abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-09-24 14:23:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

quantum init

Browse Source
This commit is contained in:
zhaoxiaomeng
2018-01-04 13:38:57 +08:00
committed by Simon
parent d11f845fde
commit 53af3b51ae
2361 changed files with 387455 additions and 144458 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
vendor/liboqs/docs/Algorithm data sheets/kex_lwe_frodo.md vendored Normal file
View File

@@ -0,0 +1,60 @@
Algorithm data sheet: `kex_lwe_frodo`
=======================================
Algorithm
---------
**Name:** Frodo
**Description:** Key exchange protocol proposed by Bos et al. [BCDMNNRS16] based on the ring learning with errors problem. Instantiation of the Lindner–Peikert approximate LWE key agreement scheme [LP10], which was an adaptation of the LWE public key encryption scheme of in public key encryption scheme of Regev [Reg05], using reconciliation mechanism of Peikert [Pei14].
**Supporting research:**
- [BCDMNNRS16] Joppe Bos, Craig Costello, Léo Ducas, Ilya Mironov, Michael Naehrig, Valeria Nikolaenko, Ananth Raghunathan, Douglas Stebila. Frodo: Take off the ring! Practical, quantum-secure key exchange from LWE. In *Proc. 23rd ACM Conference on Computer and Communications Security (CCS) 2016*, pp. 1006-1018. ACM, October 2016. [https://eprint.iacr.org/2016/659](https://eprint.iacr.org/2016/659)
- [Pei14] Chris Peikert. Lattice cryptography for the Internet. In *PQCrypto 2014*, volume 8772 of LNCS, pages 197–219. Springer, 2014. [https://eprint.iacr.org/2014/070](https://eprint.iacr.org/2014/070)
- [LP10] Richard Lindner and Chris Peikert. Better key sizes (and attacks) for LWE-based encryption. In *Proc. CT-RSA 2011*, *LNCS*, vol. 6558, pp. 319–339. Springer, February 2011. [https://eprint.iacr.org/2010/613](https://eprint.iacr.org/2010/613)
- [Reg05] Oded Regev. On lattices, learning with errors, random linear codes, and cryptography. In *Proc. 37th ACM STOC*, pp. 84–93. ACM Press, May 2005.
Security
--------
**Security model:** Unauthenticated key exchange / passive (IND-CPA) key encapsulation mechanism
**Underlying hard problem(s):** Decision learning with errors problem
Parameter set 1
---------------
"Recommended" parameter set from [BCDMNNRS16]
**Claimed classical security:**
- 2^144 (original paper)
**Claimed quantum security:**
- 2^130 (original paper)
**Communication size:**
- Alice → Bob: 11,377 bytes
- Bob → Alice: 11,296 bytes
- total: 22,673 bytes
Implementation
--------------
**Source of implementation:** Original research paper ([https://github.com/lwe-frodo/lwe-frodo](https://github.com/lwe-frodo/lwe-frodo))
**License:** MIT License
**Language:** C
**Constant-time:** Yes
**Testing:**
- Correctness: covered by test harness `test_kex`
- Statistics of shared secrets: covered by test harness `test_kex`
- Static analysis:
- `scan_build`

80
vendor/liboqs/docs/Algorithm data sheets/kex_rlwe_bcns15.md vendored Normal file
View File

