A counter-point that perhaps everyone is taking PQ a bit too seriously [1]. Personally, it seems reasonable to at least spend some effort preparing for it, given the rather long lead time required to develop, study and stress the constructions needed. It might be a long time (if ever) before cryptographically relevant quantum computers show up, but if they do, we'll be glad we had a decade or two to get ready. The al…
Google's threat model for post-quantum cryptography
51–60 of 81 posts
Re: Google's threat model for post-quantum cryptography
#52Re: Google's threat model for post-quantum cryptography
#53A counter-point that perhaps everyone is taking PQ a bit too seriously [1]. Personally, it seems reasonable to at least spend some effort preparing for it, given the rather long lead time required to develop, study and stress the constructions needed. It might be a long time (if ever) before cryptographically relevant quantum computers show up, but if they do, we'll be glad we had a decade or two to get ready. The al…
Don’t be so sure. From the article, Google seems to believe quantum computers will arrive in the next 10 years.
Re: Google's threat model for post-quantum cryptography
#54Re: Google's threat model for post-quantum cryptography
#55A counter-point that perhaps everyone is taking PQ a bit too seriously [1]. Personally, it seems reasonable to at least spend some effort preparing for it, given the rather long lead time required to develop, study and stress the constructions needed. It might be a long time (if ever) before cryptographically relevant quantum computers show up, but if they do, we'll be glad we had a decade or two to get ready. The al…
The risk is non-linear advances That's what everybody said about AI, then sudden advances ~2013 led to the situation today.
Re: Google's threat model for post-quantum cryptography
#56Stateless tokens come with independent security concerns, and moving towards stateful tokens is prudent just to ensure more robust systems. [...] Our main recommendation is to use stateful tokens where possible, given their additional security benefits. This is smart. PQC schemes often add too much overhead for interoperable cookie sizes. Instead of trying to cram a PQC signature into a cookie, just stop using the st…
Yeah; that doesn't look right to me either. Perhaps "cryptographically relevant" has some unusual meaning (parity with conventional computing?). Otherwise, the consensus view is that there's, pessimistically, a 4% probability of a total break of all public key cryptography within 5 years.
That's practically "abandon all hope right now" territory rather than "motivate adoption" territory.
Re: Google's threat model for post-quantum cryptography
#57Besides encrypting your user data at rest using these post-quantum cryptography algo. What can be done from a design point of view to make it as hard as possible to deter attackers? Would it make sense to segregate different types of data into other dbs rather than as a separate table? “Name DB” “Account DB” “Address DB” An attacker would need to have advanced knowledge of the app backend to know you have to snag bot…
If you're encrypting data at rest, just keep using an appropriate mode of AES (or ChaCha20 or whatever+) and exercising good key management practices. Quantum computing is largely irrelevant to conventional symmetric ciphers.
+ for tightly constrained values of 'whatever'
Re: Google's threat model for post-quantum cryptography
#58The threat estimate for a quantum computer that breaks cryptography shall be based on currently available data and the understanding that only the Schor algorithm is known to provide exponential speedup for factorisation. Let’s give IBM credit for attempting to factor in the number 35 in 2022, although they failed there [1]. Before that, the successful factorisation happened for the number 21 in 2012 [2] and the firs…
I think they must not be planning on the trend being linear. Maybe we’re at the linear looking beginning of a sigmoid. It seems like a reasonable bet on their part, in the sense that Google has a lot of money to play with. Even if it is unlikely that it takes off, behind hit by quantum attacks would be pretty bad for them, so maybe they see it as insurance against an unlikely but catastrophic event.
The issue is the emphasis on the importance of an inevitable threat. Organisations start to justify implementing QC-resistant algorithms on the basis that others are doing so, and in that way, they justify themselves that the threat is real. After that, we would end up with government agencies issuing a requirement that only QC-safe algorithms are acceptable for security in the process, killing useful cryptographic primitives like ElGamal cryptosystems, homomorphic encryption, blind signatures and a class of zero-knowledge proofs.
At the moment, there are only three points from which one can extrapolate further advancements. The Shor algorithm requires exponential suppression of errors with the number of qubits. This is why, although we have hundred qubit QCs, the most significant factorisation is being done at most with five qubits. Threfore, if we would have “exponential progress” in advancing QC, the advancement of factoring integers would be linear. Faster progress requires miracles. QC error correction would be no panacea either, as it would require repeated application and would require an unreasonable number of qubits as well as would increase runtime.
The miracle as well be that we figure out a way to factorize numbers on classical computers in polynomial time. Or as well break lattice based crypto on classical computers.
Re: Google's threat model for post-quantum cryptography
#59Stateless tokens come with independent security concerns, and moving towards stateful tokens is prudent just to ensure more robust systems. [...] Our main recommendation is to use stateful tokens where possible, given their additional security benefits. This is smart. PQC schemes often add too much overhead for interoperable cookie sizes. Instead of trying to cram a PQC signature into a cookie, just stop using the st…
Re: Google's threat model for post-quantum cryptography
#60A counter-point that perhaps everyone is taking PQ a bit too seriously [1]. Personally, it seems reasonable to at least spend some effort preparing for it, given the rather long lead time required to develop, study and stress the constructions needed. It might be a long time (if ever) before cryptographically relevant quantum computers show up, but if they do, we'll be glad we had a decade or two to get ready. The al…
> It might be a long time (if ever) before cryptographically relevant quantum computers show up Don’t be so sure. From the article, Google seems to believe quantum computers will arrive in the next 10 years.