DOCSLIB.ORG

Ntrucipher-Lattice Based Secret Key Encryption

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Ntrucipher-Lattice Based Secret Key Encryption NTRUCipher-Lattice Based Secret Key Encryption Maheswara Rao Valluri School of Mathematical and Computing Sciences Fiji National University, P.O.Box:7222 Derrick Campus, Suva, Fiji Island [email protected] Abstract—NTRU cryptosystem has allowed designing a over finite fields. Most of the promising candidates of the range of cryptographic schemes due to its flexibility and effi- NTRU cryptosystems are NTRUEncrypt [8] and NTRUSign ciency. Although NTRU cryptosystem was introduced nearly [9] which are resistance to the Shor’s algorithm [14] on two decades ago, it has not yet received any attention like designing a secret key encryption. In this paper, we propose a quantum computers. Damien Stehle et al. proposed a prov- secret key encryption over NTRU lattices, named as NTRUCi- able security version of the NTRU public key cryptosystem n pher. This NTRUCipher is designed using modification of the over the ring, R = Zq[x]/(x + 1), where n is a power NTRU public key encryption. We analyze this cipher efficiency of 2 and q is a prime, which provides encryption [5,6] and and the space complexity with respect to security aspects, digital signature [6]. There is still scope to work further and also show that the NTRUCipher is secured under the indistinguishability chosen plaintext attack. on their contribution in terms of setting up a specific Key words - NTRUCipher; multiple transmission attack; security parameters. Recently, Daniel J Bernstein et al. product form polynomials; secret key encryption. proposed another variant of the NTRU, named as NTRU Prime [4], over the ring, R = Z [x]/(xn x 1), where q − − I. INTRODUCTION n is a prime and q is a power of 2. In this work, we propose lattice based secret key encryption over NTRU Cryptosystem is classified as the secret key cryptosys- lattices, named as NTRUCipher. The framework of the tem (symmetric key cryptosystem) and public key cryp- encryption and decryption is the same as NTRUEncrypt [8] tosystem (asymmetric cryptosystem) based on nature of and the decryption is a probabilistic like the NTRUEncrypt cryptographic key functions and properties. The secret key [8]. Furthermore, we prove the NTRUCipher is secured cryptosystem could be categorized as the stream cipher and under the indistinguishability chosen plaintext attack (IND- block cipher based on size of the secret key, plaintext and CPA), and analyze efficiency and the space complexity with ciphertext. The block ciphers are the most influential crypto- respect to security aspects. graphic primitives in designing cryptographic schemes such The paper is organized as follows: In Section II, we as encryptions, hash functions, and message authentication recall the definition of a secret key encryption and adversary codes. In the secret key encryption, communication parties, model. Section III presents truncated polynomial rings. In a sender and receiver share and use a common key, as the Section IV, we propose the NTRUCipher - lattice based secret key, whereas in the public key cryptosystem both secret key encryption and recommend parameters for the the sender and receiver contain their own secret key and cipher. In Section V, we analyze the NTRUCipher with associated public key. The secret key cryptosystem provides respect to performance, security aspects, and space and cryptographic services such as confidentiality, integrity and arXiv:1710.01928v2 [cs.CR] 6 Oct 2017 time complexity. Finally, we provide conclusion remarks authentication of a message. The strength of the secret key in Section VI. encryption relies on two parameters: strength of algorithm and length of the secret key. The well known secret key block ciphers are the Advanced Encryption Standard (AES) II. PRELIMINARIES [10], RC5 [15], Blowfish [3], Data Encryption Standard In this