diff --git a/learning/courses/quantum-safe-cryptography/_toc.json b/learning/courses/quantum-safe-cryptography/_toc.json deleted file mode 100644 index 90c36c93fdd4..000000000000 --- a/learning/courses/quantum-safe-cryptography/_toc.json +++ /dev/null @@ -1,52 +0,0 @@ -{ - "parentUrl": "/learning/courses", - "title": "A practical introduction to quantum-safe cryptography", - "collapsed": true, - "children": [ - { - "title": "Overview", - "url": "/learning/courses/quantum-safe-cryptography", - "useDivider": true, - "preventBold": true - }, - { - "title": "Lessons", - "collapsible": false, - "children": [ - { - "title": "Course introduction", - "url": "/learning/courses/quantum-safe-cryptography/introduction-to-this-course" - }, - { - "title": "Cryptographic hash functions", - "url": "/learning/courses/quantum-safe-cryptography/cryptographic-hash-functions" - }, - { - "title": "Symmetric key cryptography", - "url": "/learning/courses/quantum-safe-cryptography/symmetric-key-cryptography" - }, - { - "title": "Asymmetric key cryptography", - "url": "/learning/courses/quantum-safe-cryptography/asymmetric-key-cryptography" - }, - { - "title": "Quantum-safe cryptography", - "url": "/learning/courses/quantum-safe-cryptography/quantum-safe-cryptography" - }, - { - "title": "What's next?", - "url": "/learning/courses/quantum-safe-cryptography/whats-next" - }, - { - "title": "Works cited", - "url": "/learning/courses/quantum-safe-cryptography/works-cited" - }, - { - "title": "Exam", - "url": "/learning/courses/quantum-safe-cryptography/exam", - "isExam": true - } - ] - } - ] -} diff --git a/learning/courses/quantum-safe-cryptography/asymmetric-key-cryptography.ipynb b/learning/courses/quantum-safe-cryptography/asymmetric-key-cryptography.ipynb deleted file mode 100644 index ae2799e1e1de..000000000000 --- a/learning/courses/quantum-safe-cryptography/asymmetric-key-cryptography.ipynb +++ /dev/null @@ -1,2595 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "id": "19b42e0f-baa1-4920-89a0-f5e8bbb2e12d", - "metadata": {}, - "source": [ - "---\n", - "title: Asymmetric key cryptography\n", - "description: In this lesson we will look at asymmetric key cryptography which forms the basis of many secure network interactions today.\n", - "---\n", - "\n", - "\n", - "{/* cspell:ignore FIPS nonrepudiation, Diffie, cryptosystems, ECDH, ciphertext, Rivest, Shamir, modexp, coprime, Nino, Diaz, Ciphertext, ciphertexts, Adleman, primality, primalitytest, totient, congrel, multinv, exteuc, intrep, semsec, Coprime, varphi, modinv, kems, Fernet, OAEP, HKDF, urandom, hkdf, Prehashed, primefactor, superpoly, subexponential, subexp, gnfs, Oded, Regev, Ragavan, Vaikuntanathan, Seyoon, Ragavanm, Vinod, Regev’s, polylogarithmic, polyalg, GNFS, Ekerå, counterparty’s, ECDLP, cofactor, Larasati, counterparty's */}" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "8f00d4c1-6c59-43ab-a731-b1232406551d", - "metadata": {}, - "source": [ - "# Asymmetric key cryptography\n", - "\n", - "In this lesson we will look at asymmetric key cryptography which forms the basis of many secure network interactions today.\n", - "\n", - "By the end of the lesson we will have covered:\n", - " - What asymmetric key cryptography is\n", - " - Usage of asymmetric key cryptography, including key exchange and digital signatures\n", - " - Security of asymmetric key cryptography in general\n", - " - Further details on RSA, DSA and Elliptic Curves algorithms and security\n", - " - Some Python code examples showing how the algorithms work in practice\n", - " - Threats to these algorithms from both classical and quantum computers" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "24b3d39a-6b6a-424d-8c14-411acf4beb7a", - "metadata": {}, - "source": [ - "## Introduction to asymmetric key cryptography\n", - "\n", - "As we learned in the last lesson, symmetric key cryptography is very fast and efficient for protecting information, but it has a few limitations:\n", - "\n", - "1. As the number of parties wishing to exchange secure information increases, the numbers of keys required grows combinatorially. It provides no mechanism to securely distribute these keys between senders and receivers.\n", - "2. There is no provision for *non-repudiation*. Any party is able to decrypt, or encrypt, messages with no way to guarantee a message was received or where it originated\n", - "\n", - "The solution to both these problems is provided by *asymmetric key cryptography* (AKC), also known as [*public key cryptography*](https://en.wikipedia.org/w/index.php?title=Public-key_cryptography&oldid=1163952916) (PKC), which therefore forms a cornerstone of modern digital security.\n", - "\n", - "Asymmetric key cryptography (AKC) involves the use of a pair of keys – one public, one private. The public and private keys are cryptographically linked and typically generated at the same time as a *key pair* using a specialized mathematical algorithm. The public key, as suggested by its name, is then meant to be freely distributed, while the private key is kept secret by the party generating the key pair. Security of communications employing asymmetric key pairs is assured as long as the private key remains confidential.\n", - "\n", - "![Figure 1. Asymmetric Key Encryption](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/akc.svg)\n", - "\n", - "*Figure 1. Asymmetric Key Encryption*\n", - "\n", - "AKC offers several useful functions, such as:\n", - "\n", - "1. **Encryption and decryption** to enable **confidentiality** of communications.\n", - "2. **Digital signatures** to ensure **authenticity**, **integrity**, and **non-repudiation**.\n", - "3. **Secure key exchange** to facilitate subsequent use of symmetric cryptosystems.\n", - "\n", - "In modern applications, AKC is primarily used for digital signatures and secure key exchange. In this lesson, we introduce these two key functions, and then we discuss several variations of cryptographic protocols for these functions." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "88e9780c-a3d2-45bf-800a-c5c999caebd1", - "metadata": {}, - "source": [ - "## Key exchange with asymmetric key cryptography\n", - "\n", - "One of the fundamental problems in cryptography is securely [exchanging keys](https://en.wikipedia.org/w/index.php?title=Key_exchange&oldid=1134576107). For example, if two parties want to use symmetric encryption, both parties need the same key to encrypt and decrypt messages. But how do they securely exchange the key? Asymmetric key cryptography addresses this through interactive and non-interactive key exchange mechanisms." - ] - }, - { - "cell_type": "markdown", - "id": "9f081971-a6e0-4129-bfe9-27ae64b232c7", - "metadata": {}, - "source": [ - "### Interactive key exchange\n", - "\n", - "An interactive *key exchange protocol* refers to a method where two parties collaborate to create a *shared secret* key over an insecure communication channel. This shared secret key can then be used for symmetric encryption and decryption tasks.\n", - "\n", - "The most well known among such protocols is the [Diffie-Hellman algorithm](https://en.wikipedia.org/w/index.php?title=Diffie%E2%80%93Hellman_key_exchange&oldid=1163912552) (DH), which was devised specifically to facilitate key exchange. In this protocol, each party generates a pair of keys (public and private) and broadcasts their public key. Then each party uses their own private key and the other party's public key to generate a shared secret key. DH employs the principles of modular arithmetic to ensure both parties end up with the same shared secret even though each party has access only to the other party's public key.\n", - "\n", - "Modern cryptosystems based on [elliptic curve cryptography](https://en.wikipedia.org/w/index.php?title=Elliptic-curve_cryptography&oldid=1160709993) (ECC) extend this concept with the [elliptic curve Diffie-Hellman)](https://en.wikipedia.org/w/index.php?title=Elliptic-curve_Diffie%E2%80%93Hellman&oldid=1160050860) (ECDH) key exchange. ECDH works similarly to DH but utilizes the properties of elliptic curves, resulting in a more secure and efficient system.\n", - "\n", - "![Figure 2. Key Exchange Protocol](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kep_akc.svg)\n", - "\n", - "*Figure 2. Key Exchange Protocol*" - ] - }, - { - "cell_type": "markdown", - "id": "21967b0c-1260-492e-abd0-3dcabb768716", - "metadata": {}, - "source": [ - "### Non-interactive key exchange\n", - "\n", - "Unlike key exchange protocols like DH and ECDH, which are interactive, requiring back-and-forth communication to decide the symmetric key, AKC also provides for non-interactive ways to establish a shared secret key. In such schemes, one party generates a pair of keys (public and private) and shares the public key with the other party. This second party then generates a random symmetric key, encrypts it with the received public key, and sends it back to the first party. The first party uses their private key to decrypt the received message, thereby obtaining the shared symmetric key. This scheme is non-interactive in that the symmetric key is determined by one party and simply communicated securely to the other party in encrypted form.\n", - "\n", - "An important consideration in non-interactive key exchange has to do with the length differential in bits between the symmetric key the parties wish to exchange and recommended message sizes in AKC. Typically, modern symmetric keys are in the range of 128-256 bits long, while asymmetric key cryptosystems such as RSA work with message sizes around 1024-4096 bits long. Therefore, when using AKC to transmit a symmetric key, for security it must nevertheless be encoded into a longer 1024-4096 bit message. This can be achieved via two approaches:\n", - "\n", - "- **Padding-based key exchange:** In this approach, the shorter (128-256 bit) symmetric key is generated first and then an agreed-upon reversible padding scheme such as [OAEP](https://en.wikipedia.org/w/index.php?title=Optimal_asymmetric_encryption_padding&oldid=1163481577) is used to embed it into a longer (1024-4096 bit) message. This longer message is encrypted using AKC and broadcasted as ciphertext. The recipient first decrypts the ciphertext and then removes the padding to extract the shorter symmetric key.\n", - "\n", - "- **Key encapsulation mechanisms (KEMs):** With [KEM-based](https://en.wikipedia.org/w/index.php?title=Key_encapsulation_mechanism&oldid=1110687965) key exchange, a random, long (1024-4096 bit) plain text message is first generated, from which a shorter (128-256 bit) symmetric key can be extracted using an agreed-upon [key derivation function](https://en.wikipedia.org/w/index.php?title=Key_derivation_function&oldid=1165650237) (KDF). The longer plain text is encrypted using AKC and broadcasted to the recipient as ciphertext. The recipient decodes the ciphertext using their private key and then uses the KDF to extract the shorter (128-256 bit) symmetric key. Popular cryptosystems such as [RSA](https://en.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&oldid=1163962255), with their ability to directly encrypt data, can be used to implement KEMs.\n", - "\n", - "![Figure 3. Key Encapsulation Mechanism](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kem_akc.svg)\n", - "\n", - "*Figure 3. Key Encapsulation Mechanism*" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "0e7f5c76-d6db-4121-84b6-d6fa1c49b3e0", - "metadata": {}, - "source": [ - "## Digital signatures with asymmetric key cryptography\n", - "\n", - "[*Digital signatures*](https://en.wikipedia.org/w/index.php?title=Digital_signature&oldid=1161173191) are another powerful application of asymmetric key cryptography. They provide authentication, integrity, and nonrepudiation enabled by the fact that within AKC, entities possess unique private keys. The basic idea underlying signature protocols is that senders of secure messages will additionally *digitally sign* the messages using their unique private key. The receiver will then verify the digital signature using the public key of the sender. Within AKC, digital signatures can be implemented by using algorithms specifically designed for that purpose or by using generic cryptosystems.\n", - "\n", - "![Figure 4. Digital signatures with asymmetric key cryptography](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_akc.svg)\n", - "\n", - "*Figure 4. Digital signatures with asymmetric key cryptography*\n", - "\n", - "### Dedicated digital signature algorithms\n", - "\n", - "Currently, the US Federal Information Processing Standard (FIPS) for digital signatures is a dedicated scheme simply titled the [*Digital Signature Algorithm*](https://en.wikipedia.org/w/index.php?title=Digital_Signature_Algorithm&oldid=1148950522) (DSA). Somewhat similarly to the Diffie-Hellman protocol, the DSA uses the algebraic properties of the modular exponential and multiplicative inverses for signature generation and verification.\n", - "\n", - "The [elliptic curve digital signature algorithm](https://en.wikipedia.org/w/index.php?title=Elliptic_Curve_Digital_Signature_Algorithm&oldid=1162097661) (ECDSA) is an ECC variant of DSA, providing the same functionality but with significantly shorter keys. This results in improved efficiency, making it a popular choice for systems with [resource constraints](https://doi.org/10.1109/ACCESS.2018.2881444).\n", - "\n", - "Both DSA and ECDSA will be illustrated in more detail later.\n", - "\n", - "### Digital signature schemes using generic cryptosystems\n", - "\n", - "In addition to dedicated algorithms, digital signatures can also be generated using generic asymmetric cryptosystems, such as [RSA](https://en.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&oldid=1163962255).\n", - "\n", - "RSA, which will be discussed in detail in a later section, also exploits modular multiplicative inverses and modular exponentiation as fundamental operations but combines them in a different sequence than DSA. In RSA, the signer typically creates a hash of the message and then encrypts the hash with their private key, creating the digital signature. Any party can then verify this signature by decrypting it with the signer's public key and comparing it with the hashed message." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "4f97da04-c219-4a06-8aca-f5ac91646869", - "metadata": {}, - "source": [ - "## Applications of asymmetric key cryptography\n", - "\n", - "[Asymmetric key cryptography](https://en.wikipedia.org/w/index.php?title=Public-key_cryptography&oldid=1163952916) is ubiquitous in modern digital technology applications. The basic functionalities of AKC described above form the building blocks of many higher-level application protocols, including:\n", - "\n", - "1. **Internet communication:** Secure communication over the internet, such as HTTPS, relies heavily on asymmetric key cryptography. The Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), use asymmetric key cryptography during the initial handshake process to establish a symmetric key, which is then used for the rest of the communication session.\n", - "\n", - "2. **Authentication:** Asymmetric key cryptography is used to create digital signatures, allowing an entity to authenticate a digital document or message as coming from a specific sender. This is used in many scenarios, from verifying software updates to legally binding digital contracts.\n", - "\n", - "3. **Email encryption:** Email encryption protocols such as PGP (Pretty Good Privacy) and its open-source alternative GPG (GNU Privacy Guard) use asymmetric key cryptography to ensure that only the intended recipient can read the email content.\n", - "\n", - "4. **Secure shell (SSH):** SSH is a protocol for secure remote login and other secure network services over an insecure network. It uses asymmetric key cryptography to authenticate the server to the client and, optionally, the client to the server.\n", - "\n", - "5. **VPN (virtual private network):** Asymmetric key encryption is used to establish secure connections in VPNs, ensuring secure communication over public networks.\n", - "\n", - "6. **Blockchain and cryptocurrencies:** Blockchain technologies, including Bitcoin and Ethereum, use asymmetric key cryptography. For example, the ownership of Bitcoin is established through digital signatures using asymmetric key cryptography.\n", - "\n", - "7. **Certificate authorities:** Asymmetric key cryptography is used by certificate authorities (CAs) to issue and sign digital certificates, which are used in TLS communication, code signing, email encryption, and more. A digital certificate binds a public key to a specific entity (for example, a person or server).\n", - "\n", - "![Figure 5. Issuing and signing digital certificates using asymmetric key cryptography](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ca_akc.svg)\n", - "\n", - "*Figure 5. Issuing and signing digital certificates using asymmetric key cryptography*" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "915529ef-0c30-46c2-8235-c041c24aabfb", - "metadata": {}, - "source": [ - "## Security of asymmetric key cryptography\n", - "\n", - "Several cryptographic notions come together to enable secure asymmetric key cryptography, including:\n", - "\n", - "**Private key secrecy**: The most basic security requirement of AKC is that the private key remains secret. However, since the private key must be mathematically linked to the public key, private key secrecy also requires that it be computationally infeasible to derive the private key from knowledge of the public key. Key generation schemes within AKC rely on computationally hard mathematical problems to facilitate this requirement.\n", - "\n", - "**Trapdoor functionality** In AKC, the encryption and decryption operations involve different complementary keys from a single-key pair. Ciphertext generated by encryption using one of the keys (for example the public key) must be inscrutable to third parties while being easily decryptable by the holder of the complementary key (in this case the private key). In other words, encryption should resemble a [*trapdoor one-way function*](https://en.wikipedia.org/w/index.php?title=Trapdoor_function&oldid=1163913265) such that third parties cannot invert the operation and recover the plain text but the private key provides a secret *trapdoor* that enables easy inversion. Popular AKC algorithms use modular exponentiation to set up trapdoor one-way function behavior.\n", - "\n", - "**Randomness**: The key generation process should also exploit randomness to ensure that keys are unpredictable, as any pattern or predictability in key generation could be exploited by an attacker. Randomness is also used for padding during encryption to generate semantically secure ciphertexts and within digital signature schemes to produce unique signatures even when the same message is signed multiple times. For this reason, the use of strong random number generators is an important part of AKC.\n", - "\n", - "**Large key size**: As in the case of SKC, large key sizes ensure protection against brute force attacks. However, since large key sizes also increase the computational cost of the encryption and decryption process, an optimal solution needs to balance security and efficiency considerations. The following table shows typical key sizes for various asymmetric key cryptography protocols and applications:\n", - "\n", - "| Protocol | Typical Key Sizes (in bits) | Application |\n", - "|----------|-------------------------------------|--------------------------------|\n", - "| RSA | 1024 (deprecated), 2048, 3072, 4096 | Encryption, digital signatures |\n", - "| DSA | 1024 (deprecated), 2048, 3072 | Digital signatures |\n", - "| DH | 2048, 3072, 4096 | Key exchange |\n", - "| ECDH | 224, 256, 384, 521 | Key exchange |\n", - "| ECDSA | 224, 256, 384, 521 | Digital signatures |\n", - "\n", - "**Public key infrastructure**: In AKC, the private keys must be kept secret by the owners while the public keys are shared. There needs to be a secure mechanism to manage and distribute these public keys between users. *Public key infrastructure* (PKI) provides a way to do this using *digital certificates*. A digital certificate provides proof of identity of the owner of the public key and is issued by a trusted authority like a certificate authority(which is part of a PKI). Hence, PKI plays an integral part in the security of modern application using AKC by enabling large-scale key management (by creating, managing, distributing and revoking digital certificates).\n", - "\n", - "### Security risks to asymmetric key cryptography\n", - "As outlined in the above table, modern asymmetric key algorithms such as RSA typically employ much larger key sizes than commonly used symmetric key counterparts such as AES-128. Even the ECC-based protocols (ECDH and ECDSA) that have smaller key sizes employ a minimum of at least 224 bits for keys. This in turn implies that a brute force attack involving an exhaustive search of the private key space to identify the correct key is computationally intractable in the foreseeable future. This remains true even if quantum computers were to be deployed for this task. Therefore, attacks against AKC usually focus on exploiting other potential weaknesses of specific cryptosystems. Some well-documented attack modes target:\n", - "\n", - "1. **Algorithmic weakness** by using sophisticated mathematical and computational means to undermine the hardness assumptions used to formulate asymmetric key algorithms. For example, the security of RSA is predicated on the difficulty of factoring large prime numbers, and recent computational advances have [enabled successful factoring of 829-bit RSA keys](https://en.wikipedia.org/w/index.php?title=RSA_Factoring_Challenge&oldid=1163481797). Therefore, 1024-bit RSA is currently deprecated. As will be discussed later, the primary risk posed by quantum computers to AKC also falls into this category.\n", - "\n", - "2. **Imperfect randomness**, which can lead to weakness in the key generation process. For example, if the random number generator used to create the keys is flawed and generates keys that are not truly random, an attacker might be able to predict the keys.\n", - "\n", - "3. **Implementation flaws** such as errors in the implementation of cryptographic algorithms that inadvertently reveal information about the keys. For example, incorrect padding can potentially reveal details about keys.\n", - "\n", - "4. **Side channels** that refer to information leakage from the physical system that performs the cryptography. Such leaks could be in the form of timing information, power consumption, or even sound, which can be exploited in a so-called [*side-channel attack*](https://en.wikipedia.org/w/index.php?title=Side-channel_attack&oldid=1162235564). For example, analyzing how long cryptographic operations take to execute could reveal the number of '1's in a binary key. This seemingly innocent leakage significantly narrows the search space, unveiling potential solutions to problems that initially seemed insurmountable.\n", - "\n", - "5. **Key exchange** by intercepting keys while they are being exchanged, such as within a [*man-in-the-middle* attack](https://en.wikipedia.org/w/index.php?title=Man-in-the-middle_attack&oldid=1164741355) (MITM). The DH protocol is susceptible to MITM attacks if additional authentication steps are not incorporated.\n", - "\n", - "6. **Key storage** by aiming to steal keys from poorly secured storage. This includes physical attacks such as manipulation or theft of storage devices.\n", - "\n", - "Securing asymmetric key cryptosystems against the variety of attacks that are possible is therefore a significant task involving mathematical, hardware, software, logistical, and legal considerations." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "477611e4-f03b-40b4-b440-997d84e227ca", - "metadata": {}, - "source": [ - "## RSA\n", - "\n", - "The [RSA (Rivest-Shamir-Adleman)](https://dl.acm.org/doi/10.1145/359340.359342) algorithm is one of the first public key cryptosystems and is widely used for secure data transmission. It is a versatile cryptosystem in that it provides the necessary operations to enable encryption, decryption, digital signatures, and key exchange within a common framework.\n", - "\n", - "In this section, we will illustrate asymmetric key cryptography (AKC) using RSA through simple examples.\n", - "\n", - "We will use the standard scenario of two parties, Alice and Bob, who wish to communicate securely using AKC.\n", - "\n", - "### The RSA algorithm\n", - "\n", - "The basic RSA algorithm involves four operations: key generation, key distribution, encryption, and decryption:" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "8d2d319c-1e33-4a67-84c5-06761b5c18ad", - "metadata": {}, - "source": [ - "1. **Key generation:**\n", - "\n", - " Public and private keys are generated based on mathematical principles around prime numbers, where calculating them is easy, but the reverse is hard.\n", - "\n", - " We'll refer to these:\n", - " - Public key: $(e, n)$\n", - " - Private key: $(d, n)$\n", - "\n", - " Note that $n$ is common to both public key and private key, and is known as the modulus. We will need to use this later.\n", - "\n", - "\n", - "\n", - "\n", - "\n", - " - Choose two distinct prime numbers, $p$ and $q$.\n", - " - chosen at random (for security).\n", - " - They should be similar in magnitude, but differ in length by a few digits, to make factoring harder.\n", - " - Prime numbers can be efficiently chosen using a primality test.\n", - " - Compute $n = p*q$.\n", - " - $n$ is the modulus for both the public and private keys.\n", - " - Compute the totient $φ$ $(n) = (p-1)*(q-1)$.\n", - " - The totient is meant to be kept secret and typically discarded after key generation.\n", - " - Choose an integer $e$ such that $1 < e < $ $φ$ $(n)$ and $gcd$$(e, $$φ$$(n)) = 1$.\n", - " - that is, $e$ and $φ$$(n)$ should be coprime.\n", - " - This number $e$ forms the public key exponent and is typically chosen as a small number for computational efficiency.\n", - " - The prime number $65537 = 2^{16} + 1$ is often used.\n", - " - Compute $d$ to satisfy the congruence relation $d*e ≡ 1 ($$mod$$φ$$(n))$.\n", - " - That is, $d$ is the multiplicative inverse of $e$ modulo $φ$$(n)$.\n", - " - This is more efficiently computed using the extended Euclidean algorithm.\n", - " - This number $d$ is the private key exponent.\n", - " - The public key consists of $(e, n)$, and the private key is $(d, n)$.\n", - "\n", - " \n", - " " - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "fd9699fd-d69b-4d26-b46d-5e2da902c0ef", - "metadata": {}, - "source": [ - "2. **Key distribution:**\n", - "\n", - " - The public key $(e, n)$ is made public to those who may wish to send a message\n", - " - The private key $(d, n)$ is kept secret." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "bf51a591-0db9-401d-a233-4e8558eacfa5", - "metadata": {}, - "source": [ - "3. **Encryption:**\n", - "\n", - " - Alice wishes to send a message $M$ to Bob. In this case a simple integer\n", - " - Alice uses Bob's public key $(e, n)$ to encrypt the message into ciphertext $C$\n", - "\n", - " \n", - " \n", - "\n", - " - $M$ is an integer $0 ≤ M < n$.\n", - " - $C ≡ M^e (mod n)$, where $C$ is the ciphertext.\n", - "\n", - " \n", - " " - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "0dd1f9b3-85b4-4fb1-84e0-a254e2f47ea9", - "metadata": {}, - "source": [ - "4. **Decryption:**\n", - "\n", - " - Bob receives the ciphertext $C$\n", - " - Bob uses his private key $(d, n)$ to decrypt the message back into message $M$\n", - "\n", - " \n", - " \n", - "\n", - " - $M ≡ C^d (mod n)$.\n", - "\n", - " \n", - " " - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "a765b247-347c-4e57-ae69-1ca4460e83af", - "metadata": {}, - "source": [ - "This is the basic outline of RSA. In practice, [more sophisticated padding schemes](https://en.wikipedia.org/w/index.php?title=Optimal_asymmetric_encryption_padding&oldid=1163481577) are applied to the plain text $M$ before encryption to ensure that equal plain texts result in different ciphertexts. This prevents a range of possible attacks against naive implementations of RSA and enables semantic security." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "297d3348-cc0a-4008-b8af-5022926ba075", - "metadata": {}, - "source": [ - "### Illustration of RSA in Python\n", - "\n", - "In the following code cells, we illustrate a simple example of the RSA algorithm using small integers and then demonstrate practical key distribution and digital signature applications using Python libraries implementing RSA.\n", - "\n", - "\n", - "Note: In this section we will show the math calculations in detail as part of the Python code\n", - "\n", - "\n", - "#### RSA key generation\n", - "\n", - "Let's step through a simple instance of the RSA algorithm employing small prime numbers.\n", - "\n", - "We will need to be able to compute the greatest common divisor of two integers, as it will be needed to test whether two integers are coprime.\n", - "\n", - "We will explain one simple way to calculate this, but it is much more efficient with larger integers to use the `math.gcd` python function." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "1271ecbd-a28c-4f32-8170-742b114de813", - "metadata": {}, - "outputs": [], - "source": [ - "import math\n", - "\n", - "\n", - "# Example function to compute the gcd (greatest common divisor)\n", - "def gcd(a, b):\n", - " if b == 0:\n", - " return a\n", - " else:\n", - " return gcd(b, a % b)\n", - "\n", - "\n", - "# let's calculate some examples using algorithm\n", - "n1 = gcd(50, 10)\n", - "n2 = gcd(99, 33)\n", - "n3 = gcd(59, 9)\n", - "\n", - "# do the same with the python library call\n", - "\n", - "m1 = math.gcd(50, 10)\n", - "m2 = math.gcd(99, 33)\n", - "m3 = math.gcd(59, 9)\n", - "\n", - "# Confirm they are the same\n", - "assert n1 == m1\n", - "assert n2 == m2\n", - "assert n3 == m3\n", - "\n", - "# They are - print out the values for explanation\n", - "print(\"gcd(50,10) =\", m1)\n", - "print(\"gcd(99,33) =\", m2)\n", - "print(\"gcd(59,9) =\", m3)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "e71a09cc-dec8-43ff-b718-a3ef48964f2f", - "metadata": {}, - "source": [ - "The first phase of the RSA workflow is key generation. This is initiated by choosing two prime numbers, which are meant to be kept secret by the entity generating the keys." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "f3b3d377-36b4-4ef8-b31b-ebf409455530", - "metadata": {}, - "outputs": [], - "source": [ - "# Choosing two prime numbers and keep them secret\n", - "p = 13\n", - "q = 19\n", - "print(\"The secret prime numbers p and q are:\", p, q)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "11c13f16-614c-4235-a97a-3c147441c162", - "metadata": {}, - "source": [ - "Next, the modulus $n$, which is simply the product of the two chosen primes, is computed. This modulus will be published as part of the public key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "3bd695c3-cc01-4b23-8a18-ddee37332807", - "metadata": {}, - "outputs": [], - "source": [ - "# Calculate n which is the modulus for both the public and private keys\n", - "n = p * q\n", - "print(\"modulus n (p*q)=\", n)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "af82b459-060d-41c1-9cca-7fe47d94489f", - "metadata": {}, - "source": [ - "The Euler totient function $\\varphi(n)$ is computed next, as it is needed for the modular multiplicative inverse operation used to determine the keys in RSA. $phi$ is also kept secret and typically discarded after key generation." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "194587d4-c5e7-4db2-b956-d53acdeec698", - "metadata": {}, - "outputs": [], - "source": [ - "# Compute Euler's totient function, φ(n) and keep it secret\n", - "phi = (p - 1) * (q - 1)\n", - "print(\"The secret Euler's function (totient) [phi(n)]:\", phi)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "f6af228b-7065-4cc6-bb05-f84fdfda17c4", - "metadata": {}, - "source": [ - "We are now ready to calculate the public and private keys. In RSA, each of these is specified by a tuple of two integers. The first entry in each tuple is a distinct integer, and the second entry is the modulus $n$ that is common to both keys.\n", - "\n", - "The first entry in the public key can be any integer greater than 1 that is coprime to $phi$. Two integers are coprime if their greatest common divisor is 1. So we use the `math.gcd` function find an integer $e$ coprime to $phi$." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "8ca9a7fa-422b-4ce9-82fe-cc7c13193000", - "metadata": {}, - "outputs": [], - "source": [ - "# Choose an integer e such that e and φ(n) are coprime\n", - "e = 2\n", - "while e < phi:\n", - " if math.gcd(e, phi) == 1:\n", - " break\n", - " else:\n", - " e += 1\n", - "print(\"Public Key (e):\", e)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "30b1652e-37fb-425e-bc57-645bfc588226", - "metadata": {}, - "source": [ - "The private key requires an integer $d$, which is the multiplicative inverse of $e$ modulo $phi$; that is, it satisfies the congruency relation $d*e\\equiv 1 \\pmod{\\varphi(n)}$. For this simple illustration where we are dealing with small integers, we can just loop over the positive integers to locate a suitable $d$. In realistic settings, the computationally efficient extended Euclidean algorithm is used for this purpose." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "f06a3674-573c-494b-9fae-c521a1e48441", - "metadata": {}, - "outputs": [], - "source": [ - "# Compute a value for d such that (d * e) % φ(n) = 1\n", - "d = 1\n", - "while True:\n", - " if (d * e) % phi == 1:\n", - " break\n", - " else:\n", - " d += 1\n", - "print(\"Private Key (d):\", d)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "d324a6b3-f955-48e7-be1b-1390d14529d9", - "metadata": {}, - "source": [ - "We now form the tuples $(e, n), (d, n)$, which form the public and private keys respectively. The public key is then published, while the private key is kept secret." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "363c54ea-1058-4960-909c-fcd10d7fb6c3", - "metadata": {}, - "outputs": [], - "source": [ - "# Public and Private Key pair\n", - "public = (e, n)\n", - "private = (d, n)\n", - "\n", - "print(f\"The Public key is {public} and Private Key is {private}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "951c8871-ab61-46d4-bb79-3dcde66c1312", - "metadata": {}, - "source": [ - "Encryption and decryption in RSA use the [modular exponentiation operation](https://en.wikipedia.org/w/index.php?title=Modular_exponentiation&oldid=1160764843). Further, the public and private keys are complementary in that either can be used to encrypt a message that the other can then decrypt.\n", - "\n", - "Here we illustrate the case where the public key $(e,n)$ is used for encryption and the private key $(d, n)$ is used for decryption by defining a Python function for each operation.\n", - "\n", - "We then encrypt and decrypt an integer message $msg$." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "e4965786-538b-481e-8bff-7c3e1e4f87b0", - "metadata": {}, - "outputs": [], - "source": [ - "# Encryption function\n", - "def encrypt(plain_text):\n", - " return (plain_text**e) % n\n", - "\n", - "\n", - "# Decryption function\n", - "def decrypt(cipher_text):\n", - " return (cipher_text**d) % n\n", - "\n", - "\n", - "# Simple message to encode\n", - "msg = 9\n", - "\n", - "# encrypt then decrypt\n", - "enc_msg = encrypt(msg)\n", - "dec_msg = decrypt(enc_msg)\n", - "\n", - "print(\"Original Message:\", msg)\n", - "print(\"Encrypted Message:\", enc_msg)\n", - "print(\"Decrypted Message:\", dec_msg)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "1ae6b258-a18d-469f-a2fd-771eb598d46b", - "metadata": {}, - "source": [ - "While the small integers used above are useful to easily outline the core ideas in the RSA algorithm, in real applications RSA requires the use of very large integers. For example, 2048-bit RSA involves the use of a modulus $n$ that is 2048 bits long, the decimal integer equivalents of which are around 10$^616$. These truly enormous numbers are necessary for the practical security of RSA." