Overview
With the rapid development of quantum computers, traditional cryptography faces severe challenges: public-key cryptographic schemes based on prime factorization (RSA), discrete logarithms (DH), and elliptic curves (ECC) can all be broken by quantum computers using Shor's algorithm. To counter the quantum threat, Post-Quantum Cryptography (PQC) is designed to resist attacks from quantum computers. KMS supports the following two PQC cryptographic algorithms:
Data confidentiality is protected using the Kyber-based PQC encryption and decryption algorithm.
Data integrity is ensured using the Dilithium-based PQC signature and verification algorithm.
Data Encryption Algorithms
The Kyber algorithm provides a basic IND-CPA secure public-key encryption (PKE) scheme based on the Module Learning-With-Error (MLWE) problem. Applying the Fujisaki-Okamoto (FO) transform yields an IND-CCA2 secure key encapsulation mechanism (KEM). KMS implements a data encapsulation mechanism (KEM-DEM) by integrating Kyber-KEM with AES-256, delivering an efficient, IND-CCA2 secure encryption scheme for users.
Operation Steps
2. Refer to the document Create a Key. Select Asymmetric Encryption and Decryption for the key purpose, and select Kyber_AES for the encryption algorithm. Data Signature Algorithms
The security of the Dilithium algorithm is based on the NP-hard problem of finding the shortest vector in a lattice. Its design balances the size of both public keys and signatures, while NIST Level 3 certification ensures a high level of security strength. Dilithium supports both DET and Random signature modes, offering flexible use cases. You can call the related signature and verification algorithms via the KMS SDK.
Operation Steps
2. Refer to the document Create a Key. Select Asymmetric Signature and Verification for the key purpose, and select Dilithium for the encryption algorithm.