44 votes
Accepted

Are cryptographic hash functions quantum secure?

It is a bit dubious to claim that hash functions "are not based on any hard problem": inverting a standard hash function, or finding a collision, is itself a very hard problem. The point of ...
user avatar
44 votes
Accepted

Does Terra Quantum AG break AES and Hash Algorithms?

The onus is on the company to prove their claims, especially when they are extreme. There is also no financial motivation to not prove their claims. I can understand if they say that they want to keep ...
user avatar
23 votes

Which elliptic curves are quantum resistant?

Post-quantum crypto is a very young field and is still changing quite rapidly. If you just want a reading list to introduce you to the topics, I would recommend the March 2015 report released by the ...
user avatar
23 votes
Accepted

Are hash functions strong against quantum cryptanalysis and/or independent enough of mathematics?

This depends on what kind of hash function you mean and what kind of security you want. Poly1305 is an almost-universal hash family, which, when used with a uniform random key for a single message, ...
user avatar
22 votes

Why are only lattice problems used in cryptography?

What makes a problem suitable for cryptography is slightly different than what makes a problem NP-hard. What is required for cryptography is average-case hardness --- i.e., a randomly selected ...
user avatar
  • 4,463
20 votes

Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

Is there any functional difference on how this process is conducted? One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and ...
user avatar
  • 131k
19 votes
Accepted

How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?

How many qubits are required for breaking RSA 2048 and RSA 4096 in real-time with a quantum computer? Like the answer you linked to shows, about $\log_2(N^2) = 2 \log_2(N)$ or just $2n$ where $n$ ...
user avatar
  • 31.2k
19 votes
Accepted

New quantum attack on lattices (or Shor strikes again)?

As mentioned in the comments, there is a serious flaw in the paper, and it has been withdrawn: see https://groups.google.com/forum/#!msg/cryptanalytic-algorithms/WNMuTfJuSRc/OtQMLRXgBwAJ and part (3) ...
user avatar
19 votes
Accepted

Is lattice-based cryptography practical?

Yes, it is feasible. In fact, the NIST post-quantum submissions include a number of lattice-based cryptographic key exchange and signature protocols. As you can see from a summary of the different ...
user avatar
  • 12.9k
17 votes

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

With a 1024 qubit quantum computer you cannot break any of the algorithm you mentioned. Current estimations for an impelmentation of Grover's algorithm for AES requires much more qubits. According to ...
user avatar
  • 6,309
16 votes

New quantum attack on lattices (or Shor strikes again)?

The authors themselves point out that this doesn't break lattice-based assumptions used in crypto. To quote: Lattice problems have received enormous attention in recent years, mainly because of ...
user avatar
15 votes

New quantum attack on lattices (or Shor strikes again)?

Unless I misunderstood the definitions, an algorithm for the problem in Definition 1 (i.e. their main result) is in fact enough to attack decision-LWE if the noise is small. The fact that they need a ...
user avatar
  • 1,126
15 votes

Does Terra Quantum AG break AES and Hash Algorithms?

Edit 2021-02-10: covering now their latest press release Red flags While the details of their work/claims are yet to be published, this article is containing a lot of conspicuous statements. Vinokur ...
user avatar
  • 7,163
14 votes
Accepted

Are post-quantum cryptographic ciphers *also* secure if the P=NP conjecture holds true?

Do the post-quantum ciphers also automag/tically address the 1st problem? Not really, however to explore that in any detail, we need to explore what the 1st problem is. If $P=NP$ is proven true, ...
user avatar
  • 131k
14 votes
Accepted

Why is pqRSA in the NIST PQC submissions?

[source of information: my interpretation of multiple hallway chats I've had with DJB and Tanja Lange at conferences] The actual NIST PQC submission was for two reasons: A joke. Evidence1: DJB ...
user avatar
14 votes
Accepted

Is this variant of Diffie-Hellman viable and quantum resilient?

