Partial Post Quantum Cryptography migration of GitLab Community Edition source code with 3 main contributions 1. Devloped RubyCrypt - a simple scanner to assist the Cryptographic Inventory Compilation of Ruby apps 2. Configured git to use PQC signature (CRYSTALS-Dilithium) for commit signing 3. Included CRYSTALS-Dilithium to ssh_data, a common cryptographic Ruby gem used by GitLab (& GitHub):1. Introduction 2. Theoretical Background - Post Quantum Cryptography 2.1. Code-based Cryptography 2.1.1. McEliece Cryptosystem 2.2. Lattice-based Cryptography 2.2.1. CRYSTALS-Dilithium 3. Post Quantum Cryptography Migration of GitLab - a Case Study 3.1. Problem Statement 3.2. Related Work 3.2.1. Software Tools for Static Program Analysis 3.3. Chosen Approach 4. Implementation 4.1. Cryptographic Inventory Compilation 4.1.1. Results 4.2. Migration Planning 4.3. Migration Execution 4.3.1. PQC Commit Signatures in git 4.3.2. Including Dilithium to ssh_data 5. Conclusion and Outlook 6. References List of Tables List of Figures List of Source Code Acronyms Notation / Partielle Migration des GitLab Community Edition Source Codes auf Verfahren der Post-Quanten-Kryptographie mit 3 Hauptergebnissen 1. Entwicklung von RubyCrypt - einem simplen Scanner zur Unterstützung der Inventarisierung verwendeter Kryptographie in Ruby-Anwendungen 2. Konfiguration von git zur Verwendung des quantensicheren Signaturalgorithmus CRYSTALS-Dilithium zur Signatur von Commits 3. Integration von CRYSTALS-Dilithium in ssh_data, ein populäres kryptographisches Ruby gem welches in GitLab (und GitHub) verwendet wird:1. Introduction 2. Theoretical Background - Post Quantum Cryptography 2.1. Code-based Cryptography 2.1.1. McEliece Cryptosystem 2.2. Lattice-based Cryptography 2.2.1. CRYSTALS-Dilithium 3. Post Quantum Cryptography Migration of GitLab - a Case Study 3.1. Problem Statement 3.2. Related Work 3.2.1. Software Tools for Static Program Analysis 3.3. Chosen Approach 4. Implementation 4.1. Cryptographic Inventory Compilation 4.1.1. Results 4.2. Migration Planning 4.3. Migration Execution 4.3.1. PQC Commit Signatures in git 4.3.2. Including Dilithium to ssh_data 5. Conclusion and Outlook 6. References List of Tables List of Figures List of Source Code Acronyms Notation

