NIST Post-Quantum Cryptography Standardization

Last updated

Post-Quantum Cryptography Standardization [1] is a program and competition by NIST to update their standards to include post-quantum cryptography. [2] It was announced at PQCrypto 2016. [3] 23 signature schemes and 59 encryption/KEM schemes were submitted by the initial submission deadline at the end of 2017 [4] of which 69 total were deemed complete and proper and participated in the first round. Seven of these, of which 3 are signature schemes, have advanced to the third round, which was announced on July 22, 2020.[ citation needed ]

Contents

On August 13, 2024, NIST released final versions of the first three Post Quantum Crypto Standards: FIPS 203, FIP 204, and FIP 205. [5]

Background

Academic research on the potential impact of quantum computing dates back to at least 2001. [6] A NIST published report from April 2016 cites experts that acknowledge the possibility of quantum technology to render the commonly used RSA algorithm insecure by 2030. [7] As a result, a need to standardize quantum-secure cryptographic primitives was pursued. Since most symmetric primitives are relatively easy to modify in a way that makes them quantum resistant, efforts have focused on public-key cryptography, namely digital signatures and key encapsulation mechanisms. In December 2016 NIST initiated a standardization process by announcing a call for proposals. [8]

The competition is now in its third round out of expected four, where in each round some algorithms are discarded and others are studied more closely. NIST hopes to publish the standardization documents by 2024, but may speed up the process if major breakthroughs in quantum computing are made.

It is currently undecided whether the future standards will be published as FIPS or as NIST Special Publication (SP).

Round one

Under consideration were: [9]
(strikethrough means it had been withdrawn)

TypePKE/KEM SignatureSignature & PKE/KEM
Lattice
  • Compact LWE
  • CRYSTALS-Kyber
  • Ding Key Exchange
  • EMBLEM and R.EMBLEM
  • FrodoKEM
  • HILA5 (withdrawn and merged into Round5)
  • KCL (pka OKCN/AKCN/CNKE)
  • KINDI
  • LAC
  • LIMA
  • Lizard
  • LOTUS
  • NewHope
  • NTRUEncrypt [10]
  • NTRU-HRSS-KEM
  • NTRU Prime
  • Odd Manhattan
  • Round2 (withdrawn and merged into Round5)
  • Round5 (merger of Round2 and Hila5, announced 4 August 2018) [11]
  • SABER
  • Three Bears
  • Titanium
Code-based
  • BIG QUAKE
  • BIKE
  • Classic McEliece + NTS- KEM
  • DAGS
  • Edon-K
  • HQC
  • LAKE (withdrawn and merged into ROLLO)
  • LEDAkem
  • LEDApkc
  • Lepton
  • LOCKER (withdrawn and merged into ROLLO)
  • McNie
  • NTS-KEM
  • ROLLO (merger of Ouroboros-R, LAKE and LOCKER) [14]
  • Ouroboros-R (withdrawn and merged into ROLLO)
  • QC-MDPC KEM
  • Ramstake
  • RLCE-KEM
  • RQC
  • pqsigRM
  • RaCoSS
  • RankSign
Hash-based
  • Gravity-SPHINCS
  • SPHINCS+
Multivariate
  • CFPKM
  • Giophantus
  • DualModeMS
  • GeMSS
  • Gui
  • HiMQ-3
  • LUOV
  • MQDSS
  • Rainbow
  • SRTPI
  • DME
Braid group
  • WalnutDSA
Supersingular elliptic curve isogeny
Satirical submission
Other
  • Guess Again
  • HK17
  • Mersenne-756839
  • RVB
  • Picnic

Round one submissions published attacks

Round two

Candidates moving on to the second round were announced on January 30, 2019. They are: [33]

TypePKE/KEMSignature
Lattice
Code-based
Hash-based
Multivariate
Supersingular elliptic curve isogeny
Zero-knowledge proofs

Round three

On July 22, 2020, NIST announced seven finalists ("first track"), as well as eight alternate algorithms ("second track"). The first track contains the algorithms which appear to have the most promise, and will be considered for standardization at the end of the third round. Algorithms in the second track could still become part of the standard, after the third round ends. [53] NIST expects some of the alternate candidates to be considered in a fourth round. NIST also suggests it may re-open the signature category for new schemes proposals in the future. [54]

On June 7–9, 2021, NIST conducted the third PQC standardization conference, virtually. [55] The conference included candidates' updates and discussions on implementations, on performances, and on security issues of the candidates. A small amount of focus was spent on intellectual property concerns.

