Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Post-Quantum Future for Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

101–110 of 175 posts

Re: A Post-Quantum Future for Let's Encrypt

#101

Post by tptacek »

m463 wrote: post #99
skmurphy wrote: post #34

We are truly living in a science fiction future where quantum code cracking is not a remote possibility but a near term risk we are planning for. In Vernor Vinge's novel "A Fire Upon the Deep" one of the most valuable commodities were one time pads that are physically transported to communication nodes to enable unbreakable communication. The pads are split into three pieces that are XORed to create the actual pad to…

I've always thought creating an ssh-otp should be easy to implement. (meaning xor the packets themselves with a huge bundle of random data duplicated at each side, and never re-used) But I think it would probably still qualify as a munition and have export restrictions.

One time pads are absurdly easy to implement. They're just impossible to use. What would be the benefit of ssh-otp?

Re: A Post-Quantum Future for Let's Encrypt

#102

Post by tialaramex »

zem wrote: post #70
tialaramex wrote: post #48

Earlier quoted context omitted.

But that's a miss, it's like one of those Neal Stephenson moments where the creator is using the right language (so it's not like reading William Gibson who clearly has no idea and knows it - he's going for the emotional feel not the technology) but they don't understand what's actually going on. OTP is in theory the correct choice if you don't have working symmetric cryptography but in fact the "Quantum computer" ap…

it's worth noting that the zones of thought universe literally had different physics; things like superintelligence and ftl travel were physically impossible closer to the galactic centre but commonplace further out. so the notion of "not physically practical" doesn't apply here.

The "Zones of Thought" is a fun premise for a story but I'm not sure it actually holds up. It is at least an excuse (unlike in say Iain M Banks which just has Star-Trek style "la la la I can't hear you" FTL travel that's basically magic) but I think the abandoned Eschaton series by Stross had a better excuse and even then Stross accidentally blew it up.

Maybe since our universe doesn't have FTL any author trying to make this work will almost inevitably screw it up? Like how the only novel I've read with the "Protagonist is much, much smarter than everybody else" that works does it by cheating - it's "Tatja Grimm's World" and [spoiler] Tatja isn't actually smarter than us everybody else on her world is stupid by our standards for reasons the plot justifies eventually.

Greg Egan, like some of the newer Stross novels, mostly says no FTL, you can go a long way but it takes a long time, for everybody else if not for you - suck it up. Which isn't a bad excuse, but also isn't FTL at all.

Re: A Post-Quantum Future for Let's Encrypt

#103

Post by tptacek »

mswphd wrote: post #89
tptacek wrote: post #83

Earlier quoted context omitted.

I didn't say Kyber/MLKEM or even LWE was a contender vs. curves in the 1990s; that wouldn't have made sense. I said lattice cryptography. As I understand it, our formal understanding of LWE is actually better than that of the original NTRU problem. I liken this to the original Certicom proposals from the 1990s versus Curve25519. There's a diversity of curve approaches (binary field Koblitz vs prime-field curves, etc;…

Yes I know. That was what my initial paragraph was about. And yes, our formal understanding of LWE is much better than the original NTRU problem. NTRU itself 1. admits non-trivial attacks if the ciphertext modulus is too large, as well as 2. had a signature algorithm (NTRU-sign) that was completely broken. Lattice-based signatures were actually a relatively thorny thing to develop. The first non-broken lattice-based…

Sure, two things:

(1) Cards on the table I don't pay attention to PQ signatures.

(2) I'm mostly just saying that LWE schemes and 90s NTRU are pretty closely related, more closely related than RSA and FFDH were (but less closely related than a binary Koblitz curve is to 25519).

Re: A Post-Quantum Future for Let's Encrypt

#104

Post by dundercoder »

skmurphy wrote: post #34

We are truly living in a science fiction future where quantum code cracking is not a remote possibility but a near term risk we are planning for. In Vernor Vinge's novel "A Fire Upon the Deep" one of the most valuable commodities were one time pads that are physically transported to communication nodes to enable unbreakable communication. The pads are split into three pieces that are XORed to create the actual pad to…

This is the second time in my life I’ve heard of this book. It was a wickedly weird book. I think I was 1/3rd through it before I figured out the plurality of the characters.

Re: A Post-Quantum Future for Let's Encrypt

#105

Post by mapt »

tialaramex wrote: post #48
skmurphy wrote: post #34

We are truly living in a science fiction future where quantum code cracking is not a remote possibility but a near term risk we are planning for. In Vernor Vinge's novel "A Fire Upon the Deep" one of the most valuable commodities were one time pads that are physically transported to communication nodes to enable unbreakable communication. The pads are split into three pieces that are XORed to create the actual pad to…

But that's a miss, it's like one of those Neal Stephenson moments where the creator is using the right language (so it's not like reading William Gibson who clearly has no idea and knows it - he's going for the emotional feel not the technology) but they don't understand what's actually going on. OTP is in theory the correct choice if you don't have working symmetric cryptography but in fact the "Quantum computer" ap…

In the High Beyond and the Lower Transcend, Horatio, there are more quantum algorithms than dreamt of in your philosophies.

