Kyber

In the above sections, we introduced two public key cryptography schemes - ECDSA and RSA. In this section we will talk about a similar cryptography scheme called Kyber with the additional quantum secure properties. The emergence of quantum computers brings out major threat in the cryptography setting as the underlying hard problems in the current cryptography schemes like Factorization problem and Discrete Logarithm problem can be solved using Shor'salgorithm on a sufficiently sized quantum bit computer. To counter this threat, researchers proposed to utilize even harder problems in mathematics to build novel cryptography schemes. One of these problems arises from Lattice Theory of mathematics.

Kyber is public key encryption scheme based on Lattice primitives where the hard problem is to find a short vector in a dense collection of lattice vectors spaced uniformly called the Shortest Vector Problem(SVP). This problem is conjectured to be quantum resistant meaning currently there are no quantum algorithms that would be able to solve the shortest vector problem efficiently.

As with classical cryptography schemes like RSA and ECDSA, Kyber utilizes public key and private key for encryption and decryption respectively. Although there has been no attacks on Kyber with respect to underlying hard problem but there are side channel attacks on the algorithm aimed to get the private key. These attacks focus on the algorithm that generate seeds as input to the private key generation algorithm. In particular, the system configuration is recorded and the extracted bytes are used as input in a permutation algorithm like shake256 to get the private key.

An adversary who controls the device will definately able to predict the shake256 algorithm's output and consequently can have the custody of the private key. With quantum random number generator , the dependency on the system parameters can be removed. The algorithm can directly call the QxEaaS API to fetch random bytes for shake256. Now even if the adversary controls the system parameters he won't be able to predict or hijack the bytes from quantum API.

Here we demonstrate using quantum randomness from the QRNG API for key generation in post-quantum cryptography.

We initialize a cryptographically secure pseudo-random number generator (AES256-CTR DRBG) using the entropy. This entropy seed ensures the PRNG output is uniformly random and unpredictable.

We then perform a Kyber512 lattice-based key exchange, setting the Kyber PRNG seed to output from our DRBG. This guarantees the private/public key pairs generated have maximum entropy.

After encrypting a message with the recipient's public key, we decrypt it back with the private key. The shared secrets match, showing correct encryption and decryption.

By front-loading the key generation process with quantum randomness, we protect the security of the lattice-based cryptosystem even against quantum computers that could potentially break traditional public key schemes. Quantum randomness is a core requirement for post-quantumsecurity, as classical randomness generation could be compromised by large-scale quantum computers.

This demonstration therefore shows how quantum entropy from QRNG can enhance the assurance of newer post-quantum cryptographic protocols that will become increasingly important for long-term security in the quantum era.

Check out the full source code on GitHub

View the source code for Kyber on our GitHub

DEEP DRIVE

Kyber Setup Guide

Setup

1git clone https://github.com/Quantum-eMotion/qxeaas-quickstarts.git

Installation

1pip install os requests dotenv

Import Libraries

1from kyber import Kyber512 2from aes256_ctr_drbg import AES256_CTR_DRBG 3import requests 4import os 5from dotenv import load_dotenv 6load_dotenv()

Retrieve Access Token and Entropy Size

1token = #your-access-token 2size = #entropy-size-required 3 4 5# Define the endpoint 6url = f'https://api-qxeaas.quantumemotion.com/entropy' 7entropy = '' 8 9# Define and submit the request 10headers = { 'Authorization': f'Bearer {token}' } 11querystring = { 'size': size } 12response = requests.get( url, headers=headers, params=querystring) 13s = str(response.json()['random_number']) 14 15entropy = s[:48] 16entropy = bytes(entropy, 'utf-8')

Initialize DRBG

1rng = AES256_CTR_DRBG(entropy)

Perform key exchange

1print("Starting Kyber512 key exchange:") 2message = input("Enter a message to sign/encrypt: ") 3 4Kyber512.set_drbg_seed(rng.random_bytes(48)) 5public_key, private_key = Kyber512.keygen() 6ciphertext, shared_secret = Kyber512.enc(public_key, message) 7decrypted = Kyber512.dec(ciphertext, private_key)

Verify decryption worked

1print("Public key:", public_key.hex()) 2print("Private key:", private_key.hex()) 3print("Ciphertext:", ciphertext.hex()) 4print("Shared secret:", shared_secret.hex()) 5print("Decrypted shared secret:", decrypted.hex()) 6 7# Verify decryption worked 8assert shared_secret == decrypted 9 10print(" 11Key exchange completed successfully!")