Post-Quantum cryptography with Javacryptool

224 POST-QUANTUM CRYPTOGRAPHY WITH JAVACRYPTOOL NIKOLAY YANKOV Abstract: We introduce the reader to the Cryptool suite application JavaCrypTool 1.0. The visual learning capability of this platform is explored with regard to post-quantum cryptographic algorithms, specifically the Leighton-Micali Signature scheme, and Xtended Merkle Signature Scheme that are recommended by NSA for softwareand firmware-signing. Keywords: CrypTool; JavaCrypTool; cryptography; education. I. Introduction Java Cryptool JCrypTool (JCT) is an open-source elearning platform developed to let one experiment with cryptography but also allowing the creation of one’s own Java crypto plug-ins, thereby extending them in various ways. JCT is also an extensive open-source development project, separated into two parts: JCT Core and JCT Crypto. The JCT Core Project takes care of the JCrypTool platform itself and is supported by a community that develops new crypto plug-ins (algorithms, analysis, games, and visualizations) and integrates them into the JCT. As of the end of 2025, there are more than 100 such plugins [9]. JCT Crypto is a repository containing all crypto plug-ins for JCrypTool. While JCT is deployed with the advanced cryptographic libraries BouncyCastle and FlexiProvider other libraries can also be added to the project. FlexiProvider is the initial default provider and is an open-source cryptographic library for the Java programming language. FlexiProvider is the security provider for the Java Cryptography Architecture (JCA) and the Java Cryptography Extension (JCE) framework that form the complete framework for performing cryptography in Java. 225 Figure 1: JCT initial screen II. Post-quantum cryptography signing schemes The quantum computer is a new type of computer that harnesses the principles of quantum mechanics to perform calculations. Unlike classical computers, which store information in binary form {0, 1}, quantum computers use qubits. In 1996, Peter Shor developed an algorithm for quantum computers that can quickly factor large numbers [11]. The security of several of the widely used crypto schemes of today, such as the RivestShamir-Adleman (RSA) [10] and elliptic curve cryptography (ECC), is threatened by this algorithm, its subsequent versions that can solve the discrete logarithm problem, and the developments in physically building working quantum computers. This is due to the fact that both de facto standards RSA and ECC, are dependent on the two one-way math problems: factoring large integers and the discrete logarithm problem. So current schemes cannot guarantee long-term confidentiality. Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to be secure against attacks by both classical and quantum computers. PQC schemes employ a variety of "hard" mathematical problems, such as lattice problems, multivariate polynomials, and code-based problems, which are believed to be beyond the capabilities of even the most powerful quantum computers. The goal of PQC is to replace vulnerable algorithms before large-scale quantum computers become a reality, securing 226 digital communications and data for the future. As per [8], NSA approves for softwareand firmware-signing the LeightonMicali Signature (LMS) scheme [5] with SHA-256/192, but all NIST SP 800-208 algorithms are also allowed. LMS is a form of post-quantum cryptography and is named after its creators, MIT professors Tom Leighton and Silvio Micali. As the term “postquantum” suggests, LMS is considered resistant under both classical and quantum computer attacks and it relies on two classical concepts: one-time signature (OTS) and Merkle trees. How it works: The Winternitz OTS (WOTS) scheme [4] is used to generate a key pair that can be used to sign exactly one message. To allow for signing of multiple messages, LMS uses a Merkle tree (a binary tree of hashes that is also a fundamental security feature used to efficiently verify the integrity of transactions within a block in most blockchain block security implementations). A large number of OTS key pairs (pki, ski) are generated, and hashes of their public keys (using a collisionresistant hash function H) form the "leaves" of the tree. The final, single public key for the entire LMS scheme is the root hash of this tree. See Fig. 2 (adapted from [3, p. 13]) for a general scheme of the LMS. Figure 2: The general scheme of LMS 227 The second PQC scheme approved by the NSA for asymmetric algorithms for digitally signing firmware and software is the Xtended Merkle Signature Scheme (XMSS) [5]. While a single-tree MSS can sign a limited number of messages (about 220, which is slightly above a million), the Xtended version can increase this number significantly by using "hypertree"—a tree of trees; see also [2, p. 585]. Both XMSS and LMS are hash-based signature schemes, and their main difference lies in their security proof: • LMS is simpler, and its security assumes an "ideal" hash function, which is a strong theoretical assumption. • XMSS has a more complex design, allowing its security to be proven in the standard model, relying on the “weaker" assumption that the hash function is collision-resistant. In JCT another variant of XMSS is also included: The eXtended Merkle MultiTree signature scheme (XMSS^MT) that is based on multiple XMSS trees chained together with the advantage compared to a simple XMSS tree that it reduces the computation efforts to create the key pair. Here the single trees are connected by signing the XMSS root node of a lower layer, and the lowest layer is used to sign messages. III. Visualization of Merkle signature schemes in JCT Our focus now shifts to the PQC schemes implemented in JCT. Using the Visuals menu, the user can select Merkle Signatures (XMSS^MT) which provides the following implementations: • MSS – the “classical” Merkle signature; • XMSS – the extended version; • XMSS^MT – the extended version with multiple trees. All schemes are visualized with five different tabs. We will follow the XMSS algorithm: Seed and key generation. Here one can use the pregenerated public and private seeds (only public for MSS), generate a random seed or input one’s data. Then the user needs to select