arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2003.00578cs.CR
收藏

公钥加密的量子不可否认性

Quantum Indistinguishability for Public Key Encryption

Tommaso Gagliardoni, Juliane Krämer, Patrick Struck

摘要:

本文研究了公钥加密方案(PKE)的量子安全性。Boneh和Zhandry(2013年)为PKE和对称密钥加密(SKE)发起了这一研究领域,尽管仅限于经典的不可验证性阶段。Gagliardoni等人。(NIPPTO '16)通过为SKE给出第一个具有量子不可分割性阶段的定义,推进了量子安全的研究。另一方面,对于PKE,不存在具有量子不可否认性阶段的量子安全概念。我们的主要结果是一个新的量子安全概念(qIND-qCPA)的PKE与量子不可分割的阶段,关闭上述差距。我们展示了一个区别攻击对基于代码的计划和对LWE基于计划与某些参数。我们还表明,规范的混合PKE-SKE加密构造是qIND-qCPA-安全的,即使底层PKE方案本身并非如此。最后,我们分类量子抗PKE计划的基础上,我们的安全概念的适用性。我们的核心思想遵循Gagliardoni等人的方法。通过使用所谓的类型2运算符来加密挑战消息。乍一看,对于PKE来说,类型2运算符似乎不自然,因为构建它们的规范方式需要秘密和公钥。然而,我们确定了一类PKE计划-我们称之为可恢复的-并表明,对于这个类类型-2运营商只需要的公钥。此外,可恢复的方案允许实现类型2运营商,即使他们遭受解密失败,这在一般情况下阻碍了由类型2运营商规定的可逆性。我们的工作表明,许多现实世界中的量子抵抗PKE计划,包括大多数NIST PQC候选人和典型的混合建设,确实是可恢复的。

英文摘要:

In this work we study the quantum security of public key encryption schemes (PKE). Boneh and Zhandry (CRYPTO'13) initiated this research area for PKE and symmetric key encryption (SKE), albeit restricted to a classical indistinguishability phase. Gagliardoni et al. (CRYPTO'16) advanced the study of quantum security by giving, for SKE, the first definition with a quantum indistinguishability phase. For PKE, on the other hand, no notion of quantum security with a quantum indistinguishability phase exists. Our main result is a novel quantum security notion (qIND-qCPA) for PKE with a quantum indistinguishability phase, which closes the aforementioned gap. We show a distinguishing attack against code-based schemes and against LWE-based schemes with certain parameters. We also show that the canonical hybrid PKE-SKE encryption construction is qIND-qCPA-secure, even if the underlying PKE scheme by itself is not. Finally, we classify quantum-resistant PKE schemes based on the applicability of our security notion. Our core idea follows the approach of Gagliardoni et al. by using so-called type-2 operators for encrypting the challenge message. At first glance, type-2 operators appear unnatural for PKE, as the canonical way of building them requires both the secret and the public key. However, we identify a class of PKE schemes - which we call recoverable - and show that for this class type-2 operators require merely the public key. Moreover, recoverable schemes allow to realise type-2 operators even if they suffer from decryption failures, which in general thwarts the reversibility mandated by type-2 operators. Our work reveals that many real-world quantum-resistant PKE schemes, including most NIST PQC candidates and the canonical hybrid construction, are indeed recoverable.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