Research

The analysis and design of post-quantum-secure cryptographic systems is becoming increasingly important and urgent, as sufficiently powerful quantum computers could be available within the next 10 to 20 years. In particular, we focus on systems of symmetric cryptography, which are still receiving relatively little attention in current research. Nevertheless, it has been demonstrated in recent years that the availability of sufficiently powerful quantum computers also compromises the security of many classical symmetric algorithms. It is not only ‘Grover’s algorithm’ that can be used for this purpose. In certain attack models, algorithms such as ‘Simon’s algorithm’ may be even more effective.

Selected publications on this topic:

Nathalie Lang, Jannis Leuther, Stefan Lucks. “Generic Composition: From Classical to Quantum Security.” PQCrypto (2026) [Link].

Nathalie Lang, Stefan Lucks. “On the Post-Quantum Security of Classical Authenticated Encryption Schemes.” AFRICACRYPT (2023) [Link].

Jannis Leuther, Stefan Lucks. “QCB is Blindly Unforgeable.” International Conference on Codes, Cryptology, and Information Security (2023) [Link].

Digital signature schemes based on cryptographic hash functions are not a new concept in classical cryptography, but are rarely used in practice, as other methods often offer better performance and require less memory (e.g. RSA or Diffie–Hellman). However, with advances in the construction of scalable quantum computers, there is a growing consensus that, in the near future, sufficiently large quantum computers will exist that can efficiently break the security of these common schemes. Hash-based signature schemes are resistant to these attacks and are therefore promising candidates for the future of digital communication security.

Selected publications on this topic:

John Kelsey, Nathalie Lang, Stefan Lucks. “Turning Hash-Based Signatures into Distributed Signatures and Threshold Signatures.” IACR Communications in Cryptology, vol. 2 (2025) [Link].

The chair focuses on both the analysis and design of block ciphers. ‘Pholkos’ is a so-called tweakable block cipher that can handle message blocks of up to 512 bits and is based on structures similar to those of AES. Tweakable block ciphers could represent an important building block for post-quantum secure symmetric systems in the future.

Selected publications on this topic:

Bossert, J., List, E., Lucks, S., & Schmitz, S. (2022, January). Pholkos – efficient large-state tweakable block ciphers from the AES round function. In Cryptographers’ Track at the RSA Conference (pp. 511–536). Cham: Springer International Publishing. [Link].

Banik, S., Bossert, J., Jana, A., List, E., Lucks, S., Meier, W., ... & Sasaki, Y. (2019). Cryptanalysis of forkaes. In Applied Cryptography and Network Security: 17th International Conference, ACNS 2019, Bogotá, Colombia, 5–7 June 2019, Proceedings 17 (pp. 43–63). Springer International Publishing [Link].

Forler, C., List, E., Lucks, S., & Wenzel, J. (2018). Poex: a beyond-birthday-bound-secure on-line cipher. Cryptography and Communications, 10, 177–193 [Link].

The famous “Heartbleed” exploit, which came to public attention in 2014, was attributable to a bug in the OpenSSL library. This, and any potential future implementation errors, can be prevented by adhering to a clear formal language definition for the underlying format. On closer examination, it was found that the so-called ‘length-prefix’ formats constitute a formal language class that is neither context-free nor context-sensitive.

Two new, related complexity-theoretic language classes, named ‘Calc-Regular’ and ‘Calc-Context-Free’, have been proposed in order to precisely define the set of length-prefix languages.

Selected publications on this topic:

Norina Marie Grosch, Joshua König, Stefan Lucks. “Taming the length field in binary data: calc-regular languages.” 2017 IEEE Security and Privacy Workshops (SPW). IEEE, 2017 [Link].

 Andreas Jakoby, Jannis Leuther, Stefan Lucks. “Formal Language Theory for Practical Security – Extended Abstract.” 2021 IEEE Security and Privacy Workshops (SPW). IEEE, 2021 [Link]