Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

Filter by
Sorted by
Tagged with
0
votes
1answer
200 views

Why are public keys derived from elliptic curve cryptography (ECC) and not from hashing?

I've just started studying Bitcoin and cryptocurrencies, so I might be wrong, but so far my understanding is that public keys are derived from private keys using ECDSA, in Bitcoin's case using ...
4
votes
2answers
144 views

Testing of PQC NIST round3 submissions

I am new to this field and have some concerns regarding PQC; How does NIST do a comparison that a particular algorithm is efficient and its security can not be broken by future quantum attacks? I am ...
5
votes
0answers
72 views

Is qTesla Secure?

qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
1
vote
0answers
40 views

Why can't we have AES512 or more? [duplicate]

Look I know AES256 is ridiculously secure but to keep aes secure even after quantum computers, I have a concern. Using the Grovers theorem aes can be reduced from 256 to 128 bits for brute force ...
5
votes
2answers
629 views

Post-quantum algorithms and side channel attacks

I am studying finalist algorithms of NIST Post-Quantum Cryptography Standardization. I noticed that almost all third party cryptanalysis papers consist of side-channel attacks. Why are classical ...
0
votes
1answer
41 views

How does knowing the factors of the key help me decrypt?

I recently started learning about cryptography and its Quantum aspect and I came across Shor's Algorithm (which solves the following problem: "Given an integer N, find its prime factors"). I ...
1
vote
3answers
450 views

Post quantum security experiment

In cryptography there are 4 basic attack classifications: Ciphertext-Only Attack Known-Plaintext Attack Chosen-Plaintext Attack Chosen-Ciphertext Attack In Katz & Lindell's textbook (2nd edition)...
1
vote
1answer
48 views

Use of irreducible Goppa codes in McEliece scheme

Is there a cryptographic reason for using an irreducible Goppa polynomial $g$ in the McEliece scheme? One doesn't need irreducibility to define a usable code, so I assume there is some structural ...
3
votes
0answers
28 views

CCA security in QROM for symmetric schemes

Assume that we have a symmetric encryption scheme $\Pi_s$ that is IND-CCA secure in the standard model. Does this imply that $\Pi_s$ is IND-CCA in QROM?
-1
votes
1answer
81 views

What would be the benefits of using a faster cryptographic system with the same level of security as AES

Essentially I'm asking, what if I have designed a quantum-proof stream cipher that is faster than AES-256? Will using less computational power for encryption/decryption be valuable to companies or ...
7
votes
1answer
317 views

NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?

Recently, the NSA (re-published?) their CNSA guidelines and some information on post-quantum computers (per the title of the document). Here's the link for convenience (document is titled, 'Quantum ...
1
vote
1answer
58 views

Evaluation criteria for NIST finalist candidates

I have seen several recent papers mention that side-channel resistance and countermeasure will be a major evaluation criterion for the NIST finalist candidates. However, I don't find any reference to ...
1
vote
1answer
42 views

Natural resistance to side channel attacks of XMSS/LMS/SPHINCS+

All these post quantum signature schemes are claimed by the authors to be naturally resistant to side channel attacks. My question is, why or how?
0
votes
1answer
55 views

Quantum secure algorithms

I want to know if the below algorithm , secure against quantum computing attack, and how I can compute the running time for the original algorithm and the proposed attack Source: Yan Zhu, HuaiXi Wang,...
0
votes
0answers
40 views

CRYSTAL-KYBER cryptosystem and Quantum computations

I've faced difficulty in understanding the proofs of the theorems that describe how Kyber is resistant to quantum attacks. (Theorems 1,2,3 and 4 in CRYSTAL-KYBER supporting document 2017) please, can ...
2
votes
1answer
119 views

Is password hashing post-quantum secure?

Current computers cannot break reasonably strong hashed passwords, for example 14 CSPRNG-generated alphanumeric characters ($\approx$80 bits of entropy). Grover's algorithm applies to hash functions ...
2
votes
1answer
77 views

dimension of Goppa codes

For the McEliece/Niederreiter cryptosystems, an efficient seemingly secure choice of code is an irreducible binary Goppa code, defined by an irreducible $g(x)\in GF(2^m)[x]$ of degree $t$ and a ...
1
vote
1answer
49 views

Why RLWE is hard or even has a solution?

