WO2025259271A1 - Combination of cryptography schemes - Google Patents

Abstract

Examples relate to acquiring a message at a signing device, determining a combined authentication information by applying an asymmetric key pre-quantum cryptography scheme or an asymmetric key post-quantum cryptography scheme to the message to generate a first authentication output, the asymmetric key post-quantum cryptography scheme being quantum secure, and applying a symmetric key cryptography scheme to the message to generate a second authentication output, the symmetric key cryptography scheme being quantum secure; and sending the message and the combined authentication information to a verifying device.

Description

86309226 COMBINATION OF CRYPTOGRAPHY SCHEMES BACKGROUND [0001] The realization of quantum computers is a challenge to classical cryptographic schemes and requires improved technologies to provide robust authentication of communication messages against quantum attacks. BRIEF DESCRIPTION OF THE DRAWINGS [0002] Figure 1 is a diagram of an example (signing) apparatus and an example (verifying) apparatus according to the present disclosure. [0003] Figure 2 illustrates an example method for determining a quantum robust authentication of a message according to the present disclosure. [0004] Figure 3 illustrates another example method for determining a quantum robust authentication of a message according to the present disclosure. [0005] Figure 4 illustrates another example method for determining a quantum robust authentication of a message according to the present disclosure. [0006] Figure 5 illustrates another example method for determining a quantum robust authentication of a message according to the present disclosure. [0007] Figure 6 is a diagram of an example system according to the present disclosure. DETAILED DESCRIPTION [0008] Quantum computers may provide sufficient computational power for solving factorization problems in classical cryptographic algorithms, such as RSA, and for solving the elliptic curve discrete logarithm problem, such as in ECC (Elliptic Curve Cryptography), and therefore create problems for conventional cryptographic schemes, such as asymmetric key cryptographic schemes. Post-quantum (PQC) schemes aim to develop cryptographic algorithms that are resistant to attacks by quantum computers, for example by relying on new hard underlying problems (such as lattice-based, hash-based, code-based, and multivariate polynomials) that are not efficiently solvable even for a quantum computer. [0009] PQC schemes may, however, introduce interoperability issues and implementation vulnerabilities. PQC schemes suitable for general purpose use are also not yet fully standardized. The migration and integration of a PQC scheme may be a slow and difficult process, especially when there are hardware dependencies, such as backward compatibility with legacy systems and ensuring proper communication between different systems or components. [00010] A hybrid cryptographic scheme, as used herein, is a combination of two cryptographic schemes, in particular a combination of an asymmetric key PQC or an asymmetric key pre-quantum cryptographic (pre-QC) scheme with a symmetric key cryptography scheme, to provide assurance on the resistance against classical and quantum attacks. Here, the asymmetric key PQC is considered to be secure against quantum computer attacks while the asymmetric key pre-QC scheme may be insecure against quantum computer attacks. The symmetric key cryptography scheme is considered to be inherently secure against quantum computer attacks with sufficiently long symmetric (shared) keys. This hybrid cryptographic scheme is not known from the prior art and, as detailed below, provides distinct technical advantages, in particular because a symmetric key infrastructure may be readily available. [00011] Non-limiting examples of asymmetric key cryptography schemes, in particular digital signature schemes, as used herein, include for pre-QC: DSA, ECDSA, EdDSA, RSS-PSS; and include for PQC: LMS, XMSS, CRYSTALS-Dilithium (ML- DSA: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.ipd .pdf), Falcon, SPHINCS+ (SLH-DSA: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.205.ipd .pdf). Non-limiting examples of symmetric key cryptography schemes, as used herein, include HMAC, CMAC, Poly1305. [00012] Figure 1 is a diagram of an example (signing) apparatus 110 and an example (verifying) apparatus 120 according to the present disclosure. Each apparatus may include multiple components, as illustrated in Figure 1. The (signing) apparatus 110 may include a memory 112, a controller 114, and a communication device (communicator) 116. The (verifying) apparatus 120 may include a memory 122, a controller 124, and a communication device (communicator) 126. In a non-limiting example, the (signing) apparatus 110 may be a user product such as a computer, a laptop, a mobile device, a printer or the like, and the (verifying) apparatus 120 may be related to a cloud device or cloud infrastructure. The communication, as indicated in Figure 1 via a communication network 130, may be an IoT or other 3GPP- based communication (such as LTE, 5G, 6G) or WiFi-based communication (based on the IEEE 802.11ax standard) between the user device and a cloud service. [00013] A memory, as used herein, may be a computer readable storage medium which may be any electronic, magnetic, optical, or other physical storage device that stores executable instructions. Thus, computer readable