1. A Simple Provably Secure AKE from the LWE Problem
Source: Mathematical Problems in Engineering, Volume 2017, April 2017
Author: Limin Zhou, and Fengju Lv
Speaker: Nguyen Ngoc Tu
Date: 2017/10/5
Green: environmentally friendly

2. Introduction Key Exchange Protocol Alice Bob
Intercept: Delete, modify, fabricate ; corrupt: clients

3. Introduction Key Exchange Protocol Diffie–Hellman key exchange Alice
Bob
D-H on finite field (or finite cyclic groups)
Computational hardness assumption (discrete logarithm):
Intercept: Delete, modify, fabricate ; corrupt: clients

4. Introduction Key Exchange Protocol Diffie–Hellman key exchange Alice
Bob
D-H on ECC
Computational hardness assumption:
Intercept: Delete, modify, fabricate ; corrupt: clients

5. Introduction Key Exchange Protocol Peter W. Shor (1997)
Quantum computer can break the factorization problem the
discrete logarithm problem in quantum polynomial time algorithms
October 2015: Researchers at University of New South Wales built a
Quantum logic gate in silicon for the first time
May 2017: IBM announced that it has successfully built and tested its most powerful universal quantum computing processors with 16 qubit processor.
Diffie–Hellman key exchange based on factorization discrete
logarithm problems become insecure in next some years!
Intercept: Delete, modify, fabricate ; corrupt: clients
P.W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” SIAM Journal on Computing, vol. 26, no. 5, pp. 1484–1509, 1997.
“World's First Silicon Quantum Logic Gate Brings Quantum Computing One Step Closer,” 2015
"IBM Builds Its Most Powerful Universal Quantum Computing Processors,“

6. Introduction (1) Lattice-based cryptography
Key Exchange Protocol
New candidates of mathematical problems
(1) Lattice-based cryptography
(2) Multivariate-based cryptography
(3) Hash-based signatures
(4) Code-based cryptography
(5) Supersingular elliptic curves-based cryptography
Intercept: Delete, modify, fabricate ; corrupt: clients

7. Outline
Introduction
Preliminaries
Proposed scheme
Conclusions

8. Preliminaries Lattice
Let be a set of linearly independent vectors. The
lattice generated by is the set of linear combinations of
with coefficients in
Fundamental domain
Contribution

9. Preliminaries
Example
Contribution

10. Preliminaries Discrete Gaussian Distribution (center at 0, variance t)
Sample the noise value
Contribution

11. Preliminaries Learning with errors problem Input a secret vector
Sample output
Select a vector
uniformly at random
Select a random a noise
Compute
Problem:
Contribution
Given at most polynomial samples
Find the secret vector
It believes that the problem belong to NP-Hard class

12. Preliminaries
Notations • • • • •
Contribution

13. Proposed scheme Setup the prime number
the dimension of the private vectors
the Gaussian parameter
the key derivation function
𝑠 𝐵
Contribution

14. Proposed scheme Setup Secrete key: Secrete key: Public key:
Bob
Alice
Secrete key:
Secrete key:
Public key:
Public key:
Contribution

15. Proposed scheme
Alice
Bob
Select
Compute
Contribution

16. Proposed scheme
Alice
Bob
Select
Compute
Contribution

17. Proposed scheme
Alice
Bob
Contribution
with overwhelming probability

18. Performance comparison
Security comparisons
BR=Bellare and Rogaway model
[5] H. Krawczyk, “HMQV: a high-performance secure Diffie-Hellman protocol (extended abstract),” in Advances in cryptology— CRYPTO 2005, vol of Lecture Notes in Computer Science, pp. 546–566, Springer, Berlin, Germany, 2005.
[7] B. LaMacchia, K. Lauter, and A. Mityagin, “Stronger security of authenticated key exchange,” in Provable Security, vol of Lecture Notes in Computer Science, pp. 1–16, Springer, Berlin, Germany, 2007.
[18] J. W. Bos, C. Costello, M. Naehrig, and D. Stebila, “Postquantum key exchange for the TLS protocol from the ring learning with errors problem,” in Proceedings of the 36th IEEE Symposium on Security and Privacy (SP ’15), pp. 553–570, San Jose, Calif, USA, May 2015.
[26] A. Fujioka, K. Suzuki, K. Xagawa, and K. Yoneyama, “Practical and post-quantum authenticated key exchange from one-way secure key encapsulation mechanism,” in Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security (ASIA CCS ’13), pp. 83–94,ACM,May 2013.
[27] A. Fujioka, K. Suzuki, K. Xagawa, and K. Yoneyama, “Strongly secure authenticated key exchange from factoring, codes, and lattices,” Designs, Codes and Cryptography, vol. 76, no. 3, pp. 469–504, 2015.
[34] B. Ustaoglu, “Obtaining a secure and efficient key agreement protocol from (H)MQV and NAXOS,” Designs, Codes, and Cryptography, vol. 46, no. 3, pp. 329–342, 2008.
AAKE:

19. Conclusions
The security of the proposed AKE scheme solely bases on the LWE problem
Provable security under the BR model
Automated Validation of Internet Security Protocols and Applications.