Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

2
votes
0answers
30 views

Is McEliece secure with non-binary Goppa codes?

A binary Goppa code with codewords of length $n$ bits that can fix $t$ errors with a polynomial over $GF(2^m)$ can encode $k = n - mt$ bits long data. That is one needs to add $mt$ check bits to fix $...
4
votes
1answer
137 views
+50

Complete Attack on RLWE Key Exchange with reused keys, without signal leakage

I am studying a research paper "Complete Attack on RLWE Key Exchange with reused keys, without signal leakage" . On page number 21 to 28, there is toy example explaining the scheme. I am unable to ...
2
votes
1answer
62 views

SIDH: key agreement - why does it work?

In SIDH both parties agree on the key in following way: Alice calculates a kernel $R = mPB + nQB$ Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$ She uses $\...
-1
votes
0answers
22 views

Post quantum TLS based web-browser client [migrated]

Are there any open source projects that implement a web browser client that has support for post quantum TLS protocols so that it can talk with post quantum patched TLS web servers. I've checked ...
0
votes
2answers
55 views

SIDH cryptosystem question

I'm trying to understand the SIDH cryptosystem and got confused at this point: Alice fixes base $\{P_A,Q_A\}$ so that it generates $E_0[l_A^{e_A}]$. Then she chooses secret parameters $m_A,n_A$ and ...
2
votes
0answers
40 views

Gentry-Halevi’s Fully-Homomorphic Encryption and hermite factor

In section 7.2, page 18 in Chen-Nguyen paper regarding BKZ 2.0, they point out different Hermite factors related to Gentry-Halevi FHE. More precisely, it is said that the critical Hermite factor for ...
1
vote
0answers
63 views

RSA vs. Super Computer vs. Quantum Computer

I know that RSA is known to be secure in the current landscape of computing, and I know that RSA is known to be broken in the world of quantum computing and cryptography. I have two questions, can ...
0
votes
0answers
7 views

What state does a qbit look like before it collapses [migrated]

Which is the correct depiction of a qbit state showing the possibilities before it collapses? Is it like: MODEL 1: 1000 0100 0010 0001 MODEL 2: 1000 0100 0010 0001 0111 1011 1101 1110 MODEL 3: ...
2
votes
0answers
41 views

IETF Recommendations for preparation for PQC- clarify in what way they are referring to bits

Which bits are being referred to when it is said by the IETF, "Continue to avoid baking-in algorithms, either explicitly or implicitly (e.g. via maximum field sizes)" ? Does that mean leave enough ...
1
vote
1answer
89 views

How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?
1
vote
1answer
57 views

NTRUSign (considered broken) as a one or few time PQ signature scheme

As many know, original NTRUSign is considered broken as signatures leak information about the private key. It takes a number of signatures to accomplish a break though, with the original break paper ...
2
votes
1answer
57 views

How does the Signature Scheme in Picnic Works

I am trying to understand how signature scheme proposed to NIST, Picnic, works. The propossal uses ZKboo and ZKboo++ as their basis. I can see how the ZKPoK works, where the witness x is some key ...
2
votes
1answer
94 views

Does the block size of a symmetric cipher impact the security of the cipher itself? [duplicate]

Will a 128 bit block have some security implication in post-quantum cryptography?
2
votes
1answer
57 views

Can I connect the hardness of a linear short integer solution problem to that of SIS problem?

As we know, SIS problem is defined as: for a function $f_A(s)$=$As$, where $A$ is a fixed, randomly-chosen matrix in $\mathbb{Z}_q^{r \times n}$, it is hard to find elements $s \in \mathbb{Z}_q^{n}$ ...
3
votes
0answers
112 views

How does post quantum key exchange in OpenSSH 8 work?

OpenSSH 8 supports a post quantum KEX, namely sntrup4591761x25519-sha512@tinyssh.org It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how ...
0
votes
0answers
22 views

Minimal secure index of quasi-cyclic codes for code-based cryptography

It is well-known that keys (generator matrices) of code-based cryptography are very large for its practical usage. To reduce them scientists propose to use families of quasi-cyclic codes. I remind ...
0
votes
0answers
34 views

Regarding the isogeny path problem

Given two elliptic curves, it is hard to calculate an isogeny of large degree between them. Does this only apply to supersingular isogenies or to ordinary ones as well? Additionally, is the mapping ...
6
votes
1answer
93 views

Why doesn't “Classic McEliece” need scrambling?

