Key Encapsulation Scheme Research Articles

Analysis of DSTU 8961:2019 in the quantum random oracle model

Modern cryptographic transformations require provable security against a relatively wide class of threats. Typically, such evidentiary security is achieved through formal analysis within the chosen security model. The development of quantum computers led to the emergence of new attack vectors to which classical cryptography was vulnerable. However, there are cryptographic systems that are considered resistant to quantum attacks and some of them are even standardized. The formal analysis of such systems has faced difficulties for a long time, which were associated with the impossibility of applying classical methods of proof to formal models that take into account quantum effects. However, in recent years, many new results have appeared that allow obtaining formal security proofs for quite complex cryptographic transformations, and most of the existing post-quantum asymmetric encryption and key encapsulation schemes currently have corresponding formal proofs within the quantum random oracle model, the most widespread security model for of post-quantum cryptography. DSTU 8961:2019 is the Ukrainian post-quantum standard for asymmetric encryption and key encapsulation. However, security proofs in the quantum random oracle model have not yet been published for it. As part of this work, security evidence was obtained for the design of the key encapsulation mechanism described in DSTU 8961:209. The obtained result is generalized for an arbitrary asymmetric encryption scheme, which may contain decryption errors and can be used to assess the security of not only DSTU 8961:2019, but also other similar asymmetric transformations.

PHY-PSIONICS: Physical-Layer Phase Secret Key Encapsulation in Correlated Subchannels

In this letter, we propose a physical-layer (PHY) phase secret key encapsulation in correlated subchannels, PHY-PSIONICS. Based on the PHY phase challenge-response authentication scheme (PHY-PCRAS), conventional PHY authentication approaches generally exploit the channel phase’s reciprocity to encapsulate the secret key. However, for typical multi-carrier systems, correlations between neighboring subcarriers could cause these schemes to lose credibility. Therefore, we propose a novel key encapsulation scheme to allow PHY phase-based authentication in practical multi-carrier systems. The shared secret key is efficiently encapsulated by the binning-based multi-bit alphabet phase fingerprinting. We constructed a testbed with several universal software radio peripherals for verification to evaluate the authentication performance experimentally in an indoor environment containing correlated subchannels. The numerical findings demonstrate that the proposed scheme is strong against eavesdropping and replay attacks, even under subchannel correlations.

Leakage-Resilient Anonymous Multi-Receiver Certificate-Based Key Encapsulation Scheme

Leakage-Resilient Anonymous Multi-Receiver Certificate-Based Key Encapsulation Scheme

Time-Memory Trade-Offs for Saber+ on Memory-Constrained RISC-V Platform

Saber is a module-lattice-based key encapsulation scheme that has been selected as a finalist in the NIST Post-Quantum Cryptography standardization project. As Saber computes on considerably large matrices and vectors of polynomials, its efficient implementation on memory-constrained IoT devices is very challenging. In this paper, we present an implementation of Saber with a minor tweak to the original Saber protocol for achieving reduced memory consumption and better performance. We call this tweaked implementation ‘Saber+’, and the difference compared to Saber is that we use different generation methods of public matrix <inline-formula><tex-math notation="LaTeX">$\boldsymbol{A}$</tex-math></inline-formula> and secret vector <inline-formula><tex-math notation="LaTeX">$\boldsymbol{s}$</tex-math></inline-formula> for memory optimization. Our highly optimized software implementation of Saber+ on a memory-constrained RISC-V platform achieves 48% performance improvement compared with the best state-of-the-art memory-optimized implementation of original Saber. Specifically, we present various memory and performance optimizations for Saber+ on a memory-constrained RISC-V microcontroller, with merely 16KB of memory available. We utilize the Number Theoretic Transform (NTT) to speed up the polynomial multiplication in Saber+. For optimizing cycle counts and memory consumption during NTT, we carefully compare the efficiency of the complete and incomplete-NTTs, with platform-specific optimization. We implement 4-layers merging in the complete-NTT and 3-layers merging in the 6-layer incomplete-NTT. An improved on-the-fly generation strategy of the public matrix and secret vector in Saber+ results in low memory footprint. Furthermore, by combining different optimization strategies, various time-memory trade-offs are explored. Our software implementation for Saber+ on selected RISC-V core takes just 3,809K, 3,594K, and 3,193K clock cycles for key generation, encapsulation, and decapsulation, respectively, while consuming only 4.8KB of stack at most.

