The security of most widely used public-key cryptography is fundamentally based on two computationally intractable problems: the integer factorization problem and the elliptic-curve discrete logarithm problem. However, these problems can be solved easily in polynomial time with the help of large-scale quantum computers using Shor's, Proos and Zalka's algorithm. Post-quantum cryptography provides schemes based on hard problems that are hard-to-solve not only by adversaries with classical computers but also by adversaries with large-scale quantum computers. Lattice-based cryptography is a branch of post-quantum cryptography consisting of schemes based on hard lattice problems. The National Institute of Standards and Technology (NIST) recently published the first set of standard post-quantum schemes. Kyber and HQC are the standard key-encapsulation mechanism/public-key encryption schemes, whereas Dilithium, Sphincs+, and Falcon are the standard digital signature algorithms. Although NIST's selection of the first set of post-quantum cryptographic standards is one of the most significant steps toward the transition from classical public-key cryptography to post-quantum cryptography, the field of post-quantum cryptography is still in a nascent stage compared to the decade-old classical public-key cryptography, such as RSA or ECDSA. Therefore, a major focus of this thesis is to bridge the gap between the theory and practice of post-quantum cryptography by exploring various problems that arise during the real-world deployment of post-quantum cryptography. Specifically, I focus on improving the practicality of lattice-based cryptography by proposing new efficient schemes, designing lightweight post-quantum schemes suitable for resource-constrained devices, efficient implementations, analyzing practical physical attacks on implementations of the post-quantum schemes, and designing their countermeasures to thwart the attacks. The first area of research of this dissertation is the exploration of various design choices for lattice-based key-encapsulation mechanisms to make them suitable in different environments under various operational constraints such as memory, silicon area, execution time, power requirement, etc. In our first contribution, we have explored various design choices for lattice-based key-encapsulation mechanisms, focusing on improving execution time on various hardware and software platforms. Our first design, Scabbard, is a suite of three key-encapsulation mechanisms that improved the state-of-the-art post-quantum key-encapsulation mechanism designs by reducing execution time, stack memory requirements, and/or area footprint. In our second contribution, we performed another design space exploration based on hardware resources (such as block RAM, distributed RAM, look-up tables, etc.) estimation and proposed the lattice-based key-encapsulation mechanism, Rudraksh, for resource-constrained devices. We also substantiate our claim of its usefulness with real-world implementations on an FPGA. The second area of research of this dissertation is the analysis of physical attacks. This attack analysis is essential when the attacker can access a device that executes cryptographic implementations, and such scenarios occur frequently in real-world deployments. Therefore, this is a crucial problem to address before deploying post-quantum cryptographic schemes in real-world applications, and countermeasures against physical attacks need to be developed as a prevention measure. In our third contribution, we proposed side-channel attack-resistant masked implementations of lattice-based KEM, Saber KEM, one of the NIST finalist KEMs. We showed that masked Saber outperforms the state-of-the-art masked implementations of Kyber, one of the NIST standards. Our investigations show that this is largely due to power-of-two moduli. Our final contribution to this thesis is physical attack analyses on implementations of the standard key-encapsulation mechanism Kyber. We proposed a cross-attack, fault-injection attack on the masked implementation of Kyber. We showed that the exploited vulnerability was introduced due to the algorithmic change caused by masking.