Finalists

TypePKE/KEMSignature
Lattice
Code-based
Multivariate

Alternate candidates

TypePKE/KEMSignature
Lattice
  • FrodoKEM
  • NTRU Prime
Code-based
Hash-based
  • SPHINCS+
Multivariate
  • GeMSS
Supersingular elliptic curve isogeny
Zero-knowledge proofs
  • Picnic

Intellectual property concerns

After NIST's announcement regarding the finalists and the alternate candidates, various intellectual property concerns were voiced, notably surrounding lattice-based schemes such as Kyber and NewHope. NIST holds signed statements from submitting groups clearing any legal claims, but there is still a concern that third parties could raise claims. NIST claims that they will take such considerations into account while picking the winning algorithms. [56]

Round three submissions published attacks

Adaptations

During this round, some candidates have shown to be vulnerable to some attack vectors. It forces these candidates to adapt accordingly:

CRYSTAL-Kyber and SABER
may change the nested hashes used in their proposals in order for their security claims to hold. [58]
FALCON
side channel attack by . A masking may be added in order to resist the attack. This adaptation affects performance and should be considered whilst standardizing. [59]

Selected Algorithms 2022

On July 5, 2022, NIST announced the first group of winners from its six-year competition. [60] [61]

TypePKE/KEMSignature
Lattice
Hash-based

Round four

On July 5, 2022, NIST announced four candidates for PQC Standardization Round 4. [62]

TypePKE/KEM
Code-based
Supersingular elliptic curve isogeny

Round four submissions published attacks

First release

On August 13, 2024, NIST released final versions of its first three Post Quantum Crypto Standards. [5] According to the release announcement:

While there have been no substantive changes made to the standards since the draft versions, NIST has changed the algorithms’ names to specify the versions that appear in the three finalized standards, which are:

Additional Digital Signature Schemes

Round One

NIST received 50 submissions and deemed 40 to be complete and proper according to the submission requirements. [65] Under consideration are: [66]
(strikethrough means it has been withdrawn)

TypeSignature
Lattice
Code-based
MPC-in-the-Head
Multivariate
  • 3WISE ("the submitter agrees that the scheme is insecure, but prefers to not withdraw in the hope that studying the scheme will advance cryptanalysis" [83] )
  • Biscuit [84]
  • DME-Sign ("Our first impression is that the attack works and we are checking the details of the attack .We are implementing a variant of the DME that may resist the attack but we have to verify it." [85] )
  • HPPC
  • MAYO [86]
  • PROV [87]
  • QR-UOV [88]
  • SNOVA [89]
  • TUOV [90]
  • UOV [91]
  • VOX [92]
Supersingular elliptic curve isogeny
Symmetric-based
  • AIMer [94]
  • Ascon-Sign
  • FAEST [95]
  • SPHINCS-alpha
Other
  • ALTEQ [96]
  • eMLE-Sig 2.0
  • KAZ-SIGN
  • Preon
  • Xifrat1-Sign.I

Round one submissions published attacks

Round Two

NIST deemed 14 submissions to pass to the second round. [123]

TypeSignature
Lattice
  • HAWK
Code-based
MPC-in-the-Head
Multivariate
Supersingular elliptic curve isogeny
Symmetric-based

See also

Related Research Articles

<span class="mw-page-title-main">Advanced Encryption Standard</span> Standard for the encryption of electronic data

The Advanced Encryption Standard (AES), also known by its original name Rijndael, is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001.

Elliptic-curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller keys to provide equivalent security, compared to cryptosystems based on modular exponentiation in Galois fields, such as the RSA cryptosystem and ElGamal cryptosystem.

The Digital Signature Algorithm (DSA) is a public-key cryptosystem and Federal Information Processing Standard for digital signatures, based on the mathematical concept of modular exponentiation and the discrete logarithm problem. In a public-key cryptosystem, two keys are generated: data can only be encrypted with the public key and encrypted data can only be decrypted with the private key. DSA is a variant of the Schnorr and ElGamal signature schemes.