Many public-key cryptosystems currently in use are threatened by the possibility of large-scale quantum computers being built in the future. To counteract this, a process of developing quantum-resistant cryptographic algorithms is underway. This process also emphasizes the importance of protecting algorithms from Side-Channel Analysis (SCA). National Institute of Standards and Technology (NIST) oversees this process, and candidates for new standards are submitted into a public evaluation to be examined, updated, and possibly eliminated in order to ensure quality and security of the future standard. To develop knowledge of how to prevent SCA on Field Programmable Gate Array (FPGA) targets, this thesis investigated SCA using the ChipWhisperer-lite capture board and a RISC-V architecture synthesized on a PolarFire FPGA development board as the custom target. Various tests and attempts to detect and verify side-channel leakage are presented. Also included is a study and continuation of a previously explored deep neural network-based SCA on Saber Key Encapsulation Mechanism, which is one of the finalists of NIST post-quantum cryptography standardization process. Changes to the network were made to enable attacks using a tenth of the previously used traces for training. In addition, by utilizing t-test, spectrum analysis, and persistence plots, this thesis was able to verify data-dependent leakage from an S-Box implemented on the FPGA target. However, the key extraction using correlation power analysis was not successful, and therefore the hypothesis for mitigation methods could not be explored. As a result, the thesis’ main contribution is to provide a theoretical background and an introduction to the field and its challenges. The lessons learnt and methods used to connect the ChipWhisperer to the FPGA target might save time and facilitate SCA for the more experienced hardware security researchers. Future work should continue to further investigate this field in order to prevent SCA. / Utvecklingen av kvantdatorer hotar många av de konventionella och idag vitt använda krypteringsalgoritmerna. Därför pågår en process att utveckla och standardisera kvantdatorsäkra krypteringsalgoritmer. Som ett viktigt steg i denna process säkerställs även deras motståndskraft mot sidokanalsattacker. Detta sker i en öppen process modererad av National Institute of Standards and Technology. Kandidaterna till de nya algoritmerna utvärderas, justeras och anslås i en öppen process likt en tävling. Målet med detta examensarbete är att bidra med kunskap och insikter kring hur sidokanalsattacker utförs och motverkas. Attacker kommer riktas mot FPGA-hårdvara konfigurerad med en RISC-V arkitektur istället för de vanligt förekommande ChipWhisperer-måltavlorna. Sidokanalsläckage skall först identifieras och verifieras för att motåtgärder skall kunna testas och utvärderas. I arbetet återskapas en tidigare utförd attack med hjälp av neurala nätverk. Den nya återskapade attacken utförs på SaberKEM, men med stor begränsning utav antalet mätserier. Detta examensarbete kunde verifiera läckage ifrån RISC-V arkitekturen när den utförde AES krypteringssteget, S-Box. Verifieringen utfördes genom användning av T-test, spektrumanalys samt studerande av överlapp hos signalerna. Dock lyckades inte attackerna extrahera känslig nyckelinformation från varken S-Box eller lösenordsjämförelser. På grund av att dessa misslyckades kunde inte arbetet fortsätta vidare till testning av hypoteser för motåtgärder. Därför bör bidraget från detta arbete främst ses som en bakgrund och introduktion till ämnet. Kapitlen Introduktion och Bakgrund bör vara en god genomgång för nybörjare för att förstå viktiga begrepp och principer. För de mer erfarna är troligen metoderna för att koppla ihop och konfigurera FPGA-målet mer intressanta. Genom att dra lärdom av arbetets svårigheter, misstag och utmaningar kan tid sparas. Slutligen uppmanas framtida arbeten att utföra attacker på svårare mål utan direkta mätpunkter för att bli bättre på att anfalla och designa säkrare system.

Atualmente, podemos perceber que uma grande dependência dos sistemas desenvolvidos sob a seara da criptografia foi instaurada em todos nós. Principalmente no tocante dos sistemas criptográficos de chave pública, que são vastamente utilizados na Internet. No entanto, a criptografia de chave pública viu-se ameaçada e começou a investigar novas fontes de problemas para seus sistemas quando Shor em 1997 desenvolveu um algoritmo de tempo polinomial para fatorar inteiros e para calcular o logaritmo discreto em um computador quântico. Neste contexto, Patarin propõe a função alçapão HFE (Hidden Field Equations), uma trapdoor baseada nos Problemas MQ (Multivariate Quadratic) e IP (Isomorfismo de Polinômios). Tais problemas não são afetados pelo algoritmo de Shor, além disto o Problema MQ foi demonstrado por Patarin e Goubin como sendo NP-completo. Apesar do HFE ter sua versão básica quebrada, ele apresenta variações -- obtidas através de modificadores genéricos -- resistentes aos principais ataques da atualidade. O Quartz -- esquema de assinatura digital baseado no HFEv-, com escolha especial de parâmetros -- é um bom exemplo desta resistência a ataques algébricos que visem a recuperação da chave privada, pois até hoje permanece seguro. Além de também se destacar por gerar assinaturas curtas. Todavia, Joux e Martinet -- baseados em axiomas do Ataque pelo Paradoxo de Aniversário -- provaram que o Quartz é maleável, demonstrando que caso o adversário possua um par (mensagem, assinatura) válido, ele conseguirá obter uma segunda assinatura com 2^(50) computações e 2^(50) chamadas ao oráculo de assinatura, logo muito abaixo dos padrões de segurança atuais que são de, no mínimo, 2^(112). Desta forma, baseado no Quartz, apresentamos um novo esquema de assinatura digital resistente a ataques adaptativos de mensagem escolhida que realizem chamadas ao oráculo aleatório, com um nível de segurança estimado em 2^(112). Nosso criptossistema proporciona, ainda, um ganho de eficiência no algoritmo de verificação de assinatura e na inicialização dos vetores que serão utilizados pelos algoritmos de assinatura e verificação. Além de, também, disponibilizarmos uma implementação do Quartz Original e do Quartz Aprimorado, na linguagem de programação Java. / Today, we can see that a large dependence of the systems developed under the cryptography was introduced in all of us. Especially in terms of public key cryptosystems, which are widely used on the Internet. However, public key cryptography was threatened and began to investigate new sources of problems for their systems when Shor in 1997 developed a polynomial time algorithm for factoring integers and to compute the discrete logarithm in a quantum computer. In this context, Patarin proposed Hidden Field Equations (HFE), a trapdoor based on MQ (Multivariate Quadratic) and IP (Isomorphism of Polynomials) problems. Such problems are not affected by the Shor algorithm, moreover MQ Problem was demonstrate by Patarin and Goubin as NP-complete. Despite the basic HFE has broken, it varies secure, obtained by generic modification. The Quartz -- digital signature scheme based on HFEv-, with special choice of parameters -- is a good example of this resistance to algebraic attacks aimed at the recovery of the private key, because even today remains secure. Furthermore, it also generates short signatures. However, Joux and Martinet -- based on axioms of Birthday Paradox Attack -- proved that Quartz is malleable, showing that if the adversary has a pair (message, signature) valid, he can get a second signature with 2^(50) computations and 2^(50) calls to the signing oracle, so far the current security standards that are at least 2^(112). Thus, based on Quartz, we present a new digital signature scheme, achieving the adaptive chosen message attacks that make calls to the random oracle, with a secure level estimated at 2^(112). Our cryptosystem also provides an efficiency gain in signature verification algorithm and initialization vectors that will be used for signing and verification algorithms. Further we provide an implementation of Original Quartz and Enhanced Quartz in the Java programming language.