I was thinking about why and how the RLWE problem is hard at all. I know that it's hard because it can be reduced to the shortest vector problem, but I'm thinking about how does it even have a ...
1
vote
1answer
135 views

Is it possible to create a Dilithium Prime or Falcon Prime?

In the NTRU Prime submission, principle author, the well-known DJB is adamant that [the] primary objective [of NTRU Prime] is to eliminate unnecessary complications in security review So much so, to ...
0
votes
0answers
21 views

How can I change the McEliece main parameters?

I use the Bouncy Castle Crypto API to implement McEliece in Java. I have also managed to encrypt and decrypt a message and it works without any problems. When I use the debugger, I see that the ...
2
votes
0answers
39 views

Basic explanation of Falcon and Dilithium

I've been trying to search for toy examples of the round 3 digital signatures Rainbow, Falcon and Dilithium. Not a lot of actual implementation examples are out there. What I'm searching for are ...
0
votes
0answers
61 views

Finding a basis for q-ary lattices

For $A\in \mathbb{Z_q}^{n\times m}$, where $m \geq n$, consider the given two q-ary lattices \begin{align} \Lambda_q^{\bot}{(A)} & = \{\mathbf{x} \in \mathbb{Z}^m: A\mathbf{x} = \mathbf{0}\text{ ...
1
vote
1answer
48 views

SIS vs LWE Problem

The Ajtai one way function is defined by $$f_A(x)= Ax \; mod\; q $$ where the x $\in \{0,1\}^m$ and A $\in \mathbb{Z_q}^{n \times m}$. $f_A(x)$ is one way function ( Ajtai 96) While the Regev One way ...
6
votes
1answer
73 views

CSIDH - l ideal generators

I am trying to study the CSIDH algorithm. I have some beginner background in elliptic curves and I have been following Andrew Sutherland's lectures (https://math.mit.edu/classes/18.783/2019/lectures....
1
vote
0answers
39 views

Combining Post-Quantum and Classical KEM

I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
0
votes
0answers
18 views

Crypto Economic Attacks such as Nothing At Stake and Sandwich Attack from Archive Nodes on Polkadot

Could you please advise me if there are threat vectors from archive nodes such as front running attacks, sandwich attacks and nothing at stake attacks as they are quite powerful in terms of the ...
0
votes
1answer
39 views

Why has ID-based PKC not been included in the NIST PQC competition?

Although there are several proposals of ID-based PKC based on lattices, multivariate cryptography, I want to know why identity (ID) based PKC is not included in the NIST post-quantum competition. Is ...
10
votes
1answer
1k views

Looking for the current status of the Chinese national cryptographic algorithm design competition

I'm trying to find the results of the Chinese national cryptographic algorithm design competition (which I believe is targeted towards postquantum algorithms); however I cannot find it. I did find ...
2
votes
1answer
43 views

Coding gain and minimum determinant in cryptography

In coding theory, the notions of coding gain and minimum determinant of a code have been defined as follows: let $\mathcal{X}$ be a (full diversity) code and $X,X^\prime\in\mathcal{X}$. Then the $\...
4
votes
1answer
148 views

How is a "quantum safe" algorithm fundamentally different from the current "secure" crypto algorithms (pre-quantum)?

I recently read that work is being done to develop "quantum safe" algorithms for encryption / hashing. Presumably, these will have fundamental differences from the current "non-quantum ...
1
vote
1answer
30 views

Kyber PKE correctness proof, how is triangle inequality used

Im reading the CRYSTALS kyber paper and am stuck on the PKE correctness proof on page 5. I can't see how the triangle inequality would help to get to the result $|| \lceil q / 2 \rfloor \cdot (m - m') ...
0
votes
0answers
66 views

Examples of post-quantum hash functions

We already know many examples of post-quantum cryptography for asymmetric, symmetric and digital signature algorithms, but is there any risk for hash functions to be attacked with quantum computers ...
0
votes
0answers
26 views

Checking whether a particular group has an efficient, faithful representation as a matrix group

There are cryptographic protocols being developed for non-abelian groups. For some protocols it is necessary to know whether the group has an efficient representation as a matrix group (say, a matrix ...
12
votes
1answer
631 views

Number of bit-operations required for information set decoding attacks on code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. This paper estimates the concrete number of bit ...
11
votes
0answers
462 views

Requirements for security against multi-target attacks, for McEliece and other code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. For these cryptosystems, it seems that an attacker ...
0
votes
0answers
50 views

Is my proof about uniqueness of ring-LWE secret correct?

