DOCSLIB.ORG

Securing Edge Devices in the Post-Quantum Internet of Things Using Lattice-Based Cryptography

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Securing Edge Devices in the Post-Quantum Internet of Things Using Lattice-Based Cryptography HUMAN-DRIVEN EDGE COMPUTING AND COMMUNICATION Securing Edge Devices in the Post-Quantum Internet of Things Using Lattice-Based Cryptography Zhe Liu, Kim-Kwang Raymond Choo, and Johann Großschädl The authors provide a ABSTRACT This approach reduces the amount of data to be brief introduction to cryp- transmitted to the cloud and eliminates the round- tographic methods for In order to increase the security of edge com- trip delay associated with the transmission of data securing the post-quan- puting, all data transmitted to and from edge from the gateway to the cloud and the transmis- devices, as well as all data stored on edge devic- sion of results in the other direction. In addition, tum IoT, including hash- es, must be encrypted. Especially when the trans- edge computing has the potential to alleviate cer- based digital signature mitted or stored data contains sensitive personal tain privacy issues by ensuring that all sensitive schemes, code-based information, long-term protection over periods data is either kept on the edge device or only sent cryptography, multivariate of ten or more years may be required, which to the cloud after anonymization. public key cryptography, can only be achieved with post-quantum cryp- As edge devices may process and store sen- tography. This article first gives a brief overview sitive personal information about their owners or and lattice-based cryp- of post-quantum public-key cryptosystems based users, they require effective protection against tography. In particular, on hard mathematical problems related to hash many kinds of attacks. An edge device can be they focus on the imple- functions, error-correcting codes, multivariate attacked from two different directions, namely mentation aspects of quadratic systems, and lattices. Then the suitability through the Internet on one hand, and through lattice-based cryptography of lattice-based cryptosystems for resource-con- connected devices on the other hand, assuming strained devices is discussed and efficient imple- the attacker is able to inject one or more manip- for resource-constrained mentations for 8 and 32-bit microcontrollers are ulated devices into the network. These threats IoT devices, and practical outlined. call for a sophisticated security architecture, suggestions to choose which has to take the very specific constraints NTRODUCTION appropriate implementa- I and requirements of the IoT into account. One tion techniques. The Internet of Things (IoT) can be defined as of the main challenges toward a secure IoT is a global network of physical objects (“things”) the fact that many IoT devices are highly con- that are equipped with computation and com- strained in terms of computational resources and munication capabilities, which enables them to network bandwidth. For example, a typical wire- be identified, monitored, and controlled over the less sensor node, like Memsic’s MICAz mote, is Internet. It is estimated that by the end of 2020, equipped with an 8-bit AVR microcontroller and somewhere between 20 and 50 billion smart has a few kilobytes of RAM and around 100 kB devices — including various kinds of sensors, of flash memory to store a primitive operating actuators, and other microsystems — will be con- system and application programs. More advanced nected to the Internet, outnumbering the world’s IoT devices often come with an ARM Cortex-M population by a factor of between 2.5 and 6.5. microcontroller and possess between 32 and 64 These billions of devices will collect unprecedent- kB RAM, as well as a few hundred kilobytes of ed amounts of data about the physical world in flash memory. Edge devices are, in general, much their environment, which needs to be transmitted more powerful than ordinary IoT devices since to a central resource (e.g., a server in the cloud) they have to perform local data processing. How- for analysis and storage. However, such a tradi- ever, when choosing cryptographic algorithms tional IoT model, in which the end devices are and protocols to be run on an edge device, the primarily used for data collection, while the infor- resource restrictions of the IoT devices with which mation extraction, post processing, and decision it needs to communicate securely must be taken making is primarily performed in the cloud, has into account. Regarding public key techniques, raised many concerns about bandwidth require- elliptic curve cryptosystems, such as Elliptic Curve ments, latency problems, as well as security and Digital Signature Algorithm (ECDSA) and Elliptic privacy issues. Edge computing, also known as Curve Diffie-Hellman (ECDH) have clear advan- fog computing, aims to mitigate said concerns by tages over their traditional counterparts such as performing some processing and analysis in the Rivest, Shamir, & Adleman (RSA) and DH due gateway that connects the IoT devices with the to the much shorter key lengths and associated Internet or on a dedicated device located at the savings in execution time, RAM requirements, and edge of the network, near the source of the data. transmission bandwidth. Digital Object Identifier: Zhe Liu is with Nanjing University of Aeronautics and Astronautics and the University of Luxembourg; 10.1109/MCOM.2018.1700330 Kim-Kwang Raymond Choo is with The University of Texas at San Antonio; Johann Großschädl is with the University of Luxembourg. 