Description
NIST’s post-quantum cryptography competition has entered in its second phase, the time has come to focus more closely on practical aspects of the candidates. On the lattice-based side, certain schemes chose to implement discrete Gaussian distributions which allow better parameters and security reductions. However, this advantage has also proved to be their Achilles’ heel, as discrete Gaussians pose serious challenges in terms of protection against timing attacks. In this talk, I will review the different timing weaknesses and present several constant-time techniques including a new approach to polynomially approximate transcendental functions (https://eprint.iacr.org/2019/511.pdf). I will emphasis on the application of these techniques on BLISS and FALCON signature schemes (https://tprest.github.io/pdf/pub/simple-fast-gaussian.pdf). We will see that the efficiency loss in the resulting implementations is reasonably low compared to the non constant-time.<br/> lien: http://desktop.visio.renater.fr/scopia?ID=729028***8178&autojoin
Next sessions
-
Encryption homomorphe sans bruit à l'aide de groupes
Speaker : Pierre Guillot - Ravel Technologies (dispo Université de Strasbourg, IRMA)
Je vais rappeler les travaux de Nuida et Ostrovski sur l'utilisation des groupes pour l'élaboration de schémas cryptographiques homomorphes. Je vais présenter nos travaux qui fournissent des encodages à la fois plus efficaces et plus généraux, et qui déterminent exactement quels groupes peuvent être utilisés. Puis je vais discuter GRAFHEN, un protocole qui utilise ces idées. Je dirai juste[…]-
Cryptography
-
-
MIKE: An efficient and compact NIKE Based on a Commutative Monoidal Action
Speaker : Jonathan Komada Eriksen - COSIC, KU Leuven
Robert recently described a powerful correspondence between certain (Hermitian) modules and (polarized) abelian varieties, which simultaneously generalizes both the class-group action underlying protocols such as CSIDH, and the Deuring correspondence, underlying protocols such as SQIsign. Using this correspondence, he also proposed how to construct a post-quantum NIKE, called MIKE, which, at a[…]-
Cryptography
-