Practical, Quantum-Secure Key Exchange from LWE
|
|
|
- Godfrey Cunningham
- 6 years ago
- Views:
Transcription
1 Practical, Quantum-Secure Key Exchange from LWE Douglas Stebila 4 th ETSI/IQC Workshop on Quantum-Safe Cryptography September 21, 2016
2 Acknowledgements Collaborators Joppe Bos Craig Costello and Michael Naehrig Léo Ducas Ilya Mironov and Ananth Raghunathan Michele Mosca Valeria Nikolaenko Support Australian Research Council (ARC) Natural Sciences and Engineering Research Council of Canada (NSERC) Queensland University of Technology Tutte Institute for Mathematics and Computing
3 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 3 LWE-Frodo Key exchange protocol from the learning with errors problem Experimental results in TLS Open Quantum Safe A library for comparing postquantum primitives Starting with key exchange Framework for easing integration into applications like OpenSSL
4 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 4 Why key exchange? Premise: large-scale quantum computers don t exist right now, but we want to protect today s communications against tomorrow s adversary. Signatures still done with traditional primitives (RSA/ECDSA) we only need authentication to be secure now benefit: use existing RSA-based PKI Key agreement done with ring-lwe, LWE, Also consider hybrid ciphersuites that use post-quantum and traditional elliptic curve
5 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 5 Learning with errors problems
6 Linear system problem: given blue, find red ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 6 Solving systems of linear equations Z secret Z = Z
7 Linear system problem: given blue, find red ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 7 Solving systems of linear equations Z secret Z = Z
8 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 8 Learning with errors problem random secret small noise Z Z Z Z =
9 Computational LWE problem: given blue, find red ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 9 Learning with errors problem random secret small noise Z Z Z Z =
10 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 10 Decision learning with errors problem random secret small noise looks random Z Z Z Z = Decision LWE problem: given blue, distinguish green from random
11 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 11 Toy example versus real-world example Z Z bits = 245 KiB
12 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 12 Ring learning with errors problem random Z Each row is the cyclic shift of the row above
13 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 13 Ring learning with errors problem random Z Each row is the cyclic shift of the row above with a special wrapping rule: x wraps to x mod 13.
14 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 14 Ring learning with errors problem random Z Each row is the cyclic shift of the row above with a special wrapping rule: x wraps to x mod 13. So I only need to tell you the first row. Þ Save communication, more efficient computation
15 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 15 Problems Computational LWE problem Decision LWE problem with or without short secrets Computational ring-lwe problem Decision ring-lwe problem
16 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 16 Key agreement from ring-lwe
17 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 17 Ding, Xie, Lin eprint 2012 Key exchange from LWE and ring-lwe BCNS15 Bos, Costello, Naehrig, Stebila. IEEE Security & Privacy 2015 Selected parameters for the 80-bit quantum security level Integrated into TLS Communication size: 8 KiB roundtrip Peikert PQCrypto 2014 Key encapsulation mechanism based on ring-lwe Standalone runtime: ms / party TLS performance impact: x slower
18 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 18 NewHope Alkim, Ducas, Pöppelman, Scwabe. USENIX Security 2016 New parameters Different error distribution Improved performance Pseudorandomly generated parameters Further performance improvements by others [GS16,LN16, ]
19 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 19 Ring-LWE LWE Cyclic structure Z Þ Save communication, more efficient computation 4 KiB representation Z bits = 245 KiB
20 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 20 Ring-LWE LWE Cyclic structure Z Þ Save communication, more efficient computation 4 KiB representation Z bits = 11 KiB
21 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 21 Why consider (slower, bigger) LWE? Generic vs. ideal lattices Ring-LWE matrices have additional structure Relies on hardness of a problem in ideal lattices LWE matrices have no additional structure Relies on hardness of a problem in generic lattices NTRU also relies on a problem in a type of ideal lattices Currently, best algorithms for ideal lattice problems are essentially the same as for generic lattices Small constant factor improvement in some cases Very recent quantum polynomial time algorithm for Ideal-SVP ( but not immediately applicable to ring- LWE If we want to eliminate this additional structure, can we still get an efficient protocol?
