Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Quantum-Safe” Crypto Hacked by 10-Year-Old PC

spectrum.ieee.org

Post reply on HN
Print view View original

121–130 of 187 posts

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#121

Post by est31 »

tptacek wrote: post #117
est31 wrote: post #116

Earlier quoted context omitted.

If you have multiple WireGuard versions, in a migration setting, you also need to do some negotiation at the start, no? Wouldn't that be potentially vulnerable to downgrade attacks as well?

No: you simply don't speak the old versions.

So the migration looks like "upgrade the client or you won't be able to connect to the server any more"? What if you use the client to talk to multiple servers, some that use the old version, some that use the new version? Maybe via a config variable adjustable per server? Then you do out of band version negotiation, and you might get away with this in the VPN setting, where entering arcane config vars is commonplace, but not in e.g. the TLS setting.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#122

Post by tptacek »

est31 wrote: post #121
tptacek wrote: post #117

Earlier quoted context omitted.

No: you simply don't speak the old versions.

So the migration looks like "upgrade the client or you won't be able to connect to the server any more"? What if you use the client to talk to multiple servers, some that use the old version, some that use the new version? Maybe via a config variable adjustable per server? Then you do out of band version negotiation, and you might get away with this in the VPN setting, where entering arcane config vars is commonplace…

Entering arcane config variables is extremely not commonplace with WireGuard.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#123

Post by jabbany »

kmeisthax wrote: post #107
RL_Quine wrote: post #28

Earlier quoted context omitted.

It’s pretty unlikely that sha2 will ever broken in a way which actually has a meaningful security impact to bitcoin, especially considering that almost every value in the system is sha2(sha2()) which nullifies a lot of attacks against hashes which need careful control of the input. Some newer tools in the system use a single hash (it’s unclear why a double one was used in the first place), but all the same it remains…

Consensus compatibility is nice, but Bitcoin has a unique problem: those old signatures own coins. Phasing out a signature algorithm means confiscating the coins in question, as the rightful owner will no longer be able to spend them anymore. Leaving them open would just let private actors break wallets to confiscate the coins themselves, with the added bonus that burnt or lost coins could be recovered, effectively i…

No idea, but I could imagine something where you have a period of time on the chain where both signature types are allowed, and people can just migrate their coins by transferring from the old wallet to one based on the new signature system. Then after a certain cutoff, the chain can phase out the old signature system entirely.

Of course this only works if the old system is just "weak" rather than "broken". There is no way to recover if the signature system is completely broken, but if ECDSA is broken then we have more to worry about than just Bitcoins.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#124

Post by scatters »

staticassertion wrote: post #110
tptacek wrote: post #13

If you'd like to hear someone who can barely do long division† discuss this vulnerability with one of the leading isogeny cryptographer researchers and the world's most isogeny-enthusiastic cryptography engineer, have I got a podcast for you: https://securitycryptographywhatever.buzzsprout.com/1822302/... There's even a transcript, if you want to read things like: So I watched the, uh, I watched Costello's tutorial,…

Can anyone do long division other than children and those who pursue math academically? Seems impossible to imagine.

You need to be able to perform long division to take quotients in algebraic structures, e.g. polynomials. Yes, Wolfram Alpha can probably do it, but not always.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#125

Post by tptacek »

karl_gluck wrote: post #113

Can someone remind me why Merkle trees of Lamport signatures aren’t the solution for postquantum asymmetric signing? Sure the signatures are huge, but they’re secure unless you can trivially invert the hash function.

SIDH/SIKE is a key exchange mechanism, not a signature scheme.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#126

Post by some_furry »

est31 wrote: post #121
tptacek wrote: post #117

Earlier quoted context omitted.

No: you simply don't speak the old versions.

So the migration looks like "upgrade the client or you won't be able to connect to the server any more"? What if you use the client to talk to multiple servers, some that use the old version, some that use the new version? Maybe via a config variable adjustable per server? Then you do out of band version negotiation, and you might get away with this in the VPN setting, where entering arcane config vars is commonplace…

I wrote a lot about a similar debate recently, but in the context of encryption at rest rather than encryption in transit

https://soatok.blog/2022/08/18/burning-trust-at-the-quantum-...

For brevity, start reading at "Isn’t cryptography fun?" which contains the relevant portion.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#127

Post by est31 »

tptacek wrote: post #122
est31 wrote: post #121

Earlier quoted context omitted.

So the migration looks like "upgrade the client or you won't be able to connect to the server any more"? What if you use the client to talk to multiple servers, some that use the old version, some that use the new version? Maybe via a config variable adjustable per server? Then you do out of band version negotiation, and you might get away with this in the VPN setting, where entering arcane config vars is commonplace…

Entering arcane config variables is extremely not commonplace with WireGuard.

I guess that's thanks to the fact that WireGuard is a new system and new systems have little legacy bloat. Maybe the WireGuard author had golden hands, and the system is perfect, and indeed it it is quite good, but I think instead that WireGuard will eventually require a new version. Then one such solution will have to be chosen.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#128

Post by some_furry »

est31 wrote: post #127
tptacek wrote: post #122

Earlier quoted context omitted.

Entering arcane config variables is extremely not commonplace with WireGuard.

I guess that's thanks to the fact that WireGuard is a new system and new systems have little legacy bloat. Maybe the WireGuard author had golden hands, and the system is perfect, and indeed it it is quite good, but I think instead that WireGuard will eventually require a new version. Then one such solution will have to be chosen.

When that happens, you will use WireGuard v2 which is incompatible with WireGuard v1.

I wouldn't expect it to happen before a crypto-relevant quantum computer is built.

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#129

Post by foota »

scatters wrote: post #124
staticassertion wrote: post #110

Earlier quoted context omitted.

Can anyone do long division other than children and those who pursue math academically? Seems impossible to imagine.

You need to be able to perform long division to take quotients in algebraic structures, e.g. polynomials. Yes, Wolfram Alpha can probably do it, but not always.

shudders with memories of abstract algebra

Re: “Quantum-Safe” Crypto Hacked by 10-Year-Old PC

#130

Post by cookiengineer »

> paper: https://eprint.iacr.org/2022/975.pdf

Does this mean that probably all SIDH key exchanges are affected?

What about TOR? Do we have to assume that key exchanges can be intercepted and recovered?

A RUSTSEC advisory was already published and they removed all SIDH algorithms there [1]

[1] https://rustsec.org/advisories/RUSTSEC-2022-0045.html

Post reply on HN