Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

Filter by
Sorted by
Tagged with
-3
votes
0answers
18 views

Let f be psuedorandom permutation [closed]

Please solve this as soon as possible
1
vote
1answer
41 views

Why RLWE is hard or even has a solution?

I was thinking about why and how the RLWE problem is hard at all. I know that it's hard because it can be reduced to the shortest vector problem, but I'm thinking about how does it even have a ...
1
vote
1answer
82 views

Is it possible to create a Dilithium Prime or Falcon Prime?

In the NTRU Prime submission, principle author, the well-known DJB is adamant that [the] primary objective [of NTRU Prime] is to eliminate unnecessary complications in security review So much so, to ...
0
votes
0answers
16 views

How can I change the McEliece main parameters?

I use the Bouncy Castle Crypto API to implement McEliece in Java. I have also managed to encrypt and decrypt a message and it works without any problems. When I use the debugger, I see that the ...
2
votes
0answers
28 views

Basic explanation of Falcon and Dilithium

I've been trying to search for toy examples of the round 3 digital signatures Rainbow, Falcon and Dilithium. Not a lot of actual implementation examples are out there. What I'm searching for are ...
-1
votes
0answers
31 views

Relation between duals of q-ary lattices

For $A\in \mathbb{Z_q}^n$, consider the given two q-ary lattices: \begin{align} \Lambda_q^{\bot}{(A)} & = \{\mathbf{x} \in \mathbb{Z}^m: A\mathbf{x} = \mathbf{0}\text{ mod }q\} \\ \Lambda_q{(A)} &...
0
votes
0answers
52 views

Finding a basis for q-ary lattices

For $A\in \mathbb{Z_q}^{n\times m}$, where $m \geq n$, consider the given two q-ary lattices \begin{align} \Lambda_q^{\bot}{(A)} & = \{\mathbf{x} \in \mathbb{Z}^m: A\mathbf{x} = \mathbf{0}\text{ ...
1
vote
1answer
30 views

SIS vs LWE Problem

The Ajtai one way function is defined by $$f_A(x)= Ax \; mod\; q $$ where the x $\in \{0,1\}^m$ and A $\in \mathbb{Z_q}^{n \times m}$. $f_A(x)$ is one way function ( Ajtai 96) While the Regev One way ...
6
votes
1answer
67 views

CSIDH - l ideal generators

I am trying to study the CSIDH algorithm. I have some beginner background in elliptic curves and I have been following Andrew Sutherland's lectures (https://math.mit.edu/classes/18.783/2019/lectures....
0
votes
0answers
11 views

Bad padding in McEliece Java [migrated]

I am trying to implement the McEliece algorithm and I am having some troubles. When I try to decrypt a message, it shows an exception saying that the ciphertext is invalid. I am using BouncyCastle ...
1
vote
0answers
36 views

Combining Post-Quantum and Classical KEM

I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
0
votes
0answers
16 views

Crypto Economic Attacks such as Nothing At Stake and Sandwich Attack from Archive Nodes on Polkadot

Could you please advise me if there are threat vectors from archive nodes such as front running attacks, sandwich attacks and nothing at stake attacks as they are quite powerful in terms of the ...
0
votes
1answer
37 views

Why has ID-based PKC not been included in the NIST PQC competition?

Although there are several proposals of ID-based PKC based on lattices, multivariate cryptography, I want to know why identity (ID) based PKC is not included in the NIST post-quantum competition. Is ...
10
votes
1answer
1k views

Looking for the current status of the Chinese national cryptographic algorithm design competition

I'm trying to find the results of the Chinese national cryptographic algorithm design competition (which I believe is targeted towards postquantum algorithms); however I cannot find it. I did find ...
2
votes
1answer
42 views

Coding gain and minimum determinant in cryptography

In coding theory, the notions of coding gain and minimum determinant of a code have been defined as follows: let $\mathcal{X}$ be a (full diversity) code and $X,X^\prime\in\mathcal{X}$. Then the $\...
4
votes
1answer
140 views

How is a "quantum safe" algorithm fundamentally different from the current "secure" crypto algorithms (pre-quantum)?

