DOCSLIB.ORG

The Quantum Menace: an Analysis of Postquantum TLS

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The Quantum Menace: an Analysis of Postquantum TLS The Quantum Menace: An Analysis of Postquantum TLS Collin Berman Reid Bixler [email protected] [email protected] Abstract key exchange allows for the two users to initi- ate a channel of communication and securely talk With the introduction of quantum comput- with one another. The authentication allows for ing, the inherent security of the TLS pro- proving that users are who they say that they are. tocol becomes endangered. Risks of los- While TLS is considered secure by todays stan- ing the privacy and integrity of communi- dards, there are actually some risks that most ei- cations over the internet are too great to ther do not realize or do not care about. That is, not consider preventative measures against the Quantum Menace. With the introduction of quantum attacks. We look at the current quantum computing, the inherent security of many key exchange protocol for TLS to deter- widespread algorithms is at risk of being broken. mine the flaws caused by quantum com- Specifically for TLS, things such as ECDH, RSA, puters. Our research focuses on analysing and DSA can be brute forced with much better ef- current alternatives that are quantum se- ficiency with a quantum algorithm known as Shors cure as well as other cryptographic meth- Algorithm. Luckily enough, quantum comput- ods that have not yet been considered for a ers are still in their early stages and some sug- post-quantum TLS. We offer final recom- gest that quantum computers will never be pow- mendations on where the TLS community erful enough to break our current level cryptogra- should go from now in order to mitigate phy. However, because we as security researchers the risk of the quantum menace. would rather focus on proactive measures rather than reactive ones, we want to find alternatives be- 1 Introduction fore there is capable quantum computing. The primary goal of the TLS protocol is to provide Specifically, we are going to focus on finding privacy and data integrity between two communi- solutions for key exchange rather than authenti- cating applications (Dierks and Rescorla, 2008). cation, because a broken key exchange allows for With TLS, clients and servers are able to securely attackers to read past communications. In terms communicate with one another with little to no of security of the communication over the inter- risk of having a third party read or alter their mes- net, focusing on privacy is more essential than data sages. TLS is used widely across the internet and integrity. In this paper, we go about analyzing a is essentially the defacto standard for secure com- number of post-quantum secure TLS implementa- munications, often even being implemented into tions as well as potential alternative cryptographic applications where an alternative protocol may be methods that have not yet been implemented into more useful. In order of priority, the makers of TLS. We finalize this analysis with a comparison TLS desire cryptographic security, interoperabil- between post-quantum TLS methods in order to ity, extensibility, and relative efficiency. The secu- determine where the security community should rity behind TLS is based off of a number of secure be heading towards. algorithms based off of hashing, symmetric cryp- 2 Post Quantum Computing tography, prime-factorization, elliptic curves, and other cryptographic methods. Quantum computing is slowly gaining traction Notably, there are essentially two portions of since it was theorized in 1982 by Richard Feyn- the TLS protocol that use these algorithms for man. It relies on quantum principles and super po- either key exchange or for authentication. The sitioning of particles to perform computational op- erations significantly faster than classical comput- on the number of signatures that can exist for a ers (Feynman, 1982). There already exist quan- generated key, even with the existence of loga- tum algorithms, which use quantum logic gates rithmically scaling Merkle trees. Also, with hash- to solve problems that were once thought com- ing, we can turn one-time hashing into multiple by putationally unsolvable. One of these algorithms, adding new public keys in each message, which is Shor’s Algorithm, is able to easily determine the also known as chaining. By doing this, the signa- prime factors of a large number (i.e. integer fac- ture of the nth message includes all n-1 previous torization) within a polynomial time (Shor, 1999). signed messages. With Merkle Trees, it is possi- Before this algorithm, integer factorization was ble to have provable reductions that say that the considered non-polynomial, also known as NP, security of the single-signing function will be the such that given a NP problem, one could verify its same security as the tree. One of the potential solutions quickly but it could not be solved within drawbacks of hashing is the fact that over time, a reasonable time, often taking longer than the ex- researchers