storage medium may be, for example, Random Access Memory (RAM), an Electrically-Erasable Programmable Read Only Memory (EEPROM), a storage drive, an optical disc, and the like. The memory may be disposed within the (signing) apparatus 110 or the (verifying) apparatus 120, as shown in Figure 1. Additionally and/or alternatively, the memory (computer readable medium) may be a portable, external or remote storage medium, for example, that allows the (signing) apparatus 110 or the (verifying) apparatus 120 to download the instructions from a portable/external/remote storage medium. In this situation, the executable instructions may be part of an installation package. The memory may comprise various instructions executable by a processor or computer chip of a controller. [00014] A controller, as used herein, may be an electronic component within an apparatus responsible for controlling its operation, typically through the execution of instructions (which may be referred to as firmware or software) stored in the memory. The controller may comprise a processor, which is a central processing unit (CPU). The processor executes instructions stored in the memory, here to provide operations regarding a combination of cryptography schemes. [00015] A communication device, as used herein, may be a component (for example, as a combination of hardware and software parts) to facilitate transmission, reception and exchange of data, information or signals between the (signing) apparatus 110 and the (verifying) apparatus 120. The communication device may enable communication across various mediums such as wired or wireless networks, electromagnetic waves, or optical signals. For this purpose, the communication device may include antenna equipment (such as a transmitter, receiver), a modulator and demodulator to encode data, an interface to provide connections (such as Ethernet ports, USB ports, Wi-Fi, Bluetooth or cellular interfaces). [00016] The memory 112 of the (signing) apparatus 110 may store a private key of an asymmetric key Pre-QC scheme or an asymmetric key PQC scheme. The memory 112 of the (signing) apparatus 110 store a symmetric key of a symmetric key cryptography scheme. As explained, the pre-QC scheme provides security against attacks from classical (bit operation based) computers, and the PQC scheme is resilient to attacks from both a classical computer as well as a quantum (qubit operation based) computer, in particular because the PQC scheme provides security even in the presence of a quantum computer. Further, the symmetric key may be sufficiently large (e.g. has a bit length sufficient) to be secure against an attack by both a classical computer a quantum computer. [00017] The controller 114 of the (signing) apparatus 110 may derive a hybrid authentication element for authenticating a message using both the private key and the symmetric key. Here, the controller 114 may, for example via a memory controller (not shown), have access to the memory 112 to retrieve or otherwise obtain both the private key and the symmetric key from the memory 112. The hybrid authentication element, as used herein, is authentication information that is generated by applying the asymmetric key Pre-QC scheme or asymmetric key PQC scheme together with the symmetric key cryptography scheme with regard to the message, and provides an authentication of the message secure against attacks by both a classical and a quantum computer. [00018] The communication device 116 of the (signing) apparatus 110 may then send the message together with the derived hybrid authentication element to the (verifying) apparatus 120. As illustrated in Figure 1, sending the message (or a processed message) together with the derived hybrid authentication element may be done by a wireless communication via a communication network 130 (such as a cloud network, a Wi-Fi network, the internet or the like). [00019] The hybrid element may be considered as a digital signature on the message such that a quantum attacker cannot masquerade as the signing entity. The skilled person understands that being secure against a quantum computer attack also means to be secure against a classical computer attack. A structure of the information element comprising the message and the hybrid authentication element, for example a particular order, applying an additional encryption and/or security mechanism, may be implemented at the controller 114 or the communication device 116. [00020] The memory 122 of the (verifying) apparatus 120 may store a public key of the asymmetric key pre-QC scheme or the asymmetric key PQC scheme, the public key being associated to the private key stored at the (signing) apparatus 110. The memory 122 of the (verifying) apparatus 120 may also store the symmetric key of the symmetric key cryptography scheme. [00021] The communication device 126 of the (verifying) apparatus 120 may receive the message together with the derived hybrid authentication element. The controller 124 may use the stored public key and symmetric key to perform a verification on the hybrid authentication element. In other words, the controller 124, verifying the hybrid authentication element, may determine whether the received message is genuine and originates from a purported source, such as the (signing) apparatus 110 or another hardware component (such as a chipset in a device) related to the (signing) apparatus 110. [00022] The hybrid or combined authentication using an asymmetric key pre-QC or PQC scheme together with a symmetric