Cryptography is the science and practice of designing computing and communication systems that are secure in the presence of adversaries.Among the central topics in cryptographic research, public-key encryption enables secure communication between two parties, while digital signatures provide guarantees on the authenticity of information.To prove the security of cryptographic schemes, we use reductions.Reduction is a fundamental concept in computer science.When problem A is reduced to problem B, it implies that B is at least as hard as A. To show such a relationship, we usually build a reduction algorithm that solves A efficiently using an algorithm that solves B as a subroutine.Such reductions not only establish the security of the cryptographic primitives, but also give a computational complexity perspective.For example, one can identify the minimal assumption on which cryptographic systems can be based.The existence of one-way functions is considered a minimal assumption in cryptography.In other words, the existence of one-way functions is essential for the existence of any cryptographic primitive.A function f is said to be one-way if, given f (x), it is computationally infeasible to efficiently recover a corresponding preimage.While one-wayness is a minimal assumption, it is also known to suffice for deriving important cryptographic primitives such as symmetric-key encryption and digital signatures.Cryptographic primitives can thus be divided into those that can be derived from one-way functions and those that cannot.Cryptographic primitives that can be derived from one-way functions are referred to as Minicrypt.In this way, one-way functions play a central role in providing a hierarchical understanding of modern cryptographic theory.When quantum communication and computation are incorporated into cryptographic protocols, it becomes possible to derive a broader class of cryptographic primitives from one-way functions.For example, while there is evidence that public-key encryption cannot be constructed from one-way functions alone in the classical setting, recent works have shown that quantum public-key encryption can be constructed from one-way functions when quantum communication channels are available.Thus, even without altering the classical boundaries, incorporating quantum communication and computation leaves ample room for phenomena that differ from those observed in the classical setting.The class of cryptographic primitives that can be constructed from one-way functions, assuming quantum computation and communication, is referred to as MiniQCrypt.As quantum technologies continue to advance and the realization of quantum communication and quantum computers becomes increasingly plausible, the study of one-way functions must be revisited and discussed within these quantum frameworks.We identify two main challenges in this area.The first challenge is to generalize the quantum reduction from one-wayness to unpredictability.The classical reduction from onewayness to unpredictability, known as the Goldreich-Levin theorem, is not only fundamental in cryptography but also plays an important role in computational complexity theory.A quantum analogue of this theorem was established by Adcock and Cleve.However, whether the quantum Goldreich-Levin theorem holds not only in the binary setting but also over more general domains such as Z q remains a nontrivial open problem.The second challenge i
Cryptography is the science and practice of designing computing and communication systems that are secure in the presence of adversaries.Among the central topics in cryptographic research, public-key encryption enables secure communication between two parties, while digital signatures provide guarantees on the authenticity of information.To prove the security of cryptographic schemes, we use reductions.Reduction is a fundamental concept in computer science.When problem A is reduced to problem B, it implies that B is at least as hard as A. To show such a relationship, we usually build a reduction algorithm that solves A efficiently using an algorithm that solves B as a subroutine.Such reductions not only establish the security of the cryptographic primitives, but also give a computational complexity perspective.For example, one can identify the minimal assumption on which cryptographic systems can be based.The existence of one-way functions is considered a minimal assumption in cryptography.In other words, the existence of one-way functions is essential for the existence of any cryptographic primitive.A function f is said to be one-way if, given f (x), it is computationally infeasible to efficiently recover a corresponding preimage.While one-wayness is a minimal assumption, it is also known to suffice for deriving important cryptographic primitives such as symmetric-key encryption and digital signatures.Cryptographic primitives can thus be divided into those that can be derived from one-way functions and those that cannot.Cryptographic primitives that can be derived from one-way functions are referred to as Minicrypt.In this way, one-way functions play a central role in providing a hierarchical understanding of modern cryptographic theory.When quantum communication and computation are incorporated into cryptographic protocols, it becomes possible to derive a broader class of cryptographic primitives from one-way functions.For example, while there is evidence that public-key encryption cannot be constructed from one-way functions alone in the classical setting, recent works have shown that quantum public-key encryption can be constructed from one-way functions when quantum communication channels are available.Thus, even without altering the classical boundaries, incorporating quantum communication and computation leaves ample room for phenomena that