12
votes
Accepted
Converting NewHope/LWE key exchange to a Diffe-Hellman-like algorithm
It has been folklore (since at least 2010) that you can do what you propose, but less efficiently than the "key transport" method of any Ring-LWE based encryption scheme or KEM.
So here is what you ...
- 1,126
11
votes
NewHope and NIST's Post-quantum standardization
From Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process
3.12 NewHope
NewHope is a KEM based on the presumed hardness of the RLWE problem. At its core is ...
- 46k
11
votes
Accepted
Number of LWE samples in NewHope
They're actually sampling $5n$ elements from $\Psi_{16}$. Perhaps Protocol 2 on page 5 shows this most clearly, where $\textbf{s}, \textbf{e} \stackrel{\$}{\leftarrow} \Psi_{16}^n$ and $\textbf{s}', \...
- 226
8
votes
Accepted
NTRU Backdoor and NewHope TLS Protocol
My name is Zhenfei Zhang. I work for Security Innovation Inc., which acquired NTRU Inc. in 2010.
The R-LWE based key exchange [1] uses a public matrix $a$ which may be manipulated.
For instance, if $a$...
- 681
6
votes
Accepted
Differences between NewHope-CPA-KEM and NewHope-CCA-KEM
Well, it turns out that a straight-forward implementation of LWE key exchanges is vulnerable to chosen ciphertext attacks, in the case that one side reuses the same private value $a$ multiple times.
...
- 140k
4
votes
Is the "New Hope" Lattice Key Exchange vulnerable to a lattice analog of the Bernstein BADA55 Attack?
Yes the Bernstein attack is applicable but the impact of the attack is reduced because the party generating the parameter is also going to be a legitimate participant of the key exchange.
Here is ...
- 199
1
vote
Module LWE with an even modulus
Yes. Learning with Rounding (LWR) is a special case of LWE, where the errors are introduced deterministically by scaling and rounding operations. If you had an algorithm that could solve LWE, the same ...
- 166
1
vote
Accepted
CECPQ1 key exchange functionality
Your understanding is correct. They experimented NewHope RLWE key exchange while maintaining X25519 as backup, in case there is something wrong with NewHope. By combining two key exchange algorithms, ...
- 370
1
vote
What is the purpose of adding secondary error to calculated key in BCNS and NewHope protocols
If $e''$ isn't there, then $v=bs'$ in both protocols, which means it would be easy to recover $s'$ given $v$ and $b$. Since $b$ is sent in the clear over the channel, and a (randomized) function of $v$...
- 343
Only top scored, non community-wiki answers of a minimum length are eligible