Criptografía poscuántica

La criptografía poscuántica es distinta de la criptografía cuántica , que se refiere al uso de fenómenos cuánticos para lograr el secreto y detectar escuchas clandestinas.

Cryptography that is secure against quantum computers

La criptografía poscuántica (a veces denominada a prueba de cuánticos , cuántica segura o cuántica resistente ) se refiere a algoritmos criptográficos (generalmente algoritmos de clave pública) que se cree que son seguros contra un ataque criptoanalítico de una computadora cuántica . A partir de 2021 ^[update], esto no es cierto para los algoritmos de clave pública más populares, que pueden romperse de manera eficiente con una computadora cuántica lo suficientemente fuerte. ^{[ cita requerida ]} El problema con los algoritmos actualmente populares es que su seguridad se basa en uno de tres problemas matemáticos difíciles: el problema de factorización de enteros, el problema del logaritmo discreto o el problema del logaritmo discreto de curva elíptica . Todos estos problemas pueden resolverse fácilmente en una computadora cuántica lo suficientemente potente que ejecute el algoritmo de Shor . ^{[1] [2]} A pesar de que las computadoras cuánticas experimentales actuales, conocidas públicamente, carecen de poder de procesamiento para romper cualquier algoritmo criptográfico real, ^[3] muchos criptógrafos están diseñando nuevos algoritmos para prepararse para un momento en que la computación cuántica se convierta en una amenaza. Este trabajo ha ganado una mayor atención de los académicos y la industria a través de la serie de conferencias PQCrypto desde 2006 y, más recientemente, a través de varios talleres sobre criptografía cuántica segura organizados por elInstituto Europeo de Normas de Telecomunicaciones (ETSI) y el Instituto de Computación Cuántica . ^{[4] [5] [6]}

En contraste con la amenaza que representa la computación cuántica para los algoritmos de clave pública actuales, la mayoría de los algoritmos criptográficos simétricos y las funciones hash actuales se consideran relativamente seguros contra los ataques de las computadoras cuánticas. ^{[2] [7]} Si bien el algoritmo cuántico de Grover acelera los ataques contra cifrados simétricos, duplicar el tamaño de la clave puede bloquear eficazmente estos ataques. ^[8] Por lo tanto, la criptografía simétrica post-cuántica no necesita diferir significativamente de la criptografía simétrica actual. Consulte la sección sobre el enfoque de clave simétrica a continuación.

Algoritmos

Actualmente, la investigación de la criptografía post-cuántica se centra principalmente en seis enfoques diferentes: ^{[2] [5]}

Criptografía basada en celosía

Artículo principal: criptografía basada en celosía

Este enfoque incluye sistemas criptográficos, tales como el aprendizaje con errores , aprendizaje anillo con errores ( ring-LWE ), ^{[9] [10] [11]} el aprendizaje anillo con errores de intercambio de claves y el aprendizaje anillo con errores firma , la mayor NTRU o GGH esquemas de cifrado y la firma NTRU más reciente y las firmas BLISS . ^[12] Algunos de estos esquemas, como el cifrado NTRU, se han estudiado durante muchos años sin que nadie haya encontrado un ataque factible. Otros, como los algoritmos ring-LWE, tienen pruebas de que su seguridad se reduce al peor de los casos.^[13] El Grupo de Estudio de Criptografía Post Quantum patrocinado por la Comisión Europea sugirió que la variante Stehle-Steinfeld de NTRU sea estudiada para estandarización en lugar del algoritmo NTRU. ^{[14] [15]} En ese momento, NTRU todavía estaba patentado. Los estudios han indicado que NTRU puede tener propiedades más seguras que otros algoritmos basados ​​en celosía. ^[dieciséis]

Criptografía multivariante

Artículo principal: criptografía multivariante

Esto incluye sistemas criptográficos como el esquema Rainbow ( Unbalanced Oil and Vinegar ) que se basa en la dificultad de resolver sistemas de ecuaciones multivariadas. Varios intentos de construir esquemas seguros de cifrado de ecuaciones multivariantes han fracasado. Sin embargo, los esquemas de firma multivariante como Rainbow podrían proporcionar la base para una firma digital cuántica segura. ^[17] Existe una patente sobre el Rainbow Signature Scheme.

