In 2014, Peikert described the first practical lattice-based key exchange that is provably secure and provides perfect forward security. However, his presentation lacks concrete proposals for parameters. We aim to provide a clear description of how the algorithm can be implemented along with some analysis for potential parameters. Previously in 2015, Singh considered the simpler case, as chosen by Bos, Costello, Naehrig and Stebila in 2014, of cyclotomic rings with power-of-two degree. In this work we focus on the case of cyclotomic rings with degree p− 1 for prime p. This allows for a greater degree of flexibility in choosing lattice dimension, which determines the security level and efficiency of the scheme. We describe the necessary arithmetic setup and then present Peikert’s DiffieHellman-like key exchange along with security, correctness and implementation analysis.
In 2014, Peikert described the first practical lattice-based key exchange that is provably secure and provides perfect forward security. However, his presentation lacks concrete proposals for parameters. We aim to provide a clear description of how the algorithm can be implemented along with some analysis for potential parameters. Previously in 2015, Singh considered the simpler case, as chosen by Bos, Costello, Naehrig and Stebila in 2014, of cyclotomic rings with power-of-two degree. In this work we focus on the case of cyclotomic rings with degree p− 1 for prime p. This allows for a greater degree of flexibility in choosing lattice dimension, which determines the security level and efficiency of the scheme. We describe the necessary arithmetic setup and then present Peikert’s DiffieHellman-like key exchange along with security, correctness and implementation analysis.
In [21], Peikert presents an efficient and provably secure set of lower level primitives for practical post-quantum cryptography. These primitives also give the first lattice-based scheme to provide perfect forward secrecy, and thus represent a major advancement in providing the same sort of security guarantees that are now expected for modern internet traffic protection. However, the presentation in [21] might prove a bit daunting for the slightly less mathematical reader. Here we provide what we hope will be a clear and selfcontained exposition of how the algorithm can be implemented, along with sample code and some initial analysis for potential parameter sizes. We focus on the simpler case, as chosen by Bos et al in [1], of cyclotomic rings whose degree is a power of two. We describe the necessary arithmetic setup and choices regarding error sampling, and give a possibly cleaner mechanism for reconciliation of the shared secrets. Then we present Peikert’s Diffie-Hellman-like key exchange algorithms along with security, correctness and implementation analysis. We demonstrate parameter choices that outperform [1] by a factor of up to 13 for equivalent security.
In recent years, lattice-based cryptography has been recognized for its many attractive properties, such as strong provable security guarantees and apparent resistance to quantum attacks, flexibility for realizing powerful tools like fully homomorphic encryption, and high asymptotic efficiency. Indeed, several works have demonstrated that for basic tasks like encryption and authentication, lattice-based primitives can have performance competitive with (or even surpassing) those based on classical mechanisms like RSA or Diffie-Hellman. However, there still has been relatively little work on developing lattice cryptography for deployment in real-world cryptosystems and protocols. In this work we take a step toward that goal, by giving efficient and practical lattice-based protocols for key transport, encryption, and authenticated key exchange that are suitable as “drop-in ” components for proposed Internet standards and other open protocols. The security of all our proposals is provably based (sometimes in the random-oracle model) on the well-studied “learning with errors over rings” problem, and hence on the conjectured worst-case hardness of problems on ideal lattices (against quantum algorithms). One of our main technical innovations (which may be of independent interest) is a simple, low-bandwidth reconciliation technique that allows two parties who “approximately agree ” on a secret value to reach exact agreement, a setting common to essentially all lattice-based encryption schemes. Our technique reduces the ciphertext length of prior (already compact) encryption schemes nearly twofold, at essentially no cost. 1
The invention of public-key cryptography (PKC) by Diffie and Hellman in 1976 is one of two milestones marking the beginning of modern cryptography. The security of a PKC system requires that it should be infeasible to compute the private key from a given public key, which in turn is typically guaranteed by the difficulty in solving some cryptographic-friendly mathematical problems. Among those problems, the integer factorization and discrete logarithm problems play pivotal roles in the development of public-key cryptography. In particular, the assumption that there is no polynomial time (classical) algorithm that solves the above two problems constitutes the basis for the security of almost all currently used public-key cryptosystems, such as RSA and ElGamal. However, Shor [1] found an efficient quantum solving algorithm for the integer factorization and discrete logarithm problems in 1994, which would destroy the security basis for most real deployed PKC systems if large-scale quantum computers become available. The rapid development of quantum technology in recent years suggests that we are getting closer to the quantum crisis of current PKC systems. As a response to the quantum crisis, the research community has made many efforts to post-quantum cryptography (PQC) that are believed to resist quantum computer attacks. Lattice-based cryptography is one of the main directions in this area, and has become the most promising PQC candidate for standardization. The research of