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "0eaa302d-959e-47c0-9818-907ba77f93d5", - "metadata": {}, - "source": [ - "#### Symmetric key exchange with RSA\n", - "As discussed previously, AKC enables two parties who wish to communicate to securely establish a *shared secret*, which can be used, for instance, as the secret key for subsequent symmetric encryption of bulk plain text.\n", - "\n", - "Let us consider the following scenario. Alice and Bob want to use SKC to encrypt and decrypt messages. However, before this process can be initialized, they need to agree on a common secret key. One option is for one party — say, Alice — to generate a secret key and then securely transmit it to Bob. To achieve this secure transfer, Alice decides to use RSA as the key encapsulation mechanism (KEM).\n", - "\n", - "This involves the following steps:\n", - "\n", - "- First, Alice generates a random symmetric key, which she intends to share with Bob.\n", - "- Then, Bob generates an asymmetric key pair and makes his public key available on a suitable channel.\n", - "- Next, Alice uses Bob's public key to encrypt the symmetric key, thus encapsulating it in a ciphertext.\n", - "- Then, Alice broadcasts the ciphertext over a reliable but not necessarily secure channel.\n", - "- Finally, Bob receives the ciphertext and decrypts it using his private key. He now has access to the symmetric key generated by Alice.\n", - "\n", - "![Figure 1. Symmetric key exchange with RSA](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_rsa.svg)\n", - "\n", - "*Figure 1. Symmetric key exchange with RSA*\n", - "\n", - "##### Padding-based key-exchange example in Python\n", - "A practical workflow utilizing RSA for padding-based non-interactive key exchange is now illustrated using the ``cryptography`` Python library.\n", - "\n", - "Import necessary modules from the ``cryptography`` Python library. If needed, this library can be installed using the command ``pip install cryptography``.\n", - "\n", - "Alice then generates a random secret key, which she intends to transmit to Bob." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "aa43e3a6-0a3b-43e1-8107-681cc213f8c2", - "metadata": {}, - "outputs": [], - "source": [ - "# pip install cryptography\n", - "from cryptography.hazmat.primitives import serialization\n", - "from cryptography.hazmat.primitives.asymmetric import rsa, padding\n", - "from cryptography.fernet import Fernet\n", - "from cryptography.hazmat.primitives import hashes\n", - "\n", - "symmetric_key = Fernet.generate_key()\n", - "print(f\"\\nSymmetric key generated by Alice: {symmetric_key}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "fb85d765-ed84-48c9-aa6e-e66045b56d88", - "metadata": {}, - "source": [ - "Using the ``rsa`` module from the ``cryptography`` library, Bob generates a key pair and then broadcasts his public key. Any one can intercept the public key and read off the public numbers $(e,n)$ that form the key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "ba720fa7-4e64-4512-a8cc-7d91890a234c", - "metadata": {}, - "outputs": [], - "source": [ - "# Bob generates a 2048-bit RSA key pair\n", - "bob_private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)\n", - "bob_public_key = bob_private_key.public_key()\n", - "print(f\"Public key broadcast by Bob: {bob_public_key}\")\n", - "print(f\"\\nPublic numbers in Bobs' public key: {bob_public_key.public_numbers()}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "26e79459-a342-441a-8796-45238e6497b8", - "metadata": {}, - "source": [ - "At this point, we assume Alice has received the public key broadcast by Bob. Alice's ``symmetric_key`` above can now be encrypted using Bob's public key to produce the ciphertext. In a realistic setting, Alice will also use additional padding methods such as [OAEP](https://en.wikipedia.org/w/index.php?title=Optimal_asymmetric_encryption_padding&oldid=1163481577) to ensure semantic security for her communications with Bob." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "a658b769-c9f9-4f89-bccf-fa5d6df7129a", - "metadata": {}, - "outputs": [], - "source": [ - "# Encryption\n", - "ciphertext = bob_public_key.encrypt(\n", - " symmetric_key,\n", - " padding.OAEP(\n", - " mgf=padding.MGF1(algorithm=hashes.SHA256()),\n", - " algorithm=hashes.SHA256(),\n", - " label=None,\n", - " ),\n", - ")\n", - "\n", - "print(\"Ciphertext:\", ciphertext)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "e484d511-a0b2-48f4-bd16-fcb8f04507aa", - "metadata": {}, - "source": [ - "Alice then broadcasts the ciphertext over an open channel, confident that only Bob with the corresponding private key will be able to decrypt it. We assume Bob has received the ciphertext and can now decrypt it using his confidential private key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "36985020-926b-4d9b-b2ea-dbc18f5a1778", - "metadata": {}, - "outputs": [], - "source": [ - "# Bob decrypts ciphertext to access the symmetric key\n", - "decrypted_symmetric_key = bob_private_key.decrypt(\n", - " ciphertext,\n", - " padding.OAEP(\n", - " mgf=padding.MGF1(algorithm=hashes.SHA256()),\n", - " algorithm=hashes.SHA256(),\n", - " label=None,\n", - " ),\n", - ")\n", - "\n", - "print(\"Decrypted key:\", decrypted_symmetric_key)\n", - "assert decrypted_symmetric_key == symmetric_key" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "4ba282d0-d9d3-4083-aa24-2a38c73583a7", - "metadata": {}, - "source": [ - "At this point, Alice and Bob both have access to the secret symmetric key, which they can use for SKC applications." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "ba9f62a9-cb02-4fe9-83d7-ced7cd916f9d", - "metadata": {}, - "source": [ - "##### Simulating a Key Encapsulation Mechanism with RSA in Python\n", - "In the following workflow, we illustrate the use of RSA to simulate a Key Encapsulation Mechanism (KEM) whereby a sufficiently long random secret message is securely exchanged and subsequently converted into a shared-secret of the appropriate length using a KDF.\n", - "\n", - "Once again Alice and Bob want to establish a shared secret non-interactively and Alice is the party that decides which secret to use.\n", - "\n", - "We start by importing some necessary Python libraries.\n", - "\n", - "Bob then generates his RSA key pair and broadcasts his public key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "1dcd5bed-0f61-4595-a426-0565629661e8", - "metadata": {}, - "outputs": [], - "source": [ - "from cryptography.hazmat.primitives.asymmetric import rsa, padding\n", - "from cryptography.hazmat.primitives.kdf.hkdf import HKDF\n", - "from cryptography.hazmat.primitives import hashes\n", - "from os import urandom\n", - "\n", - "# Bob's RSA key pair\n", - "private_key_Bob = rsa.generate_private_key(public_exponent=65537, key_size=2048)\n", - "public_key_Bob = private_key_Bob.public_key()\n", - "\n", - "print(\"Bob's private and public keys created\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "4bb2fe86-cc7c-4a48-a79b-0ea998dc8036", - "metadata": {}, - "source": [ - "Alice first generates a long random secret from which the shared secret will be eventually derived. In a pure [KEM](https://en.wikipedia.org/w/index.php?title=Key_encapsulation_mechanism&oldid=1110687965), the long secret will be a random element from the algebraic structure underlying the cryptosystem. In the case of 2048-bit RSA, this would be a random integer modulo the 2048-bit RSA modulus. As such a pure KEM does not require additional padding but in this example we are only simulating a KEM using RSA and the `cryptography` library requires the use of padding when encrypting with RSA. So we will use a somewhat shorter long secret which nevertheless is much longer than a standard 256-bit AES key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "83a786d0-c0a4-4442-9771-6a3d92f2ee02", - "metadata": {}, - "outputs": [], - "source": [ - "Alice_long_secret = urandom(160) # A 160 byte or 1280 bit random message\n", - "print(\"Alice's secret created\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "bc8356ca-443a-4239-aa00-3cb27c9d69be", - "metadata": {}, - "source": [ - "Next Alice encrypts the long secret using Bob's public key and the encrypted secret is communicated to Bob." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "0c88cd97-464c-492f-a4ed-95d18a32ecd8", - "metadata": {}, - "outputs": [], - "source": [ - "Alice_encrypted_secret = public_key_Bob.encrypt(\n", - " Alice_long_secret,\n", - " padding.OAEP(\n", - " mgf=padding.MGF1(algorithm=hashes.SHA256()),\n", - " algorithm=hashes.SHA256(),\n", - " label=None,\n", - " ),\n", - ")\n", - "print(\"Alice's secret encrypted\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "8d6b0921-39ad-4acb-82cb-f18411cbab9c", - "metadata": {}, - "source": [ - "Bob decrypt's the encrypted secret received from Alice using his private key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "c96cd5c7-14ca-40b7-b8bf-0911a239c820", - "metadata": {}, - "outputs": [], - "source": [ - "Bob_decrypted_secret = private_key_Bob.decrypt(\n", - " Alice_encrypted_secret,\n", - " padding.OAEP(\n", - " mgf=padding.MGF1(algorithm=hashes.SHA256()),\n", - " algorithm=hashes.SHA256(),\n", - " label=None,\n", - " ),\n", - ")\n", - "\n", - "assert Alice_long_secret == Bob_decrypted_secret, \"Secrets do not match!\"\n", - "\n", - "# if we get here they match\n", - "print(\"Secrets match\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "f14540de-abb5-48db-b10b-c5ab14a3fea6", - "metadata": {}, - "source": [ - "Finally both Alice and Bob separately apply an agreed upon [Key Derivation Function](https://en.wikipedia.org/w/index.php?title=Key_derivation_function&oldid=1165650237) (KDF) on the long secret to derive the symmetric key.\n", - "\n", - "Note that the process involves a hashing protocol and the use of a random *salt* which ensures uniqueness and unpredictability of the shared symmetric key in case the long secret is ever reused (not recommended). However the *salt* itself does not have to be secret and once it is randomly generated, say by Alice in this example, it can be broadcasted to Bob alongside the encrypted long secret.\n", - "\n", - "We will assume therefore that both Alice and Bob have access to the same random *salt*." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "c5e92a33-2ba6-440b-93b3-59612a4aeaff", - "metadata": {}, - "outputs": [], - "source": [ - "def key_derivation_function(secret, salt):\n", - " hkdf = HKDF(\n", - " algorithm=hashes.SHA256(),\n", - " length=32, # Desired key length\n", - " salt=salt,\n", - " info=None,\n", - " backend=None,\n", - " )\n", - " return hkdf.derive(secret)\n", - "\n", - "\n", - "common_salt = urandom(16) # Random salt accessible to both Alice and Bob\n", - "\n", - "symmetric_key_Alice = key_derivation_function(Alice_long_secret, common_salt)\n", - "symmetric_key_Bob = key_derivation_function(Bob_decrypted_secret, common_salt)\n", - "\n", - "assert symmetric_key_Alice == symmetric_key_Bob, \"Derived keys do not match!\"\n", - "print(\n", - " f\"A symmetric key of length {len(symmetric_key_Alice)*8} bits was successfully derived by both Alice and Bob!\"\n", - ")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "aa2e3da1-7a2e-4357-b853-167f821d65b0", - "metadata": {}, - "source": [ - "#### Digital signatures with RSA\n", - "We will now extend the above confidential communication scenario with Alice and Bob to one that also includes validation with the help of a [digital signature](https://en.wikipedia.org/w/index.php?title=Digital_signature&oldid=1161173191).\n", - "\n", - "As before, Alice will confidentially send a message encapsulating a symmetric key to Bob, but she will also digitally sign the message so that Bob, upon receiving the message, can verify that it was Alice who originated it and that the contents of the message were not tampered with during transmission.\n", - "\n", - "More generally, it is desirable to enable validation without compromising confidentiality whereby any interested party is able to verify the integrity, authenticity, and establish non-repudiation with respect to a given communication, even if that party does not have access to the actual plain text message.\n", - "\n", - "We will consider this general setting which then involves the following steps:\n", - "\n", - "- First, both Bob and Alice make their public keys available over an open channel.\n", - "- Then, Alice encrypts the plain text using Bob's public key, creating a ciphertext.\n", - "- Next, Alice creates a hash of the ciphertext with a *hash function* and further encrypts the resulting hashed ciphertext using her private key. This encrypted hash is the *signature*.\n", - "- Then, Alice then transmits both the ciphertext and the signature over an open channel.\n", - "- Then, Bob uses Alice's public key to decrypt the signature, revealing the hashed ciphertext.\n", - "- Next, since Bob also has access to the ciphertext itself, he uses the same hash function used by Alice to recreate a second instance of the hashed ciphertext. If the latter matches the one obtained by decrypting Alice's signature, then the message is validated, even though the ciphertext itself has not yet been decrypted.\n", - "- Finally, Bob, having validated the message, decrypts the ciphertext using his own private key.\n", - "\n", - "![Figure 2. Digital signatures with RSA](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_rsa.svg)\n", - "\n", - "*Figure 2. Digital signatures with RSA*\n", - "\n", - "This workflow for a digital signature is illustrated next.\n", - "\n", - "We once again import some useful modules from the ``cryptography`` library." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "4ab081be-3d1d-4513-80b6-df0fe69afbd0", - "metadata": {}, - "source": [ - "As before, Alice intends to securely send a symmetric key to Bob, but she also wishes to digitally sign it. In this case, we need public keys for both Alice and Bob. Therefore, the first step is for both Alice and Bob to create their own key pair using RSA and broadcast their own public key to the world." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "bb0cb967-c809-42fe-b4fb-ebaca4abb111", - "metadata": {}, - "outputs": [], - "source": [ - "from cryptography.hazmat.primitives import hashes\n", - "from cryptography.hazmat.primitives.asymmetric import padding, rsa\n", - "from cryptography.hazmat.primitives.asymmetric.utils import Prehashed\n", - "\n", - "# Generate keys for Bob\n", - "bob_private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)\n", - "bob_public_key = bob_private_key.public_key()\n", - "\n", - "# Generate keys for Alice\n", - "alice_private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)\n", - "alice_public_key = alice_private_key.public_key()\n", - "\n", - "print(\"Private and Public keys generated for Bob and Alice.\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "5cae7a5e-abd6-47e4-88c5-552406de55ff", - "metadata": {}, - "source": [ - "In the next step, as before, Alice uses Bob's public key to encrypt the symmetric key and prepares the ciphertext." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "96f5f405-718b-4c83-b7c4-53a77030dc24", - "metadata": {}, - "outputs": [], - "source": [ - "# Alice encrypts the message using Bob's public key\n", - "ciphertext = bob_public_key.encrypt(\n", - " symmetric_key,\n", - " padding.OAEP(\n", - " mgf=padding.MGF1(algorithm=hashes.SHA256()),\n", - " algorithm=hashes.SHA256(),\n", - " label=None,\n", - " ),\n", - ")\n", - "\n", - "print(\"ciphertext of symmetric key: \", ciphertext)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "3e43436f-41f9-4bd5-9a66-4271d3f6e15c", - "metadata": {}, - "source": [ - "At this stage, instead of just broadcasting the ciphertext, Alice intends to attach a digital signature to it so that she can prove to Bob that she was the sender of the message. This is done in two steps:\n", - "\n", - "1. Create a hash of the ciphertext using a hashing algorithm.\n", - "2. Encrypt the hash using Alice's private key, which amounts to a signature." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "da5af4fc-db08-4262-b1b6-4cdf799e8d69", - "metadata": {}, - "outputs": [], - "source": [ - "# Alice signs the ciphertext using her private key\n", - "digest = hashes.Hash(hashes.SHA256())\n", - "digest.update(ciphertext)\n", - "hash_to_sign = digest.finalize()\n", - "\n", - "signature = alice_private_key.sign(\n", - " hash_to_sign,\n", - " padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH),\n", - " Prehashed(hashes.SHA256()),\n", - ")\n", - "\n", - "print(\"signature: \", signature)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "07ee5026-4ee6-46e7-b8dc-ff704b1edd9c", - "metadata": {}, - "source": [ - "Alice then broadcasts the ciphertext and the signature over a network so that Bob is able to intercept both of them." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "b58e4efa-984d-4db1-84cb-d1e34f825b14", - "metadata": {}, - "outputs": [], - "source": [ - "# Bob receives the ciphertext and signature\n", - "received_ciphertext = ciphertext\n", - "received_signature = signature\n", - "\n", - "# Send signature and ciphertext here\n", - "print(\"Sending ciphertext and signature.....\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "d19c3a48-32db-400f-8a97-0c0a12ef4053", - "metadata": {}, - "source": [ - "On Bob's side, the first task is to verify the integrity and authenticity of the ciphertext. To do this, Bob creates a hash of the received ciphertext using the same hashing algorithm used by Alice." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "09fd99c2-472c-41e3-aa1e-f1e160f641e0", - "metadata": {}, - "outputs": [], - "source": [ - "# Bob creates a hash of the ciphertext using the same algorithm used by Alice\n", - "digest = hashes.Hash(hashes.SHA256())\n", - "digest.update(received_ciphertext)\n", - "hash_to_verify = digest.finalize()\n", - "\n", - "print(\"hash to verify: \", hash_to_verify)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "f573e002-7901-43b9-90f1-2a53fa3ee9a2", - "metadata": {}, - "source": [ - "Then, Bob decrypts the received signature using Alice's public key. Because Alice used her private key to create the signature, Bob is able to decrypt it using Alice's public key. The decrypted signature is nothing but a hash of the ciphertext created on Alice's end. If the hash created by Bob matches the decrypted signature, then Bob has verified that the ciphertext he received has not been tampered with and that it was Alice who signed the ciphertext.\n", - "\n", - "In the Python code below, these operations are combined into a useful utility function called ``verify`` provided by an object associated with Alice's public key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "3b90a31c-d4bb-4950-8e8d-d57d6f778028", - "metadata": {}, - "outputs": [], - "source": [ - "from cryptography.exceptions import InvalidSignature\n", - "\n", - "\n", - "def is_signature_valid(public_key, signature, data_hash):\n", - " try:\n", - " public_key.verify(\n", - " signature,\n", - " data_hash,\n", - " padding.PSS(\n", - " mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH\n", - " ),\n", - " Prehashed(hashes.SHA256()),\n", - " )\n", - " return True\n", - " except InvalidSignature:\n", - " return False\n", - "\n", - "\n", - "if is_signature_valid(alice_public_key, received_signature, hash_to_verify):\n", - " print(\"The signature is valid.\")\n", - "else:\n", - " print(\"The signature is not valid.\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "1267bda4-1659-4aab-8401-a1e240977941", - "metadata": {}, - "source": [ - "Having verified the integrity and authenticity of the received ciphertext, Bob can then decrypt it using his private key because Alice created the ciphertext using Bob's public key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "d733a450-ab2b-4a90-b237-06da6132db66", - "metadata": {}, - "outputs": [], - "source": [ - "# Bob decrypts the message using his private key\n", - "decrypted_message = bob_private_key.decrypt(\n", - " received_ciphertext,\n", - " padding.OAEP(\n", - " mgf=padding.MGF1(algorithm=hashes.SHA256()),\n", - " algorithm=hashes.SHA256(),\n", - " label=None,\n", - " ),\n", - ")\n", - "\n", - "print(\"Decrypted message:\", decrypted_message.decode())" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "54d56a0a-c68c-4fe9-8123-176615aca73a", - "metadata": {}, - "source": [ - "In the above digital signature scenario, any party — not just Bob — can verify that Alice is the sender of the ciphertext because everyone can access Alice's public key, the ciphertext, and the digital signature. Furthermore, after sending the ciphertext and the signature, Alice cannot later deny having done so because the signature can be decrypted to a meaningful hash using only her public key. This establishes non-repudiation.\n", - "\n", - "By enabling secure key distribution and supporting non-repudiation, public key cryptography establishes a strong foundation for secure digital communication." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "97f45c36-a024-4ad9-b025-3854e10654de", - "metadata": {}, - "source": [ - "## Breaking RSA\n", - "\n", - "The utility and security of the RSA algorithm outlined above rests on two mathematical assumptions:\n", - "\n", - "1. Finding the modular multiplicative inverse $d$ given that access only to $(e, n)$ is computationally infeasible.\n", - "\n", - "2. In the RSA setting, the modular exponentiation operation behaves like a one-way trapdoor function. When used for encryption, it yields ciphertext that is inscrutable, and without access to the private key, inverting the operation to recover the plain text from the ciphertext is not feasible. However, with access to the private key, which acts as a trapdoor, the ciphertext can be easily decrypted.\n", - "\n", - "The most prominent attack on the RSA algorithm aims to undermine assumption 1 by efficiently recovering the private key number $d$ via factorizing the modulus $n$. As will be illustrated below, it is easy to recover $d$ if one has access to either the prime factors $p$ and $q$ of $n$ or the totient $φ$$(n)$. Recall that $p$, $q$, and $φ$$(n)$ are kept secret during key generation and discarded after. A third party that recovers this information using a classical or quantum computer essentially uncovers the private key, breaking RSA. Thus, prime factorization is the key computational primitive necessary for breaking RSA." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "80cbdd40-5892-42a4-a5b3-e13da1e655cc", - "metadata": {}, - "source": [ - "### Classical computing and RSA\n", - "\n", - "Prime factorization of large integers is known to exhibit super-polynomial or subexponential scaling on classical computers. The best-known classical algorithm for factoring integers larger than $10^{100}$ is the *general number field sieve* [(GNFS)](https://en.wikipedia.org/w/index.php?title=General_number_field_sieve&oldid=1151781536)\n", - "\n", - "\n", - "\n", - "\n", - "\n", - "$L_n[\\frac{1}{3}, (\\frac{64}{9})^{(\\frac{1}{3})}] = e^{[((\\frac{64}{9})^{(\\frac{1}{3})} + o(1)) (log(n))^{\\frac{1}{3}}(log(log(n))^{\\frac{2}{3}})]}$\n", - "\n", - "as a function of the integer $n$ to be factorized.\n", - "\n", - "This scaling is super-polynomial in the number of bits required to represent $n$.\n", - "\n", - "Therefore, prime factorization is considered inefficient on classical computers.\n", - "\n", - "\n", - "\n", - "\n", - "At present, the [largest integers factored on classical hardware](https://en.wikipedia.org/w/index.php?title=RSA_Factoring_Challenge&oldid=1163481797) are in the range of 829 bits or 250 decimal digits. Given the exponential growth in classical computing power that has been witnessed over the last several decades, 1024-bit RSA is no longer considered secure in the near term and is now deprecated. Nevertheless, in the foreseeable future, factoring 2048-bit integers whose magnitude are in the range of $10^{617}$ is at present considered infeasible on classical systems, suggesting continued viability. The advent of quantum computers, however, voids this assessment." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "06920f9e-6912-4bb4-869c-d998c81921fd", - "metadata": {}, - "source": [ - "### Shor's quantum algorithm and RSA\n", - "\n", - "Probably the most well-known quantum algorithm today is Shor's algorithm for finding the prime factors of integers. When [introduced by Peter Shor in 1994](https://doi.org/10.1109/SFCS.1994.365700), it was recognized as the first quantum algorithm that offered a super-polynomial speedup relative to classical algorithms on a problem of great practical importance, namely prime factorization.\n", - "\n", - "Shor's algorithm can factor primes with $O(n^2)$ where $n$ is the number of bits." - ] - }, - { - "cell_type": "markdown", - "id": "9c34e60f-2da7-4824-8e64-04a0bb488a72", - "metadata": {}, - "source": [ - "\n", - "\n", - "\n", - "In the context of RSA, Shor's algorithm works by exploiting the periodicity of the modular exponential function $f(x) = a^x (mod~n)$ and provides a quantum period-finding primitive that enables efficient prime factorization of the modulus $n$.\n", - "\n", - "A simplified high-level outline of Shor's overall scheme for breaking RSA is as follows:\n", - "\n", - "1. Given the modulus $n$, which is published as part of the public key, choose a number $a$ coprime to $n$ that is, $gcd(a,n) = 1$. Since we know that $n = p*q$ has exactly two prime factors $(p, q)$, almost any number less than $n$ that we pick at random is likely to be coprime to $n$.\n", - "\n", - "2. Having chosen $a$, find the exponent $r$ such that $a^r \\equiv 1 (mod~n)$. This implies $a^r - 1 \\equiv 0 (mod~n)$. The existence of an exponent $r$ such that the above congruence holds is guaranteed by the periodicity property of modular exponentiation.\n", - "\n", - "3. If $r$ is even, $a^r - 1 \\equiv 0 (mod~n) \\implies (a^{r/2} - 1) (a^{r/2} + 1) = \\gamma*n$ for some integer $\\gamma$. The left-hand side of this latter equality must contain $p$ and $q$ as two of its prime factors since the right-hand side does. If $r$ is odd, go back to step 1 and try a different choice for $a$.\n", - "\n", - "4. Use the extended Euclid algorithm for finding $gcd((a^{r/2} - 1), n)$ or $gcd((a^{r/2} + 1), n)$. The computed GCDis very likely to identify one of the prime factors $p$ or $q$. Divide $n$ with this prime factor to recover the other.\n", - "\n", - "5. Once $p, q$ are known, use the steps from the original RSA algorithm for reconstructing the totient $\\phi(n)$ and generating the private key number $d$ as the modular inverse of the known public key number $e$.\n", - "\n", - "\n", - "" - ] - }, - { - "cell_type": "markdown", - "id": "a2182923-8b36-41ec-b7d7-9048608bd65f", - "metadata": {}, - "source": [ - "In August 2023 Oded Regev [published an improvement](https://doi.org/10.48550/arXiv.2308.06572) on Shor's original using a multi-dimensional approach resulting in $O(n^{1.5})$. There continues to be further research including by [Ragavan and Vaikuntanathan](https://doi.org/10.48550/arXiv.2310.00899) in this area which may improve time, cost, or number of qubits needed. Whilst we cannot say when running such algorithms against real-world RSA encryption truly becomes viable, it is becoming closer all the time." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "88969e58-f287-4797-9fc8-ac60ca59002e", - "metadata": {}, - "source": [ - "#### Python example demonstrating breaking RSA encryption\n", - "\n", - "In the following code cells, we illustrate an example of finding a private key given only the public key. This will use brute-force classical computation, but shows how Shor's algorithm could be used - including large keys.\n", - "\n", - "\n", - "In this section we will show the math calculations in detail as part of the Python code\n", - "\n", - "\n", - "In the example, we have a public key $(5, 247)$, and we will recover the private key.\n", - "\n", - "**Step 1:** The first step is to pick a number coprime to 247. Almost any number we guess will do the job. Let's pick 6." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "000f327d-7f76-47eb-83c1-127aea4fad25", - "metadata": {}, - "outputs": [], - "source": [ - "n = 247 # the modulus\n", - "e = 5 # public key number\n", - "a = 6 # an integer coprime to n\n", - "assert gcd(a, n) == 1\n", - "print(f\"Checked {n} and {a} are coprime\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "1f992fae-2be5-4fd2-8d77-a89b902dd157", - "metadata": {}, - "source": [ - "**Step 2:** Next we need to find the period $r$ such that $6^r \\equiv 1 (mod~247)$. In this example, we compute $r$ classically using brute force, but we could also use Shor's algorithm on a quantum computer using Qiskit." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "cbc925cb-8d4d-41e8-8821-3222cf305b19", - "metadata": {}, - "outputs": [], - "source": [ - "r = 0\n", - "rem = 100\n", - "while rem != 1:\n", - " r += 1\n", - " rem = (a**r) % n\n", - "\n", - "print(f\"period r is: {r}\")\n", - "assert a**r % n == 1\n", - "\n", - "print(f\"Checked {a}^{r} mod {n} is 1\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "05a74e48-b5ec-42de-8b51-b363ef721141", - "metadata": {}, - "source": [ - "**Step 3:** Since the period $r = 36$ is even, we can compute $f1 = (a^{r/2}-1), f2=(a^{r/2}+1)$." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "bd773c77-45df-458c-9401-3f3ee0267b34", - "metadata": {}, - "outputs": [], - "source": [ - "# explicitly use as integer\n", - "f1 = int(a ** (r / 2) - 1)\n", - "f2 = int(a ** (r / 2) + 1)\n", - "\n", - "print(f\"f1 = {f1}\")\n", - "print(f\"f2 = {f2}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "592fd0f1-cf82-4aaf-ab3e-5dca789ebe28", - "metadata": {}, - "source": [ - "**Step 4:** Find the GCD of either of those factors with $n$. Simply divide $n$ with the prime factor already found to obtain the second prime factor." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "85e5bd52-a485-410b-8620-5a1d518ec605", - "metadata": {}, - "outputs": [], - "source": [ - "q_found = gcd(f1, n)\n", - "print(f\"One possible prime factor of n ({n}) is: {q_found}\")\n", - "\n", - "# explicit int (to avoid floating point)\n", - "p_found = int(n / q_found)\n", - "print(f\"The second prime factor of n ({n}) is: {p_found}\")\n", - "\n", - "assert n == p_found * q_found" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "76f9d3a2-ed2a-45bf-9c3f-ad72ca517ddc", - "metadata": {}, - "source": [ - "**Step 5:** Having recovered the prime factors of $n = 247$ as $p_{found}=13$ and $q_{found}=19$, we compute the totient $\\phi_{found} = (p_{found}-1)*(q_{found}-1)$.\n", - "\n", - "The private key is the modular inverse of the public key number $e=5$." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "79a621f6-21a0-46da-830b-477f7218c9ef", - "metadata": {}, - "outputs": [], - "source": [ - "# Compute the totient\n", - "phi_found = (p_found - 1) * (q_found - 1)\n", - "print(f\"The totient is: {phi_found}\")\n", - "\n", - "# Recover the private key number d_found by satisfying (d_found * e) % phi_found = 1\n", - "d_found = 1\n", - "while True:\n", - " if (d_found * e) % phi_found == 1:\n", - " break\n", - " else:\n", - " d_found += 1\n", - "print(\"Private Key number:\", d_found)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "b9238d24-5998-4e94-8420-8c9ac90bb6f3", - "metadata": {}, - "source": [ - "In the above scheme, step 2 is the crucial period-finding operation for which [Shor's algorithm](https://en.wikipedia.org/w/index.php?title=Shor%27s_algorithm&oldid=1164409434) uses two fundamental quantum primitives, namely the *quantum Fourier transform* and *quantum phase estimation*. For a detailed explanation of the quantum aspects of Shor's algorithm, see the Phase estimation and factoring lesson in the [Fundamentals of Quantum Algorithms](/learning/courses/fundamentals-of-quantum-algorithms). Steps 1 and 3 through 5 involve relatively inexpensive operations that can be easily carried out on classical computers.\n", - "\n", - "Optionally, here's a detailed visual walkthrough of implementing [Shor's algorithm](https://www.youtube.com/watch?v=EdJ7RoWcU48&t=325s).\n", - "\n", - "On quantum computers, Shor's algorithm can exhibit polylogarithmic scaling as favorable as $O((log~n)^2 (log~log~n))$ in terms of the modulus $n$, or polynomial scaling in terms of the number of bits needed to represent $n$. This is a super-polynomial speedup compared to the classical GNFS algorithm.\n", - "\n", - "[Recent resource estimates](https://quantum-journal.org/papers/q-2021-04-15-433/) indicate that based on certain assumptions made regarding the hardware configuration, a few tens of thousands to several million qubits will be necessary to break 2048-bit RSA using Shor's algorithm. It is not inconceivable that quantum computers with several tens of thousands of qubits will become available over the next several years, making the lower end of the resource estimate accessible." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "1b2563fa-5a60-4da7-80c5-3a2ca48550c3", - "metadata": {}, - "source": [ - "## Diffie-Hellman key exchange and the Digital Signature Algorithm\n", - "\n", - "In the previous section, we discussed the RSA cryptosystem, whose security is based on the computational hardness of prime factorization. Here, we will discuss two popular asymmetric key cryptographic protocols, [*Diffie-Hellman* key exchange](https://en.wikipedia.org/w/index.php?title=Diffie%E2%80%93Hellman_key_exchange&oldid=1163912552) (DH) and the [*Digital Signature Algorithm*](https://en.wikipedia.org/w/index.php?title=Digital_Signature_Algorithm&oldid=1148950522) (DSA), both of which are based on a different mathematical problem, namely the discrete logarithm problem (DLP)." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "c9bc9793-e3e0-4a78-83af-b105e76ba5be", - "metadata": {}, - "source": [ - "### The discrete logarithm problem\n", - "\n", - "In the following equation we need to find $a$ given only $e$,$M$,$c$\n", - "\n", - "$a^e$ $mod$ $M = c$\n", - "\n", - "This is believed to be difficult with classic computers due to the use of modulo arithmetic, and therefore is a good mathematical basis for an encryption algorithm.\n", - "\n", - "This is known as the [discrete logarithm problem](https://en.wikipedia.org/w/index.php?title=Discrete_logarithm&oldid=1161792952) (DLP).\n", - "\n", - "### Mathematical details of the discrete logarithm problem\n", - "\n", - "The DLP is typically framed in the context of cyclic groups and is stated as follows.\n", - "\n", - "Consider a [cyclic group](https://en.wikipedia.org/w/index.php?title=Cyclic_group&oldid=1150017831) $G$ generated by a group element $g \\in G$ and given an arbitrary element $h \\in G$, find an integer $k$ such that $h = g^{k}$.\n", - "\n", - "Here the integer $k \\equiv log_{g}h$ is the discrete logarithm. The cyclic property of $G$ guarantees that for every $h$, a valid integer $k$ exists.\n", - "\n", - "For cryptography, the DLP on the multiplicative group of integers modulo a prime number $p$ denoted $(\\mathbb{Z}_p)^{\\times}$ turns out to be useful. The elements of $(\\mathbb{Z}_p)^{\\times}$ are congruence classes labeled by integers modulo $p$ that are coprime to $p$.\n", - "\n", - "For example:\n", - "\n", - "$(\\mathbb{Z}_5)^{\\times} = \\{[1],[2],[3],[4]\\}~\\mathrm{and}~(\\mathbb{Z}_7)^{\\times} = \\{[1],[2],[3],[4],[5],[6]\\} $\n", - "\n", - "The operation of multiplication $(\\times)$ on these groups is simply ordinary integer multiplication followed by reduction modulo $p$ and exponentiation by an integer $k$ is just repeated multiplication $k$ times and reduction modulo $p$.\n", - "\n", - "Let's illustrate an instance of the DLP on $(\\mathbb{Z}_7)^{\\times}$.\n", - "\n", - "This multiplicative group has two generators ${[3],[5]}$ also known as primitive roots. We will use $[5]$ as the generator; that is, generate every element of $(\\mathbb{Z}_7)^{\\times}$ using successive integer powers of 5.\n", - "\n", - "```python\n", - "#Generate elements of (Z_7)^{x} using generator [5].