Lattice-based Key-sharing Schemes

Public-key cryptography is an indispensable component used in almost all of our present-day digital infrastructure. However, most if not all of it is predominantly built upon hardness guarantees of number theoretic problems that can be broken by large-scale quantum computers in the future. Sensing the imminent threat from continued advances in quantum computing, NIST has recently initiated a global-level standardization process for quantum resistant public-key cryptographic primitives such as public-key encryption, digital signatures, and key encapsulation mechanisms. While the process received proposals from various categories of post-quantum cryptography, lattice-based cryptography features most prominently among all the submissions. Lattice-based cryptography offers a very attractive alternative to traditional public-key cryptography mainly due to the variety of lattice-based schemes offering varying flavors of security and efficiency guarantees. In this article, we survey the evolution of lattice-based key-sharing schemes (public-key encryption and key encapsulation schemes) and cover various aspects ranging from theoretical security guarantees, general algorithmic frameworks, practical implementation aspects, and physical attack security, with special focus on lattice-based key-sharing schemes competing in the NIST’s standardization process.

Compact Dilithium Implementations on Cortex-M3 and Cortex-M4

We present implementations of the lattice-based digital signature scheme Dilithium for ARM Cortex-M3 and ARM Cortex-M4. Dilithium is one of the three signature finalists of the NIST post-quantum cryptography competition. As our Cortex-M4 target, we use the popular STM32F407-DISCOVERY development board. Compared to the previous speed records on the Cortex-M4 by Ravi, Gupta, Chattopadhyay, and Bhasin we speed up the key operations NTT and NTT−1 by 20% which together with other optimizations results in speedups of 7%, 15%, and 9% for Dilithium3 key generation, signing, and verification respectively. We also present the first constant-time Dilithium implementation on the Cortex-M3 and use the Arduino Due for benchmarks. For Dilithium3, we achieve on average 2 562 kilocycles for key generation, 10 667 kilocycles for signing, and 2 321 kilocycles for verification.Additionally, we present stack consumption optimizations applying to both our Cortex- M3 and Cortex-M4 implementation. Due to the iterative nature of the Dilithium signing algorithm, there is no optimal way to achieve the best speed and lowest stack consumption at the same time. We present three different strategies for the signing procedure which allow trading more stack and flash memory for faster speed or viceversa. Our implementation of Dilithium3 with the smallest memory footprint uses less than 12kB. As an additional output of this work, we present the first Cortex-M3 implementations of the key-encapsulation schemes NewHope and Kyber.

Certificate-Based Encryption Resilient to Continual Leakage in the Standard Model

The security for many certificate-based encryption schemes was considered under the ideal condition, where the attackers rarely have the secret state for the solutions. However, with a side-channel attack, attackers can obtain partial secret values of the schemes. In order to make the scheme more practical, the security model for the certificate-based encryption which is resilient to continual leakage is first formalized. The attackers in the security model are permitted to get some secret information continuously through the side-channel attack. Based on the certificate-based key encapsulation scheme, a novel certificate-based encryption scheme is proposed, which is resilient to the continual leakage. In the standard model, the new scheme we propose is proved to be secure under the decisional truncated q-augmented bilinear Diffie–Hellman exponent hard problem and the decisional 1-bilinear Diffie–Hellman inversion hard problem. Additionally, the new scheme can resist the chosen-ciphertext attack. Moreover, a comparison is performed with other related schemes, where the proposed solution further considers the continual leakage-resilient property and exhibits less computation cost.

