An honest, detailed evaluation of the hybrid ECDH + LWE scheme's security properties, assumptions, limitations, and comparison with alternatives.
Against classical computers running the best known attacks (Pohlig-Hellman, Pollard's rho for ECDLP; lattice reduction for LWE).
Against quantum computers running the best known quantum algorithms (Grover + BKZ). ECDH is broken by Shor's; LWE resists all known quantum attacks.
At least as secure as the stronger of the two. Against any attacker (classical or quantum), they must break both ECDH and LWE simultaneously.
Assumption: Given curve $E$ over $\mathbb{F}_p$, generator $G$, and point $Q = kG$, computing $k$ is hard.
Shor's algorithm (1994) can solve ECDLP in polynomial time on a quantum computer. A 4096-qubit fault-tolerant quantum computer could break P-256 in hours. Timeline estimates: 2030-2040 for cryptographically relevant quantum computers.
Assumption: Given $(\mathbf{A}, \mathbf{b} = \mathbf{As} + \mathbf{e})$, finding $\mathbf{s}$ is computationally hard.
Hardness reduction: Regev showed LWE is at least as hard as worst-case SIVP (Shortest Independent Vector Problem) ā a notoriously hard lattice problem. If you could solve LWE, you'd solve SIVP for all lattices.
No polynomial-time quantum algorithm for LWE is known. Grover's search gives only a quadratic speedup (halves the bit-security), which is compensated by choosing slightly larger parameters.
Assuming LWE and ECDH key exchange succeed in establishing a shared key, AES-256-GCM provides:
| Property | ECDH (P-256) | Plain LWE | Kyber-512 | Hybrid (Ours) |
|---|---|---|---|---|
| Classical security | 128 bits | 128+ bits | ~100 bits | 128+ bits |
| Quantum security | Broken (Shor) | 128+ bits | ~100 bits | 128+ bits |
| Deployment history | 20+ years | Theoretical | NIST 2024 | Both combined |
| Key generation speed | Very fast | Moderate | Fast (NTT) | Both combined |
| Public key size | 64 bytes | Large (nĀ²) | 800 bytes | Both combined |
| Quantum attack exists? | Yes (Shor) | No known | No known | Must break both |
| NIST standardized | Yes (P-256) | No | Yes (ML-KEM) | Both components |
| Used in this demo | ā Real (P-256) | ā Simplified (n=4) | Structure only | ā Full hybrid |
A large-scale fault-tolerant quantum computer runs Shor's algorithm and recovers Alice's ECDH private key from her public key.
The attacker now knows $K_{ECDH}$. But to decrypt the file, they need:
Data remains safe. LWE is still secure. The hybrid key is computationally indistinguishable from random without both components.
A breakthrough algorithm (classical or quantum) efficiently solves LWE, recovering the LWE secret from the public key.
The attacker now knows $K_{LWE}$. But to decrypt the file, they need:
Data remains safe. ECDH is still secure classically. The SHA-256 hash prevents recovery from partial input.
n=4, q=97 provides zero real security. A 4Ć4 linear system with noisy data can be solved by brute force in milliseconds. This is for demonstration only. Real Kyber uses n=256, q=3329.
The hybrid key exists only in the browser's memory during this session. In a real system, you'd need a secure out-of-band channel to transmit the key, or a Public Key Infrastructure (PKI) to handle key agreements.
The "file transfer" in this demo is: encrypt ā download ā re-upload ā decrypt. A real system would need secure networking (TLS with PQ extensions), certificate validation, and authentication.
All crypto runs in the browser's JS runtime. A real system would use hardware security modules (HSMs) or secure enclaves for key storage. Browser-based crypto is fine for demos but has side-channel risks.