will eventually find ways to produce pected lifespan of the universe to solve (Ladner, collisions, which can map two different inputs to 1975). This is a major problem for the security the same output. This is why the security commu- of many of today’s technologies which rely on the nity often is always looking for a new and better hardness of prime factorization. hash function. While quantum computers are only in their in- 2.2 Code-Based Cryptography fantile stage, the potential security risks behind broken encryption schemes from quantum algo- The methods often considered with code-based rithms would be unfathomable in today’s world. cryptography is McEliece and Niederreiter. With If anybody were able to obtain a quantum com- these, the public key is made up of a dt x n ma- puter capable of performing significant computa- trix K and a message m is encrypted by multiply- tions, breaking into many secure systems would ing this matrix K by m. The receiver will receive be completely feasible. As mentioned earlier, TLS a Hidden Goppa code to decrypt this message. uses ECDH, RSA, and DSA for the key exchange These cryptographic systems have extremely ef- protocol in TLS, to name a few. ECDH is reliant ficient key generation, encryption, and decryption. on elliptic curve cryptography, which requires low However, often the problem is the very long public computing power for implementation but massive keys required. amounts to brute force an attempt to break it. 2.3 Lattice-Based Cryptography However, a modified Shor’s algorithm could no- tably decrease the computational requirement for Lattices have gotten a lot of attention from the a brute force attempt (Sullivan, 2013). With a postquantum community and a majority of cur- working quantum computer capable of significant rent quantum-secure systems are done with lattice computation, any current and previous TLS com- cryptosystems. Lattices are reliant on the Short- munications could be viewed by attacking the key est Vector Problem and the Closest Vector Prob- exchange protocol. lem, which have not yet been reduced to a polyno- However, there still exist a number of mial time to break. There are a number of different cryptographic systems that are actually se- methods including NTRU, LWE, and BLISS. cure against quantum attacks. These include: 2.4 Multivariate-Quadratic-Equations hash-based cryptography, code-based cryptog- Cryptography raphy, lattice-based cryptography, multivariate- quadratic-equations cryptography, and secret-key These rely on a sequence of polynomials and vari- cryptography. ables with coefficients. Each polynomial is re- quired to have a degree of at most 2, with no squared terms. Its possible to verify these signa- 2.1 Hash-Based Cryptography tures with a standard hash function, which will With hashing, when given an input x there will be result in shorter public keys. There are quite a an output y that should not be able to easily go number of current methods including: Rainbow, back to find x. Before the interest in postquan- Hidden Field Equations (HFE), and UOV Cryp- tum security, many researchers didnt focus much tosystems. One of the major problems with these on hash-based cryptography because of the limit systems is that, while efficient, the security is not fully understood and new attacks are found on a Hiltgen, Vaudenay, and Vaugnoux (Canvel et al., regular basis. 2003) were able to intercept passwords in a TLS channel by measuring differences in timing arising 2.5 Secret-Key Cryptography from whether or not a forged message authentica- Otherwise known as symmetric cryptography, tion code (MAC) is valid. This attack was possi- this uses either Stream Ciphers or Block Ci- ble even though Krawczyk (Krawczyk, 2001) had phers. These cryptosystems are widely used proven that the way MACs are validated is secure. and implemented including: Twofish, Serpent, Due to the effectiveness of these attacks, we AES (Rijndael), Blowfish, CAST5, Kuznyechik, only consider a protocol to be ready for TLS RC4, 3DES, Skipjack, Safer+/++ (Bluetooth), deployment if it has been implementing to be and IDEA. There already exist some symmet- resistant to timing attacks. Programmers typi- ric key management systems like Kerberos and cally achieve protection against timing attacks by 3GPP, which offers the benefit of already being writing constant-time programs, that is, programs widespread. whose runtime do not depend on secret day. This involves avoiding branching on secret data as de- 3 PQC in TLS scribed above, but also requires avoiding mem- 3.1 TLS Specifics ory accesses based on secret data, since recently- accessed data stored in the cache can be read faster Although many post-quantum cryptosystems have than data from main memory (Bernstein, 2005). been proposed by researchers, not all are ready for widespread deployment. Cryptographic software 4 Current Implementations needs to be carefully written to avoid so called side-channel attacks, which can introduce vulner- In this section we investigate post-quantum cryp- abilities into an otherwise secure protocol.
