Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

France's Anssi Will Block PQC-Free Products from Certification Starting 2027

postquantum.com

Post reply on HN
Print view View original

11–20 of 66 posts

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#11

Post by jmward01 »

tsimionescu wrote: post #8

I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.

You prepare for the 9.0 earthquake that can happen once in 500 years because it is a 9.0 earthquake and if you haven't prepared your society is dead, not because you think it will most likely happen in your lifetime.

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#12

Post by colmmacc »

I was at ANSSI headquarters last year doing a technical presentation and several of their questions were about Post-Quantum Cryptography, "Q day" (when a practical Quantum Computer is expected) and other related things. They keep a close eye on this stuff and it's to their credit. Similarly the BSI in Germany have been promoting Post-Quantum security for some time now.

I work at AWS, where we have been deploying Post-Quantum Cryptography for quite some time and have experts. We're making easier than ever, but the sudden changes in deadlines do make me wonder how many companies are going to have to spend more time than they'd planned on migrations and settings. The "context switch" of working on PQ can be quite expensive. Most tech people have no idea what ML-KEM, ML-DSA, or HQC are, or how to not worry about SHA, HMAC, or AES. It's going to be a ride!

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#13

Post by ErroneousBosh »

tsimionescu wrote: post #8

I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.

> by 2050 when, my bet, there still won't be any remotely viable QCs

I hate to be that guy, but I'm 52 now and I've been hearing about how Quantum Computing is going to revolutionise everything in the next two years, since I was in primary school and ZX81s were state-of-the-art.

At least a couple of manufacturers offered a practical and afforable(-ish) transputer-based system in the 80s that you could have actually gone out and bought.

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#14

Post by ginko »

ErroneousBosh wrote: post #13
tsimionescu wrote: post #8

I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.

> by 2050 when, my bet, there still won't be any remotely viable QCs I hate to be that guy, but I'm 52 now and I've been hearing about how Quantum Computing is going to revolutionise everything in the next two years, since I was in primary school and ZX81s were state-of-the-art. At least a couple of manufacturers offered a practical and afforable(-ish) transputer-based system in the 80s that you could have actually g…

Transputers have nothing to do with quantum computing. They're completely classical computers.

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#15

Post by exmadscientist »

exmadscientist wrote: post #9
tsimionescu wrote: post #8

I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.

Agreed. This looks from the outside like someone read a report, got unnecessarily spooked, and now the rest of the herd is following along. But it's also very possible that hypothetical report was genuinely concerning. We just haven't seen it or anything like it. However I'm pretty firmly in the "quantum computing won't be doing anything useful any time soon, if ever" camp, so that definitely colors my opinions. I do…

Would anyone downvoting care to explain? I'm genuinely interested in seeing anything that suggests there's either some secret breakthrough (completely plausible, but there's no evidence that I've seen hint of) making quantum computers actually useful, or an argument that they'll be usable by (say) 2050?

Because right now my attitudes are trained by things like this https://algassert.com/post/2500 that explain just why 15 was factored in that famous run of Shor's algorithm and not, say, 21; and why 21 hasn't been factored yet and isn't likely to be any time soon....

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#16

Post by kibwen »

tsimionescu wrote: post #8

I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.

Ironically, given that the primary use case for developing quantum computers is breaking classical encryption, switching en-masse to post-quantum schemes may very well ensure that developing a working quantum computer may never be economically viable to develop.

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#17

Post by plopilop »

tsimionescu wrote: post #8

I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.

Y2K devs had it easy, they knew the bug would arrive and when.

The problem with PQC is not that nobody knows when a CRQC (cryptographically relevant quantum computer) will appear, but that by the time it appears, you are already ~10 years too late for migrating (5 years of migration time and 5 years of your adversary silently storing all your classical crypto messages to decrypt them at a later time, the "harvest now decrypt later" attack).

Of course the HNDL attack is only relevant for the most critical pieces of infrastructures, 99% of companies are not a real target for that, especially given the storage cost of such an attack.

There is also the "trust now, forge later" attack, in which a CRQC could break a chain of trust (i.e. digital signatures), and that attack does not need any storage besides the logs of past messages. If you want to guarantee authenticity and unforgeability of your logs for, say, 20 years, you better hope that no CRQC appears by 2050 at least. Once again, it only concerns maybe 1% of companies.

But hey, these 1% companies are exactly the ones that are needing specialised crypto equipment so the move from ANSSI tracks.

I personally do not believe a CRQC will appear before 2050 either. I am willing to bet some money on it, despite researchers in quantum computers being quite confident it will appear in the next 15 years, but I am not willing to bet the entirety of Internet security on it.

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#18

Post by zamadatix »

tsimionescu wrote: post #8

I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.

It's only reasonable to call past decisions comical when you can look back and say there was certainly no reason to have ever been concerned at the time with the information and certainty of the time, not whether or not it actually turned out that way in the future and you get to judge the response with the outcome already in hand.

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#19

Post by khurs »

jmward01 wrote: post #11
tsimionescu wrote: post #8

I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.

You prepare for the 9.0 earthquake that can happen once in 500 years because it is a 9.0 earthquake and if you haven't prepared your society is dead, not because you think it will most likely happen in your lifetime.

Most countries don't prepare for earthquakes. Only countries that get earthquakes do.

YAGNI - https://en.wikipedia.org/wiki/You_aren%27t_gonna_need_it

Re: France's Anssi Will Block PQC-Free Products from Certification Starting 2027

#20

Post by dredmorbius »

PQC: Post-Quantum Cryptography.

The concern is systems which won't be resistant against quantum cryptographic attacks.

The US's NIST has an explainer page, "Post-Quantum Cryptography PQC":

https://csrc.nist.gov/projects/post-quantum-cryptography>.

Post reply on HN