I recently read that work is being done to develop "quantum safe" algorithms for encryption / hashing. Presumably, these will have fundamental differences from the current "non-quantum ...
1
vote
1answer
28 views

Kyber PKE correctness proof, how is triangle inequality used

Im reading the CRYSTALS kyber paper and am stuck on the PKE correctness proof on page 5. I can't see how the triangle inequality would help to get to the result $|| \lceil q / 2 \rfloor \cdot (m - m') ...
0
votes
0answers
62 views

Examples of post-quantum hash functions

We already know many examples of post-quantum cryptography for asymmetric, symmetric and digital signature algorithms, but is there any risk for hash functions to be attacked with quantum computers ...
0
votes
0answers
26 views

Checking whether a particular group has an efficient, faithful representation as a matrix group

There are cryptographic protocols being developed for non-abelian groups. For some protocols it is necessary to know whether the group has an efficient representation as a matrix group (say, a matrix ...
12
votes
1answer
555 views

Number of bit-operations required for information set decoding attacks on code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. This paper estimates the concrete number of bit ...
11
votes
0answers
447 views

Requirements for security against multi-target attacks, for McEliece and other code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. For these cryptosystems, it seems that an attacker ...
0
votes
0answers
45 views

Is my proof about uniqueness of ring-LWE secret correct?

Suppose that $n$ is a power of two, $q=3\pmod 8$, prime and $R=\mathbb{Z}[X]/(X^n+1)$. Denote $\Vert\cdot\Vert$ as the infinity norm in $R_q=R/qR$ on the coefficients of elements in $R_q$. The ...
3
votes
1answer
62 views

Making WOTS+ public keys shorter

In WOTS+ — as described in section 3 of RFC 8391 — public keys, private keys and signatures all consist of $len$ strings with $n$ bytes each, where $len, n \in \mathbb{N}$. Is it safe to use the hash ...
1
vote
1answer
50 views

Are my calculations about WOTS parameters correct?

I'm reading the WOTS+ paper, but I'm having some trouble with its notation and specially the involved units. For example, under my interpretation, the parameters ...
2
votes
1answer
49 views

How do I construct the Fn family of functions of WOTS+ using SHA3?

From the WOTS+ paper: Furthermore, W-OTS+ uses a family of functions Fn : {f_k : {0, 1}^n → {0, 1}^n | k ∈ Kn} with key space Kn. The reader might think of it as a cryptographic hash function family ...
3
votes
1answer
126 views

Is NOTS a valid one time signature scheme?

I've just learn about NOTS, a quantum-resistant signature scheme based on hash functions that claims to have much shorter signature and key sizes. Is this signature scheme known to be secure? From ...
0
votes
1answer
39 views

Why pre-shared key is not involved to key derivation in IKEv2?

In IKEv1 (RFC 2409), preshared secret is involved to key derivation where IKEv2 (RFC 7296) use it for only authentication. When we consider post-quantum security, this property makes IKEv1 suitable if ...
3
votes
1answer
30 views

SIDH: What if the two kernel generators are chosen in the same torsion group?

In SIDH, either party chooses its secret point $R_A = [m_A]P_A+[n_A]Q_A \in E[\ell_A^{e_A}]$, $R_B = [m_B]P_B+[n_B]Q_B \in E[\ell_B^{e_B}]$ from two different sets $E[\ell_A^{e_A}]$ and $E[\ell_B^{e_B}...
3
votes
1answer
80 views

Why define the dual of an ideal lattice with "Tr" rather than inner product?

In the paper [LPR12], I've learned that ideal lattices are ideals in algebraic number fields. However, I can't understand why we define the dual lattice of an ideal lattice with $\operatorname{Tr}$: $$...
1
vote
0answers
64 views

NTRU cryptosystem on complex numbers

Background I am interested in lattice-based cryptography. Recently I got familiar with the NTRU cryptosystem and found out that it can be extended onto hypercomplex numbers, like Quaternions (QTRU) or ...
0
votes
1answer
62 views

When is a PQ key-exchange algorithm suitable for use with long-term static keys?