The original McEliece scheme uses two random matrices S and P to scramble the generator matrix and uses $\mathsf S·\mathsf G·\mathsf P$ as the public key. The Niederreiter variant also does about the ...
0
votes
0answers
43 views

Dilithium signature scheme - Public key derivation

Good day! I am very new to Cryptography but I want to make sure I understand the concept of the scheme correctly before using it to our system. So I was looking at post quantum signature schemes, and ...
4
votes
0answers
54 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
2
votes
0answers
111 views

Quantum Resistant Algorithms and types: PKE vs PKEs vs KEM vs KEMs vs DSS

I am trying to wrap my head around the second round Quantum Resistant Algorithm candidates currently under the NIST PQC Effort. Can someone verify if the following is a correct summary of the 17-...
5
votes
1answer
108 views

Can I replace DH by a post-quantum key exchange in IBAKE for post-quantum identity-based authenticated key exchange?

IETF RFC 6539 IBAKE - Identity Based Authenticated Key Exchange describes a Hybrid key exchange using both Identity based cryptography and a standard ephemeral elliptic curve Diffie-Hellman key ...
7
votes
0answers
87 views

Differences between “NewHope” and “NewHope-simple”

The well-known paper described a key exchange (KE) scheme named "NewHope" on USENIX 2016. The authors then proposed "NewHope-Simple" - a PKE/KEM scheme. They also submitted "NewHope for NIST" - ...
1
vote
1answer
65 views

Cost of upgrading to PQCrypto

We already have recommendations on what PQCrypto to use: PDF (page 11) Symmetric encryption Thoroughly analyzed, 256-bit keys: AES-256 Salsa20 with a 256-bit key Symmetric ...
2
votes
1answer
104 views

NIST security categories (post quantum)

Here (https://www.safecrypto.eu/pqclounge/round-2-candidates/) are collected all the proposals which passed the first round of NIST Post-Quantum Cryptography Standardisation process. What does the ...
2
votes
1answer
65 views

Niederreiter cryptosystem

I can't understand how Niederreiter cryptosystem works. If $c=mH^{'T}$ than why we cannot compute $m$ directly by multiplying $c$ with the $(H^{'T})^{-1}$? Can you give me an example of a "fast ...
1
vote
1answer
98 views

CSIDH: Why do we need ideals in the form of $\langle \ell, \pi \pm 1 \rangle$ in order to apply Vélu's formulas when computing the action?

I am trying to understand the action of the CSIDH protocol. Let $E_0:y^2=x^3+ax^2+bx$ be a Montgomery elliptic curve over $\mathbb{F}_p$ for some prime $p$. If we take $\mathcal{O}$ as $End_{\mathbb{...
0
votes
1answer
35 views

Associative Multivariate Permutation

Popular multivariate schemes are constructed by having a several easy-to-invert functions/maps as parivate key, and their composition as the public key. When signing, the hash, or a padded form of ...
3
votes
1answer
52 views

Question about degree of regularity

I have been reading some papers on cryptography based on multivariate systems and I have a question. How does one relate the difficulty of calculating Gröbner basis (GB) of a multivariate system with ...
5
votes
1answer
128 views

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are or IND-CPA or IND-CCA secure. I know what CPA ...
0
votes
0answers
88 views

How reassuring is 64-qubit security?

After we've concluded that 64-bit is an insecurity for classical computers, I think many would like to know, how secure in a perspective view, is 64 quantum bits security. As we know, the Grover's ...
1
vote
1answer
155 views

Can AES be broken by factorization (using Quantum Period Finding)?

I am trying to understand the paper "Breaking Symmetric Cryptosystems using Quantum Period Finding", and I reckoned the paper is roughly implying to break secret-key cryptographic system by finding ...
11
votes
1answer
153 views

WOTS+: Why does it XOR before running data through the hash function?

I'm implementing WOTS+ in a new language and I can't seem to wrap my head around the fact that WOTS+ XOR's their input with its mask right before hashing it. I tried to look for any reasoning but so ...
1
vote
2answers
369 views

Are zero-knowledge proofs quantum-resistant?