key cryptography scheme increases resistance of a system against a quantum attack using a quantum computer without relying solely on new PQC signature schemes (and corresponding new for security and without having to use only symmetric schemes which introduce key managing complexities. Further, this combination of an asymmetric key pre-QC or PQC scheme together with a symmetric key cryptography scheme may provide non-repudiation (against classical attacks or quantum attacks). [00023] The hybrid or combined authentication also allows for a smooth transition to PQC schemes while maintaining compatibility with legacy authentication schemes. It may enable reliance on the assurance of symmetric key cryptography schemes against attacks by quantum computing devices whilst adopting new PQC schemes. The present hybrid or combined authentication using an asymmetric pre-QC or PQC scheme together with a symmetric key cryptography scheme can further be implemented more easily compared to a combination of asymmetric pre-QC and PQC schemes. [00024] Figure 2 illustrates an example method 200 for determining a quantum robust authentication of a message according to the present disclosure. The method may be implemented by the (signing) apparatus 110. [00025] At 202, method 200 includes acquiring a message at a signing device, for example the signing apparatus 110 described above. Here, acquiring the message may be achieved in different ways, for example by the (signing) apparatus generating the message, the (signing) apparatus receiving the message from a hardware component (such as a chipset in the apparatus or related to the apparatus), the message being accessed from the memory 112 or via the communication device 116. The message may also specify which digital signature type should be used, that is, specify a particular example of the combined or hybrid authentication information described below. [00026] At 204, method 200 includes determining a combined authentication information, the combined authentication being an authentication derived from applying both an asymmetric key pre-QC scheme or an asymmetric key PQC scheme and the symmetric key cryptography scheme in relation to the message. In particular, using keys stored in the memory 112, the controller 114 may apply the asymmetric key pre-QC scheme or the asymmetric key PQC scheme, being secure to attacks from (both a classical computer and) a quantum computer, to the message to generate a first authentication output. The asymmetric key pre-QC scheme and the asymmetric key PQC scheme may be a digital signature scheme. In addition, the controller 114, may apply a symmetric key cryptography scheme to the message to generate a second authentication output, the symmetric key cryptography scheme being quantum secure by having a sufficiently large symmetric key. The generated first authentication output and the generated second output may be used for the combined authentication information, such as the hybrid authentication element described above. [00027] At 206, method 200 further includes sending the message and the combined authentication information to a verifying device, such as the verifying apparatus 120. The controller of the verifying device may verify the combined authentication information and may thus determine whether the received message is genuine and originates from an expected source. [00028] The combined or hybrid authentication information, as explained, provides an authentication on a message in such a way that an attacker (either by quantum computing device or classical computation device) would have to break both the signature scheme and learn the symmetric keys in order to break authentication of the message. Not breaking the signature scheme, as used here, can be understood as the attacker not being able to forge a signature on a previously unseen message that would successfully verify as valid. Not breaking authentication of the message, as used here, can be understood as the attacker not being able to successfully masquerade as the sender; that is, the verifying device should be able to determine the message to have come from the sender (not from an attacker). [00029] According to an example of the present disclosure, the first authentication output of act 204 in Figure 2 may be a digital signature of the message, and the second authentication output of act 204 in Figure 2 may be a keyed one-way function tag of the message. The keyed one- way function tag, in short: tag or authentication tag, as used herein, may be a data (code) element resulting from inputting the message (or a processed message thereof) and the symmetric key into a cryptographic function, such as a message authentication code (MAC), a hash function, or may be derived using an authentication encryption with associated data (AEAD) algorithm. The first authentication output and the second authentication output may be generated independently, for example by using the stored private key to generate the digital signature and by using the symmetric (shared) key to generate the tag. For example, the (signing) apparatus may generate a digital signature Sig using a private key Sk of the asymmetric pre-QC or PQC scheme on the message m, i.e. Sig = SignSk(m), and may generate a tag by using a shared key K of the symmetric key cryptography scheme on the message, i.e. tag = MACK(m). The combined authentication information, sent according to act 206 in Figure 2, may then be a combination of the signature and the keyed one-way function