Post-Quantum Cryptography Johannes Buchmann and Nina Bindel - - PowerPoint PPT Presentation

▶
post quantum cryptography
SMART_READER_LITE
LIVE PREVIEW

Post-Quantum Cryptography Johannes Buchmann and Nina Bindel - - PowerPoint PPT Presentation

Jun 02, 2023 278 likes •896 views

Post-Quantum Cryptography Johannes Buchmann and Nina Bindel 16.01.2015 | 1 Public-key cryptography 16.01.2015 | 2 Public-key encryption plaintext plaintext encrypt decrypt ciphertext public secret 16.01.2015 | 3 Digital signatures

slide-1
SLIDE 1

16.01.2015 | 1

Johannes Buchmann and Nina Bindel

Post-Quantum Cryptography

slide-2
SLIDE 2

16.01.2015 | 2

Public-key cryptography

slide-3
SLIDE 3

16.01.2015 | 3

Public-key encryption

ciphertext

secret decrypt encrypt public plaintext plaintext

slide-4
SLIDE 4

16.01.2015 | 4

Digital signatures

document signature valid / invalid

public verify sign secret

slide-5
SLIDE 5

16.01.2015 | 5

IT-security requires public-key cryptography

slide-6
SLIDE 6

16.01.2015 | 6

TLS

TLS

Billions daily!

public-key encryption digital signatures

slide-7
SLIDE 7

16.01.2015 | 7

Software downloads

digital signatures

slide-8
SLIDE 8

16.01.2015 | 8

Number of worldwide downloads from Apple App Store July 2008 - October 2014 (in billions)

0,01 0,1 1 1,5 3 4 5 6,5 7 10 14 15 18 25 30 35 40 50 60 70 75 85 10 20 30 40 50 60 70 80 90 Jul '08 Sep '08 Apr '09 Jul '09 Jan '10 April '10 June '10 Sep '10 Oct '10 Jan '11 Jun '11 Jul '11 Okt '11 Mar '12 Jun '12 Oct '12 Jan '13 May '13 Oct '13 Apr '14 Jun '14 Oct '14 Downloads (in billions)

Source: Apple

slide-9
SLIDE 9

16.01.2015 | 9

Current public-key cryptography

slide-10
SLIDE 10

16.01.2015 | 10

“Generic” RSA Public key: finite Group G, exponent e, gcd e, G 1 Secret key: |G| Allows to compute: g

  • g ||, g ∈ G
slide-11
SLIDE 11

16.01.2015 | 11

“Generic” RSA encryption Public key: finite Group G, exponent e, gcd e, G 1 Secret key: |G| Allows to compute: g

  • g ||, g ∈ G

decrypt ciphertext s g s

  • plaintext

g encrypt s g

,e

plaintext g

slide-12
SLIDE 12

16.01.2015 | 12

“Generic” RSA signature Public key: finite Group G, exponent e, gcd e, G 1 Secret key: |G| Allows to compute: g

  • g ||, g ∈ G

Hash function h: 0,1∗→ G

verify signature s s ? hd document d sign s hd

  • valid /

invalid

slide-13
SLIDE 13

16.01.2015 | 13

RSA: How to keep || secret? Public key: e, p, q primes, n pq, G /n∗ Secret key: G p 1 q 1 relies on hardness of integer factorization

  • nly known method to keep |G| secret
slide-14
SLIDE 14

16.01.2015 | 14

Factorization complexity

L u v e

n v n n

u u

[ , ]

(log ) (log log )(

)

 1

Ln [0,v] = (log n)v polynomial Ln [1,v] = (elog n)v exponential

slide-15
SLIDE 15

16.01.2015 | 15

Factorization progress

Elliptic Curve Method

1985

Quadratic Sieve L1/2,1 o 1

1984

Number Field Sieve L1/3, 64/9

  • ]

1988

RSA-120 (QS)

1993

RSA-130 (NFS)

1996

RSA-576 (NFS)

2003

RSA-768 (NFS)

2009 1994

Shor algorithm L0, v] 21061 − 1 (NFS)

2012

slide-16
SLIDE 16

16.01.2015 | 16

ElGamal encryption and signatures

Rely on Discrete Logarithm Problem: Given: Group G g , h ∈ G Find: x ∈ with h g Choices for G: -GFp∗

  • group of points of elliptic curves over GFp
slide-17
SLIDE 17

16.01.2015 | 17

Algorithms for solving ∗-DL

Pollard Rho L_n1, v]

1975 1994

Number Field Sieve L1/3, 64/9

  • ]

2014

Shor algorithm L0, v]

1992 2013

GF(2·)

GF(3·) GF(3·)