\n", - "g = 5\n", - "p = 7\n", - "print(f\"Using generator {g}\")\n", - "for k in range(3*p):\n", - " print(f\"{g}**{k} mod {p} ≡ {(g**k)%7}\")\n", - "```\n", - "\n", - "We see that in modulo 7 arithmetic, raising 5 to successive integer powers yields every element of $(\\mathbb{Z}_7)^{\\times}$ exactly once before the cycle repeats indefinitely with a period $p-1 =6$.\n", - "\n", - "So the DLP on $(\\mathbb{Z}_7)^{\\times}$ with generator [5] is:\n", - "\n", - "$ \\mathrm{Given}~h \\in (\\mathbb{Z}_7)^{\\times} \\mathrm{, find~} k \\mathrm{~such~that~} 5^{k} \\equiv h~(mod~7)$.\n", - "\n", - "From the above Python cell output we see that:\n", - "\n", - "$h = 2 \\implies k=4 \\mathrm{~or~} 4 = log_5(2) (mod~7)$\n", - "\n", - "$h = 6 \\implies k=3 \\mathrm{~or~} 3 = log_5(6) (mod~7)$\n", - "\n", - "\n", - "In ordinary real number arithmetic, exponentiation is a monotonic function and finding the logarithm of any number to any base is computationally easy. In contrast, as is apparent from the simple $(\\mathbb{Z}_7)^{\\times}$ example above, modular exponentiation is non-monotonic, and even though it is periodic with period $p-1$, it is otherwise highly nontrivial. So computing its inverse, the discrete logarithm turns out to be inefficient for large $p$ on classical computers.\n", - "\n", - "This observation underpins both Diffie-Hellman (DH) key exchange and the Digital Signature Algorithm (DSA), which are discussed in the next section.\n", - "\n", - "The DLP can be extended to cyclic subgroups as follows:\n", - "\n", - "- Consider $(\\mathbb{Z}_p)^{\\times}$ defined above and an element $g \\in (\\mathbb{Z}_p)^{\\times}$ of prime order $r$ that is, $g^r \\equiv 1 (~mod~p)$.\n", - "- The set of integer powers of $g$: $\\{g^k~(mod~p) | 1 \\le k \\le r\\} = \\langle g \\rangle$ is a cyclic subgroup of $(\\mathbb{Z}_p)^{\\times}$ with group order $r$.\n", - "- A DLP can be specified on $\\langle g \\rangle$ by choosing a $h \\in \\langle g \\rangle$ and asking for $1 \\le a \\le r$ such that $ g^a~(mod~p) = h$" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "67c92910-9a62-4792-accd-38456c0c717a", - "metadata": {}, - "source": [ - "### Diffie-Hellman key exchange\n", - "\n", - "In 1976, [Whitfield Diffie and Martin Hellman proposed a key exchange protocol](https://doi.org/10.1109/TIT.1976.1055638) to enable the creation of a shared secret key over insecure communication channels. The secret key could then be used by parties sharing it for symmetric encryption. The algorithm relies on the DLP.\n", - "\n", - "![Figure 1. Diffie-Hellman key exchange](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_dh.svg)\n", - "\n", - "*Figure 1. Diffie-Hellman key exchange*\n", - "\n", - "\n", - "\n", - "\n", - "\n", - "With Alice and Bob being the two parties communicating, the protocol works as follows:\n", - "\n", - "- First, Alice and Bob agree on a large prime number $p$ and a primitive root or generator $a$.\n", - "- Then, Alice chooses a secret exponent $k_A$ randomly with $1 \\le k_A \\le p-2$ and calculates $h_A = a^{k_A}~(mod~p)$. $k_A, h_A$ are Alice's private and public keys respectively.\n", - "- Next, Bob chooses a secret exponent $k_B$ randomly with $1 \\le k_B \\le p-2$ and calculates $h_B = a^{k_B}~(mod~p)$. $k_B, h_B$ are Bob's private and public keys respectively.\n", - "- Then, Alice sends Bob $h_A$ and Bob sends Alice $h_B$ over a reliable but not necessarily secure channel.\n", - "- Then, Alice then uses the $h_B$ she received to compute the shared secret key $ \\kappa = h_B^{k_A}~(mod~p)$.\n", - "- Finally, Bob meanwhile uses the $h_A$ he received to compute the shared secret key $ \\kappa = h_A^{k_B}~(mod~p)$.\n", - "\n", - "With this protocol,\n", - "\n", - "- Alice and Bob are guaranteed to end up with the same secret key $\\kappa$ because $h_B^{k_A}~(mod~p) = (a^{k_B})^{k_A}~(mod~p) = a^{k_A k_B}~(mod~p) = (a^{k_A})^{k_B}~(mod~p) = h_A^{k_B}~(mod~p) $.\n", - "- A third party that intercepts $h_A$ or $h_B$ cannot construct the secret key $\\kappa$ because they do not have access to $k_B$ or $k_A$ respectively.\n", - "- Extracting $k_A$ or $k_B$ using the public information $a$, $p$, $h_A$ and $h_B$ is computationally hard as it is equivalent to solving the DLP on $(\\mathbb{Z}_p)^{\\times}$.\n", - "\n", - "\n", - "" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "db0d15cc-ce7a-4d6d-a004-06433a3fbe0b", - "metadata": {}, - "source": [ - "#### Illustration of the Diffie-Hellman protocol in Python\n", - "\n", - "Let's look at a simple example of the DH protocol in Python using small prime numbers:\n", - "\n", - "\n", - "In this section we will show the math calculations in detail as part of the Python code\n", - "\n", - "\n", - "**Step 1:** Alice and Bob agree on a prime $p$ and a primitive root $a$. Let's choose $p=11, a=7$." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "f33776bd-eb5b-4837-8618-e90723814a34", - "metadata": {}, - "outputs": [], - "source": [ - "# Step 1: Choose a prime `p` and a primitive root `a`\n", - "p = 11\n", - "a = 7\n", - "\n", - "print(f\"prime: {p}\")\n", - "print(f\"primitive root: {a}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "cde6cef8-9e36-4ae5-be60-ee6eeb142509", - "metadata": {}, - "source": [ - "**Steps 2, 3:** Alice chooses a secret exponent $k_A$ and calculates $h_A = a^{k_A}~(mod~p)$. Similarly, Bob chooses a secret exponent $k_B$ and calculates $h_B = a^{k_B}~(mod~p)$." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "87ada662-c219-43fd-b055-a2ca864b1847", - "metadata": {}, - "outputs": [], - "source": [ - "k_A = 4 # Alice's private key\n", - "h_A = (a ** (k_A)) % p # Alice's public key\n", - "\n", - "print(f\"Alice's private key is {k_A} and public key is {h_A}\")\n", - "\n", - "k_B = 8 # Bob's private key\n", - "h_B = (a ** (k_B)) % p # Bob's public key\n", - "\n", - "print(f\"Bob's private key is {k_B} and public key is {h_B}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "ed9ea42d-99a4-4e65-bca8-aa88d5929877", - "metadata": {}, - "source": [ - "**Step 4:** The two parties broadcast their public keys $h_A$ and $h_B$.\n", - "\n", - "**Steps 5, 6:** Each party combines their private key with the other party's public key to create the shared secret key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "03a37936-f41b-4ccf-b53d-cef1339f8391", - "metadata": {}, - "outputs": [], - "source": [ - "secret_key_alice = h_B**k_A % p\n", - "secret_key_bob = h_A**k_B % p\n", - "assert secret_key_alice == secret_key_bob\n", - "print(f\"The shared secret key is: {secret_key_bob}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "8ae2614a-a11e-4ef0-836b-6f85034dffa2", - "metadata": {}, - "source": [ - "Alice and Bob can now use the shared secret key for symmetric encryption." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "cfbe921f-8a38-4d7b-8b86-ac27ad7a6e88", - "metadata": {}, - "source": [ - "#### Security of Diffie-Hellman key exchange\n", - "\n", - "As noted above, the security of DH is predicated on the computational difficulty of solving the DLP with large primes $p$. In typical applications, NIST recommends 2048- or 3072-bit prime integers for DH key exchange, which is considered sufficiently secure against attempts to solve the DLP using classical computers.\n", - "\n", - "**Man-in-the-middle (MITM) attacks**: The fact that DH is an interactive scheme where the shared secret depends on combining one party's private key with the other party's public key makes it vulnerable to a so-called *Man-in-the-middle (MITM)* attack.\n", - "\n", - "\n", - "\n", - "\n", - "\n", - "In this scenario, a third party — say, Eve — intercepts the public keys $h_A, h_B$ during transmission and substitutes her own public key $h_E$ for each of $h_A$ and $h_B$ before forwarding them along to Bob and Alice, respectively.\n", - "\n", - "Then, instead of using $h_B$ to create her shared secret, Alice will use $h_E$ while thinking that she is using Bob's public key. Similarly, instead of using $h_A$ to create his shared secret, Bob will use $h_E$ while thinking that he is using Alice's public key.\n", - "\n", - "Because $h_E$ was used to create Alice's (Bob's) shared secret, plain text encrypted by Alice (Bob) can be decrypted by Eve.\n", - "\n", - "Thus, DH key exchange is typically used in conjunction with a digital signature algorithm to ensure that each party uses an authenticated public key for creating their shared secret.\n", - "\n", - "\n", - "" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "564a029c-18d1-409a-97db-9bfeb7048afd", - "metadata": {}, - "source": [ - "### The Digital Signature Algorithm (DSA)\n", - "\n", - "Even though generic cryptosystems like [RSA](https://en.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&oldid=1163962255) provide digital signature functionality, in 1994 NIST adopted a specialized signature scheme based on modular exponentiation and the discrete logarithm problem as the federal standard for digital signatures. This scheme, which came to be known simply as the [*Digital Signature Algorithm*](https://en.wikipedia.org/w/index.php?title=Digital_Signature_Algorithm&oldid=1148950522) (DSA), involves four distinct phases:" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "dbb0cb8d-2f73-450f-adbb-35354219315f", - "metadata": {}, - "source": [ - "1. **Key generation**:\n", - "\n", - " DSA keys are generated from:\n", - " - 2 primes that meet certain rules\n", - " - $p$ - typically 256 bits (we'll call this length $N$)\n", - " - $q$ - typically 3072 bits (we'll call this length $L$)\n", - " - A cryptographic hash function that will convert from strings of length $L$ to $N$\n", - " - An additional Parameters $g$ (see details below)\n", - "\n", - " From this we choose a random number $x$ as private key, and are able to calculate a public key $y$\n", - "\n", - " \n", - " \n", - "\n", - " - **Parameter generation:** Mathematically, DSA involves a cyclic subgroup of $(\\mathbb{Z}_p)^{\\times}$ generated by an element $g$ of prime order q < p. The first step in the DSA is therefore to select two primes p, q to set up the necessary mathematical structures.\n", - "\n", - " - Choose an $N$-bit prime $q$.\n", - " - Choose an $L$-bit prime $p$ such that $p-1$ is a multiple of $q$. The choice of $p$ specifies the group $(\\mathbb{Z}_p)^{\\times}$\n", - " - Pick an integer $1 < h < p-1$ at random and compute $g = h^{(p-1)/q}~mod~p$. If $g=1$ which happens rarely, try another h.\n", - " - Verify that $g^q~mod~p = 1$. g is thus a generator of a cyclic subgroup $\\langle g \\rangle$ of $(\\mathbb{Z}_p)^{\\times}$ of prime order q.\n", - "\n", - " The parameters $(q, p, g)$ specify an instance of the algorithm and are public information. Typically, $ N \\sim 256$ and $L \\sim 3072$ in realistic applications.\n", - "\n", - " The protocol also requires a cryptographic hash function $H : \\{0,1\\}^L \\rightarrow \\{0, 1\\}^N$ that maps binary $L$-bit strings to $N$-bit strings, for example, SHA-256.\n", - "\n", - " - **Key-pair generation:** The signer needs to generate a key pair on their end.\n", - "\n", - " - Choose a random secret integer $ x \\in \\{1,2...q-1\\}$. $x$ is the private key.\n", - " - Generate $ y = g^{x}~mod~p$. $y$ is the signer's public key.\n", - "\n", - " \n", - " " - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "d444c6cf-bbf6-4c8f-895a-e0d2c481dfb8", - "metadata": {}, - "source": [ - "2. **Key distribution:**\n", - "\n", - " The following information is shared with anyone who wishes to validate a signature\n", - " - The parameters used $(p,q,g)$ which describe the algorithm\n", - " - The hash function $H$\n", - " - the public key $y$" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "0cca51b2-b84f-4264-bcec-d108ddffe5da", - "metadata": {}, - "source": [ - "1. **Signing:**\n", - "\n", - " - The signer can now sign a message $m$. The resulting signature is $(r,s)$\n", - " - The message and signature are both now sent to the recipient\n", - "\n", - " \n", - " \n", - "\n", - " The signer signs a message $m$ as follows:\n", - "\n", - " - Choose a secret integer k at random from $\\{1,2...q-1\\}$\n", - " - Compute $r = (g^k~mod~p)~mod~q$. In the rare instance when $r=0$, try another random k.\n", - " - Compute $s = (k^{-1} (H(m) + xr))~mod~q$. In a rare instances if $s=0$, try another random k.\n", - " - The signature is the tuple $(r, s)$.\n", - " - The signer transmits the message $m$ as well as the signature $(r,s)$ to the verifier.\n", - "\n", - " Because both $r, s$ are integers, modulo $q$ the signature size is on the order of $N$-bits and not the longer $L$-bits.\n", - "\n", - " \n", - " " - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "66ba7b24-c392-444c-b5a4-033a9493837e", - "metadata": {}, - "source": [ - "2. **Verification:**\n", - "\n", - " The recipient now wishes to verify the authenticity of the sender.\n", - " They have access to the public information $(q, p, g, H, y, (r,s), m)$\n", - " They can execute a calculation which proves that the sender had access to the private key $x$\n", - "\n", - " and seeks to ascertain that the signer is someone with access to the private key $x$.\n", - "\n", - " \n", - " \n", - "\n", - " - Verify that $0 \\lt r \\lt q$ and $0 \\lt s \\lt q$, that is, $r, s$ are valid modulo~q integers.\n", - " - Compute $w = s^{-1}~mod~q$.\n", - " - Compute $u_1 = H(m)w~mod~q$.\n", - " - Compute $u_2 = rw~mod~q$.\n", - " - Compute $v = (g^{u_1}y^{u_2}~mod~p)~mod~q$.\n", - " - The signature is verified if $v = r$.\n", - "\n", - " For legitimate signatures, the correctness of the DSA algorithm is easily demonstrated as follows:\n", - "\n", - " - On the signer's end: $s = (k^{-1} (H(m) + xr))~mod~q \\implies k = ((H(m) + xr)s^{-1})~mod~q $\n", - " - Considering the right-hand side of the latter equality, a verifier can compute $s^{-1}, H(m)$ because $s, q, m, H$ are public information.\n", - " - Thus, the verifier computes $w = s^{-1}~mod~q$ and $u_1 = H(m)w~mod~q = H(m)s^{-1}~mod~q$.\n", - " - The verifier also computes $u_2 = rw~mod~q = rs^{-1}~mod~q$ as $r$ is also public.\n", - " - Note that $k = (u_1 + xu_2)~mod~q$.\n", - " - However, a verifier does not have access to $x$ as it is the signer's private key, so $k$ itself cannot be directly computed. - The scheme instead relies on the fact that even as the verifier cannot compute $k$, with a legitimate signer, the verifier should instead be able to re-compute $(g^k~mod~p)~mod~q = r$ with the help of the signer's public key $y = g^{x}~mod~p$.\n", - " - So, the verifier computes $v = (g^{u_1}y^{u_2}~mod~p)~mod~q = (g^{u_1}g^{xu_2}~mod~p)mod~q = (g^{u_1+xu_2}~mod~p)mod~q = (g^k~mod~p)mod~q$.\n", - " - The last equality follows because $g$ has order $q$ and establishes $v = r$ for valid signatures.\n", - "\n", - " \n", - " " - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "5a8da1e0-53d1-4f3e-ad50-57b9da6eeb4d", - "metadata": {}, - "source": [ - "### Illustration of the DSA in Python" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "55086196-8a33-4ffd-b9c1-50c96ec31bcd", - "metadata": {}, - "source": [ - "In this example, we'll use small primes to illustrate the DSA process in a scenario where Alice sends a signed message to Bob. We'll use small integers in this example. A real-world scenario would employ much larger primes on the order of 2048-3072 bits.\n", - "\n", - "\n", - "You can try rerunning this example with different values to see how the algorithm behaves, but ensure you start running from the first cell in this section.\n", - "\n", - "\n", - "We start by importing necessary libraries and choosing our parameters." - ] - }, - { - "cell_type": "markdown", - "id": "0e4238f9-a042-41a9-9193-8d64bbd8ec72", - "metadata": {}, - "source": [ - "The integer parameters $p$, $q$, $g$ are public information, and satisfy the following rules:\n", - "\n", - "- $p$, $q$ are both prime\n", - "- $(p-1) \\mod\\ q = 0$\n", - "- $g \\ge 2$\n", - "- $g \\le (p-2)$\n", - "- $g^{(p-1)/q} \\mod\\ p \\neq 1$" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "f2c802d0-1f1e-4734-bf7c-a7988c6315dc", - "metadata": {}, - "outputs": [], - "source": [ - "from random import randint\n", - "\n", - "# parameter generation: select the primes q, p and generator g:\n", - "# EXPERIMENT with the values, they must meet certain rules\n", - "# this example code does not verify p,q are prime\n", - "\n", - "q = 11\n", - "p = 23\n", - "g = 4\n", - "\n", - "assert (p - 1) % q == 0\n", - "assert g >= 2\n", - "assert g <= (p - 2)\n", - "assert (pow(g, (p - 1) / q) % p) != 1\n", - "\n", - "print(f\"Public information is good: q={p}, p={q}, g={g}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "5bf3ba9b-c44f-4fdf-b242-367fcdc8d9bd", - "metadata": {}, - "source": [ - "Next the signer, Alice, generates her private key.\n", - "\n", - "The private key, k (`alice-private-key` in the python code) must satisfy:\n", - " - $k \\ge 2$\n", - " - $k \\le (q-1)$" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "859a781e-6fc2-4fdd-a930-4b609a470b53", - "metadata": {}, - "outputs": [], - "source": [ - "# Alice chooses an integer randomly from {2..q-1}\n", - "# EXPERIMENT with the values\n", - "\n", - "alice_private_key = randint(2, q - 1)\n", - "# alice_private_key =\n", - "\n", - "assert alice_private_key >= 2\n", - "assert alice_private_key <= (q - 1)\n", - "\n", - "print(f\"Alice's private key is {alice_private_key}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "9a559220-5e13-4f62-a19f-1ad5b7e65da3", - "metadata": {}, - "source": [ - "Alice keeps her private key secret.\n", - "\n", - "Next, Alice computes her public key using modular exponentiation. Inverting this step to recover the private key is an instance of the DLP, so difficult to compute on classical computers where large primes are used.\n", - "\n", - "From the math explanation above, we know is this can be calculated using the formula:\n", - "\n", - "$y = g^{x} \\mod\\ p$" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "54d4d2e2-6000-4d96-bb67-b6faa4194f54", - "metadata": {}, - "outputs": [], - "source": [ - "alice_public_key = pow(g, alice_private_key, p)\n", - "# Alternatively can use (g ** alice_private_key) % p\n", - "\n", - "print(f\"Alice's public key is {alice_public_key}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "eca29da8-6a70-4867-8479-357e9a8f7f17", - "metadata": {}, - "source": [ - "As usual, Alice makes her public key available over a not-necessarily secret channel.\n", - "\n", - "Now Alice can sign a message.\n", - "\n", - "For the digital signature scheme, we need to generate a hash $H(m)$ of the message $m$ to be signed.\n", - "\n", - "Let's assume Alice and Bob agree to use a particular hashing algorithm with hash length $N$ equal to the number of bits in $q$. In this simple example, we will bound the outputs of our mock hash function by $q$. The hash function here is trivial, simply generating a random integer." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "3a88329c-3ff5-4eac-9b12-22684ebe23c6", - "metadata": {}, - "outputs": [], - "source": [ - "hash_dict = {}\n", - "\n", - "\n", - "def mock_hash_func(input_message):\n", - " print(input_message)\n", - " if input_message not in hash_dict:\n", - " hash_dict[input_message] = randint(1, q)\n", - " return hash_dict[input_message]\n", - "\n", - "\n", - "alice_message = \"Inspection tomorrow!\"\n", - "alice_hash = mock_hash_func(alice_message) # In reality, you'd use a hash function\n", - "print(f\"Alice's message hash is: {alice_hash}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "3e1b0457-4fc2-4b4f-a5bb-ff57222bdd5d", - "metadata": {}, - "source": [ - "Next, Alice needs to generate a random per-message secret number $k$ as well as its multiplicative inverse modulo $q$ to compute the signature.\n", - "\n", - "A simple brute-force algorithm can be used to compute the modular inverse. However it's better to use one of the built-in Python function `pow` as shown below" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "80110083-b511-4290-84ee-00d52ab9497c", - "metadata": {}, - "outputs": [], - "source": [ - "# brute-force implementation to find modular inverse\n", - "def modular_inverse(k, q):\n", - " for i in range(0, q):\n", - " if (k * i) % q == 1:\n", - " return i\n", - " print(f\"error! no inverse found! for {k},{q}\")\n", - " return 0\n", - "\n", - "\n", - "# Let's compare this algorithm with the standard python 'pow' function\n", - "\n", - "n1 = modular_inverse(3, 7)\n", - "n2 = modular_inverse(4, 11)\n", - "n3 = modular_inverse(7, 5)\n", - "m1 = pow(3, -1, 7)\n", - "m2 = pow(4, -1, 11)\n", - "m3 = pow(7, -1, 5)\n", - "\n", - "assert n1 == m1\n", - "assert n2 == m2\n", - "# assert(n3==m3)\n", - "\n", - "print(f\"modular_inverse(3,7) = {m1}\")\n", - "print(f\"modular_inverse(4,11) = {m2}\")\n", - "print(f\"modular_inverse(7,5) = {m3}\")\n", - "\n", - "\n", - "# Some numbers don't have modular inverses - our function throws an error\n", - "n4 = modular_inverse(2, 6)\n", - "\n", - "# The python library will throw an exception, which must be caught\n", - "if math.gcd(2, 6) == 1:\n", - " m4 = pow(2, -1, 6)\n", - "else:\n", - " print(\"Exception from pow() - no modular inverse found!\")" - ] - }, - { - "cell_type": "markdown", - "id": "8b2d066e-a3f0-4813-8611-0d3b4dd2b736", - "metadata": {}, - "source": [ - "Alice can now compute the signature.\n", - "\n", - "- $r = (g^{k} \\mod p) \\mod\\ q$\n", - "- $s = (k^{-1} (H(m) + xr)) \\mod q$\n", - "\n", - "Note that there are some particular conditions that will require us to choose a different value for $k$ in the case where either $r$ or $s$ compute to $0$. In this case we will generate a new value and repeat." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "92a4a9e5-ffc4-4181-9e64-b93506be1550", - "metadata": {}, - "outputs": [], - "source": [ - "# Start an infinite loop; we will 'break' out of it once a valid signature is found.\n", - "while True:\n", - " k = randint(1, q - 1) # Should be different for every message\n", - " print(\"Using random k =\", k)\n", - "\n", - " r = pow(g, k, p) % q\n", - " # If r is 0, the value is invalid. Try again with a new k.\n", - " if r == 0:\n", - " print(f\"{k} is not a good random value to use to calculate r. Trying another k\")\n", - " continue\n", - "\n", - " s = (pow(k, -1, q) * (alice_hash + alice_private_key * r)) % q\n", - " # If s is 0, the value is also invalid. Try again with a new k.\n", - " if s == 0:\n", - " print(f\"{k} is not a good random value to use to calculate s. Trying another k\")\n", - " continue\n", - "\n", - " # If we've reached this point, both r and s are valid. Break the loop.\n", - " signature = (r, s)\n", - " print(f\"Alice's signature is : {(r,s)}\")\n", - " break\n", - "\n", - "# After the loop, the valid r and s values can be used here.\n", - "# print(f\"Generated Signature -> r: {r}, s: {s}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "815a17be-ac5b-4083-badf-0a21e9100b11", - "metadata": {}, - "source": [ - "Alice broadcasts the message and her signature to the receiver or verifier, Bob.\n", - "\n", - "Bob has previously intercepted Alice's public key and can now verify the signature to authenticate her message.\n", - "\n", - "To do so, he performs some checks, and then re-generates a hash of Alice's broadcast message and computes the auxiliary quantities $w, u_1, u_2$ and $v$.\n", - "- $0 < r < q$\n", - "- $0 < s < q$\n", - "- $w = s^{-1} \\mod\\ q$\n", - "- $u_{1} = H(m) . w \\mod\\ q$\n", - "- $u_{2} = r . w \\mod\\ q$\n", - "- $v = (g^{u1}y^{u2} \\mod\\ p) \\mod\\ q$\n", - "\n", - "\n", - "Finally, Bob checks if $v$ equals $r$. If they are equal, then the signature is verified." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "25d6d3e7-0a2c-485f-8fee-44cf06180d32", - "metadata": {}, - "outputs": [], - "source": [ - "# Bob re-generates message hash using Alice's broadcast message\n", - "bob_hash = mock_hash_func(alice_message)\n", - "\n", - "# Bob computes auxiliary quantities w (using modular inverse), u1, u2 and v\n", - "w = (pow(s, -1, q)) % q\n", - "u1 = (bob_hash * w) % q\n", - "u2 = (r * w) % q\n", - "v = ((g**u1 * alice_public_key**u2) % p) % q\n", - "\n", - "if v == r:\n", - " print(\"Signature is valid!\")\n", - "else:\n", - " print(\"Signature is invalid!\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "0e5c9e31-9178-4368-8012-89d47ab23f08", - "metadata": {}, - "source": [ - "### Security of the DSA\n", - "\n", - "With classical computing, the security of the DSA can be influenced by several factors:\n", - "\n", - "1. **Key size**: As always, key size provides basic protection against brute force attacks. Modern applications that use DSA use key sizes of at least 2048 bits.\n", - "\n", - "2. **Quality of $k$**: In DSA, each signature needs a unique, random, and secret $k$ value (see above). The uniqueness, entropy, and secrecy of $k$ are critical, and weakness in any of these aspects could lead to the private key $x$ being compromised. The random number generators used for generating $k$ need to be secure themselves.\n", - "\n", - "3. **Hash function strength**: Since DSA uses a hash function as part of the signature generation and verification process, a weak hash function could compromise the security of the digital signature. For example, the use of SHA-1 with DSA is deprecated and SHA-2 or higher is recommended.\n", - "\n", - "In addition to these, robust DSA implementation should also guard against other types of attacks that target asymmetric key cryptography as previously outlined." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "39fea831-2457-4bcc-8554-04126b82bc7d", - "metadata": {}, - "source": [ - "### Authenticated key exchange with Diffie-Hellman and DSA\n", - "\n", - "Modern network security protocols, such as [Transport Layer Security (TLS)](https://en.wikipedia.org/w/index.php?title=Transport_Layer_Security&oldid=1155601531) and many others, involve combining the functionalities of key exchange and authentication. In the context of Diffie-Hellman, authentication is needed to guard against MITM attacks. In the following code cells, we illustrate an example where Alice and Bob perform an authenticated key exchange by combining the Diffie-Hellman and DSA protocols. For this, we will use the `cryptography` Python library.\n", - "\n", - "![Figure 2. Authenticated key exchange with Diffie-Hellman and DSA](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/auth_key_exchange.svg)\n", - "\n", - "*Figure 2. Authenticated key exchange with Diffie-Hellman and DSA*" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "475aaca8-fb3b-464f-810a-546c110aa84c", - "metadata": {}, - "source": [ - "First, Alice and Bob agree on a set of DH parameters and generate a set of DH public-private key pairs." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "9d643a66-1ccb-4a7a-a9dd-de9399840335", - "metadata": {}, - "outputs": [], - "source": [ - "# import necessary library modules\n", - "from cryptography.hazmat.primitives import hashes\n", - "from cryptography.hazmat.primitives.asymmetric import dh, dsa\n", - "\n", - "# Generate DH parameters\n", - "parameters = dh.generate_parameters(generator=2, key_size=2048)\n", - "\n", - "# Generate Alice's DH private key and public key\n", - "alice_dh_private_key = parameters.generate_private_key()\n", - "alice_dh_public_key = alice_dh_private_key.public_key()\n", - "\n", - "# Generate Bob's DH private key and public key\n", - "bob_dh_private_key = parameters.generate_private_key()\n", - "bob_dh_public_key = bob_dh_private_key.public_key()\n", - "\n", - "print(\"Public and private keys generated for Bob and Alice\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "a2264943-3391-4ced-8923-5cac3311eb27", - "metadata": {}, - "source": [ - "The DH public keys are broadcast. Next, both Alice and Bob each generate a separate key pair for use with DSA. These keys will in turn be used to sign the DH public keys to be exchanged." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "f2d37eac-3002-49ed-bc41-2fc008ad27f9", - "metadata": {}, - "outputs": [], - "source": [ - "# Generate DSA keys for Alice and Bob\n", - "alice_dsa_private_key = dsa.generate_private_key(key_size=2048)\n", - "alice_dsa_public_key = alice_dsa_private_key.public_key()\n", - "bob_dsa_private_key = dsa.generate_private_key(key_size=2048)\n", - "bob_dsa_public_key = bob_dsa_private_key.public_key()\n", - "\n", - "print(\"Additional key pair generated for signing\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "5724b61c-ba51-4a95-a0f1-4066e6b5a333", - "metadata": {}, - "source": [ - "Alice signs her DH public key using her DSA private key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "9a63ad05-4963-4da8-93b8-ca2e3c9bcd54", - "metadata": {}, - "outputs": [], - "source": [ - "# Alice signs\n", - "alice_public_bytes = alice_dh_public_key.public_bytes(\n", - " encoding=serialization.Encoding.PEM,\n", - " format=serialization.PublicFormat.SubjectPublicKeyInfo,\n", - ")\n", - "alice_signature = alice_dsa_private_key.sign(alice_public_bytes, hashes.SHA256())\n", - "\n", - "print(\"Alice signed public key\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "a9c66464-e8e1-4327-833e-39a83e01b0d2", - "metadata": {}, - "source": [ - "Similarly, Bob signs his DH public key using his DSA private key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "5fa7c787-2f6e-4fb5-b95f-21683d71f12f", - "metadata": {}, - "outputs": [], - "source": [ - "bob_public_bytes = bob_dh_public_key.public_bytes(\n", - " encoding=serialization.Encoding.PEM,\n", - " format=serialization.PublicFormat.SubjectPublicKeyInfo,\n", - ")\n", - "bob_signature = bob_dsa_private_key.sign(bob_public_bytes, hashes.SHA256())\n", - "\n", - "print(\"Bob signed public key\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "f7e9bf35-aa76-4d33-bb73-95649b5c46bf", - "metadata": {}, - "source": [ - "The DH public keys and corresponding signatures are now broadcast by both Alice and Bob. Having received their counterparty's public key and signature, each party then verifies the signature is valid. This way, a MITM attack can be prevented, as Alice, for instance, knows that Bob's DH public key was indeed signed by Bob and vice versa." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "71d668ec-a4c6-4e28-a498-699c514250bd", - "metadata": {}, - "outputs": [], - "source": [ - "# Alice and Bob verify each other's DH public keys using DSA public keys\n", - "# An InvalidSignature exception will occur if they are not valid\n", - "alice_dsa_public_key.verify(alice_signature, alice_public_bytes, hashes.SHA256())\n", - "bob_dsa_public_key.verify(bob_signature, bob_public_bytes, hashes.SHA256())\n", - "\n", - "print(\"Signatures are valid\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "90ea2311-b98e-479f-a361-7cabca27cf89", - "metadata": {}, - "source": [ - "Following signature verification, Alice and Bob generate the shared secret, which completes the key exchange." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "718b2f03-4eac-4696-84ea-01d825a68d33", - "metadata": {}, - "outputs": [], - "source": [ - "# Perform key exchange\n", - "alice_shared_key = alice_dh_private_key.exchange(bob_dh_public_key)\n", - "bob_shared_key = bob_dh_private_key.exchange(alice_dh_public_key)\n", - "\n", - "print(\"Shared secrets generated\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "a1dc9eed-618d-472a-b052-2fcd6ae7fccb", - "metadata": {}, - "source": [ - "Optionally, for additional security, Alice and Bob can use a specialized key derivation function such as *HKDF* to generate a more secure symmetric key from their shared secret using *key stretching* techniques." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "be6cdae2-908f-4547-a406-f1dabee6c512", - "metadata": {}, - "outputs": [], - "source": [ - "# Derive a shared symmetric key using key-stretching\n", - "def derive_key(shared_key):\n", - " return HKDF(\n", - " algorithm=hashes.SHA256(),\n", - " length=32,\n", - " salt=None,\n", - " info=None,\n", - " ).derive(shared_key)\n", - "\n", - "\n", - "alice_symmetric_key = derive_key(alice_shared_key)\n", - "bob_symmetric_key = derive_key(bob_shared_key)\n", - "\n", - "assert alice_symmetric_key == bob_symmetric_key\n", - "print(\"Keys checked to be the same\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "5f8cf910-32e2-4c03-8027-c1e79ba5ecf9", - "metadata": {}, - "source": [ - "## Breaking Diffie-Hellman and DSA\n", - "\n", - "Both the [Diffie-Hellman](https://en.wikipedia.org/w/index.php?title=Diffie%E2%80%93Hellman_key_exchange&oldid=1163912552) (DH) and [DSA](https://en.wikipedia.org/w/index.php?title=Digital_Signature_Algorithm&oldid=1148950522) protocols involve the generation of public keys of the form $ y = g^{x}~mod~p$, where the private key $x$ is the discrete logarithm.\n", - "\n", - "An attacker who can solve an instance of the DLP can expose the private key of one of the two parties and, by combining it with the public key of the second party, get access to the shared secret. In the case of DSA, an attacker who can solve the DLP can recover the signer's private key, voiding the basic premise of a digital signature.\n", - "\n", - "On classical computing systems, the DLP is believed not to have a polynomial-time solution. But as shown by Peter Shor in his [original 1994 paper](https://doi.org/10.1109/SFCS.1994.365700), Shor's algorithm also solves the DLP in polynomial-time on quantum computers." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "cf506d41-c8f1-4dab-bdf0-a993c81b9459", - "metadata": {}, - "source": [ - "### Shor's algorithm and the discrete logarithm problem\n", - "\n", - "Shor's algorithm is able to solve the discrete logarithm problem in polynomial time. It primarily achieves its efficiency by using quantum algorithms which can find the period of a function which depends on the input to the problem - which is then combined with more conventional operations.\n", - "\n", - "\n", - "\n", - "\n", - "Shor's algorithm provides an efficient solution to the DLP by mapping it to a more general problem in group theory known as the [hidden subgroup problem](https://en.wikipedia.org/w/index.php?title=Hidden_subgroup_problem) (HSP).\n", - "\n", - "In the HSP, one is given an algebraic group $G$ and a function $f: G \\rightarrow X$ from $G$ to some set $X$ such that $f$ is constant on each coset of some subgroup $H$ of $G$ (and distinct on different cosets). Then, the task is to determine $H$. It is known that quantum computers can solve the HSP on finite Abelian groups in time polynomial in $log~|G|$ where $|G|$ is the group order.\n", - "\n", - "In the case of the integer DLP discussed in this lesson, the mapping to the HSP is as follows:\n", - "\n", - "- Let $p$ be a prime and consider the DLP given by $ y = g^r~mod~p$ where $g$ is a generator of $(\\mathbb{Z}_p)^{\\times}$. Since $g^{p-1} \\equiv 1~mod~p$, $g$ has order $p-1$.\n", - "- Choose $G = \\mathbb{Z}_{p-1} \\times \\mathbb{Z}_{p-1}$ where $\\mathbb{Z}_{p-1}$ is the group of integers modulo $(p-1)$.\n", - "- Choose $f : G \\rightarrow (\\mathbb{Z}_p)^{\\times}$ given as $f(a, b) = g^a y^{-b}~mod~p \\equiv g^{a-rb}~mod~p$ .\n", - "- The kernel of $f$ is then the subgroup $H_0 = \\langle (r, 1) \\rangle = \\{(a,b) \\in G | f(a,b) \\equiv 1~mod~p\\} = \\{ (a, b) \\in G | a - rb \\equiv 0~mod~(p-1)\\}$.\n", - "- $f$ is constant on the cosets $(\\delta, 0) + H_0$ and \"hides\" the subgroup $H_0$ setting up an HSP.\n", - "\n", - "Given the above, Shor's quantum algorithm for the integer DLP uses a quantum oracle to evaluate the function $f$ on a state representing a uniform superposition over $G$, and then uses the quantum Fourier transform and measurements with phase estimation to produce quantum states that allow for the identification of the generator $(r, 1)$ of $H_0$. From this, $r$, the discrete logarithm of interest, can be extracted.\n", - "\n", - "\n", - "\n", - "\n", - "[Shor's original paper](https://doi.org/10.1109/SFCS.1994.365700) has a detailed description of the algorithm." