NIST Post-Quantum Cryptography Standardization
Post-Quantum Cryptography Standardization[1] is a program and competition by NIST to update their standards to include post-quantum cryptography.[2] It was announced at PQCrypto 2016.[3] 23 signature schemes and 59 encryption/KEM schemes were submitted by the initial submission deadline at the end of 2017[4] of which 69 total were deemed complete and proper and participated in the first round. Seven of these, of which 3 are signature schemes, have advanced to the third round, which was announced on July 22, 2020.
Background[]
Academic research on the potential impact of quantum computing dates back to at least 2001.[5] A NIST published report from April 2016 cites experts that acknowledge the possibility of quantum technology to render the commonly used RSA algorithm insecure by 2030.[6] As a result, a need to standardize quantum-secure cryptographic primitives was pursued. Since most symmetric primitives are relatively easy to modify in a way that makes them quantum resistant, efforts have focused on public-key cryptography, namely digital signatures and key encapsulation mechanisms. In December 2016 NIST initiated a standardization process by announcing a call for proposals.[7]
The competition is now in its third round out of expected four, where in each round some algorithms are discarded and others are studied more closely. NIST hopes to publish the standardization documents by 2024, but may speed up the process if major breakthroughs in quantum computing are made.
It is currently undecided whether the future standards be published as FIPS or as NIST Special Publication (SP).
Round one[]
Under consideration were:[8]
(strikethrough means it had been withdrawn)
Type | PKE/KEM | Signature | Signature & PKE/KEM |
---|---|---|---|
Lattice |
|
|
|
Code-based |
|
|
|
Hash-based |
|
||
Multivariate |
|
|
|
Braid group |
|
||
Supersingular elliptic curve isogeny | |||
Satirical submission | |||
Other |
|
|
Round one submissions published attacks[]
- Guess Again by Lorenz Panny [14]
- RVB by Lorenz Panny[15]
- RaCoSS by Daniel J. Bernstein, Andreas Hülsing, Tanja Lange and Lorenz Panny[16]
- HK17 by Daniel J. Bernstein and Tanja Lange[17]
- SRTPI by Bo-Yin Yang[18]
- WalnutDSA
- DRS by Yang Yu and Léo Ducas [21]
- DAGS by Elise Barelli and Alain Couvreur[22]
- Edon-K by Matthieu Lequesne and Jean-Pierre Tillich[23]
- RLCE by Alain Couvreur, Matthieu Lequesne, and Jean-Pierre Tillich[24]
- Hila5 by Daniel J. Bernstein, Leon Groot Bruinderink, Tanja Lange and Lorenz Panny[25]
- Giophantus by Ward Beullens, Wouter Castryck and Frederik Vercauteren[26]
- RankSign by Thomas Debris-Alazard and Jean-Pierre Tillich [27]
- McNie by Philippe Gaborit;[28] Terry Shue Chien Lau and Chik How Tan [29]
Round two[]
Candidates moving on to the second round were announced on January 30, 2019. They are:[30]
Type | PKE/KEM | Signature |
---|---|---|
Lattice | ||
Code-based | ||
Hash-based |
| |
Multivariate | ||
Supersingular elliptic curve isogeny | ||
Zero-knowledge proofs |
|
Round three[]
On July 22, 2020, NIST announced seven finalists ("first track"), as well as eight alternate algorithms ("second track"). The first track contains the algorithms which appear to have the most promise, and will be considered for standardization at the end of the third round. Algorithms in the second track could still become part of the standard, after the third round ends.[51] NIST expects some of the alternate candidates to be considered in a fourth round. NIST also suggests it may re-open the signature category for new schemes proposals in the future.[52]
On June 7-9, 2021, NIST conducted the third PQC standardization conference, virtually.[53] The conference included candidates' updates and discussions on implementations, on performances, and on security issues of the candidates. A small amount of focus was spent on intellectual property concerns.
Finalists[]
Type | PKE/KEM | Signature |
---|---|---|
Lattice[a] |
| |
Code-based | ||
Multivariate |
|
Alternate candidates[]
Type | PKE/KEM | Signature |
---|---|---|
Lattice |
|
|
Code-based |
|
|
Hash-based |
| |
Multivariate |
| |
Supersingular elliptic curve isogeny | ||
Zero-knowledge proofs |
|
Intellectual property concerns[]
After NIST's announcement regarding the finalists and the alternate candidates, various intellectual property concerns were voiced, notably surrounding lattice-based schemes such as Kyber and NewHope. NIST holds signed statements from submitting groups clearing any legal claims, but there is still a concern that third parties could raise claims. NIST claims that they will take such considerations into account while picking the winning algorithms.[54]
Adaptations[]
During this round, some candidates have shown to be vulnerable to some attack vectors. It forces this candidates to adapt accordingly:
- CRYSTAL-KYBER and SABER - may change the nested hashes used in their proposals in order for their security claims to hold.[55]
- FALCON - side channel attack by . A masking may be added in order to resist the attack. This adaptation affects performance and should be considered while standardizing.[56]
See also[]
Notes[]
References[]
- ^ "Post-Quantum Cryptography PQC". 3 January 2017.