Criptografía basada en hash

Artículo principal: criptografía basada en hash

Esto incluye sistemas criptográficos como las firmas Lamport y el esquema de firma Merkle y los esquemas más nuevos XMSS ^[18] y SPHINCS ^[19] . Las firmas digitales basadas en hash fueron inventadas a fines de la década de 1970 por Ralph Merkley se han estudiado desde entonces como una alternativa interesante a las firmas digitales teóricas de números como RSA y DSA. Su principal inconveniente es que para cualquier clave pública basada en hash, existe un límite en la cantidad de firmas que se pueden firmar utilizando el conjunto correspondiente de claves privadas. Este hecho había reducido el interés en estas firmas hasta que se reavivó el interés debido al deseo de una criptografía resistente al ataque de las computadoras cuánticas. No parece haber patentes sobre el esquema de firma de Merkle ^{[ cita requerida ]} y existen muchas funciones hash no patentadas que podrían usarse con estos esquemas. El esquema de firma basado en hash con estado XMSS desarrollado por un equipo de investigadores bajo la dirección de Johannes Buchmannse describe en RFC 8391. ^[20] Tenga en cuenta que todos los esquemas anteriores son firmas únicas o de tiempo limitado, Moni Naor y Moti Yung inventaron el hash UOWHF en 1989 y diseñaron una firma basada en hash (el esquema Naor-Yung) ^{[ 21]} que puede tener un uso ilimitado (la primera firma de este tipo que no requiere propiedades de trampilla).

Criptografía basada en código

Esto incluye sistemas criptográficos que se basan en códigos de corrección de errores , como los algoritmos de encriptación McEliece y Niederreiter y el esquema relacionado Courtois, Finiasz y Sendrier Signature . La firma original de McEliece utilizando códigos Goppa aleatorios ha resistido el escrutinio durante más de 30 años. Sin embargo, se ha demostrado que muchas variantes del esquema de McEliece, que buscan introducir más estructura en el código utilizado para reducir el tamaño de las claves, son inseguras. ^[22] El Grupo de Estudio de Criptografía Post Quantum patrocinado por la Comisión Europea ha recomendado el sistema de cifrado de clave pública McEliece como candidato para la protección a largo plazo contra ataques de computadoras cuánticas. ^[14]

Criptografía de isogenia de curva elíptica supersingular

Artículo principal: intercambio de claves de isogenia supersingular

Este sistema criptográfico se basa en las propiedades de las curvas elípticas supersingulares y los gráficos de isogenia supersingular para crear un reemplazo Diffie-Hellman con sigilo directo . ^[23] Este sistema criptográfico utiliza las matemáticas bien estudiadas de curvas elípticas supersingulares para crear un intercambio de claves tipo Diffie-Hellman que puede servir como un sencillo reemplazo resistente a la computación cuántica para los métodos de intercambio de claves Diffie-Hellman y curva elíptica Diffie-Hellman que son de uso generalizado en la actualidad. Debido a que funciona de manera muy similar a las implementaciones existentes de Diffie-Hellman, ofrece un secreto avanzado que se considera importante tanto para evitar la vigilancia masivapor los gobiernos, sino también para proteger contra el compromiso de claves a largo plazo debido a fallas. ^[24] En 2012, los investigadores Sun, Tian y Wang del Laboratorio de Claves Estatales de China para Redes de Servicios Integrados y la Universidad de Xidian, ampliaron el trabajo de De Feo, Jao y Plut para crear firmas digitales cuánticas seguras basadas en isogenias de curvas elípticas supersingulares. ^[25] No existen patentes que cubran este sistema criptográfico.

Resistencia cuántica de clave simétrica

Siempre que se utilicen tamaños de clave suficientemente grandes, los sistemas criptográficos de clave simétrica como AES y SNOW 3G ya son resistentes al ataque de una computadora cuántica. ^[26] Además, los sistemas y protocolos de gestión de claves que utilizan criptografía de clave simétrica en lugar de criptografía de clave pública como Kerberos y la estructura de autenticación de red móvil 3GPP también son intrínsecamente seguros contra el ataque de una computadora cuántica. Dado su despliegue generalizado en el mundo, algunos investigadores recomiendan un uso ampliado de la gestión de claves simétricas similar a Kerberos como una forma eficiente de obtener criptografía postcuántica en la actualidad. ^[27]

Reducciones de seguridad

En la investigación de la criptografía, es deseable probar la equivalencia de un algoritmo criptográfico y un problema matemático difícil conocido. Estas pruebas a menudo se denominan "reducciones de seguridad" y se utilizan para demostrar la dificultad de descifrar el algoritmo de cifrado. En otras palabras, la seguridad de un algoritmo criptográfico dado se reduce a la seguridad de un problema difícil conocido. Los investigadores están buscando activamente reducciones de seguridad en las perspectivas de la criptografía postcuántica. Los resultados actuales se dan aquí:

