Search

In order to resist the security risks caused by quantum computing, post-quantum cryptography (PQC) has been a research focus. Constructing a key encapsulation mechanism (KEM) based on lattices is one of the promising PQC routines. The algebraically structured learning with errors (LWE) problem over power-of-two cyclotomics has been one of the most widely used hardness assumptions for lattice-based cryptographic schemes. However, power-of-two cyclotomic rings may be exploited in the inflexibility of selecting parameters. Recently, trinomial cyclotomic rings of the form Zq[x]/(xn−xn/2+1), where n=2k3l, k≥1,l≥0, have received widespread attention due to their flexible parameter selection. In this paper, we propose Tyber, a variant scheme of the NIST-standardized KEM candidate Kyber over trinomial cyclotomic rings. We provide three parameter sets, aiming at the quantum security of 128, 192, and 256 bits (actually achieving 129, 197, and 276 bits) with matching and negligible error probabilities. When compared to Kyber, our Tyber exhibits stronger quantum security, by 22, 31, and 44 bits, than Kyber for three security levels.

In this article, we propose a novel bilateral generalization inhomogenous short integer solution (BiGISIS)-based password-authenticated key exchange (PAKE) scheme for post-quantum era security. The hardness assumption of the constructed PAKE is based on newly proposed hard lattice problem, BiGISIS. The main aim of this article is to provide a solution for the post-quantum secure PAKE scheme, which is one of the open problems in the literature. The proposed PAKE is the first BiGISIS-based PAKE that satisfies anonymity and reusable key features. The bilateral-pasteurization (BiP) approach is used to obtain the reusable key, and anonymity is achieved thanks to the additional identity components and hash functions. The reusable key structure reduces the time in the key generation, and anonymity prevents illegal user login attempts. The security analysis is done by following the real-or-random (RoR) model assumptions. As a result of security examinations, perfect forward secrecy (PFS) and integrity are satisfied, and the resistance against eavesdropping, manipulation-based attack (MBA), hash function simulation, impersonation, signal leakage attack (SLA), man-in-the-middle (MitM), known-key security (KKS), and offline password dictionary attack (PDA) is captured. According to the comparison analysis, the proposed PAKE is the first SLA-resistant lattice-based PAKE with reusable key and anonymity properties.

In a meaningful secret image sharing scheme with authentication, an image is distributed among the participants without raising adversaries suspicion. Additionally the cheats of the dealer and participants in the reconstruction of the image are discoverable, which means that the integration of the shares is verifiable. In this paper, we propose a novel meaningful secret image sharing with authentication property based on learning with errors problem and rook polynomial. Compared with the previous schemes, it has a higher embedding rate and a better visual quality. [ABSTRACT FROM AUTHOR]

Autonomous path proxy re-encryption (AP-PRE) is a type of PRE that implements control on the delegation path in a multi-hop PRE. AP-PRE forces the proxy to perform the transformation along a predefined path without revealing the underlying plaintext. There are several applications of AP-PRE, including electronic medical systems, data sharing, and email systems. However, as far as we know, the existing AP-PRE scheme is provably secure in the random oracle model under the classical number-theoretic assumption, which might be vulnerable to quantum computers. Therefore, it raises the intriguing question of how to construct a quantum-resistant AP-PRE scheme. In this study, we proposed an AP-PRE scheme based on the widely accepted quantum-resistant learning with errors (LWE) assumptions. Our scheme supports the polynomial length of the delegation path. Furthermore, our scheme is proved to be selective-path CPA (sCPA) secure in the standard model under LWE assumptions. [ABSTRACT FROM AUTHOR]

To protect the privacy of cloud data, encryption before uploading provides a solution. However, searching for target data in ciphertext takes effort. Therefore, searchable encryption has become an important research topic. On the other hand, since the advancement of quantum computers will lead to the crisis of cracking traditional encryption algorithms, it is necessary to design encryption schemes that can resist quantum attacks. Therefore, we propose a multi-keyword searchable identity-based proxy re-encryption scheme from lattices. In addition to resisting quantum attacks, the proposed scheme uses several cryptographic techniques to improve encryption efficiency. First, identity-based encryption is used to reduce the computation and transmission costs caused by certificates. Second, the proposed scheme uses proxy re-encryption to achieve the purpose of outsourced computing, allowing the proxy server to reduce the computation and transmission costs of the users. Third, the proposed multi-keyword searchable encryption can provide AND and OR operators to increase the flexibility of searchability. Moreover, the access structure of the proposed scheme is not based on a linear secret sharing scheme (LSSS), avoiding the errors caused by an LSSS-based structure in decryption or search results. Finally, we also give formal security proof of the proposed scheme under the decisional learning with errors assumption. [ABSTRACT FROM AUTHOR]

