Asymmetric cryptographic constructions used today could be attacked given a powerful enough quantum computer. Even if such a computer does not exist yet, it is important to anticipate its possible construction and to prepare a transition to cryptographic tools having a security resistant against attacks from quantum computers. I will introduce lattice-based cryptography, which is the most promising candidate to build post-quantum cryptographic constructions, and in particular, how we build efficient constructions based on structured lattice problems.[-]

Asymmetric cryptographic constructions used today could be attacked given a powerful enough quantum computer. Even if such a computer does not exist yet, it is important to anticipate its possible construction and to prepare a transition to cryptographic tools having a security resistant against attacks from quantum computers. I will introduce lattice-based cryptography, which is the most promising candidate to build post-quantum cryptographic constructions, and in particular, how we build efficient constructions based on structured lattice problems.[-]

This talk will focus on the last step of the number field sive algorithm used to compute discrete logarithms in finite fields. We consider here non-prime finite fields of very small extension degree: $1 \le n \le 6$. These cases are interesting in pairing-based cryptography: the pairing output is an element in such a finite field. The discrete logarithm in that finite field must be hard enough to prevent from attacks in a given time (e.g. $10$ years). Within the CATREL project we aim to compute DL records in finite fields of moderate size (e.g. in $GF(p^n$) of global size from $600$ to $800$ bits) to estimate more tightly the hardness of DL in fields of cryptographic size ($2048$ bits at the moment). The best algorithm known to compute discrete logarithms in large finite fields (with small $n$) is the number field sieve (NFS):

(1) polynomial selection: select two distinct polynomials $f,g$ defining two number fields, such that they share modulo $p$ an irreducible degree $n$ factor, and have additional properties to improve the next two steps.
(2) sieving: sieve over elements that satisfy relations, to build the factor basis made of prime ideals of small norm.
(3) linear algebra: compute the kernel of a large matrix computed the step before. Then the logarithm of each element in the factor basis is known.
(4) individual logarithm: for a given element $s \in GF(p^n)$, decompose it over the factor basis to finally compute its discrete logarithm.

The most time consuming steps are the second and third: sieving and linear algerbra. After the sieve and the linear algebra, the logarithms of the prime ideals of small norm are known. To finally compute the discrete logarithm of the given element $s$, we lift $s$ in one of the number fields and factor it in prime ideals as with “small” elements in the sieve step. However here, $s$ does not have a small norm (bounded by $B \ll Q$). Its norm is very large, in particular, larger than $Q$. The usual way is to test for many $s' = s \cdot g^e$ with $g$ the given generator of $GF(p^n)$ until the norm of $s'$ is smooth enough. The time spent to find a good $e$ is asymptotically less than the sieving time. In practice, another modification of $s'$ is computed to reduce its norm. In [?], the authors write $s' = a(x) / b(x)$ with $a, b$ of coefficients of size $\sim p^{1/2}$ instead of $p$. With $n = 4$ the norm of $s$ is $O(p^{11/2})$. Their method compute $a,b$ of norm $O(p^{7/2})$. One need to factor into small prime ideals two elements $a,b$ instead of one $s'$.
for our record computations of discrete logarithms in $\mathbb{F}_pn$ with $2 \leqslant n \leqslant 6$, we improve the preparation of $s$, so that its norm in the number field is less than $Q$. This improves its smoothness property. Assume that we want to compute the discrete logarithm of $s$ in the larger subgroup of prime order $\ell$ of $GF(p^n)$, with $\ell$ $|$ $\Phi_np$. We decompose $s$ in $\epsilon \cdot s'$ with $\epsilon$ in a subfield or in a subgroup of order prime to $\ell$ and $s?$ with reduced coefficient size. We still have $log_g s = log_g s'$ mod $\ell$. We use a tower representation of $GF(p^n)$ with subfields for our purpose. We reduce the norm of $s \in \mathbb{F}_{p4}$ from $O(p^{11/2})$ to $O(p^{7/2}), s \in GF(p^3)$ from $O(p^6)$ to $O(p^2)$ and $s \in \mathbb{F}_{p2}$ from $O(p^4)$ to $O(p)$. This does not change the asymptotic complexity of this last step but this improves a lot its running time for small $n$.[-]

The cross-combined measure (which is a natural extension of crosscorrelation measure) is introduced and important constructions of large families of binary lattices with nearly optimal cross-combined measures are presented. These results are important in the study of large families of pseudorandom binary lattices but they are also strongly related to the one dimensional case: An easy method is showed obtaining strong constructions of families of binary sequences with nearly optimal cross-correlation measures based on the previous constructions of lattices. The important feature of this result is that so far there exists only one type of constructions of very large families of binary sequences with small cross-correlation measure, and this only type of constructions was based on one-variable irreducible polynomials. Since it is very complicated to construct one-variable irreducible polynomials over $\mathbb{F}_p$, it became necessary to show other types of constructions where the generation of sequences are much faster. Using binary lattices based on two-variable irreducible polynomials this problem can be avoided, however a slightly weaker upper bound is obtained for the cross-correlation measure than in the original construction. (But, contrary to one-variable polynomials, using Schöneman-Eisenstein criteria it is very easy to construct two-variable irreducible polynomials over $\mathbb{F}_p$.)[-]

APN and AB functions are S-boxes with optimal resistance to the linear and differential cryptanalysis. In this talk we survey known constructions and classifications of these functions and discuss big open problems for the monomial case. Among these problems are the Dobbertin's conjecture on nonexistence of new APN monomials (open since 2000), the Walsh spectrum of Dobbertin's APN monomials (open since 2000), the existence of APN permutations of the form $x^d+L(x)$ where $x^d$ is some of the known APN monomials and $L$ is a nonzero linear map.

Remark :
On page 18 the speaker refers the classification result by Brinkmann [3] for functions from the field $F_{2^4}$ of order 16 to itself.[-]

It is an understatement to say that isogeny-based cryptography has been on a journey of ups and downs. Through the course of this journey, various techniques have been used to analyse isogeny-based cryptosystems. One of which, is using genus two methods to examine and build isogeny-based cryptosystems, and ultimately break one of the most promising key exchange schemes, SIDH. In this talk, we will look at cameos and appearances of genus two in isogeny-based cryptography. We will survey the landscape and see how genus two can be used constructively and sometimes destructively on isogeny-based cryptography.[-]