What are we talking about when we talk about post-quantum cryptography?

Transcription

1 PQC Asia Forum Seoul, 2016 What are we talking about when we talk about post-quantum cryptography? Fang Song Portland State University

2 PQC Asia Forum Seoul, 2016 A personal view on postquantum cryptography & a bite on quantum algorithms Fang Song Portland State University

3 How does cryptography change in a quantum world? 3

4 Triumph of modern cryptography Public-key cryptography Digital signature: DSA, Public-key encryption: RSA, Diffie-Hellmann key exchange 2015 A.M. Turing Award Symmetric-key cryptography Cryptographic protocols Block ciphers: AES Cryptographic hash function: SHA-2, Secure two/multi-party computation e-voting, Cryptography: a pillar of security for individuals, organizations and society! 4

5 Modern cryptography as a science A formal framework: provable security 2012 ACM A.M. Turing Award created mathematical structures that turned cryptography from an art into a science. Crypto scheme Σ Hard problem Π Security Model Security Analysis (Proof) Breaking Σ is as hard as solving Π Computational assumption EX. Factoring & Discrete Log hard to solve 5

6 Into a quantum world: the dark cat rises Physicists: quantum weirdness Quantum superposition 1 α 0 + β 1 2 ( ALIVE + DEAD ) Qubit Quantum Entanglement Computer scientists Non-classical correlation Spooky action at a distance A. Einstein Quantum gates & circuits 6

7 How does cryptography change in a quantum world? 7

8 Quantum attacks 1: break classical foundation Public-key crypto (DSA, RSA,DH, ) Broken! Computational assumption Factoring & Discrete Log hard to solve Factoring/DL Quantum computer can solve them a, fast! a [Shor94] Need: alternative problems to build crypto on Exciting progress: lattice-based, code-based, Question: are the new problems hard for classical & quantum computers? Is this all we need to worry about? 8

9 Quantum attacks 2: invalidate classical framework Crypto? schemes Lattices, Security Model Security Analysis Computational assumption: hard for quantum computer Alert: unique quantum attacks information-theoretically secure protocol This can happen now! (Technology available) Broken b by quantum entanglement! (vs. shared randomness) b [CSST11] Need: quantum provable-security framework Re-examine EVERY link against quantum attackers L Largely missing in PQC research 9

10 Any quantum ingredient could be a threat Task Need Availability I Run quantum factoring algorithm (to break public key crypto) Full-scale fault-tolerant QC ? II Quantum attack classical crypto Ex. Quantum entanglement Available now 10

11 How does cryptography change in a quantum world? Post-Quantum Cryptography Hard problems broken Construct on new problems Security framework fail Analyze Security against quantum adv Outperform classical protocols Ex. Quantum key distribution Quantum Cryptography NB. Many already available (even as commercial products) Crypto tools for quantum tasks Ex. Encrypt quantum data 11

12 This Talk 1 Quantum algorithms A recent breakthrough: quantum algorithm for high-degree number fields Application: break some lattice crypto! The Hidden Subgroup Problem & Quantum Fourier Sampling 2 Examples: classical security framework inadequate Quantum Rewinding Quantum random oracle model Quantum attack on symmetric crypto 12

13 exponentially Which problems admit faster quantum algorithms than classical algorithms? Poly-time quantum algorithms for: Factoring and discrete logarithm [Shor 94] Basic problems in algebraic number theory Constant degree number fields Unit group Principal ideal problem [Hallgren 02 05,SV05] Class group Arbitrary degree [EHKS STOC14] [BS SODA16] Best known classical algorithms need (at least) sub-exponential time 13

14 Our quantum algorithms for Unit group, Principal ideal problem Break several lattice-based cryptosystems believed quantum safe before L 14

15 Breaking some lattice crypto For efficiency, often use problems in lattices w/ more structures Short-PIP Ring-LWE? Bad news: Short-PIP based cryptosystems are broken! Find a short generator of a principal ideal lattice FHE c, Multilinear mapping d, PKE by GCHQ e... broken Short-PIP Our quantum alg s find A generator PIP Classical procedure: reduce size of generator in cyclotomic fields e,f c SmartV10 d GargGH13 e CampellGS15 f CramerDPR15 Find A generator of a principal ideal lattice 15