2012

Joux

L_n1/4, v]

slide-18
SLIDE 18

16.01.2015 | 18

Algorithms for solving EC-DL

1975

ECC-p-79

1997 1994

ECC-2-109

2004

ECC-p-109

2002

Secp112r1

2009

Pollard Rho L1, v] Shor algorithm L0, v] ECC2K-113

2014

ECC2K-108

2000

slide-19
SLIDE 19

16.01.2015 | 19

The quantum computer threat

slide-20
SLIDE 20

16.01.2015 | 20

Shor’s algorithm 1997

RSA and ElGamal insecure

slide-21
SLIDE 21

16.01.2015 | 21

Quantum computer realistic?

slide-22
SLIDE 22

16.01.2015 | 22

Quantum computer realistic

slide-23
SLIDE 23

16.01.2015 | 23

slide-24
SLIDE 24

16.01.2015 | 24

Post-quantum cryptography

slide-25
SLIDE 25

16.01.2015 | 25

Performance requirements

Secure until Security level RSA modulus/finite field size Elliptic curve 2015 80 1248 160 2025 96 1776 192 2030 112 2493 224 2040 128 3248 256

  • Space for keys and signatures: a few kilobytes
  • Small ciphertext expansion
  • Times: milliseconds

Ecrypt recommendations

slide-26
SLIDE 26

16.01.2015 | 26

Post-quantum problems?

No provable quantum resistence

NP

NP‐complete

P

Factoring

BQP

Bounded-Error Quantum Polynomial-Time

We must look here

slide-27
SLIDE 27

16.01.2015 | 27

Candidates

  • Solving non-linear equation systems
  • ver finite fields
  • Bounded distance decoding over

finite fields

  • Short and close lattice vectors
  • Breaking cryptographic hash

functions

  • Quantum key exchange

NP

NP‐complete

P

Factoring

BQP

slide-28
SLIDE 28

16.01.2015 | 28

Strategy

Crypto scheme Quantum resistant problem parameter set instance hardness Security level Assess Optimize performance 1 2 3 4

slide-29
SLIDE 29

16.01.2015 | 29

Multivariate cryptography

slide-30
SLIDE 30

16.01.2015 | 30

MQ problem

4x x yz ≡ 1 mod 13 7y 2xz ≡ 12 mod 13 x y 12xz ≡ 4 mod 13 Solution: x 15, y 29, z 45

slide-31
SLIDE 31

16.01.2015 | 31

MQ-Problem

Given:

n, m, p, … , p ∈ F x, … , x quadratic, F finite field

Find:

y, … , y ∈ F, such that p y, … , y … p y, … , y 0

MP is NP-complete (Garey, Johnson 1979) (decision version)

slide-32
SLIDE 32

16.01.2015 | 32

Multivariate signatures

P: F → F, easily invertible non-linear S: F → F, T: F → F, affine linear Public key: G S◦P◦T, hard to invert Secret Key: S, P,T allows to compute G T◦P◦S Signing: s T◦P◦Sm Verifying: Gs ? m Forging signature: Solve G s m 0

Fast Large keys: 100 kBit for 100 bit security Compared to 1776 bit RSA modulus

  • UOV , Goubin et al., 1999
  • Rainbow, Ding, et al. 2005
  • pFlash, Cheng, 2007
  • Gui, Ding, Petzoldt, 2015
slide-33
SLIDE 33

16.01.2015 | 33

Code-based cryptography

slide-34
SLIDE 34

16.01.2015 | 34

BDD is NP-complete (Berlekamp et al. 1978) (Decisional version)

Bounded distance decoding problem

  • Linear code C ⊆ F
  • y ∈ F
  • t ∈

Given: Find:

  • x ∈ C: distx, y t
slide-35
SLIDE 35

16.01.2015 | 35

McEliece cryptosystem (1978)

S, G, P matrices over F G generator matrix for Goppa code Public key: G′ S◦G◦P, t Secret Key: P, S, G Encryption: c mG z ∈ F Decryption: x cP mSG zP solve BDD to get y mSG decode to obtain m

Allows to solve BDD Fast Large public keys! 500 kBits for 100 bit security Compared to 1776 bit RSA modulus IND-CPA secure version

slide-36
SLIDE 36

16.01.2015 | 36

Lattice-based cryptography

slide-37
SLIDE 37

16.01.2015 | 37

Why lattice-based cryptography?

  • Expected to resist quantum computer attacks
  • Worst-to-average-case reduction
  • Permits fully homomorphic encryption
slide-38
SLIDE 38

16.01.2015 | 38

Lattice problems

n ∈ , L b ⋯ b ⊆ n lattice; B = (b1, …, bn) basis

  • Shortest Vector Problem (SVP)

Given: α 1, lattice L LB basis B Find: v ∈ L nonzero such that | v | αλL

  • Closest Vector Problem (CVP)

Given: α 1, lattice L LB basis B, t Find: v ∈ L such that t v α min∈| t w |

slide-39
SLIDE 39

16.01.2015 | 39

2-dimensional αCVP

b2 b1 t CVt

Given: B b, b , t, α Find: CV t ∈ L B : t CV t α min ||t w||

w ∈ L

slide-40
SLIDE 40

16.01.2015 | 40

Complexity of -CVP

 n

Arora et al. (1997):

