle X^n+1\rangle $ be a field?
1 vote
1 answer
84 views

Encryption and decryption for LWE

For https://asecuritysite.com/public/lwe_ring.pdf#page=9 , could anyone explain how the encryption and decryption for LWE work ? When I do more reading on https://summerschool-croatia.cs.ru.nl/2015/...
  • 111
1 vote
0 answers
55 views

Power consumption of Post-Quantum Crypto vs. legacy crypto

Is there any educated views or references on how the PQC NIST finalists compare to legacy crypto with regards to power consumption? Many thanks
  • 323
0 votes
0 answers
27 views

Is there an openssl option that allows you to dump keys from a TLS handshake?

Client-Server Example apps/openssl req -x509 -new -newkey ec:<(apps/openssl ecparam -name secp384r1) -keyout ecdsa_CA.key -out ecdsa_CA.crt -nodes -subj "/CN=oqstest" -days 365 -config ...
0 votes
1 answer
29 views

Comparing stateful hash-based signatures to group-based signatures

Some applications may require quick transition to post-quantum signatures, and stateful hash-based signatures fill that role (cf. CNSA 2.0). My question is (ignoring statefullness, focusing on space/...
  • 165
0 votes
1 answer
84 views

Post quantum hybrid model and its security

A hybrid scheme is a combination of a classical and a post-quantum scheme. In the hybrid model, if even the post-quantum section is broken, the hybrid scheme is still secure against non-quantum ...
  • 1
2 votes
1 answer
72 views

Statistical Distance and Learning with Rounding

Given an integer $b$ modulo a prime $q$, one can define a `rounding’ function $\lfloor b\rceil_p$ for a prime $p$, $p<q$, as follows: $$\lfloor b\rceil_p = \lfloor \frac{p}{q}\cdot b\rceil\bmod p.$$...
  • 381
1 vote
0 answers
52 views

For post quantum security is any HMAC with 256 bit key secure [duplicate]

For use use in Encrypt then MAC scheme i am considering using HMAC-SHA256 with 256 bit key, i am wondering if i should use HMAC-SHA512 to be post quantum secure, will simply using HMAC with 256 bit ...
5 votes
1 answer
1k views

What does the modulo plus minus mean?

May someone please explain what the notations in the image means? In general, for a modulus $q$, what does the $+$ in here $\bmod^+ q$ indicate? What does the $\pm$ in here $\bmod^\pm q$ mean?
13 votes
1 answer
3k views

The death of isogeny-based cryptography?

Wouter Castryck and Thomas Decru recently broke SIDH. From the abstract: We present an efficient key recovery attack on the Supersingular Isogeny Diffie-Hellman protocol (SIDH), based on a "glue-...
  • 131
1 vote
1 answer
119 views

The XOR operation, is it a quantum resistant operation and why is that? if not, what is the most lightweight alternatives?

The XOR operation is an important part of most of the existing end-to-end authentication protocols. Will it be part of the post-quantum authentication protocols?.
  • 11
2 votes
0 answers
44 views

Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them

Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
0 votes
0 answers
44 views

Do PQ-KEMs kyber and KEMs approved for 4th round , need Domain Separation?

Do PQ-KEMs kyber and KEMs approved for 4th round , need Domain Separation for deriving multiple keys from shared secret?
16 votes
2 answers
4k views

New paper claims quantum polylog time attack on AES

It is well known that Grover's algorithm can solve AES in $O(\sqrt{n})$ time, which is why symmetric key length needs to be double to maintain their security level in the face of a quantum adversary. ...
  • 1,232
0 votes
1 answer
80 views

can Encrypt-then-mac using HMAC-SHA256 with AES-256-GCM protect against attacks from Key committment and make it Post Quantum Secure

I read from Is GCM mode of authenticated encryption quantum secure? that AES-GCM will be insecure if the attacker is allowed to perform entangled queries on your GCM implementation, and return ...
0 votes
1 answer
85 views

Sources for post quantum cryptography

I already have experience with quantum computing and the mathematics behind it. I also know the quantum cryptography side e.g. BB84, etc. I now want to move on to post-quantum cryptography and am ...
  • 101
0 votes
0 answers
85 views

Is ChaCha20Poly1305 post quantum secure? is it better than AES-GCM or AES-OCB with 256 bit key? [duplicate]