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "b3b62d77-2c58-4f39-aa50-97d519a18434", - "metadata": {}, - "source": [ - "## Elliptic curve cryptography\n", - "\n", - "[*Elliptic curve cryptography (ECC)*](https://en.wikipedia.org/w/index.php?title=Elliptic-curve_cryptography&oldid=1160709993), based on the mathematics of [*elliptic curves*](https://en.wikipedia.org/w/index.php?title=Elliptic_curve&oldid=1164567664), offers a powerful approach to asymmetric key cryptography. ECC is known to provide a similar level of security as methods such as RSA but with shorter keys, making it more efficient and particularly well suited to systems with limited resources, such as embedded systems and mobile devices, where the [storage and computational savings of smaller key sizes are highly desirable](https://doi.org/10.1109/ACCESS.2018.2881444)." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "a8e5646b-9459-4086-a566-322bac53fa63", - "metadata": {}, - "source": [ - "### Basic principles of elliptic curve cryptography\n", - "\n", - "An elliptic curve is typically of the form $y^2 = x^3 + ax + b$ with a few interesting properties.\n", - "* It is horizontally symmetric. So for any point $(x,y)$ on the curve, it's reflection $(x,-y)$ is also on the curve\n", - "* Any non-vertical strain line will only intersect the curve at a maximum of three points\n", - "\n", - "![Figure 1. Operations of addition and point doubling on an elliptic curve. Facet 1 defines P + Q = -R. Facet 2 illustrates point doubling 2Q = -P. Facet 3 defines the additive inverse of a point as its reflection about the x-axis i.e, P = -Q ](/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ECCfig.avif)\n", - "\n", - "*Figure 1. Operations of addition and point doubling on an elliptic curve. Facet 1 defines P + Q = -R. Facet 2 illustrates point doubling 2Q = -P. Facet 3 defines the additive inverse of a point as its reflection about the x-axis i.e, P = -Q*\n", - "\n", - "Elliptic curve cryptography makes use of applying a series of arithmetic operations to points on the curve. Each effectively navigates to a new point on the curve. This is a simple process to follow in one direction, and with shorter key sizes is more efficient than other algorithms like RSA, but trying to reverse this is very difficult, hence its application to cryptography.\n", - "\n", - "\n", - "\n", - "\n", - "An [elliptic curve](https://en.wikipedia.org/w/index.php?title=Elliptic_curve&oldid=1164567664) over an algebraic field $K$ is defined by a mathematical equation, typically in the form $y^2 = x^3 + ax + b$ with the coefficients $a, b \\in K$ and describes points $(x, y) \\in K \\otimes K$ with the additional requirement that the curve have no kinks or self-intersections.\n", - "\n", - "\n", - "The properties of elliptic curves allow for operations of \"addition\" and \"scalar multiplication\" to be defined involving points on the curve.\n", - "\n", - "\n", - "**Addition**: If $P$ and $Q$ are two points on an elliptic curve, then $P + Q$ describes a unique third point identified as follows: Draw the line that intersects $P$ and $Q$ and find the third point, $R$, at which the line intersects the curve again. We then define $P + Q = −R$, the point opposite $R$ reflected through the $x$-axis (see figure below) . When the line through $P, Q$ does not intersect the curve at any finite $(x, y)$, we say it intersects the curve at the point at infinity $\\mathbf{O}$.\n", - "\n", - "\n", - "Elliptic curve addition satisfies algebraic **group** properties with the point at infinity as the additive identity.\n", - "\n", - "\n", - "**Doubling and scalar multiplication:** The operation of point doubling which corresponds to scalar multiplication by $2$ is obtained by setting $P = Q$ in the addition operation and graphically involves the tangent line at $P$. General scalar multiplication by an integer $n$ defined as $nP = P + P + ...~n$ times is obtained by repeated doubling and addition.\n", - "\n", - "\n", - "" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "16b3b894-1119-452e-8f35-2a448282c24b", - "metadata": {}, - "source": [ - "### Elliptic curve discrete logarithm problem\n", - "\n", - "The elliptic curve discrete logarithm problem (ECDLP) has many similarities to the discrete logarithm problem discussed previously, being based around the challenges of finding factors.\n", - "\n", - "The operation of [scalar multiplication on elliptic curves](https://en.wikipedia.org/w/index.php?title=Elliptic_curve_point_multiplication&oldid=1145917191) allows for the definition of the [elliptic curve discrete logarithm problem](https://en.wikipedia.org/w/index.php?title=Elliptic-curve_cryptography&oldid=1160709993):\n", - "\n", - "Given points $P, Q$ on an elliptic curve such that $Q = nP$, determine $n$.\n", - "\n", - "This problem is known to be intractable on classical computers for large $n$ and provides a basis for cryptographic security.\n", - "\n", - "\n", - "\n", - "\n", - "Elliptic curve cryptography is primarily based on the ECDLP formulated on certain algebraic **finite fields**. In 1999, NIST recommended ten finite fields for use in ECC. These are:\n", - "\n", - " - Five **prime fields** $\\mathbb {F} _{p}$ for primes $p$ of size $\\{192, 224, 256, 384, 521\\}$ bits.\n", - " - Five **binary fields** $\\mathbb {F} _{2^{n}}$ for $n \\in \\{163, 233, 283, 409, 571\\}$.\n", - "\n", - "With the above setup, an ECC-based asymmetric key cryptosystem in the case of **prime fields** may be specified as follows:\n", - "\n", - "- Choose a $p$ from the NIST-recommended list of values to specify $\\mathbb {F} _{p}$.\n", - "- Select parameters $a, b$ of the elliptic curve.\n", - "- Choose a **base point** $G$ which \"generates\" a cyclic subgroup on the curve with order $n$; that is, the smallest integer such that $nG = \\mathbf{O}$.\n", - "- Calculate the **cofactor** $h = |E(\\mathbb {F} _{p})|/n$ where $|E(\\mathbb {F} _{p})|$ is the number of points on the curve. $h$ is typically a small integer.\n", - "- The **domain parameters** $(p, a, b, G, n, h)$ allow the specification of asymmetric keys in this way:\n", - "\n", - " - The private key is a randomly chosen integer $d$ with as many bits as in the prime $p$. It should be kept secret.\n", - " - The public key is the result of \"multiplying\" the base point $G$ by the private key $d$. This is typically denoted as $Q = dG$.\n", - "\n", - "Recovering $d$ is equivalent to solving the ECDLP, which is assumed to be intractable for large $d$. The ECDLP therefore forms the basis for key exchange and digital signature schemes in direct analogy with the Diffie-Hellman and DSA schemes defined over $(\\mathbb{Z}_p)^{\\times}$ discussed previously.\n", - "\n", - "\n", - "" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "05a34d2b-bd3b-4985-aaa4-b01630ba73de", - "metadata": {}, - "source": [ - "### Key exchange with ECC\n", - "\n", - "One of the primary uses of ECC is in the key exchange protocol known as [elliptic curve Diffie-Hellman](https://en.wikipedia.org/w/index.php?title=Elliptic-curve_Diffie%E2%80%93Hellman&oldid=1160050860) (ECDH). In ECDH, each party generates a private-public key pair and then exchanges public keys. Each party then uses their own private key and the other party's public key to compute a shared secret, which can be used as the key for symmetric encryption.\n", - "\n", - "While it's relatively easy to perform point addition on an elliptic curve and derive a public key from a private key, it's computationally infeasible to reverse the process and derive a private key from a public key. This \"one-way\" behavior provides the security of the ECDH key exchange.\n", - "\n", - "Here, we will illustrate an example of how one might perform an ECDH key exchange using Python and the library `cryptography`." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "37dbfe40-5dd6-4f07-b116-1b5d5dd87261", - "metadata": {}, - "outputs": [], - "source": [ - "from cryptography.hazmat.primitives.asymmetric import ec\n", - "from cryptography.hazmat.primitives import hashes\n", - "\n", - "# Each party generates a private key\n", - "private_key1 = ec.generate_private_key(ec.SECP384R1())\n", - "private_key2 = ec.generate_private_key(ec.SECP384R1())\n", - "\n", - "# They exchange public keys\n", - "public_key1 = private_key1.public_key()\n", - "public_key2 = private_key2.public_key()\n", - "\n", - "# Each party uses their own private key and the other party's public key\n", - "# to derive the shared secret\n", - "shared_key1 = private_key1.exchange(ec.ECDH(), public_key2)\n", - "shared_key2 = private_key2.exchange(ec.ECDH(), public_key1)\n", - "\n", - "# The shared secrets are the same\n", - "assert shared_key1 == shared_key2\n", - "print(\"Keys checked to be the same\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "436b2e15-6d28-427f-8796-122050cb555e", - "metadata": {}, - "source": [ - "### Digital signatures with ECC\n", - "\n", - "ECC can also be used to generate digital signatures using the [Elliptic Curve Digital Signature Algorithm](https://en.wikipedia.org/w/index.php?title=Elliptic_Curve_Digital_Signature_Algorithm&oldid=1162097661) (ECDSA). In ECDSA, the signer creates a signature using their private key, and others can verify the signature using the signer's public key. Just like with ECDH, the security of ECDSA relies on the ECDLP. It's computationally infeasible for someone to forge a signature without access to the signer's private key.\n", - "\n", - "The following is an example of a simple sign-and-verify transaction using ECDSA with Python and `cryptography`." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "659bafbc-30b7-4f69-99a5-22d0b62869c8", - "metadata": {}, - "outputs": [], - "source": [ - "from cryptography.hazmat.primitives import hashes\n", - "from cryptography.hazmat.primitives.asymmetric import ec\n", - "\n", - "# Generate a private key for use in the signature\n", - "private_key = ec.generate_private_key(ec.SECP384R1())\n", - "\n", - "message = b\"A message to be signed\"\n", - "\n", - "# Sign the message\n", - "signature = private_key.sign(message, ec.ECDSA(hashes.SHA256()))\n", - "\n", - "# Anyone can verify the signature with the public key\n", - "public_key = private_key.public_key()\n", - "\n", - "\n", - "def check_ecdsa_signature(public_key, signature, message):\n", - " try:\n", - " public_key.verify(signature, message, ec.ECDSA(hashes.SHA256()))\n", - " return True\n", - " except InvalidSignature:\n", - " return False\n", - "\n", - "\n", - "if check_ecdsa_signature(public_key, signature, message):\n", - " print(\"The signature is valid.\")\n", - "else:\n", - " print(\"The signature is invalid.\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "136f5e1c-5802-4d81-8f45-a631db2deb97", - "metadata": {}, - "source": [ - "In the above code, if one modifies the message after it has been signed, the verification will fail, providing a guarantee of authenticity and integrity for the message." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "1ae2bd69-9658-49dd-a231-e79326013d64", - "metadata": {}, - "source": [ - "### Breaking ECDH and ECDSA\n", - "\n", - "In an analogous way to the integer discrete logarithm problem, the ECDLP turns out to be hard on classical computers but has an efficient solution on quantum computers once again via Shor's algorithm. We refer you to recent literature for a discussion related to [generalizing Shor's algorithm to the ECDLP case](https://doi.org/10.1007/978-3-030-89432-0_8)." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "eae6c9c8-9389-498c-a260-04071e22769c", - "metadata": {}, - "source": [ - "## Summary\n", - "\n", - "In this lesson, we started by looking at the main characteristics of asymmetric key cryptography (AKC) and discussed basic security considerations that underpin asymmetric cryptosystems. In particular, we introduced the two main applications of AKC — namely, key exchange and digital signatures — both of which are essential components of modern internet-based communication.\n", - "\n", - "We then looked at the RSA cryptosystem, which since the 1970s, has proven to be of immense value for securing modern digital communications by enabling key exchange and digital signatures within a simple and versatile framework. The cryptographic security of RSA with respect to classical computing is based on the hardness of factoring large integers and requires key sizes in the range of 2048 bits to assure the integers used in practical applications are large enough to resist factorization.\n", - "\n", - "We then looked at Diffie-Hellman (DH) key exchange and the Digital Signature Algorithm (DSA). The security of these schemes is predicated on the integer discrete logarithm (DLP) problem, the private key being computationally hard to extract given the public key, with no polynomial time solution on classical computers. Use of random and unique keys affords additional security against attacks. Both the integer finite field and elliptic curve variants of the DH and DSA protocols currently find widespread use across many modern digital communications protocols such as [*TLS*](https://en.wikipedia.org/w/index.php?title=Transport_Layer_Security&oldid=1155601531), [*SSH*](https://en.wikipedia.org/w/index.php?title=Secure_Shell&oldid=1158549718), and so on.\n", - "\n", - "Finally we looked at Elliptic curve cryptography. With its efficient key size and strong security properties, it currently represents an excellent choice for many cryptographic applications, from key exchange to digital signatures.\n", - "\n", - "All of these algorithms have exposure to attack from quantum algorithms, since solutions can be developed to solve the mathematical problems which acted as a premise in their design. One such example is Shor's algorithm. Therefore they will need to be replaced by quantum-safe asymmetric cryptosystems which are more resilient to attack from quantum - as well as being as safe with classical algorithms. The mathematical problems they rely on can be solved efficiently by quantum computers, necessitating the development of quantum-safe asymmetric cryptosystems that can withstand quantum attacks while maintaining classical security.\n", - "\n", - "A future lesson will look at quantum-safe cryptosystems and discuss the required approach to maintain cryptographic security." - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3" - }, - "widgets": { - "application/vnd.jupyter.widget-state+json": { - "state": {}, - "version_major": 2, - "version_minor": 0 - } - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/learning/courses/quantum-safe-cryptography/cryptographic-hash-functions.ipynb b/learning/courses/quantum-safe-cryptography/cryptographic-hash-functions.ipynb deleted file mode 100644 index aaa7bd9dec3a..000000000000 --- a/learning/courses/quantum-safe-cryptography/cryptographic-hash-functions.ipynb +++ /dev/null @@ -1,400 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "id": "3d50812a-1695-4fa8-90c6-e0aed9b51bc8", - "metadata": {}, - "source": [ - "---\n", - "title: Cryptographic hash functions\n", - "description: In this lesson we will look at cryptographic hash functions which see extensive use in quick validation and authentication.\n", - "---\n", - "\n", - "\n", - "{/* cspell:ignore onewayfn, injectivity, randomoracle, WXYZ, VXYZ, Brassard, Høyer, QRAM, Chailloux, Schrottenloher, Shen */}" - ] - }, - { - "cell_type": "markdown", - "id": "48916182-96be-446c-a13e-e05a7093c4ce", - "metadata": {}, - "source": [ - "# Cryptographic hash functions\n", - "\n", - "In this lesson we will look at cryptographic hash functions which see extensive use in quick validation and authentication.\n", - "\n", - "By the end of the lesson we will have covered:\n", - " - What cryptographic hash functions are\n", - " - Python code examples demonstrating the use of hash functions\n", - " - A look at applications of cryptographic hashing\n", - " - The security of cryptographic hashing\n", - " - Threats to these algorithms from both classical and quantum computers" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "bfc93002-5016-4f8e-a27f-6d1039bbc578", - "metadata": {}, - "source": [ - "## Introduction to cryptographic hashing\n", - "\n", - "[Hash functions](https://en.wikipedia.org/w/index.php?title=Cryptographic_hash_function&oldid=1159000809) represent a valuable construct in cryptography as they help enable validation with confidentiality. As such, hash functions form an important component of mechanisms for data authentication and integrity, such as [hash-based message authentication codes](https://en.wikipedia.org/w/index.php?title=HMAC&oldid=1158164088) (HMAC) and [digital signatures](https://en.wikipedia.org/w/index.php?title=Digital_signature&oldid=1161173191). This article will discuss the basic ideas and security considerations underpinning cryptographic hash functions and outline potential vulnerabilities from the advent of quantum computing." - ] - }, - { - "cell_type": "markdown", - "id": "8021f79c-3463-4d2e-aed1-f3a87938f7d0", - "metadata": {}, - "source": [ - "## Basic rationale and design of hash functions\n", - "\n", - "There are many situations where authentication and integrity verification need to be performed cheaply and without revealing private information to the party performing the validation.\n", - "\n", - "For example, when downloading software from a remote server, an efficient mechanism is needed to verify that the software actually downloaded has not been modified since being created by the original author of the software. Similarly, when authenticating users of web applications, it would be desirable to use a mechanism that does not involve physically storing or transmitting the actual passwords, which can potentially compromise their confidentiality.\n", - "\n", - "*Cryptographic hash functions* (CHFs) address such needs efficiently and securely.\n", - "\n", - "Fundamentally, a cryptographic hash function takes an input (or *message*) of arbitrary length and returns a fixed-size string of n-bits as output. The output of a CHF is also referred to as a *digest*." - ] - }, - { - "cell_type": "markdown", - "id": "bad81855-a824-412b-a266-e01a9ddeaeeb", - "metadata": {}, - "source": [ - "A useful CHF should satisfy several key properties:\n", - "\n", - "1. **Uniformity:** The digests produced by a CHF should be distributed uniformly and should look random. The aim is to ensure the output leaks no information about the input.\n", - "2. **Determinism:** For a given input, a CHF must always produce the same digest, that is, it must be deterministic.\n", - "3. **Irreversibility:** A CHF is a *one-way function* in that, given a digest, it should be infeasible to invert the hashing and obtain the input.\n", - "4. **Approximate injectivity:** While CHFs are many-to-one functions, they should appear to look like one-to one functions. This is achieved by combining an enormous output space size with the avalanche effect whereby tiny changes in the input lead to wildly divergent digests. This characteristic is known as approximate injectivity.\n", - "\n", - "Given this, it's possible to validate a piece of data against the original instance by comparing a digest of the data to a digest of the original.\n", - " - If the two digests match, we can be confident with high probability that the data is identical to the original.\n", - " - If the digests differ, we can be sure that the data was tampered with or is otherwise inauthentic.\n", - "\n", - "Since the CHF digests themselves do not reveal the actual contents of the data or the original, they enable validation while preserving privacy.\n", - "\n", - "\n", - "\n", - "Mathematical description\">\n", - "\n", - "A hash function $H$ can be defined as:\n", - "\n", - "$H : Σ^* \\rightarrow \\{0,1\\}^n$\n", - "\n", - "where $Σ^*$ is the set of all possible strings which we may consider to be binary strings of any length.\n", - "\n", - "\n", - "The fact that the size of the input domain $Σ^*$ of $H$ is unbounded while that of the co-domain $\\{0,1\\}^n$ is bounded means that $H$ is necessarily many-to-one mapping infinitely many inputs to any given n-bit string.\n", - "\n", - "\n", - "The properties of uniformity and determinism are nicely encapsulated within the *random oracle model* of cryptographic hashing.\n", - "\n", - " \n", - "" - ] - }, - { - "cell_type": "markdown", - "id": "50354fe2-08cd-4876-8a7d-b65fc86e551a", - "metadata": {}, - "source": [ - "## Example of cryptographic hashing in Python with SHA-256\n", - "\n", - "This simple example demonstrates cryptographic hashing using the popular [SHA-256](https://en.wikipedia.org/w/index.php?title=SHA-2&oldid=1155462953) algorithm as provided by the `cryptography` Python library." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "8a55a611-63fe-473f-9545-50a90747b680", - "metadata": {}, - "source": [ - "First we show how a minor difference in plain texts leads to a very large difference in the hash digests." - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "id": "c3776040-036f-4b13-ae18-8fc3ba4c8398", - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "The two messages differ by 1 characters\n" - ] - } - ], - "source": [ - "# Begin by importing some necessary modules\n", - "from cryptography.hazmat.backends import default_backend\n", - "from cryptography.hazmat.primitives import hashes\n", - "\n", - "\n", - "# Helper function that returns the number of characters different in two strings\n", - "def char_diff(str1, str2):\n", - " return sum(str1[i] != str2[i] for i in range(len(str1)))\n", - "\n", - "\n", - "# Messages to be hashed\n", - "message_1 = b\"Buy 10000 shares of WXYZ stock now!\"\n", - "message_2 = b\"Buy 10000 shares of VXYZ stock now!\"\n", - "\n", - "print(f\"The two messages differ by { char_diff(message_1, message_2)} characters\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "4ccc7cdd-6235-4309-946b-ed8bd8169d3e", - "metadata": {}, - "source": [ - "The two messages differ in exactly one character.\n", - "\n", - "Next, we instantiate `hash` objects to enable the hashing process, which involves calls to two methods: `update` and `finalize`.\n", - "\n", - "We see that due to the avalanche effect in the SHA-256 CHF, a one-character difference in input messages yields two very different digests." - ] - }, - { - "cell_type": "code", - "execution_count": 2, - "id": "e60af579-f19f-41ff-8ff8-ccaad6b00e21", - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "digest-1: 6e0e6261b7131bd80ffdb2a4d42f9d042636350e45e184b92fcbcc9646eaf1e7\n", - "digest-2: 6b0abb368c3a1730f935b68105e3f3ae7fd43d7e786d3ed3503dbb45c74ada46\n", - "The two digests differ by 57 characters\n" - ] - } - ], - "source": [ - "# Create new SHA-256 hash objects, one for each message\n", - "chf_1 = hashes.Hash(hashes.SHA256(), backend=default_backend())\n", - "chf_2 = hashes.Hash(hashes.SHA256(), backend=default_backend())\n", - "\n", - "# Update each hash object with the bytes of the corresponding message\n", - "chf_1.update(message_1)\n", - "chf_2.update(message_2)\n", - "\n", - "# Finalize the hash process and obtain the digests\n", - "digest_1 = chf_1.finalize()\n", - "digest_2 = chf_2.finalize()\n", - "\n", - "# Convert the resulting hash to hexadecimal strings for convenient printing\n", - "digest_1_str = digest_1.hex()\n", - "digest_2_str = digest_2.hex()\n", - "\n", - "# Print out the digests as strings\n", - "print(f\"digest-1: {digest_1_str}\")\n", - "print(f\"digest-2: {digest_2_str}\")\n", - "\n", - "print(f\"The two digests differ by { char_diff(digest_1_str, digest_2_str)} characters\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "5b0d1239-070f-42dc-8d41-2d4462d7bf09", - "metadata": {}, - "source": [ - "## Applications of cryptographic hashing\n", - "\n", - "The unique properties of CHFs make them suitable for a wide array of applications:\n", - "\n", - "- **Data integrity checks:** Hash functions can be used to create a checksum for a set of data. Any modifications to the data, intentional or not, will result in a different checksum, alerting systems or users to the change. The checksum is also typically much more compact than the original data, which makes checksum comparisons very fast.\n", - "\n", - "![Fig 1: Secure hashing for data integrity checks](/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/data-integrity.svg)\n", - "\n", - "*Figure 1. Secure hashing for data integrity*\n", - "\n", - "- **Digital signatures:** Cryptographic hashes are essential to the functioning of digital signatures as they involve comparing cryptographically hashed messages to establish authenticity and integrity while preserving privacy.\n", - "\n", - "![Fig 2: Digital signatures](/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/digital-signature.svg)\n", - "\n", - "*Figure 2. Digital signatures*\n", - "\n", - "- **Blockchain and cryptocurrencies:** Cryptocurrencies like Bitcoin rely heavily on CHFs, particularly in creating transaction integrity and enabling consensus mechanisms like *proof of work*." - ] - }, - { - "cell_type": "markdown", - "id": "a1b8348e-3f6f-4e57-96a6-c02d96b04e5e", - "metadata": {}, - "source": [ - "## Security of cryptographic hashing\n", - "\n", - "The security of a CHF is typically assessed based on resistance to two types of attacks: [pre-image](https://en.wikipedia.org/w/index.php?title=Preimage_attack&oldid=1145879411) and [collision](https://en.wikipedia.org/w/index.php?title=Collision_attack&oldid=1138239916).\n", - "\n", - "### Pre-image resistance\n", - "\n", - "*Pre-image resistance* means that given a digest, it should be infeasible to find the input.\n", - "\n", - "This is related to the one-way property of CHFs.\n", - "\n", - "A good CHF is designed in such a way that a party wishing to conduct a pre-image attack has no better option than a brute force approach, which has time complexity $2^n$.\n", - "\n", - "\n", - "\n", - "Mathematical details\">\n", - "\n", - "Given a CHF $H$ and digest $g$, it should be computationally infeasible to find any input $m$ from the pre-image of $g$ whereby $H(m) = g$.\n", - "\n", - " \n", - "" - ] - }, - { - "cell_type": "markdown", - "id": "9ef9cc2f-0be6-4961-8a4d-aad775d5e8be", - "metadata": {}, - "source": [ - "### Collision resistance\n", - "\n", - "*Collision resistance* means that it is difficult to find two different inputs that hash to the same digest.\n", - "\n", - "A *cryptographic hash collision* occurs when two inputs hash to the same digest. While collisions inevitably exist given the many-to-one nature of CHFs, a good CHF nevertheless makes it infeasible to locate one at will.\n", - "\n", - "Collision resistance is crucial for applications like digital signatures and certificates, where it could be disastrous if a malicious party were able to create a forgery that hashes to the same value.\n", - "\n", - "\n", - "\n", - "Mathematical details of hash collisions\">\n", - "\n", - " $m_1, m_2$ can be found such that $H(m_1) = H(m_2)$.\n", - "\n", - " \n", - "" - ] - }, - { - "cell_type": "markdown", - "id": "c28ba5d3-80a6-4493-8a30-e040ab500164", - "metadata": {}, - "source": [ - "### Hash length\n", - "\n", - "Collision resistance is a harder requirement than pre-image resistance and necessitates output lengths twice as long as that needed for pre-image resistance. This is because a brute force attack known as the [birthday attack](https://en.wikipedia.org/w/index.php?title=Birthday_attack&oldid=1161075943), which can be used to identify hash collisions, has time complexity $2^{n/2}$.\n", - "\n", - "In the absence of cryptanalytic weaknesses, the security of a hash function is therefore primarily influenced by its hash length. The longer the hash, the more secure it is, as it becomes harder to mount brute force attacks." - ] - }, - { - "cell_type": "markdown", - "id": "633c27c1-aa95-4be7-8d20-a84cfe921e6c", - "metadata": {}, - "source": [ - "## Commonly used cryptographic hash functions\n", - "The following table lists some commonly used cryptographic hash functions, along with their hash lengths and primary application domains:\n", - "\n", - "| Hash Function | Output Length (bits) | Common Applications |\n", - "|---------------|----------------------|------------------------------------------------------------|\n", - "| MD5 | 128 | File integrity checking, older systems, non-crypto uses |\n", - "| SHA-1 | 160 | Legacy systems, Git for version control |\n", - "| SHA-256 | 256 | Cryptocurrency (Bitcoin), digital signatures, certificates |\n", - "| SHA-3 | Variable (up to 512) | Various cryptographic applications, successor to SHA-2 |\n", - "| Blake2 | Variable (up to 512) | Cryptography, replacing MD5/SHA-1 in some systems |\n", - "| Blake3 | Variable (up to 256) | Cryptography, file hashing, data integrity |\n", - "\n", - "- [MD5](https://en.wikipedia.org/w/index.php?title=MD5&oldid=1161719955) and [SHA-1](https://en.wikipedia.org/w/index.php?title=SHA-1&oldid=1161401043), while still seen in less sensitive applications places, are considered deprecated in terms of collision resistance and are not recommended for new systems.\n", - "SHA-256, part of the [SHA-2](https://en.wikipedia.org/w/index.php?title=SHA-2&oldid=1155462953) family, is widely used and currently secure for most applications.\n", - "- [SHA-3](https://en.wikipedia.org/w/index.php?title=SHA-3&oldid=1161463128) is a newer standard that was selected by NIST in 2015 as the winner of the NIST hash function competition. It's designed to be a drop-in replacement for SHA-2, but it also has some different internal characteristics and is resistant to certain types of attacks that might be effective against SHA-2.\n", - "- [Blake2 and Blake3](https://en.wikipedia.org/w/index.php?title=BLAKE_(hash_function)&oldid=1161463384) are cryptographic hash functions that are faster than MD5, SHA-1, SHA-2, and SHA-3, but at least as secure as the latest standard, SHA-3. They are increasingly being used in new systems, particularly where speed is important." - ] - }, - { - "cell_type": "markdown", - "id": "9c29c838-d006-4861-8892-5e95a53937b0", - "metadata": {}, - "source": [ - "### Quantum risks to traditional cryptographic hashing\n", - "\n", - "The primary quantum threat to cryptographic hashing is posed by brute force attacks.\n", - "\n", - "Given a particular digest, an attacker will try out random inputs until they locate one which produces the same digest.\n", - "\n", - "With $n$ bits in the input, there are $2^n$ possible values. Therefore, the attacker needs to try out around $2^{n-1}$ inputs to have a better than 50% chance of success." - ] - }, - { - "cell_type": "markdown", - "id": "046592c2-f94d-47cf-ae23-a80f84d7dbf6", - "metadata": {}, - "source": [ - "#### Grover's algorithm\n", - "\n", - "For such an unstructured search context, Grover's algorithm can provide a quadratic speedup using a technique known as quantum amplitude amplification, reducing the time complexity of a pre-image attack to $2^{n/2}$.\n", - "\n", - "In practical terms, this means that a 256-bit CHF, which is currently considered secure against pre-image attacks by classical computers, would provide the same level of security as a 128-bit CHF when faced with a quantum attacker utilizing Grover's algorithm.\n", - "\n", - "Grover's algorithm by itself is not known to provide additional quantum speedups with respect to collision attacks beyond the limit set by the [birthday attack](https://en.wikipedia.org/w/index.php?title=Birthday_attack&oldid=1161075943), which can be carried out on classical computers. Since the classical birthday attack already requires CHFs to employ hash lengths that are twice as long as needed for pre-image resistance, the fact that Grover search effectively halves the hash length with respect to pre-image attacks does not pose a practical threat.\n", - "\n", - "For example, in the case of SHA-256, performing on the order of $2^{128}$ operations to execute a Grover-assisted pre-image attack would still be infeasible in the foreseeable future." - ] - }, - { - "cell_type": "markdown", - "id": "fd61f809-f3d7-4d14-9381-a99a1b58fab5", - "metadata": {}, - "source": [ - "#### BHT algorithm\n", - "\n", - "A quantum algorithm that combines aspects of the birthday attack with Grover search was proposed in 1997 by [Brassard, Høyer, and Tapp](http://arxiv.org/abs/quant-ph/9705002) (BHT) and affords a theoretical scaling of $O(2^{n/3})$ for finding hash collisions. However, this improved scaling is predicated on the existence of quantum random access memory [QRAM](http://arxiv.org/abs/2205.14023) technology, which currently does not exist.\n", - "\n", - "Without QRAM, the realizable scaling is $\\tilde{O}(2^{2n/5})$ and for hash lengths currently in use, this marginal improvement in collision-finding capability relative to the birthday attack does not represent a critical threat." - ] - }, - { - "cell_type": "markdown", - "id": "862061f9-1fcf-4380-98bb-f409438d8d6e", - "metadata": {}, - "source": [ - "## Summary\n", - "\n", - "Cryptographic hash functions are an essential component for ensuring data integrity and privacy in digital information systems and find widespread application in many contexts.\n", - "\n", - "The security requirements of CHFs are mainly understood in terms of their resistance to pre-image and collision attacks. For well-designed CHFs, the hash length is a good proxy for the security level.\n", - "\n", - "While the advent of quantum computers executing the Grover and BHT algorithms in theory affects the pre-image and collision resistance of traditional CHFs, the long hash lengths already in use today means that modern cryptographic hashing algorithms, such as SHA-3, are likely to remain secure barring the discovery of as-yet-unknown cryptanalytic attacks.\n", - "\n", - "The relevance of CHFs lies in their role as a fundamental building block for quantum-resistant cryptographic schemes, ensuring that digital information remains secure even in the face of potential future advancements in quantum computing algorithms and technologies." - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3" - }, - "widgets": { - "application/vnd.jupyter.widget-state+json": { - "state": {}, - "version_major": 2, - "version_minor": 0 - } - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/learning/courses/quantum-safe-cryptography/exam.mdx b/learning/courses/quantum-safe-cryptography/exam.mdx deleted file mode 100644 index 88eeb86b202a..000000000000 --- a/learning/courses/quantum-safe-cryptography/exam.mdx +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Exam | Practical introduction to quantum-safe cryptography -description: Take a 20-question exam on the IBM Training site to test your quantum-safe cryptography skills and receive a badge through Credly. ---- - -# Exam and badge - -![A square badge stating the name of this course, foundational level, and issued by IBM Quantum®.](/learning/images/courses/quantum-safe-cryptography/exam/badge.avif) - -## Post-course survey - -Congratulations on completing this course! Please take a moment to help us improve our course by filling out the following [quick survey](https://your.feedback.ibm.com/jfe/form/SV_d3XWeuV7hEC8Dki). Your feedback will be used to enhance our content offering and user experience. Thank you! - -## Test your knowledge - -After completing the reading and activities in this course, click the button below to navigate to IBM® Training, where you can take the badging exam for Quantum-safe cryptography. - -The exam consists of 20 questions, and you must answer at least 16 correctly to pass. Upon receiving a passing score, your badge will automatically be sent to the email you used to register with IBM® Training. - -Make sure you're ready to take the exam. If you don't receive a passing score in two attempts, the exam becomes temporarily locked. - -Notice: These exams on the IBM Training site may be temporarily unavailable in the next few days, due to maintenance. - - - -NOTICE: IBM leverages the services of Credly, a third-party data processor authorized by IBM and located in the United States, to assist in the administration of the IBM Digital Badge program. In order to issue you an IBM Digital Badge, your personal information (name, email address, and badge earned) will be shared with Credly. You will receive an email notification from Credly with instructions for claiming the badge. Your personal information is used to issue your badge and for program reporting and operational purposes. IBM may share the personal information collected with IBM subsidiaries and third parties globally. It will be handled in a manner consistent with IBM privacy practices. The IBM Privacy Statement can be viewed [here.](https://www.ibm.com/privacy/us/en/) \ No newline at end of file diff --git a/learning/courses/quantum-safe-cryptography/index.mdx b/learning/courses/quantum-safe-cryptography/index.mdx deleted file mode 100644 index e0b52b79f7ba..000000000000 --- a/learning/courses/quantum-safe-cryptography/index.mdx +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Overview -description: Learn the risks quantum computing poses to cryptography and learn what approaches are quantum-safe. ---- - -# Overview - -!