differ from those observed in the classical setting.The class of cryptographic primitives that can be constructed from one-way functions, assuming quantum computation and communication, is referred to as MiniQCrypt.As quantum technologies continue to advance and the realization of quantum communication and quantum computers becomes increasingly plausible, the study of one-way functions must be revisited and discussed within these quantum frameworks.We identify two main challenges in this area.The first challenge is to generalize the quantum reduction from one-wayness to unpredictability.The classical reduction from onewayness to unpredictability, known as the Goldreich-Levin theorem, is not only fundamental in cryptography but also plays an important role in computational complexity theory.A quantum analogue of this theorem was established by Adcock and Cleve.However, whether the quantum Goldreich-Levin theorem holds not only in the binary setting but also over more general domains such as Z q remains a nontrivial open problem.The second challenge i
Classical cryptography has been around for a long time in the documented human history, but most classical ciphers were broken and even solved by hand. Shannon introduced the notion of perfect secrecy that formally defines confidentiality in the information-theoretic sense, which is only possible in the restricted scenarios where the message is no longer than the encryption key. The invention of public-key cryptography (the Diffie-Hellman key exchange protocol in 1976 and the RSA crypto-system in 1977) marks the birth of modern cryptography, allowing parties to exchange messages securely without sharing any secrets in advance. Furthermore, it provides computational security based on the conjectured hardness of mathematical problems such as factorization and the discrete logarithm. Public-key cryptography has found numerous applications in the Internet, financial and banking industry, and blockchains, and it plays a crucial role in protecting information security and asset safety. Unfortunately, in the 1990s, Shor proposed efficient quantum algorithms that solve number-theoretic problems, including factorization and discrete logarithms in polynomial time. Once a quantum computer of a particular scale becomes a reality, it will cause a devastating blow to the existing public-key infrastructure. To deal with such a ‘quantum crisis’, academia and industry are looking into the design, analysis and standardization of cryptographic algorithms that can resist quantum computers referred to as post-quantum cryptography (PQC). The National Institute of Standards and Technology (NIST) has been soliciting proposals for the post-quantum public-key algorithms since 2016. More recently, the Chinese Association for Cryptologic Research (CACR) held a competition on designing cryptographic algorithms whose public-key cryptography track focused on post-quantum cryptographic algorithms. Lattice-based cryptography is considered by most to be the mainstream technical route of post-quantum cryptography, which is reflected in the number of proposals (and their percentage of the total) received in the NIST PQC process. To reflect the status quo of post-quantum cryptography, we invite leading experts in this area to contribute three technical perspectives that aim to help readers understand the algorithms, the underlying basic techniques and different technical routes to achieve quantum resistance. The first perspective, presented by Lu and Zhang, introduces public-key cryptographic algorithms whose quantum security is reducible from the conjectured quantum hardness of lattice problems. In particular, they mainly focus on public-key encryption (PKE) and the key encapsulation mechanism (KEM), which are essential building blocks for securing the confidentiality of communication without pre-shared secrets. Both types of crypto-systems are solicited by the NIST PQC standardization and the CACR algorithm design competition. This perspective gives a comprehensive survey on practical lattice-based PKEs/KEMs, and their best-known quantum and classical attacks. Another important post-quantum crypto-system is digital signature, which ensures that three goals of information security are met other than confidentiality, namely, integrity, authentication and non-repudiation. The second perspective is on lattice-based signature by Lyubashevsky. In this perspective, he surveys different techniques in building lattice-based post-quantum crypto-systems, discusses the challenges in overcoming performance issues and gives us state-of-the-art digital signature schemes. In addition to ensuring the ‘static’ security of information in storage and transmission, advanced cryptographic algorithms and protocols can guarantee information security during the computation process (possibly among multiple parties), referred to as privacy-preserving computation. Cryptographic techniques involved in privacy-preserving computation include secure multi-party computation, zero-knowledge proof and fully homomorphic encryption. There is a pressing need to migrate them to the post-quantum era. The third perspective, by Yu and Xie, presents practical instantiations of these algorithms and discusses possible ways to migrate them to their quantum-resistant counterparts. To summarize, post-quantum cryptography has received widespread attention and made significant progress in recent years. Some post-quantum cryptographic algorithms, such as the lattice-based candidate, also have other advantages (e.g., computational efficiency and full homomorphism) over their classical counterparts. Lattice-based cryptography is an emerging field with high theoretical value and wide application, and we encourage young researchers to enter and explore this new and exciting field.