16 How do quantum computers solve these problems? 16

17 The Hidden Subgroup Problem (HSP) framework INPUT Problem Π Reduction HSP on a group G Standard Def.: HSP on finite group G G H x + H f S s I s J Quantum Algorithm OUTPUT Solution to Π Captures most quantum exponential speedup Given: oracle function f: G S, s.t. H G, 1. (Periodic on H) x y H f x = f y 2. (Injective on G/H) x y H f x f y z + H s K Goal: Find (hidden subgroup) H. Continuous G (e.g. R O ) tricky, but we can handle [EHKS14] 17

18 Interesting HSP instances Computational Problems Factoring Discrete logarithm Number fields (PIP etc.) Simon s problem (Crypto app later) Graph isomorphism Unique shortest vector problem HSP on G Z Z Q Z Q R S(O) O Z T Symmetric group Dihedral group Abelian groups efficient quantum algs Non-abelian Open question:? efficient quantum algs 18

19 Solving HSP: quantum Fourier sampling Given: oracle f: G S periodic on H & Real Domain G = Z Q 0 r N 1 G = Z G = R r 0 r r 0 r F Z^ F R Fourier Spectrum 0 N/r 2N/r Noise becomes intolerable as dimension grows! 1/r 0 1/r Goal: find H Standard method for finite G 1. Quantum Fourier Sampling: Quantum Fourier transform & measure 2. Recover H from samples Old method for R UVOWXYOX Discretize & Truncate Reduce to finite G Our method for continuous R _ Informal: try to approx. sample the ideal Fourier spectrum directly! 19

20 This Talk 1 Quantum algorithms A recent breakthrough: quantum algorithm for high-degree number fields Application: break some lattice crypto! The Hidden Subgroup Problem & Quantum Fourier Sampling 2 Examples: classical security framework inadequate Quantum Rewinding Quantum random oracle model Quantum attack on symmetric crypto 20

21 Recall: classical security framework fails Security model inadequate for quantum attackers Quantum security models: Still at early stage Classical proofs can fail against quantum attackers Many PostQuantumC only consider classical attackers in proofs See more in [Song PQC14] Short vector Lattice L B? Crypto scheme Σ Quantum hard problem Π A breaks Encryption? Assume attacker A breaks scheme Σ, à Construct B from A solving hard problem Π. 21

22 I. Difficulty of quantum rewinding Rewinding argument Take snapshot of an adversary & continue Later rewind & restart from snapshot Rewinding quantum adversary difficult Cannot copy unknown quantum state Information gain à disturbance on state B A A Only special cases possible g èquantum security of many classical protocols unclear Not often seen in PQC literature? Usually does not affect analysis of encryption, signature, But does matter: e.g. Quantum-secure Identification scheme (to get signature by Fiat-Shamir)? g [Watrous09] 22

23 II. Hash function: common heuristic fails? Hash functions are everywhere: Signature, message authentication, key derivation, bitcoin, The Random Oracle (RO) heuristic widely used Lazy sampling: decide H on-the-fly Program RO: change H( ) adaptively Ease security proof of hash-based schemes (otherwise impossible) Quantum-accessible Random Oracle Nothing appears to work A lot exciting developement restoring classical proofs x H(x) Hash Function H Σ c x Σ c x H x 23

24 III. Quantum attacking symmetric crypto 3-round Feistel Cipher CBC-MAC Broken!? [KM10] [KLL+16] [SS 16] Simon s Problem HSP on Z T O Easy on a quantum computer These attacks need specific* quantum model Assume attackers have QUANTUM access to the SECRET enc/auth algorithm * In my opinion unrealistic but still possible Quantum random oracle is more justified Hash functions are public, any (quantum) user can implement it quantumly 24

25 Concluding Remarks How does cryptography change in a quantum world? Post-Quantum Cryptography Hard problems broken Construct on new problems Security framework fail Analyze Security against quantum adv Need more study on (quantum) hardness Quantum Cryptography Possible complement Be aware and cautious! Many issues unclear 25

26 I m hiring 2-3 PhD students to work on Quantum algorithms Analyzing quantum security of classical crypto Quantum crypto Maybe 1 Post-doc too Get in touch if interested Check my webpage for more: fangsong.info fang.song@pdx.edu Young but strong in Programming language, machine learning, vision, Portland is absolutely nice in many ways~ Thank you! 26