The security of a cryptosystem in most cases relies on the key being kept secret. Quantum key distribution (QKD) enables two authenticated parties without other prior information to share a perfectly secure key. However, repeatedly using the same key to encrypt many different messages is not perfectly secure. A trivial method to obtain a secret key is to use QKD to reestablish a new key for each message. In this thesis, we study an efficient method to update the keys. We call this method quantum key evolution (QKE). The QKE provides a new secret key in each round of the protocol. Therefore, a new secret key is established for next round of protocol execution. We study two problems to present secure schemes applying the QKE. First, we present a new quantum message transmission protocol, to transmit long secret message using less quantum bits than the methods of incorporating QKD with one-time pad, as well as some quantum secure direct communication protocols. Second, we present three-party authenticated quantum key distribution protocols which enable two communicating parties to authenticate the other's identity and establish a session key between them via a trusted center. For the security of our protocols, we give formal standard reduction proofs to the security of our protocols. We show that the security of our protocol is equivalent to the security of BB84 protocol which has been proved to be unconditionally secure. Therefore, our protocols are unconditionally secure.

We explore the connection between quantum error correction and quantum cryptography through the notion of conjugate (or complementary) channels. This connection is at the level of subspaces and operator subsystems; if we use a more general form of subsystem, the link between the two topics breaks down. We explore both the subspace and subsystem settings. Error correction arises as a means of addressing the issue of the introduction of noise to a message being sent from one party to another. Noise also plays a role in quantum measurement theory: If one wishes to measure a system that is in a particular state via a measurement apparatus, one can first act upon the system by a quantum channel, which can be thought of as a noise source, and then measure the resulting system using a different measurement apparatus. Such a setup amounts to the introduction of noise to the measurement process, yet has the advantage of preserving the measurement statistics. Preprocessing by a quantum channel leads to the partial order "cleaner than" on quantum probability measures. Other meaningful partial orders on quantum probability measures exist, and we shall investigate that of cleanness as well as that of absolute continuity. Lastly, we investigate partial orders on vectors corresponding to quantum states; such partial orders, namely majorization and trumping, have been linked to entanglement theory. We characterize trumping first by means of yet another partial order, power majorization, which gives rise to a family of examples. We then characterize trumping through the complete monotonicity of certain Dirichlet polynomials corresponding to the states in question. This not only generalizes a recent characterization of trumping, but the use of such mathematical objects simpli es the derivation of the result. / The Natural Sciences and Engineering Research Council of Canada (NSERC)

