Post-Quantum Cryptography

Transcription

1 Post-Quantum Cryptography Sebastian Schmittner Institute for Theoretical Physics University of Cologne CCC Cologne This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

2 Introduction Review: Asymmetric Cryptography Quantum Computer: Shor s Algorithm Complexity Post-Quantum Cryptography Overview Lattice-based cryptography Learning with errors 1 Sebastian Schmittner

3 Asymmetric Cryptography 2 Sebastian Schmittner

4 RSA 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman at MIT N = pq e < ϕ c = m e mod N ϕ = (p 1)(q 1) d = e 1 mod ϕ m = c d mod N 3 Sebastian Schmittner

5 Shor s Algorithm Combined classical/quantum probabilistic algorithm Essential step: find period of x a x mod N via superposition, quantum Fourier transform and measurement Quantum computer breaks: RSA, DSA, (hyper-)elliptic curve cryptography,... Need for post-quantum cryptography 4 Sebastian Schmittner

6 Complexity NP P NP-complete NP-hard RSA 5 Sebastian Schmittner

7 Complexity BQP NP P NP-complete NP-hard Post-Quantum! RSA PQ? 6 Sebastian Schmittner

8 Post-Quantum Cryptography 1 Existing PQ-cryptography schemes: Secret-key (Symmetric encryption, AES, 1998) Hash-based (Signature, Hash trees, 1979) Code-based (McEliece, 1978) Lattice-based (NTRU, 1998) Multivariate-quadratic-equations (Signature, HFE v, 1996) Why RSA? Security level: attack needs 2 b operations RSA: key length n RSA b 3 /(log b) 2 McEliece: key length n McEliece b 2 /(log b) 2 But: n McEliece /n RSA (b = 128) due to pre-factors 1 Bernstein, Buchmann, Dahmen: Post-quantum cryptography. Springer Sebastian Schmittner

9 Lattice-based cryptography Choose a basis B = {b 1,..., b n } of R n The finite set L = Spann Zq (B) is called a (periodic) lattice b 2 b 1 8 Sebastian Schmittner

10 Lattice-based cryptography Choose a basis B = {b 1,..., b n } of R n The finite set L = Spann Zq (B) is called a (periodic) lattice b 2 b 1 B Basis linear independent and Spann Zq (B )? =L 9 Sebastian Schmittner

11 Lattice-based cryptography Choose a basis B = {b 1,..., b n } of R n The finite set L = Spann Zq (B) is called a (periodic) lattice b 2 b 1 B Basis linear independent and Spann Zq (B ) L 10 Sebastian Schmittner

12 Lattice-based cryptography Choose a basis B = {b 1,..., b n } of R n The finite set L = Spann Zq (B) is called a (periodic) lattice b 2 b 1 b 2 b 1 B Basis linear independent and Spann Zq (B ) = L B = UB for unimodular U Gl n (Z). Lenstra Lenstra Lovász lattice (LLL) basis reduction 11 Sebastian Schmittner

13 Lattice problems Given a basis B b 2 b 1 b 2 b 1 Shortest Vector Prob. (SVP) Find shortest v L NP-hard for max-norm Used to secure NTRUEncrypt public key cryptosystem Closest Vector Problem (CVP) Find closest v L to given ṽ R n \ L Goldreich-Goldwasser- Halevi (GGH) cryptosystem 12 Sebastian Schmittner

14 Lattice problems Given a basis B b 2 b 1 b 2 b 1 Shortest Vector Prob. (SVP) Closest Vector Problem (CVP) Decision Problems: GapSVP β and GapCVP β v ṽ < 1 or v ṽ > β? Polynomialtime-equivalent and both in NP Easy for large β NP-hard for e.g. β o ( n 1/ log log n), in particular for β O(1) 13 Sebastian Schmittner

15 Learning with errors (LWE) Rough idea y x f : Z n q Z q linear, i.e. f (x) = v x for some vector v Error: y = f (x) + η with random variable η (e.g. gaussian) Can we learn the function f from samples {(x, y)}? 14 Sebastian Schmittner

16 Learning with errors (LWE) Rough idea y y = f (x) 0 + x f : Z n q Z q linear, i.e. f (x) = v x for some vector v Error: y = f (x) + η with random variable η (e.g. gaussian) Can we learn the function f from samples {(x, y)}? 15 Sebastian Schmittner

17 Learning with errors (LWE) More precise idea Replace target space by T = R/Z U(1) S 1 Group homomorphism Z q T, i.e. y y/q Distribution φ of random variable η on T Find v Z n q from polynomially many (x, v x/q + η) 16 Sebastian Schmittner

18 Learning with errors (LWE) More precise idea Decision version: φ uniform or gaussian? Equivalent to search for not to large prime q No easy instances GapSVP can be reduced to LWE LWE translates into Regev s public key cryptosystem 17 Sebastian Schmittner

19 Key exchange General idea + example: Diffie-Hellman Public: Set of commuting functions {f a }, e.g. f a (x) = e a mod N, and starting value x Private: every participant chooses random a i Exchange: everybody publishes f ai (x) Computing a from x and fa (x) needs to be hard ( Compute and publish f ai faj (x) )... (actually do this more cleverly with many participants ;) Finally everybody possesses a common key F (x) with F = f a1 f a2... = f a2 f a1... E.g. (e a ) b = e ab = ( e b) a (also true mod N) 18 Sebastian Schmittner

20 Ring learning with errors key exchange (RLWE-KEX) Rough idea Public: polynomial a(x) = n i=1 a ix i Private: small (max norm of coefficients) polynomials s and e (Almost) commuting operations: (as A + e A )s B + e B = as A s B + e a s B + e B (1) (as B + e B )s A + e A = as A s B + e B s A + e A (2) Treating e B s A + e A and e A s B + e B as errors Detailed description of the algorithm: errors_key_exchange 19 Sebastian Schmittner

21 Many Thanks!