The Advanced Encryption Standard (AES), the symmetric block cipher ratified as a standard by National Institute of Standards and Technology of the United States (NIST), was chosen using a process lasting from 1997 to 2000 that was markedly more open and transparent than its predecessor, the Data Encryption Standard (DES). This process won praise from the open cryptographic community, and helped to increase confidence in the security of the winning algorithm from those who were suspicious of backdoors in the predecessor, DES.

<span class="mw-page-title-main">Daniel J. Bernstein</span> American mathematician, cryptologist and computer scientist (born 1971)

Daniel Julius Bernstein is an American mathematician, cryptologist, and computer scientist. He was a visiting professor at CASA at Ruhr University Bochum until 2024, as well as a research professor of Computer Science at the University of Illinois at Chicago. Before this, he was a visiting professor in the department of mathematics and computer science at the Eindhoven University of Technology.

NTRU is an open-source public-key cryptosystem that uses lattice-based cryptography to encrypt and decrypt data. It consists of two algorithms: NTRUEncrypt, which is used for encryption, and NTRUSign, which is used for digital signatures. Unlike other popular public-key cryptosystems, it is resistant to attacks using Shor's algorithm. NTRUEncrypt was patented, but it was placed in the public domain in 2017. NTRUSign is patented, but it can be used by software under the GPL.

In cryptography, the McEliece cryptosystem is an asymmetric encryption algorithm developed in 1978 by Robert McEliece. It was the first such scheme to use randomization in the encryption process. The algorithm has never gained much acceptance in the cryptographic community, but is a candidate for "post-quantum cryptography", as it is immune to attacks using Shor's algorithm and – more generally – measuring coset states using Fourier sampling.

The vast majority of the National Security Agency's work on encryption is classified, but from time to time NSA participates in standards processes or otherwise publishes information about its cryptographic algorithms. The NSA has categorized encryption items into four product types, and algorithms into two suites. The following is a brief and incomplete summary of public knowledge about NSA algorithms and protocols.

NSA Suite B Cryptography was a set of cryptographic algorithms promulgated by the National Security Agency as part of its Cryptographic Modernization Program. It was to serve as an interoperable cryptographic base for both unclassified information and most classified information.

Lattice-based cryptography is the generic term for constructions of cryptographic primitives that involve lattices, either in the construction itself or in the security proof. Lattice-based constructions support important standards of post-quantum cryptography. Unlike more widely used and known public-key schemes such as the RSA, Diffie-Hellman or elliptic-curve cryptosystems — which could, theoretically, be defeated using Shor's algorithm on a quantum computer — some lattice-based constructions appear to be resistant to attack by both classical and quantum computers. Furthermore, many lattice-based constructions are considered to be secure under the assumption that certain well-studied computational lattice problems cannot be solved efficiently.

The NIST hash function competition was an open competition held by the US National Institute of Standards and Technology (NIST) to develop a new hash function called SHA-3 to complement the older SHA-1 and SHA-2. The competition was formally announced in the Federal Register on November 2, 2007. "NIST is initiating an effort to develop one or more additional hash algorithms through a public competition, similar to the development process for the Advanced Encryption Standard (AES)." The competition ended on October 2, 2012, when NIST announced that Keccak would be the new SHA-3 hash algorithm.

SHA-3 is the latest member of the Secure Hash Algorithm family of standards, released by NIST on August 5, 2015. Although part of the same series of standards, SHA-3 is internally different from the MD5-like structure of SHA-1 and SHA-2.

The following outline is provided as an overview of and topical guide to cryptography:

Post-quantum cryptography (PQC), sometimes referred to as quantum-proof, quantum-safe, or quantum-resistant, is the development of cryptographic algorithms that are currently thought to be secure against a cryptanalytic attack by a quantum computer. Most widely-used public-key algorithms rely on the difficulty of one of three mathematical problems: the integer factorization problem, the discrete logarithm problem or the elliptic-curve discrete logarithm problem. All of these problems could be easily solved on a sufficiently powerful quantum computer running Shor's algorithm or even faster and less demanding alternatives.

BLISS is a digital signature scheme proposed by Léo Ducas, Alain Durmus, Tancrède Lepoint and Vadim Lyubashevsky in their 2013 paper "Lattice Signature and Bimodal Gaussians".

Hash-based cryptography is the generic term for constructions of cryptographic primitives based on the security of hash functions. It is of interest as a type of post-quantum cryptography.

