In this paper, we present a practical and provably secure two-pass authenticated key exchange protocol over ideal lattices, which is conceptually simple and has similarities to the Diffie-Hellman based protocols such as HMQV (CRYPTO 2005) and OAKE (CCS 2013). Our method does not involve other cryptographic primitives—in particular, it does not use signatures—which simplifies the protocol and enables us to base the security directly on the hardness of the ring learning with errors problem. The security is proven in the Bellare-Rogaway model with weak perfect forward secrecy in the random oracle model. We also give a one-pass variant of our two-pass protocol, which might be appealing in specific applications. Several concrete choices of parameters are provided, and a proof-of-concept implementation shows that our protocols are indeed practical.

No abstract uploaded!

No abstract uploaded!

No abstract uploaded!

This is the note for a series of lectures that the author gave at the Centre de Recerca Matem´atica (CRM), Bellaterra, Barcelona, Spain on October 19–24, 2009. The aim is to give a comprehensive description of some recent work of the author and his students on generalisations of the Gross-Zagier formula, Euler systems on Shimura curves, and rational points on elliptic curves.