Lattice-based cryptography offers some of the most attractive primitives believed to be resistant to quantum computers. Following increasing interest from both companies and government agencies in building quantum computers, a number of works have proposed instantiations of practical post-quantum key exchange protocols based on hard problems in ideal lattices, mainly based on the Ring Learning With Errors (R-LWE) problem. While ideal lattices facilitate major efficiency and storage benefits over their non-ideal counterparts, the additional ring structure that enables these advantages also raises concerns about the assumed difficulty of the underlying problems. Thus, a question of significant interest to cryptographers, and especially to those currently placing bets on primitives that will withstand quantum adversaries, is how much of an advantage the additional ring structure actually gives in practice. Despite conventional wisdom that generic lattices might be too slow and unwieldy, we demonstrate that LWE-based key exchange is quite practical: our constant time implementation requires around 1.3ms computation time for each party; compared to the recent NewHope R-LWE scheme, communication sizes increase by a factor of 4.7x, but remain under 12 KiB in each direction. Our protocol is competitive when used for serving web pages over TLS; when partnered with ECDSA signatures, latencies increase by less than a factor of 1.6x, and (even under heavy load) server throughput only decreases by factors of 1.5x and 1.2x when serving typical 1 KiB and 100 KiB pages, respectively. To achieve these practical results, our protocol takes advantage of several innovations. These include techniques to optimize communication bandwidth, dynamic generation of public parameters (which also offers additional security against backdoors), carefully chosen error distributions, and tight security parameters.
Lattice-based cryptography offers some of the most attractive primitives believed to be resistant to quantum computers. Following increasing interest from both companies and government agencies in building quantum computers, a number of works have proposed instantiations of practical post-quantum key exchange protocols based on hard problems in ideal lattices, mainly based on the Ring Learning With Errors (R-LWE) problem. While ideal lattices facilitate major efficiency and storage benefits over their non-ideal counterparts, the additional ring structure that enables these advantages also raises concerns about the assumed difficulty of the underlying problems. Thus, a question of significant interest to cryptographers, and especially to those currently placing bets on primitives that will withstand quantum adversaries, is how much of an advantage the additional ring structure actually gives in practice. Despite conventional wisdom that generic lattices might be too slow and unwieldy, we demonstrate that LWE-based key exchange is quite practical: our constant time implementation requires around 1.3ms computation time for each party; compared to the recent NewHope R-LWE scheme, communication sizes increase by a factor of 4.7x, but remain under 12 KiB in each direction. Our protocol is competitive when used for serving web pages over TLS; when partnered with ECDSA signatures, latencies increase by less than a factor of 1.6x, and (even under heavy load) server throughput only decreases by factors of 1.5x and 1.2x when serving typical 1 KiB and 100 KiB pages, respectively. To achieve these practical results, our protocol takes advantage of several innovations. These include techniques to optimize communication bandwidth, dynamic generation of public parameters (which also offers additional security against backdoors), carefully chosen error distributions, and tight security parameters.
Lattice-based cryptographic primitives are believed to offer resilience against attacks by quantum computers. We demonstrate the practicality of post-quantum key exchange by constructing cipher suites for the Transport Layer Security (TLS) protocol that provide key exchange based on the ring learning with errors (R-LWE) problem, we accompany these cipher suites with a rigorous proof of security. Our approach ties lattice-based key exchange together with traditional authentication using RSA or elliptic curve digital signatures: the post-quantum key exchange provides forward secrecy against future quantum attackers, while authentication can be provided using RSA keys that are issued by today's commercial certificate authorities, smoothing the path to adoption. Our cryptographically secure implementation, aimed at the 128-bit security level, reveals that the performance price when switching from non-quantum-safe key exchange is not too high. With our R-LWE cipher suites integrated into the Open SSL library and using the Apache web server on a 2-core desktop computer, we could serve 506 RLWE-ECDSA-AES128-GCM-SHA256 HTTPS connections per second for a 10 KiB payload. Compared to elliptic curve Diffie-Hellman, this means an 8 KiB increased handshake size and a reduction in throughput of only 21%. This demonstrates that provably secure post-quantum key-exchange can already be considered practical.
Lattice-based cryptographic primitives are believed to offer resilience against attacks by quantum computers. We demonstrate the practicality of post-quantum key exchange by constructing cipher suites for the Transport Layer Security (TLS) protocol that provide key exchange based on the ring learning with errors (R-LWE) problem, we accompany these cipher suites with a rigorous proof of security. Our approach ties lattice-based key exchange together with traditional authentication using RSA or elliptic curve digital signatures: the post-quantum key exchange provides forward secrecy against future quantum attackers, while authentication can be provided using RSA keys that are issued by today's commercial certificate authorities, smoothing the path to adoption. Our cryptographically secure implementation, aimed at the 128-bit security level, reveals that the performance price when switching from non-quantum-safe key exchange is not too high. With our R-LWE cipher suites integrated into the Open SSL library and using the Apache web server on a 2-core desktop computer, we could serve 506 RLWE-ECDSA-AES128-GCM-SHA256 HTTPS connections per second for a 10 KiB payload. Compared to elliptic curve Diffie-Hellman, this means an 8 KiB increased handshake size and a reduction in throughput of only 21%. This demonstrates that provably secure post-quantum key-exchange can already be considered practical.
