Design and Implementation of a Post-Quantum Group Authenticated Key Exchange Protocol With the LibOQS Library: A Comparative Performance Analysis From Classic McEliece, Kyber, NTRU, and Saber
José Ignacio Escribano Pablos, Misael Enrique Marriaga, Ángel Luis Pérez del Pozo
Group authenticated key exchange protocols (GAKE) are cryptographic tools enabling a group of several users communicating through an insecure channel to securely establish a common shared high-entropy key. In the last years, the need to design cryptographic tools which provide security in the presence of attackers with access to quantum resources has become unquestionable; the field dealing with these types of protocols is usually referred to as Post-Quantum Cryptography. The U.S. National Institute for Standards and Technology (NIST) launched in 2017 an open call to find suitable post-quantum public-key algorithms for standardization. In this work, we design a GAKE that can be instantiated with any key encapsulation mechanism (KEM) that satisfies the strong security notion IND-CCA, matching NIST’s requirements for this primitive. We have implemented our GAKE with the four finalist KEMs from the NIST process: Classic McEliece, Kyber, NTRU, and Saber, making use of the open-source library LibOQS where these algorithms are provided. We have conducted a detailed comparative performance analysis of the resulting GAKE protocols, taking into account all the parameter sets proposed in the submissions. We have also made a performance analysis of all the involved building pieces, including the four finalist KEMs. Finally, we also compare our GAKE with a previous proposal implemented with Kyber.
Group authenticated key exchange protocols (GAKE) are cryptographic tools enabling a group of several users communicating through an insecure channel to securely establish a common shared high-entropy key. In the last years, the need to design cryptographic tools which provide security in the presence of attackers with access to quantum resources has become unquestionable; the field dealing with these types of protocols is usually referred to as Post-Quantum Cryptography. The U.S. National Institute for Standards and Technology (NIST) launched in 2017 an open call to find suitable post-quantum public-key algorithms for standardization. In this work, we design a GAKE that can be instantiated with any key encapsulation mechanism (KEM) that satisfies the strong security notion IND-CCA, matching NIST’s requirements for this primitive. We have implemented our GAKE with the four finalist KEMs from the NIST process: Classic McEliece, Kyber, NTRU, and Saber, making use of the open-source library LibOQS where these algorithms are provided. We have conducted a detailed comparative performance analysis of the resulting GAKE protocols, taking into account all the parameter sets proposed in the submissions. We have also made a performance analysis of all the involved building pieces, including the four finalist KEMs. Finally, we also compare our GAKE with a previous proposal implemented with Kyber.
Quantum computing poses a threat on current cryptography methods, prompting initiatives such as the U.S. National Institute for Standards and Technology (NIST) standardization process toward developing post-quantum cryptographic tools. This process concentrates on deploying “key encapsulation mechanisms” and “signature schemes”, mainly focusing on Group Authenticated key exchange (GAKE), which is crucial for secure group communication while ensuring authentication is immune to quantum attacks. Despite various two-party key exchange designs adaptable for group key exchange protocols with multiple parties, experts face challenges in secure group interactions in a post-quantum environment due to the lack of such group protocols solutions. Addressing the necessity of secure group communication in IoTs, we proposed a GAKE protocol. This paper presents its design and implementation secure under QROM; we compared our initial findings on the “Saber-based GAKE” with a Kyber-based GAKE implementation named “Complied Kyber” proposed by Pablos, focusing on IoTs. Our findings show better efficiency than “Compiled Kyber” regarding overall communication duration, especially when involving up to 2000 participants in group communication. Furthermore, thorough investigation and calculations confirm the Saber-GAKE protocol’s interoperability with IoT contexts. The protocol has worthy computational efficiency, with execution speeds of 0.064 ms on ARM Cortex-M4 and 1.56 ms on ARM Cortex-M0 systems. The memory use is well below the allowed limits, with 50.86 KB on Cortex-M4 and 35.84 KB on Cortex-M0. The performance data validate that the Saber-GAKE protocol can effectively and safely function on IoT devices with limited resources, offering strong protection against quantum computing assaults.
A group authenticated key exchange (GAKE) protocol allows a set of parties belonging to a certain designated group to agree upon a common secret key through an insecure communication network. In the last few years, many new cryptographic tools have been specifically designed to thwart attacks from adversaries which may have access to (different kinds of) quantum computation resources. However, few constructions for group key exchange have been put forward. Here, we propose a four-round GAKE which can be proven secure under widely accepted assumptions in the Quantum Random Oracle Model. Specifically, we integrate several primitives from the so-called Kyber suite of post-quantum tools in a (slightly modified) compiler from Abdalla et al. (TCC 2007). More precisely, taking as a starting point an IND-CPA encryption scheme from the Kyber portfolio, we derive, using results from Hövelmanns et al. (PKC 2020), a two-party key exchange protocol and an IND-CCA encryption scheme and prove them fit as building blocks for our compiled construction. The resulting GAKE protocol is secure under the Module-LWE assumption, and furthermore achieves authentication without the use of (expensive) post-quantum signatures.