The security of most widely used public-key cryptography is fundamentally based on two computationally intractable problems: the integer factorization problem and the elliptic-curve discrete logarithm problem. However, these problems can be solved easily in polynomial time with the help of large-scale quantum computers using Shor's, Proos and Zalka's algorithm. Post-quantum cryptography provides schemes based on hard problems that are hard-to-solve not only by adversaries with classical computers but also by adversaries with large-scale quantum computers. Lattice-based cryptography is a branch of post-quantum cryptography consisting of schemes based on hard lattice problems. The National Institute of Standards and Technology (NIST) recently published the first set of standard post-quantum schemes. Kyber and HQC are the standard key-encapsulation mechanism/public-key encryption schemes, whereas Dilithium, Sphincs+, and Falcon are the standard digital signature algorithms. Although NIST's selection of the first set of post-quantum cryptographic standards is one of the most significant steps toward the transition from classical public-key cryptography to post-quantum cryptography, the field of post-quantum cryptography is still in a nascent stage compared to the decade-old classical public-key cryptography, such as RSA or ECDSA. Therefore, a major focus of this thesis is to bridge the gap between the theory and practice of post-quantum cryptography by exploring various problems that arise during the real-world deployment of post-quantum cryptography. Specifically, I focus on improving the practicality of lattice-based cryptography by proposing new efficient schemes, designing lightweight post-quantum schemes suitable for resource-constrained devices, efficient implementations, analyzing practical physical attacks on implementations of the post-quantum schemes, and designing their countermeasures to thwart the attacks. The first area of research of this dissertation is the exploration of various design choices for lattice-based key-encapsulation mechanisms to make them suitable in different environments under various operational constraints such as memory, silicon area, execution time, power requirement, etc. In our first contribution, we have explored various design choices for lattice-based key-encapsulation mechanisms, focusing on improving execution time on various hardware and software platforms. Our first design, Scabbard, is a suite of three key-encapsulation mechanisms that improved the state-of-the-art post-quantum key-encapsulation mechanism designs by reducing execution time, stack memory requirements, and/or area footprint. In our second contribution, we performed another design space exploration based on hardware resources (such as block RAM, distributed RAM, look-up tables, etc.) estimation and proposed the lattice-based key-encapsulation mechanism, Rudraksh, for resource-constrained devices. We also substantiate our claim of its usefulness with real-world implementations on an FPGA. The second area of research of this dissertation is the analysis of physical attacks. This attack analysis is essential when the attacker can access a device that executes cryptographic implementations, and such scenarios occur frequently in real-world deployments. Therefore, this is a crucial problem to address before deploying post-quantum cryptographic schemes in real-world applications, and countermeasures against physical attacks need to be developed as a prevention measure. In our third contribution, we proposed side-channel attack-resistant masked implementations of lattice-based KEM, Saber KEM, one of the NIST finalist KEMs. We showed that masked Saber outperforms the state-of-the-art masked implementations of Kyber, one of the NIST standards. Our investigations show that this is largely due to power-of-two moduli. Our final contribution to this thesis is physical attack analyses on implementations of the standard key-encapsulation mechanism Kyber. We proposed a cross-attack, fault-injection attack on the masked implementation of Kyber. We showed that the exploited vulnerability was introduced due to the algorithmic change caused by masking.
Public-key cryptography is indispensable in maintaining the security and integrity of digital data. The most widely used current public-key cryptography is based on the integer factorization problem and the elliptic-curve discrete logarithm problem, which are vulnerable against an adversary with large-scale quantum computers. Fortunately, post-quantum cryptography (PQC) can provide security against both classical and quantum adversaries. Due to rapid advancement in quantum computer development, the transition from classical public-key cryptography to PQC has become imperative. A watershed moment in this transition is the recent publication of a set of PQC schemes by the National Institute of Standards and Technology (NIST). Although it is a significant step, the research and development in PQC is quite immature compared to several decades-old classical public-key cryptographic schemes. Therefore, several open problems, such as physical attack analysis and their countermeasures, application-specific modifications, lightweight implementations for resource-constrained devices, integration into different secure protocols, etc., need to be addressed before the widespread deployment of PQC in real-world applications. This dissertation aims to address some of these problems in order to bridge the gap between the theory and practice of PQC.
Alongside the growth of technology is the increasing demand for security of data and communication channels. As attacking power grows, devices become smaller and data expands, the security needs to be stronger yet less resource-consuming than ever before. Public key cryptography (PKC) is used in the majority of today's communications systems. The security of public-key cryptographic schemes, such as RSA and elliptic curve cryptography (ECC), is based on underlying mathematical problems such as factoring large integers or solving the discrete log problem. However, the discovery of Shor's Algorithm in 1994 insinuates that these schemes will be insecure when a full-scale quantum computer is developed, as these problems will be solvable in polynomial time. Therefore attention has moved towards post-quantum, or quantum-safe, cryptography (QSC). In 2016, the National Institute of Standards and Technology (NIST) announced the beginning of their efforts to migrate to QSC, a standardisation process which has involved the cryptographic community worldwide. There are five main types of QSC being considered for standardisation; lattice-based, code-based, multivariate-based, hash-based and isogeny-based. Lattice-based cryptography (LBC) offers a promising alternative to today's classical approaches. Hard problems based on lattices are believed to be unsolvable, even by a quantum-computer, in a feasible amount of time. In 1995, Ajtai showed that the average case complexity of these problems is at least as hard as solving the problems in the worst case. Furthermore, lattice-based schemes are the only remaining contender in the NIST process to provide the important primitives of encryption, key encapsulation and digital signature schemes (DSSs). A well-recognised open problem surrounding quantum-safe