Questions tagged [kyber]
Kyber is a Key Encapsulation Mechanism (KEM) based on the Module Learning with Errors (MLWE) problem. It is an example of lattice-based cryptography and is part of the Crystals family together with the signature scheme Dilithium.
97 questions
0 votes
1 answer
77 views
AES-GCM break POLA vs pure PQC Keyber Dithlithium? [closed]
I made a PQC library, pqccombo, with Kyber + Dilithium, no_std & std; I'm trying to be 100% NIST compliant. It'd like to remove AES-GCM, although Goog and Amzn are still using hybrid with ECDH
user137190
5 votes
1 answer
613 views
Transitioning a file encryption application to Post Quantum Cryptography
I have a file encryption application, that currently is using AES-256 in CTR mode, NIST Key Wrap and HMAC-SHA-512 for bulk encryption, session key encryption and integrity. The cryptography is open ...
- 53
3 votes
1 answer
314 views
Why isn't there a 2nth root of unity for n =256 (Kyber specifications)
Currently I am working on implementing a radix-4 NTT algorithm, but most of the research papers use a $2n$th root of unity as an input. However, in the Kyber specification, for $n = 256$ we don't ...
5 votes
1 answer
105 views
How to calculate log₂ of classical gates for ML-KEM FIPS 203, Categories 1, 3, and 5?
In the "CRYSTALS-Kyber Algorithm Specifications and Supporting Documentation (version 3.01)" paper, the values of $\log_{2}(G)$ are given for the classical gate counts in Categories 1 (...
- 175
3 votes
1 answer
173 views
Origin of the names in CRYSTALS: Cryptographic homage to sci-fi?
I understand that CRYSTALS stands for Cryptographic Suite for Algebraic Lattices, which makes sense given its mathematical foundation. But what’s up with the names Kyber and Dilithium? Feels like they’...
- 131
3 votes
0 answers
81 views
Decapsulation failure rates for ML-KEM
I tried to figure out how to compute the decapsulation failure rate for ML-KEM. Is it same as the decryption failure rate? I use the python codes from https://github.com/pq-crystals/security-estimates....
2 votes
3 answers
243 views
Symmetric-Key Cryptography counterpart for CRYSTALS-Kyber KEM
We know that the security of an encryption scheme must only depend on the key and not on the obscurity of the (key generation, encryption, decryption) algorithms. (Kerckhoff's principal 1883, Shannon ...
- 685
5 votes
1 answer
665 views
Why was the value of modulus (q) chosen small in KYBER and large in DILITHIUM?
In the KYBER key agreement algorithm, the mathematical condition dictates that $n|q-1$ and for the NTT implementation, the value of $q$ was chosen to be $3329$. In the DILITHIUM digital signature ...
- 535
2 votes
0 answers
77 views
Change KYBER KEM parameters
It seems that in the KYBER KEM algorithm, by changing some parameters (or subfunctions), higher speed can be achieved, of course, security is sacrificed a little! For example, the type of distribution ...
- 535
2 votes
1 answer
182 views
KYBER KEM centered binomial distribution
Consider the KYBER KEM algorithm. In this algorithm, a specific distribution called the centered binomial distribution is used instead of the discrete Gaussian distribution. Now, let’s move on to LWE ...
- 535
3 votes
1 answer
171 views
Dimension of lattice involved in CRYSTALS-Kyber?
I know CRYSTALS-Kyber is a module-LWE based crypto system that works on rings $$R_q=\frac{\mathbb{Z}_q[x]}{(x^n+1)}.$$ The matrix $A$ is chosen uniformly from $R_q^{k\times k}$ with $k=2$. I don't ...
- 215
2 votes
2 answers
112 views
What is the size of the keyspace of Kyber's private key and what is the duration needed to brute force it?
What is the size of the keyspace of Kyber-512's secret key and how long will it theoretically take to bruteforce it?
- 137
1 vote
1 answer
80 views
Is there a way to estimate the time it takes for a primal attack on kyber to complete for specific parameters?
I am implementing the primal attack on Kyber using BKZ and currently I am not able to complete running it for the parameters N=128 and k=2 even after 8 hours. Is there a way to estimate the duration ...
- 137
0 votes
0 answers
39 views
Why does the primal attack using BKZ produce different results when N<=32 compared to when N=64?
I am implementing the primal attack on kyber using the bkz algorithm with the code below. When N=32 or lower, it will produce the decryption key correctly. However, when N=64 the decryption key ...
- 137
4 votes
2 answers
439 views
Weak public keys in Kyber kem
Given that public key security is very important in the Kyber KEM algorithm and if this is not observed, various attacks can be applied to the discovery of the Kyber key. The question is how to ...
- 535