ISA Extensions for Finite Field Arithmetic

We present and evaluate a custom extension to the RISC-V instruction set for finite field arithmetic. The result serves as a very compact approach to software-hardware co-design of PQC implementations in the context of small embedded processors such as smartcards. The extension provides instructions that implement finite field operations with subsequent reduction of the result. As small finite fields are used in various PQC schemes, such instructions can provide a considerable speedup for an otherwise software-based implementation. Furthermore, we create a prototype implementation of the presented instructions for the extendable VexRiscv core, integrate the result into a chip design, and evaluate the design on two different FPGA platforms. The effectiveness of the extension is evaluated by using the instructions to optimize the Kyber and NewHope key-encapsulation schemes. To that end, we also present an optimized software implementation for the standard RISC-V instruction set for the polynomial arithmetic underlying those schemes, which serves as basis for comparison. Both variants are tuned on an assembler level to optimally use the processor pipelines of contemporary RISC-V CPUs. The result shows a speedup for the polynomial arithmetic of up to 85% over the basic software implementation. Using the custom instructions drastically reduces the code and data size of the implementation without introducing runtime-performance penalties at a small cost in circuit size. When used in the selected schemes, the custom instructions can be used to replace a full general purpose multiplier to achieve very compact implementations.

Leakage-Resilient Certificate-based Key Encapsulation Scheme Resistant to Continual Leakage

In the past, the security of most public-key encryption or key encapsulation schemes is shown in an ideal model, where private keys, secret keys and random values are assumed to be absolutely secure to adversaries. However, this ideal model is not practical due to side-channel attacks in the sense that adversaries could gain partial information of these secret values involved in decryption operations by perceiving energy consumption or execution timing. In such a case, these schemes under the ideal model could suffer from side-channel attacks. Recently, leakage-resilient cryptography resistant to side-channel attacks is an emerging research topic. Certificate-based encryption (CBE) or certificate-based key encapsulation (CB-KE) schemes are a class of important public-key encryption. However, little work addresses the design of leakage-resilient CBE (LR-CBE) or leakage-resilient CB-KE (LR-CB-KE) schemes. In this paper, we present the first LR-CB-KE scheme with overall unbounded leakage property which permits adversaries to continuously gain partial information of the system secret key of a trusted certificate authority (CA), the private keys and certificates of users, and random values. In the generic bilinear group model, formal security analysis is made to prove that the proposed LR-CB-KE scheme is secure against chosen ciphertext attacks.

FDCO: attribute-based fast data cloud-outsourcing scheme for mobile devices

We propose an attribute-based fast data cloud-outsourcing (FDCO) scheme, which shows great performance in mobile devices. Technically, this work is a CCA-secure online/offline key encapsulation scheme based on ciphertext-policy attribute-based encryption with public validity test and indirect user revocation mechanism. We adapt it to a mobile cloud-outsourcing scenario and present a concrete system. Our scheme is equipped with the following desirable properties: First, encapsulation needs only several lightweight online modular addition/multiplication operations, which is appealing to mobile users. Second, it is equipped with an efficient indirect user revocation mechanism to support access credential revocation. Third, it supports public encapsulation validity test, which enables auditors to filter invalid data, so as to prevent attackers from sending invalid data to stuff users’ accounts. Finally, we prove its security against chosen-ciphertext attacks (CCA) in the standard model. We conduct theoretical analyses and extensive experiments to show that our scheme is practical and efficient in application.

NTTRU: Truly Fast NTRU Using NTT

We present NTTRU – an IND-CCA2 secure NTRU-based key encapsulation scheme that uses the number theoretic transform (NTT) over the cyclotomic ring Z7681[X]/(X768−X384+1) and produces public keys and ciphertexts of approximately 1.25 KB at the 128-bit security level. The number of cycles on a Skylake CPU of our constant-time AVX2 implementation of the scheme for key generation, encapsulation and decapsulation is approximately 6.4K, 6.1K, and 7.9K, which is more than 30X, 5X, and 8X faster than these respective procedures in the NTRU schemes that were submitted to the NIST post-quantum standardization process. These running times are also, by a large margin, smaller than those for all the other schemes in the NIST process as well as the KEMs based on elliptic curve Diffie-Hellman. We additionally give a simple transformation that allows one to provably deal with small decryption errors in OW-CPA encryption schemes (such as NTRU) when using them to construct an IND-CCA2 key encapsulation.

NIST PQC: Code-Based Cryptosystems

The code-based schemes, which were submitted to the contest of post-quantum crypto algorithms NIST PQC, are studied in this work. The general characteristics of the algorithms are explored and basic properties and parameters are estimated. A comparative analysis of the electronic digital signature schemes, public-key cryptosystems and key encapsulation schemes are carried out according to the criteria of speed and length of the main cryptographic parameters.