Criptografía basada en celosía - Firma Ring-LWE

Más información: Aprendizaje en anillo con intercambio de claves de errores

En algunas versiones de Ring-LWE hay una reducción de seguridad al problema del vector más corto (SVP) en una celosía como límite inferior de la seguridad. Se sabe que el SVP es NP-hard . ^[28] Los sistemas de anillo-LWE específicos que tienen reducciones de seguridad demostrables incluyen una variante de las firmas de anillo-LWE de Lyubashevsky definidas en un artículo de Güneysu, Lyubashevsky y Pöppelmann. ^[10] El esquema de firma GLYPH es una variante de la firma Güneysu, Lyubashevsky y Pöppelmann (GLP) que tiene en cuenta los resultados de la investigación que se han obtenido después de la publicación de la firma GLP en 2012. Otra firma Ring-LWE es Ring-TESLA . ^[29] There also exists a "derandomized variant" of LWE, called Learning with Rounding (LWR), which yields " improved speedup (by eliminating sampling small errors from a Gaussian-like distribution with deterministic errors) and bandwidth."^[30] While LWE utilizes the addition of a small error to conceal the lower bits, LWR utilizes rounding for the same purpose.

Lattice-based cryptography – NTRU, BLISS

The security of the NTRU encryption scheme and the BLISS^[12] signature is believed to be related to, but not provably reducible to, the Closest Vector Problem (CVP) in a Lattice. The CVP is known to be NP-hard. The Post Quantum Cryptography Study Group sponsored by the European Commission suggested that the Stehle–Steinfeld variant of NTRU which does have a security reduction be studied for long term use instead of the original NTRU algorithm.^[14]

Multivariate cryptography – Unbalanced Oil and Vinegar

Further information: Multivariate cryptography

Unbalanced Oil and Vinegar signature schemes are asymmetric cryptographic primitives based on multivariate polynomials over a finite field ${\displaystyle \mathbb {F} }$. Bulygin, Petzoldt and Buchmann have shown a reduction of generic multivariate quadratic UOV systems to the NP-Hard Multivariate Quadratic Equation Solving problem.^[31]

Hash-based cryptography – Merkle signature scheme

Further information: Hash-based cryptography and Merkle signature scheme

In 2005, Luis Garcia proved that there was a security reduction of Merkle Hash Tree signatures to the security of the underlying hash function. Garcia showed in his paper that if computationally one-way hash functions exist then the Merkle Hash Tree signature is provably secure.^[32]

Therefore, if one used a hash function with a provable reduction of security to a known hard problem one would have a provable security reduction of the Merkle tree signature to that known hard problem.^[33]

The Post Quantum Cryptography Study Group sponsored by the European Commission has recommended use of Merkle signature scheme for long term security protection against quantum computers.^[14]

Code-based cryptography – McEliece

Further information: McEliece cryptosystem

The McEliece Encryption System has a security reduction to the Syndrome Decoding Problem (SDP). The SDP is known to be NP-hard^[34] The Post Quantum Cryptography Study Group sponsored by the European Commission has recommended the use of this cryptography for long term protection against attack by a quantum computer.^[14]

Code-based cryptography – RLCE

In 2016, Wang proposed a random linear code encryption scheme RLCE^[35] which is based on McEliece schemes. RLCE scheme can be constructed using any linear code such as Reed-Solomon code by inserting random columns in the underlying linear code generator matrix.

Supersingular elliptic curve isogeny cryptography

Further information: Supersingular isogeny key exchange

Security is related to the problem of constructing an isogeny between two supersingular curves with the same number of points. The most recent investigation of the difficulty of this problem is by Delfs and Galbraith indicates that this problem is as hard as the inventors of the key exchange suggest that it is.^[36] There is no security reduction to a known NP-hard problem.

Comparison

One common characteristic of many post-quantum cryptography algorithms is that they require larger key sizes than commonly used "pre-quantum" public key algorithms. There are often tradeoffs to be made in key size, computational efficiency and ciphertext or signature size. The table lists some values for different schemes at a 128 bit post-quantum security level.

Algorithm	Type	Public Key	Private Key	Signature
NTRU Encrypt[37]	Lattice	6130 B	6743 B
Streamlined NTRU Prime	Lattice	1232 B
Rainbow[38]	Multivariate	124 KB	95 KB
SPHINCS[19]	Hash Signature	1 KB	1 KB	41 KB
SPHINCS+[39]	Hash Signature	32 B	64 B	8 KB
BLISS-II	Lattice	7 KB	2 KB	5 KB
GLP-Variant GLYPH Signature[10][40]	Ring-LWE	2 KB	0.4 KB	1.8 KB
New Hope[41]	Ring-LWE	2 KB	2 KB
Goppa-based McEliece[14]	Code-based	1 MB	11.5 KB
Random Linear Code based encryption[42]	RLCE	115 KB	3 KB
Quasi-cyclic MDPC-based McEliece[43]	Code-based	1232 B	2464 B
SIDH[44]	Isogeny	751 B	48 B
SIDH (compressed keys)[45]	Isogeny	564 B	48 B
3072-bit Discrete Log	not PQC	384 B	32 B	96 B
256-bit Elliptic Curve	not PQC	32 B	32 B	65 B

A practical consideration on a choice among post-quantum cryptographic algorithms is the effort required to send public keys over the internet. From this point of view, the Ring-LWE, NTRU, and SIDH algorithms provide key sizes conveniently under 1KB, hash-signature public keys come in under 5KB, and MDPC-based McEliece takes about 1KB. On the other hand, Rainbow schemes require about 125KB and Goppa-based McEliece requires a nearly 1MB key.