Section, we recall the formal definition of a secret (DES) [2], and International data encryption algorithm key encryption and its security notations. (IDEA) [17]. These ciphers are built using Feistel net- work except IDEA for encryption and decryption. The Feistel network [7] was designed using XOR operator and A. Notations Permutation-Box (P-Box) and Substitution-Box (S-Box). A real valued function ǫ(c) < c−λ is negligible if for −λ The proposed cipher presented in this paper is designed every λ > 0 there exists cλ > 0 such that ǫ(c) < c using a modification of the NTRU public key cryptosystem for all c>cλ. A probabilistic polynomial time algorithm n [8] over the ring, R = Zq[x]/(x 1), where n is a is said to be efficient if its running time is polynomial prime and q is a power of 2. The− NTRU public key in its input length. We represent x a random variable cryptosystem was first appeared in [8] due to Hoffstein sampled from the probability distribution D as x D. et al. in 1998 and it is based on truncated polynomials The effectiveness of an algorithm to distinguish between← two probability distributions D0 and D1 is measured by define the following experiment between a challenger and its distinguishing advantage, defined by P rx←D0 [A(x) = : | A b 1] P rx←D1 [A(x) = 1] . We say that a decision problem Experiment: IND-CPA ( ) − | SE A is hard if there does not exist an efficient algorithm for 1: The challenger runs k $ eyGen(1λ). it that has a non-negligible advantage in . The statistical ←−K λ 2: outputs a pair of plaintexts (µ ,µ ) of the same distance between two distributions on 0 1 (D0; D1) D0,D1 lengthA and sends (µ ,µ ) to the challenger. some countable△ domain is defined as 0 1 X (D0; D1) = ∗ $ △ 3: The challenger computes c nc(µb, k) and then D0(x) D1(x) . | − | sends c∗ to the adversary. ←−E ′ 4: continues its computation and outputs : b . B. Secret Key Encryption A ′ 5: Output 1 if b = b , and 0 otherwise. The goal of the secret key encryption is to furnish Definition 3. A secret key encryption = confidentiality of communications of two or more parties. ( eyGen, nc, ec) is indistinguishable underSE chosen In the secret key encryption, a common secret key is shared plaintextK attack,E D if it holds for all probabilistic polynomial among the communication parties, before decryption of the time adversary that ciphertext, to furnish confidentiality of the plaintext. The A IND−CPA IND−CPA 1 following definitions are acquired from [12,13]. For further AdvSE ( )= P r[ExpSE ( ) = 1] 2 details, the reader is referred to [12,13]. negl(λ). A | A − |≤ Definition 1. A secret key encryption = ( eyGen, nc, ec) consists of the followingSE three algorithms:K E D III. TRUNCATED POLYNOMIAL RINGS (i) Key Generation: Key Generation ( eyGen) is a N Z K Let q be a prime. We write q for the integer modulo randomized algorithm that outputs a random key. When the ∈ q q q and represents this set by integers in the range ( 2 , 2 ). algorithm is run, a different key is generated every time. −n The truncated polynomial ring Rn,q = Zq[x]/(x + 1) Note that in this case, the input for the algorithm is a null. consists of all polynomials with coefficients in Zq and The randomized output secret key is represented with a degree less than n. An element f Rq is represented as a dollar symbol $: polynomial, ∈ 1: Input: null n−1 $ i . 2: k KeyGen(1λ) f = fix = [f0,f1, ....., fn−1] ←− i=0 (ii) Encryption : Encryption ( nc) is a randomized TwoP polynomials f,g R are multiplied by the ordi- E q algorithm that takes a plaintext µ and the secret key k as nary convolution, ∈ input, and outputs a ciphertext c. (f g) = (f .g ), k =0, 1, ..., n 1, which ∗ k i j − 1: Input: µ µ, k k, where Dµ is the plaintext i+j≡kP(mod n) ∈ D ∈ D is commutative and associative. The convolution product is space, k is the secret key space and secret key k is generatedD by the eyGen(1λ) algorithm. represented by * to distinguish it from the