22 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 22 Key agreement from LWE Bos, Costello, Ducas, Mironov, Naehrig, Nikolaenko, Raghunathan, Stebila. Frodo: Take off the ring! Practical, quantum-safe key exchange from LWE. ACM Conference on Computer and Communications Security (CCS)
23 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 23 Frodo : LWE-DH key agreement Uses two matrix forms of LWE: Public key is n x n matrix Shared secret is m x n matrix A generated pseudorandomly Secure if decision learning with errors problem is hard (and Gen is a secure PRF)
24 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 24 Rounding Error distribution We extract 4 bits from each of the 64 matrix entries in the shared secret More granular form of rounding 400 used in ring-lwe protocols var. = Parameter sizes, rounding, and error distribution all found via search scripts. Close to discrete Gaussian in terms of Rényi divergence ( ) Only requires 12 bits of randomness to sample
25 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 25 Parameters Recommended All known variants of the sieving algorithm require a list of vectors to be created of this size Paranoid 144-bit classical security, 130-bit quantum security, 103-bit plausible lower bound n = 752, m = 8, q = 2 15! = approximation to rounded Gaussian with 11 elements Failure: Total communication: 22.6 KiB 177-bit classical security, 161-bit quantum security, 128-bit plausible lower bound n = 864, m = 8, q = 2 15! = approximation to rounded Gaussian with 13 elements Failure: Total communication: 25.9 KiB
26 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 26 Standalone performance
27 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 27 Implementations Our implementations BCNS15 Frodo Pure C implementations Constant time Compare with others RSA 3072-bit (OpenSSL 1.0.1f) ECDH nistp256 (OpenSSL) Use assembly code NewHope NTRU EES743EP1 SIDH (Isogenies) (MSR) Pure C implementations
28 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 28 Standalone performance Speed Communication Quantum Security RSA 3072-bit Fast 4 ms Small 0.3 KiB ECDH nistp256 Very fast 0.7 ms Very small 0.03 KiB BCNS Fast 1.5 ms Medium 4 KiB 80-bit NewHope Very fast 0.2 ms Medium 2 KiB 206-bit NTRU EES743EP1 Fast ms Medium 1 KiB 128-bit SIDH Very slow ms Small 0.5 KiB 128-bit Frodo Recommended Fast 1.4 ms Large 11 KiB 130-bit McBits* Very fast 0.5 ms Very large 360 KiB 161-bit First 7 rows: x86_64, 2.6 GHz Intel Xeon E5 (Sandy Bridge) Google n1-standard-4 * McBits results from source paper [BCS13] Note somewhat incomparable security levels
29 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 29 TLS integration and performance
30 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 30 Integration into TLS 1.2 New ciphersuite: TLS-KEX-SIG-AES256-GCM- SHA384 SIG = RSA or ECDSA signatures for authentication KEX = Post-quantum key exchange AES-256 in GCM for authenticated encryption SHA-384 for HMAC-KDF
31 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 31 TLS performance Handshake latency Time from when client sends first TCP packet till client receives first application data No load on server Connection throughput Number of connections per second at server before server latency spikes
32 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 32 TLS handshake latency compared to RSA sig + ECDH nistp256 smaller (left) is better ECDH nistp x baseline 1.00x BCNS 1.17x 1.27x NewHope 0.75x 0.81x NTRU 1.24x 1.24x Frodo Recom. 1.14x 1.29x RSA sig ECDSA sig x86_64, 2.6 GHz Intel Xeon E5 (Sandy Bridge) server Google n1-standard-4, client -32 Note somewhat incomparable security levels
33 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 33 TLS connection throughput ECDSA signatures bigger (top) is better NewHope 1.36x NewHope Frodo 0.78x Frodo 0.87x ECDHE BCNS Frodo 600 NTRU B 1 KiB 10 KiB 100 KiB Payload size x86_64, 2.6 GHz Intel Xeon E5 (Sandy Bridge) server Google n1-standard-4, client -32 Note somewhat incomparable security levels
34 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 34 Hybrid ciphersuites Use both post-quantum key exchange and traditional key exchange Example: ECDHE + NewHope Used in Google Chrome experiment ECDHE + Frodo Session key secure if either problem is hard Why use post-quantum? (Potential) security against future quantum computer Why use ECDHE? Security not lost against existing adversaries if post-quantum cryptanalysis advances
35 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 35 TLS connection throughput hybrid w/ecdhe ECDSA signatures NewHope 0.92x Frodo 0.62x bigger (top) is better Frodo 0.69x ECDHE NewHope BCNS Frodo 400 NTRU 200 Frodo v. NewHope 0.86x 0 1 B 1 KiB 10 KiB 100 KiB Payload size x86_64, 2.6 GHz Intel Xeon E5 (Sandy Bridge) server Google n1-standard-4, client -32 Note somewhat incomparable security levels
36 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 36 Open Quantum Safe Collaboration with Mosca et al., University of Waterloo
37 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 37 Open Quantum Safe Open source C library (MIT License) Common interface for key exchange and digital signatures 1. Collect post-quantum implementations together Our own software Thin wrappers around existing open source implementations Contributions from others 2. Enable direct comparison of implementations 3. Support prototype integration into application level protocols Don t need to re-do integration for each new primitive how we did Frodo experiments
38 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 38 OQS benchmark Apache httpd OpenSSL OTR Application integrations Open Quantum Safe Library OQS-KEX OQS-SIG API BCNS15 Ring-LWE New Hope LWE McEliece NTRU SIDH Hash LWE/ring- LWE Primitive implementations
39 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 39 Current status Coming soon liboqs ring-lwe key exchange using BCNS15 OpenSSL integration into OpenSSL head ring-lwe key exchange as above liboqs benchmarking key exchange: LWE-Frodo McEliece, SIDH, NewHope*, NTRU* (* via wrappers) Integrations into other applications
40 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 40 Getting involved and using OQS If you re writing post-quantum implementations: We d love to coordinate on API And include your software if you agree If you want to prototype or evaluate post-quantum algorithms in applications: Maybe OQS will be helpful to you We d love help with: Your primitives Code review and static analysis Signature scheme implementations Additional application-level integrations
41 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 41 Summary
42 Practical, quantum-secure key exchange from LWE Douglas Stebila LWE can achieve reasonable key sizes and runtime with more conservative assumption LWE key exchange (Frodo) Performance differences are muted in application-level protocols Open Quantum Safe
43 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 43 Appendix
44 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 44 Decision learning with errors problem with short secrets Definition. Let n, q 2 N. Let be a distribution over Z. Let s $ n. Define: O,s : Sample a $ U(Z n q ), e $ ;return(a, a s + e). U: Sample (a,b 0 ) $ U(Z n q Z q ); return (a,b 0 ). The decision LWE problem with short secrets for n, q, is to distinguish O,s from U.