Lattice-based cryptography – LWE key exchange and Ring-LWE key exchange

Further information: Ring learning with errors key exchange

The fundamental idea of using LWE and Ring LWE for key exchange was proposed and filed at the University of Cincinnati in 2011 by Jintai Ding. The basic idea comes from the associativity of matrix multiplications, and the errors are used to provide the security. The paper^[46] appeared in 2012 after a provisional patent application was filed in 2012.

In 2014, Peikert^[47] presented a key transport scheme following the same basic idea of Ding's, where the new idea of sending additional 1 bit signal for rounding in Ding's construction is also utilized. For somewhat greater than 128 bits of security, Singh presents a set of parameters which have 6956-bit public keys for the Peikert's scheme.^[48] The corresponding private key would be roughly 14,000 bits.

In 2015, an authenticated key exchange with provable forward security following the same basic idea of Ding's was presented at Eurocrypt 2015,^[49] which is an extension of the HMQV^[50] construction in Crypto2005. The parameters for different security levels from 80 bits to 350 bits, along with the corresponding key sizes are provided in the paper.^[49]

Lattice-based cryptography – NTRU encryption

Further information: NTRUEncrypt

For 128 bits of security in NTRU, Hirschhorn, Hoffstein, Howgrave-Graham and Whyte, recommend using a public key represented as a degree 613 polynomial with coefficients ${\displaystyle {\bmod {\left(2^{10}\right)}}}$. This results in a public key of 6130 bits. The corresponding private key would be 6743 bits.^[37]

Multivariate cryptography – Rainbow signature

Further information: Multivariate cryptography

For 128 bits of security and the smallest signature size in a Rainbow multivariate quadratic equation signature scheme, Petzoldt, Bulygin and Buchmann, recommend using equations in ${\displaystyle \mathbb {F} _{31}}$ with a public key size of just over 991,000 bits, a private key of just over 740,000 bits and digital signatures which are 424 bits in length.^[38]

Hash-based cryptography – Merkle signature scheme

Further information: Hash-based cryptography and Merkle signature scheme

In order to get 128 bits of security for hash based signatures to sign 1 million messages using the fractal Merkle tree method of Naor Shenhav and Wool the public and private key sizes are roughly 36,000 bits in length.^[51]

Code-based cryptography – McEliece

Further information: McEliece cryptosystem

For 128 bits of security in a McEliece scheme, The European Commissions Post Quantum Cryptography Study group recommends using a binary Goppa code of length at least ${\displaystyle n=6960}$ and dimension at least ${\displaystyle k=5413}$, and capable of correcting ${\displaystyle t=119}$ errors. With these parameters the public key for the McEliece system will be a systematic generator matrix whose non-identity part takes ${\displaystyle k\times (n-k)=8373911}$ bits. The corresponding private key, which consists of the code support with ${\displaystyle n=6960}$ elements from ${\displaystyle GF(2^{13})}$ and a generator polynomial of with ${\displaystyle t=119}$ coefficients from ${\displaystyle GF(2^{13})}$, will be 92,027 bits in length^[14]

The group is also investigating the use of Quasi-cyclic MDPC codes of length at least ${\displaystyle n=2^{16}+6=65542}$ and dimension at least ${\displaystyle k=2^{15}+3=32771}$, and capable of correcting ${\displaystyle t=264}$ errors. With these parameters the public key for the McEliece system will be the first row of a systematic generator matrix whose non-identity part takes ${\displaystyle k=32771}$ bits. The private key, a quasi-cyclic parity-check matrix with ${\displaystyle d=274}$ nonzero entries on a column (or twice as much on a row), takes no more than ${\displaystyle d\times 16=4384}$ bits when represented as the coordinates of the nonzero entries on the first row.

Barreto et al. recommend using a binary Goppa code of length at least ${\displaystyle n=3307}$ and dimension at least ${\displaystyle k=2515}$, and capable of correcting ${\displaystyle t=66}$ errors. With these parameters the public key for the McEliece system will be a systematic generator matrix whose non-identity part takes ${\displaystyle k\times (n-k)=1991880}$ bits.^[52] The corresponding private key, which consists of the code support with ${\displaystyle n=3307}$ elements from ${\displaystyle GF(2^{12})}$ and a generator polynomial of with ${\displaystyle t=66}$ coefficients from ${\displaystyle GF(2^{12})}$, will be 40,476 bits in length.