multiplication in $ K Zq. We define a center l2 norm of an element f Rq by 2: c nc(µ, k), otherwise Φ if µ / µ) c c, N−1 − N−1 ∈ ←−E ∈ D ∀ ∈ D 1/2 1 where c is the ciphertext space. f = ( f f¯) , where f¯ = f and the D k k2 i − N i (iii) Decryption : Decryption ( ec) is a deterministic iP=0 iP=0 D infinity norm is f ∞ =max0≤i≤n−1 f fi f . algorithm. k k n Lemma 1[14,15]. For any f,g Rn,q = Zq[x]/(x + 1), 1: Input: c c, k k, where c is the ciphertext ∈ ∈ D ∈ D D f f.g f √n. f f f . f g f and f f.g f n. f f f . f g f . space and k is the secret key, generated by the KeyGen(1λ) ≤ ∞ ≤ ∞ ∞ algorithm. 2: µ ec(c, k) c c. A. Cryptographic Assumptions Correctness← D of the∀ ∈ secret D key encryption works as follows: We say that a secret key encryption = In this Subsection, we define the NTRUCipher ciphertext ( eyGen, nc, ec) is correct, if it holds forSE every cracking problem for which the parameters are chosen K E D $ as recommended in the table 1. The search and decision plaintext µ that P r[Deck(Enck(µ)) = µ : k KeyGen(1λ)] < negl(λ). 6 ←− ciphertext cracking problems are defined as follows: 1) Search NTRUCIpher Ciphertext Cracking Problem: Given c = r k−1 + µ(mod q) R , with r $ C. Security Notations ∗ ∈ n,q ← P (a ,a ,a ), k $ P (a ,a ,a ) , compute (r,k,µ). The aim of an adversary is to capture the secret key n 1 2 3 ← n 1 2 3 of the secret key encryptionA and then perceive the plain- 2) Decision NTRUCIpher Ciphertext Cracking Problem: −1 text corresponding to the ciphertext.
Load more

Recommended publications
  • Etsi Gr Qsc 001 V1.1.1 (2016-07)
    ETSI GR QSC 001 V1.1.1 (2016-07) GROUP REPORT Quantum-Safe Cryptography (QSC); Quantum-safe algorithmic framework 2 ETSI GR QSC 001 V1.1.1 (2016-07) Reference DGR/QSC-001 Keywords algorithm, authentication, confidentiality, security ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice The present document can be downloaded from: http://www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https://portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https://portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI.
    [Show full text]
  • Circuit-Extension Handshakes for Tor Achieving Forward Secrecy in a Quantum World
    Proceedings on Privacy Enhancing Technologies ; 2016 (4):219–236 John M. Schanck*, William Whyte, and Zhenfei Zhang Circuit-extension handshakes for Tor achieving forward secrecy in a quantum world Abstract: We propose a circuit extension handshake for 2. Anonymity: Some one-way authenticated key ex- Tor that is forward secure against adversaries who gain change protocols, such as ntor [13], guarantee that quantum computing capabilities after session negotia- the unauthenticated peer does not reveal their iden- tion. In doing so, we refine the notion of an authen- tity just by participating in the protocol. Such pro- ticated and confidential channel establishment (ACCE) tocols are deemed one-way anonymous. protocol and define pre-quantum, transitional, and post- 3. Forward Secrecy: A protocol provides forward quantum ACCE security. These new definitions reflect secrecy if the compromise of a party’s long-term the types of adversaries that a protocol might be de- key material does not affect the secrecy of session signed to resist. We prove that, with some small mod- keys negotiated prior to the compromise. Forward ifications, the currently deployed Tor circuit extension secrecy is typically achieved by mixing long-term handshake, ntor, provides pre-quantum ACCE security. key material with ephemeral keys that are discarded We then prove that our new protocol, when instantiated as soon as the session has been established. with a post-quantum key encapsulation mechanism, Forward secret protocols are a particularly effective tool achieves the stronger notion of transitional ACCE se- for resisting mass surveillance as they resist a broad curity. Finally, we instantiate our protocol with NTRU- class of harvest-then-decrypt attacks.