This paper presents a new threshold signature scheme based on Damgaard's work. The proposed scheme allows for changing the message signature threshold, thereby improving the flexibility of the original Damgaard scheme. This scheme can be applied as a user authentication system using wearable devices. Based on the hardness of lattice problems, this scheme is resistant to attacks on a quantum computer, which is an advantage over the currently used multi-factor authentication schemes. The scheme's security relies on the computational complexity of the Module-LWE and Module-SIS problems, as well as the Shamir secret sharing scheme's security. [ABSTRACT FROM AUTHOR]

Due to the rapid development of mobile communication and hardware technologies, several mobile‐based web applications have gained popularity among mobile users. Mobile users can utilize these devices to access numerous services over the Internet. To ensure secure communication, different key exchange and authentication (KEA) protocols are proposed and frequently used. However, due to the advent of quantum computers, numerous quantum‐safe KEA protocols are also developed using various complex mathematical problems in ideal lattices. As it is an emerging and developing area, we analyze the security of recently suggested ring learning with error based KEA protocols. The goal of this study is to gain a comprehensive understanding of quantum‐safe KEA mechanisms. For our study, we have considered Dharminder's LWE‐based KEA mechanism and Dharminder and Chandran's LWE‐based KEA mechanism. These protocols enable effective communication and provide a better means for safely transmitting messages between user and server. However, we have discovered that a fundamental security weakness in these methods makes them vulnerable to signal leakage attacks (SLA). Based on our analysis, we demonstrated security weakness against SLA and provide the road‐map for secure construction. [ABSTRACT FROM AUTHOR]

A recent work of Sipasseuth, Plantard and Susilo proposed to accelerate lattice-based signature verifications and compress public key storage at the cost of a precomputation on a public key. This first approach, which focused on a restricted type of key, did not include most NIST candidates or most lattice representations in general. In this work, we first present a way to improve even further both their verification speed and their public key compression capability by using a generator of numbers that better suit the method needs. We then also generalize their framework to apply to q-ary lattice schemes as well as classical lattices using Hermite Normal Form, improving their security and applicable scope, thus exhibiting potential trade-offs to accelerate lattice-based signature verification in general and compression of the public key on the verifier side for unstructured lattices. [ABSTRACT FROM AUTHOR]

Due to the development of quantum computing, there is a need for the development and analysis of cryptosystems resistant to attacks using a quantum computer (post-quantum cryptography algorithms). The security of many well-known post-quantum cryptosystems based on lattice theory depends on the complexity of solving the shortest vector problem (SVP). In this paper, a model of quantum oracle developed from Grover's algorithm is described to implement a hybrid quantum–classical algorithm based on GaussSieve. This algorithm can be used for attacks on cryptosystems whose security depends on solving the SVP. Upper bounds for the number of qubits and the depth of the circuit were obtained for two implementations of the proposed quantum oracle model: minimizing the number of qubits and minimizing the circuit depth. The complexity of implementing the proposed quantum oracle model to attack post-quantum lattice-based cryptosystems that are finalists of the NIST post-quantum cryptography competition is analyzed. [ABSTRACT FROM AUTHOR]

The Learning With Errors (LWE) problem is widely used in lattice-based cryptography, which is the most promising post-quantum cryptography direction. There are a variety of LWE-solving methods, which can be classified into four groups: lattice methods, algebraic methods, combinatorial methods, and exhaustive searching. The Blum–Kalai–Wasserman (BKW) algorithm is an important variety of combinatorial algorithms, which was first presented for solving the Learning Parity With Noise (LPN) problem and then extended to solve LWE. In this paper, we give an overview of BKW algorithms for solving LWE. We introduce the framework and key techniques of BKW algorithms and make comparisons between different BKW algorithms and also with lattice methods by estimating concrete security of specific LWE instances. We also briefly discuss the current problems and potential future directions of BKW algorithms. [ABSTRACT FROM AUTHOR]