@@ -0,0 +1,80 @@
Algorithm data sheet: `kex_rlwe_bcns15`
=======================================
Algorithm
---------
**Name:** BCNS15
**Description:** Key exchange protocol proposed by Bos et al. [BCNS15] based on the ring learning with errors problem. Instantiation of the approximate KEM in public key encryption scheme of Lyubashevsky, Peikert, Regev [LPR10], using reconciliation mechanism of Peikert [Pei14].
**Supporting research:**
- [BCNS15] Joppe W. Bos, Craig Costello, Michael Naehrig, Douglas Stebila. Post-quantum key exchange for the TLS protocol from the ring learning with errors problem. In *IEEE Symposium on Security and Privacy (S&P) 2015*, pp. 553-570. IEEE, May 2015. [https://eprint.iacr.org/2014/599](https://eprint.iacr.org/2014/599)
- [Pei14] Chris Peikert. Lattice cryptography for the Internet. In *PQCrypto 2014*, volume 8772 of LNCS, pages 197–219. Springer, 2014. [https://eprint.iacr.org/2014/070](https://eprint.iacr.org/2014/070)
- [LPR10] Vadim Lyubashevsky, Chris Peikert, and Oded Regev. On ideal lattices and learning with errors over rings. In *EUROCRYPT 2010*, volume 6110 of LNCS, pages 1–23. Springer, May 2010. [https://eprint.iacr.org/2012/230](https://eprint.iacr.org/2012/230)
Security
--------
**Security model:** Unauthenticated key exchange / passive (IND-CPA) key encapsulation mechanism
**Underlying hard problem(s):** Decision ring learning with errors problem
Parameter set 1
---------------
**Claimed classical security:**
- 2^163.8 (original paper)
- 2^86 ([https://eprint.iacr.org/2015/1092](https://eprint.iacr.org/2015/1092))
**Claimed quantum security:**
- ≥ 2^81.9 (original paper)
- 2^78 ([https://eprint.iacr.org/2015/1092](https://eprint.iacr.org/2015/1092))
**Communication size:**
- Alice → Bob: 4,096 bytes
- Bob → Alice: 4,224 bytes
- total: 8,320 bytes
Implementation
--------------
**Source of implementation:** Original research paper ([https://github.com/dstebila/rlwekex](https://github.com/dstebila/rlwekex))
**License:** Public domain ("Unlicense", [http://unlicense.org](http://unlicense.org))
**Language:** C
**Constant-time:** When preprocessor macro `CONSTANT_TIME` is defined
**Options:**
- preprocessor macro `CONSTANT_TIME` to enable constant-time code
**Testing:**
- Correctness: covered by test harness `test_kex`
- Statistics of shared secrets: covered by test harness `test_kex`
- statistical distance from uniform over 100 iterations: 0.0561185025
- Static analysis:
- `scan_build`
**Runtime:**
Operation | Iterations | Total time (s) | Time (us): mean | pop. stdev | CPU cycles: mean | pop. stdev
------------------------------ | ----------:| --------------:| ---------------:| ----------:| ----------------:| ----------:
alice 0 | 17664 | 10.000 | 566.145 | 24.189 | 2269004 | 96901
bob | 10923 | 10.001 | 915.562 | 53.806 | 3669454 | 215632
alice 1 | 86154 | 10.000 | 116.071 | 13.987 | 465102 | 56014
Runtime measurement configuration:
- CPU: Intel Core i7 (6700K "Skylake") with 4 cores each running at 4.0 GHz; single-threaded runtime measurements
- TurboBoost and hyperthreading (hardware multithreading): disabled
- liboqs version: commit [c5382941aecc85df90b9179458c9fba7a9f45611](https://github.com/open-quantum-safe/liboqs/commit/c5382941aecc85df90b9179458c9fba7a9f45611)
- compiler: gcc-6 (Homebrew gcc 6.2.0) 6.2.0
- build command: make CC=gcc-6

68
vendor/liboqs/docs/Algorithm data sheets/kex_sidh_cln16.md vendored Normal file
View File

@@ -0,0 +1,68 @@
Algorithm data sheet: `kex_sidh_cln16`
======================================
Algorithm
---------
**Name:** SIDH CLN16
**Description:**
The Supersingular Isogeny Diffie-Hellman (SIDH) key exchange protocol was proposed by Jao and DeFeo in [JD11]. The mathematical structures that provide the key exchange operations are supersingular elliptic curves and isogeny maps between them. Despite the use of elliptic curves, its security is not based on the hardness of the elliptic curve discrete logarithm problem, but instead on the hardness of computing large-degree isogenies between two given elliptic curves, believed to be resistant to quantum computers.
The library, provided by Microsoft Research, implements the algorithms of Costello, Longa, and Naehrig [CLN16], including public key compression algorithms of [CJLNRU17]. It is fully protected against timing and cache attacks: all operations on secret data run in constant time. More details at [https://www.microsoft.com/en-us/research/project/sidh-library/#].
The chosen parameters aim to provide 128 bits of security against attackers running a large-scale quantum computer, and 192 bits of security against classical algorithms. SIDH has the option of a hybrid key exchange that combines supersingular isogeny Diffie-Hellman with a high-security classical elliptic curve Diffie-Hellman key exchange at a small overhead.
SIDH is the first supersingular isogeny Diffie-Hellman software that is fully protected against timing and cache attacks: all operations on secret data run in constant time. The library is also significantly faster than previous implementations, e.g., it is about 3 times faster than the previously best (non-constant-time) supersingular isogeny Diffie-Hellman software.
**Supporting research:**
- [CLN16] Craig Costello, Patrick Longa, and Michael Naehrig. Efficient algorithms for supersingular isogeny Diffie-Hellman, available at [http://eprint.iacr.org/2016/413].
- [JD11] David Jao and Luca DeFeo. Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies, in PQCrypto 2011, LNCS 7071, pp. 19-34, 2011.
- [CJLNRU17] Craig Costello, David Jao, Patrick Longa, Michael Naehrig, Joost Renes, and David Urbanik. Efficient compression of SIDH public keys. Advances in Cryptology EUROCRYPT 2017, LNCS 10210, pp. 679-706, 2017. The preprint version is available at [http://eprint.iacr.org/2016/963].
Security
--------
**Security model:** Unauthenticated key exchange / passive (IND-CPA) key encapsulation mechanism
**Underlying hard problem(s):** hardness of computing large-degree isogenies between two given elliptic curves
Parameter set 1
---------------
"Recommended" parameter set from [CLN16]
**Claimed classical security:**
- 2^192 (original paper)
**Claimed quantum security:**
- 2^128 (original paper)
**Communication size:**
- Alice → Bob: 564 bytes (uncompressed), 330 bytes (compressed)
- Bob → Alice: 564 bytes (uncompressed), 330 bytes (compressed)
- total: 1128 bytes (uncompressed), 660 bytes (compressed)
Implementation
--------------
**Source of implementation:** Original research paper ([https://github.com/Microsoft/PQCrypto-SIDH](https://github.com/Microsoft/PQCrypto-SIDH))
**License:** MIT License
**Language:** C
**Constant-time:** Yes
**Testing:**
- Correctness: covered by test harness `test_kex`
- Statistics of shared secrets: covered by test harness `test_kex`
- Static analysis:
- `scan_build`