Is this actually a viable method of key exchange? No. An eavesdropper can find the integer $b$ chosen by Bob from $x$ (as sent by Alice) and $b'$ (as sent by Bob), and the equation $b'\,=\,b\,x\bmod ...
user avatar
  • 122k
14 votes

Current Consensus on Security of Lattice Based Cryptography?

The claimed attack does not "break" lattice-based cryptography, merely further improves known attacks. I'll try to briefly describe the situation. Asymptotics: Asymptotically, our best ...
user avatar
  • 8,394
13 votes

How will Cryptography be changed by Quantum Computing?

Current symmetric cryptography and hashes are actually believed to be reasonably secure against quantum computing. Quantum computers solve some problems much faster than the best known classical ...
user avatar
  • 3,547
13 votes

Which elliptic curves are quantum resistant?

What we traditionally call Elliptic Curve Cryptography (working in the group of points on an elliptic curve over a finite field) is vulnerable to an attack by a quantum computer running Shor's ...
user avatar
13 votes
Accepted

Post Quantum Symmetric Cryptography

AES-256 is still considered the strongest (and is considered secure) as related key attacks are not particular to analysis with quantum computers. Related key attacks could happen when AES is used ...
user avatar
  • 84.5k
12 votes

Is braid-based cryptography proven insecure when looking towards post-quantum cryptography?

I believe that the conjugacy search problem is broken by probabilistic attacks (see chapter 7). I am not sure if this completely ends braid cryptography, however, since there are other difficult ...
user avatar
12 votes
Accepted

What are the characteristics of a quantum secure protocol?

Quantum computers don't attack the protocol, they attack the cryptographic primitives used in the protocol. You need to avoid primitives that can be broken by quantum computers. Quantum computers don'...
user avatar
12 votes
Accepted

Are there any applications of Quantum Computation to Cryptography? (besides Cryptanalysis)

As noted by kodlu, you are basically asking about the existence of the whole field of quantum cryptography (which is different from post-quantum cryptography). All the field was arguably started by ...
user avatar
12 votes
Accepted

Converting NewHope/LWE key exchange to a Diffe-Hellman-like algorithm

It has been folklore (since at least 2010) that you can do what you propose, but less efficiently than the "key transport" method of any Ring-LWE based encryption scheme or KEM. So here is what you ...
user avatar
  • 1,126
12 votes
Accepted

WOTS+: Why does it XOR before running data through the hash function?

It allows the security of the construction to be reduced to second-preimage-resistance, rather than collision-resistance. This is a significant distinction, since brute force against collision-...
user avatar
  • 10.6k
12 votes
Accepted

After Google's breakthrough: When will quantum computers break today's encryption?

Since I'm not a cryptographer, I wanted to ask when quantum computers will be able to break the crypto algorithms used today and whether this breakthrough has significantly changed the predictions. ...
user avatar
11 votes
Accepted

McEliece information set decoding attack vulnerability

An old thread, but I thought it deserved an answer. Information-set decoding In short, the idea behind information-set decoding is to pick a sufficiently large set of error-free coordinates in a ...
user avatar
11 votes
Accepted

Number of LWE samples in NewHope

They're actually sampling $5n$ elements from $\Psi_{16}$. Perhaps Protocol 2 on page 5 shows this most clearly, where $\textbf{s}, \textbf{e} \stackrel{\$}{\leftarrow} \Psi_{16}^n$ and $\textbf{s}', \...
user avatar
  • 226
11 votes

Why is lattice-based cryptography believed to be hard against quantum computer?

I'm unaware of a great answer to this problem. There are "partial answers", but they are not great. Still, they are what I use to (vaguely) explain things, being someone interested in ...
user avatar
  • 8,394
11 votes
Accepted

Relation between Key-exchange and Public-Key encryption schemes

First, some definitions. A public key encryption scheme (PKE) is a scheme with public and private keys, where we can encrypt a message using the public key and decrypt using the private key. A key ...
user avatar
  • 4,382

Only top scored, non community-wiki answers of a minimum length are eligible