Hacker News Reader

Is any of the lattice-based crypto faster than Bernstein and Peter Schwabe's code-based McBits? So far I've seen quite a few vulnerabilities for lattice-based crypto. They seem riddled with traps, so it could take a very long time before we are "sure" one is safe enough.

http://binary.cr.yp.to/mcbits.html

View on HN

The problem with McBits is that it has really large keys. For a 128 bit security level you have one megabyte keys. That may be a reasonably conservative secure choice if you want post quantum cryptography today for certain applicatoins. But if you want to use it for something like TLS it's pretty much unusable. The lattice based systems look like they could be made to work in a real-world setting. The problem is of course that cryptographers will tell you that they aren't confident what works and what doesn't and what parameters are secure. And there are patents (both for ntru and parts of rlwe), which the article unfortunately doesn't mention. That's basically a dealbreaker for widespread use.

What about https://en.wikipedia.org/wiki/Supersingular_Isogeny_Key_Exch..., which seems to have reasonably small key sizes and fewer of the problems associated with lattices?

One of the nice things about a lot of lattice-based crypto is that you can often just get certain homomorphic properties for free, which is why there's been a lot of recent interest in them.

Reply on news.ycombinator.com