Hot answers tagged

12 votes

Converting NewHope/LWE key exchange to a Diffe-Hellman-like algorithm

It has been folklore (since at least 2010) that you can do what you propose, but less efficiently than the "key transport" method of any Ring-LWE based encryption scheme or KEM. So here is what you ...
Vadim L.'s user avatar
  • 1,126
11 votes

NewHope and NIST's Post-quantum standardization

From Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process 3.12 NewHope NewHope is a KEM based on the presumed hardness of the RLWE problem. At its core is ...
kelalaka's user avatar
  • 46k
11 votes

Number of LWE samples in NewHope

They're actually sampling $5n$ elements from $\Psi_{16}$. Perhaps Protocol 2 on page 5 shows this most clearly, where $\textbf{s}, \textbf{e} \stackrel{\$}{\leftarrow} \Psi_{16}^n$ and $\textbf{s}', \...
Joost's user avatar
  • 226
8 votes

NTRU Backdoor and NewHope TLS Protocol

My name is Zhenfei Zhang. I work for Security Innovation Inc., which acquired NTRU Inc. in 2010. The R-LWE based key exchange [1] uses a public matrix $a$ which may be manipulated. For instance, if $a$...
zhenfei zhang's user avatar
6 votes

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times. ...
poncho's user avatar
  • 140k
4 votes

Is the "New Hope" Lattice Key Exchange vulnerable to a lattice analog of the Bernstein BADA55 Attack?

Yes the Bernstein attack is applicable but the impact of the attack is reduced because the party generating the parameter is also going to be a legitimate participant of the key exchange. Here is ...
luiz carvalho's user avatar
1 vote

Module LWE with an even modulus

Yes. Learning with Rounding (LWR) is a special case of LWE, where the errors are introduced deterministically by scaling and rounding operations. If you had an algorithm that could solve LWE, the same ...
Andrea's user avatar
  • 166
1 vote

CECPQ1 key exchange functionality

Your understanding is correct. They experimented NewHope RLWE key exchange while maintaining X25519 as backup, in case there is something wrong with NewHope. By combining two key exchange algorithms, ...
9f241e21's user avatar
  • 370
1 vote

What is the purpose of adding secondary error to calculated key in BCNS and NewHope protocols

If $e''$ isn't there, then $v=bs'$ in both protocols, which means it would be easy to recover $s'$ given $v$ and $b$. Since $b$ is sent in the clear over the channel, and a (randomized) function of $v$...
TMM's user avatar
  • 343

Only top scored, non community-wiki answers of a minimum length are eligible