Supersingular elliptic curve isogeny cryptography

Further information: Supersingular isogeny key exchange

For 128 bits of security in the supersingular isogeny Diffie-Hellman (SIDH) method, De Feo, Jao and Plut recommend using a supersingular curve modulo a 768-bit prime. If one uses elliptic curve point compression the public key will need to be no more than 8x768 or 6144 bits in length.^[53] A March 2016 paper by authors Azarderakhsh, Jao, Kalach, Koziel, and Leonardi showed how to cut the number of bits transmitted in half, which was further improved by authors Costello, Jao, Longa, Naehrig, Renes and Urbanik resulting in a compressed-key version of the SIDH protocol with public keys only 2640 bits in size.^[45] This makes the number of bits transmitted roughly equivalent to the non-quantum secure RSA and Diffie-Hellman at the same classical security level.^[54]

Symmetric–key-based cryptography

As a general rule, for 128 bits of security in a symmetric-key-based system, one can safely use key sizes of 256 bits. The best quantum attack against generic symmetric-key systems is an application of Grover's algorithm, which requires work proportional to the square root of the size of the key space. To transmit an encrypted key to a device that possesses the symmetric key necessary to decrypt that key requires roughly 256 bits as well. It is clear that symmetric-key systems offer the smallest key sizes for post-quantum cryptography.

Forward secrecy

A public-key system demonstrates a property referred to as perfect forward secrecy when it generates random public keys per session for the purposes of key agreement. This means that the compromise of one message cannot lead to the compromise of others, and also that there is not a single secret value which can lead to the compromise of multiple messages. Security experts recommend using cryptographic algorithms that support forward secrecy over those that do not.^[55] The reason for this is that forward secrecy can protect against the compromise of long term private keys associated with public/private key pairs. This is viewed as a means of preventing mass surveillance by intelligence agencies.

Both the Ring-LWE key exchange and supersingular isogeny Diffie-Hellman (SIDH) key exchange can support forward secrecy in one exchange with the other party. Both the Ring-LWE and SIDH can also be used without forward secrecy by creating a variant of the classic ElGamal encryption variant of Diffie-Hellman.

The other algorithms in this article, such as NTRU, do not support forward secrecy as is.

Any authenticated public key encryption system can be used to build a key exchange with forward secrecy.^[56]

Open Quantum Safe project

Open Quantum Safe^[57][58] (OQS) project was started in late 2016 and has the goal of developing and prototyping quantum-resistant cryptography. It aims to integrate current post-quantum schemes in one library: liboqs.^[59] liboqs is an open source C library for quantum-resistant cryptographic algorithms. liboqs initially focuses on key exchange algorithms. liboqs provides a common API suitable for post-quantum key exchange algorithms, and will collect together various implementations. liboqs will also include a test harness and benchmarking routines to compare performance of post-quantum implementations. Furthermore, OQS also provides integration of liboqs into OpenSSL.^[60]

As of April 2017, the following key exchange algorithms are supported:^[57]

Algorithm	Type
BCNS15[61]	Ring learning with errors key exchange
NewHope[62][41]	Ring learning with errors key exchange
Frodo[63]	Learning with errors
NTRU[64]	Lattice-based cryptography
SIDH[65][66]	Supersingular isogeny key exchange
McBits[67]	Error-correcting codes

Implementation

One of the main challenges in post-quantum cryptography is considered to be the implementation of potentially quantum safe algorithms into existing systems. There are tests done, for example by Microsoft Research implementing PICNIC in a PKI using Hardware security modules.^[68] Test implementations for Google's NewHope algorithm have also been done by HSM vendors.

See also

• Ideal lattice cryptography – ring-learning with errors is one example of ideal lattice cryptography
• Post-Quantum Cryptography Standardization – by NIST
• Quantum cryptography – for cryptography based on quantum mechanics