Load more

Recommended publications
  • Lectures on the NTRU Encryption Algorithm and Digital Signature Scheme: Grenoble, June 2002
    Lectures on the NTRU encryption algorithm and digital signature scheme: Grenoble, June 2002 J. Pipher Brown University, Providence RI 02912 1 Lecture 1 1.1 Integer lattices Lattices have been studied by cryptographers for quite some time, in both the field of cryptanalysis (see for example [16{18]) and as a source of hard problems on which to build encryption schemes (see [1, 8, 9]). In this lecture, we describe the NTRU encryption algorithm, and the lattice problems on which this is based. We begin with some definitions and a brief overview of lattices. If a ; a ; :::; a are n independent vectors in Rm, n m, then the 1 2 n ≤ integer lattice with these vectors as basis is the set = n x a : x L f 1 i i i 2 Z . A lattice is often represented as matrix A whose rows are the basis g P vectors a1; :::; an. The elements of the lattice are simply the vectors of the form vT A, which denotes the usual matrix multiplication. We will specialize for now to the situation when the rank of the lattice and the dimension are the same (n = m). The determinant of a lattice det( ) is the volume of the fundamen- L tal parallelepiped spanned by the basis vectors. By the Gram-Schmidt process, one can obtain a basis for the vector space generated by , and L the det( ) will just be the product of these orthogonal vectors. Note that L these vectors are not a basis for as a lattice, since will not usually L L possess an orthogonal basis.
    [Show full text]
  • NTRU Cryptosystem: Recent Developments and Emerging Mathematical Problems in Finite Polynomial Rings
    XXXX, 1–33 © De Gruyter YYYY NTRU Cryptosystem: Recent Developments and Emerging Mathematical Problems in Finite Polynomial Rings Ron Steinfeld Abstract. The NTRU public-key cryptosystem, proposed in 1996 by Hoffstein, Pipher and Silverman, is a fast and practical alternative to classical schemes based on factorization or discrete logarithms. In contrast to the latter schemes, it offers quasi-optimal asymptotic effi- ciency and conjectured security against quantum computing attacks. The scheme is defined over finite polynomial rings, and its security analysis involves the study of natural statistical and computational problems defined over these rings. We survey several recent developments in both the security analysis and in the applica- tions of NTRU and its variants, within the broader field of lattice-based cryptography. These developments include a provable relation between the security of NTRU and the computa- tional hardness of worst-case instances of certain lattice problems, and the construction of fully homomorphic and multilinear cryptographic algorithms. In the process, we identify the underlying statistical and computational problems in finite rings. Keywords. NTRU Cryptosystem, lattice-based cryptography, fully homomorphic encryption, multilinear maps. AMS classification. 68Q17, 68Q87, 68Q12, 11T55, 11T71, 11T22. 1 Introduction The NTRU public-key cryptosystem has attracted much attention by the cryptographic community since its introduction in 1996 by Hoffstein, Pipher and Silverman [32, 33]. Unlike more classical public-key cryptosystems based on the hardness of integer factorisation or the discrete logarithm over finite fields and elliptic curves, NTRU is based on the hardness of finding ‘small’ solutions to systems of linear equations over polynomial rings, and as a consequence is closely related to geometric problems on certain classes of high-dimensional Euclidean lattices.