45 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 45 Hardness of decision LWE worst-case gap shortest vector problem (GapSVP) poly-time [BLPRS13] decision LWE tight [ACPS09] decision LWE with short secrets Practice: Assume the best way to solve DLWE is to solve LWE. Assume solving LWE involves a lattice reduction problem. Estimate parameters based on runtime of lattice reduction algorithms. (Ignore non-tightness.)
46 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 46 Standalone performance Scheme RSA 3072-bit ECDH nistp256 BCNS NewHope NTRU EES743EP1 SIDH Frodo Recomm. Frodo Paranoid Alice0 Bob Alice1 (ms) (ms) (ms) Communication (bytes) A!B B!A 387 / ,096 4,224 1,824 2,048 1,027 1, ,377 11,296 13,057 12,976 x86_64, 2.6 GHz Intel Xeon E5 (Sandy Bridge) Google n1-standard-4 Note somewhat incomparable security levels
47 ETSI/IQC 2016 Stebila Practical, Quantum-Secure Key Exchange from LWE 47 Security within TLS 1.2 Model: authenticated and confidential channel establishment (ACCE) [JKSS12] Theorem: signed LWE/ring-LWE ciphersuite is ACCE-secure if underlying primitives (signatures, LWE/ring-LWE, authenticated encryption) are secure Interesting technical detail for ACCE provable security people: need to move server s signature to end of TLS handshake because oracle-dh assumptions don t hold for ring- LWE or use an IND-CCA KEM for key exchange via e.g. [FO99]
Post-quantum key exchange based on Lattices
Post-quantum key exchange based on Lattices Joppe W. Bos Romanian Cryptology Days Conference Cybersecurity in a Post-quantum World September 20, 2017, Bucharest 1. NXP Semiconductors Operations in > 35
Post-quantum key exchange for the Internet based on lattices
Post-quantum key exchange for the Internet based on lattices Craig Costello Talk at MSR India Bangalore, India December 21, 2016 Based on J. Bos, C. Costello, M. Naehrig, D. Stebila Post-Quantum Key Exchange
Part 2 LWE-based cryptography
Part 2 LWE-based cryptography Douglas Stebila SAC Summer School Université d'ottawa August 14, 2017 https://www.douglas.stebila.ca/research/presentations Funding acknowledgements: SAC Summer School 2017-08-14
From NewHope to Kyber. Peter Schwabe April 7, 2017
From NewHope to Kyber Peter Schwabe peter@cryptojedi.org https://cryptojedi.org April 7, 2017 In the past, people have said, maybe it s 50 years away, it s a dream, maybe it ll happen sometime. I used
CRYSTALS Kyber and Dilithium. Peter Schwabe February 7, 2018
CRYSTALS Kyber and Dilithium Peter Schwabe peter@cryptojedi.org https://cryptojedi.org February 7, 2018 Crypto today 5 building blocks for a secure channel Symmetric crypto Block or stream cipher (e.g.,
NewHope for ARM Cortex-M
for ARM Cortex-M Erdem Alkim 1, Philipp Jakubeit 2, Peter Schwabe 2 erdemalkim@gmail.com, phil.jakubeit@gmail.com, peter@cryptojedi.org 1 Ege University, Izmir, Turkey 2 Radboud University, Nijmegen, The
Lattice-Based Cryptography. Chris Peikert University of Michigan. QCrypt 2016
Lattice-Based Cryptography Chris Peikert University of Michigan QCrypt 2016 1 / 24 Agenda 1 Foundations: lattice problems, SIS/LWE and their applications 2 Ring-Based Crypto: NTRU, Ring-SIS/LWE and ideal
Report on Learning with Errors over Rings-based HILA5 and its CCA Security
Report on Learning with Errors over Rings-based HILA5 and its CCA Security Jesús Antonio Soto Velázquez January 24, 2018 Abstract HILA5 is a cryptographic primitive based on lattices that was submitted
Lattice-Based Cryptography
Liljana Babinkostova Department of Mathematics Computing Colloquium Series Detecting Sensor-hijack Attacks in Wearable Medical Systems Krishna Venkatasubramanian Worcester Polytechnic Institute Quantum
Post-Quantum Cryptography & Privacy. Andreas Hülsing