    [Show full text]
  • Overview of Post-Quantum Public-Key Cryptosystems for Key Exchange
    Overview of post-quantum public-key cryptosystems for key exchange Annabell Kuldmaa Supervised by Ahto Truu December 15, 2015 Abstract In this report we review four post-quantum cryptosystems: the ring learning with errors key exchange, the supersingular isogeny key exchange, the NTRU and the McEliece cryptosystem. For each protocol, we introduce the underlying math- ematical assumption, give overview of the protocol and present some implementa- tion results. We compare the implementation results on 128-bit security level with elliptic curve Diffie-Hellman and RSA. 1 Introduction The aim of post-quantum cryptography is to introduce cryptosystems which are not known to be broken using quantum computers. Most of today’s public-key cryptosys- tems, including the Diffie-Hellman key exchange protocol, rely on mathematical prob- lems that are hard for classical computers, but can be solved on quantum computers us- ing Shor’s algorithm. In this report we consider replacements for the Diffie-Hellmann key exchange and introduce several quantum-resistant public-key cryptosystems. In Section 2 the ring learning with errors key exchange is presented which was introduced by Peikert in 2014 [1]. We continue in Section 3 with the supersingular isogeny Diffie–Hellman key exchange presented by De Feo, Jao, and Plut in 2011 [2]. In Section 5 we consider the NTRU encryption scheme first described by Hoffstein, Piphe and Silvermain in 1996 [3]. We conclude in Section 6 with the McEliece cryp- tosystem introduced by McEliece in 1978 [4]. As NTRU and the McEliece cryptosys- tem are not originally designed for key exchange, we also briefly explain in Section 4 how we can construct key exchange from any asymmetric encryption scheme.
    [Show full text]
  • A Quantum-Safe Circuit-Extension Handshake for Tor
    A quantum-safe circuit-extension handshake for Tor John Schanck, William Whyte, and Zhenfei Zhang Security Innovation, Wilmington, MA 01887 fjschanck,wwhyte,[email protected] Abstract. We propose a method for integrating NTRUEncrypt into the ntor key exchange protocol as a means of achieving a quantum-safe variant of forward secrecy. The proposal is a minimal change to ntor, essentially consisting of an NTRUEncrypt-based key exchange performed in parallel with the ntor handshake. Performance figures are provided demonstrating that the client bears most of the additional overhead, and that the added load on the router side is acceptable. We make this proposal for two reasons. First, we believe it to be an interesting case study into the practicality of quantum-safe cryptography and into the difficulties one might encounter when transi­ tioning to quantum-safe primitives within real-world protocols and code-bases. Second, we believe that Tor is a strong candidate for an early transition to quantum-safe primitives; users of Tor may be jus­ tifiably concerned about adversaries who record traffic in the present and store it for decryption when technology or cryptanalytic techniques improve in the future. 1 Introduction such as [12,23], as well as some Diffie-Hellman proto­ cols like ntor [8]. A key exchange protocol allows two parties who share no common secrets to agree on a common key over Forward secrecy. A protocol achieves forward secrecy a public channel. In addition to achieving this ba­ if the compromise of any party’s long-term key ma­ sic goal, key exchange protocols may satisfy various terial does not affect the secrecy of session keys de­ secondary properties that are deemed important to rived prior to the compromise.
    [Show full text]
  • Optimizing NTRU Using AVX2
    Master Thesis Computing Science Cyber Security Specialisation Radboud University Optimizing NTRU using AVX2 Author: First supervisor/assessor: Oussama Danba dr. Peter Schwabe Second assessor: dr. Lejla Batina July, 2019 Abstract The existence of Shor's algorithm, Grover's algorithm, and others that rely on the computational possibilities of quantum computers raise problems for some computational problems modern cryptography relies on. These algo- rithms do not yet have practical implications but it is believed that they will in the near future. In response to this, NIST is attempting to standardize post-quantum cryptography algorithms. In this thesis we will look at the NTRU submission in detail and optimize it for performance using AVX2. This implementation takes about 29 microseconds to generate a keypair, about 7.4 microseconds for key encapsulation, and about 6.8 microseconds for key decapsulation. These results are achieved on a reasonably recent notebook processor showing that NTRU is fast and feasible in practice. Contents 1 Introduction3 2 Cryptographic background and related work5 2.1 Symmetric-key cryptography..................5 2.2 Public-key cryptography.....................6 2.2.1 Digital signatures.....................7 2.2.2 Key encapsulation mechanisms.............8 2.3 One-way functions........................9 2.3.1 Cryptographic hash functions..............9 2.4 Proving security......................... 10 2.5 Post-quantum cryptography................... 12 2.6 Lattice-based cryptography................... 15 2.7 Side-channel resistance...................... 16 2.8 Related work........................... 17 3 Overview of NTRU 19 3.1 Important NTRU operations................... 20 3.1.1 Sampling......................... 20 3.1.2 Polynomial addition................... 22 3.1.3 Polynomial reduction.................. 22 3.1.4 Polynomial multiplication...............
