The United Kingdom (UK) government is considering advanced primitives such as identity-based encryption (IBE) for adoption as they transition their public-safety communications network from TETRA to an LTE-based service. However, the current LTE standard relies on elliptic-curve-based IBE, which will be vulnerable to quantum computing attacks, expected within the next 20–30 years. Lattices can provide quantum-safe alternatives for IBE. These schemes have shown promising results in terms of practicality. To date, several IBE schemes over lattices have been proposed, but there has been little in the way of practical evaluation. This paper provides the first complete optimised practical implementation and benchmarking of Latte, a promising Hierarchical IBE (HIBE) scheme proposed by the UK National Cyber Security Centre (NCSC) in 2017 and endorsed by European Telecommunications Standards Institute (ETSI). We propose optimisations for the KeyGen, Delegate, Extract and Gaussian sampling components of Latte, to increase attack costs, reduce decryption key lengths by 2x–3x, ciphertext sizes by up to 33%, and improve speed. In addition, we conduct a precision analysis, bounding the Rényi divergence of the distribution of the real Gaussian sampling procedures from the ideal distribution in corroboration of our claimed security levels. Our resulting implementation of the Delegate function takes 0.4 seconds at 80-bit security level on a desktop machine at 4.2GHz, significantly faster than the order of minutes estimated in the ETSI technical report. Furthermore, our optimised Latte Encrypt/Decrypt implementation reaches speeds up to 9.7x faster than the ETSI implementation.

Abstract Global efforts such as the National Institute of Standards and Technology (NIST)’s post-quantum standardization center on cryptographic primitives like public-key encryption and signature schemes that are secure even in the presence of quantum adversaries. In addition, one must also consider efficient certificate management as new technologies like the Internet of Things and 5G wireless networks rely on them. For example, the IEEE Standard for vehicle-to-vehicle communication depends on implicit certificates. However, the only efficient construction available is over elliptic curves, and hence not quantum-secure. This paper investigates approaches to construct implicit certificate schemes from lattices, employing the NIST Round 3 signature schemes Dilithium and Falcon. We consider emulation of the existing implicit certificate scheme and proceed to more innovative techniques like combining the two schemes or pairing them with encryption. Unfortunately, we encounter problems with each design, due to recurring causes like conflicting secret key and signature sizes, unique sampler requirements and the rigidity of the parameter sets. By explaining each of these issues, this paper will hopefully spark ideas for more successful constructions.