Post-Quantum Cryptography & Privacy Andreas Hülsing Privacy? Too abstract? How to achieve privacy? Under the hood... Asymmetric Crypto ECC RSA DSA Symmetric Crypto AES SHA2 SHA1... Combination of both
Leakage of Signal function with reused keys in RLWE key exchange
Leakage of Signal function with reused keys in RLWE key exchange Jintai Ding 1, Saed Alsayigh 1, Saraswathy RV 1, Scott Fluhrer 2, and Xiaodong Lin 3 1 University of Cincinnati 2 Cisco Systems 3 Rutgers
Post-Quantum Cryptography & Privacy. Andreas Hülsing
Post-Quantum Cryptography & Privacy Andreas Hülsing Privacy? Too abstract? How to achieve privacy? Under the hood... Public-key crypto ECC RSA DSA Secret-key crypto AES SHA2 SHA1... Combination of both
An introduction to supersingular isogeny-based cryptography
An introduction to supersingular isogeny-based cryptography Craig Costello Summer School on Real-World Crypto and Privacy June 8, 2017 Šibenik, Croatia Towards quantum-resistant cryptosystems from supersingular
Jintai Ding*, Saraswathy RV. Lin Li, Jiqiang Liu
Comparison analysis and efficient implementation of reconciliation-based RLWE key exchange protocol Xinwei Gao Beijing Key Laboratory of Security and Privacy in Intelligent Transportation, Beijing Jiaotong
https://www.microsoft.com/en-us/research/people/plonga/ Outline Motivation recap Isogeny-based cryptography The SIDH key exchange protocol The SIKE protocol Authenticated key exchange from supersingular
CRYPTANALYSIS OF COMPACT-LWE
SESSION ID: CRYP-T10 CRYPTANALYSIS OF COMPACT-LWE Jonathan Bootle, Mehdi Tibouchi, Keita Xagawa Background Information Lattice-based cryptographic assumption Based on the learning-with-errors (LWE) assumption
FrodoKEM Learning With Errors Key Encapsulation. Algorithm Specifications And Supporting Documentation
FrodoKEM Learning With Errors Key Encapsulation Algorithm Specifications And Supporting Documentation Erdem Alkim Joppe W. Bos Léo Ducas Patrick Longa Ilya Mironov Michael Naehrig Valeria Nikolaenko Chris
Picnic Post-Quantum Signatures from Zero Knowledge Proofs
Picnic Post-Quantum Signatures from Zero Knowledge Proofs MELISSA CHASE, MSR THE PICNIC TEAM DAVID DERLER STEVEN GOLDFEDER JONATHAN KATZ VLAD KOLESNIKOV CLAUDIO ORLANDI SEBASTIAN RAMACHER CHRISTIAN RECHBERGER
High-speed key encapsulation from NTRU
High-speed key encapsulation from NTRU Andreas Hülsing 1, Joost Rijneveld 2, John Schanck 3,4, Peter Schwabe 2 1 Eindhoven University of Technology, The Netherlands 2 Radboud University, Nijmegen, The
Supersingular Isogeny Key Encapsulation
Supersingular Isogeny Key Encapsulation Presented by David Jao University of Waterloo and evolutionq, Inc. Full list of submitters: Reza Azarderakhsh, FAU Matt Campagna, Amazon Craig Costello, MSR Luca
Public Key Cryptography
Public Key Cryptography Introduction Public Key Cryptography Unlike symmetric key, there is no need for Alice and Bob to share a common secret Alice can convey her public key to Bob in a public communication:
Improved Parameters for the Ring-TESLA Digital Signature Scheme
Improved Parameters for the Ring-TESLA Digital Signature Scheme Arjun Chopra Abstract Akleylek et al. have proposed Ring-TESLA, a practical and efficient digital signature scheme based on the Ring Learning
Post-Quantum Cryptography from Lattices
Post-Quantum Cryptography from Lattices Léo Ducas 1 CWI, Amsterdam, The Netherlands CWI Scientific Meeting, November 2016. 1 Funded by a PPP Grant, between NXP and CWI. Cryptography Cryptography in everyday
Post-Quantum Cryptography
Post-Quantum Cryptography Sebastian Schmittner Institute for Theoretical Physics University of Cologne 2015-10-26 Talk @ U23 @ CCC Cologne This work is licensed under a Creative Commons Attribution-ShareAlike
POST-QUANTUM CRYPTOGRAPHY HOW WILL WE ENCRYPT TOMORROW?