lattice-based cryptography dates back to the seminal work of Ajtai [2], which first based the security of cryptographic primitives on the difficulty of solving some lattice problems such as the approximate shortest vector problem and the closest vector problem. After more than two decades of development, lattice-based cryptography has gained substantial progress. In theory, we have witnessed the construction of many powerful cryptographic primitives that were not known before. In practice, the public key size of lattice-based cryptosystems has been significantly reduced from several gigabytes to a few kilobytes. For current applications and standardization, key exchanges, public-key encryptions (PKEs) and signatures are the most desired lattice-based cryptosystems, where the first two are often used to ensure information secrecy, while the last provides information authentication. Note that public-key encryptions are equivalent to two-round key exchanges, also known as the key encapsulation mechanism (KEM). In the following, we focus on lattice-based PKEs/KEMs. The design principle of lattice-based PKEs/KEMs follows two approaches: a trapdoor one-way function and an approximate commutative one-way function. In the first approach, a trapdoor one-way function f and its trapdoor f−1 are generated as the public key and private key. A plaintext m is encrypted as c = f(m), and the ciphertext is decrypted as m = f−1(c). The NTRU scheme and its variants follow such an approach. In the second approach, an approximate commutative function fs and a random input a are generated, the public key is (a, b = fs(a)) and the private key is s. A plaintext m is encrypted as c1 = gr(a), c2 = gr(b) + E(m), where r is a random element, g is an approximate commutative one-way function and E is the encoding of an error-correction code. The ciphertext (c1, c2) is decrypted as m = D(c2 − fs(c1)), where D is the decoding of an error-correction code. The correctness of decryption is guaranteed by the approximate commutative property (gr(b) = gr(fs(a)) ≈ fs(gr(a)) = fs(c1)) and the error-correction code. Learning with errors (LWE) problem-based PKE/KEM schemes and their variants follow such an approach. The standardization of PQC has received substantial support from national funding agencies, such as the European Union projects PQCrypto and SAFEcrypto. The USA National Institute of Standard and Technology (NIST) started the post-quantum standardization project in 2012, organized a worldwide ‘competition’ in 2016 and plans to deliver draft standards before 2024. After two rounds of evaluation, seven schemes were accepted as the round-three candidates on 22 July 2020, of which five are lattice-based schemes. In 2017, the International organization for standardization started a study project of post-quantum cryptography named SD8. Most LWE-based PKE schemes such as Kyber and LAC follow the Lindner-Peikert framework [3] up to the choices of ring structure, noise distribution and parameters. As the size of noise in lattice-based PKEs/EKMs is typically larger than the lower bits of the ciphertext, many schemes often artificially drop a few lower bits to optimize the practical performance without significantly increasing the final decryption noise. Kyber [4] is one of the most promising PKE/KEM candidates in the NIST PQC standardization, whose security is provably based on the difficulty of so-called module LWE (MLWE) problems. The use of MLWE allowed Kyber to obtain additional flexibility and security advantages, while keeping the same efficiency as those based on the ring-LWE problems. The strategy of dropping some lower bits is used to compress both the public-key and ciphertext sizes. For a targeted 128-bit quantum security, the public-key and ciphertext sizes of Kyber is around a single kilobyte. LAC [5] uses several techniques to reduce the modulus as small as possible: it uses a byte-level modulus, embeds powerful error-correcting codes to maximize the noise-modulus rate, provides a different style of modulus to avoid potential attacks for special polynomial ring structures and optimizes the polynomial multiplication algorithm of the bit-level secret and noise. Based on these techniques, LAC reduces the public key to 544–1056 bytes and the ciphertext to 664–1464 bytes. Meanwhile, it achieves similar computational performance compared with NTT technique schemes. By observing the asymmetries in lattice-based cryptosystems, Zhang and Yu et al. [6] proposed asymmetric MLWE and asymmetric MSIS problems, which yield further size-optimized KEMs and signature schemes to those from standard counterparts. Compared to the seven NIST round-three candidates at Category III security, their KEM scheme has parameters (public key + ciphertext size) smaller than Classic McEliece, CRYSTALS-Kyber, NTRU and Saber; their signature scheme has parameters (public key + signature size) smaller than CRYSTALS-Dilithium and Rainbow, but slightly larger than FALCON, where CRYSTALS-Kyber, NTRU, Saber, CRYSTALS-Dilithium and FALCON are lattice-based schemes. One important application of lattice-based PKEs/KEMs is to build authenticated key exchange (AKE), which could provide additional authentication to the established session key. There are several generic ways to construct AKE from lattice-based PKEs/KEMs. In the PKE setting, Xue and Lu et al. [7] proposed a more compact KEM-based framework via a new primitive named ‘2-key KEM’, which shares some item between different ciphertexts. In the only password setting, Zhang and Yu [8] presented a two-round PAKE framework from the splittable-PKEs that can be instantiated from lattices. The only known AKE that does not rely on lattice-based PKEs/KEMs was given in Ref. [9], which has two-round messages and provides implicit authentication. This work was supported by the National Natural Science Foundation of China (6197239 to X.L.; 62022018 and 61932019 to J.Z.) and the National Key Research and Development Program of China (2018YFB0804105 to J.Z.). Conflict of interest statement. None declared.
