A cryptography engineer's perspective on quantum computing timelines • Hacker News Board

Re: A cryptography engineer's perspective on quantum computing timelines

#241

Post by bigfatkitten » Tue, Apr 07, 2026, 8:10 PM UTC

raron wrote: post #113

FiloSottile wrote: post #104

Earlier quoted context omitted.

Thus succeeding at making the telecommunications vendors used for Top Secret US national security data less secure, the obvious goal of the US National Security Agency, and the only reason they wouldn't use the better cryptography designed by Dr. Bernstein. /s Truly, truly can't understand why anyone finds this line of reasoning plausible. (Before anyone yells Dual_EC_DRBG, that was a NOBUS backdoor, which is an argu…

> Thus succeeding at making the telecommunications vendors used for Top Secret US national security data less secure, the obvious goal of the US National Security Agency NSA still has the secret Suite A system for their most sensitive information. If they think that is better than the current public algorithms and their goal is to make telecommunications vendors to have better encryption, then why doesn't they publis…

The thing that sets this effort apart from DES and Clipper is that USG actually has skin in the game. Neither DES or Clipper were ever intended or approved to protect classified information.

These are algorithms that NSA will use in real systems to protect information up to the TOP SECRET codeword level through programs such as CNSA 2.0[1] and CsFC.

[1] https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA...

[2] https://www.nsa.gov/Resources/Commercial-Solutions-for-Class...

Re: A cryptography engineer's perspective on quantum computing timelines

#242

Post by nathanmcrae » Tue, Apr 07, 2026, 8:50 PM UTC

Side question, but does anyone know why specifically 2^-32 is the target floor for attacker success (in footnote 3)? I found another mention of the 2^-32 target in [0], but I'm not even certain they're related.

[0] https://csrc.nist.gov/csrc/media/Events/2023/third-workshop-...

Re: A cryptography engineer's perspective on quantum computing timelines

#243

Post by adgjlsfhk1 » Wed, Apr 08, 2026, 2:24 AM UTC

Perseids wrote: post #230

tptacek wrote: post #224

Earlier quoted context omitted.

I would be interested in seeing you rattle off the "pros and cons" of this argument, just as a synchronization mechanism for the thread so we'd know if we're on the same page.

Off the top of my head? Pro hybrid: Negligible performance impact (negligible for battery devices, negligible for data send over the wire (number of packets -> sub-discussion about specific circumstances, time on the air for cellular), negligible for speed, negligible code size increase), little implementation effort as every library already has ECC in it, ML-KEM is too new (yes actually old, but far less research in…

one more Pro hybrid only: reduction of transitions is doubtful since by the time PQC is clearly better, we're likely to have better PQC algorithms (and or better attacks that force more conservative parameters). At a bare minimum, we aren't ready to move to pure PQC until we can go a couple years without continued improvements in lattice reduction algorithms.

Re: A cryptography engineer's perspective on quantum computing timelines

#244

Post by mikestorrent » Wed, Apr 08, 2026, 2:44 AM UTC

William_BB wrote: post #209

mikestorrent wrote: post #167

Earlier quoted context omitted.

The largest number factorised on a quantum computer is 8,219,999 on a D-Wave machine (a quantum annealer, so not capable of running Shor's, but capable of being an actual shipping product you can use, unlike gate model machines). https://www.nature.com/articles/s41598-024-53708-7 > Overall, 8,219,999 = 32,749 × 251 was the highest prime product we were able to factorize within the limits of our QPU resources. To the…

You should read the article you posted before you write a comment. Hint: check P_F=0 in tables 2, 3 and 4. "Factored" is doing a lot of lifting here and is borderline deceptive. Plenty of researchers have long ago pointed out that this won't scale, see M Mosca for reference.

I'm aware; I don't think gate model machines have demonstrated much potential of scaling in practice any time soon so this is more of a lark to show how unimpressive the current Shor's attempts have been

Re: A cryptography engineer's perspective on quantum computing timelines

#245

Post by mikestorrent » Wed, Apr 08, 2026, 2:45 AM UTC

Tyyps wrote: post #189

mikestorrent wrote: post #167

Earlier quoted context omitted.

The largest number factorised on a quantum computer is 8,219,999 on a D-Wave machine (a quantum annealer, so not capable of running Shor's, but capable of being an actual shipping product you can use, unlike gate model machines). https://www.nature.com/articles/s41598-024-53708-7 > Overall, 8,219,999 = 32,749 × 251 was the highest prime product we were able to factorize within the limits of our QPU resources. To the…

This is quantum annealing and it has nothing to do with Shor (I should have been precise sorry). It is not clear at all that quantum annealing provides any speedup compared to a classical computer.

Yeah that was the first line of my comment.

Annealing is in fact proven to be able to do certain things faster than any classical CPU; whether you can make use of that particular feature is a different question. If you're into spinglasses, maybe

Re: A cryptography engineer's perspective on quantum computing timelines

#246

Post by adgjlsfhk1 » Wed, Apr 08, 2026, 2:48 AM UTC

fc417fc802 wrote: post #237

Tyyps wrote: post #198

Earlier quoted context omitted.

I think it is pretty direct from my comment that if you use a hybrid approach (done correctly) you can rely on the hardness of dlog based assumption and therefore my comment on potential weakness of PQ assumptions can be ruled out. In this way we disagree that rushing PQ is the appropriate choice if it rules out dlog based security. > He's also pointing out that the only scenario in which hybrid is of benefit is one…

You seem to just be rehashing what we already clearly agree on. Obviously if you view classically breaking PQ algorithms as higher likelihood than QC breaking classical then you are going to disagree with the premise. Can you actually back up your prediction that crypto related QC will remain either relatively ineffective or extremely expensive in the medium term?