Suppose that $n$ is a power of two, $q=3\pmod 8$, prime and $R=\mathbb{Z}[X]/(X^n+1)$. Denote $\Vert\cdot\Vert$ as the infinity norm in $R_q=R/qR$ on the coefficients of elements in $R_q$. The ...
3
votes
1answer
67 views

Making WOTS+ public keys shorter

In WOTS+ — as described in section 3 of RFC 8391 — public keys, private keys and signatures all consist of $len$ strings with $n$ bytes each, where $len, n \in \mathbb{N}$. Is it safe to use the hash ...
1
vote
1answer
51 views

Are my calculations about WOTS parameters correct?

I'm reading the WOTS+ paper, but I'm having some trouble with its notation and specially the involved units. For example, under my interpretation, the parameters ...
2
votes
1answer
51 views

How do I construct the Fn family of functions of WOTS+ using SHA3?

From the WOTS+ paper: Furthermore, W-OTS+ uses a family of functions Fn : {f_k : {0, 1}^n → {0, 1}^n | k ∈ Kn} with key space Kn. The reader might think of it as a cryptographic hash function family ...
3
votes
1answer
128 views

Is NOTS a valid one time signature scheme?

I've just learn about NOTS, a quantum-resistant signature scheme based on hash functions that claims to have much shorter signature and key sizes. Is this signature scheme known to be secure? From ...
0
votes
1answer
48 views

Why pre-shared key is not involved to key derivation in IKEv2?

In IKEv1 (RFC 2409), preshared secret is involved to key derivation where IKEv2 (RFC 7296) use it for only authentication. When we consider post-quantum security, this property makes IKEv1 suitable if ...
3
votes
1answer
38 views

SIDH: What if the two kernel generators are chosen in the same torsion group?

In SIDH, either party chooses its secret point $R_A = [m_A]P_A+[n_A]Q_A \in E[\ell_A^{e_A}]$, $R_B = [m_B]P_B+[n_B]Q_B \in E[\ell_B^{e_B}]$ from two different sets $E[\ell_A^{e_A}]$ and $E[\ell_B^{e_B}...
3
votes
1answer
97 views

Why define the dual of an ideal lattice with "Tr" rather than inner product?

In the paper [LPR12], I've learned that ideal lattices are ideals in algebraic number fields. However, I can't understand why we define the dual lattice of an ideal lattice with $\operatorname{Tr}$: $$...
1
vote
0answers
68 views

NTRU cryptosystem on complex numbers

Background I am interested in lattice-based cryptography. Recently I got familiar with the NTRU cryptosystem and found out that it can be extended onto hypercomplex numbers, like Quaternions (QTRU) or ...
0
votes
1answer
74 views

When is a PQ key-exchange algorithm suitable for use with long-term static keys?

I took a look at Cloudflare Circl because I'm curious which Post-Quantum algorithms are implemented in Go, which could be used to exchange a key. I read this comment that SIDH is only good for ...
0
votes
0answers
30 views

How does the public-key generation work in the multivariate post-quantum digital signature GeMMS?

There are a few steps in the public-key generation of GeMSS that I am trying to understand. The first is the below equations (1). What does "$\theta_i$ forms a basis for $\mathbb{F}_{2^n}$ over $\...
2
votes
1answer
63 views

Volume of an NTRU lattice

Let $K$ be a number field of degree $n$ and $\Lambda^q_h=\{(f,g)\in\mathcal{O}_K\text{ : }fh-g = 0\bmod q\mathcal{O}_K\}$, where $h$ is an NTRU public key. Then $\{(1,h),(0,q)\}$ generates a lattice. ...
0
votes
0answers
17 views

Can Merkle signatures be leveraged for key exchange?

A Merkle signature scheme is post-quantum-suitable as it relies only on the security of a one-way function. However, this construction seems to only be capable of authentication, and not ...
0
votes
1answer
72 views

Theorem of the dual isogeny in SIDH Zk proof

In the proof of soundness for the SIDH ZK proof protocol (section 6.2 in DJP11) the authors refer to the "Theorem of the dual isogeny". What do they mean by this? In particular, I don't ...
1
vote
0answers
33 views

Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...

1
2 3 4 5
11