Atualmente, podemos perceber que uma grande dependência dos sistemas desenvolvidos sob a seara da criptografia foi instaurada em todos nós. Principalmente no tocante dos sistemas criptográficos de chave pública, que são vastamente utilizados na Internet. No entanto, a criptografia de chave pública viu-se ameaçada e começou a investigar novas fontes de problemas para seus sistemas quando Shor em 1997 desenvolveu um algoritmo de tempo polinomial para fatorar inteiros e para calcular o logaritmo discreto em um computador quântico. Neste contexto, Patarin propõe a função alçapão HFE (Hidden Field Equations), uma trapdoor baseada nos Problemas MQ (Multivariate Quadratic) e IP (Isomorfismo de Polinômios). Tais problemas não são afetados pelo algoritmo de Shor, além disto o Problema MQ foi demonstrado por Patarin e Goubin como sendo NP-completo. Apesar do HFE ter sua versão básica quebrada, ele apresenta variações -- obtidas através de modificadores genéricos -- resistentes aos principais ataques da atualidade. O Quartz -- esquema de assinatura digital baseado no HFEv-, com escolha especial de parâmetros -- é um bom exemplo desta resistência a ataques algébricos que visem a recuperação da chave privada, pois até hoje permanece seguro. Além de também se destacar por gerar assinaturas curtas. Todavia, Joux e Martinet -- baseados em axiomas do Ataque pelo Paradoxo de Aniversário -- provaram que o Quartz é maleável, demonstrando que caso o adversário possua um par (mensagem, assinatura) válido, ele conseguirá obter uma segunda assinatura com 2^(50) computações e 2^(50) chamadas ao oráculo de assinatura, logo muito abaixo dos padrões de segurança atuais que são de, no mínimo, 2^(112). Desta forma, baseado no Quartz, apresentamos um novo esquema de assinatura digital resistente a ataques adaptativos de mensagem escolhida que realizem chamadas ao oráculo aleatório, com um nível de segurança estimado em 2^(112). Nosso criptossistema proporciona, ainda, um ganho de eficiência no algoritmo de verificação de assinatura e na inicialização dos vetores que serão utilizados pelos algoritmos de assinatura e verificação. Além de, também, disponibilizarmos uma implementação do Quartz Original e do Quartz Aprimorado, na linguagem de programação Java. / Today, we can see that a large dependence of the systems developed under the cryptography was introduced in all of us. Especially in terms of public key cryptosystems, which are widely used on the Internet. However, public key cryptography was threatened and began to investigate new sources of problems for their systems when Shor in 1997 developed a polynomial time algorithm for factoring integers and to compute the discrete logarithm in a quantum computer. In this context, Patarin proposed Hidden Field Equations (HFE), a trapdoor based on MQ (Multivariate Quadratic) and IP (Isomorphism of Polynomials) problems. Such problems are not affected by the Shor algorithm, moreover MQ Problem was demonstrate by Patarin and Goubin as NP-complete. Despite the basic HFE has broken, it varies secure, obtained by generic modification. The Quartz -- digital signature scheme based on HFEv-, with special choice of parameters -- is a good example of this resistance to algebraic attacks aimed at the recovery of the private key, because even today remains secure. Furthermore, it also generates short signatures. However, Joux and Martinet -- based on axioms of Birthday Paradox Attack -- proved that Quartz is malleable, showing that if the adversary has a pair (message, signature) valid, he can get a second signature with 2^(50) computations and 2^(50) calls to the signing oracle, so far the current security standards that are at least 2^(112). Thus, based on Quartz, we present a new digital signature scheme, achieving the adaptive chosen message attacks that make calls to the random oracle, with a secure level estimated at 2^(112). Our cryptosystem also provides an efficiency gain in signature verification algorithm and initialization vectors that will be used for signing and verification algorithms. Further we provide an implementation of Original Quartz and Enhanced Quartz in the Java programming language.

No description available.