cryptography is its increase in bandwidth and computational complexity in comparison to existing cryptography. However, in comparison to other quantum-safe schemes, LBC has been shown to be relatively efficient. In this thesis, novel software designs of lattice-based schemes are presented and shown to be competitive with existing PKC. Additionally, physical attacks are considered and countermeasures are incorporated into the designs. DSSs are required for authentication, integrity and non-repudiation of data. This thesis provides an evaluation of three leading signature schemes, BLISS-B, Dilithium and \textsc{Falcon}, which vary in terms of their key features, such as the sampling processes used, and the structure of the lattices. Physical attacks on the three schemes are considered and the effect on performance of appropriate attack countermeasures is evaluated. A novel fault attack on the NIST candidate \textsc{Falcon} is also proposed. A further advantage of LBC is the ability to support cryptographic primitives with extended capabilities to facilitate certificate management and compute on encrypted data. The complexity of today's technology advances mean applications require more sophisticated primitives, which contrastingly are required to run on even smaller platforms. This thesis presents novel quantum-safe advanced cryptographic schemes, specifically lattice-based identity-based encryption (IBE) and hierarchical identity-based encryption (HIBE). IBE removes the need for certificate management, as a user's public key depends on their public identity. IBE is currently used in vital applications such as emergency services communication and so the development of a high-performance quantum-safe alternative is imperative. This thesis also introduces the first scalable HIBE scheme based on lattices. The first HIBE scheme based on structured lattices, Latte, was proposed by the National Centre for Cyber Security (NCSC) in 2017. However, the public key and ciphertext sizes increased with each delegation and hence it was not feasible to scale the algorithm. Skinny Latte, proposed in this thesis, remedies this issue by fixing the dimension of the lattice, thereby making public key and ciphertext sizes constant. This research also shows that it is practical for real-world deployment. Overall, this thesis demonstrates that lattice-based cryptography is practical for real-world applications. It considers both theoretical and physical attacks, and presents novel designs of advanced quantum-safe cryptographic primitives, which have only yet been realised by lattices.
Classical cryptography has been around for a long time in the documented human history, but most classical ciphers were broken and even solved by hand. Shannon introduced the notion of perfect secrecy that formally defines confidentiality in the information-theoretic sense, which is only possible in the restricted scenarios where the message is no longer than the encryption key. The invention of public-key cryptography (the Diffie-Hellman key exchange protocol in 1976 and the RSA crypto-system in 1977) marks the birth of modern cryptography, allowing parties to exchange messages securely without sharing any secrets in advance. Furthermore, it provides computational security based on the conjectured hardness of mathematical problems such as factorization and the discrete logarithm. Public-key cryptography has found numerous applications in the Internet, financial and banking industry, and blockchains, and it plays a crucial role in protecting information security and asset safety. Unfortunately, in the 1990s, Shor proposed efficient quantum algorithms that solve number-theoretic problems, including factorization and discrete logarithms in polynomial time. Once a quantum computer of a particular scale becomes a reality, it will cause a devastating blow to the existing public-key infrastructure. To deal with such a ‘quantum crisis’, academia and industry are looking into the design, analysis and standardization of cryptographic algorithms that can resist quantum computers referred to as post-quantum cryptography (PQC). The National Institute of Standards and Technology (NIST) has been soliciting proposals for the post-quantum public-key algorithms since 2016. More recently, the Chinese Association for Cryptologic Research (CACR) held a competition on designing cryptographic algorithms whose public-key cryptography track focused on post-quantum cryptographic algorithms. Lattice-based cryptography is considered by most to be the mainstream technical route of post-quantum cryptography, which is reflected in the number of proposals (and their percentage of the total) received in the NIST PQC process. To reflect the status quo of post-quantum cryptography, we invite leading experts in this area to contribute three technical perspectives that aim to help readers understand the algorithms, the underlying basic techniques and different technical routes to achieve quantum resistance. The first perspective, presented by Lu and Zhang, introduces public-key cryptographic algorithms whose quantum security is reducible from the conjectured quantum hardness of lattice problems. In particular, they mainly focus on public-key encryption (PKE) and the key encapsulation mechanism (KEM), which are essential building blocks for securing the confidentiality of communication without pre-shared secrets. Both types of crypto-systems are solicited by the NIST PQC standardization and the CACR algorithm design competition. This perspective gives a comprehensive survey on practical lattice-based PKEs/KEMs, and their best-known quantum and classical attacks. Another important post-quantum crypto-system is digital signature, which ensures that three goals of information security are met other than confidentiality, namely, integrity, authentication and non-repudiation. The second perspective is on lattice-based signature by Lyubashevsky. In this perspective, he surveys different techniques in building lattice-based post-quantum crypto-systems, discusses the challenges in overcoming performance issues and gives us state-of-the-art digital signature schemes. In addition to ensuring the ‘static’ security of information in storage and transmission, advanced cryptographic algorithms and protocols can guarantee information security during the computation process (possibly among multiple parties), referred to as privacy-preserving computation. Cryptographic techniques involved in privacy-preserving computation include secure multi-party computation, zero-knowledge proof and fully homomorphic encryption. There is a pressing need to migrate them to the post-quantum era. The third perspective, by Yu and Xie, presents practical instantiations of these algorithms and discusses possible ways to migrate them to their quantum-resistant counterparts. To summarize, post-quantum cryptography has received widespread attention and made significant progress in recent years. Some post-quantum cryptographic algorithms, such as the lattice-based candidate, also have other advantages (e.g., computational efficiency and full homomorphism) over their classical counterparts. Lattice-based cryptography is an emerging field with high theoretical value and wide application, and we encourage young researchers to enter and explore this new and exciting field.