I read online that AES-256 is Quantum Safe , so AES-256 used in AES-GCM and AES-OCB should be quantum safe , just wondering is ChaCha20Poly1305 quantum safe , if it is then is it better than AES-256 ...
2 votes
2 answers
135 views

Mitigation of lattice-based KEM decryption failure possibility

Lattice-based PQC KEM has small probability of decryption failure In an offline setting it can be catastrophic despite being improbable. Proposed mitigation: ...
1 vote
2 answers
49 views

Generalized Haircomb OTS vs Winternitz OTS at 256bit hash security level

Suppose a 256 bit hash is used (SHA2, SHA3, ...). How does the Winternitz OTS perform at various signature sizes? I'd want to compare to a generalized K-teeth Haircomb: It's signature is $K$ of these ...
0 votes
0 answers
100 views

Which block cipher modes of AES-256 are quantum safe? Is OCB mode quantum safe?

I was wondering if I have to keep my data safe in an age when quantum computers become a reality. Which AES block cipher modes will be secure? Will AES-OCB will be quantum safe if used in a PGP like ...
0 votes
0 answers
47 views

is HMAC required if i am using AES-CFB and using Digital signatures for Authentication

I researched online and found AES-GCM and ChaCha20Poly1305 aren't post quantum secure. So I am planning to use symmetric AES256 cipher in CFB mode do I need to implement MAC using HMAC like HMAC-...
1 vote
1 answer
91 views

Is HMAC-SHA512 with 512 bit key Quantum Safe?

is HMAC-SHA512 quantum safe , I am planning to use it for encrypt-then-mac scheme with aes256-cfb mode for a post quantum safe PGP like protocol.
5 votes
1 answer
691 views

Is Argon2 Quantum safe? [duplicate]

I am developing a post quantum safe GPG like program, is argon2 quantum safe cryptographically for GPG like application.
12 votes
1 answer
2k views

Why did NIST select Kyber and Dilithium?

NIST selected Kyber for key agreement and Dilithium for digital signature applications some days ago. But IDF's MATZOV group, in their paper, broke Kyber and Dilithium and brought the security levels ...
  • 121
-2 votes
1 answer
119 views

Why does the comb of Natasha Otomoski have 21 teeth? [closed]

What is the signature size of Natasha Otomoski haircomb? What is the number of invocations of the underlying one way hash function for key generation, signature, and verification? How does it compare ...
3 votes
1 answer
130 views

Alter SPHINCS+ to have collision probability=0 and remove entropy source when signing

If you alter the SPHINCS+ signature scheme such that the number of signatures it can sign is the same as the number of hashes the hashing algorithm can output such that for example if you have a 2^256 ...
1 vote
0 answers
82 views

Which quantum resistant digital signature algorithm would you use and why (If you had to pick one now)? [closed]

Context: Many widely used public-key cryptographic schemes have been designed based on the difficulty of factoring and similar problems. That includes RSA, the Diffie-Hellman Key Exchange, ECDH, ...
1 vote
1 answer
73 views

How do you use a PQC Hybrid Shared Secret in Practice?

In https://tools.ietf.org/id/draft-stebila-tls-hybrid-design-03.html, they define (many other sources do too) hybrid shared key exchange as “Hybrid” key exchange, in this context, means the use of ...
  • 145
3 votes
1 answer
64 views

In reduction from search LWE to decsion LWE why sampling needs to repeat a polynomial number of times?

I've been reading through MIT's lecture notes on learning with errors here, and I'm trying to understand the reduction from Search LWE to Decision LWE, as described there in Section 2.7, "...
  • 311
0 votes
0 answers
15 views

Do L-trees remove the need of collision resistance hashes in XMSS MT?

I read that the bitmasks in XMSS-MT lower the security requirements from a collision resistant undetectable hash to a 2nd preimage resistant undetectable hash (see LMS vs XMSS: Comparion of two Hash-...
0 votes
1 answer
23 views

How come we only need to generate the first tree in each layer in XMSS MT

From what I understand, to reduce the time taken for public key generation, you can use nested trees in XMSS to form Multi-tree XMSS. For an instantion of 2 layers, it seems that the leaf of each L ...
2 votes
1 answer
115 views

Patterson's decoding algorithm for Goppa codes

From this Wiki page: given a Goppa code $\Gamma(g, L)$ and a binary word $v=(v_0,...,v_{n-1})$, its syndrome is defined as $$s(x)=\sum_{i=0}^{n-1}\frac{v_i}{x-L_i} \mod g(x).$$ To do error correction, ...
1 vote
2 answers
115 views

Difference signature / asymmetric encryption (PQC)

The NIST is currently trying to select new standards for post-quantum cryptography. The two main categories for the candidates are "Public-key Encryption and Key-establishment Algorithms" ...
  • 51
1 vote
0 answers
39 views

Implementation size of post quantum schemes

I was comparing classical schemes with post-quantum schemes. Therefore I was interested in the round three candidates of the NIST standardization process. So far I know, that those post-quantum ...
  • 1,657
3 votes
0 answers
91 views

Are Memory-Hard Functions de-facto quantum resistant?