POST-QUANTUM CRYPTOGRAPHY HOW WILL WE ENCRYPT TOMORROW? Hanno Böck https://hboeck.de 1 INTRODUCTION Hanno Böck, freelance journalist and hacker. Writing for Golem.de and others. Fuzzing Project, funded
How to Use Short Basis : Trapdoors for Hard Lattices and new Cryptographic Constructions
Presentation Article presentation, for the ENS Lattice Based Crypto Workgroup http://www.di.ens.fr/~pnguyen/lbc.html, 30 September 2009 How to Use Short Basis : Trapdoors for http://www.cc.gatech.edu/~cpeikert/pubs/trap_lattice.pdf
Outline Proxy Re-Encryption NTRU NTRUReEncrypt PS-NTRUReEncrypt Experimental results Conclusions. NTRUReEncrypt
NTRUReEncrypt An Efficient Proxy Re-Encryption Scheme based on NTRU David Nuñez, Isaac Agudo, and Javier Lopez Network, Information and Computer Security Laboratory (NICS Lab) Universidad de Málaga, Spain
Analysis of Error-Correcting Codes for Lattice-Based Key Exchange
Analysis of Error-Correcting Codes for Lattice-Based Key Exchange Tim Fritzmann 1, Thomas Pöppelmann 2, and Johanna Sepulveda 1 1 Technische Universität München, Germany {tim.fritzmann,johanna.sepulveda}@tum.de
Ring-SIS and Ideal Lattices
Ring-SIS and Ideal Lattices Noah Stephens-Davidowitz (for Vinod Vaikuntanathan s class) 1 Recalling h A, and its inefficiency As we have seen, the SIS problem yields a very simple collision-resistant hash
Weaknesses in Ring-LWE
Weaknesses in Ring-LWE joint with (Yara Elias, Kristin E. Lauter, and Ekin Ozman) and (Hao Chen and Kristin E. Lauter) ECC, September 29th, 2015 Lattice-Based Cryptography Post-quantum cryptography Ajtai-Dwork:
ECS 189A Final Cryptography Spring 2011
ECS 127: Cryptography Handout F UC Davis Phillip Rogaway June 9, 2011 ECS 189A Final Cryptography Spring 2011 Hints for success: Good luck on the exam. I don t think it s all that hard (I do believe I
Hardness and advantages of Module-SIS and Module-LWE
Hardness and advantages of Module-SIS and Module-LWE Adeline Roux-Langlois EMSEC: Univ Rennes, CNRS, IRISA April 24, 2018 Adeline Roux-Langlois Hardness and advantages of Module-SIS and LWE April 24, 2018
Lizard: Cut off the Tail! Practical Post-Quantum Public-Key Encryption from LWE and LWR
Lizard: Cut off the Tail! Practical Post-Quantum Public-Key Encryption from LWE and LWR Jung Hee Cheon 1, Duhyeong Kim 1, Joohee Lee 1, and Yongsoo Song 1 1 Seoul National University (SNU), Republic of
The quantum threat to cryptography
The quantum threat to cryptography Ashley Montanaro School of Mathematics, University of Bristol 20 October 2016 Quantum computers University of Bristol IBM UCSB / Google University of Oxford Experimental
Fundamentals of Modern Cryptography
Fundamentals of Modern Cryptography BRUCE MOMJIAN This presentation explains the fundamentals of modern cryptographic methods. Creative Commons Attribution License http://momjian.us/presentations Last
A gentle introduction to isogeny-based cryptography
A gentle introduction to isogeny-based cryptography Craig Costello Tutorial at SPACE 2016 December 15, 2016 CRRao AIMSCS, Hyderabad, India Part 1: Motivation Part 2: Preliminaries Part 3: Brief SIDH sketch
Cryptography IV: Asymmetric Ciphers
Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline
Classical hardness of Learning with Errors
Classical hardness of Learning with Errors Adeline Langlois Aric Team, LIP, ENS Lyon Joint work with Z. Brakerski, C. Peikert, O. Regev and D. Stehlé Adeline Langlois Classical Hardness of LWE 1/ 13 Our
HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction
HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction Daniel J. Bernstein 1 Leon Groot Bruinderink 2 Tanja Lange 2 Lorenz Panny 2 1 University of Illinois at Chicago 2
Evolution of Cryptography April 25 th 2017
Evolution of Cryptography April 25 th 2017 Internet of Things Today s Moderator: Jason Sabin Chief Security Officer, DigiCert, Inc. To ask a question: Type in your question in the Questions area of your
Classical hardness of the Learning with Errors problem
Classical hardness of the Learning with Errors problem Adeline Langlois Aric Team, LIP, ENS Lyon Joint work with Z. Brakerski, C. Peikert, O. Regev and D. Stehlé August 12, 2013 Adeline Langlois Hardness
MATH 158 FINAL EXAM 20 DECEMBER 2016
MATH 158 FINAL EXAM 20 DECEMBER 2016 Name : The exam is double-sided. Make sure to read both sides of each page. The time limit is three hours. No calculators are permitted. You are permitted one page
Classical hardness of Learning with Errors
Classical hardness of Learning with Errors Zvika Brakerski 1 Adeline Langlois 2 Chris Peikert 3 Oded Regev 4 Damien Stehlé 2 1 Stanford University 2 ENS de Lyon 3 Georgia Tech 4 New York University Our
Public Key 9/17/2018. Symmetric Cryptography Review. Symmetric Cryptography: Shortcomings (1) Symmetric Cryptography: Analogy
Symmetric Cryptography Review Alice Bob Public Key x e K (x) y d K (y) x K K Instructor: Dr. Wei (Lisa) Li Department of Computer Science, GSU Two properties of symmetric (secret-key) crypto-systems: The