- ^ "Post-Quantum Cryptography Standardization – Post-Quantum Cryptography". Csrc.nist.gov. 3 January 2017. Retrieved 31 January 2019.
- ^ "The Future Is Now: Spreading the Word About Post-Quantum Cryptography". 24 November 2020.
- ^ "Archived copy". Archived from the original on 2017-12-29. Retrieved 2017-12-29.CS1 maint: archived copy as title (link)
- ^ Hong, Zhu (2001). "Survey of Computational Assumptions Used inCryptography Broken or Not by Shor's Algorithm" (PDF). Cite journal requires
|journal=
(help) - ^ "NIST Released NISTIR 8105, Report on Post-Quantum Cryptography". 21 December 2016. Retrieved 5 November 2019.
- ^ "NIST Asks Public to Help Future-Proof Electronic Information". 20 December 2016. Retrieved 5 November 2019.
- ^ Computer Security Division, Information Technology Laboratory (3 January 2017). "Round 1 Submissions – Post-Quantum Cryptography – CSRC". Csrc.nist.gov. Retrieved 31 January 2019.
- ^ a b c "Archived copy". Archived from the original on 2017-12-29. Retrieved 2017-12-29.CS1 maint: archived copy as title (link)
- ^ a b "Google Groups". Groups.google.com. Retrieved 31 January 2019.
- ^ a b "ROLLO". Pqc-rollo.org. Retrieved 31 January 2019.
- ^ RSA using 231 4096-bit primes for a total key size of 1 TiB. "Key almost fits on a hard drive" Bernstein, Daniel (2010-05-28). "McBits and Post-Quantum RSA" (PDF). Retrieved 2019-12-10.
- ^ Bernstein, Daniel; Heninger, Nadia (2017-04-19). "Post-quantum RSA" (PDF). Retrieved 2019-12-10.
- ^ "Dear all, the following Python script quickly recovers the message from a given "Guess Again" ciphertext without knowledge of the private key" (PDF). Csrc.nist.gov. Retrieved 30 January 2019.
- ^ Panny, Lorenz (25 December 2017). "Fast key recovery attack against the "RVB" submission to #NISTPQC: t …. Computes private from public key". Twitter. Retrieved 31 January 2019.
- ^ "Archived copy". Archived from the original on 2017-12-26. Retrieved 2018-01-04.CS1 maint: archived copy as title (link)
- ^ "Archived copy". Archived from the original on 2018-01-05. Retrieved 2018-01-04.CS1 maint: archived copy as title (link)
- ^ "Dear all, We have broken SRTPI under CPA and TPSig under KMA" (PDF). Csrc.nist.gov. Retrieved 30 January 2019.
- ^ Beullens, Ward; Blackburn, Simon R. (2018). "Practical attacks against the Walnut digital signature scheme". Eprint.iacr.org.
- ^ Kotov, Matvei; Menshov, Anton; Ushakov, Alexander (2018). "AN ATTACK ON THE WALNUT DIGITAL SIGNATURE ALGORITHM". Eprint.iacr.org.
- ^ Yu, Yang; Ducas, Léo (2018). "Learning strikes again: the case of the DRS signature scheme". Eprint.iacr.org.
- ^ Barelli, Elise; Couvreur, Alain (2018). "An efficient structural attack on NIST submission DAGS". arXiv:1805.05429 [cs.CR].
- ^ Lequesne, Matthieu; Tillich, Jean-Pierre (2018). "Attack on the Edon-K Key Encapsulation Mechanism". arXiv:1802.06157 [cs.CR].
- ^ Couvreur, Alain; Lequesne, Matthieu; Tillich, Jean-Pierre (2018). "Recovering short secret keys of RLCE in polynomial time". arXiv:1805.11489 [cs.CR].
- ^ Bernstein, Daniel J.; Groot Bruinderink, Leon; Lange, Tanja; Lange, Lorenz (2017). "Hila5 Pindakaas: On the CCA security of lattice-based encryption with error correction". Cite journal requires
|journal=
(help) - ^ "Official Comments" (PDF). Csrc.nist.gov. 13 September 2018.