The advent of large-scale quantum computers poses a profound and imminent threat to the security foundations of modern cryptography. Widely deployed public-key cryptosystems, such as RSA and Elliptic Curve Cryptography (ECC), rely on problems like integer factorization and discrete logarithms, which Shor's algorithm can efficiently solve. This necessitates a proactive transition to post-quantum cryptography (PQC). Among leading candidates, lattice-based cryptography stands out due to its robust security guarantees, based on hard problems lacking known efficient quantum solutions, and structural properties facilitating efficient implementation. This paper explores the fundamental principles of lattice-based cryptography, detailing underlying mathematical hard problems such as the Shortest Vector Problem (SVP) and Learning With Errors (LWE). We review the evolution of lattice-based schemes, from early constructions to contemporary candidates like Kyber and Dilithium, emphasizing their suitability for Key Encapsulation Mechanisms (KEMs) and Digital Signature Schemes (DSS). Furthermore, we analyze their performance characteristics, security assumptions, and resilience against classical and quantum attacks, providing a critical comparison with other PQC families. This comprehensive overview, structured through a systematic critical analysis framework, highlights the ascendancy of lattice-based cryptography as a cornerstone for future quantum-resistant security infrastructure, offering theoretical underpinnings, practical implications, and actionable future research directions for a post-quantum world.
The advent of quantum computing poses a significant existential threat to current public-key cryptographic standards, particularly RSA and Elliptic Curve Cryptography (ECC), which underpin global digital security. Shor's algorithm, if implemented on a sufficiently powerful quantum computer, can efficiently break these foundational schemes, rendering vast amounts of encrypted data vulnerable. This paper investigates lattice-based cryptography as a robust and promising candidate for post-quantum security. We provide a comprehensive analysis of its theoretical underpinnings, focusing on hard problems like the Shortest Vector Problem (SVP) and Learning With Errors (LWE), which are believed to be intractable even for quantum adversaries. Through a detailed literature review and methodological exposition, we examine the construction principles of prominent lattice-based Key Encapsulation Mechanisms (KEMs) and digital signature schemes, such as Kyber and Dilithium, highlighting their inherent security properties and performance characteristics. Our results demonstrate that lattice-based schemes offer competitive efficiency, compact key sizes, and strong security guarantees against both classical and quantum attacks, positioning them as essential building blocks for the post-RSA cryptographic landscape. The discussion elaborates on the practical implications, standardization efforts by NIST, and the challenges associated with the transition to quantum-resilient cryptographic infrastructure. We conclude that lattice-based cryptography is a cornerstone of quantum resilience, critical for securing future digital communications and data integrity.
The security of classical public-key cryptosystems, which operate based on the computational intractability of integer factorization and discrete logarithm problems, is profoundly threatened by the rapid development of quantum computing. Post-Quantum Cryptography (PQC) has been proposed to improve security against quantum attacks. Lattice-based cryptography is widely regarded as one of the most promising PQC method because of its proven security, efficient implementation, and functional versatility, and it has achieved significant progress in both algorithmic design and engineering implementation in recent years. This paper presents a systematic survey of the status of research on lattice-based cryptographic algorithms. First, the fundamental theory of lattices and their core hard problems are discussed. Next, the technical characteristics and performance of encryption and key encapsulation mechanisms, digital signature schemes, and key exchange protocols constructed based on lattice hard problems are reviewed and compared. Subsequently, the principles and optimization paths of two key technologies for lattice cryptography implementation, namely polynomial multiplication using the fast Number Theoretic Transform (NTT) and pre-image sampling algorithms, are discussed. Finally, considering the PQC standardization process of the National Institute of Standards and Technology (NIST), an outlook on future research directions for lattice-based cryptography is presented. The research directions include the development of more "succinct" fundamental hard problems, strengthening security proofs, improving algorithm efficiency, and countering novel attacks. This review serves as a reference for promoting the practical deployment and further research of lattice-based cryptography.