QianHeng乾珩 PQC Docs Hub量子文档 ✦ Ask AI✦ 问问文档 ⚐ Scan⚐ 扫一扫
/

Glossary

Key terms used across the QianHeng PQC documentation, grouped by theme: threat and timing, mathematical foundations, and constructions and engineering. Acronyms are kept in English.

Threat, security goals, and timing

TermDefinition
CRQCCryptographically Relevant Quantum Computer — a quantum computer large and reliable enough to break RSA/ECC-class cryptography using Shor's algorithm. None is known to exist publicly today.
HNDLHarvest Now, Decrypt Later — an attack where encrypted data is recorded today and decrypted once a CRQC becomes available. The reason long-lived secrets are already at risk.
Shor's algorithmA quantum algorithm that factors integers and solves discrete logarithms in polynomial time, breaking RSA, ECC, SM2, SM9, and Diffie-Hellman.
Grover's algorithmA quantum search algorithm giving a quadratic speedup, roughly halving the effective key strength of symmetric ciphers and hashes. Mitigated by using larger sizes.
Mosca's inequalityIf (data shelf-life) + (migration time) > (time until a CRQC), you must begin migrating now. A planning rule attributed to Michele Mosca.
IND-CCA2Indistinguishability under adaptive chosen-ciphertext attack — the standard strong security goal for KEMs and public-key encryption.
EUF-CMAExistential Unforgeability under Chosen-Message Attack — the standard security goal for digital signatures: an attacker cannot forge a signature on any new message.
NIST levelNIST security categories 1–5 expressing PQC strength relative to brute-forcing AES-128 (1), SHA-256 collisions (2), AES-192 (3), SHA-384 / SHA3-384 collision search (4), and AES-256 (5).

Mathematical foundations

TermDefinition
LWELearning With Errors — a lattice problem of solving noisy linear equations, believed hard for quantum computers. The basis of many lattice schemes.
Module-LWEA structured, efficient variant of LWE over module lattices, used by ML-KEM and relevant to the security analysis of ML-DSA.
Module-SISThe module-lattice version of the Short Integer Solution problem; one of the core hard problems in the security analysis of ML-DSA / Dilithium signatures.
NTRUA lattice construction over polynomial rings, one of the oldest practical lattice families; the basis of Falcon / FN-DSA.
SISShort Integer Solution — a lattice problem (finding a short vector satisfying a linear relation) underpinning many lattice signatures.
LatticeA regular grid of points in n-dimensional space; the hardness of finding short or close vectors in lattices underlies the dominant PQC family.
Code-basedCryptography whose security rests on the hardness of decoding general linear error-correcting codes (e.g., McEliece, BIKE, HQC).
IsogenyA map between elliptic curves; the basis of isogeny-based schemes such as the now-broken SIKE. Included for completeness.

Constructions, engineering, and migration

TermDefinition
KEMKey Encapsulation Mechanism — a public-key primitive for securely establishing a shared symmetric key (e.g., ML-KEM). Replaces classical key exchange.
FO transformFujisaki-Okamoto transform — a generic technique that upgrades a weakly secure encryption scheme into an IND-CCA2-secure KEM; used inside ML-KEM.
WOTS+Winternitz One-Time Signature (plus) — a hash-based one-time signature building block used inside XMSS, LMS, and SPHINCS+/SLH-DSA.
FORSForest Of Random Subsets — the few-time signature component inside SPHINCS+ / SLH-DSA that lets it sign many messages statelessly.
Merkle treeA hash tree that authenticates many one-time public keys under a single root, the core structure of hash-based signatures.
Stateful / statelessA stateful signature (LMS, XMSS) must track which one-time keys are used and must never reuse state. A stateless one (SLH-DSA) carries no such risk but produces larger signatures.
HybridCombining a classical and a post-quantum algorithm so the result is secure if either remains unbroken. Common in transitional TLS deployments.
Composite signatureA single signature object that bundles a classical and a PQC signature, verified together; a structured form of hybrid signing for certificates.
Crypto-agilityDesigning systems so cryptographic algorithms can be replaced without re-architecting, enabling smooth migration as standards evolve.
CBOMCryptographic Bill of Materials — a machine-readable inventory of where and how cryptography is used across an organization; the foundation of any migration.
商密 / SMShangMi — China's national commercial-cryptography suite (SM2/SM3/SM4/SM9, ZUC). See sm-algorithms.html.

Standards & references

Note
Two distinctions cause the most confusion: Shor (breaks public-key) versus Grover (only weakens symmetric); and stateful (LMS/XMSS, dangerous if state is reused) versus stateless (SLH-DSA) hash signatures. Keep both straight and most of PQC falls into place.