Lattice Reduction Attacks on HE Schemes. Martin R. Albrecht 15/03/2018
Lattice Reduction Attacks on HE Schemes Martin R. Albrecht 15/03/2018 Learning with Errors The Learning with Errors (LWE) problem was defined by Oded Regev. 1 Given (A, c) with uniform A Z m n q, uniform
Lecture 11: Key Agreement
Introduction to Cryptography 02/22/2018 Lecture 11: Key Agreement Instructor: Vipul Goyal Scribe: Francisco Maturana 1 Hardness Assumptions In order to prove the security of cryptographic primitives, we
Increased efficiency and functionality through lattice-based cryptography
Increased efficiency and functionality through lattice-based cryptography Michele Minelli ENS, CNRS, INRIA, PSL Research University RESEARCH UNIVERSITY PARIS ECRYPT-NET Cloud Summer School Leuven, Belgium
Fast Lattice-Based Encryption: Stretching SPRING
Fast Lattice-Based Encryption: Stretching SPRING Charles Bouillaguet 1 Claire Delaplace 1,2 Pierre-Alain Fouque 2 Paul Kirchner 3 1 CFHP team, CRIStAL, Université de Lille, France 2 EMSEC team, IRISA,
L7. Diffie-Hellman (Key Exchange) Protocol. Rocky K. C. Chang, 5 March 2015
L7. Diffie-Hellman (Key Exchange) Protocol Rocky K. C. Chang, 5 March 2015 1 Outline The basic foundation: multiplicative group modulo prime The basic Diffie-Hellman (DH) protocol The discrete logarithm
Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange
Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange Nina Bindel 1 Jacqueline Brendel 1 Marc Fischlin 1 Brian Goncalves 2 Douglas Stebila 3 1 Technische Universität Darmstadt, Darmstadt,
arxiv: v2 [cs.cr] 14 Feb 2018
![arxiv: v2 [cs.cr] 14 Feb 2018](/thumbs/82/84767973.jpg "arxiv: v2 [cs.cr] 14 Feb 2018")
Code-based Key Encapsulation from McEliece s Cryptosystem Edoardo Persichetti arxiv:1706.06306v2 [cs.cr] 14 Feb 2018 Florida Atlantic University Abstract. In this paper we show that it is possible to extend
Lecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
Question: Total Points: Score:
University of California, Irvine COMPSCI 134: Elements of Cryptography and Computer and Network Security Midterm Exam (Fall 2016) Duration: 90 minutes November 2, 2016, 7pm-8:30pm Name (First, Last): Please
Post-quantum verifiable random functions from ring signatures
Post-quantum verifiable random functions from ring signatures Endre Abraham December 22, 2018 Abstract One of the greatest challenges on exchanging seemingly random nonces or data either on a trusted or
Ideal Lattices and Ring-LWE: Overview and Open Problems. Chris Peikert Georgia Institute of Technology. ICERM 23 April 2015
Ideal Lattices and Ring-LWE: Overview and Open Problems Chris Peikert Georgia Institute of Technology ICERM 23 April 2015 1 / 16 Agenda 1 Ring-LWE and its hardness from ideal lattices 2 Open questions
Cryptographical Security in the Quantum Random Oracle Model
Cryptographical Security in the Quantum Random Oracle Model Center for Advanced Security Research Darmstadt (CASED) - TU Darmstadt, Germany June, 21st, 2012 This work is licensed under a Creative Commons
Background: Lattices and the Learning-with-Errors problem
Background: Lattices and the Learning-with-Errors problem China Summer School on Lattices and Cryptography, June 2014 Starting Point: Linear Equations Easy to solve a linear system of equations A s = b
Foundations of Network and Computer Security
Foundations of Network and Computer Security John Black Lecture #6 Sep 8 th 2005 CSCI 6268/TLEN 5831, Fall 2005 Announcements Quiz #1 later today Still some have not signed up for class mailing list Perhaps
Notes for Lecture 16
COS 533: Advanced Cryptography Lecture 16 (11/13/2017) Lecturer: Mark Zhandry Princeton University Scribe: Boriana Gjura Notes for Lecture 16 1 Lattices (continued) 1.1 Last time. We defined lattices as
Information Security
SE 4472 / ECE 9064 Information Security Week 12: Random Number Generators and Picking Appropriate Key Lengths Fall 2015 Prof. Aleksander Essex Random Number Generation Where do keys come from? So far we
BEYOND POST QUANTUM CRYPTOGRAPHY
BEYOND POST QUANTUM CRYPTOGRAPHY Mark Zhandry Stanford University Joint work with Dan Boneh Classical Cryptography Post-Quantum Cryptography All communication stays classical Beyond Post-Quantum Cryptography
Titanium: Post-Quantum Lattice-Based Public-Key Encryption balancing Security Risk and Practicality
Titanium: Post-Quantum Lattice-Based Public-Key Encryption balancing Security Risk and Practicality Ron Steinfeld, Amin Sakzad, Raymond K. Zhao Monash University ron.steinfeld@monash.edu Ron Steinfeld
A Generic Hybrid Encryption Construction in the Quantum Random Oracle Model
A Generic Hybrid Encryption Construction in the Quantum Random Oracle Model Presented by: Angela Robinson Department of Mathematical Sciences, Florida Atlantic University April 4, 2018 Motivation Quantum-resistance
Elliptic curve cryptography in a post-quantum world: the mathematics of isogeny-based cryptography
