Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

words.filippo.io

Post reply on HN
Print view View original

21–30 of 116 posts

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#21

Post by cortesoft »

bob1029 wrote: post #8

I think quantum may be practically mitigated with aggressive key rotation in some cases. I've been prototyping an oauth machine-to-machine integration with a banking vendor that has our ecdsa keys rotate every 5 minutes. The keys are scheduled for deletion after 10 minutes. I see no reason I couldn't reduce this to something like 30s/60s. Our counterparty frequently scans our JWKS endpoint for revocation, so in pract…

This wouldn’t help symmetric key encryption, which is what this is talking about. The keys you are rotating are asymmetric keys, which are only used to exchange symmetric keys for the actual encryption. In good setups, those symmetric keys are changed every session anyway.

If an attacker can break the symmetric encryption in a reasonable amount of time, they can capture the output and break it later.

In addition, how are you doing the key rotation? You have to have some way of authenticating with the rotation service, and what is to stop them from breaking THAT key, and getting their own new certificate? Or breaking the trusted root authority and giving themselves a key?

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#22

Post by quinnjh »

TacticalCoder wrote: post #15

Tangentially related but regarding RSA and ECC... With RSA can't we just say: "Let's use 16 384 bit keys" and be safe for a long while? And for ECC, I know many are using the "2 exp 255 - 19" / 25519 for it's unlikely to be backdoored but it's only 256 bits but... Can't we find, say, "2 exp 2047 - 19" (just making that one up) and be safe for a while too? Basically: for RSA and ECC, is there anything preventing us fr…

> for RSA and ECC, is there anything preventing us from using keys 10x bigger?

you can run benchmarks yourself: openssl speed rsa1024 rsa2048

also this (slightly dated) java ex writeup covers this well: https://www.javamex.com/tutorials/cryptography/rsa_key_lengt...

tldr trade off is found between better performance and how many years the data needs to be assumed confidential

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#23

Post by bob1029 »

cortesoft wrote: post #21
bob1029 wrote: post #8

I think quantum may be practically mitigated with aggressive key rotation in some cases. I've been prototyping an oauth machine-to-machine integration with a banking vendor that has our ecdsa keys rotate every 5 minutes. The keys are scheduled for deletion after 10 minutes. I see no reason I couldn't reduce this to something like 30s/60s. Our counterparty frequently scans our JWKS endpoint for revocation, so in pract…

This wouldn’t help symmetric key encryption, which is what this is talking about. The keys you are rotating are asymmetric keys, which are only used to exchange symmetric keys for the actual encryption. In good setups, those symmetric keys are changed every session anyway. If an attacker can break the symmetric encryption in a reasonable amount of time, they can capture the output and break it later. In addition, how…

> This wouldn’t help symmetric key encryption, which is what this is talking about.

I agree. The point I am trying to make is that even for asymmetric encryption (which is far more vulnerable), there are still plausible ways to make a quantum break more difficult.

The only thing that could compromise this scheme, aside from breaking the signing keys, would be to have TLS broken to the extent that viewing real-time traffic is possible. Any TLS break delayed by more than 15 minutes would be worthless.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#24

Post by dist-epoch »

TacticalCoder wrote: post #15

Tangentially related but regarding RSA and ECC... With RSA can't we just say: "Let's use 16 384 bit keys" and be safe for a long while? And for ECC, I know many are using the "2 exp 255 - 19" / 25519 for it's unlikely to be backdoored but it's only 256 bits but... Can't we find, say, "2 exp 2047 - 19" (just making that one up) and be safe for a while too? Basically: for RSA and ECC, is there anything preventing us fr…

for a 10x bigger key the quantum computer needs to be 10x bigger - linear scaling.

the time to run the algorithm has cubic scaling - 1000x more time required.

but it remains exponentially faster, just 1 minute becomes 1 day, 1 day becomes 3 years. still "easily" broken

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#25

Post by evil-olive »

ndriscoll wrote: post #9
evil-olive wrote: post #7

Earlier quoted context omitted.