159
vendor/liboqs/docs/Algorithm data sheets/sig_picnic.md vendored Normal file
View File

@@ -0,0 +1,159 @@
Algorithm data sheet: `sig_picnic`
==================================
Algorithm
---------
**Name:** Picnic
**Description:**
Picnic is a post-quantum digital signature scheme that: (a) derives its security from the security of symmetric-key primitives, believed to be quantum-secure, and (b) has extremely small keypairs, and, (c) is highly parametrizable.
The public key is an image y=f(x) of a one-way function f (the block cipher LowMC) and the secret key is x. A signature is a non-interactive zero-knowledge proof of x, that incorporates a message to be signed. For this proof, improvements to the recent progress of Giacomelli et al. (USENIX'16) in constructing an efficient sigma protocol for statements over general circuits are leveraged, resulting in smaller signature sizes.
Two mechanisms for making the proof non-interactive can be used: the Fiat-Shamir transform, and Unruh's transform (EUROCRYPT'12,'15,'16). The former has smaller signatures, while the latter has a security analysis in the quantum-accessible random oracle model. By customizing Unruh's transform, the overhead is reduced to 1.6x when compared to the Fiat-Shamir transform.
**Supporting research:**
- [CDGORRSZ] Melissa Chase, David Derler, Steven Goldfeder, Claudio Orlandi, Sebastian Ramacher, Christian Rechberger, Daniel Slamanig, and Greg Zaverucha. Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives, Proceedings of ACM CCS 2017, and available at [http://eprint.iacr.org/2017/279].
Security
--------
**Security model:** existential unforgeability in the random oracle model (ROM), or quantum
random oracle model (QROM).
**Underlying hard problem(s):** hash function security (ROM/QROM), key recovery attacks on the lowMC
block cipher
Parameter set 1
---------------
"Picnic_1_316_FS" parameter set from [CDGORRSZ]
**Claimed classical security:**
- 2^256 (original paper)
**Claimed quantum security:**
- 2^128 (original paper)
**Data sizes:**
- Private key: 130 bytes
- Public key: 65 bytes
- Signature: 103464 bytes
Parameter set 2
---------------
"Picnic_1_316_UR" parameter set from [CDGORRSZ]
**Claimed classical security:**
- 2^256 (original paper)
**Claimed quantum security:**
- 2^128 (original paper)
**Data sizes:**
- Private key: 130 bytes
- Public key: 65 bytes
- Signature: 174434 bytes
Parameter set 3
---------------
"Picnic_10_38_FS" parameter set from [CDGORRSZ]
**Claimed classical security:**
- 2^256 (original paper)
**Claimed quantum security:**
- 2^128 (original paper)
**Data sizes:**
- Private key: 130 bytes
- Public key: 65 bytes
- Signature: 114264 bytes
Parameter set 4
---------------
"Picnic_10_38_UR" parameter set from [CDGORRSZ]
**Claimed classical security:**
- 2^256 (original paper)
**Claimed quantum security:**
- 2^128 (original paper)
**Data sizes:**
- Private key: 130 bytes
- Public key: 65 bytes
- Signature: 195458 bytes
Parameter set 5
---------------
"Picnic_42_14_FS" parameter set from [CDGORRSZ]
**Claimed classical security:**
- 2^256 (original paper)
**Claimed quantum security:**
- 2^128 (original paper)
**Data sizes:**
- Private key: 130 bytes
- Public key: 65 bytes
- Signature: 148236 bytes
Parameter set 6
---------------
"Picnic_42_14_UR" parameter set from [CDGORRSZ]
**Claimed classical security:**
- 2^256 (original paper)
**Claimed quantum security:**
- 2^128 (original paper)
**Data sizes:**
- Private key: 130 bytes
- Public key: 65 bytes
- Signature: 263786 bytes
Implementation
--------------
**Source of implementation:** Original research paper ([https://github.com/Microsoft/Picnic](https://github.com/Microsoft/Picnic))
**License:** MIT License
**Language:** C
**Constant-time:** Yes
**Testing:**
- Correctness: covered by test harness `test_sig`
- Statistics of signatures: covered by test harness `test_sig`
- Static analysis:
- `scan_build`