Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with post-quantum-cryptography
Search options not deleted
user 11774
This tag refers to public-key algorithms based on problems that quantum computers can't solve efficiently. Existing algorithms such as RSA, Diffie-Hellman, and ECDSA are known to be breakable using Shor's algorithm on quantum computers. Symmetric-key algorithms generally don't fall under this category.
1
vote
Post-quantum X3DH
I don't know very much about X3DH specifically, but Ben Smith's recent preprint is about isogeny-based cryptography and mentions X3DH on page 2. Unfortunately, that may be all it does, since I don't s …
- 796
-2
votes
Why is the vector sampled from Gaussian or Subgaussian distribution in lattice-based cryptog...
You can't directly sample uniformly modulo a lattice unless you know what the lattice is. The Gaussian distribution can be sampled independently of knowledge of the lattice. This distinction is import …
- 796
8
votes
Accepted
SIKE: choice of n
I am the principal submitter for the SIKE proposal.
The reference implementation uses 24, 32, and 40 bytes respectively for SIKEp503, SIKEp751, and SIKEp964 respectively. The motivation for these val …
- 796
-3
votes
Accepted
Ring-LWE in other fields
Power of 2 is explained in ePrint 2012/235:
the results from [LPR10] do not directly imply that the above problem is hard based on the worstcase hardness of lattice problems, except in the one case w …
- 796
5
votes
Accepted
Why are computations (isogeny) in SIDH done in an extended prime field?
I am an inventor of SIDH. The computations take place in $\operatorname{GF}(p^2)$ just because all supersingular elliptic curves are defined over $\operatorname{GF}(p^2)$, up to isomorphism. It's just …
- 796
4
votes
SIDH: key agreement - why does it work?
I invented SIDH and can surely answer any technical questions about it. Proofs of $E_{ab} \cong E_{ba}$ are given in several places, though rarely in official Theorem / Proof form, because this result …
- 796
2
votes
Post-quantum alternative to ElGamal? (public key verifiability)
There is nothing quite meeting your requirements, especially if you require the ability to generate random valid public keys without knowing the corresponding private key. CSIDH (not a NIST candidate) …
- 796
4
votes
Accepted
SIDH cryptosystem question
I invented SIDH. $E_0[\ell_A^{e_A}]$ has cardinality $(\ell_A^{e_A})^2$. Each of $P_A$, $Q_A$, and $R$ has order $\ell_A^{e_A}$ and they all generate different subgroups. This is possible because $E_0 …
- 796
13
votes
Accepted
Discrete Gaussian Sampling role in Lattice-Based Crypto?
A Gaussian distribution satisfies the following desirable properties:
It can be implemented coordinate-wise: If $x_1, x_2, \ldots , x_n$ are each sampled from a one-variable Gaussian distribution, t …
- 796