WPA3 was announced in 2018 [0]. I don't think it's reasonable to blame them for not anticipating the next decade of cryptographic research. ...but even if they had, what realistically could they have done about it? ML-KEM was only standardized in 2024 [1]. also, the addition of ECDH in WPA3 was to address an existing, very real, not-theoretical attack [2]: > WPA and WPA2 do not provide forward secrecy, meaning that o…

Does it matter if an attacker can decrypt public wifi traffic? You already have to assume the most likely adversary (e.g. the most likely to sell your information) is the entity running the free wifi, and they can already see everything.

> You already have to assume the most likely adversary is the entity running the free wifi

why do you have to assume that?

you're at Acme Coffeeshop. their wifi password is "greatcoffee" and it's printed next to the cash register where all customers can see it.

with WPA2 you have to consider N possible adversaries - Acme Coffee themselves, as well as every single other person at the coffeeshop.

...and also anyone else within signal range of their AP. maybe I live in an apartment above the coffeeshop, and think "lol it'd be fun to collect all that traffic and see if any of it is unencrypted".

with WPA3 you only have to consider the single possible adversary, the coffeeshop themselves.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#26

Post by tptacek »

rugina wrote: post #20

On one hand I hear that quantum computers will crack factorisation and discrete logarithms, on the other that the max number factorised is 15 and that 21 might not even be feasible. What is going on?

In the last month there has been a sharp vibe shift among cryptography engineers based on rumors that we may have demonstrations of CRQCs much sooner than anticipated, perhaps within 5 years. You're not going to get satisfactory answers beyond that; everybody understands the "factored 15" thing, the people for whom the vibe has shifted have priced that in.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#28

Post by dlcarrier »

rugina wrote: post #20

On one hand I hear that quantum computers will crack factorisation and discrete logarithms, on the other that the max number factorised is 15 and that 21 might not even be feasible. What is going on?

Coherency

To get useful results, a quantum computer needs all of its qbits to stay entangled with each other, until the entire group collapses into the result. With current technology, it is very difficult for a reasonable sized group of qbits to stay coherently entangled, so it can only solve problems that are also relatively easy to solve on classical computers.

If someone today were to figure out how to keep large numbers of bits entangled, then quantum computing would instantly be able to break any encryption that isn't quantum safe. It's not something that we are slowly working toward; it's a breakthrough that we can't predict when, or even if, it will happen.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#29

Post by dlcarrier »

kd913 wrote: post #5

If this is true, I feel teh wifi alliance have a tonne to answer for the ewaste they generate. WPA3 moved from symmetric AES to ECDH which is vulnerable to Quantum. Gonna be a tonne of IOT inverters waste.

Just yesterday I used an IoT device with WEP as the only WiFi option. Needless tosay, I use the wired connection.

The say the 's' in IoT stands for secure, and from my experience that is true. Pretty much nothing is getting thrown out, because it isn't secure.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#30

Post by daneel_w »

TacticalCoder wrote: post #15

Tangentially related but regarding RSA and ECC... With RSA can't we just say: "Let's use 16 384 bit keys" and be safe for a long while? And for ECC, I know many are using the "2 exp 255 - 19" / 25519 for it's unlikely to be backdoored but it's only 256 bits but... Can't we find, say, "2 exp 2047 - 19" (just making that one up) and be safe for a while too? Basically: for RSA and ECC, is there anything preventing us fr…

> Tangentially related but regarding RSA and ECC... With RSA can't we just say: "Let's use 16 384 bit keys" and be safe for a long while?

That's correct. The quantum computer needs to be "sufficiently larger" than your RSA key.

> Basically: for RSA and ECC, is there anything preventing us from using keys 10x bigger?

For RSA things get very unwieldy (but not technically infeasible) beyond 8192 bits. For ECC there are different challenges, some of which have nothing to do with the underlying cryptography itself: one good example is how the OpenSSH team still haven't bothered supporting Ed448, because they consider it unnecessary.

Post reply on HN