We are starting in a couple of seconds, so welcome, Norbert.
Thank you.
I hope you can hear me, right?
So yeah, my name is Norbert Poč.
I work at Red Hat, and today I will talk about hybrid public encryption, and later we will
source it with, like, some post-quantum.
Okay, so is here anybody who already knows about HPK?
Please raise your hand.
Oh, nice.
There's quite a few people.
Okay.
Okay, so who doesn't know?
HPK stands for hybrid public key encryption.
It's a symmetric and f-symmetric, like, it's combining both into a scheme.
It uses a key encapsulation mechanism.
It's used for key exchange.
It's, like, key exchanges, like, you have, like, Diffie-Hellman.
This is a bit different approach.
You can find the RFC in the 9180.
So, yeah, we have the fundamental parts of the HPK scheme.
You have, like, key encapsulation method, the key derivation, or key schedule, and the
AEAD, which provides the encryption of the messages itself.
Below, you can see listed the algorithms, which are supported.
For the key encapsulation method, we have prime, curves, and Edward curves.
For the key derivation, we use SHA versions, and AEAD supports AES and Chachapoly.
So, yeah, some familiar, like, words.
You will find later, for the CAM operations, we have K generations,
and encapsulation and the encapsulation.
For the KDF, we have extract and expand.
The extract generates a key from some input data, and the expand
expands this extracted K to some length, we wish.
For the AEAD, we have seal and open, which are encrypt and decrypt.
It's just an LES to it.
Okay, so let's talk about how does it work.
At the one side, you can see the CAM and the case schedule, encryption context, and AEAD.
Encryption context divides asymmetric on the left and symmetric on the right.
This is really important, because, like, we'll see later, that this diversion
enables us to change parts in it and leave the scheme still intact.
So, let's say we want to use, like, different algorithms for the KDF method,
and, like, we just change it and all, like, can proceed with the scheme itself.
So, we use K derivation to the KNGAP solution, create an encryption context,
which means which will consist of data we will need to do encryption
or some data or messages in the AEAD.
Yeah, and the last part, like, the symmetric part is the AEAD,
where we, like, grab some messages, encrypt it, and, like, send it over.
So, this is the communication part.
Now, I want some feedback from the last row.
Is it readable?
Okay, thank you.
So, this is a formal diagram. How does it work?
I will go it through.
So, we have Bob on the right and Alice on the left.
We will assume that Bob has some private key which already shared with Alice.
We don't care in the HPK how.
So, let's pretend that Alice knows the public key of Bob.
Then we will start with the encapsulation.
So, Alice generates a temporary key pair called fmrl.
Okay, it's visible.
So, here, it's the PKE and SKE.
And we will use Bob's private key and Alice's private, sorry, public key and private key to make,
like, Diffie-Hellman, which will give us a shared secret.
Then we use the shared secret in the KD version function to create a common key.
Then we send over our public fmrl key to Bob so he can do the same to get the shared secret.
Here, like, so we encapsulate it, send it over, and now we are at Bob.
Bob does the encapsulation.
He has his private key and Alice's public key.
Does the Diffie-Hellman get the same shared secret?
The shared secret is, again, used at the KDF, and we have a common key.
So, the common key is the same at Alice and Bob.
This is the end of the K encapsulation part.
Now we move to K schedule.
So, we get this common key, use the extract to generate some salt, let's say,
then expand it to get a key, and expand it one more time,
but with different information, as you can see here, to get an answer.
And then the third one is secret for exportation.
So, now we have set up the communication,
and we can do actually encrypted message conversations,
which is the seal and the open.
As you can see, we use the key, the nonce,
some additional information and the key, the private text, plain text.
Thank you.
So, here, you can see XOR.
The messages are counted.
So, every message has a counter and we explore it with the nonce.
Therefore, every message will be different,
even if the message is like the same.
So, if the plain text is the same, we will get a different cipher text.
That's the reason.
Okay, so, we have this nice scheme.
What can we use it for?
Possible messages are the MLS or messaging layer security.
It's quite new stuff.
I think, maybe one year old.
The MLS uses...
So, MLS solves a problem where we want to communicate.
We have communicating parties more than two.
So, let's say, I want to communicate with you,
but I want to communicate with you and you and you.
So, it's harder to exchange keys this way
because when we have, like, a two-way communication, it's easier, right?
So, this is the problem that MLS solves.
Then we have the TLS client hello and Oblivios DNS over HTTPS.
The last one is, I think, Nu1.2.
That solves the encryption of the IP address of the requester.
Okay, so, HPK comes with three modes.