In cryptographic protocols, honest parties would prefer that their security is assured even in presence of adversarial parties who have unbounded computational power. Information theoretic secure realization of cryptographic primitives provides such guarantees; but for most tasks such strong security guarantees cannot be provided for any reasonable notion of security. The standard technique used in cryptography is to assume the existence of some puzzle, whose hard instances are easy to generate but no efficient algorithm can solve them. Such assumptions, which define intractable problems for efficient algorithms, are called computational intractability assumptions.
In this work, we motivate a study of computational intractability assumptions which is goal driven and lends support to the fundamental nature of some of the traditional assumptions beyond being historical accidents. Secure multi-party computation deals with the study of constructing secure protocols for general cryptographic tasks which conform to various notions of security. Inspired by complexity theory, we use the notion of reduction to further our understanding of computational intractability assumptions. Our framework explores the hardness of natural assumptions of the form: “Task F can be securely computed given an ideally secure facility for computing G ”.
Formally, we characterize the minimal computational intractability assumption which is sufficient to securely realize a functionality using trusted copies of some other functionality. A functionality F reduces to G , similar to the complexity-theoretic notion of reduction, if F can be securely realized when parties can access trusted copies of G . Thus, if F does not reduce to G information-theoretically, we are interested in characterizing the minimal assumption, which is sufficient, to securely realize the reduction of F to G .
In our framework, we explore the relative strengths of these minimal computational assumptions. The fundamental problem, then, is to establish relations, like implication, equivalence and separation, among the assumptions which correspond to various reductions. In this work, we further our understanding of the minimal computational assumptions corresponding to such reductions by showing the following results:
1. We identify a spectrum for the set of assumptions that correspond to reduction between a pair of tasks under different security notions. These reductions are implied by the computational intractability assumption: “semi-honest secure protocol for oblivious transfer exists” (sh-OT assumption). Additionally, the information theoretically impossible reductions considered in this thesis imply the assumption: “one-way functions exist” (OWF assumption). We conjecture that OWF assumption is necessary for these reductions. In fact, the reductions considered in this thesis are either information theoretically true, false, equivalent to OWF assumption or equivalent to sh-OT assumption [MPR10a].
We expand our study to encompass reductions involving randomized functionalities and study the consequences of providing parties with a trusted source of common unbiased coins. For a strong notion of security they turn out to be useless and unless sh-OT assumption holds these randomness sources are not useful [MOPR11, MP11].
2. We [MPS10] seek to lend additional support to the widely believed premise that “non-trivial cryptography entails the existence of one-way functions”. We show that (constant round) weak coin-tossing protocols, imply OWF assumption. For the general problem, i.e. secure weak coin-tossing protocols with polynomial round complexity, we show a slightly weaker implication NP n BPP.
3. Finally, we indicate the possibility of a wide range of intractability assumptions in our spectrum, intermediate to OWF assumption and sh-OT assumption. We show that a class of natural assumptions corresponding to reductions that are relativistically separated from OWF assumption. Similar techniques have been used to show their separation from the assumption that “public-key encryption exists” (PKE assumption) [MMP11]; but these assumptions are not known to imply sh-OT assumption. We conjecture that, in fact, sh-OT assumption is relativistically separated from these assumptions.