Re: A Post-Quantum Future for Let's Encrypt

#106

Post by mswphd »

tptacek wrote: post #103
mswphd wrote: post #89

Earlier quoted context omitted.

Yes I know. That was what my initial paragraph was about. And yes, our formal understanding of LWE is much better than the original NTRU problem. NTRU itself 1. admits non-trivial attacks if the ciphertext modulus is too large, as well as 2. had a signature algorithm (NTRU-sign) that was completely broken. Lattice-based signatures were actually a relatively thorny thing to develop. The first non-broken lattice-based…

Sure, two things: (1) Cards on the table I don't pay attention to PQ signatures. (2) I'm mostly just saying that LWE schemes and 90s NTRU are pretty closely related, more closely related than RSA and FFDH were (but less closely related than a binary Koblitz curve is to 25519).

They are, my point is that this only became obvious later. The initial NTRU preprint frames it as a scheme based on modular polynomial arithmetic, rather than anything related to lattices. At the end of section 4 they even explicitly describe it as a “ring based cryptosystem” (contrasted with “group based cryptosystems”). As you say, now we would call it a lattice-based cryptosystem (over an algebraically structured lattice).

https://www.ntru.org/f/hps96.pdf

Re: A Post-Quantum Future for Let's Encrypt

#107

Post by zem »

tialaramex wrote: post #102
zem wrote: post #70

Earlier quoted context omitted.

it's worth noting that the zones of thought universe literally had different physics; things like superintelligence and ftl travel were physically impossible closer to the galactic centre but commonplace further out. so the notion of "not physically practical" doesn't apply here.

The "Zones of Thought" is a fun premise for a story but I'm not sure it actually holds up. It is at least an excuse (unlike in say Iain M Banks which just has Star-Trek style "la la la I can't hear you" FTL travel that's basically magic) but I think the abandoned Eschaton series by Stross had a better excuse and even then Stross accidentally blew it up. Maybe since our universe doesn't have FTL any author trying to m…

sure, the premise doesn't hold up as rigorous "hard" sf, like anything else involving ftl (though I do like the idea in the eschaton series that fine, you have ftl, but that doesn't make spacetime magically non-einsteinean). what I was getting at was that within that setting you cannot apply laws from our universe as to what forms of cryptography are physically infeasible to crack.

btw one of my favourite "the protagonist is much smarter than everyone else" novels is kress's badly underrated "an alien light", where sort of like tatja grimm she's a genius in a primitive society, but that comes to light when aliens try to teach the natives some basic science and she figures out a lot more than they bargained for.

Re: A Post-Quantum Future for Let's Encrypt

#108

Post by throwaway01632 »

BoppreH wrote: post #10

Interesting development. Merkle Tree Certificates throw away decades of cruft, but also decades of battle testing and ancillary tools. I trust the teams involved, but this will be a hell of a project. Still better than the alternatives that would saddle us with worse performance for ~ever.

Is there any value in first encrypting with a battle tested algorithm, and then encrypt again with the new algorithm?

Re: A Post-Quantum Future for Let's Encrypt

#109

Post by andai »

tialaramex wrote: post #48
skmurphy wrote: post #34

We are truly living in a science fiction future where quantum code cracking is not a remote possibility but a near term risk we are planning for. In Vernor Vinge's novel "A Fire Upon the Deep" one of the most valuable commodities were one time pads that are physically transported to communication nodes to enable unbreakable communication. The pads are split into three pieces that are XORed to create the actual pad to…

But that's a miss, it's like one of those Neal Stephenson moments where the creator is using the right language (so it's not like reading William Gibson who clearly has no idea and knows it - he's going for the emotional feel not the technology) but they don't understand what's actually going on. OTP is in theory the correct choice if you don't have working symmetric cryptography but in fact the "Quantum computer" ap…

But how do you do the key exchange?

Re: A Post-Quantum Future for Let's Encrypt

#110

Post by BoppreH »

throwaway01632 wrote: post #108
BoppreH wrote: post #10

Interesting development. Merkle Tree Certificates throw away decades of cruft, but also decades of battle testing and ancillary tools. I trust the teams involved, but this will be a hell of a project. Still better than the alternatives that would saddle us with worse performance for ~ever.

Is there any value in first encrypting with a battle tested algorithm, and then encrypt again with the new algorithm?

Yes! It's called a hybrid cryptosystem, and what most projects are planning to use.

The algorithms at risk are the asymmetric part (RSA, ECC, DH), not the symmetric parts (AES, ChaCha), so what is done for encryption is "generating" a secret with ML-KEM and another with ECC, combining them, and using that as key for AES or another symmetric algorithm for the actual encryption. So if you break only ECC or only ML-KEM, you don't get the combined secret. ML-KEM keys/ciphertext are small and efficient enough that this overhead is generally a non-issue.

Note that ECC can be used in many ways: asymmetric encryption, key encapsulation, or signatures. ML-KEM, the new post-quantum standard, is only a Key Encapsulation Mechanism. Hence the "generate an AES key" step, instead of "encrypt a random AES key".

For signatures, like in the announcement in the post, things are more complicated. The post is a very good introduction to the problem.

Post reply on HN