Authenticated key exchange (AKE) protocols, such as IKE and SSL/TLS, have been widely used to ensure secure com-munication over the Internet. We present in this paper a practical and provably secure AKE protocol from ideal lat-tices, which is conceptually simple and has similarities to the Diffie-Hellman based protocols such as HMQV (CRYP-TO 2005) and OAKE (CCS 2013). Our protocol does not rely on other cryptographic primitives—in particular, it does not use signatures—simplifying the protocol and resting the security solely on the hardness of the ring learning with er-rors (RLWE) problem. The security is proven in a version of the Bellare-Rogaway model, with enhancements to cap-ture weak Perfect Forward Secrecy. We also present concrete choices of parameters for different security levels. A proof-of-concept implementation shows our protocol is a practical candidate post-quantum key exchange protocol. 1.
Lattice-based cryptography stands at the forefront of contemporary cryptographic research, offering robust security guarantees that withstand the challenges posed by quantum computing. This research paper undertakes a comprehensive exploration of lattice-based key exchange protocols, with a specific and meticulous focus on the Ring Learning with Errors (RLWE) problem—a cornerstone in the lattice-based paradigm. In addition, the paper delves deeply into the innovative ding reconciliation technique, strategically employed to amplify the efficiency and effectiveness of RLWE-based key exchange protocols.Within this paper's purview lies a holistic examination of key concepts, intricacies, and recent developments in the field of lattice-based cryptography. The paper rigorously analyzes the theoretical foundations that underpin the security assurances of lattice-based protocols, particularly in the context of post-quantum cryptography. The RLWE problem, as a central tenet, is dissected to unveil its significance as a building block for cryptographic constructions, especially in the realm of key exchange.The integration of the ding reconciliation technique introduces an added layer of depth to the research. By elucidating the mechanics of this method, the paper showcases its role in streamlining the error correction process inherent in RLWE-based protocols. The reconciliation technique's contribution to efficiency is examined through both theoretical analysis and empirical validation, presenting a compelling case for its adoption in practical scenarios.Moreover, this paper critically surveys the landscape of recent developments in lattice-based cryptography, elucidating novel protocol designs, algorithmic optimizations, and real-world applications. The inherent challenges, ranging from computational complexity to practical implementation considerations, are scrutinized, providing a balanced perspective on the field's ongoing evolution.As the paper concludes, it consolidates the insights garnered from its comprehensive review, offering a panoramic understanding of lattice-based cryptography's inner workings. It outlines the broader implications of these cryptographic protocols in safeguarding digital communications and securing data transmission in a quantum-advantaged era. By synthesizing a comprehensive overview, this research paper aims to provide researchers, practitioners, and enthusiasts with a nuanced understanding of lattice-based cryptography, RLWE-based key exchange protocols, and the innovative ding reconciliation technique.
The Ding Reconciliation Scheme is dissected in detail in this study. A recently proposed method within the lattice-based cryptography framework. The study delves into the mathematical foundations and principles of the scheme, its role in secure key exchange, and its in-depth examination of the key exchange protocol that leverages it. It discusses theoretical security guarantees, vulnerabilities, and mitigation strategies. The paper also provides insights into the practical implementation of the scheme, highlighting its computational efficiency and performance evaluations. It also conducts a comparative analysis with other prominent lattice-based key exchange protocols to assess its strengths and weaknesses, highlighting potential advantages and areas for further research. The paper serves as a reference for researchers, cryptographers, and practitioners interested in the Ding Reconciliation Scheme and its applications in lattice-based cryptography, contributing to the ongoing dialogue in the field and promoting advancements in secure communication solutions.