Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST selects HQC as fifth algorithm for post-quantum encryption

nist.gov

Post reply on HN
Print view View original

101–110 of 126 posts

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#101

Post by tptacek »

bawolff wrote: post #98
bobsmooth wrote: post #88

Don't get me wrong, it's good to be prepared, but what are the chances we'll need these algorithms by 2050?

Predicting anything 25 years out is a fool's errand. Cryptographically relavent Quantum computers are definitely not happening in the near term, but 25 years is a long enough time horizon that it is plausible. Just consider what tech was like 25 years ago. Would anyone (without the benefit of hindsight) in 1999 really be able to predict modern AI, the ubiquity of smart phones, etc. Heck 25 years ago people still thou…

Except for RC4, which people were side-eyeing on Usenet in the 1990s, and key size progress, I think the cryptography primitives we were using 25 years ago have held up reasonably well. A lot of things that have been major issues since then are things that we know theoretically back in 2000, but just didn't know viscerally, because people hadn't written exploits. That's not the same thing as, like, Peter Schwabe's take on whether a particular key exchange or KEM is likely to survive until 2050.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#102

Post by rsfern »

bdcravens wrote: post #99

Completely off-topic, but in today's climate, I worry about any department like this having their efforts rendered moot if they become a DOGE target.

It’s not that off topic IMO, NIST (along with all the other federal agencies) is finalizing restructuring/reorganization plans this week in response to one of last month’s executive orders. It’s not clear when the extent of the cuts will be announced, or what the criteria will be for which programs are to be affected. Though in the Commerce secretary’s confirmation hearing there was mostly good will towards this kind of light touch non-regulatory standardization approach that NIST tries to take

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#103

Post by natch »

tptacek wrote: post #64
natch wrote: post #60

Earlier quoted context omitted.

You are tptacek; I believe you know exactly what I meant. But to indulge you, do you think we can know that the selection process is not comprised?

Explain what the compromised selection process does here. NIST doesn't control the submissions.

Your question presupposes a claim that the selection process is compromised. I'm not saying it is. I just wonder how we know it's not.

In NIST's position one could analyze the submissions for vulnerabilities to closely held (non-public) attacks, then select submissions having those vulnerabilities.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#104

Post by MidnightRider39 »

grayhatter wrote: post #95
MidnightRider39 wrote: post #93

Earlier quoted context omitted.

The problem is more that people concentrate a lot of energy on hypothetical future quantum attacks when the actual threats have been the same since the 00s: unvalidated input, buffer overflow, bad auth, xss, injection etc. All the big important systems are again and again vulnerable to these attacks (Cisco, M$, fortinet, etc.) - but of course those aren’t “sexy” problems to research and resolve, so we get the same st…

It's a mistake to conflate cryptography, with application logic errors. Your argument is akin to, > The problem is that a lot of physicians concentrate on diabetes, or hypertension, when there's people who have been stabed, or shot. Constantly hearing about how heart disease is a big problem is tiring to be honest. Also, I'm not sure what circles you run in, but if you had to ask any of my security friends if they wa…

> any of my security friends if they wanted to spend time on … quantum

I commend your friends but many people in these HN threads seem to be ready to implement post-quantum encryption right now to protect against some future threats.

> you meant having the qbits to deploy such an attack, right

Yes - last time I checked it was like 3 stable qbits. It’s just so far off from being a reality i really can’t take that research seriously. I feel like a lot of resources are wasted in this kind of research when we are still dealing with very basic problems that aren’t just as sexy to tackle.

Edit: heart disease is a real thing so your analogy is lacking - there have been 0 security risks because of quantum in the real world. It’s more like “physicians concentrating on possible alien diseases from when we colonise the universe in the future while ignoring heart disease”

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#105

Post by natch »

affinepplan wrote: post #79
natch wrote: post #50

Earlier quoted context omitted.

