7
votes
Accepted
What are the public key and output sizes for the four remaining PQC KEM candidates?
Throughout this answer the following conventions are used:
CT = Ciphertext or transmitted output of the encapsulation algorithm
PK = Public key or transmitted output of the key generation algorithm
...
- 45.7k
7
votes
Why did post-quantum key exchanges go extinct?
I do not see any post-quantum key exchange that creates a shared secret with the contributions of both parties, like in Diffie-Hellman.
Actually, in Kyber, the shared secret is a function of ...
- 145k
6
votes
Why did post-quantum key exchanges go extinct?
Principally because NIST did not make key exchanges a necessary part of the process. If we look at the NIST PQC FAQ "NIST provided APIs and security definitions for Public Key encryption, KEM, ...
- 21.9k
6
votes
Grover algorithm for public key cryptography - FrodoKEM
I am wondering if one can apply Grover algorithm on a key encapsulation mechanism in order to crack the shared key.
Here's how Grover's algorithm works (simplified): you take a 'fitness' function (...
- 145k
6
votes
Accepted
Differences between NewHope-CPA-KEM and NewHope-CCA-KEM
Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times.
...
- 145k
5
votes
Key Exchange vs Key Encapsulation
Key exchange: I'll use ECC as an example. Alice and Bob generate ephemeral key pairs and sign their ephemeral public key with their static private key, and then send their signed ephemeral public key ...
- 613
5
votes
Accepted
CRYSTALS-KYBER versus FrodoKEM, what makes each of them different than the other?
There are a few cosmetic differences but the principal difference is the matrix $A$ in the LWE problem. In Frodo it is consciously unstructured, but in Kyber it has some symmetry.
Specifically in both ...
- 21.9k
4
votes
Accepted
Using XOR to derive a data key for ECIES
As written, it makes an additional security assumption on the symmetric cipher; that the attacker can't flip bits in the key (and modify the ciphertext) to gain some advantage. That is likely true ...
- 145k
4
votes
Security of RSA-KEM against cube root attack
Q1: The random selection should be $\sqrt[3]{n}<m<n$ due to cube-root attack?
Suppose $n$ is 2048 bits long. Then $\sqrt[3] n < 2^{700}$. If $m$ is uniformly distributed in $\{1, 2, \dots, ...
- 47.9k
4
votes
Accepted
Can a KEM shared secret be used directly as a symmetric key?
The algorithms you mentioned use a secure hash function to derive this convenient 32-byte shared secret, but it is not necessarily true that all KEMs will do so. The answer to your three general ...
- 15.1k
3
votes
Error Correcting Codes Post Quantum Finalists
I want to investigate ECC/fault detection in hardware (or more accurately their lattice counterparts), specifically with one of the NIST finalists. Does anyone have any insights into this sector of ...
- 145k
3
votes
Accepted
How does TLS with PQC use key encapsulation?
As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair.
I don't believe that is correct; a ...
- 145k
3
votes
Accepted
Key transport vs key encapsulation?
Key encapsulation or key wrapping is the encryption of a key with another key. There may be a symmetric key or asymmetric key pair that encapsulates the key destined for transportation; this key can ...
- 91.9k
3
votes
Accepted
Doing RSA-KEM with RSA-OAEP
If what you have is a machine that computes RSAES-OAEP and not a machine that computes $x \mapsto x^e \bmod n$, you don't really have the tools to do RSA-KEM. You're better off doing what you were ...
- 47.9k
2
votes
Use RSA keys to derive AES key
With RSA-KEM,* the sender knows a modulus $n$ and a public exponent $e$, and the receiver knows the private exponent $d \equiv e^{-1} \pmod{\phi(n)}$. To send a message $m$, the sender picks $0 \leq ...
- 47.9k
2
votes
How does TLS with PQC use key encapsulation?
CSIDH can serve as a drop-in replacement for the (EC)DH key-exchange protocol while maintaining security against quantum computer.
Moreover, OQS modified openssl library to use the liboqs. The TLS was ...
- 95
2
votes
Accepted
Kyber-CCA-KEM - Deterministic implicit rejection
Let me assume that you want to use the following decapsulation algorithm:
On input $sk$ and $c$:
let $m' = \mathrm{Dec}(sk,c)$
if $m' = \bot$ or $\mathrm{Enc}(pk,m';G(m')) \neq c$, then return $H(sk,...
- 2,116
2
votes
Accepted
Does CCA security require rejection?
It's hard to say for certain whether "mauled ciphertexts are undetectable" in a KEM -- this is presumably a security property, so one would need a formal security definition and proof (and ...
- 12k
2
votes
Why did post-quantum key exchanges go extinct?
As others have mentioned, in lattice-based key exchange the derived secret is a function of contributions of both parties.
In fact, the standardized algorithms are very "diffie-hellman-like" ...
- 11.6k
2
votes
Accepted
Is it safe to derive Ed25519 and Kyber private keys from the same seed?
You can usually compress the key generation of a few primitives to the generation of a suitably long secret random seed. Then use a PRG to derive as many seeds as needed. Each resulting seed then ...
- 2,868
2
votes
What scheme is the best for combining two shared secrets?
As a rule of thumb, when you're combining two values, there's a risk if a simple relationship between the values can be observed in the combination. In your first two schemes, if ...
1
vote
What's the purpose of implicit rejection
From round-3 submission (downloadable from https://csrc.nist.gov/Projects/post-quantum-cryptography/selected-algorithms-2022 and https://pq-crystals.org/kyber/index.shtml):
This variant of the FO ...
- 9,001
1
vote
Accepted
Are RSA-KEM key exchange material cyphertexts indistinguishable from random noise?
The RSA function is a permutation from x to c=(x^e)%N. Assuming the plaintext integer x is ...
- 1,701
1
vote
Accepted
Two way key transport?
There is some security value insofar as in a one-pass scheme the encapsulator has to trust that the decapsulator has securely generated their public/private key pair. It's not clear how much ...
- 21.9k
1
vote
KEM security definition - IND-CCA vs IND-CCA2
Looking at the Wikipedia article, with IND-CCA you get access to the oracle only until the message c* arrives (this is a non-adaptive attack), while with IND-CCA2 you can access the oracle using ...
- 1,621
1
vote
Mitigation of lattice-based KEM decryption failure possibility
If you wish to avoid decryption failures, it can be done (easily) by inflating parameters.
This is to say that if you have certain settings where they must be avoided, this is easy to accomplish.
At a ...
- 11.6k
1
vote
Evaluation criteria for NIST finalist candidates
In the initial call for submissions in section 4.A.6 Additional Security Properties, they do state:
Another case where security and performance interact is resistance to side-channel attacks. Schemes ...
- 21.9k
1
vote
RTL solutions to Post quantum candidates
To answer your second question:
are there normally standards when it comes to implementation, or are they implemented how the user sees fit?
Implementers are given a great deal of flexibility; we ...
- 145k
1
vote
Using XOR to derive a data key for ECIES
The remark of Conrado showed me that I could look at the XOR as a simple key wrapping operation, which is basically just another encryption. In that case it is clear that the scheme is secure for ...
- 91.9k
1
vote
What is the security strength of McEliece variants?
Further search at this Round 3 Official Comment Newsgroup - found here
https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-...
- 123
Only top scored, non community-wiki answers of a minimum length are eligible