Custom services
English (pdf)
Article in xml format
Article references
Send this article by e-mail
Cited by SciELO 
Similars in
SciELO 
Permalink
Introduction
Quantum computing is an emerging field that uses the concepts of quantum mechanics to perform computations (Sigov et al., 2022). It is an intersection of fields such as mathematics, physics and computer science. The starting point for quantum computers can be traced back to the 1980s when physicists asked whether a universal device can simulate quantum mechanical systems (Feynman et al., 1982). In recent years, quantum computing has become attractive as a research topic due to the acceleration of technology (Hidary, 2021; Ho- ta and Dash, 2022; Gill et al., 2022). Recently, Google claimed having achieved Quantum Supremacy using a processor with programmable superconducting qubits to create quantum states on 53 qubits (Arute et al., 2019). As of the year 2020, organizations have built quantum computers with up to 50 qubits and are increasing it up to 100 qubits. Large companies such as Google, IBM and Microsoft and startups such as Rigetti, D-Wave and Xanadu have built quantum computers.
Cryptography is one of fundamental technologies for keeping the information society secure. In particular, public key cryptography has been used in cryptographic protocols such as SSL/TLS, IPSec, SSH, copyright protection of DVD, and so on. The most widely used public-key cryptosystems are the RSA cryptosystem (Rivest et al., 1978) and elliptic curve cryptosystem (Miller, 1985; Koblitz, 1987). The security of these
cryptosystems is based on the mathematical difficulty of the integer factorization problem (IFP) and discrete logarithm problem (DLP) (Abuarqoub et al., 2021; Scho¨ffel et al., 2022).
While the security of the aforementioned schemes cannot be practically challenged by conventional computer systems, this would not be the case in a post-quantum world where a large scale quantum computer has become a reality (Mosca, 2018). In 1994 Shor proposed a quantum polynomial time algorithm for solving the IFP and DLP in Abelian groups (Shor, 1994), and thus put in question the security of public-key cryptography. Since then, the research on post-quantum cryptography, also known as quantum-resistant cryptography, has progressed (Bernstein et al., 2009; Buchmann et al., 2016; Bernstein and Lange, 2017). The goal of post-quantum cryptography is to develop cryptographic systems that are secure against both quantum and conventional computers and can interoperate with existing communication protocols and networks (Das and Sadhu, 2022; Sajimon et al., 2022; Joseph et al., 2022; Hekkala et al., 2022; Do¨ring and Geitz, 2022; Tandel and Nasrıwala, 2022).
In August 2015 the U.S. National Security Agency (NSA) announced a transition to quantum-resistant algorithms (Koblitz and Menezes, 2016) and in 2016, the U.S. National Institute of Standards and Technology (NIST) published a standardization plan for post-quantum cryptography (Chen et al., 2016). In January 2018, NIST published the results of the first round. In total 82 algorithms were proposed from which 59 are encryption or key exchange schemes and 23 are signature schemes. After 3 to 5 years of analysis NIST will report the findings and prepare a draft of standards. At the moment of this writing, NIST’s evaluation process has moved to the final round (Alagic et al., 2020). In May 2018, the China Association for Science and Techno- logy (CAST) has released a report on the 60 major science and technology problems in twelve research fields, which considers the design of quantum-resistant cryptographic algorithms as one of the six major problems in the field of information technology.
Post-quantum cryptography is usually constructed by using mathematical problems which can be proven to be NP-hard (Bennett et al., 1997). However, for post-quantum cryptography to be practical, we need to evaluate the explicit sizes of the secure parameters used in the applications. The candidates of post-quantum cryptography include lattice-based cryptosystems (Ajtai, 1996; Gebremichael et al., 2022), code-based cryptosystems (McEliece, 1978; Fiallo, 2021; Esser et al., 2022), multivariate polynomial cryptosystems (Matsumoto and Imai, 1988; Hashimoto, 2021) and hash-based signatures (Merkle, 1989; Zeydan et al., 2022).
This paper gives an overview of the current state of the art of the alternative public-key schemes that have the capability to resist quantum computer attacks and consider their main characteristics.