    [Show full text]
  • How to Strengthen Ntruencrypt to Chosen-Ciphertext Security in the Standard Model
    NTRUCCA: How to Strengthen NTRUEncrypt to Chosen-Ciphertext Security in the Standard Model Ron Steinfeld1?, San Ling2, Josef Pieprzyk3, Christophe Tartary4, and Huaxiong Wang2 1 Clayton School of Information Technology Monash University, Clayton VIC 3800, Australia [email protected] 2 Div. of Mathematical Sciences, School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore, 637371 lingsan,[email protected] 3 Centre for Advanced Computing - Algorithms and Cryptography, Dept. of Computing, Macquarie University, Sydney, NSW 2109, Australia [email protected] 4 Institute for Theoretical Computer Science, Tsinghua University, People's Republic of China [email protected] Abstract. NTRUEncrypt is a fast and practical lattice-based public-key encryption scheme, which has been standardized by IEEE, but until re- cently, its security analysis relied only on heuristic arguments. Recently, Stehlé and Steinfeld showed that a slight variant (that we call pNE) could be proven to be secure under chosen-plaintext attack (IND-CPA), assum- ing the hardness of worst-case problems in ideal lattices. We present a variant of pNE called NTRUCCA, that is IND-CCA2 secure in the standard model assuming the hardness of worst-case problems in ideal lattices, and only incurs a constant factor overhead in ciphertext and key length over the pNE scheme. To our knowledge, our result gives the rst IND- CCA2 secure variant of NTRUEncrypt in the standard model, based on standard cryptographic assumptions. As an intermediate step, we present a construction for an All-But-One (ABO) lossy trapdoor function from pNE, which may be of independent interest. Our scheme uses the lossy trapdoor function framework of Peik- ert and Waters, which we generalize to the case of (k −1)-of-k-correlated input distributions.
    [Show full text]
  • Timing Attacks and the NTRU Public-Key Cryptosystem
    Eindhoven University of Technology BACHELOR Timing attacks and the NTRU public-key cryptosystem Gunter, S.P. Award date: 2019 Link to publication Disclaimer This document contains a student thesis (bachelor's or master's), as authored by a student at Eindhoven University of Technology. Student theses are made available in the TU/e repository upon obtaining the required degree. The grade received is not published on the document as presented in the repository. The required complexity or quality of research of student theses may vary by program, and the required minimum study period may vary in duration. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain Timing Attacks and the NTRU Public-Key Cryptosystem by Stijn Gunter supervised by prof.dr. Tanja Lange ir. Leon Groot Bruinderink A thesis submitted in partial fulfilment of the requirements for the degree of Bachelor of Science July 2019 Abstract As we inch ever closer to a future in which quantum computers exist and are capable of break- ing many of the cryptographic algorithms that are in use today, more and more research is being done in the field of post-quantum cryptography.
    [Show full text]
  • Introduction to Post-Quantum Cryptography
    8/28/19 Introduction to Post-Quantum Cryptography CERG: Cryptographic Engineering Research Group 3 faculty members, 9 Ph.D. students, 6 affiliated scholars 2 1 8/28/19 Previous Cryptographic Contests IX.1997 X.2000 AES 15 block ciphers ® 1 winner NESSIE I.2000 XII.2002 CRYPTREC XI.2004 IV.2008 34 stream 4 HW winners eSTREAM ciphers ® + 4 SW winners X.2007 X.2012 51 hash functions ® 1 winner SHA-3 I.2013 II. 2019 57 authenticated ciphers ® multiple winners CAESAR 97 98 99 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 time Cryptographic Contests 2007-Present Completed 51 hash functions ® 1 winner X.2007 X.2012 In progress SHA-3 I.2013 II.2019 57 authenticated ciphers CAESAR ® multiple winners XII.2016 TBD 69 Public-Key Post-Quantum Post-Quantum Cryptography Schemes VIII.2018 TBD 56 Lightweight authenticated ciphers & hash functions Lightweight 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 Year 2 8/28/19 Why Cryptographic Contests? Avoid back-door theories Speed-up the acceptance of a new standard Stimulate non-classified research on methods of designing a specific cryptographic transformation Focus the effort of a relatively small cryptographic community 5 Evaluation Criteria Security Software Efficiency Hardware Efficiency µProcessors µControllers FPGAs ASICs Flexibility Simplicity Licensing 6 3 8/28/19 AES Contest, 1997-2000: Block Ciphers GMU FPGA Results Straw Poll @ NIST AES 3 conference Rijndael second best in FPGAs, selected as a winner due to much better performance in software & ASICs 7 SHA-3 Round 2: 14 candidates Throughput Best: Fast & Small Worst: Slow & Big Area Throughput vs.
