Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

Filter by
Sorted by
Tagged with
0
votes
1answer
44 views

When is a PQ algorithms suitable as long-term static key for key exchange

I took a look at Cloudflare Circl because I'm curious which Post-Quantum algorithms are implemented in Go, which could be used to exchange a key. I read this comment that SIDH is only good for ...
0
votes
0answers
28 views

How does the public-key generation work in the multivariate post-quantum digital signature GeMMS?

There are a few steps in the public-key generation of GeMSS that I am trying to understand. The first is the below equations (1). What does "$\theta_i$ forms a basis for $\mathbb{F}_{2^n}$ over $\...
2
votes
1answer
46 views

Volume of an NTRU lattice

Let $K$ be a number field of degree $n$ and $\Lambda^q_h=\{(f,g)\in\mathcal{O}_K\text{ : }fh-g = 0\bmod q\mathcal{O}_K\}$, where $h$ is an NTRU public key. Then $\{(1,h),(0,q)\}$ generates a lattice. ...
0
votes
0answers
13 views

Can Merkle signatures be leveraged for key exchange?

A Merkle signature scheme is post-quantum-suitable as it relies only on the security of a one-way function. However, this construction seems to only be capable of authentication, and not ...
0
votes
1answer
55 views

Theorem of the dual isogeny in SIDH Zk proof

In the proof of soundness for the SIDH ZK proof protocol (section 6.2 in DJP11) the authors refer to the "Theorem of the dual isogeny". What do they mean by this? In particular, I don't ...
1
vote
0answers
23 views

Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
3
votes
0answers
43 views

Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?

The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems ...
0
votes
0answers
32 views

Complete taxonomy of public-key cryptosystem primitives

This question is similar to “What primitives are needed to generically implement public-key cryptography?”, but with a more applied/contingent focus: That question asked about what's theoretically ...
1
vote
1answer
61 views

Security of the Goldreich–Goldwasser– Halevi (GGH) Scheme

There is a statement in the article of "Public-Key Cryptosystems from Lattice Reduction Problems" that presents GGH encryption scheme: "The cryptanalytic problem underlying our scheme ...
3
votes
1answer
94 views

Is the post-quantum scheme quantum-resistant without regard to QROM

There are many "post-quantum" schemes have been proposed. The security of most of them is only proven under random oracle model or uses forking lemma. As described by Boneh et al. (Random ...
0
votes
0answers
50 views

Is there a source(book, thesis, paper) that explains Lattice basis reduction algorithms (LLL, HKZ) and provides an in depth analysis of the same?

I want to give a slight background about me: I've Bachelors in Computer Engineering and I've been interested in Cryptography since my college days and have been following the field ever since. I'm ...
0
votes
2answers
36 views

LMS Security Proof Paper

Is there any LMS security proof besides the one mentioned in RFC 8554? Does LMS actually have a paper which describes a proof?
0
votes
1answer
31 views

XMSS MT for height 80

The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/...
0
votes
0answers
43 views

RTL solutions to Post quantum candidates

I am looking for RTL implementations of the PQC finalists for KEM (McEliece, Kyber, Saber and NTRU) Saber provides the following repository McEliece provides some code from their website, but as far ...
3
votes
1answer
99 views

What is the simplest post-quantum asymmetric cryptographic algorithm for key exchange?

This question has been burning in the back of my head for the past few days, and a quick Google search doesn't yield any usable results. As the title suggests: What is the easiest-to-understand post-...
0
votes
0answers
20 views

XMSS vs MSS (Motivation)

I was reading XMSS and I watched some of the presentations about it by Dr. Andreas Hülsing. But I cannot underdstand what is our motivation to use XMSS with 1 layer. Why is it better than MSS? I know ...
2
votes
1answer
95 views

Can a KEM shared secret be used directly as a symmetric key?

As an example, both Classic-McEliece and Kyber KEMs produce 32 byte shared secrets. How convenient since that's exactly the size I need for an AES-256 key! Is this safe to do? My question can be ...
3
votes
1answer
108 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
0
votes
0answers
34 views

Why is noise growth from relinearisation ignored in the FV crypto scheme?

I'm going through the FV scheme and SEAL and there are a couple of things I'm not understanding with respect to noise growth of relinearisation. On page 8 they say to choose T so that the noise ...
0
votes
1answer
58 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
0
votes
1answer
81 views

Error Correcting Codes Post Quantum Finalists

I have been looking into error-correcting codes in lattice, I am specifically hoping to find some information on hardware implementations for the NIST PQ PKE/KEM finalists (Saber, CRYSTALS-Kyber, NTRU)...
2
votes
3answers
142 views

Period finding for Quantum Computers

Shor's algorithm shows how a quantum computer (with sufficiently many qubits) can solve the factorization problem efficiently. Also the discrete logarithm problem can be solved efficiently with such a ...
3
votes
0answers
70 views

Coppersmith attack on NTRU and non-commutativity

In this paper, Coppersmith and Shamir used lattice reduction to attack NTRU. At the very end of the paper, they note that developing non-commutative variants of NTRU would be wise, in light of their ...
1
vote
0answers
47 views

How to compare two post quantum digital signature schemes in terms of latency?

I want to compare two digital signature schemes of different nature. One is Hash-based (Winternitz one time signature scheme) and the other is lattice-based (Dilithium Crystals). What about be an ...
1
vote
0answers
36 views

How to evaluate number of security bits of a signature scheme?