["Hero image"](/learning/images/courses/quantum-safe-cryptography/hero.avif) - - -A practical introduction to quantum-safe cryptography is a free online course in IBM Quantum® Learning and serves as a primer on the foundational concepts in quantum-safe cryptography. - -This course was created for developers who are interested in modernizing their application security and features multimodal lessons and interactive live code examples in four core areas of cryptography: cryptographic hash functions, symmetric key cryptography, asymmetric key cryptography, and quantum-safe cryptography. - -By taking this course, developers will learn how the cybersecurity risk landscape is evolving as well as explore contemporary approaches poised to shape the quantum era. - -## Helpful materials - - - -PDFs of lecture notes will be available soon - - - -### Further reading - -- [Basics of quantum information](/learning/courses/basics-of-quantum-information/index), which offers an introduction to principles of quantum information and computation -- [Fundamentals of quantum algorithms](/learning/courses/fundamentals-of-quantum-algorithms/index), which explores computational advantages of quantum systems, and includes further details on algorithms such as Grover's algorithm -- [IBM Quantum Safe™](https://www.ibm.com/quantum/quantum-safe) -- [Why it’s time to take quantum-safe cryptography seriously](https://research.ibm.com/blog/quantum-safe-cryptography-for-industry) -- [Fundamentals of Encryption & Quantum-Safe Techniques](https://catalog.skills.network/2766) - -## Exam - -To earn your Quantum-safe cryptography badge, take the exam at IBM® Training. This exam is intended to be taken after reading the lessons in this course. After you pass the exam, you will be notified by Credly that you have earned a badge. - -[Exam](/learning/courses/quantum-safe-cryptography/exam) - -## Awarded badge - -!["Image of the awarded badge"](/learning/images/courses/quantum-safe-cryptography/exam/badge.avif) - -### Credly - -NOTICE: IBM leverages the services of Credly, a third-party data processor authorized by IBM and located in the United States, to assist in the administration of the IBM Digital Badge program. In order to issue you an IBM Digital Badge, your personal information (name, email address, and badge earned) will be shared with Credly. You will receive an email notification from Credly with instructions for claiming the badge. Your personal information is used to issue your badge and for program reporting and operational purposes. IBM may share the personal information collected with IBM subsidiaries and third parties globally. It will be handled in a manner consistent with IBM privacy practices. The IBM Privacy Statement can be viewed [here.](https://www.ibm.com/privacy/us/en/) IBM employees can view the IBM Internal Privacy Statement [here.](https://w3.ibm.com/w3publisher/w3-privacy-notice) - - - diff --git a/learning/courses/quantum-safe-cryptography/introduction-to-this-course.mdx b/learning/courses/quantum-safe-cryptography/introduction-to-this-course.mdx deleted file mode 100644 index 8f0101f0a1f7..000000000000 --- a/learning/courses/quantum-safe-cryptography/introduction-to-this-course.mdx +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Course introduction -description: This lesson provides an introduction to this course including an overview of the course contents, and approach to learning. ---- - - -## Course introduction - -This training is designed for both expert and non-expert developers who want to learn about how quantum computing poses a risk to existing cryptography as new quantum algorithms are able to break existing encryption schemes. - -Specifically, the default information is geared towards individuals with programming knowledge but limited or no experience in cryptography or quantum concepts. Practical Python examples are given which demonstrate the mathematical principles of cryptography, and can be used for some experimentation to improve understanding. This also caters to those seeking a high-level overview of quantum cryptography's workings and its significance in the modern world. - -Readers desiring a deeper understanding of both quantum physics concepts and cryptography should explore our expandable sections and presentations, which delve into the foundational mathematical concepts of this topic. - -Through this course, readers will learn how even today's data is at risk as it can be collected now, and decrypted later. It will demonstrate how our existing algorithms are compromised and introduce the innovative techniques which protect against such threats through an agile approach. - -## Key takeaways for this course - -By the end of this course, you will have a better understanding of: - -- Cryptographic primitives that underpin current cryptographic systems: - - Cryptographic Hashing - - Asymmetric Cryptography - - Symmetric Cryptography -- The quantum threat to classical encryption schemes -- Quantum-safe encryption schemes - -You will also have had the opportunity, if you wish, to run some example Python code demonstrating some of the approaches. - -Finally you can apply for a badge by passing an exam. - -## Tips for navigating this course - -In this course, you can pace your learning however you prefer. The total duration is approximately 6–7 hours including the additional presentations, and running the sample code, though this time will vary depending on your existing knowledge and any links you follow. If you need to leave the course, you can easily return later. - -You can see where you are in the course material using the navigation on the left hand side of the main content. Individual lessons can be expanded to see a set of topics, and you can click to go back to previous topics. - -Additional References and hover-help can be found highlighted as you go through the material. - -## Before you begin - -An introductory presentation is linked from the **Helpful Materials** section on the course overview page. - -This provides: - - An introduction to cryptography - - A maths primer - -If you are unfamiliar with these topics, you may wish to review this presentation before starting the lessons, or return to it if you feel the need later. - -## Lesson structure - -Each lesson will include: -- An introduction including the learning objective for this lesson -- Detail on the cryptography topic being presented including: - - An explanation of the the topic and current algorithms - - Math explanations and examples. Some of these are in collapsible sections so you can skip if you do not wish to understand the math detail. - - Optional Python code examples that can be run (you will need to be logged in) - - Risks from classical computing algorithms - - Risks from quantum computing algorithms - - Approaches to mitigate this risk -- A list of key takeaways from the lesson - -## Running the Python examples - -The Python code has been run already so that readers browsing the text can see the results without additional steps. However, and in particular for those with an interest in software development, you are encouraged to run these examples yourself. You can also experiment with input parameters and explore the principles in an experimental way. - -When you run a Python cell for the first time, you will be prompted to log in to IBM Quantum®. - -You should run each Python cell in order, from the beginning of the notebook. Later cells are typically dependent on earlier ones to set up libraries, variables, and so on. Each cell has been written to produce some output after execution. - - -The Python code examples are provided to demonstrate the mathematical principles of the algorithms being discussed. They are not intended to be used as actual implementations. It is essential to use well-supported and reviewed security libraries in any real-world usage. - - -## Digital Certification - -You have the opportunity to earn a [badge](https://www.credly.com/org/ibm/badge/practical-introduction-to-quantum-safe-cryptography) by successfully answering sufficient questions in the course assessment. - -You can try the assessment at any time. - -## Next steps after this course - -A presentation has been provided (see **Helpful Materials** on the course overview) that reviews the contents -covered in this course. You may wish to download so you can refer to it at a later point in time. - -Further courses are being developed which will follow on from this introduction and will cover topics including: -- Using quantum-safe encryption in practice -- Open-source libraries -- IBM® product offerings that can help diff --git a/learning/courses/quantum-safe-cryptography/quantum-safe-cryptography.ipynb b/learning/courses/quantum-safe-cryptography/quantum-safe-cryptography.ipynb deleted file mode 100644 index 0ff56fd76231..000000000000 --- a/learning/courses/quantum-safe-cryptography/quantum-safe-cryptography.ipynb +++ /dev/null @@ -1,889 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "id": "21ae46f6-6b84-4341-909a-fd6390dcbf2f", - "metadata": {}, - "source": [ - "---\n", - "title: Quantum-safe cryptography\n", - "description: In this lesson we will look at how moving to quantum-safe cryptography can protect data today against the threat of quantum algorithms.\n", - "---\n", - "\n", - "\n", - "{/* cspell:ignore SIDH primefactor, cryptosystems, Buchmann, Dahmen, Nazario, Diffie, DTMs, cryptologists, Homomorphic, Cryptologists, Eliece, Merkle, Isogeny, Supersingular, Zeadally, NTRU, isogeny, Sendrier, Dilithium, SPHINCS, FIPS, Lenstra, Lovász, smallsetminus,Miklós, Ajtai, Lyubashevsky, Micciancio, Díaz, Rolim, Regev, leftarrow, ciphertext, adots, liboqs, Stehle, Schwabe, kems, Decapsulation,recepient, kemalg, decapsulation, Ciphertext, plaintexts, OAEP, trival, ciphertexts, Fujisaki, Okamoto, Eiichiro, Okamato, Tatsuaki, Crytography */}" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "9aff03d6-24b3-4dda-b3d6-e93495ec7e31", - "metadata": {}, - "source": [ - "# Quantum-safe cryptography\n", - "\n", - "In this lesson we will look at how moving to quantum-safe cryptography can protect data today against the threat of quantum algorithms that could break it's protection in future .\n", - "\n", - "By the end of the lesson we will have covered:\n", - " - What quantum-safe cryptography is\n", - " - Standardization efforts including NIST competitions\n", - " - Mathematical basis of some new algorithms such as Lattices and Learning with Errors\n", - " - Some Python code examples demonstrating how new mathematic challenges can be used for encryption\n", - " - A look at some specific quantum-safe algorithms including those in the CRYSTALS suite\n", - " - Hybrid cryptography" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "6f38c512-4b68-4087-9089-7e7c0f16a2a6", - "metadata": {}, - "source": [ - "## Introduction to quantum-safe cryptography\n", - "\n", - "Since quantum computers represent a [distinct and potentially more powerful paradigm for computing](https://pubs.aip.org/aip/jap/article/132/16/160902/2837574/The-future-of-quantum-computing-with) than the classical computers in use today, cryptographic security needs to be reassessed for a world where quantum computers may proliferate, enabling new cryptographic attacks that would not be possible using classical computers.\n", - "\n", - "These attacks may occur in future on data that is being transmitted or stored now known as *harvest now, decrypt later*, so it is not sufficient to wait until the required systems are available, but to make changes now.\n", - "\n", - "The field of **quantum-safe cryptography** (QSC) encompasses efforts to [identify and develop cryptographic schemes](https://doi.org/10.1007/978-3-540-88702-7) that can withstand attacks both from quantum and classical computing systems. This is also sometimes called **quantum-resistant**, or **post-quantum cryptography**.`\n", - "\n", - "In earlier lessons, we discussed some of the potential security risks that the development of general-purpose quantum computers poses to a number of traditional cryptographic primitives such as symmetric key algorithms, cryptographic hash functions, and asymmetric key algorithms. Additionally, we mentioned cryptographically relevant quantum algorithms and the protocols they impact.\n", - "\n", - "We see that the most significant impacts of quantum algorithms occur in the context of asymmetric key cryptography, where [Shor's algorithm](https://doi.org/10.1109/SFCS.1994.365700) offers a polynomial-time solution to the prime factoring and discrete logarithm problems. Therefore, asymmetric cryptosystems based on factoring and discrete logarithms need to be replaced by new quantum-safe cryptography schemes.\n", - "\n", - "This is in contrast to the symmetric key and cryptographic hashing protocols impacted by the Grover and [BHT](https://doi.org/10.1007/BFb0054319) algorithms, where the quantum speedups are not super-polynomial. Therefore, in this latter case, existing algorithms such as AES and SHA-256 can be fortified at least in the medium term by ensuring sufficiently long key and hash lengths." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "e2ed2bd0-73bd-4c11-9f58-16696fb82d7a", - "metadata": {}, - "source": [ - "## Quantum algorithms and impacts to cryptography\n", - "\n", - "| Quantum Algorithm | Functionality | s basic operations of some sort will be sufficient to defeat it in some way.*\">Security Strength ($n$ = number of bits) | Impacted Cryptographic Protocols | Mitigation |\n", - "|-------------------|--------------------|------------------------------------------------------|--------------------------------------------------|------------------------|\n", - "| Shor | factoring | $poly(n)$ | RSA | Migrate to QSC |\n", - "| Shor | discrete logarithm | $poly(n)$ | Diffie-Hellman, DSA, Elliptic Curve Cryptography | Migrate to QSC |\n", - "| Grover | key search | $2^{n/2}$ | Symmetric key algorithms (for example, AES) | Sufficient key length |\n", - "| Grover | pre-image attack | $2^{n/2}$ | Hash functions (for example, SHA-256) | Sufficient hash length |\n", - "| BHT | collision attack | $2^{n/3}$ or $2^{2n/5}$ | Hash functions (for example, SHA-256) | Sufficient hash length |" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "d8bdba0c-e7a9-4133-a692-7d08b764dcba", - "metadata": {}, - "source": [ - "## Basic principles of quantum-safe cryptography\n", - "\n", - "### Computational complexity\n", - "\n", - "In cryptography, the *computational complexity class* [**NP (non-deterministic polynomial time)**](https://en.wikipedia.org/w/index.php?title=NP_(complexity)&oldid=1158889203) plays an important role. This class consists of decision problems for which proposed solutions can be verified in polynomial time using a deterministic Turing machine (DTM). The importance of NP stems from the fact that it is conjectured to consist of many computational problems that cannot be solved efficiently by both classical and quantum computers.\n", - "\n", - "The first generation of successful asymmetric key cryptosystems developed in the 1970s based their security on mathematical problems such as prime factorization and discrete logarithms that are now conjectured to belong to the **NP-intermediate** subclass of NP. This subclass consists of problems that are believed not to have polynomial-time solutions on DTMs but at the same time are also not as hard as the hardest problems in NP.\n", - "\n", - "The latter belong to the subclass [**NP-complete**](https://en.wikipedia.org/w/index.php?title=NP-completeness&oldid=1157123934). Following [Shor's algorithm](https://doi.org/10.1109/SFCS.1994.365700) in the 1990s, it became clear that at least some NP-intermediate problems are amenable to efficient solutions on quantum computers that are not DTMs.\n", - "\n", - "Therefore, modern quantum-safe cryptography schemes are based on NP-complete problems or related [**NP-hard**](https://en.wikipedia.org/w/index.php?title=NP-hardness&oldid=1153995836) problems, which currently are not known to be solvable efficiently even on quantum computers." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "7d5a1e8a-b7ef-4bd8-b712-fcf131445775", - "metadata": {}, - "source": [ - "### Average vs worst-case hardness\n", - "\n", - "While there are many known NP-hard problems, not every such problem is suitable as a basis for cryptographic security. In this context, the notion of [**average-case hardness**](https://en.wikipedia.org/w/index.php?title=Computational_hardness_assumption&oldid=1158033193) is useful for cryptography. A problem is **average-case hard** if most instances of the problem drawn randomly from some distribution are hard, whereas a problem is **worst-case hard** if it is hard only on some isolated *worst-case* instances. Quantum-safe cryptologists therefore search for mathematical problems that satisfy the assumption of average-case hardness and employ theoretical tools such as worst-case to average-case [reductions](http://arxiv.org/abs/2208.08125) to identify suitable protocols whose security and efficiency can be guaranteed." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "5132563a-64bc-4c10-8502-d20cf21fdb74", - "metadata": {}, - "source": [ - "### Mathematical structures\n", - "\n", - "Cryptologists have put forth a number of different mathematical structures that satisfy the necessary hardness requirements as potential candidates for quantum-safe migration of asymmetric key cryptosystems. Some well-known families include:\n", - "\n", - "1. [**Lattice-based cryptography:**](http://arxiv.org/abs/2208.08125) This class of algorithms relies on the hardness of problems such as the shortest vector problem (SVP) and the closest vector problem (CVP) in [lattice structures](https://en.wikipedia.org/w/index.php?title=Lattice_problem&oldid=1149662985). Notable lattice-based schemes include [NTRU](https://en.wikipedia.org/w/index.php?title=NTRU&oldid=1107481357) and [Learning with Errors](https://doi.org/10.1109/CCC.2010.26) (LWE).\n", - "\n", - "2. [**Code-based cryptography:**](https://doi.org/10.1007/978-3-540-88702-7_4) This type of cryptography is based on the difficulty of decoding a general linear code. The most notable example is the [McEliece cryptosystem](https://en.wikipedia.org/w/index.php?title=McEliece_cryptosystem&oldid=1158412532).\n", - "\n", - "3. [**Multivariate cryptography:**](https://en.wikipedia.org/w/index.php?title=Multivariate_cryptography&oldid=1117344303) These systems involve equations of multiple variables over a finite field. A well-known system in this category is the HFE (Hidden Field Equations) scheme.\n", - "\n", - "4. [**Hash-based cryptography:**](https://en.wikipedia.org/w/index.php?title=Hash-based_cryptography&oldid=1159153101) These are cryptographic systems that use only cryptographic hash functions. They are often used for digital signatures, like the Merkle signature scheme.\n", - "\n", - "5. [**Isogeny-based cryptography:**](https://www.computer.org/csdl/magazine/it/2019/06/08896171/1eS9UwZEbjG) These systems are based on the difficulty of certain problems in the algebraic structure of elliptic curves. [Supersingular Isogeny Diffie-Hellman](https://en.wikipedia.org/w/index.php?title=Supersingular_isogeny_key_exchange&oldid=1163291033) (SIDH) is an example." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "a8750d9f-fbaa-42ae-b3bc-87516f2fd822", - "metadata": {}, - "source": [ - "## NIST standardization of quantum-safe cryptography\n", - "\n", - "Recognizing the potential impact of quantum computing on current cryptographic systems, NIST initiated a program to standardize quantum-safe cryptographic algorithms in 2016 using a process similar to the one NIST followed to standardize the Advanced Encryption Standard (AES) in the early 2000s. In an open and transparent process involving security domain stakeholders, several QSC candidates were submitted for evaluation, and following a six-year review process, [NIST announced a list of four finalists](https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms) to become a part of NIST’s quantum-safe cryptographic standard." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "01725175-b792-494b-8773-4ea9312526e7", - "metadata": {}, - "source": [ - "### Finalists of the first NIST quantum-safe cryptography standardization effort\n", - "\n", - "| QSC Algorithm | Cryptographic family | Application |\n", - "|--------------------|----------------------|---------------------------------|\n", - "| CRYSTALS-Kyber | Lattice-based | Key encapsulation mechanism |\n", - "| CRYSTALS-Dilithium | Lattice-based | Digital signatures |\n", - "| FALCON | Lattice-based | Lightweight digital signatures |\n", - "| SPHINCS+ | Hash-based | Digital Signatures |\n", - "\n", - "\n", - "Of the four NIST finalists, three are lattice-based and one, [SPHINCS+](https://sphincs.org/), is hash-based. The Kyber and Dilithium algorithms, part of the [CRYSTALS cryptographic suite](https://pq-crystals.org/), were selected to be general-purpose protocols for key encapsulation and digital signatures, respectively. [FALCON](https://en.wikipedia.org/w/index.php?title=Falcon_(signature_scheme)&oldid=1157852190) was recommended for applications requiring smaller digital signatures than those provided by Dilithium. [SPHINCS+](https://sphincs.org/) meanwhile was primarily chosen as a backup option to the lattice-based approaches, as it uses a different mathematical structure. Lattice-based cryptography therefore seems well-positioned to form the basis for the first-generation of QSC standards.\n", - "\n", - "In August 2023, [NIST published three draft standards](https://csrc.nist.gov/news/2023/three-draft-fips-for-post-quantum-cryptography) for comments - which include the algorithms above:\n", - "- [FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard](https://csrc.nist.gov/pubs/fips/203/ipd)\n", - "- [FIPS 204, Module-Lattice-Based Digital Signature Standard](https://csrc.nist.gov/pubs/fips/204/ipd)\n", - "- [FIPS 205, Stateless Hash-Based Digital Signature Standard](https://csrc.nist.gov/pubs/fips/205/ipd)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "43808ca7-09bd-41cc-a56d-ad20bebe2583", - "metadata": {}, - "source": [ - "## Lattice-based cryptography\n", - "\n", - "As the name suggests, [lattice-based cryptography](https://en.wikipedia.org/w/index.php?title=Lattice-based_cryptography&oldid=1163912863) (LBC) is based on the hardness of certain problems defined on mathematical structures called [**lattices**](https://en.wikipedia.org/w/index.php?title=Lattice_problem&oldid=1149662985).\n", - "\n", - "Of fundamental importance are two computational problems on lattices, namely the **shortest vector problem** and the **learning with errors problem**, which we discuss below after some preliminary definitions.\n", - "\n", - "### Lattices\n", - "\n", - "We can think of what a lattice is in the world around us. The Eiffel tower (Paris), or Birds-nest stadium (Beijing). Those structures have many linked elements which can be thought of as a series of points joined together along straight lines.\n", - "\n", - "Diamonds are another form of lattice. There is a clear, repeating structure of Carbon atoms. They are then effectively joined together by atomic bonds; and this structure that is formed is what gives diamond its unique properties. However, different crystal structures can have very different layouts (can be thought of as our lattice structure), and therefore ends up with distinct features. Hence, lattices serve as the foundational mathematical framework that dictates the unique traits of different structures which we use in cryptography.\n", - "\n", - "In simple mathematical terms, a lattice can be thought of as a collection of regularly spaced points that repeat at fixed intervals. To describe how these points are positioned relative to each other, we use vectors. The specific arrangement of these vectors, which defines the layout of the lattice, is referred to as the *basis.*\n", - "\n", - "Imagine you have a box of toy construction bricks, and you want to build various objects with the same set of pieces. Each unique object you create requires a specific arrangement, and the way you choose and arrange the bricks serves as the *basis* for constructing different objects. If you change the selection or arrangement of bricks, you get a different object with distinct characteristics.\n", - "\n", - "Similarly, in a lattice, the *basis* is like the set of atomic building blocks that define the lattice's structure. Depending on how you arrange these building blocks (atoms or points) in the lattice, you can create various lattice structures with different properties. Just as changing the toy construction brick pieces changes the object you build, altering the basis changes the lattice's characteristics and properties.\n", - "\n", - "It's important to note that lattices are not limited to two or three dimensions; they can extend to higher dimensions, and in fields like cryptography, they may involve 1000s or more dimensions.\n", - "\n", - "\n", - "\n", - "\n", - "- Given $n$ linearly independent vectors $A = \\{\\mathbf{v_1},...,\\mathbf{v_n} | \\mathbf{v_i} \\in \\mathbb{R}^m\\}$, the *lattice* $\\mathcal{L}$ generated by $A$ is the set of integer linear combinations $\\mathcal{L} = \\{ \\sum_i c_i \\mathbf{v_i} | c_i \\in \\mathbb{Z} \\}$\n", - "- A *basis* $B$ of a lattice $\\mathcal{L}$ is any set of linearly independent vectors $B=\\{b_1,...,b_n\\}$ that spans the lattice i.e, $\\mathcal{L}(B) = \\{ \\sum_i z_i b_i | z_i \\in \\mathbb{Z} \\}$.\n", - "- Importantly, the basis for a given lattice is not unique. Two different basis sets $B, B^{\\prime}$ can describe the same lattice.\n", - "\n", - "\n", - "\n", - "\n", - "Not every basis is unique - it may just be a different perspective of the same structure.\n", - "\n", - "This leads to an important concept in lattice mathematics, that of [*lattice-basis reduction*](https://en.wikipedia.org/w/index.php?title=Lattice_reduction&oldid=1139588628). This is the process of taking a given integer lattice and attempting to find a *good* basis comprising short, nearly orthogonal vectors.\n", - "\n", - "![Fig 1: Lattice-basis reduction in two dimensions from a \"bad\" basis v_1, v_2 to a good basis u_1, u_2](/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/Lattice-reduction-wiki.avif)\n", - "\n", - "*Figure 1. Lattice-basis reduction in two dimensions from a \"bad\" basis $v_1$, $v_2$ to a good basis $u_1$, $u_2$*\n", - "\n", - "Lattice-basis reductions can be performed in polynomial-time using the [**Lenstra–Lenstra–Lovász** algorithm](https://en.wikipedia.org/w/index.php?title=Lenstra%E2%80%93Lenstra%E2%80%93Lov%C3%A1sz_lattice_basis_reduction_algorithm&oldid=1151925724) (LLL)." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "7d8df234-9631-488f-8bb4-9ce2ae1a85a8", - "metadata": {}, - "source": [ - "### The shortest vector problem\n", - "\n", - "The **shortest vector problem** (SVP) is the challenge of finding the shortest distance (vector), between any two points in the lattice\n", - "\n", - "\n", - "\n", - "\n", - "Given a lattice $\\mathcal{L}$ embedded in a vector space $\\mathcal{V}$ with norm $N$, the [SVP](https://en.wikipedia.org/w/index.php?title=Lattice_problem&oldid=1149662985) asks for the shortest non-zero vector in $\\mathcal{L}$ as measured by $N$, that is, find a vector $v$ such that its length $\\|v\\|_N = \\min\\limits_{v^{\\prime} \\in \\mathcal{L} \\smallsetminus \\{\\mathbf{0}\\}} \\|v^{\\prime}\\|_N = \\lambda(\\mathcal{L})$.\n", - "\n", - "\n", - "\n", - "\n", - "![Fig 2: The SVP on a lattice specified by basis vectors b_1, b_2: The orange vector is the shortest vector](/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/SVP.avif)\n", - "\n", - "*Figure 2. The SVP on a lattice specified by basis vectors $b_1$, $b_2$: The yellow vector is the shortest vector*\n", - "\n", - "[Miklós Ajtai has shown that the shortest vector problem is **NP-hard**](https://dl.acm.org/doi/10.1145/237814.237838) in the worst case for certain random lattices, even when lattice-basis reduction to a *good* basis is possible.\n", - "\n", - "Ajtai also demonstrated that there exists a worst-case to average-case reduction for the shortest vector problem, laying the foundation for its use in cryptography." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "e133436a-a592-4e3f-b7cf-cb6473c5dbc6", - "metadata": {}, - "source": [ - "### The closest vector problem\n", - "\n", - "In the **closest vector problem** (CVP) we are looking to find the closest point on the lattice to the origin, or location given.\n", - "\n", - "The CVP is also known to be NP-hard.\n", - "\n", - "![Fig 3: The CVP on a lattice specified by basis vectors b_1, b_2: The red point represents the closest lattice vector to the given external vector shown in green that is not on the lattice](/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/CVP.avif)\n", - "\n", - "*Figure 3. The CVP on a lattice specified by basis vectors $b_1$, $b_2$: The red point represents the closest lattice vector to the given external vector shown in green that is not on the lattice*\n", - "\n", - "The *shortest vector problem* is a special case of the *closest vector problem*.\n", - "\n", - "\n", - "\n", - "\n", - "A lattice $\\mathcal{L}$ embedded in a vector space $\\mathcal{V}$ with metric $M$ is given, along with a vector $v$ in $\\mathcal{V}$ but not necessarily in $\\mathcal{L}$. The task then is to find the vector $u$ in $\\mathcal{L}$ closest to $v$ as measured by $M$ that is, $d_M (u, v) = \\min\\limits_{u^{\\prime} \\in \\mathcal{L}} d_M(u^{\\prime}, v)$ where $d_M$ is the distance function of the metric $M$.\n", - "\n", - "\n", - "" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "74520042-cb9b-4f97-a795-d9a7e9af3904", - "metadata": {}, - "source": [ - "### The bounded distance decoding problem\n", - "\n", - "Very similar to the CVP is the [**bounded distance decoding**](https://doi.org/10.1007/11830924_41) (BDD) problem.\n", - "\n", - "In this case we know that the origin supplied is close to the lattice, but not *how close*, ie *bounded*.\n", - "\n", - "\n", - "\n", - "\n", - "It is additionally specified that the external vector $v$ is at most within a distance $\\sigma\\lambda(\\mathcal{L})$, where $\\lambda(\\mathcal{L})$ is the length of the shortest vector in the lattice and $\\sigma$ is a small parameter.\n", - "\n", - "\n", - "" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "f2d24ee5-e7ae-40aa-ad8e-5d69ebd037cd", - "metadata": {}, - "source": [ - "### The learning with errors problem\n", - "\n", - "\n", - "The learning with errors (LWE) problem is based on the mathematics of lattices combined with the idea of introducing errors into an equation.\n", - "\n", - "As is the case with any mathematical basis for cryptographic algorithms we can easily introduce noise as we make a series of calculations, but trying to find the inverse is very difficult.\n", - "\n", - "\n", - "\n", - "\n", - "The [learning with errors problem](https://en.wikipedia.org/w/index.php?title=Learning_with_errors&oldid=1153719613) ${\\mathrm{LWE}_{q,\\chi}}$ with modulus $q$ and error distribution $\\chi$ is: Given access only to polynomially many samples $(\\mathbf {a} ,t)$ of choice from Alice's distribution $A_{\\mathbf{s},\\chi }$, \"learn\" and output the secret vector ${\\mathbf{s}}\\in {\\mathbb{Z}}_{q}^{n}$.\n", - "\n", - "- Let ${\\mathbb {Z} _{q}}$ be the ring of integers modulo $q$.\n", - "- Let ${\\mathbb {Z}_{q}^{n}}$ be the set of $n$-dimensional vectors over ${\\displaystyle \\mathbb{Z}_{q}}$.\n", - "- An adversary — say, Alice — chooses a fixed vector ${\\mathbf{s}} \\in {\\mathbb {Z}}_{q}^{n}$ and keeps it a secret.\n", - "- Alice also specifies $\\chi$, a fixed \"error\" probability distribution over $\\mathbb {Z} _{q}$.\n", - "- Using the above ingredients, she constructs a distribution $A_{\\mathbf{s},\\chi }$ on ${\\mathbb{Z}}_{q}^{n}\\times{\\mathbb {Z} _{q}}$ as follows:\n", - " 1. From the uniform distribution over ${\\mathbb{Z}}_{q}^{n}$, Alice chooses a vector ${\\mathbf{a}}\\in {\\mathbb{Z}}_{q}^{n}$ .\n", - " 2. From the given distribution $\\chi$, she picks a number $ {\\displaystyle \\varepsilon \\in \\mathbb {Z} _{q} }$.\n", - " 3. She then evaluates ${\\displaystyle t=\\langle \\mathbf{a} ,\\mathbf {s} \\rangle + \\varepsilon}$, where $\\langle\\mathbf{a},\\mathbf{s}\\rangle =\\sum_i a_{i}s_{i}$ is the standard inner product on ${\\mathbb{Z}}_{q}^{n}$ and the addition is in $\\mathbb {Z} _{q}$.\n", - " 4. Alice outputs ${\\displaystyle (\\mathbf {a} ,t)}$.\n", - "\n", - " Note the errors introduced: $\\varepsilon$ drawn from $\\chi$\n", - "\n", - " Early developments in the LWE problem employed the one-dimensional discrete Gaussian distribution on $\\mathbb {Z} _{q}$ as the error distribution.\n", - "\n", - "\n", - "\n", - "\n", - "The remarkable feature of the LWE problem is that without the errors, it reduces to a set of linear equations that can be easily solved using a technique like Gaussian elimination.\n", - "\n", - "However, the inclusion of a suitable error distribution renders it an NP-hard problem." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "8718a850-048e-4d5e-94ed-06aba2ddcf6b", - "metadata": {}, - "source": [ - "### Encryption using the Learning with Errors cryptosystem\n", - "The LWE problem discussed above leads to a public key cryptosystem introduced by [Regev](https://doi.org/10.1109/CCC.2010.26).\n", - "\n", - "The exact process will be covered in the Python example below.\n", - "\n", - "\n", - "\n", - "\n", - "**Parameters:** The cryptosystem is characterized by the vector dimension or security parameter $n$, modulus $q$, number of LWE samples $N$, and error distribution $\\chi$. Typical choices that guarantee both security and correctness are:\n", - "\n", - "- $q$ is a prime between $n^2$ and $2n^2$\n", - "- $N = 1.1\\cdot~n~log~q$\n", - "- $\\chi = \\Psi_{\\alpha}$, with $\\alpha = 1/(\\sqrt{n}~log^2{n})$, where $\\Psi_{\\alpha}$ is obtained by sampling the normal distribution $\\mathcal{N}(0, \\alpha^2/(2\\pi))$ and reducing the result modulo 1\n", - "\n", - "**Private key:** The private key is the secret vector ${\\mathbf{s}} \\in {\\mathbb {Z}}_{q}^{n}$.\n", - "\n", - "**Public key:** Choose $N$ samples $(\\mathbf{a}_i ,b_i)_{i=1}^N$ from the LWE distribution $A_{\\mathbf{s},\\chi }$\n", - "\n", - "**Encryption:**\n", - "\n", - "- Encryption utilizes the public key and is carried out bit by bit.\n", - "- For each bit of the message, randomly choose a binary vector $\\mathbf{r} \\in \\{0,1\\}^N$.\n", - "- If the message bit is 0, the encryption is $(\\sum_i \\mathbf{a}_i r_i, \\sum_i b_i r_i)$.\n", - "- If the message bit is 1, the encryption is $(\\sum_i \\mathbf{a}_i r_i, \\lfloor \\frac{q}{2}\\rfloor + \\sum_i b_i r_i)$.\n", - "\n", - "**Decryption:**\n", - "\n", - "- The decryption utilizes the private key ${\\mathbf{s}}$.\n", - "- The pair $({\\mathbf{a}, b })$ decrypts to $0$ if $b-\\langle \\mathbf{a}\\cdot\\mathbf{s}\\rangle$ is closer to $0$ than $\\lfloor\\frac{q}{2}\\rfloor$ modulo $q$, else it decrypts to 1.\n", - "\n", - "\n", - "The security of the LWE public key cryptosystem was analyzed by Regev:\n", - "\n", - "- Firstly, it was shown that recovering the error/noise vector $\\mathbf{e} = [\\varepsilon_1,...,\\varepsilon_N] \\leftarrow \\chi^N$ involved in the construction of the public key is as hard as the bounded distance decoding (BDD) problem, which, as noted above, is believed to be NP-hard. This establishes the correspondence between LWE and explicit lattice problems.