Quantum-safe cryptography for the Internet

公钥密码术对于确保所有互联网通信的安全至关重要。例如，传输层安全(TLS)协议使用公钥加密来保护用于输入密码或信用卡号码的每个“HTTPS”网页。然而，实践中使用的所有公钥算法都基于数学问题--例如因式分解、离散对数或椭圆曲线--这些问题可能会被量子计算机破解。量子安全密码学领域，也被称为后量子密码学或量子抵抗密码学，旨在构建被认为即使在对抗量子计算机时也是安全的公钥密码系统。物理学的不断进步指向了大规模量子计算机的最终构建。这样的未来设备仍将能够解密当今的通信，允许任何人解密今天传输的数据。因此，重要的是现在就开始开发和部署量子安全密码学，甚至在量子计算机建立之前。*已经提出了几种构建量子安全密码学的数学技术，包括格子(和错误学习问题)、纠错码、多元方程和散列函数。它们被用来构建公钥加密和数字签名方案，以及像完全同态加密这样的复杂功能。*不幸的是，所有当前的量子安全算法都有缺陷，使它们不适合实际使用。一些协议需要更大的密钥大小或密文，这增加了通信成本；另一些协议的实现速度很慢。现有的量子安全密码学研究主要集中在公钥加密和数字签名上，而现实世界中的大多数协议都需要经过认证的密钥交换。关于如何高效、安全地将它们集成到应用程序中以及它们的性能特征的研究很少。*本研究计划的总体目标是设计出能够抵御量子计算机攻击并可在互联网上使用的密码系统，重点是认证的密钥交换协议。我们将通过为各种加密任务设计新的和改进的算法，并在已部署的协议的背景下分析和测试这些算法来实现这一点，以确定适合长期使用的技术。*这项研究的结果将支持创造保护通信免受量子计算机攻击的互联网技术。预期的结果是实用的新加密算法、开放源码软件，以及在互联网协议中使用量子安全密码术的建议，供互联网标准机构使用。加拿大互联网用户将从增强的安全性中受益。这项研究支持加拿大成为量子技术领导者的战略投资。**

Public key cryptography is essential in securing all Internet communications. For example, the Transport Layer Security (TLS) protocol uses public key cryptography to protect every "https" web page for entering passwords or credit card numbers. However, all public key algorithms used in practice are based on mathematical problems—such as factoring, discrete logarithms, or elliptic curves—which could be broken by a quantum computer. The field of quantum-safe cryptography, also called post-quantum or quantum-resistant cryptography, aims to construct public key cryptosystems that are believed to be secure even against quantum computers. Ongoing advancements in physics point toward the eventual construction of large-scale quantum computers. Such future devices would still be able to decrypt present-day communications, allowing anyone to decrypt data transmitted today. Thus, it is important to start developing and deploying quantum-safe cryptography now, even before quantum computers are built.***Several mathematical techniques have been proposed for constructing quantum-safe cryptosystems, including lattices (and the learning-with-errors problem), error-correcting codes, multivariate equations, and hash functions. These have been used to construct public key encryption and digital signature schemes, as well as complex functionality like fully homomorphic encryption.***Unfortunately, all current quantum-safe algorithms have drawbacks that make them unsuitable for practical use. Some require larger key sizes or ciphertexts, increasing communication costs; others have slow implementations. Existing research in quantum-safe cryptography has focused on public key encryption and digital signatures, whereas most real-world protocols need authenticated key exchange. There is little research on how to efficiently and securely integrate them in applications, and their performance characteristics.***The overall aim of this research program is to design cryptographic systems that are secure against attacks by quantum computers and are practical for use on the Internet, with a specific focus on authenticated key exchange protocols. We will achieve this by designing new and improved algorithms for a variety of cryptographic tasks and analysing and testing these algorithms in the context of deployed protocols to identify techniques that are suitable for long-term use.***The results of this research will support the creation of Internet technologies that protect communication from quantum computers. The anticipated outcomes are practical new encryption algorithms, open source software, and recommendations for the use of quantum-safe cryptography in Internet protocols, ready for use by Internet standards bodies. Canadian Internet users will benefit from enhanced security. This research supports Canada's strategic investment in becoming a leader in quantum technologies.**