    [Show full text]
  • The Whole Is Less Than the Sum of Its Parts: Constructing More Efficient Lattice-Based Akes?
    The Whole is Less than the Sum of its Parts: Constructing More Efficient Lattice-Based AKEs? Rafael del Pino1;2;3, Vadim Lyubashevsky4, and David Pointcheval3;2;1 1 INRIA, Paris 2 Ecole´ Normale Sup´erieure,Paris 3 CNRS 4 IBM Research Zurich Abstract. Authenticated Key Exchange (AKE) is the backbone of internet security protocols such as TLS and IKE. A recent announcement by standardization bodies calling for a shift to quantum-resilient crypto has resulted in several AKE proposals from the research community. Be- cause AKE can be generically constructed by combining a digital signature scheme with public key encryption (or a KEM), most of these proposals focused on optimizing the known KEMs and left the authentication part to the generic combination with digital signatures. In this paper, we show that by simultaneously considering the secrecy and authenticity require- ments of an AKE, we can construct a scheme that is more secure and with smaller communication complexity than a scheme created by a generic combination of a KEM with a signature scheme. Our improvement uses particular properties of lattice-based encryption and signature schemes and consists of two parts { the first part increases security, whereas the second reduces communication complexity. We first observe that parameters for lattice-based encryption schemes are always set so as to avoid decryption errors, since many observations by the adversary of such failures usually leads to him recovering the secret key. But since one of the requirements of an AKE is that it be forward-secure, the public key must change every time. The intuition is therefore that one can set the parameters of the scheme so as to not care about decryption errors and everything should still remain secure.
    [Show full text]
  • NIST)  Quantum Computing Will Break Many Public-Key Cryptographic Algorithms/Schemes ◦ Key Agreement (E.G
    Post Quantum Cryptography Team Presenter: Lily Chen National Institute of Standards and Technology (NIST) Quantum computing will break many public-key cryptographic algorithms/schemes ◦ Key agreement (e.g. DH and MQV) ◦ Digital signatures (e.g. RSA and DSA) ◦ Encryption (e.g. RSA) These algorithms have been used to protect Internet protocols (e.g. IPsec) and applications (e.g.TLS) NIST is studying “quantum-safe” replacements This talk will focus on practical aspects ◦ For security, see Yi-Kai Liu’s talk later today ◦ Key establishment: ephemeral Diffie-Hellman ◦ Authentication: signature or pre-shared key Key establishment through RSA, DHE, or DH Client Server ◦ RSA – Client encrypts pre- master secret using server’s Client RSA public key Hello Server Hello Certificate* ◦ DHE – Ephemeral Diffie- ServerKeyExchange* Hellman CertificateRequest* ◦ DH – Client generates an ServerHelloDone ephemeral DH public value. Certificate* ClientKeyExchange* Pre-master secret is generated CertificateVerify* using server static public key {ChangeCipherSpec} Finished Server authentication {ChangeCipherSpec} ◦ RSA – implicit (by key Finished confirmation) ◦ DHE - signature Application data Application Data ◦ DH – implicit (by key confirmation) IKE ◦ A replacement of ephemeral Diffie-Hellman key agreement should have a fast key pair generation scheme ◦ If signatures are used for authentication, both signing and verifying need to be equally efficient TLS ◦ RSA - encryption replacement needs to have a fast encryption ◦ DHE – fast key pair generation and efficient signature verification ◦ DH – fast key pair generation Which are most important in practice? ◦ Public and private key sizes ◦ Key pair generation time ◦ Ciphertext size ◦ Encryption/Decryption speed ◦ Signature size ◦ Signature generation/verification time Not a lot of benchmarks in this area Lattice-based ◦ NTRU Encryption and NTRU Signature ◦ (Ring-based) Learning with Errors Code-based ◦ McEliece encryption and CFS signatures Multivariate ◦ HFE, psFlash , Quartz (a variant of HFE), Many more….
