Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare targets 2029 for full post-quantum security

blog.cloudflare.com

Post reply on HN
Print view View original

101–110 of 120 posts

Re: Cloudflare targets 2029 for full post-quantum security

#101

Post by tptacek »

lmm wrote: post #90
tptacek wrote: post #81

Earlier quoted context omitted.

Lattice cryptography was a contender alongside curves as a successor to RSA. It's not new. The specific lattice constructions we looked at during NIST PQC were new iterations on it, but so was Curve25519 when it was introduced. It's extremely not a rush job. The elephant in the room in these conversations is Daniel Bernstein and the shade he has been casting on MLKEM for the last few years. The things I think you sho…

Bernstein's ego is at a level where he thinks most other people are idiots (not without some justification), that's been clear for decades. What are you hinting at?

I'm not saying anything about his ego or trying to psychoanalyze him. I'm saying: he attempted to get a lattice scheme standardized under the NIST PQC contest, and now fiercely opposes the standard that was chosen instead.

Re: Cloudflare targets 2029 for full post-quantum security

#103

Post by ifwinterco »

thenewnewguy wrote: post #52
PUSH_AX wrote: post #20

Earlier quoted context omitted.

Nothing has been broken yet, however data can be collected now and be cracked when the time comes, hence why there is a push.

Can a theoretical strong enough quantum computer break PFS?

If you store a whole session of traffic from today you can break the key exchange with a quantum computer in the future.

AES probably can't be broken but that's irrelevant because in this scenario you have the key in plaintext from the key exchange

Re: Cloudflare targets 2029 for full post-quantum security

#104

Post by ZiiS »

PunchyHamster wrote: post #54
jeroenhd wrote: post #28

Earlier quoted context omitted.

If any kind of proof about serious quantum computers comes to light, browsers can force most websites' hand by marking non-PQ ciphers as insecure. Maybe it'll require TLS 1.4/QUIC 2, with no changes but the cipher specifications, but it can happen in two or three years. Certificates themselves don't last longer than a year anyway. Corporations running ancient software that doesn't support PQ TLS will have the same co…

There is no reason to not support non quantum safe algorithms for foreseeable future in the first place

They are slower, larger, and less tested. Specifically the hope was to develop hybrids that could also provably be more pre-quantum secure then what they are replacing. History dose not favour rushing cryptography.

Re: Cloudflare targets 2029 for full post-quantum security

#105

Post by Hendrikto »

ZiiS wrote: post #104
PunchyHamster wrote: post #54

Earlier quoted context omitted.

There is no reason to not support non quantum safe algorithms for foreseeable future in the first place

They are slower, larger, and less tested. Specifically the hope was to develop hybrids that could also provably be more pre-quantum secure then what they are replacing. History dose not favour rushing cryptography.

You misread the comment you replied to.

Re: Cloudflare targets 2029 for full post-quantum security

#107

Post by GoblinSlayer »

jeroenhd wrote: post #28
rdl wrote: post #18

It will be interesting to compare PQ rollout to HTTPS rollout historically (either the "SSL becomes widespread in 2015" thing, or the deprecation SSL 3.0). Cloudflare is in an easy position to do stuff like this because it can decouple end user/browser upgrade cycles from backend upgrade cycles. Some browsers and some end user devices get upgraded quickly, so making it easy to make it optionally-PQ on any site, and t…

If any kind of proof about serious quantum computers comes to light, browsers can force most websites' hand by marking non-PQ ciphers as insecure. Maybe it'll require TLS 1.4/QUIC 2, with no changes but the cipher specifications, but it can happen in two or three years. Certificates themselves don't last longer than a year anyway. Corporations running ancient software that doesn't support PQ TLS will have the same co…

When you connect, you specify supported ciphers. If the server doesn't support them, there's standard "insufficient security" (71) error that was there since at least TLS 1.0, maybe earlier.

Re: Cloudflare targets 2029 for full post-quantum security

#108

Post by KAMSPioneer »

Hendrikto wrote: post #105
ZiiS wrote: post #104

Earlier quoted context omitted.

They are slower, larger, and less tested. Specifically the hope was to develop hybrids that could also provably be more pre-quantum secure then what they are replacing. History dose not favour rushing cryptography.

You misread the comment you replied to.

Which, to be fair, is easy to do because they used a triple-negative.

Rephrased, they meant to say "there is no reason to remove support for quantum-vulnerable algorithms in the near future."

IMO that's much less likely to be accidentally misinterpreted.

Re: Cloudflare targets 2029 for full post-quantum security

#109

Post by GoblinSlayer »

fc417fc802 wrote: post #80
stingraycharles wrote: post #24

Earlier quoted context omitted.

> Updating websites is going to be so much easier than dealing with other systems (bitcoin probably the worst; data at rest storage systems; hardware). IPv6 deserves a prominent spot there

Does it? That one is different because IPv4 with CGNAT largely "just works" except for P2P type stuff. As a result there's a strong incentive for anyone who has a working setup to just not care. I can use myself as an example here. IPv6 is supported by all my hardware, all the software I use, and my ISP provides it. Yet my LAN intentionally remains IPv4 only with NAT. Why? Because adding IPv6 to my LAN would require…

https://blog.exe.dev/ssh-host-header

Re: Cloudflare targets 2029 for full post-quantum security

#110

Post by draw_down »

sophacles wrote: post #19
moi2388 wrote: post #14

Earlier quoted context omitted.

Theory. And afaik there are still questions as to if the PQ algorithms are actually secure.

tbf - since we still don't know if p != np, there are still questions about if the current algorithms are secure also.

[dead]
Post reply on HN