their Winternitz parameter that determines signature length either, 4 or 16, in the JCT visualization. Lastly, 228 they have to Generate key pair by choosing the selectable amount of WOTS key pairs that create the MerkleTree using a random seed. Only powers of two: 2h where h = 1, …, 6, are allowed in JCT. Our example uses h = 3. MerkleTree. The tree is visualized, and one can choose any leaf or node to see their hash values, as well as color the path to the root node and their authentication nodes. The selected leaf, its parent nodes, and the root are colored in yellow, and the neighboring leaf and all nodes that form the verification path are in red. All other leaves and nodes remain green (see Fig. 3 where leaf 6 is selected). Key pair. Here Merkle key pair and size are shown. The public key (and its size in bytes) consists of the value of the root node and the seed, and the private key (and its size in kilobytes) – an index of the next one-time key pair that will be used, the seed, and all private one-time keys with indices from 0 to 2h-1. Signature generation. Here one can choose interactive or simple signature generation, with the only difference being that the former allows one to see parts of the signature interactively. One can input up to 2h messages. For each input, JCT searches for a free one-time keypair, and the one-time signature is then added to the main signature. More information is needed to hash the tree, and the values from the red-marked nodes are important for the verifier and have to be supplemented. This information forms the authentication path. Figure 3: The MerkleTree visualization in JCT for the XMSS scheme 229 Verification. Initially, the leaf with the correct index (yellow path) is selected, and if another leaf with the wrong index is selected, the verification will fail. For the verification process we need the public Merkle (MSS) key, the Merkle (MSS) signature (containing the index, the one-time signature, and the authentication path), and the message. During the verification of a message, the one-time public key is calculated from the message and the one-time signature. Instead of checking this one-time public key, it is used as a leaf in the MerkleTree. Together with the index and the authentication path, a root node public key is calculated. If the calculated value matches with the Merkle public key, the verification is successful and the signature is accepted; otherwise, the verification fails. IV. Conclusion We have introduced the Java CryptTool (JCT) as an opensource e-learning platform for cryptography and the threat quantum computing poses to current algorithms like RSA and ECC. We have described the post-quantum cryptography (PQC) and the NSA-approved hash-based signature schemes like LMS and XMSS, which use Merkle trees to remain secure against quantum attacks, and described how JCT visualizes these Merkle signature schemes (MSS, XMSS, and XMSS^MT) using a five-tab interface that guides users through the process. For symmetric-key algorithms for information protection, the NSA requests the Advanced Encryption Standard (AES) with a 256-bit key and, for hash function – the Secure Hash Algorithm (SHA) with 384-, and 512-bit digest sizes. Both these algorithms are included in JCT with visual and algorithmic implementations. The approved asymmetric algorithm for key establishment is CRYSTALS-Kyber [6], and for digital signatures, CRYSTALS-Dilithium [7], both part of the CRYSTALS (Cryptographic Suite for Algebraic Lattices) package, which was selected by the U.S. National Institute of Standards and Technology (NIST) to become the new global standard for postquantum cryptography. The CRYSTAL suite algorithms are not yet included in JCT. 230 REFERENCES: 1. COOPER, David A., et al., 2020. Recommendation for Stateful Hash-Based Signature Schemes: NIST Special Publication 800208 [online]. Gaithersburg, MD: National Institute of Standards and Technology, October 2020, DOI: 10.6028/NIST.SP.800-208 [Accessed 8 November 2025]. Available from: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800 -208.pdf 2. ESSLINGER, B., Learning and Experiencing Cryptography with Cryptool and Sagemath, Artech House, Norwood, 2024, ISBN: 9781685690175 3. HÜLSING, Andreas, 2013. Practical Forward Secure Signatures using Minimal Security Assumptions [online]. Darmstadt: Technische Universität Darmstadt. PhD Thesis. [Accessed 8 November 2025]. Available from: https://tuprints.ulb.tudarmstadt.de/id/document/45936 4. HÜLSING, A., D. BUTIN, S. GAZDAG, J. RIJNEVELD, and A. MOHAISEN, 2018. XMSS: eXtended Merkle Signature Scheme [online]. Internet Engineering Task Force, May 2018. Request for Comments: 8391. [Accessed 8 November 2025]. Available from: https://www.rfc-editor.org/rfc/rfc8391.html 5. LEIGHTON, Frank T. and MICALI, Silvio, Large provably fast and secure digital signature schemes based on secure hash functions. United States patent US 5,432,852. 11 July 1995. 6. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY, 2024, Module-Lattice-Based Key-Encapsulation Mechanism (MLKEM) Standard, (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 203, DOI: 10.6028/NIST.FIPS.203. 7. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY, 2024, Module-Lattice-Based Digital Signature (ML-DSA) Standard, (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 204, DOI: 10.6028/NIST.FIPS.204. 231 8. NATIONAL SECURITY AGENCY, 2025. Commercial National Security Algorithm Suite 2.0 Algorithms [online]. Washington, DC: U.S. Department of Defense, 30 May 2025 [accessed 8 November 2025]. Available from: https://media.defense.gov/2025/May/30/2003728741/-1/- 1/0/CSA_CNSA_2.0_ALGORITHMS.PDF 9. RESEARCH INSTITUTE CYBER DEFENCE (CODE), About JCrypTool. [Online] University of Bundeswehr Munich, 2025. [accessed 8 November 2025]. Available from: https://www.cryptool.org/en/jct/ 10. RIVEST, R.L., SHAMIR, A. and ADLEMAN, L., 1978. A Method for Obtaining Digital Signatures and Public-Key Cryptosystems. Communications of the ACM, February 1978, vol. 21, no. 2, pp. 120-126. 11. SHOR, P. W., 1997. Polynomial Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer. SIAM Journal on Computing, vol. 26, no. 5, pp. 1484-1509, DOI: 10.1137/S0097539795293172