Lattice-based cryptographic primitives are believed to offer resilience against attacks by quantum computers. Following increasing interest from both companies and government agencies in building quantum computers, a number of works have proposed instantiations of practical post-quantum key-exchange protocols based on hard problems in lattices, mainly based on the Ring Learning With Errors (R-LWE) problem.\nIn this work we present an analysis of Ring-LWE based key-exchange mechanisms and compare two implementations of Ring-LWE based key-exchange protocol: BCNS and NewHope. This is important as NewHope protocol implementation outperforms state-of-the art elliptic curve based Diffie-Hellman key-exchange X25519, thus showing that using quantum safe key-exchange is not only a viable option but also a faster one. Specifically, this thesis compares different reconciliation methods, parameter choices, noise sampling algorithms and performance.
In recent years, lattice-based cryptography has been recognized for its many attractive properties, such as strong provable security guarantees and apparent resistance to quantum attacks, flexibility for realizing powerful tools like fully homomorphic encryption, and high asymptotic efficiency. Indeed, several works have demonstrated that for basic tasks like encryption and authentication, lattice-based primitives can have performance competitive with (or even surpassing) those based on classical mechanisms like RSA or Diffie-Hellman. However, there still has been relatively little work on developing lattice cryptography for deployment in real-world cryptosystems and protocols. In this work we take a step toward that goal, by giving efficient and practical lattice-based protocols for key transport, encryption, and authenticated key exchange that are suitable as “drop-in ” components for proposed Internet standards and other open protocols. The security of all our proposals is provably based (sometimes in the random-oracle model) on the well-studied “learning with errors over rings” problem, and hence on the conjectured worst-case hardness of problems on ideal lattices (against quantum algorithms). One of our main technical innovations (which may be of independent interest) is a simple, low-bandwidth reconciliation technique that allows two parties who “approximately agree ” on a secret value to reach exact agreement, a setting common to essentially all lattice-based encryption schemes. Our technique reduces the ciphertext length of prior (already compact) encryption schemes nearly twofold, at essentially no cost. 1
Lattice-based cryptography stands at the forefront of contemporary cryptographic research, offering robust security guarantees that withstand the challenges posed by quantum computing. This research paper undertakes a comprehensive exploration of lattice-based key exchange protocols, with a specific and meticulous focus on the Ring Learning with Errors (RLWE) problem—a cornerstone in the lattice-based paradigm. In addition, the paper delves deeply into the innovative ding reconciliation technique, strategically employed to amplify the efficiency and effectiveness of RLWE-based key exchange protocols.Within this paper's purview lies a holistic examination of key concepts, intricacies, and recent developments in the field of lattice-based cryptography. The paper rigorously analyzes the theoretical foundations that underpin the security assurances of lattice-based protocols, particularly in the context of post-quantum cryptography. The RLWE problem, as a central tenet, is dissected to unveil its significance as a building block for cryptographic constructions, especially in the realm of key exchange.The integration of the ding reconciliation technique introduces an added layer of depth to the research. By elucidating the mechanics of this method, the paper showcases its role in streamlining the error correction process inherent in RLWE-based protocols. The reconciliation technique's contribution to efficiency is examined through both theoretical analysis and empirical validation, presenting a compelling case for its adoption in practical scenarios.Moreover, this paper critically surveys the landscape of recent developments in lattice-based cryptography, elucidating novel protocol designs, algorithmic optimizations, and real-world applications. The inherent challenges, ranging from computational complexity to practical implementation considerations, are scrutinized, providing a balanced perspective on the field's ongoing evolution.As the paper concludes, it consolidates the insights garnered from its comprehensive review, offering a panoramic understanding of lattice-based cryptography's inner workings. It outlines the broader implications of these cryptographic protocols in safeguarding digital communications and securing data transmission in a quantum-advantaged era. By synthesizing a comprehensive overview, this research paper aims to provide researchers, practitioners, and enthusiasts with a nuanced understanding of lattice-based cryptography, RLWE-based key exchange protocols, and the innovative ding reconciliation technique.
The advent of quantum computing poses a significant threat to the security foundations of current asymmetric cryptographic schemes, which primarily rely on the perceived difficulty of integer factorization and discrete logarithm problems. Shor's algorithm, in particular, demonstrates that a sufficiently powerful quantum computer could break these schemes efficiently, necessitating the development of quantum-resistant alternatives. This paper explores the construction of quantum-secure primitives utilizing ideal lattices, a specialized class of lattices that offer enhanced efficiency and structural advantages compared to general lattices. We delve into the theoretical underpinnings of ideal lattices, including the Ring Learning With Errors (Ring-LWE) problem and the NTRU problem, which are believed to be hard even for quantum computers. The paper reviews the evolution of lattice-based cryptography, analyzes the security reductions from worst-case lattice problems to average-case problem instances relevant for cryptographic constructions, and discusses the practical implications for key encapsulation mechanisms and digital signatures. We examine the current state of ideal lattice-based schemes, such as those standardized by NIST, and consider their performance characteristics, key sizes, and resistance to known attacks, including side-channel vulnerabilities. Our analysis highlights that ideal lattices provide a robust and efficient foundation for building the next generation of asymmetric cryptographic primitives, moving beyond the vulnerabilities inherent in factoring-based systems.