Improved Classical Cryptanalysis of SIKE in Practice

Costello, Craig; Longa, Patrick; Naehrig, Michael; Renes, Joost; Virdia, Fernando

doi:10.1007/978-3-030-45388-6_18

Cited by 20 publications

(8 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is believed that the best classical algorithm [7] to attack the problem has the complexity O( 2√ l e l ), where l e l = min(l e 1 1 , l e 2 2 ), while the claw-finding quantum algorithm [21] has the complexity O( 3√ l e l ). Recent research [4,16] show that the actual quantum complexity of breaking the isogeny problem is estimated by O( 4√ p) operations, but we choose to be a little on a safe side.…”

Section: Discussionmentioning

confidence: 99%

Limonnitsa: making Limonnik-3 post-quantum

Grebnev¹

2020

Матем. вопр. криптогр.

View full text Add to dashboard Cite

Предлагается протокол выработки общего ключа с аутентификацией на основе открытого ключа “Лимонница”. Протокол основан на структуре протокола “Лимонник-3”, вошедшего в состав Рекомендаций по стандартизации Р 1323565.1.004-2017 “Схемы выработки общего ключа с аутентификацией на основе открытого ключа”, утвержденных в 2017 году Росстандартом, но в дополнение к стандартизированным криптографическим решениям предполагает использование механизма изогений суперсингулярных эллиптических кривых, что делает возможным его использование даже при появлении эффективных квантовых вычислителей, способных решать задачи криптографического анализа. Протокол не требует использования цифровой подписи как отдельного примитива, позволяет двум участникам использовать различные наборы параметров для выработки и сертификации открытого ключа. В статье описывается протокол “Лимонница”, исследуются заложенные в его основу синтезные решения и криптографические требования, предъявляемые к протоколу при его разработке, изучаются вопросы криптографической стойкости. При условии применения предлагаемых в статье параметров и алгоритмов показана стойкость протокола относительно известных классов атак, в том числе задачи определения секретного ключа. Получено формальное доказательство стойкости протокола в модифицированной модели Канетти--Кравчика в предположении о вычислительной сложности аналога задачи Диффи--Хеллмана для случая изогений суперсингулярных эллиптических кривых. Таким образом, показано, что протокол “Лимонница” является гибким, стойким криптографическим решением, удовлетворяющим всем предъявляемым к современным протоколам выработки общего ключа требованиям.

show abstract

Section: Discussionmentioning

confidence: 99%

Limonnitsa: making Limonnik-3 post-quantum

Grebnev¹

2020

Матем. вопр. криптогр.

View full text Add to dashboard Cite

show abstract

“…In the next step, we extrapolate the model function to higher values of n and compare them to the values resulting from evaluating Equation (1) at the respective n-values. The results are visualized in Figure 2.…”

Section: Motivating Examplementioning

confidence: 99%

“…The two main ideas behind it are: (1) The enumeration algorithm we already considered demonstrates that the variable in the exponent may grow faster than linearly (quadratic in that case). ( 2) Previous work about the LLL lattice reduction algorithm 19 shows that the practical behavior of programs with polynomial runtime can be accurately modeled by polynomials with a real exponent,although the complexity class  for the underlying algorithm is given by integer exponents.…”

Section: Exponential Polynomial Modelsmentioning

confidence: 99%

“…Another possibility to improve the performance and to increase the stability is the function minbleicsetscale which sets the scaling of the variables. The scaling is set to [1,1] by default. This is not optimal since, in particular, in the case of exponential and factorial runtime behavior the difference in the size of the variables is several orders of magnitude.…”

Section: 21mentioning

confidence: 99%

See 1 more Smart Citation

SimAnMo—A parallelized runtime model generator

Burger

Nguyen

Bischof

2021

Concurrency and Computation

View full text Add to dashboard Cite

In this article, we present the novel features of the recent version of SimAnMo, the Simulated Annealing Modeler. The tool creates models that correlate the size of one input parameter of an application to the corresponding runtime and thus SimAnMo allows predictions for larger input sizes. A focus lies on applications whose runtime grows exponentially in the input parameter size. Such programs are, for example, of high interest for cryptanalysis to analyze practical security of traditional and post-quantum secure schemes. However, SimAnMo also generates reliable models for the widespread case of polynomial runtime behavior and also for the important case of factorial runtime increase. SimAnMo's model generation is based on a parallelized simulated annealing procedure and heuristically minimizes the costs of a model. Those may rely on different quality metrics. Insights into SimAnMo's software design and its usage are provided. We demonstrate the quality of SimAnMo's models for different algorithms from various application fields. We show that our approach also works well on ARM architectures.

show abstract

“…In this paper, we study quantum algorithms for the golden collision search problem. In the context of the NIST call, these algorithms can be applied in a generic key-recovery of the NIST candidate SIKE (non-commutative supersingular isogeny-based key encapsulation) [20,2,15]. They can also be used in some lattice attacks [3].…”

Section: Introductionmentioning

confidence: 99%

Low-Gate Quantum Golden Collision Finding

Jaques

Schrottenloher

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The golden collision problem asks us to nd a single, special collision among the outputs of a pseudorandom function. This generalizes meet-in-the-middle problems, and is thus applicable in many contexts, such as cryptanalysis of the NIST post-quantum candidate SIKE.The main quantum algorithms for this problem are memory-intensive, and the costs of quantum memory may be very high. The quantum circuit model implies a linear cost for random access, which annihilates the exponential advantage of the previous quantum collision-nding algorithms over Grover's algorithm or classical van Oorschot-Wiener.Assuming that quantum memory is costly to access but free to maintain, we provide new quantum algorithms for the golden collision problem with high memory requirements but low gate costs. Under the assumption of a two-dimensional connectivity layout, we provide better quantum parallelization methods for generic and golden collision nding. This lowers the quantum security of the golden collision and meet-in-the-middle problems, including SIKE.

show abstract

Improved Classical Cryptanalysis of SIKE in Practice

Cited by 20 publications

References 19 publications

Limonnitsa: making Limonnik-3 post-quantum

Limonnitsa: making Limonnik-3 post-quantum

SimAnMo—A parallelized runtime model generator

Low-Gate Quantum Golden Collision Finding

Contact Info

Product

Resources

About