A Simple Provably Secure AKE from the LWE Problem Source: Mathematical Problems in Engineering, Volume 2017, April 2017 Author: Limin Zhou, and Fengju Lv Speaker: Nguyen Ngoc Tu Date: 2017/10/5 Green: environmentally friendly

Introduction Key Exchange Protocol Alice Bob Intercept: Delete, modify, fabricate ; corrupt: clients

Introduction Key Exchange Protocol Diffie–Hellman key exchange Alice Bob D-H on finite field (or finite cyclic groups) Computational hardness assumption (discrete logarithm): Intercept: Delete, modify, fabricate ; corrupt: clients

Introduction Key Exchange Protocol Diffie–Hellman key exchange Alice Bob D-H on ECC Computational hardness assumption: Intercept: Delete, modify, fabricate ; corrupt: clients

Introduction Key Exchange Protocol Peter W. Shor (1997) Quantum computer can break the factorization problem the discrete logarithm problem in quantum polynomial time algorithms October 2015: Researchers at University of New South Wales built a Quantum logic gate in silicon for the first time May 2017: IBM announced that it has successfully built and tested its most powerful universal quantum computing processors with 16 qubit processor. Diffie–Hellman key exchange based on factorization discrete logarithm problems become insecure in next some years! Intercept: Delete, modify, fabricate ; corrupt: clients P.W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” SIAM Journal on Computing, vol. 26, no. 5, pp. 1484–1509, 1997. “World's First Silicon Quantum Logic Gate Brings Quantum Computing One Step Closer,” 2015 "IBM Builds Its Most Powerful Universal Quantum Computing Processors,“ 2017 https://www-03.ibm.com/press/us/en/pressrelease/52403.wss

Introduction (1) Lattice-based cryptography Key Exchange Protocol New candidates of mathematical problems (1) Lattice-based cryptography (2) Multivariate-based cryptography (3) Hash-based signatures (4) Code-based cryptography (5) Supersingular elliptic curves-based cryptography Intercept: Delete, modify, fabricate ; corrupt: clients

Outline Introduction Preliminaries Proposed scheme Conclusions

Preliminaries Lattice Let be a set of linearly independent vectors. The lattice generated by is the set of linear combinations of with coefficients in Fundamental domain Contribution

Preliminaries Example Contribution

Preliminaries Discrete Gaussian Distribution (center at 0, variance t) Sample the noise value Contribution

Preliminaries Learning with errors problem Input a secret vector Sample output Select a vector uniformly at random Select a random a noise Compute Problem: Contribution Given at most polynomial samples Find the secret vector It believes that the problem belong to NP-Hard class

Preliminaries Notations • • • • • Contribution

Proposed scheme Setup the prime number the dimension of the private vectors the Gaussian parameter the key derivation function 𝑠 𝐵 Contribution

Proposed scheme Setup Secrete key: Secrete key: Public key: Bob Alice Secrete key: Secrete key: Public key: Public key: Contribution

Proposed scheme Alice Bob Select Compute Contribution

Proposed scheme Alice Bob Select Compute Contribution

Proposed scheme Alice Bob Contribution with overwhelming probability

Performance comparison Security comparisons BR=Bellare and Rogaway model [5] H. Krawczyk, “HMQV: a high-performance secure Diffie-Hellman protocol (extended abstract),” in Advances in cryptology— CRYPTO 2005, vol. 3621 of Lecture Notes in Computer Science, pp. 546–566, Springer, Berlin, Germany, 2005. [7] B. LaMacchia, K. Lauter, and A. Mityagin, “Stronger security of authenticated key exchange,” in Provable Security, vol. 4784 of Lecture Notes in Computer Science, pp. 1–16, Springer, Berlin, Germany, 2007. [18] J. W. Bos, C. Costello, M. Naehrig, and D. Stebila, “Postquantum key exchange for the TLS protocol from the ring learning with errors problem,” in Proceedings of the 36th IEEE Symposium on Security and Privacy (SP ’15), pp. 553–570, San Jose, Calif, USA, May 2015. [26] A. Fujioka, K. Suzuki, K. Xagawa, and K. Yoneyama, “Practical and post-quantum authenticated key exchange from one-way secure key encapsulation mechanism,” in Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security (ASIA CCS ’13), pp. 83–94,ACM,May 2013. [27] A. Fujioka, K. Suzuki, K. Xagawa, and K. Yoneyama, “Strongly secure authenticated key exchange from factoring, codes, and lattices,” Designs, Codes and Cryptography, vol. 76, no. 3, pp. 469–504, 2015. [34] B. Ustaoglu, “Obtaining a secure and efficient key agreement protocol from (H)MQV and NAXOS,” Designs, Codes, and Cryptography, vol. 46, no. 3, pp. 329–342, 2008. AAKE:

Conclusions The security of the proposed AKE scheme solely bases on the LWE problem Provable security under the BR model Automated Validation of Internet Security Protocols and Applications.