The invention of public-key cryptography (PKC) by Diffie and Hellman in 1976 is one of two milestones marking the beginning of modern cryptography. The security of a PKC system requires that it should be infeasible to compute the private key from a given public key, which in turn is typically guaranteed by the difficulty in solving some cryptographic-friendly mathematical problems. Among those problems, the integer factorization and discrete logarithm problems play pivotal roles in the development of public-key cryptography. In particular, the assumption that there is no polynomial time (classical) algorithm that solves the above two problems constitutes the basis for the security of almost all currently used public-key cryptosystems, such as RSA and ElGamal. However, Shor [1] found an efficient quantum solving algorithm for the integer factorization and discrete logarithm problems in 1994, which would destroy the security basis for most real deployed PKC systems if large-scale quantum computers become available. The rapid development of quantum technology in recent years suggests that we are getting closer to the quantum crisis of current PKC systems. As a response to the quantum crisis, the research community has made many efforts to post-quantum cryptography (PQC) that are believed to resist quantum computer attacks. Lattice-based cryptography is one of the main directions in this area, and has become the most promising PQC candidate for standardization. The research of lattice-based cryptography dates back to the seminal work of Ajtai [2], which first based the security of cryptographic primitives on the difficulty of solving some lattice problems such as the approximate shortest vector problem and the closest vector problem. After more than two decades of development, lattice-based cryptography has gained substantial progress. In theory, we have witnessed the construction of many powerful cryptographic primitives that were not known before. In practice, the public key size of lattice-based cryptosystems has been significantly reduced from several gigabytes to a few kilobytes. For current applications and standardization, key exchanges, public-key encryptions (PKEs) and signatures are the most desired lattice-based cryptosystems, where the first two are often used to ensure information secrecy, while the last provides information authentication. Note that public-key encryptions are equivalent to two-round key exchanges, also known as the key encapsulation mechanism (KEM). In the following, we focus on lattice-based PKEs/KEMs. The design principle of lattice-based PKEs/KEMs follows two approaches: a trapdoor one-way function and an approximate commutative one-way function. In the first approach, a trapdoor one-way function f and its trapdoor f−1 are generated as the public key and private key. A plaintext m is encrypted as c = f(m), and the ciphertext is decrypted as m = f−1(c). The NTRU scheme and its variants follow such an approach. In the second approach, an approximate commutative function fs and a random input a are generated, the public key is (a, b = fs(a)) and the private key is s. A plaintext m is encrypted as c1 = gr(a), c2 = gr(b) + E(m), where r is a random element, g is an approximate commutative one-way function and E is the encoding of an error-correction code. The ciphertext (c1, c2) is decrypted as m = D(c2 − fs(c1)), where D is the decoding of an error-correction code. The correctness of decryption is guaranteed by the approximate commutative property (gr(b) = gr(fs(a)) ≈ fs(gr(a)) = fs(c1)) and the error-correction code. Learning with errors (LWE) problem-based PKE/KEM schemes and their variants follow such an approach. The standardization of PQC has received substantial support from national funding agencies, such as the European Union projects PQCrypto and SAFEcrypto. The USA National Institute of Standard and Technology (NIST) started the post-quantum standardization project in 2012, organized a worldwide ‘competition’ in 2016 and plans to deliver draft standards before 2024. After two rounds of evaluation, seven schemes were accepted as the round-three candidates on 22 July 2020, of which five are lattice-based schemes. In 2017, the International organization for standardization started a study project of post-quantum cryptography named SD8. Most LWE-based PKE schemes such as Kyber and LAC follow the Lindner-Peikert framework [3] up to the choices of ring structure, noise distribution and parameters. As the size of noise in lattice-based PKEs/EKMs is typically larger than the lower bits of the ciphertext, many schemes often artificially drop a few lower bits to optimize the practical performance without significantly increasing the final decryption noise. Kyber [4] is one of the most promising PKE/KEM candidates in the NIST PQC standardization, whose security is provably based on the difficulty of so-called module LWE (MLWE) problems. The use of MLWE allowed Kyber to obtain additional flexibility and security advantages, while keeping the same efficiency as those based on the ring-LWE problems. The strategy of dropping some lower bits is used to compress both the public-key and ciphertext sizes. For a targeted 128-bit quantum security, the public-key and ciphertext sizes of Kyber is around a single kilobyte. LAC [5] uses