If you think the bad actors are only on one side, you are in a bubble that is feeding you bad information.

yes, and if you think the _number_ of bad actors on each side are even CLOSE to similar in magnitudes then you are in a bubble that is feeding you bad information

I would just encourage you to keep your eyes open and listen to the other side, and revisit this post and see how it ages.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#107

Post by coppsilgold »

buu700 wrote: post #49
EGreg wrote: post #36

What is your favorite post-quantum encryption approach? I think Lattice-based ones will eventually be broken by a quantum algorithm. I am fully on board with lamport signatures and SPHINCS+

In Cyph, I went with Kyber (lattice-based) combined with HQC (code-based) for encryption. NTRU Prime also may be a good option if Kyber is ever broken in a way that doesn't fundamentally break all lattice crypto. For signing, I treat Dilithium (lattice-based) as "standard security" and SPHINCS+ (hash-based) as "high security". In particular, the former is used for end user public keys and certificates, while the latt…

> In all cases, I wouldn't use PQC without combining it with classical crypto

With hash-based signatures, hybridization isn't required. They are the most powerful signature scheme approach by far. The security assumption hash-based signatures rely on is also shared with every other signature scheme (hashes are what are signed). Other schemes come with additional assumptions.

It's unfortunate that hash-based public key exchange is not practical. Merkle Puzzles require 2^n data exchange for 2^2n security.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#108

Post by adgjlsfhk1 »

dist-epoch wrote: post #82
FateOfNations wrote: post #74

Earlier quoted context omitted.

Given how seriously the spookie parts of the US government are taking it, I would treat it with a similar level of urgency. While we obviously aren't privy to everything they know, their public actions indicate that they don't think it's a hypothetical risk, and is something that we will need to be ready for within the next decade or so, given technology refresh cycles: they need to get these crypto algorithms in pla…

> Given how seriously the spookie parts of the US government are taking it, I would treat it with a similar level of urgency Various US standards require encryption algorithms to be considered safe for the next 30 years. Sufficiently big quantum computers are likely in the next 30 years, but it's not urgent in any other meaning of the word.

given how sticky crypto algorithms are, transitioning early is a really good idea. git is still stuck with SHA1, and there's plenty of triple DES hiding in the boring types of critical infrastructure that no one can update.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#109

Post by buu700 »

coppsilgold wrote: post #107
buu700 wrote: post #49

Earlier quoted context omitted.

In Cyph, I went with Kyber (lattice-based) combined with HQC (code-based) for encryption. NTRU Prime also may be a good option if Kyber is ever broken in a way that doesn't fundamentally break all lattice crypto. For signing, I treat Dilithium (lattice-based) as "standard security" and SPHINCS+ (hash-based) as "high security". In particular, the former is used for end user public keys and certificates, while the latt…

> In all cases, I wouldn't use PQC without combining it with classical crypto With hash-based signatures, hybridization isn't required. They are the most powerful signature scheme approach by far. The security assumption hash-based signatures rely on is also shared with every other signature scheme (hashes are what are signed). Other schemes come with additional assumptions. It's unfortunate that hash-based public ke…

That's fair. I'd basically agree, which is why I decided not to hybridize SPHINCS+ with Dilithium as I did with the two post-quantum encryption algorithms.

Having said that, while SPHINCS+ seems highly likely to be safe (particularly as far as PQC goes), it isn't impossible that someone finds a flaw in e.g. the construction used to implement statelessness. It's probably fine on its own, and stacking it with something like RSA is maybe more trouble than it's worth, but there's also very little downside to hybridizing with Ed25519 given its overhead relative to SPHINCS+; 64 bytes on top of a ~30 KB signature is practically a rounding error.

(Also, small correction to my last comment: only the SPHINCS+ signatures are large, not the public keys.)

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#110

Post by mistercheph »

tptacek wrote: post #81
immibis wrote: post #80

Earlier quoted context omitted.

Seems pretty obvious no? 1. Pretend to be someone else and enter a backdoored algorithm. Or pressure someone to enter a backdoored algorithm for you. Or just give them the algorithm for the reward of being the winner. 2. Be NIST, and choose that algorithm.

You think someone is going to pretend to be Chris Peikert and submit a backdoored construction as him, and that's going to work? This is the problem with all these modern NIST contest theories. They're not even movie plots. Your last bit, about them paying someone like Peikert off, isn't even coherent; they could do that with or without the contest.

> they could do that with or without the contest

Then why does the contest give you any more confidence that the selection isn't backdoored?

Post reply on HN