APPQC: Advanced Practical Post-Quantum Cryptography From Lattices

后量子公钥加密和签名的标准化工作即将完成。与此同时，在最近的十年里，我们看到了更先进的加密算法的大规模部署，而目前还没有有效的后量子候选算法。例如，这些算法允许在某些方面受到损害后提供强有力的保证，保护隐私的联系人查找，凭据和电子现金。该项目将通过追求三个指导性问题来解决将这种结构“提升”到后量子时代的挑战：-在量子计算机上使用和不使用提示解决晶格问题的成本是多少？这个问题的答案将为从“基本”到“高级”的整个基于格的加密堆栈提供信心。研究提示的存在可以解决侧信道攻击和高级结构。-与前量子密码学建立特征和（接近）性能奇偶性的晶格假设是什么？标准晶格假设似乎不能与基于配对甚至一些基于diffie - hellman的前量子结构建立特征奇偶性，我们如何实现高效和安全的先进实用后量子解决方案？-格基密码学与其他假设的仔细组合有多有效？如果我们想在实践中部署我们的后量子解决方案，我们需要设计安全的混合方案，如果它们的前量子部分或后量子部分是安全的，并且在实践中部署许多先进的基于格子的原语，我们需要小心地将它们与零知识证明组合在一起以排除一些攻击。基于格的密码学已经成为一种关键技术，既可以实现高效的基本原语（如后量子加密），也可以实现高级解决方案（如使用加密数据和程序进行计算）。因此，它很好地定位于处理后量子跃迁阶段2的先进而实用的原语的中间地带。

Standardisation efforts for post-quantum public-key encryption and signatures are close to completion. At the same time the most recent decade has seen the deployment, at scale, of more advanced cryptographic algorithms where no efficient post-quantum candidates exist. These algorithms e.g. permit to give strong guarantees even after some parties were compromised, privacy-preserving contact lookups, credentials and e-cash. This project will tackle the challenge of "lifting" such constructions to the post-quantum era by pursuing three guiding questions:- What is the cost of solving lattice problems with and without hints on a quantum computer? Answers to this question will provide confidence in the entire stack of lattice-based cryptography from "basic" to "advanced". Studying the presence of hints tackles side-channel attacks and advanced constructions.- What are the lattice assumptions that establish feature- and (near) performance-parity with pre-quantum cryptography? Standard lattice assumptions do not seem to establish feature parity with pairing-based or even some Diffie-Hellman-based pre-quantum constructions, how can we achieve efficient and secure advanced practical post-quantum solutions?- How efficient is a careful composition of lattice-base cryptography with other assumptions? If we want to deploy our post-quantum solutions in practice, we will need to design hybrid schemes that are secure if either of their pre- or post-quantum part is secure and to deploy many advanced lattice-based primitives in practice we need to carefully compose them with zero-knowledge proofs to rule out some attacks.Lattice-based cryptography has established itself as a key technology to realise both efficient basic primitives like post-quantum encryption and advanced solutions such as computation with encrypted data and programs. It is thus well positioned to tackle the middle ground of advanced yet practical primitives for phase 2 of the post-quantum transition.