\n", - "- Secondly, security against chosen plain text attacks (CPA) is based on the observation that an algorithm for distinguishing between encryptions of 0 and 1 in the above cryptosystem can also distinguish between the distribution $A_{\\mathbf{s},\\chi }$ and the uniform distribution over $\\mathbb{Z}_{q}^{n} \\times \\mathbb{Z}_{q}$, which would imply a solution of LWE itself.\n", - "\n", - "\n", - "" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "aae44857-9704-446d-84ff-394983ee2410", - "metadata": {}, - "source": [ - "### Illustration of LWE encryption in Python\n", - "\n", - "The following simple example shows the use of LWE for encryption and decryption. Bob will send an encrypted message to Alice.\n", - "\n", - "First, Alice and Bob agree on the **problem parameters**. These are explained in detail in the maths section above, but in summary we require $n, q, N, \\chi$.\n", - "\n", - "We start with some of the basic parameters\n", - "\n", - "- $N$ represents the number of samples\n", - "- $q$ is a modulus\n", - "- n is known as the security parameter, or vector dimension.\n", - "\n", - "\n", - "These parameters are all public information in principle." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "dd2c3acb-b8fd-4376-9737-0cbcf9868c02", - "metadata": {}, - "outputs": [], - "source": [ - "import numpy as np\n", - "\n", - "n = 8\n", - "q = 127\n", - "N = int(1.1 * n * np.log(q))\n", - "sigma = 1.0\n", - "print(f\"n={n},q={q},N={N},sigma={sigma}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "580435c9-3491-42ae-8910-9c972bacef71", - "metadata": {}, - "source": [ - "We also need a way of introducing errors\n", - "\n", - "Here $\\chi$ represent the errors we want to introduce - we use a discrete Gaussian distribution on $\\mathbb{Z}_{q}$ characterized by mean 0 and standard deviation $\\sigma$.\n", - "\n", - "This definition of the errors to introduce is also public.\n", - "\n", - "So in Python, we need a simple function that approximates random error/noise contributions $\\varepsilon$ drawn from a discrete Gaussian distribution $\\chi$ with standard deviation $\\sigma$.\n", - "\n", - "Some example values are printed so that you can see the distribution around 0." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "77b85ae3-7f51-471c-977d-71e63a41c58d", - "metadata": {}, - "outputs": [], - "source": [ - "def chi(stdev, modulus):\n", - " return round((np.random.randn() * stdev**2)) % modulus\n", - "\n", - "\n", - "# print some examples\n", - "sd = 2\n", - "m = 1000\n", - "for x in range(10):\n", - " print(\"chi = \", chi(sd, m))" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "44c0025a-2ee4-45fa-ba57-7de2d8acf420", - "metadata": {}, - "source": [ - "Next, Alice needs to generate her key pair.\n", - "\n", - "She sets up her **private key** by choosing $n$ values between 0 and $q$." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "52ffa800-7b9c-47ff-b545-09ee75d0a3fb", - "metadata": {}, - "outputs": [], - "source": [ - "# Alice's private key\n", - "alice_private_key = np.random.randint(0, high=q, size=n)\n", - "print(f\"Alice's private key: {alice_private_key}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "22ed818e-9768-46d5-a073-af84b12aadc0", - "metadata": {}, - "source": [ - "Alice now sets up her **public key**, by choosing random vectors, which are then combined with the generated errors.\n", - "\n", - "\n", - "\n", - "\n", - "More precisely, she needs to generate the sample $A_{s,\\chi}$.\n", - "\n", - "Accordingly, she randomly chooses vectors $\\mathbf{a} \\in \\mathbb{Z}_{q}^{n}$ and errors $\\varepsilon$ from $\\chi$ to construct $N$ samples $(\\mathbf{a}, b)$.\n", - "\n", - "\n", - "" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "80c0936a-c661-415a-acb3-67c11e7b742b", - "metadata": {}, - "outputs": [], - "source": [ - "# Alice's Public Key\n", - "alice_public_key = []\n", - "\n", - "# N is the number of values we want in the key\n", - "for i in range(N):\n", - " # Get n random values between 0 and *module lattices* and the related [**Module-LWE**](https://eprint.iacr.org/2012/090).\n", - "\n", - "We refer interested readers to specialized courses on these topics for the mathematical details but note here that Module-LWE is seen as a compromise between LWE and Ring-LWE. It provides more efficiency than LWE (though less than Ring-LWE) but also gives a higher level of security assurance than Ring-LWE because it does not rely as heavily on the algebraic structure of the problem.\n", - "\n", - "### Key Encapsulation Mechanisms and CRYSTALS-Kyber\n", - "Traditional asymmetric key cryptosystems are most heavily deployed for their *key-exchange* and *digital signature* functionalities and as such, the NIST standardization process sought to develop quantum-safe alternatives for these two functionalities. The [**CRYSTALS-Kyber**](https://pq-crystals.org/kyber/index.shtml) protocol is therefore designed as a dedicated [**Key Encapsulation Mechanism**](https://en.wikipedia.org/w/index.php?title=Key_encapsulation_mechanism&oldid=1110687965) (KEM) rather than as a general purpose encryption scheme such as RSA. A workflow illustrating the use of Kyber to establish a shared secret between two parties is shown below.\n", - "\n", - "#### KEM example using liboqs (local setup required)\n", - "\n", - "\n", - "This example requires some additional local installation, and currently cannot be run on this site. You can review the output below, or alternatively copy the cells to a suitable local environment if you wish to run these examples**\n", - "\n", - "\n", - "Here we make use of the algorithms provided by the `liboqs` open source project which provides a libraries for prototyping and experimenting with quantum-safe cryptography. Refer to the links below to setup and test, and then run these examples in your local Python environment.\n", - "\n", - "- **Python Library:** This provides the Python language binding for liboqs - https://github.com/open-quantum-safe/liboqs-Python\n", - "- **liboqs implementation:** This is required by the Python library, and provides the actual algorithm implementations and must be built - https://github.com/open-quantum-safe/liboqs\n", - "\n", - "\n", - "Alice wishes to create and securely communicate a shared secret to Bob using a quantum-safe encryption approach. She will use the `Kyber512` KEM algorithm provided by liboqs.\n", - "\n", - "We begin by importing relevant Python modules :" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "65c75e53-8294-415f-965c-ff6c6bdfe7a4", - "metadata": {}, - "outputs": [], - "source": [ - "import warnings\n", - "import oqs\n", - "from pprint import pprint\n", - "\n", - "warnings.filterwarnings(\"ignore\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "c4ce7173-1cb8-4718-be33-c4bb801832a4", - "metadata": {}, - "source": [ - "`liboqs` provides a number of KEM implementations and a list of the available algorithms can be easily obtained as follows" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "9128f65d-291f-4513-887e-578906452e3a", - "metadata": {}, - "outputs": [], - "source": [ - "kems = oqs.get_enabled_kem_mechanisms()\n", - "pprint(kems, compact=True)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "57697057-da4c-437d-89f9-0a5dcbe6ea83", - "metadata": {}, - "source": [ - "We see that one of the options in the list is `Kyber512` which we will employ in this example. Key exchange using Kyber involves three simple steps namely\n", - "1. Key generation\n", - "2. Encapsulation\n", - "3. Decapsulation\n", - "\n", - "In the key generation step, the recepient Bob, needs to generate an asymmetric key pair using `Kyber512` and broadcast his public key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "ac845751-b610-4920-a503-7a7fa501930b", - "metadata": {}, - "outputs": [], - "source": [ - "kemalg = \"Kyber512\"\n", - "bob = oqs.KeyEncapsulation(kemalg)\n", - "bob_public_key = bob.generate_keypair()" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "e35a9479-9eff-48a1-8f74-7a0680e4e2e2", - "metadata": {}, - "source": [ - "Next in the **encapsulation** step, upon receiving Bob's public key, Alice generates both the shared secret and it's corresponding ciphertext using `Kyber512` and Bob's public key. The ciphertext which *encapsulates* the shared secret is then broadcasted to Bob." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "2177bcf3-f027-467e-abe5-468aea4ccdef", - "metadata": {}, - "outputs": [], - "source": [ - "alice = oqs.KeyEncapsulation(kemalg)\n", - "ciphertext, shared_secret_alice = alice.encap_secret(bob_public_key)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "324e0bac-05cf-41fe-b959-0359d8ba4fe0", - "metadata": {}, - "source": [ - "Finally, in the **decapsulation** step, Bob uses his private key to recover the shared secret from the ciphertext." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "a2524ad1-c210-455b-a56f-917dfd179f96", - "metadata": {}, - "outputs": [], - "source": [ - "shared_secret_bob = bob.decap_secret(ciphertext)\n", - "print(\"\\nShared secretes coincide:\", shared_secret_bob == shared_secret_alice)" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "f235ab0e-ccaa-41c8-8ce3-b7ffeccf510f", - "metadata": {}, - "source": [ - "Note that in contrast to key exchange using RSA, no extraneous padding or key derivation functions are involved here. Kyber's design as a KEM allows for a very minimal user interface while providing the gold standard [**IND-CCA2**](https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047) security for key exchange." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "14bba37c-2ba1-44d9-a02b-395266105fba", - "metadata": {}, - "source": [ - "### IND-CPA and IND-CCA security in lattice-based cryptography\n", - "In the lesson on Symmetric Key Cryptography, we introduced the notion of **semantic security** or **IND-CPA** security which refers to [**indistinguishability under chosen-plaintext attack**](https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047).\n", - "\n", - "Traditional cryptosystems whether symmetric (such as AES) or asymmetric (such as RSA) use deterministic functions to implement encryption operations. This means that a given plaintext, combined with a given encryption key will always encrypt to the same ciphertext. Such deterministic cryptosystems are vulnerable to *chosen plaintext attack* whereby an adversary is able to extract information by requesting encryptions of arbitrary plaintexts of their choice from the deterministic encryption function.\n", - "\n", - "To achieve IND-CPA security in this context, **additional randomness** is introduced at encryption time either through *initialization vectors* or *padding*. For instance AES is only IND-CPA secure when used in [Cipher Block Chaining (CBC) or Gaolis/Counter Mode (GCM) modes of operation](https://en.wikipedia.org/w/index.php?title=Block_cipher_mode_of_operation&oldid=1154901199#cite_note-23) that use random initialization vectors. Similarly with RSA, [OAEP padding](https://en.wikipedia.org/w/index.php?title=Optimal_asymmetric_encryption_padding&oldid=1163481577) is need to ensure IND-CPA security.\n", - "\n", - "In contrast, lattice-based schemes for encryption are inherently randomized due to the problem definition itself. In particular, in the LWE based encryption scheme outlined above, there are two distinct elements of randomness:\n", - "- **(1)** The error (or noise) $\\varepsilon$ drawn from the distribution $\\chi$\n", - "- **(2)** The random binary vectors $\\mathbf{r} \\in \\{0,1\\}^N$ used for encrypting each bit in the message.\n", - "\n", - "The errors $\\varepsilon$ contribute to the security of the public key, ensuring that it's computationally hard to deduce the secret key $\\mathbf{s}$. The random binary vectors $\\mathbf{r}$ on the other hand provide the essential randomness needed for making repeated encryptions of the same plaintext bit non-deterministic. Thus LWE based schemes are considered IND-CPA secure without the need for external mechanisms such as padding.\n", - "\n", - "Modern cryptosystems aim to achieve so called [**IND-CCA**](https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047) security which stands for **indistinguishability under chosen-ciphertext attack**. In this setting the adversary has the ability to obtain decryptions of a non-trival set of ciphertexts of their choosing with the aim of extracting information to subsequently break the cryptosystem. A scheme is IND-CCA secure if, even with this capability, the adversary cannot do better than random guessing when trying to distinguish encrypted messages. IND-CCA is a stronger security notion than IND-CPA and subsumes it.\n", - "\n", - "Quantum safe KEMs such as **Kyber** are designed to be IND-CCA secure. This is achieved in two steps:\n", - "1. An IND-CPA secure public key encryption(PKE) scheme is defined. In the case of Kyber such a PKE is based on **Module-LWE**.\n", - "2. A variant of the [Fujisaki-Okamoto transform](https://doi.org/10.1007/s00145-011-9114-1) (FO) is applied to obtain a CCA-secure KEM. The FO transformation is a generic method to convert encryption schemes that are IND-CPA secure into ones that are IND-CCA secure. For details we refer readers to the [original papers](https://doi.org/10.1007/s00145-011-9114-1).\n", - "\n", - "For more information on the security features of **Kyber** and **Dilithium**, as well as reference implementations in various programming languages, you are encouraged to consult the [CRYSTALS suite documentation](https://pq-crystals.org/)." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "8194f07b-61bb-4dfe-9ca7-61d30c3ab51e", - "metadata": {}, - "source": [ - "## Hybrid cryptography\n", - "\n", - "Hybrid cryptography refers to using quantum-safe public-key algorithms are combined with traditional public key algorithms (like RSA or elliptic curves) such that the solution is at least no less secure than existing traditional cryptography.\n", - "\n", - "This can help address 2 issues:\n", - "\n", - "1. Existing standards may mandate specific algorithms to be used for encryption, or that such algorithms are in some way approved. To add quantum safety, encryption could first be done using the regular algorithm, but then further protected by a quantum-safe algorithm, whilst still meeting required standards.\n", - "\n", - "2. Quantum algorithms are new, and further analysis is needed to ensure they are indeed safe and correct. For example one of the initial algorithms shortlisted by NIST was subsequently cracked and proven to be insecure. To mitigate this risk, encryption can be done both using a standard, well-reviewed, secure (apart from quantum!) algorithm, in addition to a post-quantum algorithm." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "4c26e1cd-9d1f-4946-9875-5c99fa2abd07", - "metadata": {}, - "source": [ - "## Summary\n", - "The migration to quantum-safe cryptography (QSC) of asymmetric key cryptosystems is necessitated by the expected advent of quantum computers that can break traditional asymmetric key algorithms predicated on the classical hardness of NP-intermediate problems. QSC is conjectured to be robust to quantum attacks because its security is based on NP-hard problems, which generally cannot be efficiently solved even with quantum computers.\n", - "\n", - "In this context, hard problems rooted in the theory of mathematical lattices such as the learning with errors (LWE) problem have emerged as leading contenders for QSC standardization. In particular, the CRYSTALS-Kyber and CRYSTALS-Dilithium algorithms, based on modular lattices, are well positioned as near-term alternatives to popular asymmetric key protocols like RSA, Elliptic Curve, Diffie-Hellman, and DSA.\n", - "\n", - "As we navigate the complex landscape of quantum-safe cryptography, embracing these innovative solutions will be pivotal in upholding the integrity and confidentiality of our digital interactions in the quantum era." - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3" - }, - "widgets": { - "application/vnd.jupyter.widget-state+json": { - "state": {}, - "version_major": 2, - "version_minor": 0 - } - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/learning/courses/quantum-safe-cryptography/symmetric-key-cryptography.ipynb b/learning/courses/quantum-safe-cryptography/symmetric-key-cryptography.ipynb deleted file mode 100644 index 03842339aa6c..000000000000 --- a/learning/courses/quantum-safe-cryptography/symmetric-key-cryptography.ipynb +++ /dev/null @@ -1,653 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "id": "14dd451a", - "metadata": {}, - "source": [ - "---\n", - "title: Symmetric key cryptography\n", - "description: In this lesson we will look at symmetric key cryptography which secures much of the data at rest and in transit by virtue of its efficiency.\n", - "---\n", - "\n", - "\n", - "{/* cspell:ignore ciphertext, cryptosystems, Rijndael, Daemen, Rijmen, monoalphabetic, secretpy, Smid, Foti, lambda, encryptor, encypt, Schneier, ciphertexts, informationally, polyalphabetic, Vigenère, anagramming, Ciphertext, Prichett, Cryptosystems, Caeser, Vigenere, FIPS, Nechvatal, Dworkin, Roback, Technol, Codebook, cryptologists, keystreams, keystream, indcpa, Ehrsam, Tuchman, Bonnetain, Naya, Plasencia, IACR, multiround, Feistel, fips, Twofish, sbox, Rivest, QUIC, quic, Tomoiaga, Stratulat, digitalsignature, STOC, Leurent, qcaa, quantizations, secmargin, Cryptoanalytic, Malviya, Tiwari, Chawla, EUROCRYPT, Coron, semsec, Shamir, Adleman, Nazario */}" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "ea2ca7f5", - "metadata": {}, - "source": [ - "# Symmetric key cryptography\n", - "\n", - "In this lesson we will look at symmetric key cryptography which secures much of the data at rest and in transit by virtue of its efficiency.\n", - "\n", - "By the end of the lesson we will have covered:\n", - " - What symmetric key cryptography is\n", - " - Python code examples demonstrating the use of symmetric key cryptography\n", - " - A look at applications of symmetric key cryptography\n", - " - Symmetric key cryptography applications\n", - " - The security of symmetric key cryptography\n", - " - Threats to these algorithms from both classical and quantum computers" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "59728408", - "metadata": {}, - "source": [ - "## Introduction to symmetric key cryptography\n", - "\n", - "*Symmetric key cryptography (SKC)* is the oldest and most intuitive form of cryptography. With SKC, confidential information is secured through symmetric key encryption (SKE), that is, by using a *single secret key* for both encryption and decryption.\n", - "\n", - "SKC involves:\n", - "- An encryption function that converts a given plain text instance to ciphertext while utilizing a secret key\n", - "- A decryption function that inverts the operation by converting the ciphertext back to plain text using the same secret key\n", - "\n", - "Plain text can mean any kind of unencrypted data such as natural language text or binary code whose information content is in principle directly accessible, while ciphertext refers to encrypted data whose information content is intended to be inaccessible prior to decryption.\n", - "\n", - "An algorithm that describes the encryption and decryption operations using a shared secret key is also called a symmetric cipher.\n", - "\n", - "![Fig 1: Symmetric key encryption of a given plaintext to ciphertext and decryption back to plaintext using the same key.](/learning/images/courses/quantum-safe-cryptography/symmetric-key-cryptography/skc.svg)\n", - "\n", - "*Figure 1. Symmetric key encryption of a given plain text to ciphertext and decryption back to plain text using the same key.*" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "3b1ddcc3", - "metadata": {}, - "source": [ - "## Properties of symmetric key cryptosystems\n", - "\n", - "A symmetric key cryptosystem should ensure the following properties to secure messages-both statically stored data and/or communications over some transmission channel:\n", - "\n", - "- **Confidentiality:** Refers to the property that the information content of encrypted messages is protected from unauthorized access.\n", - "- **Integrity:** Refers to the property that any tampering of encrypted messages during storage or transmission can be detected.\n", - "- **Authenticity:** Refers to the property that the receiver of a message can verify the identity of the sender and detect impersonation by an unauthorized party.\n", - "\n", - "Furthermore, these properties should be realized in a setting where the algorithms or ciphers used for encryption and decryption may be public and where access to the information content of encrypted messages is controlled exclusively through access to the secret key.\n", - "\n", - "Implementing a secure symmetric key cryptosystem therefore involves two main tasks:\n", - "\n", - "1. Employing a robust symmetric key encryption algorithm resistant to cryptographic attacks.\n", - "2. Ensuring confidentiality in the distribution and management of secret keys.\n", - "\n", - "In this lesson, we will discuss aspects related to the first task, which forms the primary concern of SKC technology. The second task, however, needs solutions that fall outside of SKC itself and will be introduced later." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "442a9abb", - "metadata": {}, - "source": [ - "## Illustration of symmetric key encryption using python\n", - "\n", - "We show a simple example of the encrypt and decrypt operations using the classical Caesar shift cipher and the modern Advanced Encryption System (AES), which has been the standard for symmetric key encryption since 2001." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "45e8c800", - "metadata": {}, - "source": [ - "First we set up some Python libraries that provide the needed symmetric key encryption ciphers, and then define the plain text we wish to encrypt." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "06552f57", - "metadata": {}, - "outputs": [], - "source": [ - "# Install the library if needed\n", - "# %pip install secretpy\n", - "\n", - "# import the required crypto functions which will be demonstrated later\n", - "from secretpy import Caesar\n", - "from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes\n", - "from functools import reduce\n", - "import numpy as np\n", - "\n", - "# Set the plaintext we want to encrypt\n", - "plaintext = \"this is a strict top secret message for intended recipients only\"\n", - "print(f\"\\nGiven plaintext: {plaintext}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "0a215aa9", - "metadata": {}, - "source": [ - "We will see how to encrypt and decrypt it using two different symmetric key encryption methods:\n", - "\n", - "1. The classic [Caesar shift cipher](https://en.wikipedia.org/w/index.php?title=Caesar_cipher&oldid=1151194063)\n", - "2. The modern [Advanced Encryption Standard](https://www.nist.gov/publications/development-advanced-encryption-standard) AES-256 protocol" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "eb46068d", - "metadata": {}, - "source": [ - "### Caesar shift cipher:\n", - "\n", - "Caesar shift encryption involves defining\n", - " - An alphabet of possible characters to encode\n", - " - A *shift value* which can be between 0 (unencrypted) and the length of the alphabet. We consider this the *key*.\n", - "\n", - "It is known as a *monoalphabetic substitution cipher* since each letter of the plain text is substituted with another in the ciphertext.\n", - "\n", - "In this example we will use lowercase letters of the alphabet.\n", - "\n", - "Let's start by setting things up." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "ecaf0d3c", - "metadata": {}, - "outputs": [], - "source": [ - "# initialize the required python object for doing Caesar shift encryption\n", - "caesar_cipher = Caesar()\n", - "\n", - "# Define the shift, ie the key\n", - "caesar_key = 5\n", - "print(f\"Caesar shift secret key: {caesar_key}\")\n", - "\n", - "# Define the alphabet\n", - "alphabet = (\n", - " \"a\",\n", - " \"b\",\n", - " \"c\",\n", - " \"d\",\n", - " \"e\",\n", - " \"f\",\n", - " \"g\",\n", - " \"h\",\n", - " \"i\",\n", - " \"j\",\n", - " \"k\",\n", - " \"l\",\n", - " \"m\",\n", - " \"n\",\n", - " \"o\",\n", - " \"p\",\n", - " \"q\",\n", - " \"r\",\n", - " \"s\",\n", - " \"t\",\n", - " \"u\",\n", - " \"v\",\n", - " \"w\",\n", - " \"x\",\n", - " \"y\",\n", - " \"z\",\n", - " \" \",\n", - ")\n", - "print(f\"alphabet: {alphabet}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "bb662f02", - "metadata": {}, - "source": [ - "Encrypt the plain text to get ciphertext for the Caesar cipher." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "af9f3eb4", - "metadata": {}, - "outputs": [], - "source": [ - "caeser_ciphertext = caesar_cipher.encrypt(plaintext, caesar_key, alphabet)\n", - "print(f\"Encrypted caeser shift ciphertext: {caeser_ciphertext}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "a74671e1", - "metadata": {}, - "source": [ - "Decrypt the ciphertext back to the original plain text using the same key used for encryption." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "da614545", - "metadata": {}, - "outputs": [], - "source": [ - "caeser_plaintext = caesar_cipher.decrypt(caeser_ciphertext, caesar_key, alphabet)\n", - "print(f\"Decrypted caeser shift plaintext: {caeser_plaintext}\\n\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "224337cd", - "metadata": {}, - "source": [ - "### Advanced encryption standard (AES) cipher\n", - "\n", - "We now encrypt the plain text using AES, a popular symmetric key encryption algorithm.\n", - "\n", - "We start by creating the key, in this case, a random 16-letter string." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "a7d8af57", - "metadata": {}, - "outputs": [], - "source": [ - "# lambda defines an inline function in this case that takes two values a,b\n", - "# with the resulting expression of a+b\n", - "# reduce uses a two-argument function(above), and applies this to all the entries in the list\n", - "# (random alphabet characters) cumulatively\n", - "aes_key = reduce(lambda a, b: a + b, [np.random.choice(alphabet) for i in range(16)])\n", - "\n", - "print(f\"AES secret key: {aes_key}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "15868918", - "metadata": {}, - "source": [ - "AES supports multiple operating modes and requires we specify which to use.\n", - "\n", - "We choose the *Cipher Block Chaining* (CBC) mode provided by the `modes.CBC` class of the `cryptography` library. The CBC mode of AES uses randomness for additional security. This requires specifying a random *Initialization Vector* (IV), also called a *nonce*. We will use a random string for this as well, just like we did for the key." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "d2e4df17", - "metadata": {}, - "outputs": [], - "source": [ - "aes_initialization_vector = reduce(\n", - " lambda a, b: a + b, [np.random.choice(alphabet) for i in range(16)]\n", - ")\n", - "print(f\"AES initialization vector: {aes_initialization_vector}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "b9f32932", - "metadata": {}, - "source": [ - "We can now instantiate an AES cipher on behalf of the sender of the secret message. Note that the initialization vector is passed to the `modes.CBC` class to set up the CBC mode of operation.\n", - "\n", - "We will then encrypt the plain text to send." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "fa477669", - "metadata": {}, - "outputs": [], - "source": [ - "# The encryptor is setup using the key and CBC. In both cases\n", - "# we need to convert the string (utf-8) into bytes\n", - "sender_aes_cipher = Cipher(\n", - " algorithms.AES(bytes(aes_key, \"utf-8\")),\n", - " modes.CBC(bytes(aes_initialization_vector, \"utf-8\")),\n", - ")\n", - "aes_encryptor = sender_aes_cipher.encryptor()\n", - "\n", - "# update can add text to encypt in chunks, and then finalize is needed\n", - "# to complete the encryption process\n", - "aes_ciphertext = (\n", - " aes_encryptor.update(bytes(plaintext, \"utf-8\")) + aes_encryptor.finalize()\n", - ")\n", - "\n", - "# Note the output is a string of bytes\n", - "print(f\"Encrypted AES ciphertext: {aes_ciphertext}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "d4c641b9", - "metadata": {}, - "source": [ - "To decrypt it, let us instantiate an AES cipher on behalf of the receiver. Note that the intended receiver has access to both the secret key and the initialization vector, but the latter is not required to be secret." - ] - }, - { - "cell_type": "code", - "execution_count": null, - "id": "10571495", - "metadata": {}, - "outputs": [], - "source": [ - "# Similar setup of AES to what we did for encryption, but this time, for decryption\n", - "receiver_aes_cipher = Cipher(\n", - " algorithms.AES(bytes(aes_key, \"utf-8\")),\n", - " modes.CBC(bytes(aes_initialization_vector, \"utf-8\")),\n", - ")\n", - "aes_decryptor = receiver_aes_cipher.decryptor()\n", - "\n", - "# Do the decryption\n", - "aes_plaintext_bytes = aes_decryptor.update(aes_ciphertext) + aes_decryptor.finalize()\n", - "\n", - "# convert back to a character string (we assume utf-8)\n", - "aes_plaintext = aes_plaintext_bytes.decode(\"utf-8\")\n", - "\n", - "print(f\"Decrypted AES plaintext: {aes_plaintext}\")" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "80ef03c1", - "metadata": {}, - "source": [ - "## Applications of symmetric key cryptography\n", - "\n", - "While classical ciphers such as the Caesar cipher fell out of use a long time ago, modern symmetric cryptosystems such as AES are [deployed in a wide range of applications](https://books.google.com/books?id=01vfjgEACAAJ), including:\n", - "\n", - "1. **Data encryption and decryption:** SKC is widely used to protect sensitive data, whether statically stored on a device or transmitted over a network. Examples include protecting user credentials, encrypting email messages, and securing financial transactions, among others.\n", - "\n", - "2. **Secure communication:** Common communication protocols such as SSL/[TLS](https://en.wikipedia.org/w/index.php?title=Transport_Layer_Security&oldid=1155601531) use a combination of symmetric and asymmetric key encryption to ensure the confidentiality and integrity of data exchanged between two parties. These messages are encrypted and decrypted using symmetric key encryption which uses a shared key. The key used in symmetric key encryption is securely exchanged using asymmetric key encryption which uses a public-private key pair. Symmetric key encryption is much faster and hence can be used for encryption of messages of large size.\n", - "\n", - "3. **Authenticity verification:** In some settings, SKC is employed through techniques like [message authentication codes](https://en.wikipedia.org/w/index.php?title=Message_authentication_code&oldid=1151014755) (MACs) and keyed-hash MACs (HMAC) to verify the authenticity and integrity of messages, ensuring tamper-resistant communication.\n", - "\n", - "4. **File and disk encryption:** Full-disk encryption software and file encryption tools employ SKC to protect sensitive data stored on hard disks or portable storage devices.\n", - "\n", - "5. **Virtual private networks:** [VPN](https://en.wikipedia.org/w/index.php?title=Virtual_private_network&oldid=1154342615) technologies, which aim to provide confidential communication channels free from eavesdropping, can use symmetric or asymmetric key encryption to connect remote users as well as corporate networks.\n", - "\n", - "The diverse array of applications in which SKC is deployed in turn require that symmetric cryptosystems satisfy a certain set of criteria." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "492f9e09", - "metadata": {}, - "source": [ - "## Principles of symmetric key encryption\n", - "In this section, we will discuss some of the basic [principles underlying the security of symmetric key encryption algorithms](https://doi.org/10.1080/07468342.1987.11973000).\n", - "\n", - "**Resistance to brute force attack:** The most basic requirement for the security of an encryption cipher is that the key space size — in other words, the number of possible distinct keys from which someone using the algorithm could have chosen — is very large.\n", - "\n", - "**Resistance to cryptanalytic attack:** The second basic requirement for a cipher, symmetric or otherwise, is that it can generate ciphertexts that are informationally inscrutable. To this end, a necessary but not sufficient condition from an information theory perspective is that [ciphertexts should be characterized by high entropy](https://en.wikipedia.org/w/index.php?title=Entropy_(information_theory)&oldid=1154931420), making them indistinguishable from random text with no discernible patterns or correlations. This way, an attacker can gain no information about the plain text or secret key by trying to analyze the ciphertext using frequency analysis or other statistical techniques.\n", - "\n", - "Resistance to general forms of cryptanalytic attacks sufficient to ensure [semantic security](https://en.wikipedia.org/w/index.php?title=Semantic_security&oldid=1133491450) is formalized via the notion of [*indistinguishability*](https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047). While there are several variants of indistinguishability with distinct requirements, a symmetric cryptosystem is considered to be semantically secure if it satisfies the criterion of [*Indistinguishability under Chosen Plain Text Attack*](https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047) (IND-CPA). This means that an attacker cannot distinguish between the encryptions of two different messages even if allowed to send multiple plain texts of their choosing to the algorithm and view the corresponding ciphertexts.\n", - "\n", - "As we will consider later, IND-CPA typically requires the use of randomness to ensure that each time a given plain text is encrypted with a given secret key, the resulting ciphertext is unpredictably different for each encryption.\n", - "\n", - "**Failure modes of classical ciphers:** Before the advent of modern cryptography in the 1970s, most classical ciphers in practical use failed to satisfy one or both above requirements. For instance, early substitution ciphers such as the monoalphabetic [Caesar shift cipher](https://en.wikipedia.org/w/index.php?title=Caesar_cipher&oldid=1151194063) were characterized by both a small key space size (see Table 1) and low entropy ciphertext, making them insecure against a variety of cryptanalytic attacks such as brute force attacks, frequency analysis, and known-plain-text (KPT) attacks.\n", - "\n", - "Subsequent polyalphabetic substitution ciphers such as the [Vigenère cipher](https://en.wikipedia.org/w/index.php?title=Vigen%C3%A8re_cipher&oldid=1155012941) and the [Enigma machine cipher](https://en.wikipedia.org/w/index.php?title=Enigma_machine&oldid=1154440070) featured effectively large key space sizes, making them resistant to brute force attacks, but they were susceptible to frequency analysis and KPT attacks, respectively. Similarly to substitution ciphers, [classic transposition ciphers](https://en.wikipedia.org/w/index.php?title=Transposition_cipher&oldid=1151499771), which rearrange letters in a message instead of substituting them, are also compromised by a variety of attacks such as anagramming, statistical analysis, brute force, and KPT attacks, among others.\n", - "\n", - "Theoretically, a polyalphabetic substitution cipher known as the [one-time pad](https://en.wikipedia.org/w/index.php?title=One-time_pad&oldid=1155039884) (OTP) is known to be cryptographically secure. An OTP features a secret key that should be (1) composed of randomly chosen letters or bits, (2) at least as long as the original plain text, and (3) used only once. An OTP is impractical for actual applications because if the secret key — which is required to be as long as the plain text and can be used only once — could be shared securely, then so could the original plain text. The OTP instead illustrates the utility of randomness in generating secure ciphertexts.