Upload File

post-quantum cryptography - nluugmodern post-quantum crypto „users using cryptography on...

  • Home
  • Documents
  • Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?
41
Post-Quantum Cryptography Andreas Hülsing TU Eindhoven

Upload: others

Post on 04-Oct-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Post-Quantum Cryptography

Andreas Hülsing

TU Eindhoven

Page 2: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Quantum kills the Internet

11/21/2019 Andreas Hülsing https://huelsing.net 2

Page 3: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Background:Cryptography

11/21/2019 Andreas Hülsing https://huelsing.net 3

Page 4: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Secret key encryption (SKE)

01/07/2019 https://huelsing.net 4

plaintext

Sdkfj

kj

djd

fj

djf

jkj

plaintext

Key k Key k

SKE.Enc SKE.Dec

Page 5: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Message authentication (MAC)

01/07/2019 https://huelsing.net 5

plaintext

Key k Key k

MAC.Tag MAC.Vrfyplaintext

Page 6: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

How to build secret key crypto?

• Random function sufficient (we need one-wayness)

• Attacks ≈ unstructured search

• How to build random behaving function?

11/21/2019 Andreas Hülsing https://huelsing.net 6

Engineering*

* Disclaimer: Massive simplification

Spoiler: Killed by quantum? Not that we know.

(but weakened)*

Page 7: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

How does Bob learn shared key k?

11/21/2019 Andreas Hülsing https://huelsing.net 7

Page 8: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Public key encryption (PKE)

01/07/2019 https://huelsing.net 8

plaintext

Sdkfj

kj

djd

fj

djf

jkj

plaintext

Bob’s pkBob’s sk

PKE.Enc PKE.Dec

Page 9: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Digital Signature (DSig)

01/07/2019 https://huelsing.net 9

plaintext

Alice’s pk

DSig.Sign DSig.Vrfyplaintext

Alice’s sk

Page 10: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Applications

• Code signing (DSIG)• Software updates

• Software distribution

• Mobile code

• Communication security (DSIG, PKE / KEX /KEM)• TLS, SSH, IPSec, ...

• eCommerce, online banking, eGovernment, ...

• Private online communication

11/21/2019 Andreas Hülsing https://huelsing.net 11

Page 11: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Communication security (simplified)

Hi

pk, Cert(pk belongs to shop)

PKC to establish shared secret sk

SKC secured communication using sk

11/21/2019 Andreas Hülsing https://huelsing.net 12

Page 12: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

How to build PKC

(Computationally)

hard problemRSA

DL

QR DDH

PKC SchemeRSA-OAEP

ECDSA DH-KE

11/21/2019 Andreas Hülsing https://huelsing.net 13

Page 13: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

The Quantum Threat

Page 14: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Shor‘s algorithm (1994)

• Quantum computers can do FFT very efficiently

• Can be used to find period of a function

• This can be exploited to factor efficiently (RSA)

• Shor also shows how to solve discrete log efficiently (DSA, DH, ECDSA, ECDH)

Page 15: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Grover‘s algorithm (1996)

• Quantum computers can search 𝑁 entry DB in Θ( 𝑁)

• Application to symmetric crypto

• Nice: Grover is provably optimal (For random function)

• Double security parameter.

Page 16: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

How to build PKC

(Computationally)

hard problemRSA

DL

QR DDH

PKC SchemeRSA-OAEP

ECDSA DH-KE

11/21/2019 Andreas Hülsing https://huelsing.net 17

Page 17: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Communication security (simplified)

Hi

pk, Cert(pk belongs to shop)

PKC to establish shared secret sk

SKC secured communication using sk

11/21/2019 Andreas Hülsing https://huelsing.net 18

Page 18: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Why care today

• EU launched a one billion Euro project on quantum technologies

• Similar range is spent in China

• US administration passed a bill on spending $1.275 billion US dollar on quantum computing research

• Google, IBM, Microsoft, Alibaba, and others run their own research programs.

21.11.2019 https://huelsing.net 19

Page 19: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

It‘s a question of risk assessment

21.11.2019 https://huelsing.net 20

Page 20: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Real world cryptography development

Develop systems Analyze securityImplement

systems

Analyze implementation

security

Select best systems and standardize

them

Integrate systems into products & protocols

Role out secure products

21.11.2019 21https://huelsing.net

Page 21: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Who would store all encrypted data traffic? That must be expensive!

21.11.2019 https://huelsing.net 22

Page 22: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Long-lived systems

• Development time easily 10+ years

• Lifetime easily 10+ years

• At least make sure you got a secure update channel!

21.11.2019 https://huelsing.net 23

Page 23: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

What about QKD?

11/21/2019 Andreas Hülsing https://huelsing.net 24

Page 24: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Recall:Communication security (simplified)

Hi

pk, Cert(pk belongs to shop)

PKC to establish shared secret sk

SKC secured communication using sk

11/21/2019 Andreas Hülsing https://huelsing.net 25

Page 25: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

The problem solved by QKD

Given

• a shared classical secret,

• a physical channel between parties that supports QKD

• compatible QKD devices on both ends of the channel

It is possible to

• generate a longer shared classical secret.

