Post Quantum Cryptography

Transitioning to a Quantum-Resistant Public Key Infrastructure unforgeability, non-separability
A Note on Hybrid Signature Schemes defines weak separability, strong separability, backwards/forwards compatibility, simultaneous verification, hybrid generality

RFC 9180 - Hybrid Public Key Encryption ❗!important
An Analysis of Hybrid Public Key Encryption

Algorithms

Post-Quantum Cryptography | CSRC

Lattice-based cryptography - Wikiwand
Multivariate cryptography - Wikiwand
Hash-based cryptography - Wikiwand
Code-based cryptography
Isogeny-based cryptography
Symmetric key quantum resistance

CRYSTALS hard problems over module lattices, learning with errors (LWE)

Standardized Algorithms

Federal Register :: Announcing Issuance of Federal Information Processing Standards (FIPS) FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, FIPS 204, Module-Lattice-Based Digital Signature Standard, and FIPS 205, Stateless Hash-Based Digital Signature Standard comments for the standards

Post-Quantum signatures zoo

FIPS 203: ML-KEM

FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard
hard problems over module lattices, LWE
originally Kyber
pqcrystals-kyber library is also replaced by ml-kem
almost drop in replacement for ECDH
ECDH is a NIKE (Non-Interactive Key Exchange) whereas ML-KEM is a KEM

what is Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM) - Phind
In-Depth Overview of FIPS 203: The Module-Lattice-Based Key-Encapsulation Mechanism Standard | Encryption Consulting
An Overview about FIPS 203: Module-Lattice-based Key-Encapsulation-Mechanism - HackMD

FIPS 204: ML-DSA

FIPS 204 Module-Lattice-Based Digital Signature Standard
hard problems over module lattices, LWE
originally Dilithium
pqcrystals-dilithium library is also replaced by ml-dsa
almost drop-in replacement for RSA and ECDSA
outperforms SLH-DSA in both signature generation and validation time, as well as in signature size

what is Module-Lattice-Based Digital Signature Standard (ML-DSA) - Phind
In-Depth Overview of FIPS 204: Module-Lattice-Based Digital Signature Standard

HashML-DSA considered harmful – Key Material
Address external mu and PH modes · Issue #131 · lamps-wg/draft-composite-sigs
Don't use a prehashed version of ML-DSA · Issue #54 · chipsalliance/adams-bridge

FIPS 205: SLH-DSA

FIPS 205 Stateless Hash-Based Digital Signature Standard
stateless signature, hash-based
originally SPHINCS+
has limit on the max number of signatures per signing key (e.g. 2^64)
smaller key sizes, strong cryptographic assurances
long-lived TLS sessions

what is Stateless Hash-Based Digital Signature Standard (SLH-DSA) - Phind
In-Depth Overview of FIPS 205: Stateless Hash-Based Digital Signature Standard
On Protecting SPHINCS+ Against Fault Attacks | IACR Transactions on Cryptographic Hardware and Embedded Systems
draft-ietf-lamps-cms-sphincs-plus-19 overview of SLH-DSA

FIPS 205: FN-DSA (not final)

FFT (Fast-Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm
stateless signature, NTRU lattice, requires floating point when signing
originally Falcon
https://csrc.nist.gov/csrc/media/Presentations/2024/falcon/images-media/prest-falcon-pqc2024.pdf

Stateful Signature

state is considered a part of private key
RFC 8391 - XMSS: eXtended Merkle Signature Scheme hash-based signatures
XMSS/xmss-reference: Repository for the XMSS reference code, accompanying RFC 8391, XMSS: eXtended Merkle Signature Scheme
RFC 8554 - Leighton-Micali Hash-Based Signatures LMS, hash-based signatures
cisco/hash-sigs: A full-featured implementation of of the LMS and HSS Hash Based Signature Schemes from draft-mcgrew-hash-sigs-07.

Research

Public Key Encryption + Key encapsulation mechanism
BIKE - Bit Flipping Key Encapsulation QC-MDPC (Quasi-Cyclic Moderate Density Parity-Check)
Classic McEliece: Intro binary Goppa codes, very large (268kB) public key, very small ciphertexts (128 bytes)
NTS-KEM merged with Classic McEliece
FrodoKEM LWE
HQC Syndrome decoding of structure codes (Hamming Quasi-Cyclic)
NTRU Prime: Intro NTRU lattice
SIKE – Supersingular Isogeny Key Encapsulation isogeny-based, 💀pawned do not use

Stateless Signature
CROSS crypto random linear code
MAYO structured multivariable quadratic equations, balanced signature (321/180 bytes) and public key (1.1/5.4kB) sizes
Hawk NTRU lattice
PQCRainbow structured multivariable quadratic equations, 💀pawned do not use

BIKE - Bit Flipping Key Encapsulation
awslabs/bike-kem: Additional implementation of BIKE (Bit Flipping Key Encapsulation)
Bit Flipping Key Encapsulation for the Post-Quantum Era | IEEE Journals & Magazine | IEEE Xplore

draft-wiggers-hbs-state-02