\n", - "\n", - "An attacker trying to implement a brute force search through the key space to find a key that decrypts the message has to perform a number of operations proportional to the key space size.\n", - "\n", - "Therefore, a large key space size provides resistance against brute force attacks by rendering them computationally infeasible. Table 1 lists the key space sizes of some well-known ciphers." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "47b2e4e8", - "metadata": {}, - "source": [ - "### Table 1: Key space sizes of some symmetric ciphers\n", - "\n", - "\n", - "\n", - "| Cipher | Key length | Key space size |\n", - "|--------------|------------------|-------------------------------------------|\n", - "| Caeser shift | 1 | alphabet-size |\n", - "| Vigenere | n | alphabet-size$^\\mathrm{n}$ |\n", - "| One-time-pad | plaintext-length | alphabet-size$^\\mathrm{plaintext-length}$ |\n", - "| DES | 56 | 2$^\\mathrm{56}$ |\n", - "| AES-128 | 128 | 2$^\\mathrm{128}$ |\n", - "| AES-192 | 192 | 2$^\\mathrm{192}$ |\n", - "| AES-256 | 256 | 2$^\\mathrm{256}$ |\n", - "| ChaCha20 | 256 | 2$^\\mathrm{256}$ |" - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "66cd329b", - "metadata": {}, - "source": [ - "Modern symmetric key encryption schemes largely overcome the limitations of the classical ciphers. They produce ciphertext resistant to and feature large key space sizes while also being much more practically efficient than an OTP.\n", - "\n", - "**Block ciphers**: One class of modern ciphers — such as [DES](https://en.wikipedia.org/w/index.php?title=Data_Encryption_Standard&oldid=1154751166) and [AES](https://www.nist.gov/publications/development-advanced-encryption-standard) — achieve security by combining the principles of confusion and diffusion [originally introduced by Claude Shannon](https://en.wikipedia.org/wiki/A_Mathematical_Theory_of_Communication#:~:text=%22A%20Mathematical%20Theory%20of%20Communication,the%20generality%20of%20this%20work). We discuss these notions in a setting where encryption schemes work with binary representations of messages:\n", - "\n", - "- **Confusion**: Confusion is the characteristic whereby each bit in the ciphertext depends on multiple bits of the secret key. It ensures that a small change in the secret key modifies almost all the bits of the ciphertext, obscuring the relationship between the ciphertext and the secret key.\n", - "\n", - "- **Diffusion**: Diffusion is the characteristic whereby flipping a single bit in the plain text should modify roughly half the bits in the ciphertext and vice versa. Diffusion hides statistical relationships between the plain text and ciphertext. Ciphers with adequate diffusion satisfy the so-called *avalanche criterion* of cryptography.\n", - "\n", - "Block ciphers implement confusion and diffusion using cryptographic structures known as [substitution-permutation networks](https://en.wikipedia.org/w/index.php?title=Substitution%E2%80%93permutation_network&oldid=1098155951) (SPNs) operating on discrete blocks of data. An SPN accepts a block of plain text and the secret key as inputs and performs a specified number of [*rounds*](https://en.wikipedia.org/w/index.php?title=Round_(cryptography)&oldid=1149554107) of transformations to yield a ciphertext block. Each round is composed of alternating mathematical structures known as substitution boxes [(S-boxes)](https://en.wikipedia.org/w/index.php?title=S-box&oldid=1154458964) and permutation boxes [(P-boxes)](https://en.wikipedia.org/w/index.php?title=Permutation_box&oldid=1151700196) or equivalent operations.\n", - "\n", - "These respectively implement complex nonlinear and linear transformations on the input blocks, leading to [*avalanche effects*](https://en.wikipedia.org/w/index.php?title=Avalanche_effect&oldid=1148010716) in the ciphertext.\n", - "\n", - "SPNs are designed in such a way that increasing the number of rounds typically increases the security of the cipher. This leads to the notion of [*security margin*](https://pmc.ncbi.nlm.nih.gov/articles/PMC4878865/)." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "a159587c", - "metadata": {}, - "source": [ - "**Security margin:** The security margin of a given SPN-based cryptographic cipher is the difference between the number of rounds in the complete implementation of the cipher and the maximum number of rounds that are known to be breakable using the best-known real-world attack.\n", - "\n", - "For instance, currently the best-known faster-than-brute-force attacks against AES-256 can break up to 9 rounds out of the total 14 rounds in the full cipher when used in the standard mode known as *Electronic Codebook* (ECB) mode. Therefore, [currently the security margin of AES-256 is 5 rounds](https://doi.org/10.13154/tosc.v2019.i2.55-93).\n", - "\n", - "**Stream ciphers:** As an alternative to block ciphers, modern cryptologists have also designed practically secure [*stream ciphers*](https://en.wikipedia.org/w/index.php?title=Stream_cipher&oldid=1143750236) such as [Chacha20](https://en.wikipedia.org/w/index.php?title=Salsa20&oldid=1145010249). These ciphers utilize randomness as a fundamental part of their design and operate on pseudorandom *keystreams* of bits instead of discrete blocks of data.\n", - "\n", - "Accordingly, stream ciphers combine a secret key and an [initialization vector](https://en.wikipedia.org/w/index.php?title=Initialization_vector&oldid=1136156102) (IV) to seed a [pseudorandom random number generator](https://en.wikipedia.org/w/index.php?title=Pseudorandom_number_generator&oldid=1153255020) (PRNG) to produce a keystream of random bits which are then combined with the given plain text to yield the ciphertext. In this sense, stream ciphers are similar to a one-time pad (OTP) but feature shorter secret key lengths and reusable keys, which makes them more practical. However, for the same reason, they do not guarantee perfect secrecy, unlike an OTP.\n", - "\n", - "**Semantic security**: We conclude this subsection by returning to the notion of semantic security or IND-CPA level security introduced above. The basic operations implemented by [block ciphers](https://en.wikipedia.org/w/index.php?title=Block_cipher_mode_of_operation&oldid=1154901199#cite_note-23) such as S-box and P-box are deterministic. This means that in standard operating modes such as ECB, a given plain-text key pair always yields the same ciphertext, a state of affairs that is susceptible to chosen-plain-text attacks.\n", - "\n", - "To achieve IND-CPA level security, block ciphers need to operate in a mode that utilizes randomness introduced via a pseudorandom initialization vector (IV) with the additional requirement that no two encryption operations use the same key-IV pair. AES supports several modes of operation, such as [cipher block chaining](https://patents.google.com/patent/US4074066A/en) (CBC), which are IND-CPA secure. A similar requirement also holds for stream ciphers whereby the same key-IV pair should not be used to seed the PRNG more than once if IND-CPA is desired." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "004fa4ed", - "metadata": {}, - "source": [ - "## Popular symmetric key algorithms\n", - "\n", - "Having introduced some basic principles of SKC, we now list a few popular symmetric key algorithms to illustrate a variety of the approaches pursued in modern cryptosystems. Modern block ciphers and stream ciphers are both employed in different contexts as illustrated below.\n", - "\n", - "1. [**Advanced Encryption Standard:**](https://www.nist.gov/publications/development-advanced-encryption-standard) AES, already introduced above, is currently the de facto standard for SKC owing to its security, efficiency, and performance characteristics. AES features fixed key sizes of 128, 192, and 256 bits and uses a multiround substitution-permutation network (SPN). AES is known to be resistant to a wide range of cryptanalytic attacks. AES was announced as a Federal Information Processing Standard (FIPS) for symmetric key encryption in the United States in 2001.`\n", - "\n", - "2. [**Data Encryption Standard (DES) and Triple Data Encryption Standard (3DES):**](https://en.wikipedia.org/w/index.php?title=Data_Encryption_Standard&oldid=1154751166) DES was a block cipher originally invented by Horst Feistel and coworkers at IBM® in the 1970s and employed a SPN with a relatively short 56-bit key. DES was adopted as a FIPS for symmetric key encryption in the United States until the late 1990s when it was shown to be breakable using brute force attacks with specialized hardware due to its small key space size. Subsequently, 3DES was introduced as a replacement and applies the DES algorithm three times with different keys, increasing the key length to 168 bits. Nevertheless, 3DES is largely superseded by AES.\n", - "\n", - "3. [**Blowfish and Twofish:**](https://en.wikipedia.org/w/index.php?title=Blowfish_(cipher)&oldid=1120053771) Blowfish and its successor, Twofish, are block ciphers proposed by cryptographer Bruce Schneier in the 1990s. Blowfish and Twofish allow variable key lengths of up to 448 bits and 256 bits respectively, offering some flexibility in the tradeoff between security and performance. Unlike AES, they also feature key-dependent S-boxes. Twofish was one of the finalists in the NIST competition to select the Advanced Encryption Standard but ultimately was not chosen. Both algorithms are currently considered secure.\n", - "\n", - "4. [**Rivest Ciphers (RC2, RC4, RC5, and RC6):**](https://en.wikipedia.org/w/index.php?title=RC_algorithm&oldid=1072978900) The Rivest Cipher (RC) family of symmetric key algorithms was designed by Ron Rivest starting in the 1980s. RC2 was an early 64-bit block cipher while RC4 was stream cipher widely-used in security protocols related to web-traffic due to its simplicity and speed. Neither is currently considered secure. RC5 and RC6 are SPN based block ciphers designed with customizable block size, key size, and number of rounds. Like Twofish above, RC6 was a finalist in the NIST AES competition and is considered secure.\n", - "\n", - "5. [**Salsa20 and ChaCha20:**](https://en.wikipedia.org/w/index.php?title=Salsa20&oldid=1145010249) Salsa20 and ChaCha20 refer to a related family of stream ciphers designed by cryptographer Daniel Bernstein in the 2000s. Salsa20 is a part of the eSTREAM European Union cryptographic validation project's profile-1 portfolio. ChaCha20, a modification of Salsa20, was designed to increase diffusion characteristics and performance. Currently, ChaCha20 is considered secure and offers better performance in the absence of dedicated AES hardware acceleration. Therefore, ChaCha20 finds use in certain settings such as network protocols like QUIC and mobile devices with ARM-based CPUs." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "ac739199", - "metadata": {}, - "source": [ - "## Advantages of symmetric key cryptography\n", - "\n", - "After outlining the properties of symmetric key cryptosystems and some of the principles that underlie their development, we now list some of the main advantages of [SKC](https://books.google.com/books?id=01vfjgEACAAJ) relative to asymmetric key cryptography. The latter will be discussed in subsequent lessons.\n", - "\n", - "1. **Speed and efficiency:** Symmetric key algorithms are more suitable for encrypting large volumes of data or for use in real-time communication scenarios since they are generally faster and less resource intensive than their asymmetric counterparts. SKC algorithms such as AES scale linearly with the size of the plain text and do not involve algebraically intensive mathematical operations. See [Tomoiaga et al.](https://doi.org/10.1109/ICSNC.2010.33) for a detailed review of the performance characteristics of AES.\n", - "\n", - "2. **Scalability:** Owing to their relatively low computational overhead, symmetric key algorithms scale well with the number of users and the amount of data being encrypted.\n", - "\n", - "3. **Simplicity:** Symmetric encryption protocols are often easier to implement and understand compared to asymmetric key approaches, making them attractive for developers and users." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "86419a6c", - "metadata": {}, - "source": [ - "## Challenges and limitations of symmetric key cryptography\n", - "\n", - "Despite the advantages, symmetric key cryptography also has some challenges and limitations:\n", - "\n", - "1. **Key distribution and management:** In SKC, both the sender and the receiver of a message must have access to the same key, which must be kept confidential from unauthorized parties. If the key is somehow intercepted or compromised by a third party then the security of the encrypted data is also lost. The secure distribution and management of the secret key is therefore a major challenge. However, the solution to this challenge lies outside of SKC itself.\n", - "\n", - "2. **Lack of non-repudiation:** [Non-repudiation](https://en.wikipedia.org/w/index.php?title=Non-repudiation&oldid=1148337707) refers to the ability to prove that a specific party has sent a message. In SKC, since the same key is used for both encryption and decryption, it is not possible to determine which party has created a particular ciphertext. In contrast, asymmetric key cryptography provides non-repudiation through the use of digital signature.\n", - "\n", - "To address these challenges, symmetric key cryptography is often used in combination with asymmetric key cryptography. For instance, one often uses asymmetric key encryption to securely transmit a relatively short shared secret key between sender and receiver. This enables the subsequent use of symmetric key encryption to transmit much larger data and messages efficiently." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "1abe52d3", - "metadata": {}, - "source": [ - "## Quantum computing and symmetric key encryption: Risks and mitigation\n", - "\n", - "Quantum cryptography offers a promising avenue for risk mitigation in the digital age, with the adoption of quantum-safe products poised to secure our information against the looming threat of quantum computing advancements.\n", - "\n", - "In what follows, we discuss the risks posed by quantum computers to symmetric key encryption schemes introduced in the previous section and outline some potential pathways to mitigating the risks." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "24c45b60", - "metadata": {}, - "source": [ - "### Quantum cryptographic attacks\n", - "\n", - "There are two distinct classes of quantum threats to traditional cryptographic algorithms:\n", - "\n", - "1. **Quantum brute force attacks**: These refer to situations where the attacker uses a quantum computer to execute a specialized quantum algorithm to conduct a brute force search through the key space of a symmetric cipher. The most relevant quantum primitive for enabling this kind of attack is [Grover's algorithm](https://dl.acm.org/doi/10.1145/237814.237866).\n", - "\n", - "2. **Quantum cryptanalytic attacks**: These refer to situations where quantum computers are deployed to execute cryptanalytic attacks that aim to recover either the secret key or plain text in a more efficient manner than a brute force search. The possibility of executing successful quantum attacks depends on many factors having to do with the mathematical structure of the cipher being analyzed as well as potential weaknesses in specific implementations." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "0f9d8da1", - "metadata": {}, - "source": [ - "### Risk mitigation strategies for quantum attacks\n", - "\n", - "Before we discuss risk mitigation strategies for quantum attacks, let's introduce the notion of a cryptographic cipher's [security level](https://en.wikipedia.org/w/index.php?title=Security_level&oldid=1131789113):\n", - "\n", - "**Security level** is a measure of the difficulty of breaking a cipher measured in terms of the number of computational operations that a successful break of the cipher would require.\n", - "\n", - "Typically, the security level is expressed in bits; that is, in general, a cipher offers N-bit security if it requires $\\mathcal{O}(2^{N})$ operations to break it. On classical computers, assuming a symmetric cipher is otherwise cryptographically secure, the security level is roughly synonymous with the key length.\n", - "\n", - "For instance, the security level of AES-128, which features a 128-bit key, is generally considered to be 128 bits because it would require on the order of 2$^{128}$ operations for an attacker employing a classical computer to try out all possible 128-bit keys in the key space.\n", - "\n", - "### Brute force attacks and mitigation\n", - "\n", - "**Quantum brute force attack risk:** A [quantum brute force attack](https://inria.hal.science/hal-01237242) changes the above assessment because Grover's algorithm enables an attacker with a suitable quantum computer to search the key space of a cipher quadratically faster than any classical computer.\n", - "\n", - "For instance, the same brute force attack on AES-128 with Grover's algorithm could potentially be achieved with just 2$^{64}$ operations. Therefore the security level of AES-128 is reduced from 128 bits to 64 bits when faced with a quantum adversary running Grover search. Since computational power has traditionally grown exponentially with time, currently a security level of 64 bits is considered insecure, which means that once sufficiently capable quantum computers are realized, AES-128 will have to be abandoned.\n", - "\n", - "The same kind of calculation applies to other symmetric block or stream ciphers whereby the security level for a given key length is effectively halved by Grover's algorithm.\n", - "\n", - "**Quantum brute force attack risk mitigation:** The above considerations imply that an obvious way to resist quantum brute force attacks is to at least [double the minimum key lengths used for symmetric key encryption](https://inria.hal.science/hal-01237242).\n", - "\n", - "Therefore, to ensure 128-bit security with regard to quantum brute force attacks, one would simply use ciphers such as AES-256 or ChaCha20 that employ 256-bit keys. This is considered secure because even with quantum computers, performing 2$^{128}$ operations to break ciphers is infeasible in the foreseeable future.\n", - "\n", - "While theoretically simple, this proposed solution of doubling key sizes is not without costs, as longer key sizes imply additional computational cost for routine encryption-decryption tasks, along with slower performance, more memory requirement, and additional energy use." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "b22fca89", - "metadata": {}, - "source": [ - "### Cryptanalytic attacks and mitigation\n", - "\n", - "**Quantum cryptanalytic attacks risk:** The risk to symmetric key cryptosystems posed by quantum cryptanalytic attacks is currently being [actively researched by cryptographers](https://www.sciencedirect.com/science/article/pii/S0045790622003743). The combination of classical and quantum computing potentially expands the array of tools available to attackers to probe weaknesses in the mathematical structure of ciphers, and a wide range of new quantum cryptanalytic attacks are currently being proposed. These include quantizations of known classical techniques such as [linear and differential cryptanalysis](https://inria.hal.science/hal-01237242) as well as new attack modes with no classical counterparts.\n", - "\n", - "A [recent quantum cryptanalytic study of the Advanced Encryption Standard (AES)](https://doi.org/10.13154/tosc.v2019.i2.55-93) found that the cipher remained resistant to various known quantum cryptanalytic attacks and continued to exhibit an adequate post-quantum security margin. However, some studies have found that various symmetric ciphers considered classically secure are easily compromised by so-called [*quantum chosen plain text attack*](https://doi.org/10.1007/978-3-319-56617-7_3). Therefore, new primitives for symmetric key encryption designed specifically for the post-quantum era have also been proposed.\n", - "\n", - "**Quantum cryptanalytic attacks risk mitigation:** Given that quantum cryptanalysis as a discipline is in its infancy, it may be the case that post-quantum symmetric cryptography will undergo rapid evolution as new quantum cryptanalytic attacks arise and as new ciphers resistant to them are proposed and evaluated. Therefore, the best strategy to mitigate the risk of quantum cryptanalytic attacks in the foreseeable future is [*cryptographic agility*](https://en.wikipedia.org/w/index.php?title=Cryptographic_agility&oldid=1155073704) (or crypto-agility). Crypto-agility refers to the ability of an information system to quickly and easily adopt alternative cryptographic primitives without disruptive changes to the system infrastructure.\n", - "\n", - "Crypto-agility requires the ability to replace obsolete algorithms used for encryption, decryption, digital signatures, or other cryptographic functions with minimal effort and disruption. Crypto-agile systems will be well positioned to manage the transition to post-quantum symmetric key cryptography." - ] - }, - { - "attachments": {}, - "cell_type": "markdown", - "id": "06ac8475", - "metadata": {}, - "source": [ - "## Summary\n", - "\n", - "Symmetric key cryptography provides robust and efficient solutions for securing digital information. The simplicity of using the same key for both encryption and decryption enables high performance and scalability, making SKC suitable for a wide range of applications.\n", - "\n", - "The security of SKC relies on algorithmic resistance to cryptographic attacks as well as proper secret key management. Modern symmetric key cryptosystems combine the principles of confusion, diffusion, and randomness, in conjunction with adequate key sizes, to achieve semantic security. Secret key management, while crucial, cannot be achieved with SKC alone.\n", - "\n", - "Understanding the properties and limitations of SKC will enable developers to design, implement, and deploy secure information technology solutions using approaches included longer key sizes as needed, and the use of new algorithms.\n", - "\n", - "The advancement of quantum computing and quantum learning introduces a new dimension to symmetric key cryptography. Quantum computers have the potential to unravel the security provided by classical symmetric key algorithms, prompting the need for quantum-resistant cryptographic approaches to ensure data privacy and protection in the face of evolving technological landscapes." - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3" - }, - "widgets": { - "application/vnd.jupyter.widget-state+json": { - "state": {}, - "version_major": 2, - "version_minor": 0 - } - } - }, - "nbformat": 4, - "nbformat_minor": 5 -} diff --git a/learning/courses/quantum-safe-cryptography/whats-next.mdx b/learning/courses/quantum-safe-cryptography/whats-next.mdx deleted file mode 100644 index d1b29836f6cb..000000000000 --- a/learning/courses/quantum-safe-cryptography/whats-next.mdx +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: What's next? -description: This lesson will look at the next steps you can take to modernize your cryptographic landscape. ---- - -{/* cspell:ignore CBOMs, CBOM, Remediator */} - -# What's next? - -Now that you’ve learned the fundamentals of quantum-safe cryptography, explore the technologies IBM Quantum® offers for modernizing your cryptographic landscape and building quantum cyber resilience. [IBM Quantum Safe™](https://www.ibm.com/quantum/quantum-safe) is a comprehensive set of tools, capabilities, and approaches combined with deep expertise to help you plan and execute your organization’s migration to quantum-safe cryptography. Discover, observe, and transform your cryptography with three core technical capabilities: - -**1. IBM Quantum Safe Explorer** - -IBM Quantum Safe Explorer simplifies the discovery and management of cryptography by performing source code and object code scanning to identify all cryptographically relevant artifacts, uncover dependencies, and surface vulnerabilities. Explorer represents this data in a [Cryptography Bill of Materials](https://github.com/IBM/CBOM) (CBOM), a common extension to the Software Bill of Materials (SBOM) that systematizes the creation and sharing of metadata describing cryptographic artifacts. - -**2. IBM Quantum Safe Advisor** - -IBM Quantum Safe Advisor complements the static code analysis from IBM Quantum Safe Explorer with a dynamic, runtime perspective of your cryptographic posture and compliance. Advisor correlates [CBOMs][CBOM] and aggregates data from network and endpoint scans to build a comprehensive cryptographic inventory. This inventory details: - -- The types and locations of your cryptographic instances -- Associated certificates, cipher suites, and CBOMs -- The relationships between assets and data flows -- Potential vulnerabilities to quantum technology - -With its policy-based enrichment, Advisor equips you to evaluate your cryptography and data compliance and generate a prioritized list of vulnerabilities so that you can establish a quantum-safe remediation strategy. - -**3. IBM Quantum Safe Remediator** - -IBM Quantum Safe Remediator enables you to apply best practices for quantum-safe remediation patterns focused on VPN communication, TLS communication, and cluster access communication. Build crypto-agility by exploring solutions for transforming your cryptography without disrupting business operations. - -Read the [technology guide](https://www.ibm.com/quantum/assets/quantum-safe/IBM_Quantum-Safe-Technology-Brochure.pdf), and learn more on the [IBM Quantum Safe site.](https://www.ibm.com/quantum/quantum-safe) - -[CBOM]: #definition-tooltip "A schema extension of the CycloneDX Software Bill of Materials (SBOM) standard that provides an object model for describing cryptographic artifacts and their dependencies." - -## Digital Certification - -As you have now completed the learning material for this course, you may wish to earn the course [badge](https://www.credly.com/org/ibm/badge/practical-introduction-to-quantum-safe-cryptography) by successfully answering sufficient questions in the course exam. - -## Post-course survey - -Please take a moment to help us improve our course with a quick [post-course survey](https://your.feedback.ibm.com/jfe/form/SV_d3XWeuV7hEC8Dki). Your feedback will be used to enhance our content offering and user experience. Thank you! \ No newline at end of file diff --git a/learning/courses/quantum-safe-cryptography/works-cited.mdx b/learning/courses/quantum-safe-cryptography/works-cited.mdx deleted file mode 100644 index 21ca6c7416aa..000000000000 --- a/learning/courses/quantum-safe-cryptography/works-cited.mdx +++ /dev/null @@ -1,283 +0,0 @@ ---- -title: Works cited -description: This document provides a list of all citations used within the course. ---- - -{/* cspell:ignore Malviya, Tiwari, Chawla, Leurent, Naya, Plasencia, IACR, Santoli, Schaffner, Alagic, EUROCRYPT, Coron, Nazario, Rivest, Shamir, Adleman, cryptosystems, STOC, Buchmann, Dahmen, Kaplan, Leurent, Naya, Plasencia, Cryptosystems, Tomoiaga, Stratulat, Zeadally, Isogeny, Supersingular, isogeny, Overbeck, Sendrier, Buchmann, Dahmen, NTRU, Micciancio, 5Tilborg, Lyubashevsky, Micciancio, Díaz, Rolim, Zwick, Schwabe, SPHINCS, Schwabe, Regev, Lyubashevsky, Shamir, ASIACRYPT, Matsui, pyca, Gidney, Ekerå, Larasati, Gheorghiu, Hosoyamada, Sasaki, EUROCRYPT, Canteaut, Ishai, Proos, Zalka, Bonnetain, Chailloux, Schrottenloher, Shen, Diffie, Diffie, Nino, Diaz, Eliece, Supersingular, isogeny, Lenstra, Lenstra, Lovász, Ajtai, Langlois, Stehle, Schwabe, Schwabe, Schneier, Prichett, Cryptosystems, Tilborg, Foti, Vigenère, Nechvatal, Dworkin, Foti, Roback, Technol, Ciphertext, Ehrsam, Tuchman, Fujisaki, Eiichiro,Okamato, Tatsuaki, Crytography */} - - -# Works cited - -## Full list of references - -[1] A. K. Malviya, N. Tiwari, and M. Chawla, “Quantum cryptanalytic attacks of symmetric ciphers: A review,” *Computers and Electrical Engineering*, vol. 101, p. 108122, Jul. 2022, doi: [10.1016/j.compeleceng.2022.108122](https://doi.org/10.1016/j.compeleceng.2022.108122). - -[2] M.Kaplan, G. Leurent, A. Leverrier, and M. Naya-Plasencia, “Quantum Differential and LinearCryptanalysis,” *IACR Transactions on Symmetric Cryptology*, vol. 2016, no. 1, p. 71, 2016, doi: [10.13154/tosc.v2016.i1.71-94](https://doi.org/10.13154/tosc.v2016.i1.71-94). - -[3] T. Santoli and C. Schaffner, “Using Simon’s algorithm to attack symmetric-key cryptographic primitives,” *Quantum Information & Computation*, vol. 17, no. 1–2, pp. 65–78, Feb. 2017. - -[4] G. Alagic and A. Russell, “Quantum-Secure Symmetric-Key Cryptography Based on Hidden Shifts,” in *Advances in Cryptology – EUROCRYPT 2017*, J.-S. Coron and J. B. Nielsen, Eds., in Lecture Notes in Computer Science. Cham: Springer International Publishing, 2017, pp. 65–93. doi: [10.1007/978-3-319-56617-7_3](https://doi.org/10.1007/978-3-319-56617-7_3). - -[5] S. Bravyi, O. Dial, J. M. Gambetta, D. Gil, and Z. Nazario, “The future of quantum computing with superconducting qubits,” *Journal of Applied Physics*, vol. 132, no. 16, p. 160902, Oct. 2022, doi: [10.1063/5.0082975](https://doi.org/10.1063/5.0082975). - -[6] P. W. Shor, “Algorithms for quantum computation: Discrete logarithms and factoring,” in *Proceedings 35th Annual Symposium on Foundations of Computer Science*, Nov. 1994, pp. 124–134. doi: [10.1109/SFCS.1994.365700](https://doi.org/10.1109/SFCS.1994.365700). - -[7] R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public-key cryptosystems,” *Communications of the ACM*, vol. 21, no. 2, pp. 120–126, Feb. 1978, doi: [10.1145/359340.359342](https://doi.org/10.1145/359340.359342). - -[8] “Security level,” *Wikipedia*. Jan. 2023. Accessed: May 20, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Security_level&oldid=1131789113](https://en.wikipedia.org/w/index.php?title=Security_level&oldid=1131789113) - -[9] L. K. Grover, “A fast quantum mechanical algorithm for database search,” in *Proceedings of the twenty-eighth annual ACM symposium on Theory of Computing*, in STOC ’96. New York, NY, USA: Association for Computing Machinery, Jul. 1996, pp. 212–219. doi: [10.1145/237814.237866](https://doi.org/10.1145/237814.237866). - -[10] D. J. Bernstein, J. Buchmann, and E. Dahmen, Eds., *Post-Quantum Cryptography*. Berlin, Heidelberg: Springer Berlin Heidelberg, 2009. doi: [10.1007/978-3-540-88702-7](https://doi.org/10.1007/978-3-540-88702-7). - -[11] M. Kaplan, G. Leurent, A. Leverrier, and M. Naya-Plasencia, “Breaking Symmetric Cryptosystems using Quantum Period Finding,” *arXiv.org*. Feb. 2016. doi: [10.1007/978-3-662-53008-5_8](https://doi.org/10.1007/978-3-662-53008-5_8). - -[12] “Cryptographic agility,” *Wikipedia*. May 2023. Accessed: May 21, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Cryptographic_agility&oldid=1155073704](https://en.wikipedia.org/w/index.php?title=Cryptographic_agility&oldid=1155073704) - -[13] R. Tomoiaga and M. Stratulat, “AES Performance Analysis on Several Programming Environments, Operating Systems or Computational Platforms,” in *2010 Fifth International Conference on Systems and Networks Communications*, Aug. 2010, pp. 172–176. doi: [10.1109/ICSNC.2010.33](https://doi.org/10.1109/ICSNC.2010.33). - -[14] C. Peng, J. Chen, S. Zeadally, and D. He, “Isogeny-Based Cryptography: A Promising Post-Quantum Technique,” *IT Professional*, vol. 21, no. 6, pp. 27–32, Nov. 2019, doi: [10.1109/MITP.2019.2943136](https://doi.org/10.1109/MITP.2019.2943136). - -[15] “Multivariate cryptography,” *Wikipedia*. Oct. 2022. Accessed: Jun. 14, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Multivariate_cryptography&oldid=1117344303](https://en.wikipedia.org/w/index.php?title=Multivariate_cryptography&oldid=1117344303) - -[16] “Hash-based cryptography,” *Wikipedia*. Jun. 2023. Accessed: Jun. 14, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Hash-based_cryptography&oldid=1159153101](https://en.wikipedia.org/w/index.php?title=Hash-based_cryptography&oldid=1159153101) - -[17] “Supersingular isogeny key exchange,” *Wikipedia*. Apr. 2023. Accessed: Jun. 14, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Supersingular_isogeny_key_exchange&oldid=1150441329](https://en.wikipedia.org/w/index.php?title=Supersingular_isogeny_key_exchange&oldid=1150441329) - -[18] “NP-intermediate,” *Wikipedia*. Apr. 2023. Accessed: Jun. 14, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=NP-intermediate&oldid=1147641056](https://en.wikipedia.org/w/index.php?title=NP-intermediate&oldid=1147641056) - -[19] R. Overbeck and N. Sendrier, “Code-based cryptography,” in *Post-Quantum Cryptography*, D. J. Bernstein, J. Buchmann, and E. Dahmen, Eds., Berlin, Heidelberg: Springer, 2009, pp. 95–145. doi: [10.1007/978-3-540-88702-7_4](https://doi.org/10.1007/978-3-540-88702-7_4). - -[20] “NTRU,” *Wikipedia*. Aug. 2022. Accessed: Jun. 14, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=NTRU&oldid=1107481357](https://en.wikipedia.org/w/index.php?title=NTRU&oldid=1107481357) - -[21] “Learning with errors,” *Wikipedia*. May 2023. Accessed: Jun. 14, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Learning_with_errors&oldid=1153719613](https://en.wikipedia.org/w/index.php?title=Learning_with_errors&oldid=1153719613) - -[22] “NIST Announces First Four Quantum-Resistant Cryptographic Algorithms,” *NIST*, Jul. 2022, Accessed: Jun. 15, 2023. [Online]. Available: [https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms](https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms) - -[23] “Lattice reduction,” *Wikipedia*. Feb. 2023. Accessed: Jun. 15, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Lattice_reduction&oldid=1139588628](https://en.wikipedia.org/w/index.php?title=Lattice_reduction&oldid=1139588628) - -[24] D. Micciancio, “Closest Vector Problem,” in *Encyclopedia of Cryptography and Security*, H. C. A. van Tilborg, Ed., Boston, MA: Springer US, 2005, pp. 79–80. doi: [10.1007/0-387-23483-7_66](https://doi.org/10.1007/0-387-23483-7_66). - -[25] “Lattice problem,” *Wikipedia*. Apr. 2023. Accessed: Jun. 15, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Lattice_problem&oldid=1149662985](https://en.wikipedia.org/w/index.php?title=Lattice_problem&oldid=1149662985) - -[26] Y.-K. Liu, V. Lyubashevsky, and D. Micciancio, “On Bounded Distance Decoding for General Lattices,” in *Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques*, J. Díaz, K. Jansen, J. D. P. Rolim, and U. Zwick, Eds., in Lecture Notes in Computer Science. Berlin, Heidelberg: Springer, 2006, pp. 450–461. doi: [10.1007/11830924_41](https://doi.org/10.1007/11830924_41). - -[27] P. Schwabe, “SPHINCS+.” Accessed: Jun. 20, 2023. [Online]. Available: [https://sphincs.org/](https://sphincs.org/) - -[28] “Digital Signature Algorithm,” *Wikipedia*. Apr. 2023. Accessed: Jun. 20, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Digital_Signature_Algorithm&oldid=1148950522](https://en.wikipedia.org/w/index.php?title=Digital_Signature_Algorithm&oldid=1148950522) - -[29] P. W. