Cryptographie

: CSIDH, or `commutative supersingular isogeny Diffie-Hellman' is a new isogeny-based protocol of Castryck, Lange, Martindale, Panny, and Renes. The Diffie-Hellman style scheme resulting from the group action allows for public key validation at very little cost, runs reasonably fast in practice, and has public keys of only 64 bytes at a conjectured AES-128 security level, matching NIST’s post-quantum security category I. For comparison, the SIDH (and SIKE) isogeny-based cryptosystems are somewhat faster than CSIDH, but they do not support non-interactive key exchange, and their public keys and ciphertexts are 6 times larger than in CSIDH. We will describe the CSIDH protocol, give an overview of the security analysis, and outline some potential applications.

I will review the hash-based signature submitted to the NIST competition jointly with Guillaume Endignoux, discussing its assurance level and performance. Then I will discuss the challenges of deploying post-quantum cryptography in an end-to-end encryption product for machine-to-machine communications.  

Functional encryption (FE) is an advanced cryptographic primitive which allows, for a single encrypted message, to finely control how much information on the encrypted data each receiver can recover. To this end many functional secret keys are derived from a master secret key. Each functional secret key allows, for a ciphertext encrypted under the associated public key, to recover a specific function of the underlying plaintext. However constructions for general FE are far from practical, or rely on non-standard and ill-understood cryptographic assumptions. In this talk I will focus on the construction of efficient FE schemes for linear functions (i.e. the inner product functionality), and the framework in which our constructions hold. Such schemes yield many practical applications, and our constructions are the first FE schemes for inner products modulo a prime that are both efficient and recover the result whatever its size. Our framework consist of a cyclic group $G$ where the decision Diffie-Hellman assumption holds together with a subgroup $F$ of $G$ where the discrete logarithm problem is easy. This setting can be instantiated with class groups of imaginary quadratic fields, and allows us to encode information in the exponent of the subgroup $F$, which can be efficiently recovered whatever its size.