# Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

521 questions
Filter by
Sorted by
Tagged with
18 views

### Let f be psuedorandom permutation [closed]

Please solve this as soon as possible
41 views

### Why RLWE is hard or even has a solution?

I was thinking about why and how the RLWE problem is hard at all. I know that it's hard because it can be reduced to the shortest vector problem, but I'm thinking about how does it even have a ...
82 views

### Is it possible to create a Dilithium Prime or Falcon Prime?

In the NTRU Prime submission, principle author, the well-known DJB is adamant that [the] primary objective [of NTRU Prime] is to eliminate unnecessary complications in security review So much so, to ...
16 views

### How can I change the McEliece main parameters?

I use the Bouncy Castle Crypto API to implement McEliece in Java. I have also managed to encrypt and decrypt a message and it works without any problems. When I use the debugger, I see that the ...
28 views

### Basic explanation of Falcon and Dilithium

I've been trying to search for toy examples of the round 3 digital signatures Rainbow, Falcon and Dilithium. Not a lot of actual implementation examples are out there. What I'm searching for are ...
31 views

### Relation between duals of q-ary lattices

For $A\in \mathbb{Z_q}^n$, consider the given two q-ary lattices: \begin{align} \Lambda_q^{\bot}{(A)} & = \{\mathbf{x} \in \mathbb{Z}^m: A\mathbf{x} = \mathbf{0}\text{ mod }q\} \\ \Lambda_q{(A)} &...
52 views

### Finding a basis for q-ary lattices

For $A\in \mathbb{Z_q}^{n\times m}$, where $m \geq n$, consider the given two q-ary lattices \begin{align} \Lambda_q^{\bot}{(A)} & = \{\mathbf{x} \in \mathbb{Z}^m: A\mathbf{x} = \mathbf{0}\text{ ...
30 views

### SIS vs LWE Problem

The Ajtai one way function is defined by $$f_A(x)= Ax \; mod\; q$$ where the x $\in \{0,1\}^m$ and A $\in \mathbb{Z_q}^{n \times m}$. $f_A(x)$ is one way function ( Ajtai 96) While the Regev One way ...
67 views

### CSIDH - l ideal generators

I am trying to study the CSIDH algorithm. I have some beginner background in elliptic curves and I have been following Andrew Sutherland's lectures (https://math.mit.edu/classes/18.783/2019/lectures....
11 views

I am trying to implement the McEliece algorithm and I am having some troubles. When I try to decrypt a message, it shows an exception saying that the ciphertext is invalid. I am using BouncyCastle ...
36 views

### Combining Post-Quantum and Classical KEM

I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
16 views

### Crypto Economic Attacks such as Nothing At Stake and Sandwich Attack from Archive Nodes on Polkadot

Could you please advise me if there are threat vectors from archive nodes such as front running attacks, sandwich attacks and nothing at stake attacks as they are quite powerful in terms of the ...
37 views

### Why has ID-based PKC not been included in the NIST PQC competition?

Although there are several proposals of ID-based PKC based on lattices, multivariate cryptography, I want to know why identity (ID) based PKC is not included in the NIST post-quantum competition. Is ...
1k views

### Looking for the current status of the Chinese national cryptographic algorithm design competition

I'm trying to find the results of the Chinese national cryptographic algorithm design competition (which I believe is targeted towards postquantum algorithms); however I cannot find it. I did find ...
42 views

62 views

### Examples of post-quantum hash functions

We already know many examples of post-quantum cryptography for asymmetric, symmetric and digital signature algorithms, but is there any risk for hash functions to be attacked with quantum computers ...
26 views

### Checking whether a particular group has an efficient, faithful representation as a matrix group

There are cryptographic protocols being developed for non-abelian groups. For some protocols it is necessary to know whether the group has an efficient representation as a matrix group (say, a matrix ...
555 views

### Number of bit-operations required for information set decoding attacks on code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. This paper estimates the concrete number of bit ...
447 views

### Requirements for security against multi-target attacks, for McEliece and other code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. For these cryptosystems, it seems that an attacker ...
45 views

### Is my proof about uniqueness of ring-LWE secret correct?

Suppose that $n$ is a power of two, $q=3\pmod 8$, prime and $R=\mathbb{Z}[X]/(X^n+1)$. Denote $\Vert\cdot\Vert$ as the infinity norm in $R_q=R/qR$ on the coefficients of elements in $R_q$. The ...
62 views