tag in a predefined order, for example in an order (m, Sig, tag) or (m, tag, Sig). The combination may be any suitable way of communicating the signature and keyed function tag in conjunction with the message (so that the verifying device can associate the message with the combined authentication information). Examples of such a combination may be sending the signature and keyed one-way function tag as distinct data elements, for example linked together in a suitable way, a concatenation of the signature and keyed one-way function tag, an encapsulation of the signature and keyed one-way function tag, or the like. In other words, the combined authentication information may be a hybrid authentication element in which the digital signature and the authentication tag are arranged together in a prescribed order. [00030] The (verifying) apparatus may receive (m, Sig, tag) or (m, tag, Sig), for example via the communication device 126 in Figure 1, and the controller of the (verifying) apparatus may then verify the digital signature using the public key Pk, Verify_sigPk(m,Sig) = T|F, to determine whether the output is true (T) or false (F). Here, the communication device 126 or the controller 124 of the (verifying) apparatus may also verify whether all the expected digital signatures in the hybrid or combined authentication information are present prior to accepting the message as valid. In addition, the controller of the (verifying) apparatus may verify the tag using the shared key K, Verify_MACK (m,tag) = T|F. The controller may further determine the message to be an authentic message only if the verification of the signature and the tag are successful (true). [00031] According to the above example, the digital signature may be a digital signature of a structure containing information of the message and the keyed one- way function tag, or the keyed one-way function tag may be a keyed one-way function tag of a structure(m||Sig) containing information of the message and the digital signature. The derived based on a nested structure of the message and the tag (m||tag), derived based on a nested structure of the message and the digital signature (m||Sig), or using another logical function to encapsulate the message or signature with the tag. Here, this implies a specific order in which the first authentication output or the second authentication output is generated to compute respective structures. [00032] Figure 3 illustrates another example method 300 for determining a quantum robust authentication of a message according to the present disclosure to minimize communication load. The method may be implemented by the (signing) apparatus 100. At 302, method 300 includes first applying the symmetric key cryptography scheme using the stored symmetric (shared) key to generate, as the second authentication output, a tag of the message. Thereafter or subsequently to generating the tag, at 304, the method 300 includes applying the asymmetric key pre-QC scheme or the asymmetric key PQC scheme using the private key to generate, as the first authentication output, a signature of a structure containing information of the message and the tag. Again, the structure may be based on a nested structure (m||tag) or using another logical function to encapsulate the message or signature and the tag. Here, the combined authentication information (hybrid authentication element) is (only) the generated signature. Therefore, at 306, the method 300 includes sending the message and the generated signature. Although this example still applies the hybrid combination of asymmetric key pre-QC or PQC scheme and the symmetric key cryptography scheme, minimized communication can be achieved because the (verifying) apparatus can independently compute the tag, tag = MACK(m) using the received message and the stored shared key. The verification process at the (verifying) apparatus may then only have verify the signature, Verify_sigPk(m||tag, Sig) = T|F. [00033] Figure 4 illustrates another example method 400 for determining a quantum robust authentication of a message according to the present disclosure to minimize communication load. The method may be implemented by the (signing) apparatus 100. At 402, method 400 includes generating, as the first authentication output, a signature of the message by applying the asymmetric key pre-QC scheme or the asymmetric key PQC scheme, and generating, as the second authentication output, a tag of the message by applying the symmetric key cryptography scheme. Then, at 404, method 400 includes determining an extended tag or adjusted authentication from the generated tag, for example by using an extendable output function (XOF) or the like, tag’ = XOF(tag). The extended tag may have a bit length adjusted to the bit length of the signature, in particular it may have a bit length that is longer than the generated tag, for example so that the extended tag has the same bit length as the signature. At 406, method 400 includes masking the generated signature, Sig’ = Sig ⊕ tag’ using the extended tag. While the masking operation is represented here using an exclusive OR operation, ⊕, the skilled person understands that masking (e.g. of a message or a signature) may also be achieved using other processing, such as block-cipher encryption, such as AEAD. Also in this example, the (signing) apparatus may only send the masked signature Sig’. In other words, the combined authentication information (hybrid authentication element) may be (only) the masked signature which