- ^ Debris-Alazard, Thomas; Tillich, Jean-Pierre (2018). "Two attacks on rank metric code-based schemes: RankSign and an Identity-Based-Encryption scheme". arXiv:1804.02556 [cs.CR].
- ^ "I am afraid the parameters in this proposal have at most 4 to 6‐bits security under the Information Set Decoding (ISD) attack" (PDF). Csrc.nist.gov. Retrieved 30 January 2019.
- ^ Lau, Terry Shue Chien; Tan, Chik How (31 January 2019). "Key Recovery Attack on McNie Based on Low Rank Parity Check Codes and Its Reparation". In Inomata, Atsuo; Yasuda, Kan (eds.). Advances in Information and Computer Security. Lecture Notes in Computer Science. 11049. Springer International Publishing. pp. 19–34. doi:10.1007/978-3-319-97916-8_2. ISBN 978-3-319-97915-1.
- ^ Computer Security Division, Information Technology Laboratory (3 January 2017). "Round 2 Submissions – Post-Quantum Cryptography – CSRC". Csrc.nist.gov. Retrieved 31 January 2019.
- ^ a b Schwabe, Peter. "CRYSTALS". Pq-crystals.org. Retrieved 31 January 2019.
- ^ "FrodoKEM". Frodokem.org. Retrieved 31 January 2019.
- ^ Schwabe, Peter. "NewHope". Newhopecrypto.org. Retrieved 31 January 2019.
- ^ "Archived copy". Archived from the original on 2019-09-01. Retrieved 2019-01-30.CS1 maint: archived copy as title (link)
- ^ "SABER". Retrieved 17 June 2019.
- ^ "ThreeBears". SourceForge.net. Retrieved 31 January 2019.
- ^ "Falcon". Falcon. Retrieved 26 June 2019.
- ^ "qTESLA – Efficient and post-quantum secure lattice-based signature scheme". Retrieved 31 January 2019.
- ^ "BIKE – Bit Flipping Key Encapsulation". Bikesuite.org. Retrieved 31 January 2019.
- ^ "HQC". Pqc-hqc.org. Retrieved 31 January 2019.
- ^ "LEDAkem Key Encapsulation Module". Ledacrypt.org. Retrieved 31 January 2019.
- ^ "LEDApkc Public Key Cryptosystem". Ledacrypt.org. Retrieved 31 January 2019.
- ^ "Archived copy". Archived from the original on 2017-12-29. Retrieved 2017-12-29.CS1 maint: archived copy as title (link)
- ^ "RQC". Pqc-rqc.org. Retrieved 31 January 2019.
- ^ [1]
- ^ "Archived copy". Archived from the original on 2019-01-31. Retrieved 2019-01-30.CS1 maint: archived copy as title (link)
- ^ "LUOV -- An MQ signature scheme". Retrieved 22 January 2020.
- ^ "MQDSS post-quantum signature". Mqdss.org. Retrieved 31 January 2019.
- ^ "SIKE – Supersingular Isogeny Key Encapsulation". Sike.org. Retrieved 31 January 2019.
- ^ "Picnic. A Family of Post-Quantum Secure Digital Signature Algorithms". microsoft.github.io. Retrieved 26 February 2019.
- ^ a b Moody, Dustin; Alagic, Gorjan; Apon, Daniel C.; Cooper, David A.; Dang, Quynh H.; Kelsey, John M.; Liu, Yi-Kai; Miller, Carl A.; Peralta, Rene C.; Perlner, Ray A.; Robinson, Angela Y.; Smith-Tone, Daniel C.; Alperin-Sheriff, Jacob (2020). "Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process". doi:10.6028/NIST.IR.8309. S2CID 243755462. Retrieved 2020-07-23. Cite journal requires
|journal=
(help) - ^ Third PQC Standardization Conference - Session I Welcome/Candidate Updates, retrieved 2021-07-06
- ^ Computer Security Division, Information Technology Laboratory (2021-02-10). "Third PQC Standardization Conference | CSRC". CSRC | NIST. Retrieved 2021-07-06.
- ^ "Submission Requirements and Evaluation Criteria" (PDF).
- ^ Grubbs, Paul; Maram, Varun; Paterson, Kenneth G. (2021). "Anonymous, Robust Post-Quantum Public Key Encryption". Cite journal requires
|journal=
(help) - ^ Karabulut, Emre; Aysu, Aydin (2021). "Falcon Down: Breaking Falcon Post-Quantum Signature Scheme through Side-Channel Attacks". Cite journal requires
|journal=
(help)
External links[]
- Cryptography standards
- Cryptography contests
- Post-quantum cryptography