# Post Quantum Cryptographic Keys Generated with Physical Unclonable Functions
## 2 Lattice and Code-Based Post Quantum Cryptography
### Learning with Rounding Cryptography  
The learning with rounding problem was first introduced by [PERSON] [21]. It is the derandomized version of learning with error, which deterministically generates the noise in the LWE by rounding coefficients. This will eliminate the noise sampling, and significantly reduce the bandwidth [22]. The LWR is proved to be as hard as LWE to solve; hence, it remains secure to be used in cryptographic applications. In schemes such as \"Saber\", a constant h is added as a constant vector to simulate the rounding operation by bit shifting, therefore playing a similar protecting role than the error vectors of LWE [18]. Saber, which is one of the NIST's finalists in the key encapsulation category, uses LWR for key generation in public key encryption and key encapsulation. Below all three steps of PKE and KEM are described:  
Saber PKE Key Generation  
1. Similar to LWE, seed \(a_{(i)}\) is used to generate matrix \(A_{(i)}\).
2. Seed \(b_{(i)}\) is used to generate vector \(s_{(i)}\).
3. The vector \(t_{(i)}\) is computed: \(t_{(i)}\gets A_{(i)}\). \(s_{(i)}+h_{(i)}\).
4. Both seed \(a_{(i)}\) and \(t_{(i)}\) become the public key \(PK_{(i)}\).
5. \(s_{(i)}\) becomes the private key \(Sk_{(i)}\). Saber PKE Encryption  
1. The seed \(a_{(i)}\) and \(t_{(i)}\) is extracted from public key to encrypt the message \(m\).
2. Matrix \(A_{(i)}\) and vector \(s^{\prime}_{(i)}\) are generated.
3. The vector \(t^{\prime}_{(i)}\) is computed by rounding the product of \(A_{(i)}\). \(s^{\prime}_{(i)}\): \(t^{\prime}_{(i)}\gets A^{\prime}_{(i)}\). \(s^{\prime}_{(i)}+h_{(i)}\).
4. Polynomial \(v^{\prime}_{(i)}\) is calculated as: \(v^{\prime}_{(i)}=t_{(i)}\). \(s^{\prime}_{(i)}\).
5. \(v^{\prime}_{(i)}\) is used to encrypt the message \(m\) which denoted as \(c_{m}\).
6. Ciphertext consists of \(c_{m}\) and \(t^{\prime}_{(i)}\). Saber PKE Decryption  
1. \(v_{(i)}\) is calculated as: \(v_{(i)}=t^{\prime}_{(i)}\). \(s_{(i)}\).  
The message \(m^{\prime}\) is decrypted by reversing computations with \(v_{(i)}\) and \(c_{m}\).  
The Saber key encapsulation mechanism has three steps: Saber KEM Key Generation, Saber KEM Encapsulation, and Saber KEM Decapsulation:  
Saber KEM Key Generation  
1. Saber PKE key generation is used to return seed \(a_{(i)}\), \(t_{(i)}\) and \(s_{(i)}\).
2. Both seed \(a_{(i)}\) and \(t_{(i)}\) become the Saber KEM public key \(Pk_{(i)}\).
3. The hashed public key \(PkH_{(i)}\) is generated using SHA3-256.
4. Parameter \(z\) is randomly sampled.
5. \(z\), \(PkH_{(i)}\) and \(s_{(i)}\) become the Saber KEM secret key.  
Saber KEM Encapsulation
1. Message \(m\) and public key \(Pk_{(i)}\) are hashed using SHA3-256.
2. Saber PKE encryption is used to generate ciphertext.
3. Hash of the \(Pk_{(i)}\) and ciphertext are concatenated, then hashed to encapsulate the key. Saber KEM Decapsulation
1. Message \(m^{\prime}\) is decrypted by using Saber PKE Decryption.
2. The decrypted message \(m^{\prime}\) and hashed public key \(PkH_{(i)}\) are hashed to generate K'.
3. Ciphertext \(c^{\prime}_{m}\) is generated from Saber PKE Encryption for message \(m^{\prime}\).
4. If \(c_{m}=c^{\prime}_{m}\) then the K = Hash(K',\(c\)), if not, K = Hash(z,\(c\)).  
The level of documentation available on LWR is not quite as complete as what is available for LWE. However, the proposed implementation of LWR for NIST's PQC program is solid. The use of PUFs to secure PKIs based on LWR is not more challenging than the one based on LWE.