Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST announces first PQC algoritms to be standardized

groups.google.com

Post reply on HN
Print view View original

101–110 of 132 posts

Re: NIST announces first PQC algoritms to be standardized

#101

Post by tptacek »

chasil wrote: post #35
layer8 wrote: post #22

Earlier quoted context omitted.

OpenSSH has merely chosen that as its current default. Surely multiple algorithms will be supported in the future as they have in the past.

There was considerable strife for Daniel J. Bernstein during this competition. https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c... It would not surprise me if OpenSSH only chooses to add SPHINCS+ and refuses the others.

What does Bernstein's process complaint about NIST's process complaint about him have to do with which ciphersuites OpenSSH will support?

Re: NIST announces first PQC algoritms to be standardized

#102

Post by kragen »

tptacek wrote: post #99
kragen wrote: post #98

Presumably since Dual_EC_DRBG it is counterproductive to rely on NIST's recommendations for secure cryptography. What should we rely on instead?

https://news.ycombinator.com/item?id=31994063

No post body was provided.

Re: NIST announces first PQC algoritms to be standardized

#103

Post by cpeterso »

elromulous wrote: post #6

PQC = post quantum cryptography

Looks like the name “CRYSTALS-KYBER” is a Star Wars reference (kyber crystals). At least one of the authors of CRYSTALS-KYBER (Peter Schwabe) published an earlier PQC algorithm called “NewHope”, another Star Wars reference.

And “CRYSTALS-DILITHIUM” is, obviously, a Star Trek reference. :)

Re: NIST announces first PQC algoritms to be standardized

#105

Post by NavinF »

marcosdumay wrote: post #38
NavinF wrote: post #27

Earlier quoted context omitted.

"When will 256 bit ECC become insecure?" : https://www.metaculus.com/questions/8169/?invite=GpV2Dc The community prediction is 22% by 2032 which seems way too high IMO. I predict 5% due to advances in automated algorithm search and 0% due to quantum computers in that time frame.

Why would a croudsoursing site know that? This is the kind of question where 1 expert will fare better than the average of 90% of the people.

Sure. If that 1 expert bothered to post a falsifiable prediction like “x% likely this’ll happen by year y”, the rest of us could read their argument and update our predictions.

Unfortunately that’s pretty uncommon so everyone has to go by base rates (crypto algorithms seem to last x years historically) and vague guesses (quantum computer capabilities seem to be doubling every x years so I dunno maybe enough qbits by 2050)

Re: NIST announces first PQC algoritms to be standardized

#106

Post by tptacek »

kragen wrote: post #100
google234123 wrote: post #78

Earlier quoted context omitted.

Bernstein seems to be involved in never ending drama. Maybe the problem is him?

Bernstein being "involved in never-ending drama" is the reason it's legal to export strong cryptography from the US today and the reason much of this PQC work got done at all. He's clearly a person who often fights in cases where almost everyone else surrendered instead, which is presumably what you mean by "the problem is him," but I don't see why you describe it as a "problem". His inclination to tell hard truths,…

It doesn't seem reasonable to say that Bernstein is the reason much of this PQC work got done at all.

He was one of the earliest PQC popularizers and probably coined the term. But asserting that he enabled everyone else's work is a little like saying that the person who coined "misuse-resistant authenticated encryption" enabled all the different misuse-resistant schemes; the underlying issue was plainly evident, and people were obviously going to work on it.

Your last sentence falls afoul of the HN guidelines, and your comment would be far stronger without it. Which is unfortunate, since there's an interesting and curious conversation to be had about the significance of Bernstein's role in PQC.

Re: NIST announces first PQC algoritms to be standardized

#107

Post by chasil »

tptacek wrote: post #101
chasil wrote: post #35

Earlier quoted context omitted.

There was considerable strife for Daniel J. Bernstein during this competition. https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c... It would not surprise me if OpenSSH only chooses to add SPHINCS+ and refuses the others.

