Hey! I'm David, the author of the Real-World Cryptography book. I'm a crypto engineer at O(1) Labs on the Mina cryptocurrency, previously I was the security lead for Diem (formerly Libra) at Novi (Facebook), and a security consultant for the Cryptography Services of NCC Group. This is my blog about cryptography and security and other related topics that I find interesting.

The Merkle signature scheme is a digital signature scheme based on hash trees (also called Merkle trees) and one-time signatures such as the Lamport signature scheme. It was developed by Ralph Merkle in the late 1970s and is an alternative to traditional digital signatures such as the Digital Signature Algorithm or RSA.

Reading the SPHINCS whitepaper (a hash-based signature), we can understand a bit more why hash-based signatures were considered by PQCrypto to replace our current quantum weak signatures.

– RSA and ECC are perceived today as being small and fast, but they are broken in polynomial time by Shor’s algorithm. The polynomial is so small that scaling up to secure parameters seems impossible.
– Lattice-based signature schemes are reasonably fast and provide reasonably small signatures and keys for proposed parameters. However, their quanti- tative security levels are highly unclear. It is unsurprising for a lattice-based scheme to promise “100-bit” security for a parameter set in 2012 and to correct this promise to only “75-80 bits” in 2013. Fur- thermore, both of these promises are only against pre-quantum attacks, and it seems likely that the same parameters will be breakable in practice by quantum computers.
– Multivariate-quadratic signature schemes have extremely short signatures, are reasonably fast, and in some cases have public keys short enough for typical applications. However, the long-term security of these schemes is even less clear than the security of lattice-based schemes.
– Code-based signature schemes provide short signatures, and in some cases have been studied enough to support quantitative security conjectures. How- ever, the schemes that have attracted the most security analysis have keys of many megabytes, and would need even larger keys to be secure against quantum computers.

it's a two-track event. There are some talks about everything. From Indistinghuishability Obfuscation to Multi Parti Computation. Seems like a good place to be! I'm waiting for videos/slides/reports about the event. Will edit this post accordingly.

I'm looking at Indistinghuishability Obfuscation (iO). Which seems to be coming from Fully Homomorphic Encryption (FHE), Functional Encryption (FE) and Multilinear Maps (MM).

Watching Sanjam Garg introduction to this iO, I noticed one interesting slide that puts things into context:

2 parties key exchange in 1976 (DH)

3 parties in 2000 (Joux)

X parties in 2013 (GGH)

Video here:

EDIT:

Apparently, @Leptan is telling me that all multiparty key exchange using multilinear maps are broken as of today. Cf Cryptanalysis of GGH Map

Sometimes I read something interesting, and so I take a screenshot of it. And I know some people glance at this blog hoping to read a short piece that will provide some good knowledge. So here you go.

Taken from a Dan Bernstein's blogpost:

some history on curves

some constant-time shenanigans

The following is taken from the wikipedia's page on cryptanalysis

It is possible to repeatedly fold a standard letter-sized sheet of paper at the midway point about six to seven times. In 2012, some MIT students were able to fold an 1.2 kilometer long toilet paper 13 times. And every time the paper was folded, the number of layers on top of each other doubled. Therefore, the MIT students ended up with 2^13 = 8192 layers of paper on top of each other. And poor Eve's job was to manually count all layers one by one.

Please refer to this Wiki before asking questions that might have been asked before (use your common sense).

Cryptography is also usually more interesting than decrypting your random ciphertext, so consider that when posting, read what we are sharing first to see if it's really pertinent.

How to learn about Cryptography?

The first thing you should do, is to sign-up for Dan Boneh's course Crypto I on Coursera.

You do not have to finish it. Watching a few videos will already give you an idea of what is crypto and how easy/hard it is for you. If you can finish the course, and enjoy it at the same time, then you're in for a lot of fun.

Don't try signing-up for Crypto II though.

Alright, that was interesting, MOAR

There are many ways to learn more about crypto. Here's a non-exhaustive list:

But my favorite way: read whitepapers. Look at the ePrint archives and check what papers interest you. Often papers will come with an introduction section that explains the basics.

What about studying cryptography in a real school?

First, it's important to cultivate your new passion. Don't let your course get in the way of reading or building and doing side projects involving crypto.

Second, You need either a bachelor in mathematics or computer science. Depending on which part you find the more interesting in crypto. Usually Math => Theorical Cryptography, CS => Applied Cryptography.

Now either you don't have a master, and you could choose to do a cryptography master. There are a few: Rennes, Bordeaux, Limoges in France.Stanford, etc...

Or you can do a Computer Science or Number Theory oriented master and pick a crypto subject for a phd. Note that a phd will often lead you into theorical research in university, although some phd can be done within a company and might involve applied crypto. But companies around the world might find that relatively relevant (in France a phd will get you to some places).

It's important to know what you want to do, theorical or applied or in the middle? Usually finding an internship in a applied crypto company helps to get out of academia for a while. A good way to see what please you the most. And good news, in cryptography internships are pretty easy to find (at least at the moment).

Alright I'm studying crypto now, how to get more involved?

Cryptography is a big world, many things are happening and it's sometimes hard to follow everything. Especially some mediums give you a high noise-to-quality ratio. So here they are:

Now is your time to find an internship or a job? Apply everywhere, in the world. But where? Where other cryptographers are working, or have worked. You can find that on their published papers (usually written in the header), on Twitter, on Linkedin, etc...

Another good way is to check for "who's hiring" posts on hackernews or reddit

First of all, we stress that SVP and its variants should all be considered easy when the lattice dimension is less than 70. Indeed, we will see in Section 4 that exhaustive search techniques can solve SVP within an hour up to dimension 60. But because such techniques have exponential running time, even a 100-dimensional lattice is out of reach. When the lattice dimension is beyond 100, only approximation algorithms like LLL, DEEP and BKZ can be run.

I can't remember from what article I got that from. Must have been something Phong Nguyen wrote.

It states that a lattice of dimension 60 could be easily solved, in an hour, by an exhaustive search (or similar techniques (enumeration?)). Something to dig into.