In post-quantum cryptography, NewHope is a key-agreement protocol by Erdem Alkim, Léo Ducas, Thomas Pöppelmann, and Peter Schwabe that is designed to resist quantum computer attacks.

<span class="mw-page-title-main">Commercial National Security Algorithm Suite</span> Set of cryptographic algorithms by the NSA

The Commercial National Security Algorithm Suite (CNSA) is a set of cryptographic algorithms promulgated by the National Security Agency as a replacement for NSA Suite B Cryptography algorithms. It serves as the cryptographic base to protect US National Security Systems information up to the top secret level, while the NSA plans for a transition to quantum-resistant cryptography.

Kyber is a key encapsulation mechanism (KEM) designed to be resistant to cryptanalytic attacks with future powerful quantum computers. It is used to establish a shared secret between two communicating parties without an (IND-CCA2) attacker in the transmission system being able to decrypt it. This asymmetric cryptosystem uses a variant of the learning with errors lattice problem as its basic trapdoor function. It won the NIST competition for the first post-quantum cryptography (PQ) standard. NIST calls its standard Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM).

Éric Brier is a French cryptographer whose surname has been given to the Brier number and, acronymically with his colleagues Thomas Peyrin and Jacques Stern, the Format-preserving encryption standard BPS, more formally known as FFP3. He has worked for the French military procurement agency DGA, at Gemplus in the field of smart cards as a white-hat hacker, and similarly at Gemalto and Ingenico. He has been employed at the Thales Group since July 2020, working largely on quantum cryptography and NIST Post-Quantum Cryptography Standardization As Chief Technology Officer his team's signature-signing scheme Falcon was selected as a standard under the aegis of NIST after a rigorous six-year competition

