Cryptography · Cluster
Post-Quantum Cryptography
Lattice and code-based schemes.
- 01 How Shor's Algorithm Turns Factoring into Period Finding Why quantum phase estimation on a modular exponentiation function recovers RSA private keys, and what the circuit cost reveals about which schemes need replacing and which do not.
- 02 Why Learning With Errors Is Believed Hard in the Worst Case How finding a close lattice point relates to recovering a secret from noisy linear equations, and why the reduction direction makes lattice schemes resistant to the structural attacks that break structured problems.
- 03 Why Decoding a Random Linear Code Is Hard Enough to Sign With How the syndrome decoding problem underpins code-based cryptography, what the Prange and Stern algorithms reveal about its cost, and how the Niederreiter form turns it into signatures.
- 04 Inside ML-KEM: Noise Growth from Keygen to Decapsulation A concrete walk through KeyGen, Encaps and Decaps in FIPS 203, tracking the error term as powers of two so the compression parameters and failure bounds make sense.
- 05 The Fiat-Shamir with Aborts Loop in ML-DSA How rejection sampling hides the signing nonce, why a signature leaks nothing but a transcript, and what the rejection rate costs in signing throughput.
- 06 All-or-Nothing Transforms and the Extra Tightness in ML-KEM Why the Fujisaki-Okamoto transform alone leaves a small gap in decapsulation security, and how an all-or-nothing transform closes it for lattice schemes.
- 07 Hybrid Key Exchange with X25519 and ML-KEM-768 What happens to a TLS or SSH handshake when a lattice KEM is concatenated with an elliptic curve exchange, and which composition rules the transcript must obey.
- 08 Constant-Time Arithmetic for Lattice Schemes Which operations in ML-KEM and ML-DSA leak through timing or cache behaviour, and how the standard techniques for secret-dependent branches and indexing apply to polynomial arithmetic.
- 09 Basis Reduction in Practice: LLL, BKZ and the Delta Parameter How the block size K in BKZ sets the security estimate for lattice schemes, why LLL is only the preprocessing step, and what a solver actually does with the reduced basis.
- 10 What the Ring Structure Costs: MOD-LWE Versus Plain LWE Why replacing a random matrix with polynomial multiplication shrinks keys and speeds arithmetic, and which cryptographic and cryptanalytic problems that structure introduces in exchange.