11/21/2019 Andreas Hülsing https://huelsing.net 26

“Key growing”(≠ “Key establishment“)

Page 26: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Solution to the problem caused by Shor?Post-quantum cryptography

11/21/2019 Andreas Hülsing https://huelsing.net 27

Page 27: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

How to build PKC

(Computationally)

hard problemRSA

DL

QR DDH

PKC SchemeRSA-OAEP

ECDSA DH-KE

11/21/2019 Andreas Hülsing https://huelsing.net 28

(computationally)

Quantum-hard Problem

Page 28: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Early post-quantum crypto

„Cryptography based on problems that are conjectured to be hard even for quantum computers.“

...

1

3

14232

2

32

34121

2

11

y

xxxxxxy

xxxxxxy

Lattice-based: SVP / CVP Hash-based: CR / SPR / ...

Code-based: SD Multivariate: MQ

11/21/2019 Andreas Hülsing https://huelsing.net 29

Page 29: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Modern post-quantum crypto

„Users using cryptography on conventional computers facing quantum adversaries“

Adds questions like

• How to argue security?

• Are our security models sound?

• What is the complexity of actual quantum attacks?

11/21/2019 Andreas Hülsing https://huelsing.net 30

Page 30: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

NIST Competition

11/21/2019 Andreas Hülsing https://huelsing.net 35

“We see our role as managing a process of achieving community consensus in a transparent and timely manner” NIST’s Dustin Moody 2018

Page 31: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Status of the competition

• Nov 2017: 82 submissions collected

• Dec 2017: 69 “complete & proper” proposals published• -> Starts round 1 (of 2 or 3 rounds)

• Jan 2019: 26 proposals selected for 2nd round. • 17 KEM, 9 Signature

• 2022 – 2024 Draft standards exist

11/21/2019 Andreas Hülsing https://huelsing.net 36

Page 32: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

General conflict

11/21/2019 Andreas Hülsing https://huelsing.net 37

Security Performance

Page 33: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Open questions

11/21/2019 Andreas Hülsing https://huelsing.net 38

Page 34: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Proofs are complicated

11/21/2019 Andreas Hülsing https://huelsing.net 39

Page 35: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Possible issues with “proofs“

“Security proof“ = proof that breaking scheme is as hard as solving hard math problem

• Some proofs are in the wrong models

• Some proofs are massively loose

• Some proofs are just wrong

In PQC we have to deal with new math, new models of computation & security!

11/21/2019 Andreas Hülsing https://huelsing.net 40

Page 36: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Way out?

• Reviewing is hard, time-consuming, and not rewarding

• Possible solution: Computer-verified proofs

11/21/2019 Andreas Hülsing https://huelsing.net 41

Page 37: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Protocol integration

11/21/2019 Andreas Hülsing https://huelsing.net 42

Page 38: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

11/21/2019 Andreas Hülsing https://huelsing.net 43

Plug‘n‘play?

• Today‘s protocols are built around DH

• NIST selects KEM and DSig

• Performance gap between SKC and PKC widens

• Efficient schemes are less mature than today‘s crypto

• Requires new protocol design

Page 39: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Conclusion

• When large-scale QC are built, we need new PKC

• It remains a question of risk assessment

• We are making progress to standardize PQC but we still need time• (For applications with long-term secrecy requirements

you can move now at the price of higher costs)

11/21/2019 Andreas Hülsing https://huelsing.net 44

Page 40: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Resources

• PQ Summer School: http://www.pqcschool.org/

• NIST PQC Standardization Project: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography

11/21/2019 Andreas Hülsing https://huelsing.net 45

http://www.pqcschool.org/
https://csrc.nist.gov/Projects/Post-Quantum-Cryptography
Page 41: Post-Quantum Cryptography - NLUUGModern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue security?

Thank you!

Questions?

11/21/2019 Andreas Hülsing https://huelsing.net 46


Post-quantum cryptography · 2016-09-13 · Post-quantum crypto is crypto that resists attacks by quantum computers. I PQCrypto 2006: International Workshop on Post-Quantum Cryptography

Post-Quantum Cryptography on FPGAs: the ... · Post-Quantum Cryptography on FPGAs: the NiederreiterCryptosystem 1. Project Overview 3. Contributions We presentafullcryptosystemwithtunable

Post-quantum cryptography proposal - shiftleft.org · Post-quantum cryptography proposal: ThreeBears (draft) Inventor, developer and submitter Mike Hamburg Rambus Security Division

Introduzione alla Post-Quantum Cryptography€¦ · Introduzione alla Post-Quantum Cryptography Author: Matteo Bonini Created Date: 4/5/2017 3:21:57 PM

Cryptography in a Post-Quantum World

Post-Quantum Cryptography - DTU Orbit · Post-Quantum Cryptography Author: Val erie Gauthier Umana~ Technical University of Denmark Department of Mathematics Building 303S, DK-2800