The first one is the basic,
and then there are two more, providing authentication.
We have authentication mode with private key
or a pre-shared key in a PSK mode, or we can combine the both
and have the old PSK mode.
What about the security?
The base mode is programmed to be secure
against indistinguishability ciphertext,
and the authenticated modes are outside there and inside the CCS secure.
Yeah, so, later on, you can find a report at the references.
So, let's move to the post-quantum stuff.
As I said before, the key encapsulation and the AEAD are separated.
So, to make it post-quantum, we can just put post-quantum algorithms
to the key encapsulation method, and we will get post-quantum HPK.
The proposal was for kyber and psych,
but as most of you know, psych is already out of the game.
Kyber is one of the NIST finalists for key exchange methods.
It uses chem the same way instead of DH-style key exchange.
It is a lattice-based game standing upon learning with errors
and running problem, and kyber is proven to be IND CCS secure too.
Yeah, so we have this nice diagram again.
There we can see hybrid version.
We have post-quantum only version of HPK and hybrid.
Hybrid uses post-quantum and the old algorithms too for the key encapsulation method.
Like if one breaks, you can still have some security.
So, you can see gray boxes here.
These boxes are the old algorithms,
which means if we eliminate them, the post-quantum version will be visible.
That means the same way, so first I will go through the post-quantum.
The same way Bob generates the key pair prior HPK,
and let's say that Alice already knows that key.
The difference here is that we don't do classical Diffie-Hellman,
but we encrypt some random data and we will get a shared secret here.
And the ciphertext of that shared secret.
Then we do the key derivation to get the common key,
send over the ciphertext of the shared secret to Bob,
who can decrypt it and do the same here.
And as you can see, everything else is the same as the basic HPK.
For the hybrid mode, the only difference is here.
So, for the KDF, the post-quantum and the basic shared secret is concatenated,
and everything else should be the same.
Okay, so what is the security of the post-quantum?
In the base mode, it's still INCCI2 secure
because the KM algorithm is proven to be INCCI2 secure.
For the hybrid mode, it needs more proof because the concatenation there,
and the authentication for both hybrid and PQ only would need more work.
So, let's see some benchmarks.
I got this benchmark from the paper, which you can see below.
They were done on Intel Core E7 with 4 cores, 8 megabytes of cache and 8 megabytes of RAM,
using AWC LST, cryptographic library.
And the environment, each algorithm was run 10,000 times,
and the first and fourth quartile was eliminated of the measures to make it more accurate.
The measures are in CPU clock cycles, and I think it was medium or something like that.
Okay, so here you can see Psyche, which is now eliminated,
but I think it's a nice reference that it was a lot slower.
So, this blue one is the basic Edward curve, like the basic HPK,
then the green one is a hybrid one, and yeah, here the yellow is kyber only.
And as you can see, it is faster than the Edward curve, which is interesting.
Then there is one more graph.
Here you can see the green lines, which tells us that the ky encapsulation method is constant time,
so it doesn't constant in a way that it doesn't affect the encryption itself,
because the tests were done for data encryption for 1 kilobyte of data, 10 kilobyte, 100 kilobyte, and 1 megabyte of data.
So, as you can see, the cost is more on the encryption of the data itself.
So, there is a red line.
You can see that's for reference. This is a version of LSA encrypting 240 bytes of data.
Yeah, so here you can see references if you want to read more about it,
and thank you for attention.
So, any questions?
We had some questions on metrics, so I will try to read it.
The question was, how do we make quantum resistant crypto work on constrained devices?
What?
How do we make quantum resistant crypto work on constrained devices?
Well, that's a good question. I don't know the answer before, so sorry for that.
Okay, so any other question in here?
Thank you. The last slide, I think page 15, you showed some benchmarks,
but these are on the whole encryption, right?
Like, not only the exchange of the keys and the setup of the symmetry key, but the whole exchange, right?
They are both. So, as you can see, the green line is like the key exchange itself,
and then you have like the seal and the open operation here.
So, it's, if you take, for example, one message and one key exchange,
that's what the benchmark says, like it's together.
Yeah, okay, all right. Which was expected, because anyway, the quantum,
the post quantum part is only in the beginning of the exchange.
And then when the symmetry key is established, you continue with using your EEAD.
Yes, that's correct.
All right, thanks.
So, the post quantum part is only at the K exchange, and later on it is the same.
Okay, any other question?
Yeah, I just wanted to say that the post quantum is more about like asymmetric keys.
It doesn't really affect the symmetric part, so it's okay.
Any other question around here?
If not, we can probably, thank you for the talk, thank you for the questions.
Thank you for coming.