    [Show full text]
  • Performance Evaluation of RSA and NTRU Over GPU with Maxwell and Pascal Architecture
    Performance Evaluation of RSA and NTRU over GPU with Maxwell and Pascal Architecture Xian-Fu Wong1, Bok-Min Goi1, Wai-Kong Lee2, and Raphael C.-W. Phan3 1Lee Kong Chian Faculty of and Engineering and Science, Universiti Tunku Abdul Rahman, Sungai Long, Malaysia 2Faculty of Information and Communication Technology, Universiti Tunku Abdul Rahman, Kampar, Malaysia 3Faculty of Engineering, Multimedia University, Cyberjaya, Malaysia E-mail: [email protected]; {goibm; wklee}@utar.edu.my; [email protected] Received 2 September 2017; Accepted 22 October 2017; Publication 20 November 2017 Abstract Public key cryptography important in protecting the key exchange between two parties for secure mobile and wireless communication. RSA is one of the most widely used public key cryptographic algorithms, but the Modular exponentiation involved in RSA is very time-consuming when the bit-size is large, usually in the range of 1024-bit to 4096-bit. The speed performance of RSA comes to concerns when thousands or millions of authentication requests are needed to handle by the server at a time, through a massive number of connected mobile and wireless devices. On the other hand, NTRU is another public key cryptographic algorithm that becomes popular recently due to the ability to resist attack from quantum computer. In this paper, we exploit the massively parallel architecture in GPU to perform RSA and NTRU computations. Various optimization techniques were proposed in this paper to achieve higher throughput in RSA and NTRU computation in two GPU platforms. To allow a fair comparison with existing RSA implementation techniques, we proposed to evaluate the speed performance in the best case Journal of Software Networking, 201–220.
    [Show full text]
  • Fast Elliptic Curve Cryptography in Openssl
    Fast Elliptic Curve Cryptography in OpenSSL Emilia K¨asper1;2 1 Google 2 Katholieke Universiteit Leuven, ESAT/COSIC [email protected] Abstract. We present a 64-bit optimized implementation of the NIST and SECG-standardized elliptic curve P-224. Our implementation is fully integrated into OpenSSL 1.0.1: full TLS handshakes using a 1024-bit RSA certificate and ephemeral Elliptic Curve Diffie-Hellman key ex- change over P-224 now run at twice the speed of standard OpenSSL, while atomic elliptic curve operations are up to 4 times faster. In ad- dition, our implementation is immune to timing attacks|most notably, we show how to do small table look-ups in a cache-timing resistant way, allowing us to use precomputation. To put our results in context, we also discuss the various security-performance trade-offs available to TLS applications. Keywords: elliptic curve cryptography, OpenSSL, side-channel attacks, fast implementations 1 Introduction 1.1 Introduction to TLS Transport Layer Security (TLS), the successor to Secure Socket Layer (SSL), is a protocol for securing network communications. In its most common use, it is the \S" (standing for \Secure") in HTTPS. Two of the most popular open- source cryptographic libraries implementing SSL and TLS are OpenSSL [19] and Mozilla Network Security Services (NSS) [17]: OpenSSL is found in, e.g., the Apache-SSL secure web server, while NSS is used by Mozilla Firefox and Chrome web browsers, amongst others. TLS provides authentication between connecting parties, as well as encryp- tion of all transmitted content. Thus, before any application data is transmit- ted, peers perform authentication and key exchange in a TLS handshake.
    [Show full text]
  • Making NTRU As Secure As Worst-Case Problems Over Ideal Lattices
    Making NTRU as Secure as Worst-Case Problems over Ideal Lattices Damien Stehlé1 and Ron Steinfeld2 1 CNRS, Laboratoire LIP (U. Lyon, CNRS, ENS Lyon, INRIA, UCBL), 46 Allée d’Italie, 69364 Lyon Cedex 07, France. [email protected] – http://perso.ens-lyon.fr/damien.stehle 2 Centre for Advanced Computing - Algorithms and Cryptography, Department of Computing, Macquarie University, NSW 2109, Australia [email protected] – http://web.science.mq.edu.au/~rons Abstract. NTRUEncrypt, proposed in 1996 by Hoffstein, Pipher and Sil- verman, is the fastest known lattice-based encryption scheme. Its mod- erate key-sizes, excellent asymptotic performance and conjectured resis- tance to quantum computers could make it a desirable alternative to fac- torisation and discrete-log based encryption schemes. However, since its introduction, doubts have regularly arisen on its security. In the present work, we show how to modify NTRUEncrypt to make it provably secure in the standard model, under the assumed quantum hardness of standard worst-case lattice problems, restricted to a family of lattices related to some cyclotomic fields. Our main contribution is to show that if the se- cret key polynomials are selected by rejection from discrete Gaussians, then the public key, which is their ratio, is statistically indistinguishable from uniform over its domain. The security then follows from the already proven hardness of the R-LWE problem. Keywords. Lattice-based cryptography, NTRU, provable security. 1 Introduction NTRUEncrypt, devised by Hoffstein, Pipher and Silverman, was first presented at the Crypto’96 rump session [14]. Although its description relies on arithmetic n over the polynomial ring Zq[x]=(x − 1) for n prime and q a small integer, it was quickly observed that breaking it could be expressed as a problem over Euclidean lattices [6].