Mathematical foundations of quantum computing
The basic idea behind a quantum computer is to replace binary digits with quantum bits, or qubits for short. As opposed to binary bits, qubits can exist in additional states in between the two binary states. This is defined as a superposition of the digital states (Wang, 2012). In other words, the state of a qubit can be described by a two-dimensional state space in C2 with orthonormal basis vectors |0⟩ and |1⟩ (which well known as Dirac notation):
α|0⟩ + β |1⟩
where α and β are the probability amplitudes for the states 0 and 1 respectively and must satisfy the constraints
|α| + |β | = 1
ensuring a collected probability of 1. The fact that a quantum computer can contain numerous such states concurrently, ensures its potential dominance over traditional computers. Like classical computers, quantum computers use quantum registers made up of multiple qubits. Quantum registers are a relatively straightfor- ward extension of quantum bits. A register of n qubits is a superposition of all 2 n possible bit strings that could be represented using n bits. The state space of a size-n quantum register is a linear combination of n basis vectors, each of length 2 n :
2n 1∑i=0α i |i⟩
Here i is the base-10 integer representation of a length-n number in base-2 and the the squares of the absolute values of the amplitudes of all 2 n possible bit configurations of an n-bit register sum to unity:
2n−1∑i=0|α i |
In classical computing, one way of thinking about algorithm design and computation is via universal Turing machines. Quantum universal Turing machines were first described by David Deutsch in 1985 (Deutsch, 1985) and operations on a quantum computer are most often described using quantum circuits made up of qubits and quantum logic gates, a concept also introduced by Deutsch a few years after his specification of the quantum analog to a Turing machine (Deutsch, 1989). Mathematically, classical logic gates are described using boolean algebra and quantum logic gates act in a similar way, in that quantum logic gates applied to quantum registers map the quantum superposition to another, together allowing the evolution of the system to some desired final state, a correct answer.
Despite the inherent superiority of a quantum computer, there are many challenges in quantum computing. Quantum algorithms are mainly probabilistic. This means that in one operation a quantum computer returns many solutions where only one is the correct, weakens the advantage of quantum computing speed. Qubits are susceptible to errors. Qubits suffer from bit-flips as well as phase errors. Direct inspection for errors should be avoided as it will cause the value to collapse, leaving its superposition state. Another challenge is the difficulty of coherence. Qubits can retain their quantum state for a short period of time (Muhonen et al., 2014). In 2017, IBM introduced the definition of Quantum Volume: a metric to measure how powerful a quantum computer is based on how many qubits it has, how good is the error correction on these qubits, and the number of operations that can be done in parallel. Increase in the number of qubit does not improve a quantum computer if the error rate is high. However, improving the error rate would result in a more powerful quantum computer (Jurcevic et al., 2021).
Some important quantum algorithms
Shor’s algorithm
As mentioned in the introduction, the most important quantum algorithm for cryptography is Shor’s algorithm (Shor, 1994). This algorithm uses quantum computers to efficiently solve two hard problems: IFP and DLP in Abelian groups. The idea behind Shor’s algorithm is to compare the phases of prime numbers as sinus waves to factorise great integers. Peter Shor himself explained how this works, by comparing it to shining lights onto a diffraction grating to get a pattern. Using number theory, the problem of number factorisation can be converted into a search for the period of a really long sequence, or rather, the length at which a sequence repeats itself. Then, just as with light diffraction, this periodic pattern is run through a quantum computer which functions as a computational interferometer, creating an interference pattern. This will output the period, which can be processed using a classical computer, to factorise the number.
The reason why this works is that instead of finding a number, we are aiming towards finding a period, which is a global property rather than a singular point. While this is by no means easier if we were to use a traditional computer, a quantum computer can solve this efficiently. By using the qubits, we can create an extensive superposition across factors from the period, which can be obtained using a traditional computer. To do this, we must find a nontrivial factor of the number which is to be factorised. This factor is then used in the calculations which are done on the quantum computer. While quantum physics is no easy thing, the most essential part of these calculations is the quantum Fourier transform (QFT). The QFT maps two vectors of complex numbers to each other, effectively mapping a periodic sequence to its period.
The classical and quantum complexities for finding the order of a random element in Z∗ n are summarized below:
Quantum complexity is in O (log n)2 loglog(n) logloglog(n) .