several techniques to reduce the modulus as small as possible: it uses a byte-level modulus, embeds powerful error-correcting codes to maximize the noise-modulus rate, provides a different style of modulus to avoid potential attacks for special polynomial ring structures and optimizes the polynomial multiplication algorithm of the bit-level secret and noise. Based on these techniques, LAC reduces the public key to 544–1056 bytes and the ciphertext to 664–1464 bytes. Meanwhile, it achieves similar computational performance compared with NTT technique schemes. By observing the asymmetries in lattice-based cryptosystems, Zhang and Yu et al. [6] proposed asymmetric MLWE and asymmetric MSIS problems, which yield further size-optimized KEMs and signature schemes to those from standard counterparts. Compared to the seven NIST round-three candidates at Category III security, their KEM scheme has parameters (public key + ciphertext size) smaller than Classic McEliece, CRYSTALS-Kyber, NTRU and Saber; their signature scheme has parameters (public key + signature size) smaller than CRYSTALS-Dilithium and Rainbow, but slightly larger than FALCON, where CRYSTALS-Kyber, NTRU, Saber, CRYSTALS-Dilithium and FALCON are lattice-based schemes. One important application of lattice-based PKEs/KEMs is to build authenticated key exchange (AKE), which could provide additional authentication to the established session key. There are several generic ways to construct AKE from lattice-based PKEs/KEMs. In the PKE setting, Xue and Lu et al. [7] proposed a more compact KEM-based framework via a new primitive named ‘2-key KEM’, which shares some item between different ciphertexts. In the only password setting, Zhang and Yu [8] presented a two-round PAKE framework from the splittable-PKEs that can be instantiated from lattices. The only known AKE that does not rely on lattice-based PKEs/KEMs was given in Ref. [9], which has two-round messages and provides implicit authentication. This work was supported by the National Natural Science Foundation of China (6197239 to X.L.; 62022018 and 61932019 to J.Z.) and the National Key Research and Development Program of China (2018YFB0804105 to J.Z.). Conflict of interest statement. None declared.
Ce memoire examine le rôle des fonctions à sens unique en cryptographie quantique. À cette fin, elle se penche sur les générateurs d’états quantiques pseudaléatoires, un concept récemment introduit par Ji, Liu et Song, qui sont analogues aux générateurs pseudaléatoires. Des travaux récents ont montré que ces générateurs peuvent être construits à partir de toute fonction à sens unique (sécurisée quantiquement) et peuvent être utilisés pour créer diverses primitives cryptographiques quantiques, telles que l’engagement de bit quantique, le chiffrement quantique à clé symétrique et les codes d’authentification de messages quantiques. Cela implique que, tout comme en cryptographie classique, les fonctions à sens unique constituent une condition suffisante pour réaliser la cryptographie quantique.Bien qu’elles soient suffisantes, elles ne sont peut-être pas strictement nécessaires. Des travaux novateurs, présentés par Kretschmer, ont montré qu’il existe certains mondes relativisés dans lesquels des générateurs d’états quantiques pseudaléatoires existent alors même que les fonctions à sens unique n’existent pas. Cela suggère que les générateurs d’états quantiques pseudaléatoires pourraient reposer sur des hypothèses plus faibles. Ainsi, même si la cryptographie classique s’avérait impossible, la cryptographie quantique ne le serait peut-être pas. Ce memoire présente un résumé complet de ces résultats, en mettant l’accent sur la clarté et la lisibilité, et discute des perspectives de recherche prometteuses
Following its etymology, the term cryptography denotes the techniques used to ensure the confidentiality of information in its storage or transmission. Besides confidentiality, cryptography also encompasses other important functions such as authentication, signature, non-repudiation or secret sharing, to name just a few. The purpose of this section is to give a short introduction to classical cryptography, but only for areas that are relevant to quantum cryptography. For our purposes, we will only deal with confidentiality and authentication. The former is the most important function that quantum key distribution helps to achieve, while the latter is a requirement for quantum key distribution to work. Also, we will cover some topics on the security of classical cryptographic schemes so as to give some insight when comparing classical and quantum cryptography. The study of cryptography ranges from the analysis of cryptographic algorithms (or primitives ) to the design of a solution to a security problem. A cryptographic algorithm is a mathematical tool that provides a solution to a very specific problem and may be based on premises or on other primitives. A solution can be designed by combining primitives, and the requirements and functions of the primitives have to be combined properly. We will first review the confidentiality provided by ciphers that use the same key for both encryption and decryption, hence called secret-key ciphers . Then, we will discuss authentication techniques. Finally, we will show some aspects of public-key cryptography .
