16 research outputs found
An upper bound on the decryption failure rate of static-key NewHope
We give a new proof that the decryption failure rate of NewHope512 is at most . As in previous work, this failure rate is with respect to random, honestly generated, secret key and ciphertext pairs. However, our technique can also be applied to a fixed secret key. We demonstrate our technique on some subsets of the NewHope1024 key space, and we identify a large subset of NewHope1024 keys with failure rates of no more than
A Comparison of NTRU Variants
We analyze the size vs. security trade-offs that are available when selecting parameters for perfectly correct key encapsulation mechanisms based on NTRU
Multi-power Post-quantum RSA
Special purpose factoring algorithms have discouraged the adoption of multi-power RSA, even in a post-quantum setting. We revisit the known attacks and find that a general recommendation against repeated factors is unwarranted. We find that one-terabyte RSA keys of the form are competitive with one-terabyte RSA keys of the form . Prime generation can be made to be a factor of 100000 times faster at a loss of at least but not more than bits of security against known attacks. The range depends on the relative cost of bit and qubit operations under the assumption that qubit operations cost bit operations for some constant
Decryption failure is more likely after success
The user of an imperfectly correct lattice-based public-key encryption scheme leaks information about their secret key with each decryption query that they answer---even if they answer all queries successfully. Through a refinement of the D\u27Anvers--Guo--Johansson--Nilsson--Vercauteren--Verbauwhede failure boosting attack, we show that an adversary can use this information to improve his odds of finding a decryption failure. We also propose a new definition of -correctness, and we re-assess the correctness of several submissions to NIST\u27s post-quantum standardization effort
Circuit-extension handshakes for Tor achieving forward secrecy in a quantum world
We propose a circuit extension handshake for Tor that is forward secure against adversaries who gain quantum computing capabilities after session negotiation. In doing so, we refine the notion of an authenticated and confidential channel establishment (ACCE) protocol and define pre-quantum, transitional, and post-quantum ACCE security. These new definitions reflect the types of adversaries that a protocol might be designed to resist. We prove that, with some small modifications, the currently deployed Tor circuit extension handshake, ntor, provides pre-quantum ACCE security. We then prove that our new protocol, when instantiated with a post-quantum key encapsulation mechanism, achieves the stronger notion of transitional ACCE security. Finally, we instantiate our protocol with NTRUEncrypt and provide a performance comparison between ntor, our proposal, and the recent design of Ghosh and Kate
Transcript secure signatures based on modular lattices
We introduce a class of lattice-based digital signature schemes
based on modular properties of the coordinates of lattice vectors. We also
suggest a method of making such schemes transcript secure via a rejection
sampling technique of Lyubashevsky (2009). A particular instantiation
of this approach is given, using NTRU lattices. Although the scheme is
not supported by a formal security reduction, we present arguments for
its security and derive concrete parameters (first version) based on the
performance of state-of-the-art lattice reduction and enumeration tech-
niques. In the revision, we re-evaluate the security of first version of the
parameter sets, under the hybrid approach of lattice reduction attack
the meet-in-the-middle attack. We present new sets of parameters that
are robust against this attack, as well as all previous known attacks
DA-Encrypt: Homomorphic Encryption via Non-Archimedean Diophantine Approximation --- Preliminary Report
We give a theoretical description of a new homomorphic encryption scheme DA-Encrypt that is based on (non-archimedean) Diophantine Approximation
Choosing Parameters for NTRUEncrypt
We describe a methods for generating parameter sets and calculating security estimates for NTRUEncrypt. Analyses are provided for the standardized product-form parameter sets from IEEE 1363.1-2008 and for the NTRU Challenge parameter sets
CRYSTALS -- Kyber: a CCA-secure module-lattice-based KEM
Rapid advances in quantum computing, together with the announcement by the National Institute of Standards and Technology (NIST) to define new standards for digital-signature, encryption, and key-establishment protocols, have created significant interest in post-quantum cryptographic schemes.
This paper introduces Kyber (part of CRYSTALS -- Cryptographic Suite for Algebraic Lattices -- a package submitted to NIST post-quantum standardization effort in November 2017), a portfolio of post-quantum cryptographic primitives built around a key-encapsulation mechanism (KEM),based on hardness assumptions over module lattices. Our KEM is most naturally seen as a successor to the NewHope KEM (Usenix 2016). In particular, the key and ciphertext sizes of our new construction are about half the size, the KEM offers CCA instead of only passive security, the security is based on a more general (and flexible) lattice problem, and our optimized implementation results in essentially the same running time as the aforementioned scheme.
We first introduce a CPA-secure public-key encryption scheme, apply a variant of the Fujisaki--Okamoto transform to create a CCA-secure KEM, and eventually construct, in a black-box manner, CCA-secure encryption, key exchange, and authenticated-key-exchange schemes. The security of our primitives is based on the hardness of Module-LWE in the classical and quantum random oracle models, and our concrete parameters conservatively target more than bits of post-quantum security