References

  1. ↑ "Post-Quantum Cryptography PQC". 3 January 2017.
  2. ↑ "Post-Quantum Cryptography Standardization – Post-Quantum Cryptography". Csrc.nist.gov. 3 January 2017. Retrieved 31 January 2019.
  3. ↑ Moody, Dustin (24 November 2020). "The Future Is Now: Spreading the Word About Post-Quantum Cryptography". NIST.
  4. ↑ "Final Submission received". Archived from the original on 29 December 2017. Retrieved 29 December 2017.
  5. 1 2 NIST Releases First 3 Finalized Post-Quantum Encryption Standards, NIST, August 13, 2024
  6. ↑ Hong, Zhu (2001). "Survey of Computational Assumptions Used in Cryptography Broken or Not by Shor's Algorithm" (PDF).
  7. ↑ "NIST Released NISTIR 8105, Report on Post-Quantum Cryptography". 21 December 2016. Retrieved 5 November 2019.
  8. ↑ "NIST Asks Public to Help Future-Proof Electronic Information". NIST. 20 December 2016. Retrieved 5 November 2019.
  9. ↑ Computer Security Division, Information Technology Laboratory (3 January 2017). "Round 1 Submissions – Post-Quantum Cryptography – CSRC". Csrc.nist.gov. Retrieved 31 January 2019.
  10. 1 2 3 "NIST Post Quantum Crypto Submission". Archived from the original on 29 December 2017. Retrieved 29 December 2017.
  11. 1 2 "Google Groups". Groups.google.com. Retrieved 31 January 2019.
  12. ↑ qTESLA team. "Efficient and post-quantum secure lattice-based signature scheme". qTESLA.org. Archived from the original on 9 December 2023. Retrieved 4 March 2024.
  13. ↑ "qTESLA". Microsoft Research. Archived from the original on 31 December 2022. Retrieved 4 March 2024.
  14. 1 2 "ROLLO". Pqc-rollo.org. Retrieved 31 January 2019.
  15. ↑ RSA using 231 4096-bit primes for a total key size of 1 TiB. "Key almost fits on a hard drive" Bernstein, Daniel (28 May 2010). "McBits and Post-Quantum RSA" (PDF). Retrieved 10 December 2019.
  16. ↑ Bernstein, Daniel; Heninger, Nadia (19 April 2017). "Post-quantum RSA" (PDF). Retrieved 10 December 2019.
  17. ↑ "Dear all, the following Python script quickly recovers the message from a given "Guess Again" ciphertext without knowledge of the private key" (PDF). Csrc.nist.gov. Retrieved 30 January 2019.
  18. ↑ Panny, Lorenz (25 December 2017). "Fast key recovery attack against the "RVB" submission to #NISTPQC: t .... Computes private from public key". Twitter . Retrieved 31 January 2019.
  19. ↑ "Comments on RaCoSS". Archived from the original on 26 December 2017. Retrieved 4 January 2018.
  20. ↑ "Comments on HK17". Archived from the original on 5 January 2018. Retrieved 4 January 2018.
  21. ↑ "Dear all, We have broken SRTPI under CPA and TPSig under KMA" (PDF). Csrc.nist.gov. Retrieved 30 January 2019.
  22. ↑ Beullens, Ward; Blackburn, Simon R. (2018). "Practical attacks against the Walnut digital signature scheme". Cryptology ePrint Archive.
  23. ↑ Kotov, Matvei; Menshov, Anton; Ushakov, Alexander (2018). "An attack on the walnut digital signature algorithm". Cryptology ePrint Archive.
  24. ↑ Yu, Yang; Ducas, Léo (2018). "Learning strikes again: the case of the DRS signature scheme". Cryptology ePrint Archive.
  25. ↑ Barelli, Elise; Couvreur, Alain (2018). "An efficient structural attack on NIST submission DAGS". arXiv: 1805.05429 [cs.CR].
  26. ↑ Lequesne, Matthieu; Tillich, Jean-Pierre (2018). "Attack on the Edon-K Key Encapsulation Mechanism". arXiv: 1802.06157 [cs.CR].
  27. ↑ Couvreur, Alain; Lequesne, Matthieu; Tillich, Jean-Pierre (2018). "Recovering short secret keys of RLCE in polynomial time". arXiv: 1805.11489 [cs.CR].
  28. ↑ Bernstein, Daniel J.; Groot Bruinderink, Leon; Lange, Tanja; Lange, Lorenz (2017). "Hila5 Pindakaas: On the CCA security of lattice-based encryption with error correction". Cryptology ePrint Archive.
  29. ↑ "Official Comments" (PDF). Csrc.nist.gov. 13 September 2018.
  30. ↑ Debris-Alazard, Thomas; Tillich, Jean-Pierre (2018). "Two attacks on rank metric code-based schemes: RankSign and an Identity-Based-Encryption scheme". arXiv: 1804.02556 [cs.CR].
  31. ↑ "I am afraid the parameters in this proposal have at most 4 to 6-bits security under the Information Set Decoding (ISD) attack" (PDF). Csrc.nist.gov. Retrieved 30 January 2019.