References

1. Peter W. Shor (1997). "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer". SIAM Journal on Computing. 26 (5): 1484–1509. arXiv:quant-ph/9508027. Bibcode:1995quant.ph..8027S. doi:10.1137/S0097539795293172. S2CID 2337707.
2. Daniel J. Bernstein (2009). "Introduction to post-quantum cryptography" (PDF). Post-Quantum Cryptography.
3. "New qubit control bodes well for future of quantum computing". phys.org.
4. "Cryptographers Take On Quantum Computers". IEEE Spectrum. 2009-01-01.
5. "Q&A With Post-Quantum Computing Cryptography Researcher Jintai Ding". IEEE Spectrum. 2008-11-01.
6. "ETSI Quantum Safe Cryptography Workshop". ETSI Quantum Safe Cryptography Workshop. ETSI. October 2014. Archived from the original on 17 August 2016. Retrieved 24 February 2015.
7. Daniel J. Bernstein (2009-05-17). "Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete?" (PDF).
8. Daniel J. Bernstein (2010-03-03). "Grover vs. McEliece" (PDF).
9. Peikert, Chris (2014). "Lattice Cryptography for the Internet". IACR. Archived from the original (PDF) on 31 January 2014. Retrieved 10 May 2014.
10. Güneysu, Tim; Lyubashevsky, Vadim; Pöppelmann, Thomas (2012). "Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems" (PDF). INRIA. Retrieved 12 May 2014.
11. Zhang, jiang (2014). "Authenticated Key Exchange from Ideal Lattices". iacr.org. IACR. Archived from the original (PDF) on 17 August 2014. Retrieved 7 September 2014.
12. Ducas, Léo; Durmus, Alain; Lepoint, Tancrède; Lyubashevsky, Vadim (2013). "Lattice Signatures and Bimodal Gaussians". Retrieved 2015-04-18.
13. Lyubashevsky, Vadim; =Peikert; Regev (2013). "On Ideal Lattices and Learning with Errors Over Rings". IACR. Archived from the original (PDF) on 22 July 2013. Retrieved 14 May 2013.
14. Augot, Daniel (7 September 2015). "Initial recommendations of long-term secure post-quantum systems" (PDF). PQCRYPTO. Retrieved 13 September 2015.
15. Stehlé, Damien; Steinfeld, Ron (2013-01-01). "Making NTRUEncrypt and NTRUSign as Secure as Standard Worst-Case Problems over Ideal Lattices".
16. Easttom, Chuck (2019-02-01). "An Analysis of Leading Lattice-Based Asymmetric Cryptographic Primitives". An Analysis of Leading Lattice-Based Asymmetric Cryptographic Primitivess. pp. 0811–0818. doi:10.1109/CCWC.2019.8666459. ISBN 978-1-7281-0554-3. S2CID 77376310.
17. Ding, Jintai; Schmidt (7 June 2005). "Rainbow, a New Multivariable Polynomial Signature Scheme". In Ioannidis, John (ed.). Third International Conference, ACNS 2005, New York, NY, USA, June 7–10, 2005. Proceedings. Lecture Notes in Computer Science. 3531. pp. 64–175. doi:10.1007/11496137_12. ISBN 978-3-540-26223-7.
18. Buchmann, Johannes; Dahmen, Erik; Hülsing, Andreas (2011). "XMSS - A Practical Forward Secure Signature Scheme Based on Minimal Security Assumptions". Post-Quantum Cryptography. PQCrypto 2011. Lecture Notes in Computer Science. 7071. pp. 117–129. CiteSeerX 10.1.1.400.6086. doi:10.1007/978-3-642-25405-5_8. ISSN 0302-9743.
19. Bernstein, Daniel J.; Hopwood, Daira; Hülsing, Andreas; Lange, Tanja; Niederhagen, Ruben; Papachristodoulou, Louiza; Schneider, Michael; Schwabe, Peter; Wilcox-O’Hearn, Zooko (2015). Oswald, Elisabeth; Fischlin, Marc (eds.). SPHINCS: practical stateless hash-based signatures. Lecture Notes in Computer Science. 9056. Springer Berlin Heidelberg. pp. 368–397. CiteSeerX 10.1.1.690.6403. doi:10.1007/978-3-662-46800-5_15. ISBN 9783662467992.
20. "RFC 8391 - XMSS: eXtended Merkle Signature Scheme". tools.ietf.org.
21. Moni Naor, Moti Yung: Universal One-Way Hash Functions and their Cryptographic Applications .STOC 1989: 33-43
22. Overbeck, Raphael; Sendrier (2009). Bernstein, Daniel (ed.). Code-based cryptography. Post-Quantum Cryptography. pp. 95–145. doi:10.1007/978-3-540-88702-7_4. ISBN 978-3-540-88701-0.
23. De Feo, Luca; Jao; Plut (2011). "Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies" (PDF). PQCrypto 2011. Retrieved 14 May 2014.