What does Bernstein's process complaint about NIST's process complaint about him have to do with which ciphersuites OpenSSH will support?

OpenSSH appears to have disregarded NIST, and made their own determination on a pq-kex.

Should NIST be disregarded?

NTRU-prime is not a finalist, but OpenSSH has decided that the NIST designation is irrelevant.

https://www.openssh.com/releasenotes.html

ssh(1), sshd(8): use the hybrid Streamlined NTRU Prime + x25519 key exchange method by default ("sntrup761x25519-sha512@openssh.com"). The NTRU algorithm is believed to resist attacks enabled by future quantum computers and is paired with the X25519 ECDH key exchange (the previous default) as a backstop against any weaknesses in NTRU Prime that may be discovered in the future. The combination ensures that the hybrid exchange offers at least as good security as the status quo.

We are making this change now (i.e. ahead of cryptographically- relevant quantum computers) to prevent "capture now, decrypt later" attacks where an adversary who can record and store SSH session ciphertext would be able to decrypt it once a sufficiently advanced quantum computer is available.

Re: NIST announces first PQC algoritms to be standardized

#109

Post by tptacek »

chasil wrote: post #107
tptacek wrote: post #101

Earlier quoted context omitted.

What does Bernstein's process complaint about NIST's process complaint about him have to do with which ciphersuites OpenSSH will support?

OpenSSH appears to have disregarded NIST, and made their own determination on a pq-kex. Should NIST be disregarded? NTRU-prime is not a finalist, but OpenSSH has decided that the NIST designation is irrelevant. https://www.openssh.com/releasenotes.html ssh(1), sshd(8): use the hybrid Streamlined NTRU Prime + x25519 key exchange method by default ("sntrup761x25519-sha512@openssh.com"). The NTRU algorithm is believed t…

I personally think NIST should be disregarded, but you can disregard NIST and still end up with CRYSTALS-KYBER as your default PQC KEM, on its own merits, which can include the fact that NIST's standardization spurs so much implementation of CRYSTALS-KYBER that it becomes a de facto standard in addition to a de jure standard. (Same for signatures, and so on).

People with qualms about NIST might also reasonably have qualms about AES. And there is a common cipher that people use outside of AES --- Chapoly. But it would be downright weird to use, like, Serpent or Twofish; it would be the cryptography equivalent of a "code smell". Chapoly and AES are the de facto standards, and OpenSSH supports both.

Again though: my question is just, what does this (frankly weird) Bernstein complaint have to do with any of it? Bernstein himself is a NISTPQC participant; he's on one of the (large) winning signature teams.

(I think all the technical details here are super interesting, but not especially motivating; I'm not a cryptographer and you should disregard me as well, but my basic take on QC crypto attacks is "Rodents of unusual size? I don't think they exist.")

Re: NIST announces first PQC algoritms to be standardized

#110

Post by tptacek »

bioemerl wrote: post #108

Something that worries me, if someone cracks our current encryption using quantum computers couldn't they be logging everything we say right now and everything we say right now is actually unsecure to someone 10 years in the future?

Yes. That's, for instance, why people say the KEM problem has more urgency than the signature problem; a PQC KEM is what you need today if you're worried that someone's archiving your TLS sessions so they can break them with the quantum computer their government promised them for Christmas in 2034. Even if your KEX involves a signature, your adversary can't time-travel back to 2022 to break it with their 2034 scooty-puff quantum edition. But if all you've got is classical ECC and RSA, you're in trouble.

If you assume the PQC KEM doesn't interact with classical ECDH, you might want to get some kind of PQC KEM rolled out as quickly as you can, in a dual construction with ECDH; the worst that happens is, your new KEM isn't quantum-safe (or anything-safe), but your ECDH holds up. But that's (if you believe in quantum attacks on crypto) still better than no PQC KEM at all.

Post reply on HN