With the threat of a large quantum computer that might appear in a foreseeable future, the classical cryptography and the currently used algorithms designed to secure the communication can no longer be considered safe. Therefore, new algorithms were proposed and analysed, so-called, post-quantum cryptography that should be secure against both classical and quantum computers. Thanks to the competition by National Institute of Standards and Technology, we currently have standards for a few algorithms that are ready to be used. Community more or less is happy with the theoretical justification, but now raises a very important question about the security of the implementation of said algorithms.
My research delves into exactly that question: assessing the security of post-quantum cryptography. One very important part of it is the field of side-channel attacks. They are based on the fact that any device during a computation has certain physical properties: it takes time to run a computation; the device inherently draws certain amount of power and emits electromagnetic radiation. Measuring this information a certain way can reveal information about the secret used to keep the communication safe: the adversary with this additional information can break an algorithm despite the algorithm being provably secure; it’s just the proofs do not account for this information. There are other problems with the discrepancy between theoretical models and real-world scenarios.
What made you want to pursue a PhD?
When I was doing my master’s thesis, where I wanted to greatly improve the post-quantum electronic voting scheme, I really enjoyed the process of creating something new, even if it was based on the previous results. I found it amusing that for a few papers that I read and thought I understood, when I actually start putting a new scheme together, I realised that I missed so much, that I could get much more from the papers. I decided to pursue a PhD to be in this creative and demanding field.
Do you believe some results from your research will be applied in practice eventually? And if so, how / how?
My thesis mostly focuses on the attacks. It is designed to better outline the capabilities of the adversary. With this knowledge in mind, the defensive measures should be built accordingly.
What are your plans for the future?
I’d like to focus now on the protection. There are many interesting problems in this area. Specifically, it is an open problem now how to build secure and efficient implementation of post-quantum cryptography in hardware.
Länk till avhandlingen (på engelska, Lunds universitets forskningsportal).