Hot answers tagged

7 votes
Accepted

What are the public key and output sizes for the four remaining PQC KEM candidates?

Throughout this answer the following conventions are used: CT = Ciphertext or transmitted output of the encapsulation algorithm PK = Public key or transmitted output of the key generation algorithm ...
  • 44.8k
6 votes

Grover algorithm for public key cryptography - FrodoKEM

I am wondering if one can apply Grover algorithm on a key encapsulation mechanism in order to crack the shared key. Here's how Grover's algorithm works (simplified): you take a 'fitness' function (...
  • 134k
6 votes
Accepted

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times. ...
  • 134k
4 votes
Accepted

Using XOR to derive a data key for ECIES

As written, it makes an additional security assumption on the symmetric cipher; that the attacker can't flip bits in the key (and modify the ciphertext) to gain some advantage. That is likely true ...
  • 134k
4 votes

Key Exchange vs Key Encapsulation

Key exchange: I'll use ECC as an example. Alice and Bob generate ephemeral key pairs and sign their ephemeral public key with their static private key, and then send their signed ephemeral public key ...
  • 593
4 votes

Security of RSA-KEM against cube root attack

Q1: The random selection should be $\sqrt[3]{n}<m<n$ due to cube-root attack? Suppose $n$ is 2048 bits long. Then $\sqrt[3] n < 2^{700}$. If $m$ is uniformly distributed in $\{1, 2, \dots, ...
4 votes
Accepted

Can a KEM shared secret be used directly as a symmetric key?

The algorithms you mentioned use a secure hash function to derive this convenient 32-byte shared secret, but it is not necessarily true that all KEMs will do so. The answer to your three general ...
  • 13.8k
3 votes
Accepted

How does TLS with PQC use key encapsulation?

As there don't seem to be any PQC alternatives for Diffie-Hellman (DH / ECDH), DH must have been replaced by key encapsulation using an ephemeral key pair. I don't believe that is correct; a ...
  • 134k
3 votes
Accepted

Key transport vs key encapsulation?

Key encapsulation or key wrapping is the encryption of a key with another key. There may be a symmetric key or asymmetric key pair that encapsulates the key destined for transportation; this key can ...
  • 86.5k
3 votes
Accepted

Doing RSA-KEM with RSA-OAEP

If what you have is a machine that computes RSAES-OAEP and not a machine that computes $x \mapsto x^e \bmod n$, you don't really have the tools to do RSA-KEM. You're better off doing what you were ...
2 votes

Use RSA keys to derive AES key

With RSA-KEM,* the sender knows a modulus $n$ and a public exponent $e$, and the receiver knows the private exponent $d \equiv e^{-1} \pmod{\phi(n)}$. To send a message $m$, the sender picks $0 \leq ...
2 votes

How does TLS with PQC use key encapsulation?

CSIDH can serve as a drop-in replacement for the (EC)DH key-exchange protocol while maintaining security against quantum computer. Moreover, OQS modified openssl library to use the liboqs. The TLS was ...
  • 75
2 votes

Error Correcting Codes Post Quantum Finalists

I want to investigate ECC/fault detection in hardware (or more accurately their lattice counterparts), specifically with one of the NIST finalists. Does anyone have any insights into this sector of ...
  • 134k
1 vote

Mitigation of lattice-based KEM decryption failure possibility

If you wish to avoid decryption failures, it can be done (easily) by inflating parameters. This is to say that if you have certain settings where they must be avoided, this is easy to accomplish. At a ...
  • 8,742
1 vote

Evaluation criteria for NIST finalist candidates

In the initial call for submissions in section 4.A.6 Additional Security Properties, they do state: Another case where security and performance interact is resistance to side-channel attacks. Schemes ...
  • 12k
1 vote

What is the security strength of McEliece variants?

Further search at this Round 3 Official Comment Newsgroup - found here https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-...
  • 123
1 vote

Using XOR to derive a data key for ECIES

The remark of Conrado showed me that I could look at the XOR as a simple key wrapping operation, which is basically just another encryption. In that case it is clear that the scheme is secure for ...
  • 86.5k
1 vote

One time Key Encapsulation Mechanism?

In general you simply create a new symmetric secret key for each message. You wrap this using a trusted public key for the person holding the private key. In general you use KEM just because you don't ...
  • 86.5k
1 vote

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

It probably doesn't hurt to include the encapsulation as additional data for the AEAD, but there is no need. The generic KEM/DEM composition, \begin{align} &(C_0, k) \leftarrow \operatorname{...
1 vote
Accepted

RSA-KEM: minimal number of random bits

Theoretical concern. The standard security reduction of RSA-KEM to the RSA problem relies on the ability of the decryption oracle to handle most of the input space. If you don't feed all the bits ...

Only top scored, non community-wiki answers of a minimum length are eligible