<story><title>NIST Post-Quantum Cryptography Round 1 Submissions</title><url>https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Round-1-Submissions</url></story><parent_chain></parent_chain><comment><author>Nokinside</author><text>If you can tolerate ~1MB private keys, Classic McEliece is probably the best conservative and secure post-quantum option just now before others are analyzed more. It&amp;#x27;s old and proven.&lt;p&gt;&amp;gt;9    Advantages and limitations (2.B.6)&lt;p&gt;&amp;gt;The central advantage of this submission is security.  See the design rationale.&lt;p&gt;&amp;gt;Regarding efficiency, the use of random-looking linear codes with no visible structure forces public-key sizes to be on the scale of a megabyte for quantitatively high security:  the public key is a full (generator&amp;#x2F;parity-check) matrix.  Key-generation software is also not very fast. Applications  must  continue  using  each  public  key  for  long  enough  to  handle  the  costs  of generating and distributing the key.&lt;p&gt;&amp;gt;There are, however, some compensating efficiency advantages.  Encapsulation and decapsu-
lation are reasonably fast in software, and impressively fast in hardware, due to the simple nature  of  the  objects  (binary  vectors)  and  operations  (such  as  binary  matrix-vector  multiplications).   Key  generation  is  also  quite  fast  in  hardware.   The  hardware  speeds  of  key generation and decoding are already demonstrated by our FPGA implementation.  Encapsulation takes only a single pass over a public key, allowing large public keys to be streamed through small coprocessors and small devices.&lt;p&gt;&amp;gt;Furthermore,  the  ciphertexts  are  unusually  small  for  post-quantum  cryptography:  under 256  bytes  for  our  suggested  high-security  parameter  sets.   This  allows  ciphertexts  to  fit comfortably  inside  single  network  packets.   The  small  ciphertext  size  can  be  much  more important for total traffic than the large key size, depending on the ratio between how often keys are sent and how often ciphertexts are sent.  System parameters can be adjusted for even smaller ciphertexts.</text></comment>
<story><title>NIST Post-Quantum Cryptography Round 1 Submissions</title><url>https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Round-1-Submissions</url></story><parent_chain></parent_chain><comment><author>bascule</author><text>One of them has already fallen victim to a key recovery attack:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;yx7__&amp;#x2F;status&amp;#x2F;945283780851400704&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;yx7__&amp;#x2F;status&amp;#x2F;945283780851400704&lt;/a&gt;&lt;p&gt;Round2 (LWE-based) and SIKE (isogeny-based) are the particularly interesting ones to me. Both support comparatively small keys (~1kB), with Round2 seemingly winning on performance, but also patented.</text></comment>