Best-known rigorous probabilistic classical algorithm has complexity in e
O
(√log n loglog n).
Best-known heuristic1 probabilistic classical algorithm has complexity in e
O
√3 log n √3 (loglog n)2 .
Vazirani explored in detail the methodology of Shor’s algorithm and showed how it can be used to solve DLP’s (Vazirani, 1998). Starting from a random superposition state of two integers, and by performing a series of Fourier transformations, a new superposition can be set-up to give us with high probability two integers that satisfy an equation. By using this equation we can calculate the value r which is the unknown exponent in the DLP.
The classical and quantum complexities for finding discrete logarithms problem in F∗ q are summarized below:
Quantum complexity is in O (log q)2 loglog(q) logloglog(q) .
Best-known rigorous probabilistic classical algorithm has complexity in e
O
(√log q loglog q).
Best-known heuristic probabilistic classical algorithm has complexity in e
O
√3 log q √3 (loglog q)2 .
Other quantum algorithms
There are other important quantum algorithms that also directly impact in cryptography but with a much less devastating effect than Shor’s algorithm. While the best classical algorithm for a search over unordered data has complexity O(n), Grover’s algorithm (Grover, 1996) performs the search on a quantum computer in only O(√n) operations, a quadratic speedup. It works by replacing the qubits in a superposition of all possible states using Hadamard gates, and then enhancing the probability of the sought element. Grover’s algorithm increases the speed at which it is possible to do a brute-force search for cryptographic keys (Grassl et al., 2016; Jang et al., 2020; Jaques et al., 2020). This affects all cryptographic algorithms, but a suficient counter-measure is to double the key-size.
The collision problem models collision-resistant hash functions in cryptography (Mittelbach and Fischlin, 2021). When building secure digital signature schemes, it is useful to have a family of hash functions {H i }, such that finding a distinct (x, y) pair with H i (x) = H i (y) is computationally intractable. The best known upper bound on the number of queries needed by a quantum computer to solve this problem with bounded error
probability is O (√3 n) (Brassard et al., 1997). This means that it is necessary to at least triple the length of the
outputs of the hash functions to reach the current levels of security.
Post-quantum schemes
We now review the algorithmic hardness assumptions that are currently being used as the security basis of post-quantum public-key cryptography and we consider the main post-quantum schemes.
Lattice-based schemes
From the mathematical point of view, historically lattices have been studied since the 18th century by mat- hematicians such as Lagrange and Gauss. However, the interest in cryptography starts more recently with Ajtai’s work, that proves the existence of one-way functions based on the hardness of the shortest vector problem (SVP). Ajtai showed how to construct provable secure hash functions based on hard lattice problems.
Definition 1: Let R m be a m-Dimensional Euclidean Vector Space, and B = {b 1 , . . . , b n } be a set of n linearly independent vectors, the lattice L in R m is the additive subgroup, that consists of all linear combinations of B with integer coefficients, in other words:
nL (b 1 , . . . , b n ) = ∑ x i b i : x i Z
i=1
where the vectors b 1 , . . . , b n are the called basis vector of L and the set B is called lattice basis.
The most important computational problem in lattices is the shortest vector problem (SVP). This problem is known to be NP-hard under random reduction (Ajtai, 1996) and it is defined as follows.
Definition 2 (SVP): Given the lattice L (B), one has to find a nonzero vector with minimum norm, typically in the Euclidean norm.
The following problems are also important for cryptographic purposes:
closest vector problem (CVP): Given the lattice L (B) and a vector t ∈ R
m
, the goal is to find the vector
v ∈ L (B) closest to t.
shortest independent vector problem (SIVP): Given basis B ∈ Z
m×n
, we must find n linearly independent lattice vectors (v
1
, . . . , v
n
), such that maximum norm among these vectors is minimum.
The versatility and flexibility of lattice based cryptography, in terms of possible cryptographic features and simplicity of the basic operations, make it one of the most promising lines of research in cryptography. Mo- reover, some lattice schemes are supported by security demonstrations that rely on the worst-case hardness of certain problems.
