APPQC: Advanced Practical Post-Quantum Cryptography From Lattices

后量子公钥加密和签名的标准化工作接近完成。与此同时，在最近十年里，人们大规模地部署了更先进的密码算法，在这些算法中，不存在有效的后量子候选算法。例如，这些算法允许即使在某些方受到攻击后也能提供强有力的保证，从而保护联系人查找、凭据和电子现金的隐私。这个项目将通过解决三个指导性问题来解决将这种结构提升到后量子时代的挑战：-在量子计算机上有提示和没有提示的情况下解决晶格问题的成本是多少？对这个问题的回答将使人们对整个基于格子的密码学从“基础”到“高级”充满信心。研究提示的存在可以解决旁通道攻击和高级构造。-建立与前量子密码学的特征和(接近)性能的对等的晶格假设是什么？标准格子假设似乎不能与基于配对的或甚至一些基于Diffie-Hellman的前量子构造建立特征奇偶，我们如何才能获得高效和安全的高级实用后量子解决方案？-仔细地将基于格子的密码学与其他假设组合在一起有多高的效率？如果我们想要在实践中部署我们的后量子解决方案，我们将需要设计混合方案，如果它们的前量子部分或后量子部分是安全的，那么我们将需要在实践中部署许多先进的基于格的原语，我们需要仔细地将它们与零知识证明组合在一起，以排除一些攻击。基于格的密码学已经确立了自己作为一项关键技术，既可以实现高效的基本原语，如后量子加密，也可以实现高级解决方案，如使用加密数据和程序进行计算。因此，它处于有利地位，可以为后量子跃迁的第二阶段处理先进但实用的基本体的中间基础。

Standardisation efforts for post-quantum public-key encryption and signatures are close to completion. At the same time the most recent decade has seen the deployment, at scale, of more advanced cryptographic algorithms where no efficient post-quantum candidates exist. These algorithms e.g. permit to give strong guarantees even after some parties were compromised, privacy-preserving contact lookups, credentials and e-cash. This project will tackle the challenge of "lifting" such constructions to the post-quantum era by pursuing three guiding questions:- What is the cost of solving lattice problems with and without hints on a quantum computer? Answers to this question will provide confidence in the entire stack of lattice-based cryptography from "basic" to "advanced". Studying the presence of hints tackles side-channel attacks and advanced constructions.- What are the lattice assumptions that establish feature- and (near) performance-parity with pre-quantum cryptography? Standard lattice assumptions do not seem to establish feature parity with pairing-based or even some Diffie-Hellman-based pre-quantum constructions, how can we achieve efficient and secure advanced practical post-quantum solutions?- How efficient is a careful composition of lattice-base cryptography with other assumptions? If we want to deploy our post-quantum solutions in practice, we will need to design hybrid schemes that are secure if either of their pre- or post-quantum part is secure and to deploy many advanced lattice-based primitives in practice we need to carefully compose them with zero-knowledge proofs to rule out some attacks.Lattice-based cryptography has established itself as a key technology to realise both efficient basic primitives like post-quantum encryption and advanced solutions such as computation with encrypted data and programs. It is thus well positioned to tackle the middle ground of advanced yet practical primitives for phase 2 of the post-quantum transition.