also minimizes the communication load. [00034] According to this example, the (verifying) apparatus can determine the tag from the received message and the stored shared K: tag = MACK(m), and equally extend the determined tag: tag’ XOF(tag). Based thereon, the (verifying) apparatus can unmask the received signature Sig = Sig’ ⊕ tag’, and then proceed to verify the signature, Verify_sigPk(m, Sig) = T|F to determine whether the message can be accepted as being an authentic message. [00035] According to a variation of this example, rather than generating a tag (e.g. a MAC tag, a hash tag, or an authentication tag derived using an authentication encryption with associated data (AEAD) algorithm), and using an extension function (such as XOF) for the tag to hide the signature, the symmetric (shared) key K may be used to provide confidentiality on the signature in other ways, for example by using the symmetric (shared) key K in a symmetric encryption scheme (such as AES) to encrypt the message, or by deriving a value from the symmetric (shared) key K and XOF-ing (extending) the thus derived value with the signature. [00036] Figure 5 illustrates another example method 500 for determining a quantum robust authentication of a message according to the present disclosure to minimize communication load. The method may be implemented by the (signing) apparatus 100. At 502, method 500 includes, using the stored symmetric (shared) key K, applying the symmetric key cryptographic scheme to generate a keyed one-way function tag of the message and extending the keyed one-way function tag so that the authentication tag has an extended bit length, for example by using the XOF function, tag’ = XOF(tag). As explained above, the authentication tag may thus have a similar or equal bit length as the message. Then, at 504, method 500 includes masking the message with the determined extended keyed one-way function tag, m’ = m ⊕ tag’. At 506, method 500 further includes, using the stored private key, applying the asymmetric key pre-QC scheme or the asymmetric key PQC scheme to generate a signature of the masked message, Sig = SignSk(m’). The communication device of the (signing) apparatus may then send the message and the thus generated signature. Also in this example, the combined authentication information is the signature and does not include the tag. As such, instead of using the symmetric (shared) key to hide the signature, the symmetric (shared) key may be used to mask the message itself (rather than the signature). In this example, an attacking entity (using a conventional or quantum computing device) cannot learn the input to the signing procedure which reduces the ability to break the signature scheme. [00037]In other words, the controller of the (signing) apparatus is to use the stored symmetric key to generate an authentication tag of the message, to mask the message using an adapted authentication tag derived from the authentication tag, for example by extending the bit length of the generated tag, and to use the stored private key to generate a signature of the masked message. The hybrid authentication element (combined authentication information) then includes (only) the signature of the masked message, reducing the communication load when sending the authentication information. [00038]According to this example, the controller of the (verifying) apparatus can determine the tag from the received message and the stored shared K. The controller may also extend the determined tag: tag’ = XOF(tag). Based thereon, the controller can mask the received message m’ = m ⊕ tag’, and then verify the masked signature, Verify_sigPk(m’, Sig) = T|F to determine whether the message can be accepted as being an authentic message. [00039]According to a variation of this example, rather than generating a tag (e.g. a MAC tag, a hash tag, or an authentication tag derived using an authentication encryption with data (AEAD) algorithm), and using an extension function (such as XOF) for the tag to hide the message, the symmetric (shared) key K may be used to provide confidentiality on the message in other ways, for example by using the symmetric (shared) key K in a symmetric encryption scheme (such as AES) to encrypt the message, or by deriving a value from the symmetric (shared) key K and XOF-ing (extending) the thus derived value with the message. Alternatively, the symmetric (shared) key K may also be input into the expansion function directly, for example, to derive an extended key K1 = XOF(K), and to mask the message using the extended key, m’ = m ⊕ K1. In addition, rather than deriving a digital signature for a masked message m’ and sending the message m to the (verifying) apparatus, the controller of the (signing) apparatus may generate a digital signature for the message and send the masked message m’. In either case, the attacking entity can be prevented from learning the input to the signing algorithm (pre-QC or PQC). [00040]According to another example of the present disclosure, the controller of the (signing) apparatus may use a plurality of distinct keys derived from the symmetric (shared) key when applying the symmetric key cryptography scheme in combination with either a pre-QC scheme or a PQC scheme. For example, the controller of the (signing) apparatus may derive a first distinct key K1 from the symmetric (shared) key K and use this first key K1 to mask the communication message, m’=m ⊕ K1. The first distinct key may be derived using a key derivation function (KDF) or another