Post-quantum cryptography · Post-quantum cryptography shielding us against quantum-computer fallout Daniel J. Bernstein1 and Tanja Lange2 1University of Illinois at Chicago 2Technische

Introduction to post-quantum cryptography · \Post-Quantum Cryptography Standardization Project". Solicits submissions on signatures and encryption. Tanja Lange Introduction to post-quantum

BEYOND POST–QUANTUM CRYPTOGRAPHYmzhandry/docs/talks/BeyondPQC.slides.pdfBeyond Post -Quantum Cryptography Eventually, all computers will be quantum . Adversary may use quantum interactions

Post-Quantum Cryptography in ARM Processors · 2019-10-07 · Open Questions about Post-Quantum Cryptography •Design better post-quantum cryptosystems •Improve classical and quantum

Quantum Cryptography Post Tenebras Lux! Grégoire Ribordy

Recent Developments of Post Quantum Cryptography · Security Evaluation of Post‐Quantum Cryptography Rabi Model Shor IBM’s NMR Haroche-Wineland’s (1944) Algorithm Quantum Computer

Post-Quantum Cryptographyparshurambudhathoki.weebly.com/.../38024669/post_quantum_crypt… · Quantum cryptography needs direct connection between the quantum cryptography hardware

Update on the NIST Post-Quantum Cryptography Project · Update on the NIST Post-Quantum Cryptography Project ... • Guest researchers and invited speakers ... • Post-quantum cryptography

FO-like Combiners and Hybrid Post-Quantum Cryptography

Post-quantum cryptography D. J. Bernstein University of ... · cryptography be developed out ... Buchmann–Williams: Dead. ... Bernstein: “Introduction to post-quantum cryptography

Cryptography in a Post Quantum Computing World

PQCHacks: a gentle introduction to post-quantum cryptography

Post Quantum Cryptography - Universiti Putra Malaysiaeinspem.upm.edu.my/journal/fullpaper/vol11saugust/1-28.pdf · Post Quantum Cryptography Nitaj, A. Laboratoire de Mathématiques

Post-Quantum Cryptography: Lattice-based encryption

Preparing for post-quantum cryptography in TLS · Assumptions for post-quantum KEMs –Learning with errors, ring-LWE ... TLS:DIV •2017-04-30 Preparing for post-quantum cryptography

Post-quantum cryptography proposal: ThreeBears · 2019-07-25 · Post-quantum cryptography proposal: ThreeBears Inventor, developer and submitter Mike Hamburg Rambus Cryptography

Encryption Post-Quantum Cryptography Infographic …...Title Encryption Post-Quantum Cryptography Infographic JP Author DigiCert.Inc Subject The history of cryptography is a cycle

Post-Quantum Cryptography #2 - crypto.cs.mcgill.cacrypto.cs.mcgill.ca/~crepeau/WATERLOO/LEC-2.pdf · Post-Quantum Cryptography #2 Prof. Claude Crépeau McGill University jeudi 18

Post-Quantum Cryptography€¦ · Modern post-quantum crypto „Users using cryptography on conventional computers facing quantum adversaries ^ Adds questions like •How to argue

Post Quantum Cryptography in the Cloud · 2019-11-05 · cryptography • Supporters of the ETSI-IQC Quantum Safe Cryptography Workshop since 2013 • Member of the ETSI Quantum Safe

Post-Quantum Cryptography

18 Post-Quantum Cryptography July 2019 · Science and Technology Briefings – No. 18 - Quantum and Post-Quantum Cryptography Page 2 FIGURE 1. THE PRINCIPLE OF ASYMMETRIC ENCRYPTION

Lattice-based Cryptography · Cryptography Post-Quantum CryptographyResults and Perspectives Outline 1 Cryptography Fundamental Goals Techniques and Limitations 2 Post-Quantum Cryptography

Gröbner Bases Techniques in Post-Quantum Cryptography · LWE-basedcryptography: newtoolforasymptoticalhardness Gröbner Bases Techniques in Post-Quantum Cryptography A major tool

Post-quantum Lattice-based Cryptography - DiVA portal935425/FULLTEXT01.pdf · Post-quantum Lattice-based Cryptography REBECCA STAFFAS Master’s Thesis in Mathematics (30 ECTS credits)

KMIP Post-Quantum Cryptography Profile Working Draft 02 · 49 2 Post-Quantum Cryptography Profile 50 The Post-Quantum Cryptography Profile describes a KMIP client interacting with

Post-quantum cryptography · Post-Quantum Cryptography. Quantum-secure problems Credits: Buchmann, Bindel 2015. Conjectured quantum-secure problems •Solving multivariate quadratic

An introduction to post-quantum cryptography · An introduction to post-quantum cryptography Author: Andrew Savchenko Subject: Linux, Cryptography, Quantum computing Created Date:

Post-Quantum Cryptography: Lattice-Based Cryptography and