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,” *SIAM Journal on Computing*, vol. 26, no. 5, pp. 1484–1509, Oct. 1997, doi: [10.1137/S0097539795293172](https://doi.org/10.1137/S0097539795293172). - -[30] P. Schwabe, “CRYSTALS.” Accessed: Jun. 20, 2023. [Online]. Available: [https://pq-crystals.org/](https://pq-crystals.org/) - -[31] Y. Li, K. S. Ng, and M. Purcell, “A Tutorial Introduction to Lattice-based Cryptography and Homomorphic Encryption.” arXiv, Sep. 2022. doi: [10.48550/arXiv.2208.08125](https://doi.org/10.48550/arXiv.2208.08125). - -[32] O. Regev, “The Learning with Errors Problem (Invited Survey),” in *2010 IEEE 25th Annual Conference on Computational Complexity*, Jun. 2010, pp. 191–204. doi: [10.1109/CCC.2010.26](https://doi.org/10.1109/CCC.2010.26). - -[33] “Elliptic-curve cryptography,” *Wikipedia*. Jun. 2023. Accessed: Jun. 20, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Elliptic-curve_cryptography&oldid=1160709993](https://en.wikipedia.org/w/index.php?title=Elliptic-curve_cryptography&oldid=1160709993) - -[34] “Elliptic curve point multiplication,” *Wikipedia*. Mar. 2023. Accessed: Jun. 20, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Elliptic_curve_point_multiplication&oldid=1145917191](https://en.wikipedia.org/w/index.php?title=Elliptic_curve_point_multiplication&oldid=1145917191) - -[35] “Symmetric-key algorithm,” *Wikipedia*. Mar. 2023. Accessed: Jun. 20, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Symmetric-key_algorithm&oldid=1147165636](https://en.wikipedia.org/w/index.php?title=Symmetric-key_algorithm&oldid=1147165636) - -[36] V. Lyubashevsky, “Fiat-Shamir with Aborts: Applications to Lattice and Factoring-Based Signatures,” in *Advances in Cryptology – ASIACRYPT 2009*, M. Matsui, Ed., in Lecture Notes in Computer Science. Berlin, Heidelberg: Springer, 2009, pp. 598–616. doi: [10.1007/978-3-642-10366-7_35](https://doi.org/10.1007/978-3-642-10366-7_35). - -[37] “Welcome to pyca/cryptography — Cryptography 42.0.0.dev1 documentation.” Accessed: Jun. 27, 2023. [Online]. Available: [https://cryptography.io/en/latest/](https://cryptography.io/en/latest/) - -[38] J. Ha, J. Lee, and J. Heo, “Resource analysis of quantum computing with noisy qubits for Shor’s factoring algorithms,” *Quantum Information Processing*, vol. 21, no. 2, p. 60, Jan. 2022, doi: [10.1007/s11128-021-03398-1](https://doi.org/10.1007/s11128-021-03398-1). - -[39] C. Gidney and M. Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” *Quantum*, vol. 5, p. 433, Apr. 2021, doi: [10.22331/q-2021-04-15-433](https://doi.org/10.22331/q-2021-04-15-433). - -[40] “Phys. Rev. Lett. 127, 140503 (2021) - Factoring 2048-bit RSA Integers in 177 Days with 13 436 Qubits and a Multimode Memory.” Accessed: Jun. 27, 2023. [Online]. Available: [https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.127.140503](https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.127.140503) - -[41] H. T. Larasati and H. Kim, “Quantum Cryptanalysis Landscape of Shor’s Algorithm for Elliptic Curve Discrete Logarithm Problem,” in *Information Security Applications*, H. Kim, Ed., in Lecture Notes in Computer Science. Cham: Springer International Publishing, 2021, pp. 91–104. doi: [10.1007/978-3-030-89432-0_8](https://doi.org/10.1007/978-3-030-89432-0_8). - -[42] “Cryptographic hash function,” *Wikipedia*. Jun. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Cryptographic_hash_function&oldid=1159000809](https://en.wikipedia.org/w/index.php?title=Cryptographic_hash_function&oldid=1159000809) - -[43] R. Preston, “Applying Grover’s Algorithm to Hash Functions: A Software Perspective,” *IEEE Transactions on Quantum Engineering*, vol. 3, pp. 1–10, 2022, doi: [10.1109/TQE.2022.3233526](https://doi.org/10.1109/TQE.2022.3233526). - -[44] V. Gheorghiu and M. Mosca, “Benchmarking the quantum cryptanalysis of symmetric, public-key and hash-based cryptographic schemes.” arXiv, Feb. 2019. doi: [10.48550/arXiv.1902.02332](https://doi.org/10.48550/arXiv.1902.02332). - -[45] G. Brassard, P. Hoyer, and A. Tapp, “Quantum Algorithm for the Collision Problem,” 1998, pp. 163–169. doi: [10.1007/BFb0054319](https://doi.org/10.1007/BFb0054319). - -[46] A. Hosoyamada and Y. Sasaki, “Finding Hash Collisions with Quantum Computers by Using Differential Trails with Smaller Probability than Birthday Bound,” in *Advances in Cryptology – EUROCRYPT 2020*, A. Canteaut and Y. Ishai, Eds., in Lecture Notes in Computer Science. Cham: Springer International Publishing, 2020, pp. 249–279. doi: [10.1007/978-3-030-45724-2_9](https://doi.org/10.1007/978-3-030-45724-2_9). - -[47] J. Proos and C. Zalka, “Shor’s discrete logarithm quantum algorithm for elliptic curves.” arXiv, Jan. 2004. doi: [10.48550/arXiv.quant-ph/0301141](https://doi.org/10.48550/arXiv.quant-ph/0301141). - -[48] “HMAC,” *Wikipedia*. Jun. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=HMAC&oldid=1158164088](https://en.wikipedia.org/w/index.php?title=HMAC&oldid=1158164088) - -[49] “Digital signature,” *Wikipedia*. Jun. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Digital_signature&oldid=1161173191](https://en.wikipedia.org/w/index.php?title=Digital_signature&oldid=1161173191) - -[50] “SHA-2,” *Wikipedia*. May 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=SHA-2&oldid=1155462953](https://en.wikipedia.org/w/index.php?title=SHA-2&oldid=1155462953) - -[51] “Preimage attack,” *Wikipedia*. Mar. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Preimage_attack&oldid=1145879411](https://en.wikipedia.org/w/index.php?title=Preimage_attack&oldid=1145879411) - -[52] “Collision attack,” *Wikipedia*. Feb. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Collision_attack&oldid=1138239916](https://en.wikipedia.org/w/index.php?title=Collision_attack&oldid=1138239916) - -[53] “BLAKE (hash function),” *Wikipedia*. Jun. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=BLAKE_(hash_function)&oldid=1161463384](https://en.wikipedia.org/w/index.php?title=BLAKE_(hash_function)&oldid=1161463384) - -[54] “MD5,” *Wikipedia*. Jun. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=MD5&oldid=1161719955](https://en.wikipedia.org/w/index.php?title=MD5&oldid=1161719955) - -[55] “SHA-1,” *Wikipedia*. Jun. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=SHA-1&oldid=1161401043](https://en.wikipedia.org/w/index.php?title=SHA-1&oldid=1161401043) - -[56] “SHA-3,” *Wikipedia*. Jun. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=SHA-3&oldid=1161463128](https://en.wikipedia.org/w/index.php?title=SHA-3&oldid=1161463128) - -[57] “Birthday attack,” *Wikipedia*. Jun. 2023. Accessed: Jun. 27, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Birthday_attack&oldid=1161075943](https://en.wikipedia.org/w/index.php?title=Birthday_attack&oldid=1161075943) - -[58] X. Bonnetain, A. Chailloux, A. Schrottenloher, and Y. Shen, “Finding many Collisions via Reusable Quantum Walks.” arXiv, May 2022. doi: [10.48550/arXiv.2205.14023](https://doi.org/10.48550/arXiv.2205.14023). - -[59] “Public-key cryptography,” *Wikipedia*. Jul. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Public-key_cryptography&oldid=1163952916](https://en.wikipedia.org/w/index.php?title=Public-key_cryptography&oldid=1163952916) - -[60] “Key exchange,” *Wikipedia*. Jan. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Key_exchange&oldid=1134576107](https://en.wikipedia.org/w/index.php?title=Key_exchange&oldid=1134576107) - -[61] “Key encapsulation mechanism,” *Wikipedia*. Sep. 2022. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Key_encapsulation_mechanism&oldid=1110687965](https://en.wikipedia.org/w/index.php?title=Key_encapsulation_mechanism&oldid=1110687965) - -[62] “Diffie–Hellman key exchange,” *Wikipedia*. Jul. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Diffie%E2%80%93Hellman_key_exchange&oldid=1163912552](https://en.wikipedia.org/w/index.php?title=Diffie%E2%80%93Hellman_key_exchange&oldid=1163912552) - -[63] “Elliptic-curve Diffie–Hellman,” *Wikipedia*. Jun. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Elliptic-curve_Diffie%E2%80%93Hellman&oldid=1160050860](https://en.wikipedia.org/w/index.php?title=Elliptic-curve_Diffie%E2%80%93Hellman&oldid=1160050860) - -[64] “Elliptic Curve Digital Signature Algorithm,” *Wikipedia*. Jun. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Elliptic_Curve_Digital_Signature_Algorithm&oldid=1162097661](https://en.wikipedia.org/w/index.php?title=Elliptic_Curve_Digital_Signature_Algorithm&oldid=1162097661) - -[65] C. A. Lara-Nino, A. Diaz-Perez, and M. Morales-Sandoval, “Elliptic Curve Lightweight Cryptography: A Survey,” *IEEE Access*, vol. 6, pp. 72514–72550, 2018, doi: [10.1109/ACCESS.2018.2881444](https://doi.org/10.1109/ACCESS.2018.2881444). - -[66] “RSA (cryptosystem),” *Wikipedia*. Jul. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&oldid=1163962255](https://en.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&oldid=1163962255) - -[67] “Trapdoor function,” *Wikipedia*. Jul. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Trapdoor_function&oldid=1163913265](https://en.wikipedia.org/w/index.php?title=Trapdoor_function&oldid=1163913265) - -[68] “RSA Factoring Challenge,” *Wikipedia*. Jul. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=RSA_Factoring_Challenge&oldid=1163481797](https://en.wikipedia.org/w/index.php?title=RSA_Factoring_Challenge&oldid=1163481797) - -[69] “Side-channel attack,” *Wikipedia*. Jun. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Side-channel_attack&oldid=1162235564](https://en.wikipedia.org/w/index.php?title=Side-channel_attack&oldid=1162235564) - -[70] “Man-in-the-middle attack,” *Wikipedia*. Jul. 2023. Accessed: Jul. 10, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Man-in-the-middle_attack&oldid=1164741355](https://en.wikipedia.org/w/index.php?title=Man-in-the-middle_attack&oldid=1164741355) - -[71] “Optimal asymmetric encryption padding,” *Wikipedia*. Jul. 2023. Accessed: Jul. 11, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Optimal_asymmetric_encryption_padding&oldid=1163481577](https://en.wikipedia.org/w/index.php?title=Optimal_asymmetric_encryption_padding&oldid=1163481577) - -[72] “Modular exponentiation,” *Wikipedia*. Jun. 2023. Accessed: Jul. 11, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Modular_exponentiation&oldid=1160764843](https://en.wikipedia.org/w/index.php?title=Modular_exponentiation&oldid=1160764843) - -[73] “General number field sieve,” *Wikipedia*. Apr. 2023. Accessed: Jul. 11, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=General_number_field_sieve&oldid=1151781536](https://en.wikipedia.org/w/index.php?title=General_number_field_sieve&oldid=1151781536) - -[74] “Quantum Fourier Transform.” Accessed: Jul. 11, 2023. [Online]. Available: [https://learn.qiskit.org](https://learn.qiskit.org) - -[75] “Quantum Phase Estimation.” Accessed: Jul. 11, 2023. [Online]. Available: [https://learn.qiskit.org](https://learn.qiskit.org) - -[76] “Shor’s algorithm,” *Wikipedia*. Jul. 2023. Accessed: Jul. 11, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Shor%27s_algorithm&oldid=1164409434](https://en.wikipedia.org/w/index.php?title=Shor%27s_algorithm&oldid=1164409434) - -[77] “Discrete logarithm,” *Wikipedia*. Jun. 2023. Accessed: Jul. 11, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Discrete_logarithm&oldid=1161792952](https://en.wikipedia.org/w/index.php?title=Discrete_logarithm&oldid=1161792952) - -[78] “Cyclic group,” *Wikipedia*. Apr. 2023. Accessed: Jul. 11, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Cyclic_group&oldid=1150017831](https://en.wikipedia.org/w/index.php?title=Cyclic_group&oldid=1150017831) - -[79] W. Diffie and M. Hellman, “New directions in cryptography,” *IEEE Transactions on Information Theory*, vol. 22, no. 6, pp. 644–654, Nov. 1976, doi: [10.1109/TIT.1976.1055638](https://doi.org/10.1109/TIT.1976.1055638). - -[80] “Hidden subgroup problem,” *Wikipedia*. May 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Hidden_subgroup_problem&oldid=1154290989](https://en.wikipedia.org/w/index.php?title=Hidden_subgroup_problem&oldid=1154290989) - -[81] “Secure Shell,” *Wikipedia*. Jun. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Secure_Shell&oldid=1158549718](https://en.wikipedia.org/w/index.php?title=Secure_Shell&oldid=1158549718) - -[82] “Elliptic curve,” *Wikipedia*. Jul. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Elliptic_curve&oldid=1164567664](https://en.wikipedia.org/w/index.php?title=Elliptic_curve&oldid=1164567664) - -[83] “Post-quantum cryptography,” *Wikipedia*. Jul. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Post-quantum_cryptography&oldid=1163915034](https://en.wikipedia.org/w/index.php?title=Post-quantum_cryptography&oldid=1163915034) - -[84] “NP (complexity),” *Wikipedia*. Jun. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=NP_(complexity)&oldid=1158889203](https://en.wikipedia.org/w/index.php?title=NP_(complexity)&oldid=1158889203) - -[85] “NP-completeness,” *Wikipedia*. May 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=NP-completeness&oldid=1157123934](https://en.wikipedia.org/w/index.php?title=NP-completeness&oldid=1157123934) - -[86] “NP-hardness,” *Wikipedia*. May 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=NP-hardness&oldid=1153995836](https://en.wikipedia.org/w/index.php?title=NP-hardness&oldid=1153995836) - -[87] “Average-case complexity,” *Wikipedia*. Apr. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Average-case_complexity&oldid=1151098788](https://en.wikipedia.org/w/index.php?title=Average-case_complexity&oldid=1151098788) - -[88] “Worst-case complexity,” *Wikipedia*. Feb. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Worst-case_complexity&oldid=1138645328](https://en.wikipedia.org/w/index.php?title=Worst-case_complexity&oldid=1138645328) - -[89] “Computational hardness assumption,” *Wikipedia*. Jun. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Computational_hardness_assumption&oldid=1158033193](https://en.wikipedia.org/w/index.php?title=Computational_hardness_assumption&oldid=1158033193) - -[90] “McEliece cryptosystem,” *Wikipedia*. Jun. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=McEliece_cryptosystem&oldid=1158412532](https://en.wikipedia.org/w/index.php?title=McEliece_cryptosystem&oldid=1158412532) - -[91] “Supersingular isogeny key exchange,” *Wikipedia*. Jul. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Supersingular_isogeny_key_exchange&oldid=1163291033](https://en.wikipedia.org/w/index.php?title=Supersingular_isogeny_key_exchange&oldid=1163291033) - -[92] “Falcon (signature scheme),” *Wikipedia*. May 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Falcon_(signature_scheme)&oldid=1157852190](https://en.wikipedia.org/w/index.php?title=Falcon_(signature_scheme)&oldid=1157852190) - -[93] “Lattice-based cryptography,” *Wikipedia*. Jul. 2023. Accessed: Jul. 12, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Lattice-based_cryptography&oldid=1163912863](https://en.wikipedia.org/w/index.php?title=Lattice-based_cryptography&oldid=1163912863) - -[94] “Lenstra–Lenstra–Lovász lattice basis reduction algorithm,” *Wikipedia*. Apr. 2023. Accessed: Jul. 13, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Lenstra%E2%80%93Lenstra%E2%80%93Lov%C3%A1sz_lattice_basis_reduction_algorithm&oldid=1151925724](https://en.wikipedia.org/w/index.php?title=Lenstra%E2%80%93Lenstra%E2%80%93Lov%C3%A1sz_lattice_basis_reduction_algorithm&oldid=1151925724) - -[95] M. Ajtai, “The shortest vector problem in L2 is NP-hard for randomized reductions (extended abstract),” in *Proceedings of the thirtieth annual ACM symposium on Theory of computing*, in STOC ’98. New York, NY, USA: Association for Computing Machinery, May 1998, pp. 10–19. doi: [10.1145/276698.276705](https://doi.org/10.1145/276698.276705). - -[96] M. Ajtai, “Generating hard instances of lattice problems (extended abstract),” in *Proceedings of the twenty-eighth annual ACM symposium on Theory of Computing*, in STOC ’96. New York, NY, USA: Association for Computing Machinery, Jul. 1996, pp. 99–108. doi: [10.1145/237814.237838](https://doi.org/10.1145/237814.237838). - -[97] “Ring learning with errors,” *Wikipedia*. Apr. 2023. Accessed: Jul. 13, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Ring_learning_with_errors&oldid=1148731729](https://en.wikipedia.org/w/index.php?title=Ring_learning_with_errors&oldid=1148731729) - -[98] A. Langlois and D. Stehle, “Worst-Case to Average-Case Reductions for Module Lattices.” 2012. Accessed: Jul. 13, 2023. [Online]. Available: [https://eprint.iacr.org/2012/090](https://eprint.iacr.org/2012/090) - -[99] P. Schwabe, “Kyber.” Accessed: Jul. 13, 2023. [Online]. Available: [https://pq-crystals.org/kyber/index.shtml](https://pq-crystals.org/kyber/index.shtml) - -[100] P. Schwabe, “Dilithium.” Accessed: Jul. 13, 2023. [Online]. Available: [https://pq-crystals.org/dilithium/index.shtml](https://pq-crystals.org/dilithium/index.shtml) - -[101] “Key derivation function,” *Wikipedia*. Jul. 2023. Accessed: Aug. 04, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Key_derivation_function&oldid=1165650237](https://en.wikipedia.org/w/index.php?title=Key_derivation_function&oldid=1165650237) - -[102] B. Schneier, *Applied Cryptography: Protocols, Algorithms, and Source Code in C*. John Wiley & Sons, 2015. Available: [https://books.google.com/books?id=01vfjgEACAAJ](https://books.google.com/books?id=01vfjgEACAAJ) - -[103] D. Luciano and G. Prichett, “Cryptology: From Caesar Ciphers to Public-key Cryptosystems,” *The College Mathematics Journal*, vol. 18, no. 1, pp. 2–17, Jan. 1987, doi: [10.1080/07468342.1987.11973000](https://doi.org/10.1080/07468342.1987.11973000). - -[104] M. E. Smid and J. Foti, “Development of the Advanced Encryption Standard,” *NIST*, vol. 126, Aug. 2021, Accessed: May 17, 2023. [Online]. Available: [https://www.nist.gov/publications/development-advanced-encryption-standard](https://www.nist.gov/publications/development-advanced-encryption-standard) - -[105] “Caesar cipher,” *Wikipedia*. Apr. 2023. Accessed: May 17, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Caesar_cipher&oldid=1151194063](https://en.wikipedia.org/w/index.php?title=Caesar_cipher&oldid=1151194063) - -[106] “Vigenère cipher,” *Wikipedia*. May 2023. Accessed: May 17, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Vigen%C3%A8re_cipher&oldid=1155012941](https://en.wikipedia.org/w/index.php?title=Vigen%C3%A8re_cipher&oldid=1155012941) - -[107] “One-time pad,” *Wikipedia*. May 2023. Accessed: May 17, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=One-time_pad&oldid=1155039884](https://en.wikipedia.org/w/index.php?title=One-time_pad&oldid=1155039884) - -[108] “Enigma machine,” *Wikipedia*. May 2023. Accessed: May 17, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Enigma_machine&oldid=1154440070](https://en.wikipedia.org/w/index.php?title=Enigma_machine&oldid=1154440070) - -[109] “Transposition cipher,” *Wikipedia*. Apr. 2023. Accessed: May 17, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Transposition_cipher&oldid=1151499771](https://en.wikipedia.org/w/index.php?title=Transposition_cipher&oldid=1151499771) - -[110] “Data Encryption Standard,” *Wikipedia*. May 2023. Accessed: May 17, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Data_Encryption_Standard&oldid=1154751166](https://en.wikipedia.org/w/index.php?title=Data_Encryption_Standard&oldid=1154751166) - -[111] C. E. Shannon, “A Mathematical Theory of Cryptography.” Bell System Technical Memo MM 45-110-02, Sep. 1945. - -[112] “Substitution–permutation network,” *Wikipedia*. Jul. 2022. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Substitution%E2%80%93permutation_network&oldid=1098155951](https://en.wikipedia.org/w/index.php?title=Substitution%E2%80%93permutation_network&oldid=1098155951) - -[113] “S-box,” *Wikipedia*. May 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=S-box&oldid=1154458964](https://en.wikipedia.org/w/index.php?title=S-box&oldid=1154458964) - -[114] “Permutation box,” *Wikipedia*. Apr. 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Permutation_box&oldid=1151700196](https://en.wikipedia.org/w/index.php?title=Permutation_box&oldid=1151700196) - -[115] “Round (cryptography),” *Wikipedia*. Apr. 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Round_(cryptography)&oldid=1149554107](https://en.wikipedia.org/w/index.php?title=Round_(cryptography)&oldid=1149554107) - -[116] J. Nechvatal, E. Barker, D. Dodson, M. Dworkin, J. Foti, and E. Roback, “Status Report on the First Round of the Development of the Advanced Encryption Standard,” *J Res Natl Inst Stand Technol*, vol. 104, no. 5, pp. 435–459, 1999, doi: [10.6028/jres.104.027](https://doi.org/10.6028/jres.104.027). - -[117] “Stream cipher,” *Wikipedia*. Mar. 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Stream_cipher&oldid=1143750236](https://en.wikipedia.org/w/index.php?title=Stream_cipher&oldid=1143750236) - -[118] “Initialization vector,” *Wikipedia*. Jan. 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Initialization_vector&oldid=1136156102](https://en.wikipedia.org/w/index.php?title=Initialization_vector&oldid=1136156102) - -[119] “Pseudorandom number generator,” *Wikipedia*. May 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Pseudorandom_number_generator&oldid=1153255020](https://en.wikipedia.org/w/index.php?title=Pseudorandom_number_generator&oldid=1153255020) - -[120] “Semantic security,” *Wikipedia*. Jan. 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Semantic_security&oldid=1133491450](https://en.wikipedia.org/w/index.php?title=Semantic_security&oldid=1133491450) - -[121] “Ciphertext indistinguishability,” *Wikipedia*. Dec. 2022. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047](https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047) - -[122] “Ciphertext indistinguishability,” *Wikipedia*. Dec. 2022. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047#IND-CPA](https://en.wikipedia.org/w/index.php?title=Ciphertext_indistinguishability&oldid=1130147047#IND-CPA) - -[123] “Entropy (information theory),” *Wikipedia*. May 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Entropy_(information_theory)&oldid=1154931420](https://en.wikipedia.org/w/index.php?title=Entropy_(information_theory)&oldid=1154931420) - -[124] W. F. Ehrsam, C. H. W. Meyer, J. L. Smith, and W. L. Tuchman, “Message verification and transmission error detection by block chaining,” US4074066A, Feb. 1978 Accessed: May 18, 2023. [Online]. Available: [https://patents.google.com/patent/US4074066A/en](https://patents.google.com/patent/US4074066A/en) - -[125] “Block cipher mode of operation,” *Wikipedia*. May 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Block_cipher_mode_of_operation&oldid=1154901199#cite_note-23](https://en.wikipedia.org/w/index.php?title=Block_cipher_mode_of_operation&oldid=1154901199#cite_note-23) - -[126] “Non-repudiation,” *Wikipedia*. Apr. 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Non-repudiation&oldid=1148337707](https://en.wikipedia.org/w/index.php?title=Non-repudiation&oldid=1148337707) - -[127] “Transport Layer Security,” *Wikipedia*. May 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Transport_Layer_Security&oldid=1155601531](https://en.wikipedia.org/w/index.php?title=Transport_Layer_Security&oldid=1155601531) - -[128] “Message authentication code,” *Wikipedia*. Apr. 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Message_authentication_code&oldid=1151014755](https://en.wikipedia.org/w/index.php?title=Message_authentication_code&oldid=1151014755) - -[129] “Virtual private network,” *Wikipedia*. May 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Virtual_private_network&oldid=1154342615](https://en.wikipedia.org/w/index.php?title=Virtual_private_network&oldid=1154342615) - -[130] “Avalanche effect,” *Wikipedia*. Apr. 2023. Accessed: May 18, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Avalanche_effect&oldid=1148010716](https://en.wikipedia.org/w/index.php?title=Avalanche_effect&oldid=1148010716) - -[131] X. Bonnetain, M. Naya-Plasencia, and A. Schrottenloher, “Quantum Security Analysis of AES,” *IACR Transactions on Symmetric Cryptology*, pp. 55–93, Jun. 2019, doi: [10.13154/tosc.v2019.i2.55-93](https://doi.org/10.13154/tosc.v2019.i2.55-93). - -[132] “Salsa20,” *Wikipedia*. Mar. 2023. Accessed: May 19, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Salsa20&oldid=1145010249](https://en.wikipedia.org/w/index.php?title=Salsa20&oldid=1145010249) - -[133] “Blowfish (cipher),” *Wikipedia*. Nov. 2022. Accessed: May 19, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=Blowfish_(cipher)&oldid=1120053771](https://en.wikipedia.org/w/index.php?title=Blowfish_(cipher)&oldid=1120053771) - -[134] “RC algorithm,” *Wikipedia*. Feb. 2022. Accessed: May 19, 2023. [Online]. Available: [https://en.wikipedia.org/w/index.php?title=RC_algorithm&oldid=1072978900](https://en.wikipedia.org/w/index.php?title=RC_algorithm&oldid=1072978900) - -[135] Fujisaki, Eiichiro, and Okamato, Tatsuaki, "Secure Integration of Symmetric and Asymmetric Encryption Schemes," Journal of Crytography, pp. 80-101, Jan. 2013, doi: [10.1007/s00145-011-9114-1](https://doi.org/10.1007/s00145-011-9114-1) - -[136] Snow, Dwaine, "Fundamentals of Encryption & Quantum-Safe Techniques," Skills Network. [Online]. Available: [https://catalog.skills.network/2766](https://catalog.skills.network/2766) diff --git a/learning/index.mdx b/learning/index.mdx index c098d12096c9..193b2d1e37e1 100644 --- a/learning/index.mdx +++ b/learning/index.mdx @@ -19,7 +19,6 @@ If you don't see your course in the following list, edit `learning/index.mdx` an - [General formulation of quantum information](/learning/courses/general-formulation-of-quantum-information) - [Quantum business foundations](/learning/courses/quantum-business-foundations) - [Foundations of quantum error correction](/learning/courses/foundations-of-quantum-error-correction) -- [Practical Introduction to Quantum-Safe Cryptography](/learning/courses/quantum-safe-cryptography) - [Utility-scale quantum computing](/learning/courses/utility-scale-quantum-computing) - [Qiskit in classrooms - computer science](/learning/modules/computer-science) - [Qiskit in classrooms - quantum mechanics](/learning/modules/quantum-mechanics) diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ECCfig.avif b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ECCfig.avif deleted file mode 100644 index d66296480b21..000000000000 Binary files a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ECCfig.avif and /dev/null differ diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/akc.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/akc.svg deleted file mode 100644 index ab62947e01dc..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/akc.svg +++ /dev/null @@ -1,93 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/akc@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/akc@dark.svg deleted file mode 100644 index ecf9efb436b2..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/akc@dark.svg +++ /dev/null @@ -1,89 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/auth_key_exchange.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/auth_key_exchange.svg deleted file mode 100644 index 7d7b96200404..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/auth_key_exchange.svg +++ /dev/null @@ -1,50 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/auth_key_exchange@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/auth_key_exchange@dark.svg deleted file mode 100644 index 2f4da2fbe628..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/auth_key_exchange@dark.svg +++ /dev/null @@ -1,50 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ca_akc.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ca_akc.svg deleted file mode 100644 index 0cfdfcad0bb4..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ca_akc.svg +++ /dev/null @@ -1,69 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ca_akc@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ca_akc@dark.svg deleted file mode 100644 index f44996d3e88b..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/ca_akc@dark.svg +++ /dev/null @@ -1,57 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_akc.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_akc.svg deleted file mode 100644 index aec5822693fe..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_akc.svg +++ /dev/null @@ -1,115 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_akc@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_akc@dark.svg deleted file mode 100644 index 0d55cab06b3f..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_akc@dark.svg +++ /dev/null @@ -1,144 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_rsa.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_rsa.svg deleted file mode 100644 index 4d5a133ff3ee..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_rsa.svg +++ /dev/null @@ -1,181 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_rsa@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_rsa@dark.svg deleted file mode 100644 index 5b5b2cf7b22b..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/dig_sig_rsa@dark.svg +++ /dev/null @@ -1,165 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kem_akc.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kem_akc.svg deleted file mode 100644 index 297c4e1abfd2..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kem_akc.svg +++ /dev/null @@ -1,89 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kem_akc@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kem_akc@dark.svg deleted file mode 100644 index 224f4a5b20d2..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kem_akc@dark.svg +++ /dev/null @@ -1,57 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kep_akc.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kep_akc.svg deleted file mode 100644 index fa6d359cd03c..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kep_akc.svg +++ /dev/null @@ -1,89 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kep_akc@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kep_akc@dark.svg deleted file mode 100644 index f32ae4649e14..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/kep_akc@dark.svg +++ /dev/null @@ -1,81 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_dh.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_dh.svg deleted file mode 100644 index c3ef382f5e7b..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_dh.svg +++ /dev/null @@ -1,83 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_dh@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_dh@dark.svg deleted file mode 100644 index 80feb7304633..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_dh@dark.svg +++ /dev/null @@ -1,60 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_rsa.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_rsa.svg deleted file mode 100644 index 502b1a077e94..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_rsa.svg +++ /dev/null @@ -1,157 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_rsa@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_rsa@dark.svg deleted file mode 100644 index 3eeedd86121f..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/asymmetric-key-cryptography/key_exchange_rsa@dark.svg +++ /dev/null @@ -1,154 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/data-integrity.svg b/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/data-integrity.svg deleted file mode 100644 index 51801875ca22..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/data-integrity.svg +++ /dev/null @@ -1,55 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/data-integrity@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/data-integrity@dark.svg deleted file mode 100644 index 4cfa63da688c..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/data-integrity@dark.svg +++ /dev/null @@ -1,55 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/digital-signature.svg b/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/digital-signature.svg deleted file mode 100644 index c6115f772ed6..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/digital-signature.svg +++ /dev/null @@ -1,120 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/digital-signature@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/digital-signature@dark.svg deleted file mode 100644 index 252ef13903a3..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/cryptographic-hash-functions/digital-signature@dark.svg +++ /dev/null @@ -1,123 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/exam/badge.avif b/public/learning/images/courses/quantum-safe-cryptography/exam/badge.avif deleted file mode 100644 index a2a846f9c86b..000000000000 Binary files a/public/learning/images/courses/quantum-safe-cryptography/exam/badge.avif and /dev/null differ diff --git a/public/learning/images/courses/quantum-safe-cryptography/hero.avif b/public/learning/images/courses/quantum-safe-cryptography/hero.avif deleted file mode 100644 index 408d6d05e824..000000000000 Binary files a/public/learning/images/courses/quantum-safe-cryptography/hero.avif and /dev/null differ diff --git a/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/CVP.avif b/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/CVP.avif deleted file mode 100644 index 81f23daed542..000000000000 Binary files a/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/CVP.avif and /dev/null differ diff --git a/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/Lattice-reduction-wiki.avif b/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/Lattice-reduction-wiki.avif deleted file mode 100644 index 3ea052d6138a..000000000000 Binary files a/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/Lattice-reduction-wiki.avif and /dev/null differ diff --git a/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/SVP.avif b/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/SVP.avif deleted file mode 100644 index dae54fc96e02..000000000000 Binary files a/public/learning/images/courses/quantum-safe-cryptography/quantum-safe-cryptography/SVP.avif and /dev/null differ diff --git a/public/learning/images/courses/quantum-safe-cryptography/symmetric-key-cryptography/skc.svg b/public/learning/images/courses/quantum-safe-cryptography/symmetric-key-cryptography/skc.svg deleted file mode 100644 index 8b07865f3694..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/symmetric-key-cryptography/skc.svg +++ /dev/null @@ -1,91 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/public/learning/images/courses/quantum-safe-cryptography/symmetric-key-cryptography/skc@dark.svg b/public/learning/images/courses/quantum-safe-cryptography/symmetric-key-cryptography/skc@dark.svg deleted file mode 100644 index 14b1170da402..000000000000 --- a/public/learning/images/courses/quantum-safe-cryptography/symmetric-key-cryptography/skc@dark.svg +++ /dev/null @@ -1,91 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/qiskit_bot.yaml b/qiskit_bot.yaml index 8d5076ae2fe9..90fc20db8fbf 100644 --- a/qiskit_bot.yaml +++ b/qiskit_bot.yaml @@ -1142,24 +1142,6 @@ notifications: "learning/courses/foundations-of-quantum-error-correction/exam": - "@kcmccormibm" - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/asymmetric-key-cryptography": - - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/cryptographic-hash-functions": - - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/index": - - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/introduction-to-this-course": - - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/quantum-safe-cryptography": - - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/symmetric-key-cryptography": - - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/whats-next": - - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/works-cited": - - "@christopherporter1" - "learning/courses/quantum-safe-cryptography/exam": - - "@christopherporter1" "learning/modules/computer-science/deutsch-jozsa": - "@christopherporter1" "learning/modules/computer-science/grovers": diff --git a/scripts/config/notebook-testing.toml b/scripts/config/notebook-testing.toml index 4372455f2351..cf9fd1e910e7 100644 --- a/scripts/config/notebook-testing.toml +++ b/scripts/config/notebook-testing.toml @@ -329,11 +329,6 @@ notebooks = [ "learning/courses/foundations-of-quantum-error-correction/fault-tolerant-quantum-computing/approach-to-fault-tolerance.ipynb", "learning/courses/foundations-of-quantum-error-correction/fault-tolerant-quantum-computing/controlling-error-propagation.ipynb", "learning/courses/foundations-of-quantum-error-correction/fault-tolerant-quantum-computing/threshold-theorem.ipynb", - "learning/courses/quantum-safe-cryptography/cryptographic-hash-functions.ipynb", - "learning/courses/quantum-safe-cryptography/quantum-safe-cryptography.ipynb", - "learning/courses/quantum-safe-cryptography/symmetric-key-cryptography.ipynb", - "learning/courses/quantum-safe-cryptography/WhatNext.ipynb", - "learning/courses/quantum-safe-cryptography/asymmetric-key-cryptography.ipynb", "learning/courses/quantum-chem-with-vqe/introduction.ipynb", "learning/courses/quantum-chem-with-vqe/hamiltonian-construction.ipynb", "learning/courses/quantum-chem-with-vqe/ansatz.ipynb",