Searches have returned absolutely no results on this question. With that in mind, I assume the answer is either painfully obvious ('of course quantum computers get no advantage when it comes to ...
1 vote
0 answers
29 views

What is an advantage of the Charles--Lauter--Goren hash function?

What is an advantage of the Charles--Lauter--Goren hash function (based on isogenies of elliptic curves) among other provably secure collision-resistance hash functions ? I heard that it is slower.
2 votes
1 answer
156 views

RLWE Explanation

In RLWE, we often choose the following polynomial ring, where q is a prime, and n is a power of 2, e.g. $2^k$ $$\mathbb Z_q[X]/(X^n + 1)$$ We know that ${X^{2^k}} + 1$ is an irreducible polynomial ...
1 vote
1 answer
59 views

Classical vs Quantum-Safe Algorithms and Protocols / Application Approach

Various proposals are being explored for X509 V3 certificates in a Post Quantum Cryptography (PQC) world. Currently, these include just having a certificate for classical and PQ, having a hybrid ...
  • 145
0 votes
0 answers
45 views

Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret

I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
0 votes
0 answers
26 views

How $f(x)$ set in ring-lattice crypto?

I want to clear out some confusions I have about Lattice crypto. As discussed in this talk Signatures, Commitments, Zero-Knowledge, and Applications For ring $Z_q[x]/f(x)$, I want to understand ...
  • 239
1 vote
1 answer
56 views

Errors for $\mathsf{LWE}$

Why do we take Gaussian-like errors in $\mathsf{LWE}$? Why for example we don't take uniform errors?
  • 365
2 votes
2 answers
62 views

Solving $\mathsf{SVP}_{\gamma}$ in worst-case

What does it mean to solve $\mathsf{SVP}_{\gamma}$ in worst-case? Does it mean that the problem is solvable for any lattice we choose?
  • 365
0 votes
0 answers
62 views

Comparing the performance of ECC/RSA with post quantum protocols

I wanted to compare the performance of different cryptographic systems. There is a pretty good paper comparing the 3rd round finalists of the NIST competition. I was wondering if there are good ...
  • 1,657
2 votes
1 answer
239 views

Comparison of Post Quantum Algorithms in Nist 3rd round

I'm interested in the Post Quantum Algorithms of the 3rd round of the NIST standardization competition. The algorithms for KEM are Classic McEliece, CRYSTALS-KYBER, NTRU, SABER and their 5 ...
  • 1,657
1 vote
1 answer
195 views

Models and assumptions in the post quantum world

I'm currently trying to get an overview of post-quantum cryptography. Now I'm struggling with correlations and adjustments of the PQ-world and the Modern-world of cryptography. My Questions: Can you ...
  • 1,657
1 vote
1 answer
83 views

Tree Parity Machines (neural cryptography) advantages

It seems that neural cryptography is an interesting research topic and there are some important contributions published in the last years. The proposed algorithms are suitable for symmetric key ...
  • 11
2 votes
1 answer
493 views

Is the combination of X25519 ECDH and NTRU in OpenSSH 9.X secure against quantum attacks?

Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks? Why is it believed that this combination is secure?
4 votes
1 answer
168 views

What is the effect of low rank dual sublattices on the dual lattice attack on LWE?

In the dual lattice attack of Espitau, Joux and Kharchenko (On a dual/hybrid approach to small secret LWE), the authors propose distinguishing (and subsequently recovering secret values) of LWE ...
  • 12k
1 vote
0 answers
29 views

On the effectiveness of Sidelnikov-Shestakov attack under a bad guess

I have been studying Wieschebrink paper "Cryptanalysis of the Niederreiter Public Key Scheme Based on GRS Codes". In the paper a cryptosystem using GRS codes is exhibited with an attack ...

1
2 3 4 5
13