    [Show full text]
  • Cryptanalysis of Public Key Cryptosystems Abderrahmane Nitaj
    Cryptanalysis of Public Key Cryptosystems Abderrahmane Nitaj To cite this version: Abderrahmane Nitaj. Cryptanalysis of Public Key Cryptosystems. Cryptography and Security [cs.CR]. Université de Caen Normandie, 2016. tel-02321087 HAL Id: tel-02321087 https://hal-normandie-univ.archives-ouvertes.fr/tel-02321087 Submitted on 20 Oct 2019 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. MEMOIRE D'HABILITATION A DIRIGER DES RECHERCHES Sp´ecialit´e: Math´ematiques Pr´epar´eau sein de l'Universit´ede Caen Normandie Cryptanalysis of Public Key Cryptosystems Pr´esent´eet soutenu par Abderrahmane NITAJ Soutenu publiquement le 1er d´ecembre 2016 devant le jury compos´ede Mr Thierry BERGER Professeur, Universit´ede Limoges Rapporteur Mr Marc GIRAULT Chercheur HDR, Orange Labs, Caen Examinateur Mr Marc JOYE Chercheur HDR, NXP Semiconductors Rapporteur Mr Fabien LAGUILLAUMIE Professeur, Universit´ede Lyon 1 Rapporteur Mr Denis SIMON Professeur, Universit´ede Caen Examinateur Mme Brigitte VALLEE Directrice de Recherche, CNRS Examinatrice M´emoirepr´epar´eau Laboratoire de Math´ematiquesNicolas Oresme (LMNO) Contents Remerciements ix List of Publications xi 1 Introduction 1 2 Cryptanalysis of RSA 9 2.1 Introduction . .9 2.2 Continued Fractions .
    [Show full text]
  • Choosing Parameters for Ntruencrypt
    Choosing Parameters for NTRUEncrypt Jeff Hoffstein1, Jill Pipher1, John M. Schanck2;3, Joseph H. Silverman1, William Whyte3, and Zhenfei Zhang3 1 Brown University, Providence, USA fjhoff,jpipher,[email protected] 2 University of Waterloo, Waterloo, Canada 3 Security Innovation, Wilmington, USA fjschanck,wwhyte,[email protected] Abstract. We describe a methods for generating parameter sets and calculating security estimates for NTRUEncrypt. Analyses are provided for the standardized product-form parameter sets from IEEE 1363.1-2008 and for the NTRU Challenge parameter sets. 1 Introduction and Notation In this note we will assume some familiarity with the details and notation of NTRUEncrypt. The reader desiring further background should consult standard references such as [4, 5, 12]. The key parameters are summarized in Table 1. Each is, implicitly, a function of the security parameter λ. Primary NTRUEncrypt Parameters N N; q Ring parameters RN;q = Zq[X]=(X − 1). p Message space modulus. d1; d2; d3 Non-zero coefficient counts for product form polynomial terms. dg Non-zero coefficient count for private key component g. dm Message representative Hamming weight constraint. Table 1. NTRUEncrypt uses a ring of convolution polynomials; a polynomial ring parameterized by a prime N and an integer q of the form N RN;q = (Z=qZ)[X]=(X − 1): The subscript will be dropped when discussing generic properties of such rings. We denote multiplication in R by ∗. An NTRUEncrypt public key is a generator for a cyclic R-module of rank 2, and is denoted (1; h). The private key is an element of this module which is \small" with respect to a given norm and is denoted (f; g).
    [Show full text]