Cryptology ePrint Archive: Report 2018/725

Round5: KEM and PKE based on GLWR

Sauvik Bhattacharya and Oscar Garcia-Morchon and Thijs Laarhoven and Ronald Rietman and Markku-Juhani O. Saarinen and Ludo Tolhuizen and Zhenfei Zhang

Abstract: Standardization bodies such as NIST and ETSI are currently seeking quantum resistant alternatives to vulnerable RSA and elliptic curve-based public-key algorithms. In this context, we present Round5, a lattice-based cryptosystem providing a key encapsulation mechanism and a public-key encryption scheme. Round5 is based on the General Learning with Rounding problem, unifying non-ring and ring lattice rounding problems into one. Usage of rounding combined with a tight analysis leads to significantly reduced bandwidth and randomness requirements. Round5's reliance on prime-order cyclotomic rings offers a large design space allowing fine-grained parameter optimization. The use of sparse-ternary secret keys improves performance and significantly reduces decryption failure rates at minimal additional cost. The use of error-correcting codes, in combination with ring multiplications in $\mathbb{Z}[x]/(x^{n+1}-1)$ that ensures non-correlated errors, further improves the latter. Round5 parameters have been carefully optimized for bandwidth, while the design facilitates efficient implementation.

As a result, Round5 has leading performance characteristics among all NIST post-quantum candidates, and at the same time attains conservative security levels that fully fit NIST's security categories. Round5's schemes share common building blocks, simplifying (security and operational) analysis and code review. Finally, Round5 proposes various approaches of refreshing the system public parameter A, which efficiently prevent precomputation and back-door attacks.

Disclaimer: This is a draft version, not all sections are included.

Category / Keywords: public-key cryptography / Lattice cryptography,Post-quantum cryptography,Learning with rounding,prime cyclotomic ring,key encapsulation,CCA security,CPA security

Date: received 3 Aug 2018, last revised 26 Jan 2019

Contact author: sauvik bhattacharya at philips com

Available format(s): PDF | BibTeX Citation

Note: Updated title to reflect full specification document.

Version: 20190126:102712 (All versions of this report)

Short URL: ia.cr/2018/725


[ Cryptology ePrint archive ]