Summary: As the new generation of power scheme, smart grid is proposed to overcome the shortcomings of traditional systems, such as low efficiency and reliability. In this article, a novel lattice‐based secure primitive for privacy‐preserving smart grid communications is proposed, which has the remarkable characteristics, such as scalable multi‐dimensional fine‐grained power data structure and differential privacy security. First, combining with the lattice‐based data encryption technology, while effectively resisting quantum attacks, the method of simultaneous processing of multi‐dimensional data is innovated. Second, through combining the additive homomorphism of the lattice‐based cryptosystem and the Chinese remainder theorem, the data aggregation mechanism that can directly perform homomorphic operations on compressed ciphertext is constructed. Thanks to the above innovative design ideas, the proposed scheme not only significantly improves the efficiency of data communication and processing, greatly reduces the computational cost of the intermediate entity, but also realizes the data confidentiality and information privacy. Finally, observing the decentralized topology of communication nodes in the typical cyber‐physical system of smart grid, the localized differential privacy technology is leveraged to optimize and balance the utility, security, and efficiency of differential privacy. Extensive performance evaluations are conducted to illustrate that the proposed scheme outperforms the state‐of‐the‐art similar schemes in terms of computation complexity and communication cost. [ABSTRACT FROM AUTHOR]

Abstract The current widely used public‐key cryptosystems are vulnerable to quantum attacks. To prepare for cybersecurity in the quantum era, some projects have been launched to call for post‐quantum alternatives. Due to solid security and desirable performance, lattice‐based cryptosystems are viewed as promising candidates in the upcoming standardisation of post‐quantum cryptography. This study surveys the lattice‐based cryptosystems in the post‐quantum standardisation processes including the NIST Post‐Quantum Cryptography Standardisation and the Chinese Cryptographic Algorithm Design Competition, from both design and security aspects. We present generic design paradigms of lattice‐based schemes and describe several representative proposals and recent progress. We also recap some main cryptanalytic results and methods for estimating the concrete security of lattice‐based schemes.

A group signature allows a group member who signs the message on behalf of the other group members. Any recipient also verifies the signature without knowing the signer. However, it is possible to reveal the signer’s identity since the group signatures have the tracing mechanism. In general, the group signature size increases the number of group members. However, the schemes are also proposed with the constant signature size. On the other hand, the security of some schemes are based on the discrete logarithm and factorization problems while some schemes which are secure against quantum attacks are proposed. To the best of our knowledge, the signature scheme in the group concept has not been proposed on lattices in quantum oracles. In this paper, we propose a new constant-size and partially-dynamic group signature scheme on lattice assumptions. We combine the Dilithium signature scheme, a Stern-like zero-knowledge scheme and Regev’s encryption scheme. We give a zero-knowledge argument system for our proposed scheme and security analysis in the quantum random oracle model. According to the comparison results, the proposed scheme has better size complexity in asymptotic concept.

The post-quantum cryptography (PQC) standardization process of the National Institute of Standards and Technology (NIST) has entered the final round. Kyber is one of the four key encapsulation mechanism (KEM) finalists. The coefficient multiplication is vulnerable to side-channel attacks. In this paper, we analyzed the multiplication part of Kyber and proposed the methods for constructing ciphertext. By using the chosen ciphertext, more functions can be attacked in the reference implementation of Kyber512. The attacks succeed on the pqm4 implementation with chosen ciphertext while failing with random ciphertext in our experiment environment. For all the attacks, the full secret key recovery can be achieved in a few minutes. • We used chosen ciphertext to attack more position in the decryption of Kyber. • The number of traces used for some functions was reduced by using chosen ciphertext. • In all the experiments, the proposed attack taked only several minutes. [ABSTRACT FROM AUTHOR]

The deployment of cloud services enables users to outsource their data to cloud servers and retrieve the target data efficiently. However, the application of quantum computers in clouds would be realized from the recent breakthrough results of quantum computers. Existing authentication schemes based on conventional hardness assumptions will be confronted with quantum attackers in the near future. A lattice-based authentication scheme resolves this tension. Although, existing lattice-based authentication schemes employing identity-based signcryption (IBS), the security against misbehaved private key generators (mPKG) is not well-considered, which may cause privacy issues in some application scenarios since the mPKG can generate the secret key for any given identity. This paper proposes an IBS-based authentication scheme for cloud storage dubbed LAMA that thwarts adversaries who have quantum computing power. We integrate the IBS scheme with the lattice-based cryptography, which is the variant of existing IBS-based authentication schemes and is post-quantum secure. We integrate identity certifying authority (ICA) with private key generator (PKG) to ensure security against mPKG. Our comprehensive security proof demonstrates that LAMA is indistinguishable against chosen plaintext attacks and secure against mPKG. We conduct a comprehensive performance evaluation of LAMA, which demonstrates the high efficiency of LAMA in terms of computation and communication overhead and proves that it can be easily deployed on low configured user devices. [ABSTRACT FROM AUTHOR]