158 0163-6804/18/$25.00 © 2018 IEEE IEEE Communications Magazine • February 2018 Authorized licensed use limited to: George Mason University. Downloaded on October 04,2020 at 15:13:16 UTC from IEEE Xplore. Restrictions apply. The security of modern public key cryptosys- resistant against quantum computers. The clas- The focus of research tems relies on the hardness of well studied math- sical Merkle Signature Scheme (MSS) is based ematical problems such as the integer factoring on a one-time signature (OTS) system and uses activities is currently problem (IFP), the discrete logarithm problem a binary hash tree (nowadays called Merkle tree) directed toward four (DLP), or its elliptic curve variant, the ECDLP. It to obtain a “many-time” signature scheme. The 2n is widely acknowledged, however, that all these leaf nodes are hash values of the public keys of main categories: lat- problems could be effectively solved with a quan- 2n OTS key pairs, each of which can only be used tice-based cryptography, tum computer, which puts essentially every key to sign one message. Each inner node contains multivariate cryptog- exchange and digital signature scheme in use the hash of the concatenation of its two children, today at risk of being broken [1]. Estimates as to and the hash value at the root node is the public raphy, hash-based when the first powerful quantum computer will key of the scheme. The private key of the MSS cryptography, and code- be available vary significantly, but according to is the entire set of OTS key pairs, which can be some predictions it could happen before the end generated using a pseudo-random generator with based cryptography. of the next decade (i.e., in less than 15 years). For- a short seed to reduce storage requirements. An These four categories n n tunately, there are a few mathematical problems MSS with 2 OTS key pairs can be used to sign 2 differ greatly in terms that are intractable not only for classical comput- messages, whereby the signature of the ith mes- ers, but also when using a sophisticated quan- sage mi consists of the OTS signature on mi using of the underlying hard tum computer. The sub-area of cryptography that the ith OTS secret key (at the ith leaf), the ith OTS mathematical problem deals with the design, cryptanalysis, and imple- public key, and the so-called authentication path mentation of cryptographic algorithms supposed of the latter, which includes all n + 1 intermediate and also with respect to be able to withstand attacks by quantum com- nodes on the path from the ith leaf to the root. to performance, key puters is known as Post-Quantum Cryptography MSS only requires a secure hash function to guar- lengths, and the length (PQC) and has recently gained a lot of interest. antee the overall security of the scheme, but has Regarding public key cryptosystems, the focus the disadvantage of large signature sizes. Two of ciphertexts as well as of research activities is currently directed toward recent developments in this area of research are digital signatures. four main categories: lattice-based cryptography, an improved variant of MSS called XMSS and the multivariate cryptography, hash-based cryptogra- stateless signature scheme SPHINCS. phy, and code-based cryptography. These four Code-based cryptosystems use an error cor- categories differ greatly in terms of the under- recting code to construct a one-way function; lying hard mathematical problem and also with their security is based on the hardness of decod- respect to performance, key lengths, and the ing a message that contains random errors and length of ciphertexts as well as digital signatures. recovering the code structure. A well-known Lattice-based cryptography is often regarded as example is the McEliece public key encryption one of the best options for PQC in the IoT since scheme, which employs binary Goppa codes it combines high efficiency with reasonably short due to their high error correction capability. keys. The private key is a binary irreducible degree-t PQC has attracted the interest of standard- Goppa code chosen secretly by the receiver of ization bodies all over the world. In 2016, the the message, and the corresponding public key National Institute of Standards and Technology is a generator matrix G describing a scrambled (NIST) announced their intention to standardize and randomly permuted version of this code. To post-quantum cryptosystems and also released a encrypt a message, the sender first encodes it call for proposals.
