The National Institute of Standards and Technology is in the process of selecting post-quantum public-key cryptography (PQC) algorithms through a public competition-like process. Dilithium, a lattice-based signature scheme, is a PQC candidate submitted to the NIST. It offers a fairly good performance with relatively straightforward implementation. In this study, we considered a secure two-party Dilithium signing protocol. We described how to build a distributed key generation and distributed signing protocol for Dilithium. Our protocol achieves a coordinated two-party Dilithium signature generation using Brakersiki/Fan-Vercauteren homomorphic encryption scheme. Our protocol is proven secure against active adversaries corrupting one of the players. Compared with other protocols, our protocol has advantage in resisting quantum computing attacks.
The National Institute of Standards and Technology is in the process of selecting post-quantum public-key cryptography (PQC) algorithms through a public competition-like process. Dilithium, a lattice-based signature scheme, is a PQC candidate submitted to the NIST. It offers a fairly good performance with relatively straightforward implementation. In this study, we considered a secure two-party Dilithium signing protocol. We described how to build a distributed key generation and distributed signing protocol for Dilithium. Our protocol achieves a coordinated two-party Dilithium signature generation using Brakersiki/Fan-Vercauteren homomorphic encryption scheme. Our protocol is proven secure against active adversaries corrupting one of the players. Compared with other protocols, our protocol has advantage in resisting quantum computing attacks.
Quantum computing challenges the mathematical problems anchoring the security of the classical public key algorithms. For quantum-resistant public key algorithms, the National Institute of Standards and Technology (NIST) has undergone a multi-year standardization process and selected the post-quantum cryptography (PQC) public key digital signatures of Dilithium, Falcon, and SPHINCS+. Finding common ground to compare these algorithms can be difficult because of their design differences, including the fundamental math problems (lattice-based vs. hash-based). We use a visualization model to show the key/signature size vs. security trade-offs for all PQC algorithms. Our performance analyses compare the algorithms’ computational loads in the execution time. Building on the individual algorithms’ analyses, we analyze the communication costs and implementation overheads when integrated with Public Key Infrastructure (PKI) and with Transport Layer Security (TLS) and Transmission Control Protocol (TCP)/Internet Protocol (IP). Our results show that the lattice-based algorithms of Dilithium and Falcon induce lower computational overheads than the hash-based algorithms of SPHINCS+. In addition, the lattice-based PQC can outperform the classical algorithm with comparable security strength; for example, Dilithium 2 and Falcon 512 outperform RSA 4096 in the TLS handshake time duration.
Alongside the growth of technology is the increasing demand for security of data and communication channels. As attacking power grows, devices become smaller and data expands, the security needs to be stronger yet less resource-consuming than ever before. Public key cryptography (PKC) is used in the majority of today's communications systems. The security of public-key cryptographic schemes, such as RSA and elliptic curve cryptography (ECC), is based on underlying mathematical problems such as factoring large integers or solving the discrete log problem. However, the discovery of Shor's Algorithm in 1994 insinuates that these schemes will be insecure when a full-scale quantum computer is developed, as these problems will be solvable in polynomial time. Therefore attention has moved towards post-quantum, or quantum-safe, cryptography (QSC). In 2016, the National Institute of Standards and Technology (NIST) announced the beginning of their efforts to migrate to QSC, a standardisation process which has involved the cryptographic community worldwide. There are five main types of QSC being considered for standardisation; lattice-based, code-based, multivariate-based, hash-based and isogeny-based. Lattice-based cryptography (LBC) offers a promising alternative to today's classical approaches. Hard problems based on lattices are believed to be unsolvable, even by a quantum-computer, in a feasible amount of time. In 1995, Ajtai showed that the average case complexity of these problems is at least as hard as solving the problems in the worst case. Furthermore, lattice-based schemes are the only remaining contender in the NIST process to provide the important primitives of encryption, key encapsulation and digital signature schemes (DSSs). A well-recognised open problem surrounding quantum-safe cryptography is its increase in bandwidth and computational complexity in comparison to existing cryptography. However, in comparison to other quantum-safe schemes, LBC has been shown to be relatively efficient. In this thesis, novel software designs of lattice-based schemes are presented and shown to be competitive with existing PKC. Additionally, physical attacks are considered and countermeasures are incorporated into the designs. DSSs are required for authentication, integrity and non-repudiation of data. This thesis provides an evaluation of three leading signature schemes, BLISS-B, Dilithium and \textsc{Falcon}, which vary in terms of their key features, such as the sampling processes used, and the structure of the lattices. Physical attacks on the three schemes are considered and the effect on performance of appropriate attack countermeasures is evaluated. A novel fault attack on the NIST candidate \textsc{Falcon} is also proposed. A further advantage of LBC is the ability to support cryptographic primitives with extended capabilities to facilitate certificate management and compute on encrypted data. The complexity of today's technology advances mean applications require more sophisticated primitives, which contrastingly are required to run on even smaller platforms. This thesis presents novel quantum-safe advanced cryptographic schemes, specifically lattice-based identity-based encryption (IBE) and hierarchical identity-based encryption (HIBE). IBE removes the need for certificate management, as a user's public key depends on their public identity. IBE is currently used in vital applications such as emergency services communication and so the development of a high-performance quantum-safe alternative is imperative. This thesis also introduces the first scalable HIBE scheme based on lattices. The first HIBE scheme based on structured lattices, Latte, was proposed by the National Centre for Cyber Security (NCSC) in 2017. However, the public key and ciphertext sizes increased with each delegation and hence it was not feasible to scale the algorithm. Skinny Latte, proposed in this thesis, remedies this issue by fixing the dimension of the lattice, thereby making public key and ciphertext sizes constant. This research also shows that it is practical for real-world deployment. Overall, this thesis demonstrates that lattice-based cryptography is practical for real-world applications. It considers both theoretical and physical attacks, and presents novel designs of advanced quantum-safe cryptographic primitives, which have only yet been realised by lattices.