With continuing research into quantum computing, current public key cryptographic algorithms such as RSA and ECC will become insecure. These algorithms are based on the difficulty of integer factorization or discrete logarithm problems, which are difficult to solve on classical computers but become easy with quantum computers. Because of this threat, government and industry are investigating new public key standards, based on mathematical assumptions that remain secure under quantum computing. This paper investigates methods of improving the area and performance of one of the proposed algorithms for key exchanges, "NewHope." We describe a pipelined FPGA implementation of NewHope512cpa which dramatically increases the throughput for a similar design area. Our pipelined encryption implementation achieves 652.2 Mbps and a 0.088 Mbps/LUT throughput-to-area (TPA) ratio, which are the best known results to date, and achieves an energy efficiency of 0.94 nJ/bit. This represents TPA and energy efficiency improvements of 10.05× and 8.58×, respectively, over a non-pipelined approach. Additionally, we investigate replacing the large SHAKE XOF (hash) function with a lightweight Trivium based PRNG, which reduces the area by 32% and improves energy efficiency by 30% for the pipelined encryption implementation, and which could be considered for future cipher specifications. / Master of Science / Cryptography is prevalent in almost every aspect of our lives. It is used to protect communication, banking information, and online transactions. Current cryptographic protections are built specifically upon public key encryption, which allows two people who have never communicated before to setup a secure communication channel. However, due to the nature of current cryptographic algorithms, the development of quantum computers will make it possible to break the algorithms that secure our communications. Because of this threat, new algorithms based on principles that stand up to quantum computing are being investigated to find a suitable alternative to secure our systems. These algorithms will need to be efficient in order to keep up with the demands of the ever growing internet. This paper investigates four hardware implementations of a proposed quantum-secure algorithm to explore ways to make designs more efficient. The improvements are valuable for high throughput applications, such as a server which must handle a large number of connections at once.

Device-independent cryptography provides security in various tasks whilst removing an assumption that cryptographers previously thought of as crucial -- complete trust in the machinations of their experimental apparatus. The theory of Bell inequalities as a proof of indeterminism within nature allows for secure device-independent schemes requiring neither trust in the cryptographers' devices nor reliance on the completeness of quantum mechanics. However, the extreme paranoia attributable to the relaxed assumptions within device independence requires an explicit consideration of the previously assumed ability of the experimenters to freely make random choices. This thesis addresses the so-called `free will loophole', presenting Bell tests and associated cryptographic protocols robust against adversarial manipulation of the random number generators with which measurements in a Bell test are selected. We present several quantitative measures for this experimental free will, otherwise known as measurement dependence. We discuss how an eavesdropper maliciously preprogramming the experimenters' untrusted devices can falsely simulate the violation of a Bell inequality. We also bound the amount of Bell violation achievable within a certain degree of measurement dependence. This analysis extends to device-independent randomness expansion, bounding the guessing probability and estimating the amount of privacy amplification required to distil private randomness. The protocol is secure against either arbitrary no-signalling or quantum adversaries. We also consider device-independent key distribution, studying adversarial models that exploit the free will loophole. Finally, we examine a model correlated between the random number generators and Bell devices across multiple runs of a Bell test. This enables an explicit exposition of the optimal cheating strategy and how the correlations manifest themselves within this strategy. We prove that there remain Bell violations for a sufficiently high, yet non-maximal degree of measurement dependence which cannot be simulated by a classical attack, regardless of how many runs of the experiment those choices are correlated over.

Nous nous intéressons à la réalisation par états quantiques de primitives cryptographiques classiques. Nous introduisons les concepts de l’avantage et de epsilon -enveloppes. Ensuite, nous démontrons que pour tout état, il existe un état strict-correct dont la différence entre leur fuite d’information est bornée supérieurement. Ce résultat démontre qu’il existe une relation entre la continuité de la fuite d’information et la mesure de dépendance entre les registres quantiques d’Alice et Bob. Par la suite, nous démontrons que si un état exhibe une de deux propriétés, sa fuite d’information est toujours bornée inférieurement par la fuite d’un état strict-correct. Ceci démontre que les résultats de Salvail et al. se généralisent pour des états en général respectant ces propriétés. Finalement, nous analysons numériquement la fuite d’information pour des enveloppes réalisant les primitives 1-2-OT et ROT. Nous trouvons un état correct qui atteint un minimum qui bat la borne inférieure précédemment trouvée par Salvail et al. / We are interested in classical cryptographic primitive implemented by quantum states. We introduce the concepts of advantage and -embedding. Following this, we show that for every state there exist a strict-correct state for which the difference between the leakage of both states is upper bounded. This result shows a relation between the leakage and the measure of dependency of Alice and Bob’s quantum registers. We then show that if a state exhibits one of two properties, then its leakage is lower bounded by that of a strict-correct state. This shows that the results of Salvail and al. [26] can be generalized to generic states that satisfy those conditions. Finally, we do a numerical analysis of the leakage of embedding for 1-2-OT and ROT primitives. We find a state that leaks less information than the lower bound previously found by Salvail and al. in [26].