Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST selects HQC as fifth algorithm for post-quantum encryption

nist.gov

Post reply on HN
Print view View original

111–120 of 126 posts

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#111

Post by __MatrixMan__ »

whimsicalism wrote: post #12

Give how quickly quantum is potentially coming, I wonder if we should/could find some way of using multiple quantum-resistant algorithms simultaneously as a default, in case a fault is found after the limited time we have to verify that there are no faults. Also - should we not be switching over to these algorithms starting like... now? Am I wrong that anyone collecting https traffic now will be able to break it in t…

It's not clear whether NIST's recommendations are influenced by their relationship with the NSA (who would have an incentive to pressure NIST to recommend an algorithm which they--and hopefully they alone--can break). So perhaps the reasonable move is to use only one NIST-recommended algorithm and have the other layer be one that they do not recommend.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#112

Post by jeffrallen »

__MatrixMan__ wrote: post #111
whimsicalism wrote: post #12

Give how quickly quantum is potentially coming, I wonder if we should/could find some way of using multiple quantum-resistant algorithms simultaneously as a default, in case a fault is found after the limited time we have to verify that there are no faults. Also - should we not be switching over to these algorithms starting like... now? Am I wrong that anyone collecting https traffic now will be able to break it in t…

It's not clear whether NIST's recommendations are influenced by their relationship with the NSA (who would have an incentive to pressure NIST to recommend an algorithm which they--and hopefully they alone--can break). So perhaps the reasonable move is to use only one NIST-recommended algorithm and have the other layer be one that they do not recommend.

Or just ask NIST to STFU about cryptographic systems entirely, because their integrity is completely destroyed by their association with NSA.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#113

Post by kerkeslager »

MidnightRider39 wrote: post #94
kerkeslager wrote: post #76

Earlier quoted context omitted.

I agree with you based on my following QC that we're still pretty far away from QC attacks on current crypto. The problem is, this sort of question suffers from a lot of unknown unknowns. How confident are you that we don't see crypto broken by QC in the next 10 years? The next 20? Whatever your confidence, the answer is probably "not confident enough" because the costs of that prediction being wrong are incalculable…

You don’t need any QC attacks if you can far easier find exploits in the same top10 vulns that were used 20 years ago… Industry should first address that very real and serious risk that is present _right now_ before thinking about QC.

It's a fallacy that multiple companies and governments need to be working on one thing at a time. We absolutely should be patching current vulnerabilities and implementing quantum-safe cryptography. There's no conflict between these goals.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#114

Post by snowwrestler »

MidnightRider39 wrote: post #104
grayhatter wrote: post #95

Earlier quoted context omitted.

It's a mistake to conflate cryptography, with application logic errors. Your argument is akin to, > The problem is that a lot of physicians concentrate on diabetes, or hypertension, when there's people who have been stabed, or shot. Constantly hearing about how heart disease is a big problem is tiring to be honest. Also, I'm not sure what circles you run in, but if you had to ask any of my security friends if they wa…

> any of my security friends if they wanted to spend time on … quantum I commend your friends but many people in these HN threads seem to be ready to implement post-quantum encryption right now to protect against some future threats. > you meant having the qbits to deploy such an attack, right Yes - last time I checked it was like 3 stable qbits. It’s just so far off from being a reality i really can’t take that rese…

I think one reason people want to take it seriously is that to the non-expert it just looks like a scale engineering problem, and people have proven to be shockingly good at scale engineering over the past century.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#116

Post by daghamm »

jonmon6691 wrote: post #20
whimsicalism wrote: post #12

Give how quickly quantum is potentially coming, I wonder if we should/could find some way of using multiple quantum-resistant algorithms simultaneously as a default, in case a fault is found after the limited time we have to verify that there are no faults. Also - should we not be switching over to these algorithms starting like... now? Am I wrong that anyone collecting https traffic now will be able to break it in t…

Correct, KEM's should be replaced ASAP since they are currently vulnerable to store-now-decrypt-later attacks. Digital signature algorithms are less urgent but considering how long it takes to roll out new cryptography standards, they should be preferred for any new designs. That said, the new PQC signatures are much larger than the current 32 byte ed25519 signatures that are most common, and that could end up being…

Sorry, can you expand on the issues with KEM?

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#117

Post by chowells »

0xDEAFBEAD wrote: post #90
formerly_proven wrote: post #65

Earlier quoted context omitted.

Do not! Use a combiner / KDF.

Curious why this is being downvoted.

Almost certainly because of the inappropriately aggressive tone for what would otherwise be a nice clean clarification. I just said "split" and "combine", making it possible to believe I literally meant "put half the bits in each". That's so bad of an idea that I was sure no one would think I meant that. But I can see how I wasn't clear enough. An additional clarification is good info.

But the way it was posted is so inappropriately aggressive that I think people were downvoting based on tone alone.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#118

Post by tptacek »

mistercheph wrote: post #110
tptacek wrote: post #81

Earlier quoted context omitted.

You think someone is going to pretend to be Chris Peikert and submit a backdoored construction as him, and that's going to work? This is the problem with all these modern NIST contest theories. They're not even movie plots. Your last bit, about them paying someone like Peikert off, isn't even coherent; they could do that with or without the contest.

> they could do that with or without the contest Then why does the contest give you any more confidence that the selection isn't backdoored?

It's not the contest so much as the reputation of the winning team and the reputations of all the teams who did cryptanalytic work. Wait, I guess that means it is the contest. Well, there's your answer.

People on threads like these are pretending NIST was a shadowy force making secret determinations, but the whole thing happens in the open, and NIST is essentially just proctoring.

A lot of this kind of thing is just people telling on themselves that they don't follow the field and don't trust any cryptography not done by one of the three cryptographers they've ever heard of.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#119

Post by MidnightRider39 »

kerkeslager wrote: post #113
MidnightRider39 wrote: post #94

Earlier quoted context omitted.

You don’t need any QC attacks if you can far easier find exploits in the same top10 vulns that were used 20 years ago… Industry should first address that very real and serious risk that is present _right now_ before thinking about QC.

It's a fallacy that multiple companies and governments need to be working on one thing at a time. We absolutely should be patching current vulnerabilities and implementing quantum-safe cryptography. There's no conflict between these goals.

The reality is that resources are constrained and there is definitely conflict between different goals - if you invest in one thing you can’t invest as much in another. For me it looks like the investment in QC is way bigger than its real life impact - which is 0. Sure it can be a niche field for some more esoteric research - but it shouldn’t be the no1 topic for security researchers. But I get that QC brings in the grant money so naturally research gravitates toward it.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#120

Post by daghamm »

mmooss wrote: post #106
bobsmooth wrote: post #88

Don't get me wrong, it's good to be prepared, but what are the chances we'll need these algorithms by 2050?

There are many secrets created 25 years ago that need to be secure now; think of national security secrets.

US is pushing for these to replace classic crypto in commercial applications by 2030.

The C in CNSA 2.0 is for "Commercial".

Post reply on HN