In 1997, Ajtai and Dwork proposed the first public-key cryptosystem from lattices, whose average-case secu- rity is based on the worst-case of the unique shortest vector problem (SVP) (Ajtai and Dwork, 1997). They claimed that their cryptosystem is provably secure, but in 1998, Nguyen and Ster refuted it (Nguyen and Stern, 1998). Furthermore, the AD public key is big and it causes message expansion making it an unrealistic public key candidate in post-quantum era.
The Goldreich-Goldwasser-Halevi (GGH) was published in 1997 (Goldreich et al., 1997). GGH makes use of the closest vector problem (CVP). Despite the fact that GGH is more efficient than Ajtai-Dwork (AD), in 1999, Nguyen proved that GGH has a major flaw; partial information on plaintexts can be recovered by solving CVP instances (Nguyen, 1999).
NTRU was published in 1998 (Hoffstein et al., 1998). It was originally constructed over polynomial rings but can also be defined over lattices, because the underlying problem can be interpreted as being SVP and CVP.
NTRU relies on the difficulty of factorizing certain polynomials making it resistant against Shor’s algorithm. It is used for both encryption (NTRUEncrypt) and digital signature (NTRUSign) schemes. To provide 128-bit post-quantum security level NTRU demands 12 881-bit keys (Hirschhorn et al., 2009). A result reduces the security of NTRU-based cryptosystems to the worst-case problem over ideal lattices (Stehle´ and Steinfeld, 2011). In 2013, Damien Stehle and Ron Steinfeld developed a provably secure version of NTRU (SS-NTRU) (Stehle and Steinfeld, 2013). In May 2016 a new version of NTRU called NTRU Prime was released (Bernstein et al., 2016). NTRU Prime countermeasures the weaknesses of several lattice based cryptosystems, including NTRU, by using different more secure ring structures.
Code-based schemes
Another class of hard algorithmic problems that is used as a basis of postquantum public-key cryptography comes from coding theory. Let k ≤ n be positive integers and let F q be a finite field. The Hamming weight w(u) of a vector u ∈ F n is the number of nonzero components of u. The Hamming distance between two vectors u and v in F n is w(u − v).
Definition 3: A [n, k] binary linear code C of length n and dimension k is a k-dimensional subspace of F n , which can be represented by two matrices; a k × n generator matrix G, such that C = {mG, m ∈ F k } or by a
(n − k) × n parity check matrix H, such that C = {c ∈ F n , Hc T = 0}, where c ∈ C .
Several computational problems involving codes are intractable. The following problems are important for code-based cryptography. The general decoding problem (GDP) is defined as follows.
Definition 4 (GDP): Let F q be a finite field, and let (G, t, c) be a triple consisting of a matrix G ∈ F k×n , an integer t < n, and a vector c ∈ F n . The question if there is a vector m ∈ F k such that e = c − mG has Hamming
q q
weight w(e) ≤ t.
The search problem associated with the GDP is to calculate the vector m given the word with errors c, known as the syndrome decoding problem (SDP).
(n−k)×n
Definition 5 (SDP): Let F q be a finite field, and let (H, t, s) be a triple consisting of an H ∈ F, an integer t < n, and a vector sF (n−k) . The question is whether there is a vector e ∈ F n with Hamming weight ofq w(e) ≤ t such that He T = s T .
Both the GDP and the SDP for linear codes are NP-complete (Berlekamp et al., 1978). In contrast to the overall results, the knowledge of the structure of certain codes makes the GDP and SDP soluble in polynomial time. A basic strategy to define code-based cryptosystems is therefore keep secret the information about the structure of the code and publish a code associated without any apparent structure (hence, by hypothesis hard to decode).
The first code-based cryptosystem is McEliece, which was proposed by Robert McEliece in 1978 (McEliece, 1978) and has not been broken during the last forty years. Encryption and decryption in the McEliece scheme can be performed very efficiently (Biswas and Sendrier, 2008) but has much larger key size than that of the RSA encryption (Rivest et al., 1978) and the Elgamal encryption (ElGamal, 1985) proposed almost at the same period, which prevented it from being widely used in applications. In addition, the McEliece cryptosystem adds redundancy during encryption, therefore the ciphertexts are longer than their corresponding cleartexts.