Load more

Recommended publications
  • Qchain: Quantum-Resistant and Decentralized PKI Using Blockchain
    SCIS 2018 2018 Symposium on Cryptography and Information Security Niigata, Japan, Jan. 23 - 26, 2018 The Institute of Electronics, Copyright c 2018 The Institute of Electronics, Information and Communication Engineers Information and Communication Engineers QChain: Quantum-resistant and Decentralized PKI using Blockchain Hyeongcheol An ∗ Kwangjo Kim ∗ Abstract: Blockchain was developed under public domain and distributed database using the P2P connection. Therefore, blockchain does not have any central administrator or Certificate Au- thority(CA). However, Public Key Infrastructure(PKI) must have CA which issues and signs the digital certificates. PKI CA must be fully trusted by all parties in a domain. Also, current public key cryptosystem can be broken using quantum computing attacks. The post-quantum cryptography (PQC) must be secure against the quantum adversary. We combine blockchain technique with one of post-quantum cryptography lattice-based cryptosystems. In this paper, we suggest QChain which is quantum-resistant decentralized PKI system using blockchain. We propose modified lattice-based GLP signature scheme. QChain uses modified GLP signature which uses Number Theoretic Transformation (NTT). We compare currently used X.509 v3 PKI and QChain certificate. Keywords: blockchain, post-quantum cryptography, lattice, decentralized PKI 1 Introduction ficulty of Discrete Logarithm Problem (DLP) and In- teger Factorization Problem (IFP). However, DLP and 1.1 Motivation IFP can be solved within the polynomial time by Shor's Public-key cryptosystem needs Public Key Infras- algorithm[3] using the quantum computer. Therefore, tructure (PKI) which is to guarantee the integrity of we need secure public key cryptosystem against the for all user's public key. Currently used PKI system quantum adversary.
    [Show full text]
  • On the Security of Lattice-Based Cryptography Against Lattice Reduction and Hybrid Attacks
    On the Security of Lattice-Based Cryptography Against Lattice Reduction and Hybrid Attacks Vom Fachbereich Informatik der Technischen Universit¨atDarmstadt genehmigte Dissertation zur Erlangung des Grades Doktor rerum naturalium (Dr. rer. nat.) von Dipl.-Ing. Thomas Wunderer geboren in Augsburg. Referenten: Prof. Dr. Johannes Buchmann Dr. Martin Albrecht Tag der Einreichung: 08. 08. 2018 Tag der m¨undlichen Pr¨ufung: 20. 09. 2018 Hochschulkennziffer: D 17 Wunderer, Thomas: On the Security of Lattice-Based Cryptography Against Lattice Reduction and Hybrid Attacks Darmstadt, Technische Universit¨atDarmstadt Jahr der Ver¨offentlichung der Dissertation auf TUprints: 2018 Tag der m¨undlichen Pr¨ufung:20.09.2018 Ver¨offentlicht unter CC BY-SA 4.0 International https://creativecommons.org/licenses/ Abstract Over the past decade, lattice-based cryptography has emerged as one of the most promising candidates for post-quantum public-key cryptography. For most current lattice-based schemes, one can recover the secret key by solving a corresponding instance of the unique Shortest Vector Problem (uSVP), the problem of finding a shortest non-zero vector in a lattice which is unusually short. This work is concerned with the concrete hardness of the uSVP. In particular, we study the uSVP in general as well as instances of the problem with particularly small or sparse short vectors, which are used in cryptographic constructions to increase their efficiency. We study solving the uSVP in general via lattice reduction, more precisely, the Block-wise Korkine-Zolotarev (BKZ) algorithm. In order to solve an instance of the uSVP via BKZ, the applied block size, which specifies the BKZ algorithm, needs to be sufficiently large.
