Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
words.filippo.io
Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
1–10 of 116 posts
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#2[dead]
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#3Disconcerting opening. If you want to put hash algorithms in the same category as symmetric keys in this particular case then say so without referring to them as if they are symmetric keys.
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#4Disconcerting opening. If you want to put hash algorithms in the same category as symmetric keys in this particular case then say so without referring to them as if they are symmetric keys.
Hashes are symmetric cryptography primitives, and it's even proper to talk about key sizes for e.g. HMAC and HKDF hash-based constructions, to which Grover's algorithm applies analogously to how it applies to cipher keys.
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#5If this is true, I feel teh wifi alliance have a tonne to answer for the ewaste they generate.
WPA3 moved from symmetric AES to ECDH which is vulnerable to Quantum. Gonna be a tonne of IOT inverters waste.
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#6If this is true, I feel teh wifi alliance have a tonne to answer for the ewaste they generate. WPA3 moved from symmetric AES to ECDH which is vulnerable to Quantum. Gonna be a tonne of IOT inverters waste.
WPA3 moved from PBKDF to ECDH. AES CCMP and GCMP are still the underlying block ciphers in WPA3 with some other extensions for China
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#7If this is true, I feel teh wifi alliance have a tonne to answer for the ewaste they generate. WPA3 moved from symmetric AES to ECDH which is vulnerable to Quantum. Gonna be a tonne of IOT inverters waste.
WPA3 was announced in 2018 [0]. I don't think it's reasonable to blame them for not anticipating the next decade of cryptographic research.
...but even if they had, what realistically could they have done about it? ML-KEM was only standardized in 2024 [1].
also, the addition of ECDH in WPA3 was to address an existing, very real, not-theoretical attack [2]:
> WPA and WPA2 do not provide forward secrecy, meaning that once an adverse person discovers the pre-shared key, they can potentially decrypt all packets encrypted using that PSK transmitted in the future and even past, which could be passively and silently collected by the attacker. This also means an attacker can silently capture and decrypt others' packets if a WPA-protected access point is provided free of charge at a public place, because its password is usually shared to anyone in that place.
0: https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#WPA3
1: https://en.wikipedia.org/wiki/ML-KEM
2: https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Lack_of...
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#8I think quantum may be practically mitigated with aggressive key rotation in some cases. I've been prototyping an oauth machine-to-machine integration with a banking vendor that has our ecdsa keys rotate every 5 minutes. The keys are scheduled for deletion after 10 minutes. I see no reason I couldn't reduce this to something like 30s/60s. Our counterparty frequently scans our JWKS endpoint for revocation, so in practice an attacker with a quantum computer would need to be very fast if they wanted to break this particular wire agreement the scary way.
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#9If this is true, I feel teh wifi alliance have a tonne to answer for the ewaste they generate. WPA3 moved from symmetric AES to ECDH which is vulnerable to Quantum. Gonna be a tonne of IOT inverters waste.
WPA3 was announced in 2018 [0]. I don't think it's reasonable to blame them for not anticipating the next decade of cryptographic research. ...but even if they had, what realistically could they have done about it? ML-KEM was only standardized in 2024 [1]. also, the addition of ECDH in WPA3 was to address an existing, very real, not-theoretical attack [2]: > WPA and WPA2 do not provide forward secrecy, meaning that o…
Does it matter if an attacker can decrypt public wifi traffic? You already have to assume the most likely adversary (e.g. the most likely to sell your information) is the entity running the free wifi, and they can already see everything.
Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
#10Very good breakdown, if I’m understanding Grover’s algorithm correctly, are you saying essentially that it would require either too much compute or too much time to be feasible but is still much more realistic than a brute force attack?
If that’s the case, would the time eventually be basically irrelevant with enough compute? For instance, if what’s now a data center is able to fit in the palm of your hand (comparing early computers that took up rooms to phones nowadays). So if compute is (somehow) eventually able to be incredibly well optimized or if we use something new, like how microprocessors were the next big thing, would that then be a quantum threat to 128-bit symmetric keys?