Quantum computers will break today's most popular public-key cryptographic systems, including RSA, DSA, and ECDSA. This book introduces the reader to the next generation of cryptographic algorithms, the systems that resist quantum-computer attacks: in particular, post-quantum public-key encryption systems and post-quantum public-key signature systems. Leading experts have joined forces for the first time to explain the state of the art in quantum computing, hash-based cryptography, code-based cryptography, lattice-based cryptography, and multivariate cryptography. Mathematical foundations and implementation issues are included. This book is an essential resource for students and researchers who want to contribute to the field of post-quantum cryptography.

Post-quantum cryptography

We present new candidates for quantum-resistant public-key cryptosystems based on the conjectured difficulty of finding isogenies between supersingular elliptic curves. The main technical idea in our scheme is that we transmit the images of torsion bases under the isogeny in order to allow the two parties to arrive at a common shared key despite the noncommutativity of the endomorphism ring. Our work is motivated by the recent development of a subexponential-time quantum algorithm for constructing isogenies between ordinary elliptic curves. In the supersingular case, by contrast, the fastest known quantum attack remains exponential, since the noncommutativity of the endomorphism ring means that the approach used in the ordinary case does not apply. We give a precise formulation of the necessary computational assumption along with a discussion of its validity. In addition, we present implementation results showing that our protocols are multiple orders of magnitude faster than previous isogeny-based cryptosystems over ordinary curves.

/pdf/towards-quantum-resistant-cryptosystems-from-supersingular-3i2d4br24h.pdf

Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies

Quantum computers will break today's most popular public-key cryptographic systems, including RSA, DSA, and ECDSA This book introduces the reader to the next generation of cryptographic algorithms, the systems that resist quantum-computer attacks: in particular, post-quantum public-key encryption systems and post-quantum public-key signature systems Leading experts have joined forces for the first time to explain the state of the art in quantum computing, hash-based cryptography, code-based cryptography, lattice-based cryptography, and multivariate cryptography Mathematical foundations and implementation issues are included This book is an essential resource for students and researchers who want to contribute to the field of post-quantum cryptography

/pdf/post-quantum-cryptography-c7g8371i5w.pdf

Post Quantum Cryptography

This paper shows that a $390 mass-market quad-core 2.4GHz Intel Westmere (Xeon E5620) CPU can create 109000 signatures per second and verify 71000 signatures per second on an elliptic curve at a 2128 security level. Public keys are 32 bytes, and signatures are 64 bytes. These performance figures include strong defenses against software side-channel attacks: there is no data flow from secret keys to array indices, and there is no data flow from secret keys to branch conditions.

https://link.springer.com/content/pdf/10.1007%2Fs13389-012-0027-1.pdf

High-speed high-security signatures

An argument system for NP is a proof system that allows efficient verification of NP statements, given proofs produced by an untrusted yet computationally-bounded prover. Such a system is non-interactive and publicly-verifiable if, after a trusted party publishes a proving key and a verification key, anyone can use the proving key to generate non-interactive proofs for adaptively-chosen NP statements, and proofs can be verified by anyone by using the verification key.

/pdf/snarks-for-c-verifying-program-executions-succinctly-and-in-5gpviqjs3v.pdf

SNARKs for C : verifying program executions succinctly and in zero knowledge

This paper introduces "twisted Edwards curves," a generalization of the recently introduced Edwards curves; shows that twisted Edwards curves include more curves over finite fields, and in particular every elliptic curve in Montgomery form; shows how to cover even more curves via isogenies; presents fast explicit formulas for twisted Edwards curves in projective and inverted coordinates; and shows that twisted Edwards curves save time for many curves that were already expressible as Edwards curves.

/pdf/twisted-edwards-curves-2gee9kh9ad.pdf

Twisted Edwards curves

This paper presents several improvements to Stern's attack on the McEliece cryptosystem and achieves results considerably better than Canteaut et al. This paper shows that the system with the originally proposed parameters can be broken in just 1400 days by a single 2.4GHz Core 2 Quad CPU, or 7 days by a cluster of 200 CPUs. This attack has been implemented and is now in progress.

This paper proposes new parameters for the McEliece and Niederreiter cryptosystems achieving standard levels of security against all known attacks. The new parameters take account of the improved attack; the recent introduction of list decoding for binary Goppa codes; and the possibility of choosing code lengths that are not a power of 2. The resulting public-key sizes are considerably smaller than previous parameter choices for the same level of security.

/pdf/attacking-and-defending-the-mceliece-cryptosystem-1xnqm4iq5i.pdf

Attacking and Defending the McEliece Cryptosystem

This paper presents several improvements to Stern’s attack on the McEliece cryptosystem and achieves results considerably better than Canteaut et al. This paper shows that the system with the originally proposed parameters can be broken in just 1400 days by a single 2.4GHz Core 2 Quad CPU, or 7 days by a cluster of 200 CPUs. This attack has been implemented and is now in progress. This paper proposes new parameters for the McEliece and Niederreiter cryptosystems achieving standard levels of security against all known attacks. The new parameters take account of the improved attack; the recent introduction of list decoding for binary Goppa codes; and the possibility of choosing code lengths that are not a power of 2. The resulting public-key sizes are considerably smaller than previous parameter choices for the same level of security.

/pdf/attacking-and-defending-the-mceliece-cryptosystem-18wojdxeti.pdf

Attacking and defending the McEliece cryptosystem

The best known non-structural attacks against code-based cryptosystems are based on information-set decoding Stern's algorithm and its improvements are well optimized and the complexity is reasonably well understood However, these algorithms only handle codes over F2

This paper presents a generalization of Stern's information-set- decoding algorithm for decoding linear codes over arbitrary finite fields Fq and analyzes the complexity This result makes it possible to compute the security of recently proposed code-based systems over non-binary fields

As an illustration, ranges of parameters for generalized McEliece cryptosystems using classical Goppa codes over F31 are suggested for which the new information-set-decoding algorithm needs 2128 bit operations

Information-set decoding for linear codes over F q

Very few public-key cryptosystems are known that can encrypt and decrypt in time b2+o(1) with conjectured security level 2b against conventional computers and quantum computers. The oldest of these systems is the classic McEliece code-based cryptosystem.

The best attacks known against this system are generic decoding attacks that treat McEliece's hidden binary Goppa codes as random linear codes. A standard conjecture is that the best possible w-error-decoding attacks against random linear codes of dimension k and length n take time 2(α(R, W)+o(1))n if k/n → R and w/n → W as n → ∞.

Before this paper, the best upper bound known on the exponent α(R, W) was the exponent of an attack introduced by Stern in 1989. This paper introduces "ball-collision decoding" and shows that it has a smaller exponent for each (R, W): the speedup from Stern's algorithm to ball-collision decoding is exponential in n.

/pdf/smaller-decoding-exponents-ball-collision-decoding-19p5p2iw2p.pdf

Christiane Peters

Papers

Twisted Edwards curves

Attacking and Defending the McEliece Cryptosystem

Attacking and defending the McEliece cryptosystem

Information-set decoding for linear codes over F q

Smaller decoding exponents: ball-collision decoding