    [Show full text]
  • Eindhoven University of Technology MASTER Towards Post-Quantum
    Eindhoven University of Technology MASTER Towards post-quantum bitcoin side-channel analysis of bimodal lattice signatures Groot Bruinderink, L. Award date: 2016 Link to publication Disclaimer This document contains a student thesis (bachelor's or master's), as authored by a student at Eindhoven University of Technology. Student theses are made available in the TU/e repository upon obtaining the required degree. The grade received is not published on the document as presented in the repository. The required complexity or quality of research of student theses may vary by program, and the required minimum study period may vary in duration. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain Towards Post-Quantum Bitcoin Side-Channel Analysis of Bimodal Lattice Signatures Leon Groot Bruinderink Email: [email protected] Student-ID: 0682427 A thesis submitted in partial fulfillment of the requirements for the degree of Master of Science in Industrial and Applied Mathematics Supervisors: prof.dr. Tanja Lange (TU/e) dr. Andreas H¨ulsing(TU/e) dr. Lodewijk Bonebakker (ING) January 2016 Acknowledgements This thesis is the result of many months of work, both at my internship company ING and university TU/e.
    [Show full text]
  • Masking the GLP Lattice-Based Signature Scheme at Any Order
    Masking the GLP Lattice-Based Signature Scheme at Any Order Gilles Barthe1, Sonia Bela¨ıd2, omas Espitau3, Pierre-Alain Fouque4, Benjamin Gregoire´ 5, Melissa´ Rossi6;7, and Mehdi Tibouchi8 1 IMDEA Soware Institute [email protected] 2 CryptoExperts [email protected] 3 Sorbonne Universite,´ Laboratoire d’informatique de Paris VI [email protected] 4 Universite´ de Rennes [email protected] 5 Inria Sophia Antipolis [email protected] 6 ales 7 Ecole´ Normale Superieure´ de Paris, Departement´ d’informatique, CNRS, PSL Research University, INRIA [email protected] 8 NTT Secure Platform Laboratories [email protected] Abstract. Recently, numerous physical aacks have been demonstrated against laice- based schemes, oen exploiting their unique properties such as the reliance on Gaussian distributions, rejection sampling and FFT-based polynomial multiplication. As the call for concrete implementations and deployment of postquantum cryptography becomes more pressing, protecting against those aacks is an important problem. However, few counter- measures have been proposed so far. In particular, masking has been applied to the decryp- tion procedure of some laice-based encryption schemes, but the much more dicult case of signatures (which are highly non-linear and typically involve randomness) has not been considered until now. In this paper, we describe the rst masked implementation of a laice-based signature scheme. Since masking Gaussian sampling and other procedures involving contrived prob- ability distribution would be prohibitively inecient, we focus on the GLP scheme of Guneysu,¨ Lyubashevsky and Poppelmann¨ (CHES 2012). We show how to provably mask it in the Ishai–Sahai–Wagner model (CRYPTO 2003) at any order in a relatively ecient man- ner, using extensions of the techniques of Coron et al.
    [Show full text]
  • The Whole Is Less Than the Sum of Its Parts: Constructing More Efficient Lattice-Based Akes?
    The Whole is Less than the Sum of its Parts: Constructing More Efficient Lattice-Based AKEs? Rafael del Pino1;2;3, Vadim Lyubashevsky4, and David Pointcheval3;2;1 1 INRIA, Paris 2 Ecole´ Normale Sup´erieure,Paris 3 CNRS 4 IBM Research Zurich Abstract. Authenticated Key Exchange (AKE) is the backbone of internet security protocols such as TLS and IKE. A recent announcement by standardization bodies calling for a shift to quantum-resilient crypto has resulted in several AKE proposals from the research community. Be- cause AKE can be generically constructed by combining a digital signature scheme with public key encryption (or a KEM), most of these proposals focused on optimizing the known KEMs and left the authentication part to the generic combination with digital signatures. In this paper, we show that by simultaneously considering the secrecy and authenticity require- ments of an AKE, we can construct a scheme that is more secure and with smaller communication complexity than a scheme created by a generic combination of a KEM with a signature scheme. Our improvement uses particular properties of lattice-based encryption and signature schemes and consists of two parts { the first part increases security, whereas the second reduces communication complexity. We first observe that parameters for lattice-based encryption schemes are always set so as to avoid decryption errors, since many observations by the adversary of such failures usually leads to him recovering the secret key. But since one of the requirements of an AKE is that it be forward-secure, the public key must change every time. The intuition is therefore that one can set the parameters of the scheme so as to not care about decryption errors and everything should still remain secure.