    [Show full text]
  • Optimizing NTRU Using AVX2
    Master Thesis Computing Science Cyber Security Specialisation Radboud University Optimizing NTRU using AVX2 Author: First supervisor/assessor: Oussama Danba dr. Peter Schwabe Second assessor: dr. Lejla Batina July, 2019 Abstract The existence of Shor's algorithm, Grover's algorithm, and others that rely on the computational possibilities of quantum computers raise problems for some computational problems modern cryptography relies on. These algo- rithms do not yet have practical implications but it is believed that they will in the near future. In response to this, NIST is attempting to standardize post-quantum cryptography algorithms. In this thesis we will look at the NTRU submission in detail and optimize it for performance using AVX2. This implementation takes about 29 microseconds to generate a keypair, about 7.4 microseconds for key encapsulation, and about 6.8 microseconds for key decapsulation. These results are achieved on a reasonably recent notebook processor showing that NTRU is fast and feasible in practice. Contents 1 Introduction3 2 Cryptographic background and related work5 2.1 Symmetric-key cryptography..................5 2.2 Public-key cryptography.....................6 2.2.1 Digital signatures.....................7 2.2.2 Key encapsulation mechanisms.............8 2.3 One-way functions........................9 2.3.1 Cryptographic hash functions..............9 2.4 Proving security......................... 10 2.5 Post-quantum cryptography................... 12 2.6 Lattice-based cryptography................... 15 2.7 Side-channel resistance...................... 16 2.8 Related work........................... 17 3 Overview of NTRU 19 3.1 Important NTRU operations................... 20 3.1.1 Sampling......................... 20 3.1.2 Polynomial addition................... 22 3.1.3 Polynomial reduction.................. 22 3.1.4 Polynomial multiplication...............
    [Show full text]
  • Dynamic Public Key Certificates with Forward Secrecy
    electronics Article Dynamic Public Key Certificates with Forward Secrecy Hung-Yu Chien Department of Information Management, National Chi Nan University, Nantou 54561, Taiwan; [email protected] Abstract: Conventionally, public key certificates bind one subject with one static public key so that the subject can facilitate the services of the public key infrastructure (PKI). In PKI, certificates need to be renewed (or revoked) for several practical reasons, including certificate expiration, private key breaches, condition changes, and possible risk reduction. The certificate renewal process is very costly, especially for those environments where online authorities are not available or the connection is not reliable. A dynamic public key certificate (DPKC) facilitates the dynamic changeover of the current public–private key pairs without renewing the certificate authority (CA). This paper extends the previous study in several aspects: (1) we formally define the DPKC; (2) we formally define the security properties; (3) we propose another implementation of the Krawczyk–Rabin chameleon-hash- based DPKC; (4) we propose two variants of DPKC, using the Ateniese–Medeiros key-exposure-free chameleon hash; (5) we detail two application scenarios. Keywords: dynamic public key certificate; chameleon signature; certificate renewal; wireless sensor networks; perfect forward secrecy 1. Introduction Citation: Chien, H.-Y. Dynamic Certificates act as the critical tokens in conventional PKI systems. With the trust Public Key Certificates with Forward of the CA, a