24. Higgins, Peter (2013). "Pushing for Perfect Forward Secrecy, an Important Web Privacy Protection". Electronic Frontier Foundation. Retrieved 15 May 2014.
25. Sun, Xi; Tian; Wang (19–21 Sep 2012). Browse Conference Publications > Intelligent Networking and Co … Help Working with Abstracts Toward Quantum-Resistant Strong Designated Verifier Signature from Isogenies. Intelligent Networking and Collaborative Systems (INCoS), 2012 4th International Conference on. pp. 292–296. doi:10.1109/iNCoS.2012.70. ISBN 978-1-4673-2281-2. S2CID 18204496.
26. Perlner, Ray; Cooper (2009). "Quantum Resistant Public Key Cryptography: A Survey". NIST. Retrieved 23 Apr 2015.
27. Campagna, Matt; Hardjono; Pintsov; Romansky; Yu (2013). "Kerberos Revisited Quantum-Safe Authentication" (PDF). ETSI.
28. Lyubashevsky, Vadim; Peikert; Regev (25 June 2013). "On Ideal Lattices and Learning with Errors Over Rings" (PDF). Springer. Retrieved 19 June 2014.
29. Akleylek, Sedat; Bindel, Nina; Buchmann, Johannes; Krämer, Juliane; Marson, Giorgia Azzurra (2016). "An Efficient Lattice-Based Signature Scheme with Provably Secure Instantiation".
30. Nejatollahi, Hamid; Dutt, Nikil; Ray, Sandip; Regazzoni, Francesco; Banerjee, Indranil; Cammarota, Rosario (2019-02-27). "Post-Quantum Lattice-Based Cryptography Implementations: A Survey". ACM Computing Surveys. 51 (6): 1–41. doi:10.1145/3292548. ISSN 0360-0300. S2CID 59337649.
31. Bulygin, Stanislav; Petzoldt; Buchmann (2010). "Towards Provable Security of the Unbalanced Oil and Vinegar Signature Scheme under Direct Attacks". Progress in Cryptology – INDOCRYPT 2010. Lecture Notes in Computer Science. 6498. pp. 17–32. CiteSeerX 10.1.1.294.3105. doi:10.1007/978-3-642-17401-8_3. ISBN 978-3-642-17400-1.
32. Pereira, Geovandro; Puodzius, Cassius; Barreto, Paulo (2016). "Shorter hash-based signatures". Journal of Systems and Software. 116: 95–100. doi:10.1016/j.jss.2015.07.007.
33. Garcia, Luis. "On the security and the efficiency of the Merkle signature scheme" (PDF). Cryptology ePrint Archive. IACR. Retrieved 19 June 2013.
34. Blaum, Mario; Farrell; Tilborg (31 May 2002). Information, Coding and Mathematics. Springer. ISBN 978-1-4757-3585-7.
35. Wang, Yongge (2016). "Quantum resistant random linear code based public key encryption scheme RLCE". Proceedings of Information Theory (ISIT). IEEE ISIT: 2519–2523. arXiv:1512.08454. Bibcode:2015arXiv151208454W.
36. Delfs, Christina; Galbraith (2013). "Computing isogenies between supersingular elliptic curves over F_p". arXiv:1310.7789 [math.NT].
37. Hirschborrn, P; Hoffstein; Howgrave-Graham; Whyte. "Choosing NTRUEncrypt Parameters in Light of Combined Lattice Reduction and MITM Approaches" (PDF). NTRU. Archived from the original (PDF) on 30 January 2013. Retrieved 12 May 2014.
38. Petzoldt, Albrecht; Bulygin; Buchmann (2010). "Selecting Parameters for the Rainbow Signature Scheme – Extended Version -". Archived from the original (PDF) on 11 Aug 2010. Retrieved 12 May 2014.
39. "SPHINCS+: Submission to the NIST post-quantum project" (PDF).
40. Chopra, Arjun (2017). "GLYPH: A New Insantiation of the GLP Digital Signature Scheme".
41. Alkim, Erdem; Ducas, Léo; Pöppelmann, Thomas; Schwabe, Peter (2015). "Post-quantum key exchange - a new hope" (PDF). Cryptology ePrint Archive, Report 2015/1092. Retrieved 1 September 2017.
42. Wang, Yongge (2017). "Revised Quantum Resistant Public Key Encryption Scheme RLCE and IND-CCA2 Security for McEliece Schemes".
43. Misoczki, R.; Tillich, J. P.; Sendrier, N.; Barreto, P. S. L. M. (2013). MDPC-McEliece: New McEliece variants from Moderate Density Parity-Check codes. 2013 IEEE International Symposium on Information Theory. pp. 2069–2073. CiteSeerX 10.1.1.259.9109. doi:10.1109/ISIT.2013.6620590. ISBN 978-1-4799-0446-4. S2CID 9485532.
44. Costello, Craig; Longa, Patrick; Naehrig, Michael (2016). "Efficient algorithms for supersingular isogeny Diffie-Hellman" (PDF). Advances in Cryptology.