  32. ↑ Lau, Terry Shue Chien; Tan, Chik How (31 January 2019). "Key Recovery Attack on McNie Based on Low Rank Parity Check Codes and Its Reparation". In Inomata, Atsuo; Yasuda, Kan (eds.). Advances in Information and Computer Security. Lecture Notes in Computer Science. Vol. 11049. Springer International Publishing. pp. 19–34. doi:10.1007/978-3-319-97916-8_2. ISBN   978-3-319-97915-1.
  33. ↑ Computer Security Division, Information Technology Laboratory (3 January 2017). "Round 2 Submissions – Post-Quantum Cryptography – CSRC". Csrc.nist.gov. Retrieved 31 January 2019.
  34. 1 2 Schwabe, Peter. "CRYSTALS". Pq-crystals.org. Retrieved 31 January 2019.
  35. ↑ "FrodoKEM". Frodokem.org. Retrieved 31 January 2019.
  36. ↑ Schwabe, Peter. "NewHope". Newhopecrypto.org. Retrieved 31 January 2019.
  37. ↑ "NTRU Prime: Intro". Archived from the original on 1 September 2019. Retrieved 30 January 2019.
  38. ↑ "SABER" . Retrieved 17 June 2019.
  39. ↑ "ThreeBears". SourceForge.net. Retrieved 31 January 2019.
  40. ↑ "Falcon". Falcon. Retrieved 26 June 2019.
  41. ↑ "BIKE – Bit Flipping Key Encapsulation". Bikesuite.org. Retrieved 31 January 2019.
  42. ↑ "HQC". Pqc-hqc.org. Retrieved 31 January 2019.
  43. ↑ "LEDAkem Key Encapsulation Module". Ledacrypt.org. Retrieved 31 January 2019.
  44. ↑ "LEDApkc Public Key Cryptosystem". Ledacrypt.org. Retrieved 31 January 2019.
  45. ↑ "NTS-Kem". Archived from the original on 29 December 2017. Retrieved 29 December 2017.
  46. ↑ "RQC". Pqc-rqc.org. Retrieved 31 January 2019.
  47. ↑ "Sphincs". Sphincs.org. Retrieved 19 June 2023.
  48. ↑ "GeMSS". Archived from the original on 31 January 2019. Retrieved 30 January 2019.
  49. ↑ "LUOV -- An MQ signature scheme" . Retrieved 22 January 2020.
  50. ↑ "MQDSS post-quantum signature". Mqdss.org. Retrieved 31 January 2019.
  51. ↑ "SIKE – Supersingular Isogeny Key Encapsulation". Sike.org. Retrieved 31 January 2019.
  52. ↑ "Picnic. A Family of Post-Quantum Secure Digital Signature Algorithms". microsoft.github.io. Retrieved 26 February 2019.
  53. ↑ Moody, Dustin; Alagic, Gorjan; Apon, Daniel C.; Cooper, David A.; Dang, Quynh H.; Kelsey, John M.; Liu, Yi-Kai; Miller, Carl A.; Peralta, Rene C.; Perlner, Ray A.; Robinson, Angela Y.; Smith-Tone, Daniel C.; Alperin-Sheriff, Jacob (2020). "Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process". doi: 10.6028/NIST.IR.8309 . S2CID   243755462 . Retrieved 23 July 2020.
  54. ↑ Third PQC Standardization Conference - Session I Welcome/Candidate Updates, 10 June 2021, retrieved 6 July 2021
  55. ↑ Computer Security Division, Information Technology Laboratory (10 February 2021). "Third PQC Standardization Conference | CSRC". CSRC | NIST. Retrieved 6 July 2021.
  56. ↑ "Submission Requirements and Evaluation Criteria" (PDF).
  57. ↑ Beullens, Ward (2022). "Breaking Rainbow Takes a Weekend on a Laptop" (PDF). Eprint.iacr.org.
  58. ↑ Grubbs, Paul; Maram, Varun; Paterson, Kenneth G. (2021). "Anonymous, Robust Post-Quantum Public Key Encryption". Cryptology ePrint Archive.
  59. ↑ Karabulut, Emre; Aysu, Aydin (2021). "Falcon Down: Breaking Falcon Post-Quantum Signature Scheme through Side-Channel Attacks". Cryptology ePrint Archive.
  60. ↑ "NIST Announces First Four Quantum-Resistant Cryptographic Algorithms". NIST. 5 July 2022. Retrieved 9 July 2022.
  61. ↑ "Selected Algorithms 2022". CSRC | NIST. 5 July 2022. Retrieved 9 July 2022.
  62. ↑ "Round 4 Submissions". CSRC | NIST. 5 July 2022. Retrieved 9 July 2022.
  63. ↑ "SIKE Team - Foreword and postscript" (PDF).
  64. ↑ Goodin, Dan (2 August 2022). "Post-quantum encryption contender is taken out by single-core PC and 1 hour". Ars Technica. Retrieved 6 August 2022.
  65. ↑ Moody, Dustin (17 July 2023). "Onramp submissions are posted!".
  66. ↑ "Digital Signature Schemes". csrc.nist.gov. 29 August 2022. Retrieved 17 July 2023.
  67. ↑ "SMAUG & HAETAE - HAETAE".
  68. ↑ "Hufu".
  69. ↑ "RACCOON – Not just a signature, a whole family of it !".