I took a look at Cloudflare Circl because I'm curious which Post-Quantum algorithms are implemented in Go, which could be used to exchange a key. I read this comment that SIDH is only good for ...
0
votes
0answers
30 views

How does the public-key generation work in the multivariate post-quantum digital signature GeMMS?

There are a few steps in the public-key generation of GeMSS that I am trying to understand. The first is the below equations (1). What does "$\theta_i$ forms a basis for $\mathbb{F}_{2^n}$ over $\...
2
votes
1answer
60 views

Volume of an NTRU lattice

Let $K$ be a number field of degree $n$ and $\Lambda^q_h=\{(f,g)\in\mathcal{O}_K\text{ : }fh-g = 0\bmod q\mathcal{O}_K\}$, where $h$ is an NTRU public key. Then $\{(1,h),(0,q)\}$ generates a lattice. ...
0
votes
0answers
17 views

Can Merkle signatures be leveraged for key exchange?

A Merkle signature scheme is post-quantum-suitable as it relies only on the security of a one-way function. However, this construction seems to only be capable of authentication, and not ...
0
votes
1answer
67 views

Theorem of the dual isogeny in SIDH Zk proof

In the proof of soundness for the SIDH ZK proof protocol (section 6.2 in DJP11) the authors refer to the "Theorem of the dual isogeny". What do they mean by this? In particular, I don't ...
1
vote
0answers
30 views

Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
3
votes
0answers
66 views

Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?

The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems ...
0
votes
0answers
35 views

Complete taxonomy of public-key cryptosystem primitives

This question is similar to “What primitives are needed to generically implement public-key cryptography?”, but with a more applied/contingent focus: That question asked about what's theoretically ...
1
vote
1answer
76 views

Security of the Goldreich–Goldwasser– Halevi (GGH) Scheme

There is a statement in the article of "Public-Key Cryptosystems from Lattice Reduction Problems" that presents GGH encryption scheme: "The cryptanalytic problem underlying our scheme ...
3
votes
1answer
113 views

Is the post-quantum scheme quantum-resistant without regard to QROM

There are many "post-quantum" schemes have been proposed. The security of most of them is only proven under random oracle model or uses forking lemma. As described by Boneh et al. (Random ...
3
votes
0answers
90 views

Is there a source(book, thesis, paper) that explains Lattice basis reduction algorithms (LLL, HKZ) and provides an in depth analysis of the same?

I want to give a slight background about me: I've Bachelors in Computer Engineering and I've been interested in Cryptography since my college days and have been following the field ever since. I'm ...
0
votes
2answers
36 views

LMS Security Proof Paper

Is there any LMS security proof besides the one mentioned in RFC 8554? Does LMS actually have a paper which describes a proof?
0
votes
1answer
34 views

XMSS MT for height 80

The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/...
0
votes
0answers
47 views

RTL solutions to Post quantum candidates

I am looking for RTL implementations of the PQC finalists for KEM (McEliece, Kyber, Saber and NTRU) Saber provides the following repository McEliece provides some code from their website, but as far ...
3
votes
1answer
105 views

What is the simplest post-quantum asymmetric cryptographic algorithm for key exchange?

This question has been burning in the back of my head for the past few days, and a quick Google search doesn't yield any usable results. As the title suggests: What is the easiest-to-understand post-...
0
votes
0answers
23 views

XMSS vs MSS (Motivation)

I was reading XMSS and I watched some of the presentations about it by Dr. Andreas Hülsing. But I cannot underdstand what is our motivation to use XMSS with 1 layer. Why is it better than MSS? I know ...
2
votes
1answer
110 views

Can a KEM shared secret be used directly as a symmetric key?

As an example, both Classic-McEliece and Kyber KEMs produce 32 byte shared secrets. How convenient since that's exactly the size I need for an AES-256 key! Is this safe to do? My question can be ...
3
votes
1answer
158 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
0
votes
0answers
37 views

Why is noise growth from relinearisation ignored in the FV crypto scheme?

I'm going through the FV scheme and SEAL and there are a couple of things I'm not understanding with respect to noise growth of relinearisation. On page 8 they say to choose T so that the noise ...
0
votes
1answer
58 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...

1
2 3 4 5
11