    [Show full text]
  • SSL Checklist for Pentesters
    SSL Checklist for Pentesters Jerome Smith BSides MCR, 27th June 2014 # whoami whoami jerome • Pentester • Author/trainer – Hands-on technical – Web application, infrastructure, wireless security • Security projects – Log correlation – Dirty data – Incident response exercises • Sysadmin • MSc Computing Science (Dist) • www.exploresecurity.com | @exploresecurity Introduction • Broad review of SSL/TLS checks – Viewpoint of pentester – Pitfalls – Manually replicating what tools do (unless you told the client that SSL Labs would be testing them ) – Issues to consider reporting (but views are my own) • While SSL issues are generally low in priority, it’s nice to get them right! • I’m not a cryptographer: this is all best efforts SSLv2 • Flawed, e.g. no handshake protection → MITM downgrade • Modern browsers do not support SSLv2 anyway – Except for IE but it’s disabled by default from IE7 – That mitigates the risk these days – http://en.wikipedia.org/wiki/Transport_Layer_Security#W eb_browsers • OpenSSL 1.0.0+ doesn’t support it – Which means SSLscan won’t find it – General point: tools that dynamically link to an underlying SSL library in the OS can be limited by what that library supports SSLv2 • Same scan on different OpenSSL versions: SSLv2 • testssl.sh warns you – It can work with any installed OpenSSL version • OpenSSL <1.0.0 s_client -ssl2 switch – More on this later • Recompile OpenSSL – http://blog.opensecurityresearch.com/2013/05/fixing-sslv2-support- in-kali-linux.html • SSLyze 0.7+ is statically linked – Watch out for bug https://github.com/iSECPartners/sslyze/issues/73
    [Show full text]
  • Post-Quantum TLS Without Handshake Signatures Full Version, September 29, 2020
    Post-Quantum TLS Without Handshake Signatures Full version, September 29, 2020 Peter Schwabe Douglas Stebila Thom Wiggers Max Planck Institute for Security and University of Waterloo Radboud University Privacy & Radboud University [email protected] [email protected] [email protected] ABSTRACT Client Server static (sig): pk(, sk( We present KEMTLS, an alternative to the TLS 1.3 handshake that TCP SYN uses key-encapsulation mechanisms (KEMs) instead of signatures TCP SYN-ACK for server authentication. Among existing post-quantum candidates, G $ Z @ 6G signature schemes generally have larger public key/signature sizes compared to the public key/ciphertext sizes of KEMs: by using an ~ $ Z@ ss 6G~ IND-CCA-secure KEM for server authentication in post-quantum , 0, 00, 000 KDF(ss) TLS, we obtain multiple benefits. A size-optimized post-quantum ~ 6 , AEAD (cert[pk( ]kSig(sk(, transcript)kkey confirmation) instantiation of KEMTLS requires less than half the bandwidth of a ss 6~G size-optimized post-quantum instantiation of TLS 1.3. In a speed- , 0, 00, 000 KDF(ss) optimized instantiation, KEMTLS reduces the amount of server CPU AEAD 0 (application data) cycles by almost 90% compared to TLS 1.3, while at the same time AEAD 00 (key confirmation) reducing communication size, reducing the time until the client can AEAD 000 (application data) start sending encrypted application data, and eliminating code for signatures from the server’s trusted code base. Figure 1: High-level overview of TLS 1.3, using signatures CCS CONCEPTS for server authentication. • Security and privacy ! Security protocols; Web protocol security; Public key encryption.