45. Costello, Craig; Jao; Longa; Naehrig; Renes; Urbanik. "Efficient Compression of SIDH public keys". Retrieved 8 October 2016.
46. Lin, Jintai Ding, Xiang Xie, Xiaodong (2012-01-01). "A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem".
47. Peikert, Chris (2014-01-01). "Lattice Cryptography for the Internet".
48. Singh, Vikram (2015). "A Practical Key Exchange for the Internet using Lattice Cryptography". Retrieved 2015-04-18.
49. Zhang, Jiang; Zhang, Zhenfeng; Ding, Jintai; Snook, Michael; Dagdelen, Özgür (2015-04-26). "Authenticated Key Exchange from Ideal Lattices". In Oswald, Elisabeth; Fischlin, Marc (eds.). Advances in Cryptology - EUROCRYPT 2015. Lecture Notes in Computer Science. Springer Berlin Heidelberg. pp. 719–751. CiteSeerX 10.1.1.649.1864. doi:10.1007/978-3-662-46803-6_24. ISBN 978-3-662-46802-9.
50. Krawczyk, Hugo (2005-08-14). "HMQV: A High-Performance Secure Diffie-Hellman Protocol". In Shoup, Victor (ed.). Advances in Cryptology – CRYPTO 2005. Lecture Notes in Computer Science. 3621. Springer. pp. 546–566. doi:10.1007/11535218_33. ISBN 978-3-540-28114-6.
51. Naor, Dalit; Shenhav; Wool (2006). "One-Time Signatures Revisited: Practical Fast Signatures Using Fractal Merkle Tree Traversal" (PDF). IEEE. Retrieved 13 May 2014.
52. Barreto, Paulo S. L. M.; Biasi, Felipe Piazza; Dahab, Ricardo; López-Hernández, Julio César; Morais, Eduardo M. de; Oliveira, Ana D. Salina de; Pereira, Geovandro C. C. F.; Ricardini, Jefferson E. (2014). Koç, Çetin Kaya (ed.). A Panorama of Post-quantum Cryptography. Springer International Publishing. pp. 387–439. doi:10.1007/978-3-319-10683-0_16. ISBN 978-3-319-10682-3.
53. De Feo, Luca; Jao; Plut (2011). "Towards Quantum-Resistant Cryptosystems From Supersingular Elliptic Curve Isogenies". Archived from the original (PDF) on October 2011. Retrieved 12 May 2014.
54. "Cryptology ePrint Archive: Report 2016/229". eprint.iacr.org. Retrieved 2016-03-02.
55. Ristic, Ivan (2013-06-25). "Deploying Forward Secrecy". SSL Labs. Retrieved 14 June 2014.
56. "Does NTRU provide Perfect Forward Secrecy?". crypto.stackexchange.com.
57. "Open Quantum Safe". openquantumsafe.org.
58. Stebila, Douglas; Mosca, Michele. "Post-Quantum Key Exchange for the Internet and the Open Quantum Safe Project". Cryptology ePrint Archive, Report 2016/1017, 2016. Retrieved 9 April 2017.
59. "liboqs: C library for quantum-resistant cryptographic algorithms". 26 November 2017 – via GitHub.
60. "openssl: Fork of OpenSSL that includes quantum-resistant algorithms and ciphersuites based on liboqs". 9 November 2017 – via GitHub.
61. Stebila, Douglas (26 Mar 2018). "liboqs nist-branch algorithm datasheet: kem_newhopenist". GitHub. Retrieved 27 September 2018.
62. "Lattice Cryptography Library". Microsoft Research. 19 Apr 2016. Retrieved 27 September 2018.
63. Bos, Joppe; Costello, Craig; Ducas, Léo; Mironov, Ilya; Naehrig, Michael; Nikolaenko, Valeria; Raghunathan, Ananth; Stebila, Douglas (2016-01-01). "Frodo: Take off the ring! Practical, Quantum-Secure Key Exchange from LWE".
64. "NTRUOpenSourceProject/NTRUEncrypt". GitHub. Retrieved 2017-04-10.
65. "SIDH Library - Microsoft Research". Microsoft Research. Retrieved 2017-04-10.
66. Feo, Luca De; Jao, David; Plût, Jérôme (2011-01-01). "Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies". Archived from the original on 2014-05-03.
67. Bernstein, Daniel J.; Chou, Tung; Schwabe, Peter (2015-01-01). "McBits: fast constant-time code-based cryptography".
68. "Microsoft/Picnic" (PDF). GitHub. Retrieved 2018-06-27.

Further reading

• Post-Quantum Cryptography. Springer. 2008. p. 245. ISBN 978-3-540-88701-0.
• Isogenies in a Quantum World
• On Ideal Lattices and Learning With Errors Over Rings
• Kerberos Revisited: Quantum-Safe Authentication
• The picnic signature scheme

External links

• PQCrypto, the post-quantum cryptography conference
• ETSI Quantum Secure Standards Effort
• NIST's Post-Quantum crypto Project
• PQCrypto Usage & Deployment