 

c n

c

all for hard

  • NP

is CVP

  • log

hard

  • NP

Goldreich, Goldwasser (2000):

 

 

AM AM coNP coNP  

  • r

hard

  • NP

not is CVP

  • log

/ n n

hard

  • NP

not

slide-41
SLIDE 41

16.01.2015 | 41

Practical complexity http://www.latticechallenge.org/

slide-42
SLIDE 42

16.01.2015 | 42

The idea of lattice-based cryptography

  • GGH Sign 1995
  • NTRU Encrypt 1996
  • NTRU Sign 2003
slide-43
SLIDE 43

16.01.2015 | 43

Reduced bases (Gauß 1801)

b b 1 2 b

slide-44
SLIDE 44

16.01.2015 | 44

, reduced ⇒ CVP easy

b2 b1

t xb xb CV t x1b x2 b

CVt t

slide-45
SLIDE 45

16.01.2015 | 45

, not reduced ⇒ CVP hard

L = 2, B = ( 1 0 , 0 1 , t 3.4 2.3 , CVPt 3 2 Another basis B’ = ( 100 99 , 99 98 ) t = 3.4 2.3 = −560.9 · 100 99 + 566.6 · 99 98 −561 · 100 99 + 567 · 99 98 = 33 27 3 2 = CVPt

slide-46
SLIDE 46

16.01.2015 | 46

Key generation

Key generation: n ∈ , L ⊆ n lattice Secret key: „reduced“ basis B of L. (Allows to efficiently solve CVP.) Public key: „bad” basis B’ of L. (Does not.)

slide-47
SLIDE 47

16.01.2015 | 47

Public-key encryption

Plaintext v ∈ L Encryption(public key, v)

  • small e ∈ n
  • ciphertext w v e

Decryption(secret key, w): ‐ v CVw

w e v

slide-48
SLIDE 48

16.01.2015 | 48

Public: Cryptographic hash function h: 0,1 → n

Digital signature

w v

w hd Sign(secret key, document d): v CVw Verify(public key, v, w): v close to w ?

slide-49
SLIDE 49

16.01.2015 | 49

Learning the secret key

Nguyen and Regev 2006 NTRU-251 broken using ≈ 400 signatures GGH-400 broken using ≈ 160.000 signatures

s2 s1 s1 s3 s4

slide-50
SLIDE 50

16.01.2015 | 50

Performance

  • NTRU encrypt 1996: fast and small

The provable schemes to be studied more

  • Bliss 2013 and Bai/Galbraith 2014 signature with

improvements of Bindel: fast but large signatures

  • Lindner, Peikert 2010 encryption with improvements of

Göpfert: fast but ciphertext expansion

slide-51
SLIDE 51

16.01.2015 | 51

Hash-based signatures

slide-52
SLIDE 52

16.01.2015 | 52

Trapdoor one-way function Digital signature scheme Collision resistant hash function

Typical construction

slide-53
SLIDE 53

16.01.2015 | 53

Trapdoor one-way functions hard to construct but not required

One-way FF

Naor, Yung 1989 Rompel 1990

Digital signature scheme

slide-54
SLIDE 54

16.01.2015 | 54

XMSS signature

JB, Coronado, Dahmen, Hülsing

One-way FF XMSS Pseudorandom FF Second-preimage resistant HFF

  • Based on Merkle signature scheme
  • Has minimal security requirements
slide-55
SLIDE 55

16.01.2015 | 55

Cryptographic HFF XMSS Pseudorandom FF Second-preimage resistant HFF

XMSS in practice

Trapdoor one-way function DL RSA MP-Sign Block Cipher

slide-56
SLIDE 56

16.01.2015 | 56

AES Blowfish 3DES Twofish Threefish Serpent IDEA RC5 RC6 …

Hash functions & Blockciphers

SHA-2 SHA-3 BLAKE Grøstl JH Keccak Skein VSH MCH MSCQ SWIFFTX RFSB …

slide-57
SLIDE 57

16.01.2015 | 57

XMSS performance

slide-58
SLIDE 58

16.01.2015 | 58

XMSS transfer project

Denis Butin, Stefan Gazdag

http://www.square-up.org/

slide-59
SLIDE 59

16.01.2015 | 59

Conclusion

slide-60
SLIDE 60

16.01.2015 | 60

Todos

  • Standardize and integrate into standard applications: XMSS + NTRU-

Encrypt/McEliece

  • Provide/optimize security proofs
  • Study computational problems in the presence of modern computing architectures
  • > parameter selection
  • Optimize schemes for secure parameters - consider side channels.
  • Integrate with quantum key exchange.

http://www.crossing.tu-darmstadt.de

slide-61
SLIDE 61

16.01.2015 | 61