    [Show full text]
  • Loop Abort Faults on Lattice-Based Fiat-Shamir & Hash’N Sign Signatures
    Loop abort Faults on Lattice-Based Fiat-Shamir & Hash'n Sign signatures Thomas Espitau4, Pierre-Alain Fouque2, Beno^ıtG´erard1, and Mehdi Tibouchi3 1 DGA.MI & IRISA z 2 NTT Secure Platform Laboratories x 3 Institut Universitaire de France & IRISA & Universit´ede Rennes I { 4 Ecole Normale Sup´erieurede Cachan & Sorbonne Universit´es,UPMC Univ Paris 06, LIP6k Abstract. As the advent of general-purpose quantum computers appears to be drawing closer, agencies and advisory bodies have started recommending that we prepare the transition away from factoring and discrete logarithm-based cryptography, and towards postquantum secure constructions, such as lattice-based schemes. Almost all primitives of classical cryptography (and more!) can be realized with lattices, and the efficiency of primitives like encryption and signatures has gradually improved to the point that key sizes are competitive with RSA at similar security levels, and fast performance can be achieved both in software and hardware. However, little research has been conducted on physical attacks targeting concrete implementations of postquantum cryptography in general and lattice-based schemes in par- ticular, and such research is essential if lattices are going to replace RSA and elliptic curves in our devices and smart cards. In this paper, we look in particular at fault attacks against some instances of the Fiat-Shamir family of signature scheme on lattices (BLISS, GLP, TESLA and PASSSign) and on the GPV scheme, member of the Hash'n Sign family. Some of these schemes have achieved record-setting efficiency in software and hardware. We present several possible fault attacks, one of which allows a full key recovery with as little as a single faulty signature, and discuss possible countermeasures to mitigate these attacks.
    [Show full text]
  • Design and Analysis of Decentralized Public Key Infrastructure with Quantum-Resistant Signatures
    석 ¬ Y 위 | 8 Master's Thesis 양자 ´1 서명D t©\ È중YT 공개¤ 0반 lpX $Ä 및 분석 Design and Analysis of Decentralized Public Key Infrastructure with Quantum-resistant Signatures 2018 H 형 철 (W ; 哲 An, Hyeongcheol) \ m 과 Y 0 Ð Korea Advanced Institute of Science and Technology 석 ¬ Y 위 | 8 양자 ´1 서명D t©\ È중YT 공개¤ 0반 lpX $Ä 및 분석 2018 H 형 철 \ m 과 Y 0 Ð 전산Y부 (정보보8대YÐ) Design and Analysis of Decentralized Public Key Infrastructure with Quantum-resistant Signatures Hyeongcheol An Advisor: Kwangjo Kim A dissertation submitted to the faculty of Korea Advanced Institute of Science and Technology in partial fulfillment of the requirements for the degree of Master of Science in Computer Science (Information Security) Daejeon, Korea June 12, 2018 Approved by Kwangjo Kim Professor of Computer Science The study was conducted in accordance with Code of Research Ethics1. 1 Declaration of Ethical Conduct in Research: I, as a graduate student of Korea Advanced Institute of Science and Technology, hereby declare that I have not committed any act that may damage the credibility of my research. This includes, but is not limited to, falsification, thesis written by someone else, distortion of research findings, and plagiarism. I confirm that my thesis contains honest conclusions based on my own careful research under the guidance of my advisor. MIS H형철. 양자 ´1 서명D t©\ È중YT 공개¤ 0반 lpX $Ä 및 분석. 전산Y부 (정보보8대YÐ) . 2018D. 50+iv ½. 지ÄP수: @광p. 20164355 (영8 |8) Hyeongcheol An. Design and Analysis of Decentralized Public Key Infras- tructure with Quantum-resistant Signatures.
