Natural Barriers to Quantum Extraction: On the Post-Quantum (In)security of (O)EKE and Masny-Rindal OT
Researchers prove (O)EKE and Masny-Rindal OT are not UC-secure against quantum adversaries, even with post-quantum KEMs.
The paper proves that a general family of (O)EKE password-authenticated key-exchange compilers and Masny-Rindal oblivious transfer are not UC-secure against quantum polynomial-time adversaries, even when instantiated with a post-quantum KEM. The adversarial strategy prevents a simulator from extracting the password or the receiver's choice bit. The same compilers still achieve certain game-based security notions, and the authors prove an advantage-tight one-way-to-hiding lemma.
- (O)EKE and Masny-Rindal OT fail UC security against quantum adversaries.
- The break holds even when the underlying KEM is post-quantum.
- The strategy blocks extraction of passwords or OT choice bits.
- Certain game-based guarantees remain, with a tighter one-way-to-hiding lemma.
From the original article
1 min read at arxiv.orgEncrypted key exchange (EKE), introduced by Bellovin and Merritt (IEEE S\&P 1992), and Masny-Rindal OT, introduced by Masny and Rindal (ACM CCS 2019), are highly-efficient methods for compiling essentially any KEM into advanced cryptographic protocols, namely password-authenticated key exchange (PAKE) and oblivious transfer (OT), by relying only on idealized symmetric-key primitives.
By James Bartusek · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.