PKC-Sec: Security Analysis of Classical and Post-Quantum Public Key Cryptography Assumptions

公钥加密（PKC）依赖于计算问题的存在，这些问题难以置信地难以解决——但并非不可能解决。20世纪70年代PKC起源的基本经典例子是整数分解问题和离散对数问题（DLP）。虽然没有已知的有效的，即多项式时间算法来解决这些问题，但在经典计算机上运行，由于肖尔在1994年的惊人突破，这两个问题都可以在足够大的量子计算机上有效地解决。在量子计算、量子信息理论和量子算法领域进行了深入的研究，在过去15年左右的时间里，NIST和ETSI都在认真研究替代后量子（PQ）密码系统，并进行了标准化工作。PQ密码系统必须对经典计算机和量子计算机都是安全的，因此在完全信任它们以取代我们现有的PKC硬度假设之前，必须对其潜在的硬度假设进行深入研究。在这些标准建立起来并且密码学实践完全迁移到PQ密码学之前，对经典硬度假设的研究也必须坚持下去，特别是在零星的，有时是惊人的进展中：例如，对于一个特殊但很大的有限域族，DLP可以在准多项式时间内在经典计算机上求解，即“非常接近”有效，这要归功于格兰杰博士和他的合作者以及Joux和他的合作者的一系列结果。在这个项目中，我们将研究和开发算法来解决PKC安全的基础计算问题，无论是现在还是将来。特别地，我们将研究：在上述特殊有限域族中的DLP，一种有效的经典算法可能即将出现；Legendre伪随机函数的安全性，它非常适合多方计算，并被提议用于以太坊的下一个迭代-事实上的标准区块链平台-但没有得到很好的研究；最后是基于超奇异同工的PQ密码的安全性，尽管这是一个相对年轻的领域，但它提供了许多非常有前途的应用。由于它们的性质，任何基于数学结构的密码学假设都可能比目前认为的要弱，我们将加深我们对这些自然和基本问题的理解和评估的硬度，从而为密码学社区和更广泛的所有密码学用户提供安全保证。

Public key cryptography (PKC) depends on the existence of computational problems that are incredibly hard - but not impossible - to solve. Classical examples that were fundamental to the origins of PKC in the 1970s (and indeed were prominent centuries earlier) are the integer factorisation problem and the discrete logarithm problem (DLP). While there are no known efficient, i.e., polynomial-time algorithms for solving these problems that run on classical computers, thanks to Shor's astounding breakthrough ideas in 1994, both can be solved efficiently on a quantum computer of sufficient size. Intense research in the areas of quantum computation, quantum information theory and quantum algorithms ensued, and replacement post-quantum (PQ) cryptosystems have been studied in earnest for the past 15 years or so, with standardisation efforts in process by both NIST and ETSI. PQ cryptosystems must be secure against both classical and quantum computers and therefore their underlying hardness assumptions must be studied intensely before they can be fully trusted to replace our existing PKC hardness assumptions. Until these standards have been established and cryptographic practice migrates entirely to PQ cryptography, it is also essential that the study of classical hardness assumptions persists, particularly as sporadic and sometimes spectacular progress can occur: for instance, for a special but large family of finite fields the DLP can be solved on a classical computer in quasi-polynomial time, i.e., `very nearly' efficiently, thanks to a series of results due to Dr. Granger and his collaborators, and Joux and his collaborators.In this project we will research and develop algorithms for solving computational problems that are foundational to the security of PKC, both now and in the future. In particular, we will study: the DLP in the aforementioned special family of finite fields, for which an efficient classical algorithm is potentially on the horizon; the security of the Legendre pseudo-random function, which is extremely well suited for multi-party computation and has been proposed for use in the next iteration of Ethereum - the de facto standard blockchain platform - but is not so well-studied; and finally the security of supersingular isogeny-based PQ cryptography, which although a relatively young field offers many very promising applications. Due to their nature, any cryptographic assumptions based on mathematical constructions are potentially weaker than currently believed, and we will deepen our understanding and assess the hardness of these natural and fundamental problems, thus providing security assurances to the cryptography community and more generally all users of cryptography.