Post-Quantum Key Exchange in TLS via SIKE
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The emergence of quantum computers poses a threat to classical public-key based secret exchanges, necessitating the development of post-quantum cryptographic algorithms that are resistant to quantum attacks, while also requiring seamless integration with existing technologies without requiring a complete overhaul of infrastructure or protocols.
Innovation Solution
The implementation of a post-quantum key exchange mechanism within the Transport Layer Security (TLS) protocol, utilizing a 'propose and commit' mechanism for quantum-resistant encryption, which is backwards compatible and can be integrated into existing TLS infrastructure without modifications, using key encapsulation mechanisms like Supersingular Isogeny Key Encapsulation (SIKE) and hash-based message authentication codes (HMAC) to ensure security against both classical and quantum attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If post-quantum cryptographic algorithms are implemented to resist quantum attacks, then security against quantum attackers is improved, but device complexity and computational overhead increase
Solution Approach 1:
The cryptographic system is segmented into multiple distinct components: key generation module, key encapsulation module (using SIKE or other PQ algorithms), key decryption module, and HMAC generation module. This segmentation allows each component to be optimized independently and facilitates gradual adoption of post-quantum algorithms without replacing the entire cryptographic infrastructure.
Solution Approach 2:
The patent introduces intermediary key encapsulation mechanisms that bridge classical and post-quantum cryptographic systems. The key encapsulation module acts as an intermediary layer that can work with both classical key exchange protocols and post-quantum algorithms, enabling seamless integration and backwards compatibility while providing quantum resistance.
2Reliability
If post-quantum encryption algorithms are adopted to ensure quantum resistance, then security is improved, but compatibility with existing systems and protocols deteriorates
Solution Approach 1:
The cryptographic module is designed with multi-functionality to support both classical cryptographic algorithms and post-quantum algorithms. The key encapsulation module can selectively implement different algorithms (e.g., SIKE, Kyber, or classical ECDH) based on configuration, allowing the same system to serve both legacy and quantum-resistant requirements simultaneously.
Solution Approach 2:
The system implements dynamic algorithm selection where the cryptographic protocol can adaptively choose between classical and post-quantum algorithms based on the capabilities of communicating parties. This dynamic approach enables gradual adoption of post-quantum cryptography while maintaining compatibility with systems that have not yet upgraded, allowing the system to evolve over time without breaking existing connections.
3Reliability
If complex post-quantum key exchange protocols are implemented, then security against quantum attackers is improved, but processing time and computational resources increase
Solution Approach 1:
The implementation applies partial post-quantum protection selectively to only the key exchange portion of the communication protocol, rather than encrypting all data. The key encapsulation and decryption operations provide quantum resistance for the critical secret exchange, while allowing standard, faster encryption algorithms to be used for bulk data transmission, thus balancing security with performance.
Solution Approach 2:
The system allows adjustment of cryptographic parameters such as key sizes, iteration counts, and algorithm selection to optimize the balance between security and performance. By tuning these parameters, the system can provide adequate quantum resistance while minimizing the impact on processing speed and computational resource consumption, adapting to different performance requirements.
Data Source
AI summary
A system, computer-readable storage medium, and method for secure network communication. A first device employs a first secret to establish a stream between the first and a second device. A third key, first ciphertext based on a first key, and hash of the first key are received from the second device by the first. A second key is applied to recover a second secret from the first ciphertext. The third key is encrypted to generate a second ciphertext including a third secret. Fourth and fifth keys are derived based on the first, second, and third secrets. A message authentication code is generated based on the fourth and third keys, first ciphertext, hash of the first key, and second ciphertext. The second ciphertext and message authentication code are transmitted by the first to the second device, and the fifth key is employed by the first device to modify the stream.