Questions tagged [post-quantum-cryptography]

Cryptography that will remain secure should large-scale quantum computing become feasible. Based on hard problems with no known polynomial-time quantum algorithm (e.g., Shor's algorithm).

Filter by
Sorted by
Tagged with
0
votes
1answer
35 views

XMSS MT for height 80

The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/...
0
votes
0answers
47 views

RTL solutions to Post quantum candidates

I am looking for RTL implementations of the PQC finalists for KEM (McEliece, Kyber, Saber and NTRU) Saber provides the following repository McEliece provides some code from their website, but as far ...
3
votes
1answer
105 views

What is the simplest post-quantum asymmetric cryptographic algorithm for key exchange?

This question has been burning in the back of my head for the past few days, and a quick Google search doesn't yield any usable results. As the title suggests: What is the easiest-to-understand post-...
0
votes
0answers
24 views

XMSS vs MSS (Motivation)

I was reading XMSS and I watched some of the presentations about it by Dr. Andreas Hülsing. But I cannot underdstand what is our motivation to use XMSS with 1 layer. Why is it better than MSS? I know ...
2
votes
1answer
114 views

Can a KEM shared secret be used directly as a symmetric key?

As an example, both Classic-McEliece and Kyber KEMs produce 32 byte shared secrets. How convenient since that's exactly the size I need for an AES-256 key! Is this safe to do? My question can be ...
4
votes
1answer
171 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
0
votes
0answers
44 views

Why is noise growth from relinearisation ignored in the FV crypto scheme?

I'm going through the FV scheme and SEAL and there are a couple of things I'm not understanding with respect to noise growth of relinearisation. On page 8 they say to choose T so that the noise ...
0
votes
1answer
58 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
0
votes
1answer
90 views

Error Correcting Codes Post Quantum Finalists

I have been looking into error-correcting codes in lattice, I am specifically hoping to find some information on hardware implementations for the NIST PQ PKE/KEM finalists (Saber, CRYSTALS-Kyber, NTRU)...
2
votes
3answers
152 views

Period finding for Quantum Computers

Shor's algorithm shows how a quantum computer (with sufficiently many qubits) can solve the factorization problem efficiently. Also the discrete logarithm problem can be solved efficiently with such a ...
3
votes
0answers
76 views

Coppersmith attack on NTRU and non-commutativity

In this paper, Coppersmith and Shamir used lattice reduction to attack NTRU. At the very end of the paper, they note that developing non-commutative variants of NTRU would be wise, in light of their ...
1
vote
0answers
50 views

How to compare two post quantum digital signature schemes in terms of latency?

I want to compare two digital signature schemes of different nature. One is Hash-based (Winternitz one time signature scheme) and the other is lattice-based (Dilithium Crystals). What about be an ...
1
vote
0answers
38 views

How to evaluate number of security bits of a signature scheme?

I am trying to evaluate the effective security levels that a digital signature scheme (namely post-quantum digital schemes like WOT-S (Winternitz one time signature scheme) and Dilithium Crystals). ...
3
votes
3answers
738 views

Why do Problems for Post-Quantum algorithms have to be NP-Hard?

The mathematical problems used for Post-Quantum Cryptography problems I came across, are NP-complete, e.g. Solving quadratic equations over finite fields short lattice vectors and close lattice ...
2
votes
1answer
61 views

Error Check in Lattice PQC

I am by no means an expert in the PQC field and am just trying to self teach myself about it. I was hoping to look into error correcting in lattice. I want learn about error or fault detection as it ...
3
votes
0answers
70 views

Openssl speed vs TLS speed with postquantum KEM

I'm studying the performance of postquantum KEM in TLS with the OQS (OQS is a project that integrate liboqs to openssl). I don't know why, but the KEM algorithms performance in TLS is 10 times slower ...
12
votes
2answers
2k views

Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term ...
1
vote
1answer
184 views

SVP algorithms and complexity

I took image from Simons Institute's presentation. Complexity classes of Approximate SVP problem according to approximation factors are given in the table. My question is, What is the meaning of blue ...
2
votes
0answers
61 views

How to associate a post-quantum public key with a pre-quantum one in blockchains?