    [Show full text]
  • Practical Lattice-Based Cryptography in Hardware
    Practical Lattice-Based Cryptography in Hardware James Victor Howe MSc BSc Supervisor: Professor Máire O’Neill School of Electronics, Electrical Engineering, and Computer Science, Queen’s University Belfast. This dissertation is submitted for the degree of Doctor of Philosophy May 2018 Nomenclature N Defines the security parameter of a given cryptoscheme. λ Defines the arithmetic precision of a given cryptoscheme. µ Defines the message data used with a digital signature scheme. σ The standard deviation of the discrete Gaussian distribution. τ The tail-cut parameter of the discrete Gaussian distribution. AES Advanced encryption standard. ASIC Application-specific integrated circuit. AVX Advanced vector extensions. BDD Bounded distance decoding. BG The lattice-based digital signature scheme of Bai and Galbraith[2014b]. BKZ The Block Korkine-Zolotarev lattice reduction algorithm. BLISS The bimodal lattice-based digital signature scheme of Ducas et al.[2013]. CCA Chosen-ciphertext attack. CPA Chosen-plaintext attack. CPU Central processing unit. Nomenclature iii CVP The closest vector problem. DCK The decisional compact knapsack problem. DDoS Distributed denial of service. DNS Domain name system. DSA Digital signature algorithm. DSS Digital signature scheme. ECC Elliptic-curve cryptography. ECDSA Elliptic-curve digital signature algorithm. EU-CMA Existentially unforgeable under a chosen message attack. FDH Full-domain hash. FF Flip-flop. FFT Fast Fourier transform. FPGA Field-programmable gate array. GapCVP The approximate decision version of the closest vector problem (CVP). GapSVP The approximate decision version of the shortest vector problem (SVP). GGH The Goldreich-Goldwasser-Halevi [Goldreich et al., 1996] lattice-based cryptosystem. GLP The Güneysu-Lyubashevsky-Pöppelmann [Güneysu et al., 2012] lattice- based digital signature scheme.
    [Show full text]
  • Lattice-Based Signatures: Optimization and Implementation on Reconfigurable Hardware
    1 Lattice-Based Signatures: Optimization and Implementation on Reconfigurable Hardware Tim Guneysu,¨ Vadim Lyubashevsky, and Thomas Poppelmann¨ Abstract—Nearly all of the currently used signature schemes, such as RSA or DSA, are based either on the factoring assumption or the presumed intractability of the discrete logarithm problem. As a consequence, the appearance of quantum computers or algorithmic advances on these problems may lead to the unpleasant situation that a large number of today’s schemes will most likely need to be replaced with more secure alternatives. In this work we present such an alternative – an efficient signature scheme whose security is derived from the hardness of lattice problems. It is based on recent theoretical advances in lattice-based cryptography and is highly optimized for practicability and use in embedded systems. The public and secret keys are roughly 1:5 kB and 0:3 kB long, while the signature size is approximately 1:1 kB for a security level of around 80 bits. We provide implementation results on reconfigurable hardware (Spartan/Virtex-6) and demonstrate that the scheme is scalable, has low area consumption, and even outperforms classical schemes. Index Terms—Public key cryptosystems, reconfigurable hardware, signature scheme, ideal lattices, FPGA. F 1 INTRODUCTION and NTRUSign [33], broken due to flaws in the ad-hoc design approaches [19], [51]. This has changed since the It has been known, ever since Shor’s seminal result [58], introduction of cyclic and ideal lattices [46] and related that all asymmetric cryptosystems based on factoring computationally hard problems like RING-SIS [42], [44], and the (elliptic curve) discrete logarithm problem can [52] and RING-LWE [45].
    [Show full text]
  • (Not) to Design and Implement Post-Quantum Cryptography
    SoK: How (not) to Design and Implement Post-Quantum Cryptography James Howe1, Thomas Prest1, and Daniel Apon2 1 PQShield, Oxford, UK. {james.howe,thomas.prest}@pqshield.com 2 National Institute of Standards and Technology, USA. [email protected] Abstract Post-quantum cryptography has known a Cambrian explosion in the last decade. What started as a very theoretical and mathematical area has now evolved into a sprawling research field, complete with side-channel resistant embedded implementations, large scale deployment tests and standardization efforts. This study systematizes the current state of knowledge on post-quantum cryptography. Compared to existing studies, we adopt a transversal point of view and center our study around three areas: (i) paradigms, (ii) implementation, (iii) deployment. Our point of view allows to cast almost all classical and post-quantum schemes into just a few paradigms. We highlight trends, common methodologies, and pitfalls to look for and recurrent challenges. 1 Introduction Since Shor’s discovery of polynomial-time quantum algorithms for the factoring and discrete log- arithm problems, researchers have looked at ways to manage the potential advent of large-scale quantum computers, a prospect which has become much more tangible of late. The proposed solutions are cryptographic schemes based on problems assumed to be resistant to quantum com- puters, such as those related to lattices or hash functions. Post-quantum cryptography (PQC) is an umbrella term that encompasses the design, implementation, and integration of these schemes. This document is a Systematization of Knowledge (SoK) on this diverse and progressive topic. We have made two editorial choices. First, an exhaustive SoK on PQC could span several books, so we limited our study to signatures and key-establishment schemes, as these are the backbone of the immense majority of protocols.
