Abstract:Key Exchange (KE) is, undoubtedly, one of the most used cryptographic primitives in practice. Its authenticated version, Authenticated Key Exchange (AKE), avoids man-in-the-middle-based attacks by providing authentication for both parties involved. It is widely used on the Internet, in protocols such as TLS or SSH. In this work, we provide new constructions for KE and AKE based on ideal lattices in the Random Oracle Model (ROM). The contributions of this work can be summarized as follows: • It is well-known that RLWE-based KE protocols are not robust for key reuses since the signal function leaks information about the secret key. We modify the design of previous RLWE-based KE schemes to allow key reuse in the ROM. Our construction makes use of a new technique called pasteurization which enforces a supposedly RLWE sample sent by the other party to be indeed indistinguishable from a uniform sample and, therefore, ensures no information leakage in the whole KE process. • We build a new AKE scheme based on the construction above. The scheme provides implicit authentication (that is, it does not require the use of any other authentication mechanism, like a signature scheme) and it is proven secure in the Bellare-Rogaway model with weak Perfect Forward Secrecy in the ROM. It improves previous designs for AKE schemes based on lattices in several aspects. Our construction just requires sampling from only one discrete Gaussian distribution and avoids rejection sampling and noise flooding techniques, unlike previous proposals (Zhang et al., EUROCRYPT 2015). Thus, the scheme is much more efficient than previous constructions in terms of computational and communication complexity. Since our constructions are provably secure assuming the hardness of the RLWE problem, they are considered to be robust against quantum adversaries and, thus, suitable for post-quantum applications. ∗Email: pmbranco@math.tecnico.ulisboa.pt

Practical Randomized RLWE-Based Key Exchange Against Signal Leakage Attack.

Complete Attack On Rlwe Key Exchange With Reused Keys, Without Signal Leakage

Leakage of Signal Function with Reused Keys in RLWE Key Exchange

Light the Signal: Optimization of Signal Leakage Attacks Against LWE-Based Key Exchange

Comparison Analysis and Efficient Implementation of Reconciliation-Based RLWE Key Exchange Protocol.

Key Exchange and Authenticated Key Exchange with Reusable Keys Based on RLWE Assumption

One Sample Ring-LWE with Rounding and Its Application to Key Exchange.

Provably Secure Password Authenticated Key Exchange Based On Rlwe For The Post-Quantum World

How to Validate the Secret of a Ring Learning with Errors (RLWE) Key

Post-Quantum Secure Remote Password Protocol from RLWE Problem.

Cryptanalysis of RLWE-Based One-Pass Authenticated Key Exchange

Universally Composable Oblivious Transfer Protocol Based on the RLWE Assumption

A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem.

An ECDLP-Based Randomized Key RFID Authentication Protocol

Efficient KEA-Style Lattice-Based Authenticated Key Exchange

Provably Secure Three-Party Password-Based Authenticated Key Exchange From Rlwe

Toward Proxy Re-encryption from Learning with Errors in the Exponent

Exploiting Redundant Randomness for Resisting Key Exposure in Encrypted Communication Systems

Non-interactive zero-knowledge proof scheme from RLWE-based key exchange

Improved security bound for the round-robin-differential-phase-shift quantum key distribution

A Key Exchange Based on the Short Integer Solution Problem and the Learning with Errors Problem