The security of the McEliece cryptosystem is very sensitive to the use of the binary Goppa code (Goppa, 1970, 1971), many attempts have been made to reduce the key sizes by replacing the binary Goppa code with other error-correcting codes, but failed in preserving the security of the cryptosystem. Although the security of code- based cryptography is related to the fact from the complexity theory that syndrome decoding in an arbitrary linear code is difficult, most known code-based cryptosystems typically use codes with special algebraic structures that allowefficient syndrome decoding, and the designers mainly focus on finding appropriate tricks (usually without theoretical guarantees) to hide the structures of those codes (Bucerzan et al., 2017). A well- known variant of the McEliece cryptosystem is the so-called Niederreiter cryptosystem (Niederreiter, 1986). However, both cryptosystems are equivalent in term of security when employing the same code (Li et al., 1994).
Multivariate polynomial cryptosystems
In 1983, Ong and Schnorr made the first attempt to construct multivariate signature (Ong and Schnorr, 1984). Although this signature scheme was found insecure (Pollard and Schnorr, 1987), it seemed to initiate the study of multivariate polynomial cryptography.
The security of multivariate public key cryptosystems schemes is based upon the difficulty of solving nonlinear system of equations over finite fields (MQ), which is known to be NP-hard (Garey and Johnson, 1979). In particular, in most cases, such schemes are based upon multivariate systems of quadratic equations because of computational advantages. However, there are no multivariate polynomial cryptosystems whose security is guaranteed by the NP-hardness of the MQ problem. The past few decades have witnessed several multivariate cryptosystems, but most of them have been broken. The reason is that the MQ problems underlying most multivariate cryptosystems can be efficiently solved given some trapdoors, and the designers usually failed to hide those trapdoors in their multivariate cryptographic constructions from the adversary.
There exists a large variety of practical multivariate signature schemes. The best known of these are UOV (Kipnis et al., 1999), Rainbow (Ding and Schmidt, 2005), and pFlash (Ding et al., 2007). Additionally, there exist multivariate signature schemes from the HFEv- family, which produce very short signatures (e.g. 120 bit). The most promising scheme in this direction is Gui (Petzoldt et al., 2015). Signing and verifying with all of these schemes is very fast, presumably much faster than RSA and ECC (Chen et al., 2009). It was shown that, in general, encryption schemes were not as secure as it was believed to be, while signatures constructions can be considered viable.
Hash-based signatures
Just like the name suggests, this direction only focuses on constructing digital signatures from hash functions. The concept of digital signatures was introduced by Diffie and Hellman (Diffie and Hellman, 1976) and beca- me popular after Ralph Merkle’s work (Merkle, 1979). By relying on the Merkle-hash tree, one can construct digital signatures with multiple security solely from hash functions (Merkle, 1989). Hash-based signatures can be made very efficient if one allows the signer to keep a state of previously signed messages. There are also stateless hash-based signatures with worse efficiency. For now, the community still does not know how to construct other public-key cryptosystems beyond signatures solely from hash functions. Currently, the hash-based signature schemes Stateless Practical Hash-based Incredibly Nice Collision-resilient Signatures (SPHINCS) (Bernstein et al., 2015) is under evaluation for standardization (Alagic et al., 2020).
Conclusions
Year by year it seems that we are getting closer to create a fully operational universal quantum computer that can utilize strong quantum algorithms such as Shor’s algorithm and Grover’s algorithm. The consequence of this technological advancement is the absolute collapse of the present public key algorithms that are conside- red secure, such as RSA and Elliptic Curve Cryptosystems. The answer on that threat is the introduction of cryptographic schemes resistant to quantum computing using mathematical-based solutions like lattice-based cryptography, hash-based signatures, and code-based cryptography.
Post-quantum cryptography is aiming to provide cryptographic primitives that are secure against attacks using quantum computers. It is using mathematical problems that are believed to be hard to solve by both classi- cal and quantum computers. Several post-quantum schemes are well understood and are considered strong candidates for standardization and practical application. Some post-quantum schemes have been known and investigated for many years. The efforts of the cryptographic community have been invaluable in analyzing and implementing schemes throughout the NIST process. NIST expects to select a small number of candidates for standardization by 2022 or 2023.