In 1994, Peter Shor developed a quantum algorithm that can efficiently solve the factorization and discrete logarithm problems. These problems are the foundation of modern cryptographic algorithms and the existence of an efficient algorithm for solving them threatens their security. Although large-scale quantum computers capable of breaking current cryptographic algorithms are not yet available, advances in quantum technology and the risk of “store now, decrypt later” attacks make it essential to prepare for migration to quantum-safe cryptography today. For the past decade, the cryptographic community has been actively developing algorithms that are not exploitable by Shor’s algorithm; such algorithms are said to be “quantum-safe” or “post-quantum.” However, cryptographic algorithms do not exist in isolation—they are components of larger cryptographic systems, such as protocols or other cryptographic primitives. Migrating these systems to use quantum-safe algorithms is therefore a complex task. This thesis studies the migration of several widely used cryptographic systems to post-quantum cryptography. In particular, we consider the migration of the public-key infrastructure (PKI), the TLS protocol, the XML Encryption and XML Signature standards, the SAML security framework, the Advanced Electronic Signature (AdES) standard, and the password-authenticated public-key encryption (PAPKE) primitive. For each topic, we analyze how the presence of quantum adversaries affects the security of existing constructions and identify components that rely on cryptographic assumptions vulnerable to quantum attacks. Based on this analysis, we propose approaches for adapting these systems to use post-quantum cryptographic algorithms. The proposed solutions are considered in two main forms: purely post-quantum and hybrid post-quantum. Purely post-quantum approaches rely exclusively on post-quantum algorithms, while hybrid post-quantum approaches combine classical and post-quantum mechanisms in order to provide security as long as at least one of the underlying assumptions remains secure. Hybrid post-quantum approaches are primarily motivated by uncertainty regarding the security of post-quantum algorithms. For each proposal, we discuss the advantages and disadvantages of the design, including deployment complexity, compatibility with existing systems, and performance considerations. In several cases, we also provide proof-of-concept implementations and evaluate their performance through benchmarks. We study post-quantum public-key infrastructures, which form a fundamental component of many other cryptographic systems. We show that constructing a purely post-quantum PKI does not fundamentally differ from constructing a classical PKI. For hybrid deployments, we propose two approaches—the composite hybrid and the parallel hybrid—which differ primarily in their implementation complexity. We also survey and analyze existing proposals for post-quantum TLS. In contrast, systems such as XML encryption and XML signatures, the SAML security framework, and the eIDAS-related AdES standard have received little attention in the context of post-quantum migration. For these systems, we outline possible migration approaches and provide proof-of-concept implementations. In addition, we present an example migration plan for a Trust Service Provider that relies on all of the discussed cryptographic systems, together with the methodology used to develop it. Finally, we consider the migration of the cryptographic primitive PAPKE. We propose a novel construction that replaces an ideal cipher with a half-ideal cipher, resulting in more efficient quantum-safe constructions and motivating the study of a new public-key encryption property called decryption robustness.