### Making WOTS+ public keys shorter

In WOTS+ — as described in section 3 of RFC 8391 — public keys, private keys and signatures all consist of $len$ strings with $n$ bytes each, where $len, n \in \mathbb{N}$. Is it safe to use the hash ...
50 views

### Are my calculations about WOTS parameters correct?

I'm reading the WOTS+ paper, but I'm having some trouble with its notation and specially the involved units. For example, under my interpretation, the parameters ...
49 views

### How do I construct the Fn family of functions of WOTS+ using SHA3?

From the WOTS+ paper: Furthermore, W-OTS+ uses a family of functions Fn : {f_k : {0, 1}^n → {0, 1}^n | k ∈ Kn} with key space Kn. The reader might think of it as a cryptographic hash function family ...
126 views

### Is NOTS a valid one time signature scheme?

I've just learn about NOTS, a quantum-resistant signature scheme based on hash functions that claims to have much shorter signature and key sizes. Is this signature scheme known to be secure? From ...
39 views

### Why pre-shared key is not involved to key derivation in IKEv2?

In IKEv1 (RFC 2409), preshared secret is involved to key derivation where IKEv2 (RFC 7296) use it for only authentication. When we consider post-quantum security, this property makes IKEv1 suitable if ...
30 views

60 views

### Volume of an NTRU lattice

Let $K$ be a number field of degree $n$ and $\Lambda^q_h=\{(f,g)\in\mathcal{O}_K\text{ : }fh-g = 0\bmod q\mathcal{O}_K\}$, where $h$ is an NTRU public key. Then $\{(1,h),(0,q)\}$ generates a lattice. ...
17 views

### Can Merkle signatures be leveraged for key exchange?

A Merkle signature scheme is post-quantum-suitable as it relies only on the security of a one-way function. However, this construction seems to only be capable of authentication, and not ...
67 views

### Theorem of the dual isogeny in SIDH Zk proof

In the proof of soundness for the SIDH ZK proof protocol (section 6.2 in DJP11) the authors refer to the "Theorem of the dual isogeny". What do they mean by this? In particular, I don't ...
30 views

### Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
66 views

### Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?

The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems ...
35 views

### Complete taxonomy of public-key cryptosystem primitives

This question is similar to “What primitives are needed to generically implement public-key cryptography?”, but with a more applied/contingent focus: That question asked about what's theoretically ...
76 views

### Security of the Goldreich–Goldwasser– Halevi (GGH) Scheme

There is a statement in the article of "Public-Key Cryptosystems from Lattice Reduction Problems" that presents GGH encryption scheme: "The cryptanalytic problem underlying our scheme ...
113 views

### Is the post-quantum scheme quantum-resistant without regard to QROM

There are many "post-quantum" schemes have been proposed. The security of most of them is only proven under random oracle model or uses forking lemma. As described by Boneh et al. (Random ...
90 views

### Is there a source(book, thesis, paper) that explains Lattice basis reduction algorithms (LLL, HKZ) and provides an in depth analysis of the same?

I want to give a slight background about me: I've Bachelors in Computer Engineering and I've been interested in Cryptography since my college days and have been following the field ever since. I'm ...
36 views

### LMS Security Proof Paper

Is there any LMS security proof besides the one mentioned in RFC 8554? Does LMS actually have a paper which describes a proof?
34 views

### XMSS MT for height 80

The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/...
47 views

### RTL solutions to Post quantum candidates

I am looking for RTL implementations of the PQC finalists for KEM (McEliece, Kyber, Saber and NTRU) Saber provides the following repository McEliece provides some code from their website, but as far ...
105 views

### What is the simplest post-quantum asymmetric cryptographic algorithm for key exchange?

This question has been burning in the back of my head for the past few days, and a quick Google search doesn't yield any usable results. As the title suggests: What is the easiest-to-understand post-...
23 views

### XMSS vs MSS (Motivation)

I was reading XMSS and I watched some of the presentations about it by Dr. Andreas Hülsing. But I cannot underdstand what is our motivation to use XMSS with 1 layer. Why is it better than MSS? I know ...
110 views

### Can a KEM shared secret be used directly as a symmetric key?

As an example, both Classic-McEliece and Kyber KEMs produce 32 byte shared secrets. How convenient since that's exactly the size I need for an AES-256 key! Is this safe to do? My question can be ...
158 views

### Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...