I am trying to evaluate the effective security levels that a digital signature scheme (namely post-quantum digital schemes like WOT-S (Winternitz one time signature scheme) and Dilithium Crystals). ...
3
votes
3answers
693 views

Why do Problems for Post-Quantum algorithms have to be NP-Hard?

The mathematical problems used for Post-Quantum Cryptography problems I came across, are NP-complete, e.g. Solving quadratic equations over finite fields short lattice vectors and close lattice ...
2
votes
1answer
56 views

Error Check in Lattice PQC

I am by no means an expert in the PQC field and am just trying to self teach myself about it. I was hoping to look into error correcting in lattice. I want learn about error or fault detection as it ...
3
votes
0answers
60 views

Openssl speed vs TLS speed with postquantum KEM

I'm studying the performance of postquantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl). I don't know why, but the KEM algorithms performance in TLS is 10 times slower ...
12
votes
2answers
2k views

Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term ...
1
vote
1answer
164 views

SVP algorithms and complexity

I took image from Simons Institute's presentation. Complexity classes of Approximate SVP problem according to approximation factors are given in the table. My question is, What is the meaning of blue ...
2
votes
0answers
60 views

How to associate a post-quantum public key with a pre-quantum one in blockchains?

As a layperson, I'm curious if a cryptocurrency could fork to a quantum-resistant algorithm without people losing access to their wallets. Is it possible to generate a quantum-resistant public key ...
1
vote
1answer
71 views

Expansion Factors

There seems to be a quantity, often denoted $\gamma$, such that the $l_2$ norm of a product of two polynomials can be written as the product of the norms, up to multiplication by $\gamma$. For ...
2
votes
0answers
46 views

Trade-offs for more parties in PICNIC multi-computation

In the PICNIC post-quantum signature scheme, a zero-knowledge proof of the secret key for a symmetric encryption is produced by implementing the encryption as a Yao garbled circuit of a three-party ...
1
vote
0answers
20 views

Non-causal private keys in PICNIC

I've been thinking about PICNIC, the tier 2 NIST post-quantum signature scheme. Leaving aside the innovative multi-party computation zero-knowledge proof structure, the private key is an $n$-bit key ...
2
votes
1answer
94 views

Understanding Unique-SVP and Kannan's Embedding

I am trying to understand the Kannan embedding technique. But I am confused about the formation of the B' and the finding of the short vector inside that basis. How does this basis matrix in the ...
0
votes
1answer
46 views

Leighton-Micali Hash-Based Signature key sizes

I am working with the RFC for Leighton-Micali Hash-Based Signatures: RFC-8554. The question is if I understood it correctly and my calculations of the key sizes are correct. Basically, LMS uses ...
1
vote
0answers
40 views

Implementing LMS

I already created my own version of the hash based signature scheme LMS, but my signing results do not match the test vectors provided in the RFC. I am not sure what I do wrong, thus I wanted to try ...
6
votes
2answers
212 views

LWE: Round a continuous Gaussian to a true Discrete Gaussian

Short version: how is it possible to round a continuous Gaussian into a true discrete Gaussian (usually denoted $\mathcal{D}_{\mathbb{Z},\alpha q}$)? The goal is to obtain a reduction from continuous ...
1
vote
1answer
72 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
0
votes
1answer
74 views

Soundness of Trevisan’s Extractor Against Quantum Side Information

I wonder how sound Trevisan's extractor can be against quantum side information. I checked many papers. And all of these papers were aiming to explain how sound Trevisan's Extractor is against quantum ...
0
votes
0answers
39 views

Is the NTRU Challenge still ongoing?

In 2016, security innovation released the NTRU challenge. I understand that NTRU is now patent free and it seems like most of the documents related to the NTRU challenge on security innovation's ...
1
vote
1answer
61 views

What is the NTRU parameter equivalent to security level 112, 128 and 192?

I came across this paper which mentions this table, which states that NTRU 347 is equivalent to 112 bit security level However, in this paper, Choosing parameters for NTRU mentions that NTRU-401 is ...
2
votes
1answer
29 views

Using XMSS with Blake2

Since XMSS only requires a 2nd preimage resistant hash function, is using Blake2 in XMSS possible? It is not in standard, but Blake2 seems to be faster than SHA256
0
votes
1answer
74 views

Implementation of Leighton-Micali Hash-Based Signatures

I am trying to follow the RFC instructions but am not sure if I understand it. In the RFC there are also some test cases given, although my implementation yields different results. Test Cases: https://...
2
votes
0answers
33 views

What is the extra defense that McEliece 6960119 and 6688128 have that 8192128 does not?

From https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf The 8192128 parameter set is bigger, but the ...
2
votes
1answer
101 views

Post quantum security of the BLAKE family

Is there any proof that BLAKE (including 2 and 3) is post-quantum secure? We know that as Merkle–Damgård (with proper padding) preserves collapse sha2 is post-quantum secure. I know that the sponge-...
0
votes
1answer
56 views

How secure is LMS?

LMS is a hash-based digital signature scheme. It is a standard alongside of XMSS, which has it's bit-security stated in the paper(about 200bit-security for standard parameters). LMS security ...
3
votes
1answer
87 views

What is the largest parameter broken for NTRU?

The original secure parameters for NTRU shown below are from the original HPS98 paper. This is vastly different from the current secure suggested parameters in the NIST PQC round 3 submission. ...
2
votes
1answer
92 views

How to encode and decode message into polynomial form on NTRU

This question is based on a previously asked question. How to make a message into a polynomial on NTRU encryption? I am tasked to implement NTRU with toy parameters such as $N=7$ or $N=11$ and I have ...
2
votes
2answers
126 views

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ...

1
2 3 4 5
10