Hot answers tagged

6

Throughout this answer the following conventions are used: CT = Ciphertext or transmitted output of the encapsulation algorithm PK = Public key or transmitted output of the key generation algorithm Cat 1 / 3 / 5 = NIST security categories with the following specification: Any attack that breaks the relevant security definition must require ...


6

I am wondering if one can apply Grover algorithm on a key encapsulation mechanism in order to crack the shared key. Here's how Grover's algorithm works (simplified): you take a 'fitness' function (that takes a guess at the value you're searching for and evaluates to a '1' if the guess is correct and '0' if it is not - for AES, the fitness function might be '...


6

Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times. In this straight-forward implementation, Alice generates a private vector $a$, and sends his key share $a M + \epsilon$. Then, when Bob receives this key share,...


4

Q1: The random selection should be $\sqrt[3]{n}<m<n$ due to cube-root attack? Suppose $n$ is 2048 bits long. Then $\sqrt[3] n < 2^{700}$. If $m$ is uniformly distributed in $\{1, 2, \dots, n - 1, n\}$, what is $\Pr[m < \sqrt[3] n]$? Is this probability large enough that you have to worry about it? Now at the end the document it says; ...


4

As written, it makes an additional security assumption on the symmetric cipher; that the attacker can't flip bits in the key (and modify the ciphertext) to gain some advantage. That is likely true for most ciphers we would use in practice, but is nevertheless an additional assumption. This is not difficult to fix; we don't select a random symmetric key $K_d$...


3

The algorithms you mentioned use a secure hash function to derive this convenient 32-byte shared secret, but it is not necessarily true that all KEMs will do so. The answer to your three general questions would thus be all "it depends on the actual algorithm". In general, they use KDFs. The Kyber KEM submission, for example, uses SHAKE-256: As a ...


3

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. I don't believe that is correct; a postquantum Key Encapsulation Method (KEM) would appear to be the natural replacement for DH/ECDH within TLS. In the KEM, one side (the client) produces a KEM public ...


3

Key encapsulation or key wrapping is the encryption of a key with another key. There may be a symmetric key or asymmetric key pair that encapsulates the key destined for transportation; this key can then be called a key transport key. Key transportation is simply the secure transportation of a key. For public keys you'd expect integrity and authenticity - ...


3

If what you have is a machine that computes RSAES-OAEP and not a machine that computes $x \mapsto x^e \bmod n$, you don't really have the tools to do RSA-KEM. You're better off doing what you were doing in the first place—unless I can talk you out of going near the incoherent minefield of hysterical raisins without meaningful guidance that is the WebCrypto ...


2

Key exchange: I'll use ECC as an example. Alice and Bob generate ephemeral key pairs and sign their ephemeral public key with their static private key, and then send their signed ephemeral public key to each other. Both parties receive the others signed ephemeral public key and verify it using the others static public key, stored by a CA or in a PKI. Now ...


2

With RSA-KEM,* the sender knows a modulus $n$ and a public exponent $e$, and the receiver knows the private exponent $d \equiv e^{-1} \pmod{\phi(n)}$. To send a message $m$, the sender picks $0 \leq x < n$ uniformly at random, derives $k = H(x)$ for some hash function $H$, computes $y = x^e \bmod n$, and transmits $y$ alongside the authenticated ...


2

CSIDH can serve as a drop-in replacement for the (EC)DH key-exchange protocol while maintaining security against quantum computer. Moreover, OQS modified openssl library to use the liboqs. The TLS was modified not following the standards, as you said.


2

I want to investigate ECC/fault detection in hardware (or more accurately their lattice counterparts), specifically with one of the NIST finalists. Does anyone have any insights into this sector of Lattice Cryptography? Actually, none on the NIST Lattice finalists (Kyber, NTRU, Saber) use error correction; for that matter, neither do the NIST Lattice ...


1

In the initial call for submissions in section 4.A.6 Additional Security Properties, they do state: Another case where security and performance interact is resistance to side-channel attacks. Schemes that can be made resistant to side-channel attack at minimal cost are more desirable than those whose performance is severely hampered by any attempt to resist ...


1

Further search at this Round 3 Official Comment Newsgroup - found here https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/EiwxGnfQgec?pli=1 OP (Kirk Fleming) sets up these estimates mceliece-3488-064 143 ...


1

The remark of Conrado showed me that I could look at the XOR as a simple key wrapping operation, which is basically just another encryption. In that case it is clear that the scheme is secure for confidentiality; it just adds another layer of encryption. Of course, encryption by itself doesn't offer integrity / authenticity. ECIES cannot offer authenticity ...


1

In general you simply create a new symmetric secret key for each message. You wrap this using a trusted public key for the person holding the private key. In general you use KEM just because you don't want to encrypt/decrypt the entire message with the asymmetric key pair. Using a hybrid cryptosystem is much more efficient. If you need to create a transport ...


1

It probably doesn't hurt to include the encapsulation as additional data for the AEAD, but there is no need. The generic KEM/DEM composition, \begin{align} &(C_0, k) \leftarrow \operatorname{KEM}_{\mathit{pk}}() \\ &C_1 \leftarrow \operatorname{DEM}_k(M) \\ &\operatorname{return} C_0\mathbin\|C_1, \end{align} provides adequate security ...


1

Theoretical concern. The standard security reduction of RSA-KEM to the RSA problem relies on the ability of the decryption oracle to handle most of the input space. If you don't feed all the bits into the KDF, or if you treat some inputs equivalently, you may shoot yourself in the foot, like failure to verify lHash in OAEP. Practical concern. If you don't ...


Only top voted, non community-wiki answers of a minimum length are eligible