Cryptology ePrint Archive: Report 2018/725

Round5: Compact and Fast Post-Quantum Public-Key Encryption

Sauvik Bhattacharya and Oscar Garcia-Morchon and Thijs Laarhoven and Ronald Rietman and Markku-Juhani O. Saarinen and Ludo Tolhuizen and Zhenfei Zhang

Abstract: Standardization bodies such as NIST and ETSI are currently seeking quantum resistant alternatives to vulnerable RSA and elliptic curve-based public-key algorithms. In this context, we present Round5, a lattice-based cryptosystem providing a key encapsulation mechanism and a public-key encryption scheme. Round5 is based on the General Learning with Rounding problem, unifying non-ring and ring lattice rounding problems into one. Usage of rounding combined with a tight analysis leads to significantly reduced bandwidth and randomness requirements. Round5's reliance on prime-order cyclotomic rings offers a large design space allowing fine-grained parameter optimization. The use of sparse-ternary secret keys improves performance and significantly reduces decryption failure rates at minimal additional cost. The use of error-correcting codes further improves the latter. Round5 parameters have been carefully optimized for bandwidth, while the design facilitates efficient implementation. As a result, Round5 has leading performance characteristics among all NIST post-quantum candidates, and at the same time attains conservative security levels that fully fit NIST's security categories. Round5's schemes share common building blocks, simplifying (security and operational) analysis and code review. Finally, Round5 proposes various approaches of refreshing the system public parameter $\textbf{A}$, which efficiently prevent precomputation and back-door attacks.

Category / Keywords: Lattice cryptography,Post-quantum cryptography,Learning with rounding,prime cyclotomic ring,key encapsulation,CCA security,CPA security

Date: received 3 Aug 2018, last revised 6 Aug 2018

Contact author: sauvik bhattacharya at philips com

Available format(s): PDF | BibTeX Citation

Note: Small (typo) corrections in Introduction and Abstract.

Version: 20180809:142744 (All versions of this report)

Short URL: ia.cr/2018/725


[ Cryptology ePrint archive ]