function using a nonce n1, such as an extension function K1 = XOF(K, n1). In other words, the controller may mask the message using a first distinct key derived from a symmetric key K using a first nonce n1. Then, the controller of the (signing) apparatus may apply the symmetric key cryptography scheme to generate an authentication tag of the message (or masked message) and the asymmetric key QC scheme or the asymmetric key PQC scheme to generate a signature of a structure containing information of the message (or masked message) and tag, as described above. The controller of the (signing) apparatus may further derive a second distinct key K2 (using a key derivation function (KDF) or another function derived from the symmetric key K using a second nonce n2, e.g. K2 = XOF(K, n2)) (or from a different symmetric key) and mask the signature using the second key, Sig’=Sig ⊕ K2. The communication device of the (signing) apparatus may send the masked message m' and the combined authentication information to the (verifying) apparatus, whereby the combined authentication information includes the masked signature Sig’ and the first nonce and the second nonce, preferably combined (e.g. concatenated, linked or the like) in a predefined order. [00041]The communication device of the (verifying) apparatus may receive the masked message m’ and the combined authentication information, as described, and interact with the controller of the (verifying) apparatus so that the controller can re-derive the second key K2 using the received second nonce to unmask the signature Sig=Sig’ ⊕ K2, and to re-derive the first key K1 using the received first nonce to unmask the message m=m’ ⊕ K1. With the thus unmasked message, the controller of the (verifying) apparatus may generate the tag, tag = MACK(m), and can subsequently verify the signature, Verify_sigPk(m||tag, Sig) = T|F. [00042] While in the above example the same symmetric (shared) key K is used a plurality of times, and may thus lead to extra exposure to additional attacks, this risk may be further mitigated by an additional level of key derivation, such as deriving a symmetric (shared) key K’ per message, using K’ to determine the tag deriving unique keys K’1 and K’2 to the message and the signature, respectively, or using multiple pre-shared keys, for example dependent on the memory and efficiency requirements of the application example. [00043] As explained above, the keyed one-way function tag authentication tag can be, for example, a MAC tag, a hash tag, or an authentication tag derived using an authentication encryption with associated data (AEAD) algorithm. In particular, an authenticated encryption with associated data (AEAD) algorithm, such as AES-GCM, AES-CCM or Chacha-Poly1305, may be used. In general, when a sender (e.g. signing apparatus) has a communication message m and associated data d, and the sender wishes to have both the message and the data to be authenticated and is also concerned with the confidentiality of the message. Then, the (signing) apparatus may use a symmetric (shared) key K to both encrypt the message and determine a tag on the message and the associated data, resulting in a cyphertext c and a tag: AEADK(m,d) = (c,d,tag). The (signing) apparatus may then send the cyphertext, the data and the tag to the (verifying) apparatus for verification and decryption, Verify_AEADK(c,d,tag) = (m,d)|F, i.e. if the tag is valid, the message is returned. In any of the above examples, an AEAD scheme may be used in such a way that the message may be input as d, i.e as the associated data, (whilst m is an empty bit string), or the message can be input as m (which additionally can achieve confidentiality of the message). In addition, when a digital signature is generated first (using pre-QC or PQC), then this digital signature may be input into the AEAD algorithm as the message m. [00044] Further, in any of the examples described in the present disclosure, rather than using the symmetric (shared) key K directly, a unique key K’ derived from the symmetric (shared) key K, for example by using a key derivation function, may be used for each message being sent. That is, when applying the symmetric key cryptography scheme, the controller may use a KDF on the stored symmetric (shared) key K to derive a unique key per communication message. In such a way, even if an attacking entity would learn a used key, the attacking entity will not be able to learn or derive other symmetric keys that are used for other communication messages. [00045]For example, the unique key K’ may be determined as a message-dependent unique key, K’=KDF(K,m), to then directly determine the tag by tag = MACK’(m). [00046]For example, the unique key K’ may also be determined as signature-dependent unique key, K’=KDF(K,sig), so that the (signing) apparatus may determine the signature from the message, Sig = SignSk(m), derive K’=KDF(K,sig), and then determine the tag using the unique key by tag = MACK’(m||Sig). [00047] For example, the unique key K’ may also be determined using a random value that is provided together with the communication message. For example, the (signing) apparatus may generate a nonce n, determine the unique key K’ using the nonce, K’=KDF(K,n), and then determine the tag using the thus derived unique key, tag = MAC^K’(m). The nonce may be sent to the (verifying) apparatus together with the message (m,n,Sig,tag) or may be treated as a part of the message, for example by being part of a nested, encapsulated or otherwise