Postquantum Cryptography: what, why, and how? SIMBA Enric Florit - PowerPoint PPT Presentation

. . . . . . . . . . . . . . . . . Postquantum Cryptography: what, why, and how? SIMBA Enric Florit Zacarías . . . . . . . . . . . . . . . . . . . . . . . November 27, 2019

. . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH . . . . . . . . . . . . . . . . . . . . . . . . . . 2 / 35

. . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Public-key cryptography Imagine Alice and Bob want to communicate through a channel, but they’ve never met before. How can they agree on a secret key to encrypt their communications, using e.g. AES? . . . . . . . . . . . . . . . . . . . . . . . . . . 3 / 35

. . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Public-key cryptography Imagine Alice and Bob want to communicate through a channel, but they’ve never met before. How can they agree on a secret key to encrypt their communications, using e.g. AES? . . . . . . . . . . . . . . . . . . . . . . . . . . 3 / 35

. Diffje and Hellman (1976) . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Alice chooses a private key 1 . a p , and publishes A a p . Bob chooses a private key 1 b p , and publishes B b p . They may use the shared secret A b B a ab p . . . . . . . . . . . . . . . . . . 4 / 35 . . . . . . . . . . . . . . Use the group ( Z / p Z ) × = ⟨ α ⟩ .

. What? Postquantum Cryptography . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP How? Isogenies and SIDH . References Diffje and Hellman (1976) Bob chooses a private key 1 b p , and publishes B b p . They may use the shared secret A b B a ab p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 / 35 Use the group ( Z / p Z ) × = ⟨ α ⟩ . Alice chooses a private key 1 < a < p , and publishes A = α a mod p .

. . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Diffje and Hellman (1976) They may use the shared secret A b B a ab p . . . . . . . . . . . . . . . . . . . . . . 4 / 35 . . . . . Use the group ( Z / p Z ) × = ⟨ α ⟩ . Alice chooses a private key 1 < a < p , and publishes A = α a mod p . Bob chooses a private key 1 < b < p , and publishes B = α b mod p .

. . . . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Diffje and Hellman (1976) . . . . . . . . . . . . . . . . . . . . . . . . 4 / 35 Use the group ( Z / p Z ) × = ⟨ α ⟩ . Alice chooses a private key 1 < a < p , and publishes A = α a mod p . Bob chooses a private key 1 < b < p , and publishes B = α b mod p . They may use the shared secret A b ≡ B a ≡ α ab mod p .

. Why? Solving the DLP . . . . . . . . . . Introduction: Diffje-Hellman What? Postquantum Cryptography . How? Isogenies and SIDH References Computational problems Problem (Discrete Logarithm - DLP) Problem (Diffje-Hellman - DHP) Given a cyclic group G and elements a , b G, fjnd ab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 / 35 Given a cyclic group G = ⟨ α ⟩ and an element β ∈ G, fjnd x ∈ Z such that β = α x .

. . . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Computational problems Problem (Discrete Logarithm - DLP) Problem (Diffje-Hellman - DHP) . . . . . . . . . . . . . . . . . . . . . . . . . 5 / 35 Given a cyclic group G = ⟨ α ⟩ and an element β ∈ G, fjnd x ∈ Z such that β = α x . Given a cyclic group G = ⟨ α ⟩ and elements α a , α b ∈ G, fjnd α ab .

. . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH . . . . . . . . . . . . . . . . . . . . . . . . . . 6 / 35

. . . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Why? Solving the DLP Let’s see some algorithms to solve for discrete logarithms! Problem (Discrete Logarithm - DLP) . . . . . . . . . . . . . . . . . . . . . . . . . 7 / 35 Given a cyclic group G = ⟨ α ⟩ and an element β ∈ G, fjnd x ∈ Z such that β = α x .

b and x . 1. Compute and store . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Baby step – giant step b , for 0 . b m . 2. Compute am , for 0 a m , and check for a match am b . 3. If so, am am b . . . . . . . . . . . . . . . . . . . 8 / 35 . . . . . . . . . . . . . . √ Let m > N be an integer. Then for every x ≤ N , x = am + b , with 0 ≤ a , b < m .

b and x . How? Isogenies and SIDH . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography References . Baby step – giant step 2. Compute am , for 0 a m , and check for a match am b . 3. If so, am am b . . . . . . . . . . . . . . . . . 8 / 35 . . . . . . . . . . . . . . √ Let m > N be an integer. Then for every x ≤ N , x = am + b , with 0 ≤ a , b < m . 1. Compute and store α b , for 0 ≤ b < m .

b and x . . . . . . . . . . . Introduction: Diffje-Hellman . . Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Baby step – giant step 3. If so, am am b . . . . . . . . . . . . . . . . . . . . . . . 8 / 35 . . . . . √ Let m > N be an integer. Then for every x ≤ N , x = am + b , with 0 ≤ a , b < m . 1. Compute and store α b , for 0 ≤ b < m . 2. Compute βα − am , for 0 ≤ a < m , and check for a match βα − am = α b .

. . . . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Baby step – giant step . . . . . . . . . . . . . . . . . . . . . . . . 8 / 35 √ Let m > N be an integer. Then for every x ≤ N , x = am + b , with 0 ≤ a , b < m . 1. Compute and store α b , for 0 ≤ b < m . 2. Compute βα − am , for 0 ≤ a < m , and check for a match βα − am = α b . 3. If so, β = α am + b and x = am + b .

N p e has order p e , and If p e . What? Postquantum Cryptography . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP References How? Isogenies and SIDH . Pohlig-Hellman Then use the Chinese Remainder Theorem to combine the information. N , then N p e N p e x . We can compute x p e ! *Only useful if N is smooth (all prime factors are small). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 / 35 Idea: factor N = ∏ r i , and obtain x mod p e i i = 1 p e i i for each i .

. . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Pohlig-Hellman Then use the Chinese Remainder Theorem to combine the information. *Only useful if N is smooth (all prime factors are small). . . . . . . . . . . . . . . . . . . . . . 9 / 35 . . . . . Idea: factor N = ∏ r i , and obtain x mod p e i i = 1 p e i i for each i . If p e | N , then α N / p e has order p e , and β N / p e = ( α N / p e ) x . We can compute x mod p e !

. . . . . . . . . . . . . . Introduction: Diffje-Hellman Why? Solving the DLP What? Postquantum Cryptography How? Isogenies and SIDH References Pohlig-Hellman Then use the Chinese Remainder Theorem to combine the information. *Only useful if N is smooth (all prime factors are small). . . . . . . . . . . . . . . . . . . . . . 9 / 35 . . . . . Idea: factor N = ∏ r i , and obtain x mod p e i i = 1 p e i i for each i . If p e | N , then α N / p e has order p e , and β N / p e = ( α N / p e ) x . We can compute x mod p e !

compute the integer y i for which g i 1 g e i i . . 1. Choose a factor base y i . we will . For each g i Index calculus k References How? Isogenies and SIDH What? Postquantum Cryptography Why? Solving the DLP Introduction: Diffje-Hellman . . 2. Find a relation of the form i t . 3. The discrete logarithm will be x t i 1 e i g i k t i 1 e i y i k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 / 35 It applies to fjnite fjelds: Z / p Z and F p r .