Elliptic curve cryptography in a post-quantum world: the mathematics of isogeny-based cryptography Andrew Sutherland MIT Undergraduate Mathematics Association November 29, 2018 Creating a shared secret
Pseudorandomness of Ring-LWE for Any Ring and Modulus. Chris Peikert University of Michigan
Pseudorandomness of Ring-LWE for Any Ring and Modulus Chris Peikert University of Michigan Oded Regev Noah Stephens-Davidowitz (to appear, STOC 17) 10 March 2017 1 / 14 Lattice-Based Cryptography y = g
Intro to Public Key Cryptography Diffie & Hellman Key Exchange
Introduction to Modern Cryptography Lecture 5 Number Theory: 1. Quadratic residues. 2. The discrete log problem. Intro to Public Key Cryptography Diffie & Hellman Key Exchange Course Summary - Math Part
Cryptography CS 555. Topic 25: Quantum Crpytography. CS555 Topic 25 1
Cryptography CS 555 Topic 25: Quantum Crpytography CS555 Topic 25 1 Outline and Readings Outline: What is Identity Based Encryption Quantum cryptography Readings: CS555 Topic 25 2 Identity Based Encryption
Quantum Technologies: Threats & Solutions to Cybersecurity
Quantum Technologies: Threats & Solutions to Cybersecurity Bruno Huttner ID Quantique & Cloud Security Alliance, Quantum-Safe Security Working Group NIAS2017; Mons, Oct. 2017 ID Quantique Company Profile
What are we talking about when we talk about post-quantum cryptography?
PQC Asia Forum Seoul, 2016 What are we talking about when we talk about post-quantum cryptography? Fang Song Portland State University PQC Asia Forum Seoul, 2016 A personal view on postquantum cryptography
Open problems in lattice-based cryptography
University of Auckland, New Zealand Plan Goal: Highlight some hot topics in cryptography, and good targets for mathematical cryptanalysis. Approximate GCD Homomorphic encryption NTRU and Ring-LWE Multi-linear
A Framework to Select Parameters for Lattice-Based Cryptography
A Framework to Select Parameters for Lattice-Based Cryptography Nabil Alkeilani Alkadri, Johannes Buchmann, Rachid El Bansarkhani, and Juliane Krämer Technische Universität Darmstadt Department of Computer
Notes for Lecture 17
U.C. Berkeley CS276: Cryptography Handout N17 Luca Trevisan March 17, 2009 Notes for Lecture 17 Scribed by Matt Finifter, posted April 8, 2009 Summary Today we begin to talk about public-key cryptography,
Public-key cryptography and the Discrete-Logarithm Problem. Tanja Lange Technische Universiteit Eindhoven. with some slides by Daniel J.
Public-key cryptography and the Discrete-Logarithm Problem Tanja Lange Technische Universiteit Eindhoven with some slides by Daniel J. Bernstein Cryptography Let s understand what our browsers do. Schoolbook
Quantum Cryptography
Quantum Cryptography Christian Schaffner Research Center for Quantum Software Institute for Logic, Language and Computation (ILLC) University of Amsterdam Centrum Wiskunde & Informatica Quantum Computer
The quantum threat to cryptography
The quantum threat to cryptography Michele Mosca 8 May 2016 Vienna, Austria Cryptography in the context of quantum computers E. Lucero, D. Mariantoni, and M. Mariantoni Harald Ritsch Y. Colombe/NIST How
Markku-Juhani O. Saarinen
Shorter Messages and Faster Post-Quantum Encryption with Round5 on Cortex M Markku-Juhani O. Saarinen S. Bhattacharya 1 O. Garcia-Morchon 1 R. Rietman 1 L. Tolhuizen 1 Z. Zhang 2 (1)
Introduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
Managing the quantum risk to cybersecurity. Global Risk Institute. Michele Mosca 11 April 2016
Managing the quantum risk to cybersecurity Global Risk Institute Michele Mosca 11 April 2016 Cyber technologies are becoming increasingly pervasive. Cybersecurity is a growing and fundamental part of safety
A brief survey of post-quantum cryptography. D. J. Bernstein University of Illinois at Chicago
A brief survey of post-quantum cryptography D. J. Bernstein University of Illinois at Chicago Once the enormous energy boost that quantum computers are expected to provide hits the street, most encryption
CIS 6930/4930 Computer and Network Security. Topic 5.2 Public Key Cryptography
CIS 6930/4930 Computer and Network Security Topic 5.2 Public Key Cryptography 1 Diffie-Hellman Key Exchange 2 Diffie-Hellman Protocol For negotiating a shared secret key using only public communication
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 11 February 21, 2013 CPSC 467b, Lecture 11 1/27 Discrete Logarithm Diffie-Hellman Key Exchange ElGamal Key Agreement Primitive Roots
Chapter 8 Public-key Cryptography and Digital Signatures
Chapter 8 Public-key Cryptography and Digital Signatures v 1. Introduction to Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital
1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Message Authentication Codes (MACs)
Message Authentication Codes (MACs) Tung Chou Technische Universiteit Eindhoven, The Netherlands October 8, 2015 1 / 22 About Me 2 / 22 About Me Tung Chou (Tony) 2 / 22 About Me Tung Chou (Tony) Ph.D.