The requirement for favoring hybrid isn't that "you view classically breaking PQ algorithms as higher likelihood than QC breaking classical", but you think that the likelihood than QC breaking classical is less than a billion times more than the likelyhood of classically breaking PQ.

Hybrid has essentially no cost, so we should favor it as long as it has a greater than negligible chance of providing protection. IMO the likelihood of CRQCs breaking ECC is pretty high (>50% by 2040) and the odds of classically breaking lattices is low (<1% by 2050), but creating a 0.5% chance of breaking cryptography for the entire world seems way to high when we have a free mitigation right here.

Re: A cryptography engineer's perspective on quantum computing timelines

#247

Post by tptacek » Wed, Apr 08, 2026, 4:15 AM UTC

adgjlsfhk1 wrote: post #243

Perseids wrote: post #230

Earlier quoted context omitted.

Off the top of my head? Pro hybrid: Negligible performance impact (negligible for battery devices, negligible for data send over the wire (number of packets -> sub-discussion about specific circumstances, time on the air for cellular), negligible for speed, negligible code size increase), little implementation effort as every library already has ECC in it, ML-KEM is too new (yes actually old, but far less research in…

one more Pro hybrid only: reduction of transitions is doubtful since by the time PQC is clearly better, we're likely to have better PQC algorithms (and or better attacks that force more conservative parameters). At a bare minimum, we aren't ready to move to pure PQC until we can go a couple years without continued improvements in lattice reduction algorithms.

This is like saying we should have halted all RSA deployments until improvements in sieving stopped happening. The lattice contestants were all designed assuming BKZ would continually improve. It's not 1994 anymore, asymmetric cryptography is not a huge novelty to the industry, nobody is doing the equivalent of RSA-512.

Re: A cryptography engineer's perspective on quantum computing timelines

#248

Post by caf » Wed, Apr 08, 2026, 5:49 AM UTC

ifwinterco wrote: post #203

FiloSottile wrote: post #104

Earlier quoted context omitted.

Thus succeeding at making the telecommunications vendors used for Top Secret US national security data less secure, the obvious goal of the US National Security Agency, and the only reason they wouldn't use the better cryptography designed by Dr. Bernstein. /s Truly, truly can't understand why anyone finds this line of reasoning plausible. (Before anyone yells Dual_EC_DRBG, that was a NOBUS backdoor, which is an argu…

Maybe your motives are benevolent, but you're arguing two things: 1) We can broadly trust the US government 2) We should adopt new encryption partly designed and funded by the US government, and get rid of the battle tested encryption that they seem not to be able to break Forgive me for being somewhat suspicious of your motives here

[We can broadly trust the US government] not to promote broken encryption to its own agencies.

Re: A cryptography engineer's perspective on quantum computing timelines

#249

Post by fc417fc802 » Wed, Apr 08, 2026, 6:30 AM UTC

adgjlsfhk1 wrote: post #246

fc417fc802 wrote: post #237

Earlier quoted context omitted.

You seem to just be rehashing what we already clearly agree on. Obviously if you view classically breaking PQ algorithms as higher likelihood than QC breaking classical then you are going to disagree with the premise. Can you actually back up your prediction that crypto related QC will remain either relatively ineffective or extremely expensive in the medium term?

The requirement for favoring hybrid isn't that "you view classically breaking PQ algorithms as higher likelihood than QC breaking classical", but you think that the likelihood than QC breaking classical is less than a billion times more than the likelyhood of classically breaking PQ. Hybrid has essentially no cost, so we should favor it as long as it has a greater than negligible chance of providing protection. IMO t…

Not so. One of the core premises of the article that we're discussing here is that hybrid is proving to be quite difficult for entirely nontechnical reasons.

I agree that my previous wording was sloppy to the point of error. The point I was trying to communicate was that we already had agreement that an elevated assessment of the chance of a classical attack against a given PQ algorithm would lead to one disagreeing with the aforementioned premise that we should switch to a PQ only scheme making use of said algorithm. Rehashing that is just stating the obvious.

What wasn't presented was any reasoning to back an elevated risk assessment for any particular PQ algorithm, of which there are several. So at that point the "argument" amounts to little more than "nuh-uh, that risk assessment is wrong" which isn't exactly convincing or insightful.

Re: A cryptography engineer's perspective on quantum computing timelines

#250

Post by Perseids » Wed, Apr 08, 2026, 7:02 AM UTC

tptacek wrote: post #247

adgjlsfhk1 wrote: post #243

Earlier quoted context omitted.

one more Pro hybrid only: reduction of transitions is doubtful since by the time PQC is clearly better, we're likely to have better PQC algorithms (and or better attacks that force more conservative parameters). At a bare minimum, we aren't ready to move to pure PQC until we can go a couple years without continued improvements in lattice reduction algorithms.

This is like saying we should have halted all RSA deployments until improvements in sieving stopped happening. The lattice contestants were all designed assuming BKZ would continually improve. It's not 1994 anymore, asymmetric cryptography is not a huge novelty to the industry, nobody is doing the equivalent of RSA-512.

> This is like saying we should have halted all RSA deployments until improvements in sieving stopped happening.

Absolutely not. If people were advocating for ECC only, you would have a point. But this thread is about hybrids vs ML-KEM-only (for key exchange!). Everybody here wants to deploy the algorithm your favoring and wants to deploy it now, just not without a safety net.