Saber on ARM

The CCA-secure lattice-based post-quantum key encapsulation scheme Saber is a candidate in the NIST’s post-quantum cryptography standardization process. In this paper, we study the implementation aspects of Saber in resourceconstrained microcontrollers from the ARM Cortex-M series which are very popular for realizing IoT applications. In this work, we carefully optimize various parts of Saber for speed and memory. We exploit digital signal processing instructions and efficient memory access for a fast implementation of polynomial multiplication. We also use memory efficient Karatsuba and just-in-time strategy for generating the public matrix of the module lattice to reduce the memory footprint. We also show that our optimizations can be combined with each other seamlessly to provide various speed-memory trade-offs. Our speed optimized software takes just 1,147K, 1,444K, and 1,543K clock cycles on a Cortex-M4 platform for key generation, encapsulation and decapsulation respectively. Our memory efficient software takes 4,786K, 6,328K, and 7,509K clock cycles on an ultra resource-constrained Cortex-M0 platform for key generation, encapsulation, and decapsulation respectively while consuming only 6.2 KB of memory at most. These results show that lattice-based key encapsulation schemes are perfectly practical for securing IoT devices from quantum computing attacks.

Analysis and comparative studies of code-based key encapsulation mechanisms submitted to the NIST PQC competition

The error correcting code-based key encapsulation mechanisms, presented to the NIST PQC competition, are investigated. The results of the primary comparative analysis of the cryptographic properties and the performance indicators of the key encapsulation schemes are presented.

Generic Fully Simulatable Adaptive Oblivious Transfer

We aim at constructing adaptive oblivious transfer protocols, enjoying fully simulatable security, from various well-known assumptions such as DDH, d-Linear, QR, and DCR. To this end, we present two generic constructions of adaptive OT, one of which utilizes verifiable shuffles together with threshold decryption schemes, while the other uses permutation networks together with what we call loosely-homomorphic key encapsulation schemes. The constructions follow a novel designing approach called “blind permutation”, which completely differs from existing ones. We then show that specific choices of the building blocks lead to concrete adaptive OT protocols with fully simulatable security in the standard model under the targeted assumptions. Our generic methods can be extended to build universally composable (UC) secure OT protocols, with a loss in efficiency.

Weak leakage resilient extractable hash proof system and construction for weak leakage resilient CCA-secure public-key encryption

Public-key encryption can be used in cloud systems to protect data in data sharing, identity authentication, etc. However, traditional public-key encryption does not capture the side-channel attacks. Inspired by this, the model of key-leakage attacks is formalised. However, constructing schemes in this model seems somewhat difficult and most key-leakage attacks in reality may be weak. In this paper, we consider the model of weak key-leakage attacks and focus on how to construct a weak leakage-resilient CCA-secure key encapsulation scheme. To this end, we present the new definitions of weak leakage-resilient extractable hash proofs and weak leakage-resilient partial ABO-extractable hash proofs and propose generic transformations to construct them from extractable hash proof. Then we show how to derive a weak leakage-resilient CCA-secure key encapsulation scheme based on them. We also give a concrete instantiation in a group of prime order and design an experiment to show the leakage-resilience in reality.

Efficient identity‐based key encapsulation scheme with wildcards for email systems

SUMMARYIdentity‐based key encapsulation scheme with wildcards (WIB‐KEM) is very useful in email systems for confidential communication, as it enables the effective encryption of email to a range of users simultaneously whose identities match a certain pattern. In this paper, I propose a WIB‐KEM scheme achieving simultaneously high efficiency and security level. Our scheme achieves the low computational cost because during the decryption phase the bilinear pairing operation of decryption is constant. Moreover, the private key size shrinks as the identity depth increases. I further prove its adaptive chosen ciphertext security under decisional bilinear Diffie–Hellman assumption in standard model. The scheme not only can meet security demands but is also efficient in terms of computation and communication. Our scheme is tested on a modern station, and the experimental results demonstrate its suitability for large‐scale email systems. Copyright © 2013 John Wiley &amp; Sons, Ltd.