The learning with errors (LWE) problem has emerged as the most popular hard problem for constructing lattice based cryptographic solutions. In this paper, we propose a verifiable multi secret sharing scheme based on LWE problem and prove the security of our scheme in the standard model. It is a threshold scheme and every t participants (t ≤ n) can recover multiple secrets, in one stage. Moreover, it has a non-interactive verification and no extra communication is needed among participants and the dealer in the verification phase. In short, it is the first LWE based threshold multi secret sharing scheme that has formal security in the standard model. [ABSTRACT FROM AUTHOR]

A "confidential monetary value" carries information about the real monetary value but does not disclose it. Post-quantum private blockchains with confidential monetary values—large-sized blockchains with large verification times—have the least scalability because they need to save and verify more information than those with "plain-text monetary values". High scalability is an essential security requirement for decentralized blockchain payment systems because the more honest peers who can afford to verify the blockchain copies are, the higher the security. We propose a quantum-safe transaction protocol for confidential monetary blockchains, LACT+ (Lattice-based Aggregable Confidential Transactions), which is more scalable than previous post-quantum confidential blockchains, i.e., many input/output transactions with logarithmic sized complexity. [ABSTRACT FROM AUTHOR]

Global efforts such as the National Institute of Standards and Technology (NIST)'s post-quantum standardization center on cryptographic primitives like public-key encryption and signature schemes that are secure even in the presence of quantum adversaries. In addition, one must also consider efficient certificate management as new technologies like the Internet of Things and 5G wireless networks rely on them. For example, the IEEE Standard for vehicle-to-vehicle communication depends on implicit certificates. However, the only efficient construction available is over elliptic curves, and hence not quantum-secure. This paper investigates approaches to construct implicit certificate schemes from lattices, employing the NIST Round 3 signature schemes Dilithium and Falcon. We consider emulation of the existing implicit certificate scheme and proceed to more innovative techniques like combining the two schemes or pairing them with encryption. Unfortunately, we encounter problems with each design, due to recurring causes like conflicting secret key and signature sizes, unique sampler requirements and the rigidity of the parameter sets. By explaining each of these issues, this paper will hopefully spark ideas for more successful constructions. [ABSTRACT FROM AUTHOR]

Copyright of Journal of Southeast University (English Edition) is the property of Journal of Southeast University Editorial Office and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

We construct an efficient dynamic group signature (or more generally an accountable ring signature) from isogeny and lattice assumptions. Our group signature is based on a simple generic construction that can be instantiated by cryptographically hard group actions such as the CSIDH group action or an MLWE-based group action. The signature is of size O (log N) , where N is the number of users in the group. Our idea builds on the recent efficient OR-proof by Beullens, Katsumata, and Pintore (Asiacrypt'20), where we efficiently add a proof of valid ciphertext to their OR-proof and further show that the resulting non-interactive zero-knowledge proof system is online extractable. Our group signatures satisfy more ideal security properties compared to previously known constructions, while simultaneously having an attractive signature size. The signature size of our isogeny-based construction is an order of magnitude smaller than all previously known post-quantum group signatures (e.g., 6.6 KB for 64 members). In comparison, our lattice-based construction has a larger signature size (e.g., either 126 KB or 89 KB for 64 members depending on the satisfied security property). However, since the O (·) -notation hides a very small constant factor, it remains small even for very large group sizes, say 2 20 . [ABSTRACT FROM AUTHOR]

Benefit from the characteristics of easy parallelism, high speed, and that the security in the average-case is able to be established on the worst-case of some underlying hard problems, latticebased cryptography is considered to be the most promising post-quantum cryptographic standard. In those lattice-based cryptographic schemes built on the polynomial ring, number-theoretic transform algorithm is one of the key technical methods to accelerate the multiplication of two polynomials so that the efficiency of the schemes can be improved. However, the existing algorithms are only applicable to polynomial rings in the form Zq[x]/(xn ± 1), and the security parameter n has to be a power of 2. This paper improves the number-theoretic transform formula and shows how polynomial multiplication works over a new polynomial ring Zq[x]/(xn -- xn/2 + 1). Moreover, the computational complexity of the formula can be computed with the help of butterfly algorithm. Combined with the Karatsuba algorithm, the range of parameter selection is expanded in the case of n = c · 2k, and the computational complexity is reduced. [ABSTRACT FROM AUTHOR]