As a layperson, I'm curious if a cryptocurrency could fork to a quantum-resistant algorithm without people losing access to their wallets. Is it possible to generate a quantum-resistant public key ...
1
vote
1answer
75 views

Expansion Factors

There seems to be a quantity, often denoted $\gamma$, such that the $l_2$ norm of a product of two polynomials can be written as the product of the norms, up to multiplication by $\gamma$. For ...
2
votes
0answers
50 views

Trade-offs for more parties in PICNIC multi-computation

In the PICNIC post-quantum signature scheme, a zero-knowledge proof of the secret key for a symmetric encryption is produced by implementing the encryption as a Yao garbled circuit of a three-party ...
1
vote
0answers
22 views

Non-causal private keys in PICNIC

I've been thinking about PICNIC, the tier 2 NIST post-quantum signature scheme. Leaving aside the innovative multi-party computation zero-knowledge proof structure, the private key is an $n$-bit key ...
2
votes
1answer
263 views

Understanding Unique-SVP and Kannan's Embedding

I am trying to understand the Kannan embedding technique. But I am confused about the formation of the B' and the finding of the short vector inside that basis. How does this basis matrix in the ...
0
votes
1answer
57 views

Leighton-Micali Hash-Based Signature key sizes

I am working with the RFC for Leighton-Micali Hash-Based Signatures: RFC-8554. The question is if I understood it correctly and my calculations of the key sizes are correct. Basically, LMS uses ...
1
vote
0answers
49 views

Implementing LMS

I already created my own version of the hash based signature scheme LMS, but my signing results do not match the test vectors provided in the RFC. I am not sure what I do wrong, thus I wanted to try ...
6
votes
2answers
289 views

LWE: Round a continuous Gaussian to a true Discrete Gaussian

Short version: how is it possible to round a continuous Gaussian into a true discrete Gaussian (usually denoted $\mathcal{D}_{\mathbb{Z},\alpha q}$)? The goal is to obtain a reduction from continuous ...
1
vote
1answer
83 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
0
votes
1answer
77 views

Soundness of Trevisan’s Extractor Against Quantum Side Information

I wonder how sound Trevisan's extractor can be against quantum side information. I checked many papers. And all of these papers were aiming to explain how sound Trevisan's Extractor is against quantum ...
0
votes
0answers
56 views

Is the NTRU Challenge still ongoing?

In 2016, security innovation released the NTRU challenge. I understand that NTRU is now patent free and it seems like most of the documents related to the NTRU challenge on security innovation's ...
1
vote
1answer
97 views

What is the NTRU parameter equivalent to security level 112, 128 and 192?

I came across this paper which mentions this table, which states that NTRU 347 is equivalent to 112 bit security level However, in this paper, Choosing parameters for NTRU mentions that NTRU-401 is ...
2
votes
1answer
42 views

Using XMSS with Blake2

Since XMSS only requires a 2nd preimage resistant hash function, is using Blake2 in XMSS possible? It is not in standard, but Blake2 seems to be faster than SHA256
0
votes
1answer
112 views

Implementation of Leighton-Micali Hash-Based Signatures

I am trying to follow the RFC instructions but am not sure if I understand it. In the RFC there are also some test cases given, although my implementation yields different results. Test Cases: https://...
2
votes
1answer
58 views

What is the extra defense that McEliece 6960119 and 6688128 have that 8192128 does not?

From https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf The 8192128 parameter set is bigger, but the ...
2
votes
1answer
174 views

Post quantum security of the BLAKE family

Is there any proof that BLAKE (including 2 and 3) is post-quantum secure? We know that as Merkle–Damgård (with proper padding) preserves collapse sha2 is post-quantum secure. I know that the sponge-...
1
vote
1answer
66 views

How secure is LMS?