  70. ↑ "masksign/raccoon: Raccoon Signature Scheme -- Reference Code". GitHub .
  71. ↑ "Squirrels - Introduction".
  72. ↑ "CROSS crypto".
  73. ↑ "FuLeeca: A Lee-based Signature Scheme - Lehrstuhl für Nachrichtentechnik".
  74. ↑ "LESS project".
  75. ↑ "MEDS".
  76. ↑ "WAVE".
  77. ↑ "MIRA".
  78. ↑ "MiRitH".
  79. ↑ "MQOM".
  80. ↑ "PERK".
  81. ↑ "RYDE".
  82. ↑ "SD-in-the-Head".
  83. 1 2 Smith-Tone, Daniel (17 July 2023). "OFFICIAL COMMENT: 3WISE".
  84. ↑ "Home".
  85. ↑ "OFFICIAL COMMENT: DME Key Recovery Attack". groups.google.com. Retrieved 10 September 2023.
  86. ↑ "MAYO".
  87. ↑ "PROV".
  88. ↑ "QR-UOV".
  89. ↑ "SNOVA". snova.pqclab.org. Retrieved 23 September 2023.
  90. ↑ "TUOV".
  91. ↑ "UOV".
  92. ↑ "VOX".
  93. ↑ "SQIsign".
  94. ↑ "AIMer Signature".
  95. ↑ "Come and join the FAEST | FAEST Signature Algorithm".
  96. ↑ "ALTEQ".
  97. ↑ Tibouchi, Mehdi (17 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: EagleSign".
  98. ↑ Bernstein, D.J. (17 July 2023). "OFFICIAL COMMENT: KAZ-SIGN".
  99. ↑ Fluhrer, Scott (17 July 2023). "KAZ-SIGN".
  100. ↑ Panny, Lorenz (17 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: Xifrat1-Sign.I".
  101. ↑ Tibouchi, Mehdi (18 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: EagleSign".
  102. ↑ Beullens, Ward (18 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: HPPC".
  103. ↑ Perlner, Ray (21 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: HPPC".
  104. ↑ Saarinen, Markku-Juhani O. (18 July 2023). "OFFICIAL COMMENT: ALTEQ".
  105. ↑ Bouillaguet, Charles (19 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: Biscuit".
  106. ↑ Niederhagen, Ruben (19 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: MEDS".
  107. ↑ van Woerden, Wessel (20 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: FuLeeca".
  108. ↑ Persichetti, Edoardo (21 July 2023). "OFFICIAL COMMENT: LESS".
  109. ↑ Saarinen, Markku-Juhani O. "Round 1 (Additional Signatures) OFFICIAL COMMENT: DME-Sign".
  110. ↑ "OFFICIAL COMMENT: DME Key Recovery Attack". groups.google.com. Retrieved 10 September 2023.
  111. ↑ van Woerden, Wessel (25 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: EHTv3".
  112. ↑ Suhl, Adam (29 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: EHT".
  113. ↑ VASSEUR, Valentin (29 July 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: Enhanced pqsigRM".
  114. ↑ "Round 1 (Additional Signatures) OFFICIAL COMMENT: Enhanced pqsigRM". groups.google.com. Retrieved 30 September 2023.
  115. ↑ Saarinen, Markku-Juhani O. (27 July 2023). "Buffer overflows in HAETAE / On crypto vs implementation errors".
  116. ↑ Saarinen, Markku-Juhani O. (29 July 2023). "HuFu: Big-flipping forgeries and buffer overflows".
  117. ↑ Carrier, Kevin (3 August 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: SDitH".
  118. ↑ Carrier, Kevin; Hatey, Valérian; Tillich, Jean-Pierre (5 December 2023). "Projective Space Stern Decoding and Application to SDitH". arXiv: 2312.02607 [cs.IT].
  119. ↑ Furue, Hiroki (28 August 2023). "Round 1 (Additional Signatures) OFFICIAL COMMENT: VOX".
  120. ↑ Liu, Fukang; Mahzoun, Mohammad; Øygarden, Morten; Meier, Willi (10 November 2023). "Algebraic Attacks on RAIN and AIM Using Equivalent Representations". IACR ePrint (2023/1133).
  121. ↑ Ikematsu, Yasuhiko; Akiyama, Rika (2024), Revisiting the security analysis of SNOVA , retrieved 28 January 2024
  122. ↑ Ferreira, River Moreira; Perret, Ludovic (2024), Polynomial-Time Key-Recovery Attack on the ${\tt NIST}$ Specification of ${\tt PROV}$ , retrieved 4 April 2024
  123. ↑ Moody, Dustin (24 October 2024). "Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process".
  124. ↑ "CROSS crypto".
  125. ↑ "LESS project".
  126. ↑ "Mirath".
  127. ↑ "MQOM".
  128. ↑ "PERK".
  129. ↑ "RYDE".
  130. ↑ "SD-in-the-Head".
  131. ↑ "MAYO".
  132. ↑ "QR-UOV".
  133. ↑ "SNOVA". snova.pqclab.org. Retrieved 23 September 2023.
  134. ↑ "UOV".
  135. ↑ "SQIsign".
  136. ↑ "Come and join the FAEST | FAEST Signature Algorithm".
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.