Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Experimenting with Post-Quantum Cryptography

security.googleblog.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Experimenting with Post-Quantum Cryptography

#11

Post by aruss »

bradleyjg wrote: post #4

As I understand it that the picture for symmetric encryption in a quantum computer world is still relatively rosy. The key strength of something like AES is halved, but with the important caveat that the difficulty is with respect to quantum operations rather than classical operations and there's no guarantee quantum computers will be able to scale as well over time as silicon has. The situation for asymmetric encryp…

That's right, symmetric encryption is fine. You're also right that protocols that rely on factoring or discrete log (more generally, any hidden subgroup problem) will be broken by quantum computers. However, this still means symmetric encryption is in trouble; namely in that we still need a post-quantum method for exchanging keys, otherwise symmetric ciphers will be virtually useless.

Re: Experimenting with Post-Quantum Cryptography

#12

Post by DenisM »

a hypothetical, future quantum computer would be able to retrospectively decrypt any internet communication that was recorded today, and many types of information need to remain confidential for decades. Thus even the possibility of a future quantum computer is something that we should be thinking about today.

Uh-oh.

Apparently not even Perfect Forward Secrecy can protect against this: https://en.wikipedia.org/wiki/Forward_secrecy#Attacks

Re: Experimenting with Post-Quantum Cryptography

#14

Post by andrewclunn »

hackaflocka wrote: post #9

Upvote for hearing "post-quantum" for the first time in my life. I suspect Deepak Chopra is going to appropriate it soon enough.

When you realize that your soul is already entangled with existence on a quantum level, your consciousness can achieve post-quantum awareness...

Re: Experimenting with Post-Quantum Cryptography

#15

Post by agl »

tptacek wrote: post #13

Are the TLS constructions they're using documented anywhere? Is this a combination of Ring-LWE and, say, ECC, in case there are as-yet-unknown implementation faults in Ring-LWE?

We haven't written a spec because we don't intend for this to be widespread. However, the spec would basically be: run both X25519 and NewHope concurrently, concatenate their outputs and feed that into the TLS KDF as normal.

It is indeed a combination of R-LWE and ECC because it doesn't yet seem reasonable to depend on R-LWE alone. Not only because of the possibility of implementation faults in NewHope, but also because of the possibility of significant crypto-analytic advances against R-LWE, even with classical computers.

Re: Experimenting with Post-Quantum Cryptography

#16

Post by NobleSir »

agl wrote: post #15
tptacek wrote: post #13

Are the TLS constructions they're using documented anywhere? Is this a combination of Ring-LWE and, say, ECC, in case there are as-yet-unknown implementation faults in Ring-LWE?

We haven't written a spec because we don't intend for this to be widespread. However, the spec would basically be: run both X25519 and NewHope concurrently, concatenate their outputs and feed that into the TLS KDF as normal. It is indeed a combination of R-LWE and ECC because it doesn't yet seem reasonable to depend on R-LWE alone. Not only because of the possibility of implementation faults in NewHope, but also beca…

Maybe this is a naive question, not knowing chrome well, but is the source available? Would love to play around with this..

Re: Experimenting with Post-Quantum Cryptography

#18

Post by Retr0spectrum »

bognition wrote: post #17
Retr0spectrum wrote: post #8

Could someone replace the link with the non-mobile version? https://security.googleblog.com/2016/07/experimenting-with-p...

just remove ?m=1 from the end of the url

If 1000 people need to do that, the few seconds it takes quickly adds up.

It would be much easier if the original link was changed.

Re: Experimenting with Post-Quantum Cryptography

#19

Post by baby »

NobleSir wrote: post #16
agl wrote: post #15

Earlier quoted context omitted.

We haven't written a spec because we don't intend for this to be widespread. However, the spec would basically be: run both X25519 and NewHope concurrently, concatenate their outputs and feed that into the TLS KDF as normal. It is indeed a combination of R-LWE and ECC because it doesn't yet seem reasonable to depend on R-LWE alone. Not only because of the possibility of implementation faults in NewHope, but also beca…

Maybe this is a naive question, not knowing chrome well, but is the source available? Would love to play around with this..

https://github.com/google/boringssl/blob/master/include/open...

Re: Experimenting with Post-Quantum Cryptography

#20

Post by baby »

Frank2312 wrote: post #6
Trufa wrote: post #3

> We explicitly do not wish to make our selected post-quantum algorithm a de-facto standard Like so many other things in computer science history, that seems like a great way to make it the de-facto standard.

If Google manages to prove it works and there are no better alternatives later on, then it will probably become the de-facto standard. However, the second condition seems to not be met if Google is right, because they mention there are promising papers published. ­>Since we selected New Hope, we've noted two promising papers in this space, which are welcome.

There is also the fact that "as of now" efficient quantum computers capable to break our crypto is fiction.
Post reply on HN