linked structure, SignSk(m||n). [00048] For example, the unique key K’ may also be determined on a shared unique value (nonce) that does not need to be communicated to the (verifying) apparatus. For example, the nonce can be the number of communication messages that are signed so far, up to a predetermined time point, or the using the signing key. The (verifying) apparatus may be able to determine this number using a common message numbering, or in case the (verifying) apparatus is the only verifier and receives the communication message in an order. [00049]Here, the nonce for deriving the unique key may be a time, e.g. an operation time of the (signing) apparatus, to a sufficient granularity that the (verifying) apparatus can determine this value, for example using a synchronized system. A suitable granularity may be days since UNIX epoch, for example if a message delivery rate is slow, or seconds since UNIX epoch, if a message delivery rate is fast, such as in protocols in which both parties (signing and verifying apparatus) are online synchronously. The (verifying) apparatus may have to try several time values in case of higher delivery rates. [00050]The skilled person understands that deriving unique keys in such a way can be understood as a form of key rotation and thus reduces the usage of each key which may further strengthen the hybrid cryptography schemes against hardware attacks. Further, mitigations against hardware attacks for the asymmetric key (in pre-QC or PQC) may also be achieved by rotation through a set of different keys for each communication message. [00051]Figure 6 is a diagram of an example system 600 according to the present disclosure. The system may include a processor 602 and a non-transitory computer- readable storage medium 604 to store a computer program. Although the description may refer to a single processor and a single computer readable storage medium, the description may also apply to a system with multiple processors and multiple computer readable storage mediums. In such example, the instructions may be distributed and stored across multiple computer readable storage mediums and the may be distributed and executed across multiple processors. [00052]Processor 602 may be a central processing unit (CPU), a semiconductor based microprocessor, and/or hardware devices suitable for retrieval and execution of instructions stored in computer-readable storage medium 602. The processor 602 may fetch, decode, and execute instructions 612 and 614 or a combination thereof. The processor may be part of a controller of a (signing) apparatus as described above. [00053]Referring to Figure 6, derive hybrid authentication information instruction 612, when executed by a processor of a controller, may derive hybrid authentication information by using a private key pre-QC scheme or private key PQC scheme being applied to a message. As described herein, the PQC scheme may provide resilience against an attack from a quantum computer. In combination therewith, derive hybrid authentication information instruction 612, when executed by a processor of a controller, may further derive the hybrid authentication information by using a symmetric key cryptography scheme being applied to the message, also the symmetric key cryptography scheme may be resilient to an attack from a quantum computer. Further, the hybrid authentication information instruction 614 may, when executed by the processor of a controller, provide an authentication of the message. [00054]Further, the hybrid authentication information instruction 612, may use any one of the above examples to generate the combined authentication information or hybrid authentication element. For example, the hybrid authentication information may include a digital signature of the message, based on the private key pre- QC scheme or private key PQC scheme, and an authentication tag of the message, based on the symmetric key cryptography scheme, which may be arranged in a predefined order. [00055]Alternatively, the hybrid authentication information instruction 612 may cause the processor to mask a generated digital signature, mask the message, or may generate a signature of a structure containing information of the message with a tag of the message to reduce the bit length of the hybrid authentication information, as described above, and to further improve security by not sending the tag. [00056]In the foregoing detailed description of the present disclosure, reference is made to the accompanying drawings that form a part hereof, and in which is shown by way of illustration how examples of the disclosure may be practiced. These examples are described in sufficient detail to enable those of ordinary skill in the art to practice the examples of this disclosure, and it is to be understood that other examples may be utilized and that process, electrical, and/or structural changes may be made without departing from the scope of the present disclosure. [00057]The figures herein follow a numbering convention in which the first digit corresponds to the drawing figure number and the remaining digits identify an element or component in the drawing. Elements shown in the various figures herein can be added, exchanged, and/or eliminated so as to provide a number of additional examples of the present disclosure. In addition, the proportion and the relative scale of the elements provided in the figures are intended to illustrate the examples of the present disclosure, and should not be taken in a limiting sense.