LMS is a hash-based digital signature scheme. It is a standard alongside of XMSS, which has it's bit-security stated in the paper(about 200bit-security for standard parameters). LMS security ...
3
votes
1answer
92 views

What is the largest parameter broken for NTRU?

The original secure parameters for NTRU shown below are from the original HPS98 paper. This is vastly different from the current secure suggested parameters in the NIST PQC round 3 submission. ...
2
votes
1answer
150 views

How to encode and decode message into polynomial form on NTRU

This question is based on a previously asked question. How to make a message into a polynomial on NTRU encryption? I am tasked to implement NTRU with toy parameters such as $N=7$ or $N=11$ and I have ...
2
votes
2answers
158 views

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. However, since TLS 1.3 always performs ...
0
votes
1answer
55 views

Speeding up XMSS

To compute the XMSS Tree root, one needs to compute all the 2^h keys and hash them together. The higher the height of the tree, the more keys there are and the longer the KeyGen computation. The ...
1
vote
1answer
85 views

What is the security strength of McEliece variants?

Please help me understand the security strength of McEliece variants prepared for Round 3. I looked at the specifications - https://classic.mceliece.org/nist/mceliece-20201010.pdf - it doesn't have ...
1
vote
1answer
93 views

Meaning of Dilithium-1024x768 or Dilithium2

Can someone explain me the meaning of 1024 and 768 in Dilithium-1024x768 in the algorithm? And the meaning of 2 in Dilithium2 in the algorithm?
2
votes
1answer
36 views

XMSS - creation of authentication path

The reference uses treeHash algorithm everytime a signature is generated, thus generating authentication path AND the root, which is not necessary, as the root has only to be generated once. ...
0
votes
0answers
43 views

Authentication tag length and post-quantum security

The recommended hash length for post-quantum security seems to be either 384-bits or 512-bits. 512-bits gives 256-bit collision resistance, and 256-bit security is obviously ideal for post-quantum ...
0
votes
0answers
41 views

Performance comparison of SPHINCS+ and XMSS or LMS

Is there a comparison of the performance between SPHINCS+ and XMSS(MT) or LMS? I am aware of this paper that compares LMS and XMSS but nothing that compares either of them to SPHINCS+. I ask because I ...
2
votes
1answer
81 views

Computational LWE-Trapdoor without tag

In the paper Trapdoors for Lattices: Simpler, Tighter, Faster, Smaller, Micciancio and Peikert mention that it is possible to save an additive $n$ term in the dimension $\bar{m}$ in paragraph $\...
26
votes
7answers
5k views

Does Terra Quantum AG break AES and Hash Algorithms?

According to this Bloomberg article: A Swiss Company Says It Found Weakness That Imperils Encryption Terra Quantum AG has a team of about 80 quantum physicists, cryptographers and mathematicians, who ...
0
votes
0answers
42 views

GSW and homomorphic addition on integers

Is it possible to use the GSW scheme (Gentry, Sahai, Waters) also on integer values and not just single bits? If not, are there any schemes that support integer arithmetic with the same nice property ...
0
votes
0answers
46 views

GSW13 scheme and integer arithmetic

I'm new to lattice-based cryptography and have trouble understanding if the GSW13 (Gentry, Sahai, Waters) scheme works only on single bits. But is it also possible to encrypt integers with this scheme ...
1
vote
1answer
74 views

Algebraic Variants of NTRU

There are a large number of algebraic NTRU variants: for example, in some (such as ETRU), the underlying ring has been changed to the ring of integers of a certain number field; there is GR-NTRU, ...
1
vote
1answer
49 views

The mathematical similarity and difference between code-based PKE and multivariate DSS

In code-based public key encryption schemes, a public key is formed by matrix-multiplying 2 linear matrices to the left and right side of a easily decodeable error-correcting code, so that it'll be ...

1
2
3 4 5
11