McBits: Fast code-based cryptography
McBits: Fast code-based cryptography Peter Schwabe Radboud University Nijmegen, The Netherlands Joint work with Daniel Bernstein, Tung Chou December 17, 2013 IMA International Conference on Cryptography
Lessons Learned from High-Speed Implementa6on and Benchmarking of Two Post-Quantum Public-Key Cryptosystems
Lessons Learned from High-Speed Implementa6on and Benchmarking of Two Post-Quantum Public-Key Cryptosystems Malik Umar Sharif, Ahmed Ferozpuri, and Kris Gaj George Mason University USA Partially supported
Public-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols nichols@math.umass.edu University of Massachusetts Oct. 14, 2015 Cryptography basics Cryptography is the study of secure communications. Here are
Practical Analysis of Key Recovery Attack against Search-LWE Problem
Practical Analysis of Key Recovery Attack against Search-LWE Problem The 11 th International Workshop on Security, Sep. 13 th 2016 Momonari Kudo, Junpei Yamaguchi, Yang Guo and Masaya Yasuda 1 Graduate
Public-Key Cryptosystems CHAPTER 4
Public-Key Cryptosystems CHAPTER 4 Introduction How to distribute the cryptographic keys? Naïve Solution Naïve Solution Give every user P i a separate random key K ij to communicate with every P j. Disadvantage:
A New Approach to Practical Secure Two-Party Computation. Jesper Buus Nielsen Peter Sebastian Nordholt Claudio Orlandi Sai Sheshank
A New Approach to Practical Secure Two-Party Computation Jesper Buus Nielsen Peter Sebastian Nordholt Claudio Orlandi Sai Sheshank Secure Two-Party Computation Alice has an input a {0,1} * Bob has an input
Cryptology. Scribe: Fabrice Mouhartem M2IF
Cryptology Scribe: Fabrice Mouhartem M2IF Chapter 1 Identity Based Encryption from Learning With Errors In the following we will use this two tools which existence is not proved here. The first tool description
Solving LWE with BKW
Martin R. Albrecht 1 Jean-Charles Faugére 2,3 1,4 Ludovic Perret 2,3 ISG, Royal Holloway, University of London INRIA CNRS IIS, Academia Sinica, Taipei, Taiwan PKC 2014, Buenos Aires, Argentina, 28th March
Post-quantum security models for authenticated encryption
Post-quantum security models for authenticated encryption Vladimir Soukharev David R. Cheriton School of Computer Science February 24, 2016 Introduction Bellare and Namprempre in 2008, have shown that
A Lattice-based AKE on ARM Cortex-M4
A Lattice-based AKE on ARM Cortex-M4 Julian Speith 1, Tobias Oder 1, Marcel Kneib 2, and Tim Güneysu 1,3 1 Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Germany {julian.speith,tobias.oder,tim.gueneysu}@rub.de
Lectures 2+3: Provable Security
Lectures 2+3: Provable Security Contents 1 Motivation 1 2 Syntax 3 3 Correctness 5 4 Security Definitions 6 5 Important Cryptographic Primitives 8 6 Proofs of Security 10 7 Limitations of Provable Security
Parameter selection in Ring-LWE-based cryptography
Parameter selection in Ring-LWE-based cryptography Rachel Player Information Security Group, Royal Holloway, University of London based on joint works with Martin R. Albrecht, Hao Chen, Kim Laine, and
STRIBOB : Authenticated Encryption
1 / 19 STRIBOB : Authenticated Encryption from GOST R 34.11-2012 or Whirlpool Markku-Juhani O. Saarinen mjos@item.ntnu.no Norwegian University of Science and Technology Directions in Authentication Ciphers
Lecture 14 More on Digital Signatures and Variants. COSC-260 Codes and Ciphers Adam O Neill Adapted from
Lecture 14 More on Digital Signatures and Variants COSC-260 Codes and Ciphers Adam O Neill Adapted from http://cseweb.ucsd.edu/~mihir/cse107/ Setting the Stage We will cover in more depth some issues for
Sharing a Secret in Plain Sight. Gregory Quenell
Sharing a Secret in Plain Sight Gregory Quenell 1 The Setting: Alice and Bob want to have a private conversation using email or texting. Alice Bob 2 The Setting: Alice and Bob want to have a private conversation
Post-Snowden Elliptic Curve Cryptography. Patrick Longa Microsoft Research
Post-Snowden Elliptic Curve Cryptography Patrick Longa Microsoft Research Joppe Bos Craig Costello Michael Naehrig NXP Semiconductors Microsoft Research Microsoft Research June 2013 the Snowden leaks the