    [Show full text]
  • Sicherheit in Kommunikationsnetzen (Network Security)
    Sicherheit in Kommunikationsnetzen (Network Security) Transport Layer Security Dr.-Ing. Matthäus Wander Universität Duisburg-Essen Transport Layer Security (TLS) PrivateTLS data Web browser Web server ∙ Cryptographic protocol ∘ Provides security on top of reliable transport (TCP) ∘ Used to secure HTTP, SMTP, IMAP, XMPP and others ∙ Security goals ∘ Authentication of server and optionally client ∘ Data integrity (no manipulation of data) ∘ Confidentiality (encryption) Universität Duisburg-Essen Matthäus Wander 2 Verteilte Systeme History ∙ Predecessor: Secure Sockets Layer (SSL) ∘ Developed by Netscape for HTTPS (= HTTP + SSL) ∙ 1994: SSL 2.0 ∘ Insecure, major security weaknesses ∙ 1995: SSL 3.0 ∘ Insecure, deprecated since 2015 (RFC 7568) ∙ 1999: TLS 1.0, minor improvements to SSL 3.0 ∘ Standardization and further development by IETF Universität Duisburg-Essen Matthäus Wander 3 Verteilte Systeme History ∙ 2003: TLS Extensions ∘ New features or security mechanisms (e.g. Encrypt-then-MAC, RFC 7366) ∙ 2006: TLS 1.1 ∘ Security improvements ∙ 2008: TLS 1.2 Presented in this lecture ∘ Added new or replaced old cryptographic algorithms ∙ TLS 1.3 is work in progress as of 2017 ∘ Outlook: new handshake and other major changes Universität Duisburg-Essen Matthäus Wander 4 Verteilte Systeme Protocol Overview Application Layer (e.g. HTTP) Handshake Change Cipher Application Alert Protocol Protocol Spec Protocol Data Protocol Record Protocol Transport Layer (e.g. TCP) ∙ TLS consists of two layers: ∘ Handshake Protocol and other protocols ∘ Record Protocol
    [Show full text]
  • Timing Attacks and the NTRU Public-Key Cryptosystem
    Eindhoven University of Technology BACHELOR Timing attacks and the NTRU public-key cryptosystem Gunter, S.P. Award date: 2019 Link to publication Disclaimer This document contains a student thesis (bachelor's or master's), as authored by a student at Eindhoven University of Technology. Student theses are made available in the TU/e repository upon obtaining the required degree. The grade received is not published on the document as presented in the repository. The required complexity or quality of research of student theses may vary by program, and the required minimum study period may vary in duration. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain Timing Attacks and the NTRU Public-Key Cryptosystem by Stijn Gunter supervised by prof.dr. Tanja Lange ir. Leon Groot Bruinderink A thesis submitted in partial fulfilment of the requirements for the degree of Bachelor of Science July 2019 Abstract As we inch ever closer to a future in which quantum computers exist and are capable of break- ing many of the cryptographic algorithms that are in use today, more and more research is being done in the field of post-quantum cryptography.
    [Show full text]
  • On Adapting NTRU for Post-Quantum Public-Key Encryption
    On adapting NTRU for Post-Quantum Public-Key Encryption Dutto Simone, Morgari Guglielmo, Signorini Edoardo Politecnico di Torino & Telsy S.p.A. De Cifris AugustæTaurinorum - September 30th, 2020 Dutto, Morgari, Signorini On adapting NTRU for Post-Quantum Public-Key Encryption 1 / 30 Introduction Introduction Post-QuantumCryptography (PQC) aims to find non-quantum asymmetric cryptographic schemes able to resist attacks by quantum computers [1]. The main developments in this field were obtained after the realization of the first functioning quantum computers in the 2000s. Of all the ongoing research projects, one of the most followed by the international community is the NIST PQC Standardization Process, which began in 2016 and is now in its final stages [2]. Dutto, Morgari, Signorini On adapting NTRU for Post-Quantum Public-Key Encryption 2 / 30 Introduction This public, competition-like process focuses on selecting post-quantumKey-EncapsulationMechanisms (KEMs) and Digital Signature schemes. Public-KeyEncryption (PKE) schemes won't be standardized since, in general, the submitted KEMs are obtained from PKE schemes and the inverse processes are simple. However, there are cases for which re-obtaining the PKE scheme from the KEM is not straightforward, like the NTRU submission [3]. Our work focused on solving this problem by introducing a PKE scheme obtained from the KEM proposed in the NTRU submission, while maintaining its security. Dutto, Morgari, Signorini On adapting NTRU for Post-Quantum Public-Key Encryption 3 / 30 NTRU The original PKE scheme NTRU The original PKE scheme The NTRU submission is inspired by a PKE scheme introduced by Hoffstein, Pipher, Silverman in 1998 [4].
    [Show full text]