    [Show full text]
  • Efficient Identity-Based Encryption Over NTRU Lattices
    Efficient Identity-Based Encryption over NTRU Lattices L´eoDucas?, Vadim Lyubashevsky??, and Thomas Prest??? Abstract. Efficient implementations of lattice-based cryptographic sche- mes have been limited to only the most basic primitives like encryption and digital signatures. The main reason for this limitation is that at the core of many advanced lattice primitives is a trapdoor sampling al- gorithm (Gentry, Peikert, Vaikuntanathan, STOC 2008) that produced outputs that were too long for practical applications. In this work, we show that using a particular distribution over NTRU lattices can make GPV-based schemes suitable for practice. More concretely, we present the first lattice-based IBE scheme with practical parameters { key and ciphertext sizes are between two and four kilobytes, and all encryp- tion and decryption operations take approximately one millisecond on a moderately-powered laptop. As a by-product, we also obtain digital signature schemes which are shorter than the previously most-compact ones of Ducas, Durmus, Lepoint, and Lyubashevsky from Crypto 2013. Key words: Lattice Cryptography, Identity-Based Encryption, Digital Signatures, NTRU 1 Introduction Recent improvements in efficiency have firmly established lattice-based cryptog- raphy as one of the leading candidates to replace number-theoretic cryptography after the eventual coming of quantum computing. There are currently lattice- based encryption [HPS98,LPR13a,LPR13b], identification [Lyu12], and digital signature schemes [GLP12,DDLL13] that have run-times (both in software and in hardware), key sizes, and output lengths that are more or less on par with traditional number-theoretic schemes. But unfortunately, the extent of practi- cal lattice-based cryptography stops here. While number-theoretic assumptions ? University of California, San Diego.
    [Show full text]
  • Loop-Abort Faults on Lattice-Based Signature Schemes and Key Exchange Protocols
    1 Loop-Abort Faults on Lattice-Based Signature Schemes and Key Exchange Protocols Thomas Espitau, Pierre-Alain Fouque, Benoˆıt Gerard,´ and Mehdi Tibouchi F Abstract—Although postquantum cryptography is of growing practical on improving the performance of lattice-based cryptogra- concern, not many works have been devoted to implementation security phy, and actual implementation results suggest that prop- issues related to postquantum schemes. erly optimized schemes may be competitive with, or even In this paper, we look in particular at fault attacks against imple- outperform, classical factoring and discrete logarithm-based mentations of lattice-based signatures and key exchange protocols. constructions1. For signature schemes, we are interested both in Fiat–Shamir type constructions (particularly BLISS, but also GLP, PASSSign, and Ring- The literature on the underlying number-theoretic prob- TESLA) and in hash-and-sign schemes (particularly the GPV-based lems of lattice-based cryptography is extensive (even scheme of Ducas–Prest–Lyubashevsky). For key exchange protocols, though concrete bit security is not nearly as well understood we study the implementations of NewHope, Frodo, and Kyber. These as for factoring and discrete logarithms). On the other hand, schemes form a representative sample of modern, practical lattice- there is currently a distinct lack of cryptanalytic results based signatures and key exchange protocols, and achieve a high level on the physical security of implementations of lattice-based of efficiency in both software and hardware. We present several fault schemes (or in fact, postquantum schemes in general! [66]). attacks against those schemes that recover the entire key recovery with It is well-known that physical attacks, particularly against only a few faulty executions (sometimes only one), show that those attacks can be mounted in practice based on concrete experiments in public-key schemes, are often simpler, easier to mount hardware, and discuss possible countermeasures against them.
    [Show full text]