Are zero-knowledge proofs quantum-resistant?
3
votes
1answer
105 views

Adapting LWE Trapdoors for Ring-LWE

In the paper Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller by Micciancio and Peikert, they present the following theorem about the existence of trapdoor for LWE. Theorem 5.1: There is an ...
3
votes
1answer
86 views

Why are computations (isogeny) in SIDH done in an extended prime field?

While reading the SIDH key exchange protocol, I noticed that all the isogeny computations and curves are defined over the extended prime field $\mathbb{F}_{p^2}$. Does it make the problem ...
2
votes
1answer
251 views

Practical quantum attacks on SHA256 MAC and HMAC

Is SHA256 MAC (or HMAC) vulnerable to any quantum attacks? Game setup: The attacker's goal is to produce a valid MAC to be accepted by other devices in the ecosystem. The ecosystem consists of ...
3
votes
1answer
159 views

Practical quantum attacks on AES - Is AES-128 used in a block mode vulnerable to attack using quantum algorithms

Can Grover's (or similar) algorithm be used to attack AES-128 when used in cipher modes like CTR? It seems like the answer is no... Also I have a similar question for SHA256 when used for a MAC. It ...
2
votes
2answers
379 views

Attacking AES128 with Grover's algorithm

How many plain text / cipher text pairs are required by Grover's algorithm when it is used to try and discover a secret AES key? I am trying to determine if having a device which limits the speed at ...
2
votes
1answer
91 views

Encrypt your ECDSA signature with NTRU to make them quantum secure, does that work?

I have a general question about quantum security. ECDSA is suppose to be broken by quantum computers. Whilst something like NTRU is suppose to be secure. My question is: if we sign with ECDSA and ...
5
votes
0answers
73 views

IND-CCA2 post-quantum key exchange

QUIC requires that servers reuse keys so that session resumption works. That breaks many post-quantum key exchange systems. I am looking for a post-quantum key exchange algorithm with the following ...
2
votes
1answer
83 views

Original NTRU : How to calculate the size of private key?

In the original NTRU paper:NTRU: A Ring-Based Public Key Cryptosystem,1996, the author proposes 3 choices of implementation parameters: moderate, high and highest. Let's take moderate security level ...
3
votes
1answer
138 views

Post-quantum X3DH

I was trying to look into weather or not it would be possible to build a post-quantum version of the signal protocol. The double ratchet algorithm is trivial to modify, replacing the ECDH key ...
0
votes
1answer
55 views

How many messages before Sphincs(+) becomes insecure?

How many messages would it take until the success probability of a forger becomes $1/2$? $1/4$?
2
votes
1answer
134 views

Is post-quantum Oblivious Transfer possible

If I’m not mistaken classical OT is not regarded quanum-safe. However I’ve been reading (not really understanding) some papers [1,2] and some reviews[3] on quantum OT and/or post-quantum OT, it seems ...
-5
votes
1answer
70 views

What happens when quantum-resistant cryptography is implemented using a quantum computer?

What happens when quantum-resistant cryptography is implemented using a quantum computer? Give the whole deal with the qubits, is this even a worthy action?
3
votes
1answer
176 views

How are isogeny graphs made and how are they helpful to crypto?

I don't understand how the shapes of isogeny graphs are determined. While Alice and Bob do walk on it and don't backtrack, are they actually relevant to crypto? Also, I was told that supersingular ...
1
vote
1answer
183 views

What is post Quantum Cryptography?

Post-quantum cryptography is cryptography under the assumption that the attacker has a large quantum computer; post-quantum cryptosystems strive to remain secure even in this scenario. Post-quantum ...
4
votes
2answers
564 views

Can post-quantum algorithms be run on commercial devices?

Noob alert! Can we run quantum safe algorithms on commercial devices (like phones, laptops, etc)? I've seen some messaging apps and vpn providers marketing themselves as quantum-proof. How likely is ...
1
vote
1answer
140 views

Exactly what part of SIDH is proven to be NP-hard?

SIDH is quantum secure, why is it quantum secure? Exactly which part of the algorithm is proven to be NP-hard? Computing the isogeny function?