术语表

乾珩 PQC 文档中使用的关键术语，按主题分组：威胁与时机、数学基础、构造与工程。缩略词保留英文。

威胁 安全目标与时机

术语释义
CRQC密码学相关量子计算机——规模与可靠性足以借助 Shor 算法攻破 RSA/ECC 级密码的量子计算机。目前公开领域尚无已知实例。
HNDL先收集、后解密——攻击者今日记录加密数据，待 CRQC 出现后再解密。这是长生命周期机密已处于风险中的原因。
Shor 算法一种量子算法，能在多项式时间内分解整数并求解离散对数，从而攻破 RSA、ECC、SM2、SM9 与 Diffie-Hellman。
Grover 算法一种量子搜索算法，带来平方级加速，约使对称密码与杂凑的有效密钥强度减半。可通过增大长度缓解。
Mosca 不等式若（数据保密时长）加（迁移时长）大于（CRQC 到来时间），则必须立即开始迁移。该规划法则归于 Michele Mosca。
IND-CCA2自适应选择密文攻击下的不可区分性——KEM 与公钥加密的标准强安全目标。
EUF-CMA选择消息攻击下的存在性不可伪造——数字签名的标准安全目标：攻击者无法对任何新消息伪造签名。
NIST 等级NIST 安全类别 1 至 5，以暴力破解 AES-128（1）、SHA-256 碰撞（2）、AES-192（3）、SHA-384 / SHA3-384 碰撞搜索（4）、AES-256（5）为基准衡量后量子强度。

数学基础

术语释义
LWE带误差学习——一种求解含噪线性方程的格难题，被认为对量子计算机也难解，是众多格方案的基础。
Module-LWE定义在模格上的结构化高效 LWE 变体，被 ML-KEM 采用，并与 ML-DSA 的安全分析相关。
Module-SIS短整数解的模格版本，是 ML-DSA / Dilithium 签名安全分析中的核心难题之一。
NTRU定义在多项式环上的格构造，是最早的实用格家族之一，是 Falcon / FN-DSA 的基础。
SIS短整数解——一种格难题（寻找满足线性关系的短向量），支撑众多格签名。
格n 维空间中规则排列的点阵；在格中寻找短向量或近向量的难度，是主流后量子家族的根基。
编码类安全性建立在对一般线性纠错码解码之难度上的密码学（如 McEliece、BIKE、HQC）。
同源椭圆曲线之间的映射；同源类方案（如已被攻破的 SIKE）的基础。此处列出以求完整。

构造 工程与迁移

术语释义
KEM密钥封装机制——一种用于安全建立共享对称密钥的公钥原语（如 ML-KEM），替代经典密钥交换。
FO 变换Fujisaki-Okamoto 变换——一种将弱安全加密方案提升为 IND-CCA2 安全 KEM 的通用技术，用于 ML-KEM 内部。
WOTS+Winternitz 一次性签名（增强版）——一种杂凑型一次性签名构件，用于 XMSS、LMS 与 SPHINCS+/SLH-DSA 内部。
FORS随机子集森林——SPHINCS+ / SLH-DSA 内部的少次签名组件，使其能以无状态方式签署大量消息。
Merkle 树一种杂凑树，将众多一次性公钥认证于单一根之下，是杂凑签名的核心结构。
有状态 / 无状态有状态签名（LMS、XMSS）必须跟踪已用一次性密钥且绝不可复用状态。无状态签名（SLH-DSA）无此风险，但签名更大。
混合将经典算法与后量子算法组合，只要其一未被攻破结果即安全。常见于过渡期 TLS 部署。
组合签名将经典签名与后量子签名捆绑并一并验证的单一签名对象；是面向证书的结构化混合签名形式。
密码敏捷性在系统设计上支持密码算法替换而无需重构，使迁移能随标准演进而平稳进行。
CBOM密码物料清单——一份机器可读的清单，记录组织内何处及如何使用密码；任何迁移的基础。
商密 / SMShangMi——中国国家商用密码套件（SM2/SM3/SM4/SM9、ZUC）。参见 sm-algorithms.html。

标准与参考

说明
最易混淆的两组区分：Shor（攻破公钥）与 Grover（仅削弱对称）；以及有状态（LMS/XMSS，复用状态即危险）与无状态（SLH-DSA）杂凑签名。理清这两点，后量子密码的大部分内容便豁然开朗。
⚑ Report an error⚑ 纠错与校正