Abstract Quantum computing poses fascinating challenges for current cryptography, threatening the security of many schemes and protocols widely used today. To adapt to this reality, the U.S. National Institute for Standards and Technology (NIST) is currently running a standardization process in search of post‐quantum (classical, yet resistant to quantum attacks ) cryptographic tools, focusing on signature schemes and key encapsulation mechanisms. Many of the competing proposals also include designs for two‐party key exchange, which can be combined in different ways to fit scenarios involving parties, that is, yielding group key exchange protocols. However, very few implementations of such group protocols are available to practitioners, which face a non‐trivial challenge when deciding how to implement a protocol for establishing secure group sessions in this new post‐quantum scenario. With this in mind, the authors report on the implementation of a secure post‐quantum group key exchange protocol in the so‐called Quantum Random Oracle Model . The protocol decided to implement is based on a KEM called Kyber , which is one of the finalists of the NIST competition. Not only this group construction is the only one available in the literature using a NIST finalist, but also, among all post‐quantum designs the authors are aware of, it uses this strongest security model (as, e.g. in other proposals, the adversarial interaction with the hash functions of the system is assumed to be exclusively classical). Furthermore, experimental evidence is provided supporting this choice in terms of performance, even if the number of involved entities is large (up to 2000). All data and code are publicly available.
Current improvements in quantum computing present a substantial challenge to classical cryptographic systems, which typically rely on problems that can be solved in polynomial time using quantum algorithms. Consequently, post-quantum cryptography (PQC) has emerged as a promising solution to emerging quantum-based cryptographic challenges. The greatest threat is public-key cryptosystems, which are primarily responsible for key exchanges. In PQC, key encapsulation mechanisms (KEMs) are crucial for securing key exchange protocols, particularly in Internet communication, virtual private networks (VPNs), and secure messaging applications. CRYSTALS-Kyber and NTRU are two well-known PQC KEMs offering robust security in the quantum world. However, even when quantum computers are functional, they are not easily accessible. IoT devices will not be able to utilize them directly, so there will still be a requirement to protect IoT devices from quantum attacks. Concerns such as limited computational power, energy efficiency, and memory constraints in devices such as those used in IoTs, embedded systems, and smart cards limit the use of these techniques in constrained environments. These concerns always arise there. To address this issue, this study conducts a broad comparative analysis of Kyber and NTRU, with special focus on their security, performance, and implementation efficiency in such environments (IOT/constrained environments). In addition, a case study was conducted by applying KEMs to a low-power embedded device to analyze their performance in real-world scenarios. These results offer an important comparison for cyber security engineers and cryptographers who are involved in integrating post-quantum cryptography into resource-constrained devices.
Group Authenticated Key Exchange (GAKE) protocol can achieve authentication among multiple users within a group and facilitates the agreement on a consistent group key, which ensures the security of the transmission of data within the group. Society is entering the post-quantum era with the development of quantum computers, and traditional cryptographic algorithms used in existing group authenticated key exchange protocols may not be able to resist quantum attacks. Using the lattice-based key encapsulation mechanism Kyber, we have developed a post-quantum secure group key exchange protocol. The protocol incorporates dynamic joining and leaving phases for group users to ensure scalability, while also utilizing passwords for user authentication. Finally, we formally prove the security of the protocol and compare it with other lattice-based group authenticated key exchange protocols through simulation experiments, the results demonstrate that our protocol is more efficient.
Crystals-Kyber and Classic-McEliece are two prominent post-quantum key encapsulation mechanisms (KEMs) designed to address the challenges posed by quantum computing to classical cryptographic schemes. While the former has been standardized by the National Institute of Standards and Technology (NIST), the latter is well-known for its exceptional robustness and as one of the finalists of the fourth round of post-quantum cryptography standardization. Private set intersection (PSI) is a privacy-preserving technique that enables two parties, each possessing a dataset, to compute the intersection of their sets without revealing anything else. This can be achieved thanks to homomorphic encryption (HE), which allows computations on encrypted data. In this paper, firstly, we study Kyber and McEliece, apart from being KEMs, as post-quantum public key encryption (PKE), and examine their homomorphic properties. Secondly, we design two different two-party PSI protocols that utilize the homomorphic capabilities of Kyber and McEliece. Thirdly, a practical performance evaluation under NIST’s security levels 1, 3, and 5 is conducted, focusing on three key metrics: storage overhead, communication overhead, and computation cost. Insights indicate that the Kyber-based PSI Protocol, which utilizes the multiplicative homomorphic property, is secure but less efficient. In contrast, the McEliece-based PSI protocol, while efficient in practice, raises concerns regarding its security as a homomorphic encryption scheme.