Claims

CLAIMS 1. A method, comprising: acquiring a message at a signing device; determining a combined authentication information by - applying an asymmetric key pre-quantum cryptography scheme or an asymmetric key post-quantum cryptography scheme to the message to generate a first authentication output, the asymmetric key post-quantum cryptography scheme being quantum secure, and - applying a symmetric key cryptography scheme to the message to generate a second authentication output, the symmetric key cryptography scheme being quantum secure; and sending the message and the combined authentication information to a verifying device. 2. The method of claim 1, wherein - the first authentication output is a digital signature of the message, - the second authentication output is a keyed one-way function tag of the message, and - the combined authentication information is a combination of the signature and the keyed one-way function tag in a predefined order. 3. The method of claim 2, wherein - the digital signature is a digital signature of a structure containing the message and the keyed one- way function tag, or - the keyed one-way tag is a keyed one-way function tag of a structure containing the message and the digital signature. 4. The method of claim 1, wherein the symmetric key cryptography scheme is applied first to generate a keyed one-way function tag of the message and thereafter the asymmetric key pre-quantum cryptography scheme or the asymmetric key post-quantum cryptography scheme is applied to generate a signature of a structure containing the message and the keyed one-way function tag, and the combined authentication information is the signature. 5. The method of claim 1, wherein the asymmetric key pre- quantum cryptography scheme or the asymmetric key post- quantum cryptography scheme is applied to generate a signature of the message and the symmetric key cryptography scheme is applied to generate a keyed one- way function tag of the message, further comprising: determining an extended keyed one-way function tag having an extended bit length; and masking the signature with the extended keyed one-way function tag, wherein the combined authentication information is the masked signature. 6. The method of claim 1, wherein the symmetric key cryptographic scheme is applied to generate a keyed one- way function tag of the message, further comprising: determining an extended keyed one-way function tag having an extended bit length; masking the message with the extended keyed one-way function tag, wherein the asymmetric key pre-quantum cryptography scheme or the asymmetric key post-quantum cryptography scheme is applied to generate a signature of the masked message, and wherein the combined authentication information is the signature. 7. The method of claim 1, further comprising: masking the message using a first key derived from a symmetric key using a first nonce; wherein the symmetric key cryptography scheme is applied to generate a keyed one-way function tag of the message and the asymmetric key pre-quantum cryptography scheme or the asymmetric key post-quantum cryptography scheme is applied to generate a signature of a structure containing the message and the keyed one-way function tag, masking the signature using a second key derived from the symmetric key or another symmetric key using a second nonce; and sending the masked message and the combined authentication information, the combined authentication information being the masked signature and the first nonce and the second nonce. 8. Apparatus for providing authentication, comprising: a memory to store a private key of an asymmetric key pre- quantum cryptography scheme or an asymmetric key post- quantum cryptography scheme and a symmetric key of a symmetric key cryptography scheme; and a controller to derive a hybrid authentication element for authenticating a message using both the private key and the symmetric key; and a communication device to send the message and the hybrid authentication element to a verifying apparatus. 9. The apparatus of claim 8, the controller further to - use the private to generate a digital signature of the message, - use the symmetric key to generate an authentication tag of the message, wherein the hybrid authentication element comprises the signature and the authentication tag in a prescribed order. 10. The apparatus of claim 8, the controller further to - first use the symmetric key to generate an authentication tag of the message, and - subsequently use the private key to generate a signature of a structure containing the message and the authentication tag, wherein the hybrid authentication element is the signature. 11. The apparatus of claim 8, the controller further to - use the private key to generate a signature of the message, - use the symmetric key to generate an authentication tag of the message, - mask the signature with an adjusted authentication tag derived from the authentication tag, wherein the hybrid authentication element is the masked signature. 12. The apparatus of claim 8, the controller further to - use the symmetric key to generate an authentication tag of the message, - mask the message using an adapted authentication tag derived from the authentication tag, - use the private to generate a signature of the masked message, wherein the hybrid authentication element is the signature. 13. A computer program comprising instructions which, when the computer program is executed by a processor, cause the processor to: - derive hybrid authentication information by using a private key pre-quantum or private key post-quantum cryptography scheme being applied to a message, the post-quantum cryptography scheme being resilient to an attack from a quantum computer, and by using a symmetric key cryptography scheme being applied to the message, the symmetric key cryptography scheme resilient to an attack from a quantum computer; and - use the hybrid authentication information for an authentication of the message. 14. The computer program of claim 13, wherein the hybrid authentication information includes a digital signature of the message and a keyed one-way function tag of the message arranged in a predefined order. 15. The computer program of claim 13, the processor further to mask a generated digital signature, mask the message, or to generate a signature of a structure containing the message and a keyed one-way function tag of the message to reduce a bit length of the hybrid authentication information.