The emergence of quantum computing poses unprecedented challenges to contemporary cryptographic systems, particularly those relying on integer factorization and discrete logarithm assumptions. While the National Institute of Standards and Technology (NIST) has standardized post-quantum cryptographic algorithms including Dilithium for digital signatures, existing verification processes often involve computationally intensive operations unsuitable for resource-constrained environments. This paper presents Dilion, a novel digital signature scheme that synergistically combines the quantum-resistant foundation of Dilithium with an innovative homomorphic pairwise verification mechanism. Unlike conventional signature schemes requiring expensive decryption operations during verification, Dilion performs verification directly on encrypted data through elliptic curve-based homomorphic encryption. Our approach introduces a lightweight verification protocol that leverages Dilithium's challenge-response structure while incorporating cryptographically secure pairwise identity binding. Comprehensive experimental evaluation demonstrates that Dilion maintains equivalent security guarantees to standard Dilithium while achieving approximately 40% reduction in verification computational complexity. We provide rigorous security proofs demonstrating that Dilion achieves existential unforgeability under chosen message attacks, context-binding security, and privacy preservation under standard cryptographic assumptions.
Public key cryptography and signature schemes are essential for reliable digital communication. Asymmetric encryption has been achieved through complex algorithms, such as RSA and Diffie-Hellman, but recent advancements in quantum computing pose threats to the security of these algorithms in the near future as a quantum computer may solve the problems these algorithms are based on. Therefore, Post-Quantum Cryptography (PQC) algorithms have been proposed and investigated by an international community of scientists, especially through the NIST PQC competition ongoing since 2016. They have gathered and classified four different key exchange algorithms and three signature schemes. This paper focuses on implementing the signature schemes inside a popular open-source Android email application as a plug-in and comparing their performances based on this app plug-in utilization. We have used a library, liboqs, from the Open Quantum Safe project as the starting point, which ensures regularity in our results. We also compare the current standard candidate signature schemes with the currently used standard RSA-4096. Our results show that Dilithium has noticeably faster key generation, signing, and verification with the relatively affordable key and signature size. Also, to the best of our knowledge, our study provides the first practical Android email application plug-in supporting PQ-based signatures.
In this paper, we propose DiLizium: a new lattice-based two-party signature scheme. Our scheme is constructed from a variant of the Crystals-Dilithium post-quantum signature scheme. This allows for more efficient two-party implementation compared with the original but still derives its post-quantum security directly from the Module Learning With Errors and Module Short Integer Solution problems. We discuss our design rationale, describe the protocol in full detail, and provide performance estimates and a comparison with previous schemes. We also provide a security proof for the two-party signature computation protocol against a classical adversary. Extending this proof to a quantum adversary is subject to future studies. However, our scheme is secure against a quantum attacker who has access to just the public key and not the two-party signature creation protocol.
Cryptographic algorithms such as RSA, ECDSA, and HMAC-SHA256 underpin modern secure communication, relying on the difficulty of solving complex mathematical problems in polynomial time. However, with quantum computers, Shor’s and Grover’s algorithms may break RSA and ECDSA in polynomial time. Even without quantum computers, adversaries can adopt a “harvest now, decrypt later” approach, prompting research on the standardization of quantum-safe, or post-quantum, cryptography (PQC). This paper proposes a CRYSTALS-Dilithium-driven framework for securing API endpoints. The proposed framework secures APIs using Dilithium-signed JWTs with nonces for authorization claims and request payloads, utilizing Dilithium FIPS-204 “ML-DSA-44,” “ML-DSA-65,” and “ML-DSA-87” from the Open Quantum Safe project. Analysis shows that only legitimate parties can issue and verify tokens; JWTs and keys resist quantum and classical attacks, replay attacks, and offer non-repudiation, data integrity, and authenticity. The protocol was compared with classical algorithms for key generation, signing, decoding, and storage overhead. Benchmarking results indicate that MLDSA-44 (NIST strength category 2) offers the ideal balance between performance, reliability, and quantum readiness. Tamarin-Prover, with its ability to model the unique mathematical structures, larger key sizes, and specific failure modes inherent to PQC algorithms, was used for formal analysis. The proposed framework provides an approach to securing JWTs and APIs with PQC Dilithium, backed by formal guarantees.