Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare targets 2029 for full post-quantum security

blog.cloudflare.com

Post reply on HN
Print view View original

111–120 of 120 posts

Re: Cloudflare targets 2029 for full post-quantum security

#111

Post by jeroenhd »

bwesterb wrote: post #30
jeroenhd wrote: post #28

Earlier quoted context omitted.

If any kind of proof about serious quantum computers comes to light, browsers can force most websites' hand by marking non-PQ ciphers as insecure. Maybe it'll require TLS 1.4/QUIC 2, with no changes but the cipher specifications, but it can happen in two or three years. Certificates themselves don't last longer than a year anyway. Corporations running ancient software that doesn't support PQ TLS will have the same co…

No need for a TLS 1.4. Leaf certificates don't last long, but root CAs do. An attacker can just mint new certs from a broken root key. Hopefully many devices can be upgraded to PQ security with a firmware update. Worse than not receiving updates, is receiving malicious firmware updates, which you can't really prevent without upgrading to something safe first.

> An attacker can just mint new certs from a broken root key.

In Chrome at the very least, the certificate not being in the certificate transparency logs should throw errors and report issues to the mothership, and that should detect abuse almost instantly.

You'd still be DoSing an entire certificate authority because a factored CA private key means the entire key is instantly useless, but it wouldn't allow attacks to last long.

Re: Cloudflare targets 2029 for full post-quantum security

#112

Post by bwesterb »

jeroenhd wrote: post #111
bwesterb wrote: post #30

Earlier quoted context omitted.

No need for a TLS 1.4. Leaf certificates don't last long, but root CAs do. An attacker can just mint new certs from a broken root key. Hopefully many devices can be upgraded to PQ security with a firmware update. Worse than not receiving updates, is receiving malicious firmware updates, which you can't really prevent without upgrading to something safe first.

> An attacker can just mint new certs from a broken root key. In Chrome at the very least, the certificate not being in the certificate transparency logs should throw errors and report issues to the mothership, and that should detect abuse almost instantly. You'd still be DoSing an entire certificate authority because a factored CA private key means the entire key is instantly useless, but it wouldn't allow attacks t…

Yeah, PQ certificate transparency is crucial for downgrade protection: https://westerbaan.name/~bas/rwpqc2026/bas.pdf

Re: Cloudflare targets 2029 for full post-quantum security

#113

Post by bwesterb »

ZiiS wrote: post #104
PunchyHamster wrote: post #54

Earlier quoted context omitted.

There is no reason to not support non quantum safe algorithms for foreseeable future in the first place

They are slower, larger, and less tested. Specifically the hope was to develop hybrids that could also provably be more pre-quantum secure then what they are replacing. History dose not favour rushing cryptography.

They are large, but they're not that slow actually. We've been testing them for almost a decade now. I agree that rushing is bad. That's why we need to start moving now, so that we're not rushing even closer to the deadline.

Re: Cloudflare targets 2029 for full post-quantum security

#114

Post by bwesterb »

bdeol22 wrote: post #106

2029 is plausible at Cloudflare's edge; the long tail is boring enterprise TLS configs someone last touched in 2017.

Yeah, it's rough. Important to understand now for each product / system what the business impact is if it's not upgraded in time.

Re: Cloudflare targets 2029 for full post-quantum security

#115

Post by bwesterb »

xienze wrote: post #51
tptacek wrote: post #33

Earlier quoted context omitted.

Among cryptography engineers there was a sharp vibe shift over the last 2 months; there are papers supporting that vibe shift, but there's also a rumor mill behind it too. The field has basically aligned fully in a way it hadn't before that this is an urgent concern. The simplest way to put it is that everyone's timeline for a real-world CRQC has shortened. Not everyone has the same timeline, but all those timelines…

> The field has basically aligned fully in a way it hadn't before that this is an urgent concern. AKA “we want more funding.”

You sure? Defenders get funding if things break—not when they actually did their job.

Re: Cloudflare targets 2029 for full post-quantum security

#117

Post by phicoh »

TacticalCoder wrote: post #82

Tangential question... Seen that many are already moving to QC-resistant cryptography and that more are shifting by the day... I've got a question: what are the implications of quantum computers going to be if we consider that the entirety of cryptography will have moved to quantum-resistant cryptography ? In other words: I only ever read about quantum computing when it's to talk about breaking cryptography. But what…

We can assume that organizations like NSA have collected a huge amount of traffic that is protected by RSA or EC. So they well have plenty of use for those quantum computers.

Re: Cloudflare targets 2029 for full post-quantum security

#118

Post by snowwrestler »

TacticalCoder wrote: post #82

Tangential question... Seen that many are already moving to QC-resistant cryptography and that more are shifting by the day... I've got a question: what are the implications of quantum computers going to be if we consider that the entirety of cryptography will have moved to quantum-resistant cryptography ? In other words: I only ever read about quantum computing when it's to talk about breaking cryptography. But what…

To start, I am NOT an expert on the underlying technologies. But I have some exposure to the topic at let’s say more like an ecosystem level.

There are tons of hypothesized applications for quantum computing based on the expectation it will provide better simulation of quantum effects for e.g. chemistry, and offer major speedups of highly parallel simulation problems like nuclear plasma or some things in finance. Easy to Google to learn more about these.

But keeping the focus squarely on the military and intelligence services, one answer to your question is that everyone is not going to switch to post-quantum cryptography instantaneously. It’s going to take a while, especially for a long tail of “infrastructure” type things like networking gear, “internet of things,” industrial sensors, etc. Things that national intelligence services might like to break into to enable breaking into other things.

Quantum breaks may also still succeed against stored encrypted data from before the switch to PQ. And for at least a couple decades, national intelligence services have been scaling up their storage resources. So they might have a “backlog” they can work through.

Finally, things don’t have to last forever. Everything the military / government builds has an expected lifespan, and it only has to be valuable during that life span. And risks can be rare but huge in national security. So if quantum code-breaking computers only help the NSA learn a few very important things for a limited time, that still might be “worth it” to them. Or if a quantum computer doesn’t break any important cryptography, but helps advance the engineering and enables better quantum computers in the future for other anpplications—again, still might be worth it.

Re: Cloudflare targets 2029 for full post-quantum security

#119

Post by rocqua »

GoblinSlayer wrote: post #107
jeroenhd wrote: post #28

Earlier quoted context omitted.

If any kind of proof about serious quantum computers comes to light, browsers can force most websites' hand by marking non-PQ ciphers as insecure. Maybe it'll require TLS 1.4/QUIC 2, with no changes but the cipher specifications, but it can happen in two or three years. Certificates themselves don't last longer than a year anyway. Corporations running ancient software that doesn't support PQ TLS will have the same co…

When you connect, you specify supported ciphers. If the server doesn't support them, there's standard "insufficient security" (71) error that was there since at least TLS 1.0, maybe earlier.

Confidentiality of the TLS connection is indeed easy to handle here.

The hard part is certificate authentication. And that's not included in the cipher suite setting.

Re: Cloudflare targets 2029 for full post-quantum security

#120

Post by bdeol22 »

bwesterb wrote: post #114
bdeol22 wrote: post #106

2029 is plausible at Cloudflare's edge; the long tail is boring enterprise TLS configs someone last touched in 2017.

Yeah, it's rough. Important to understand now for each product / system what the business impact is if it's not upgraded in time.

Agreed. The migrations that stall are usually missing an explicit owner for each TLS surface, not missing algorithms. Business impact is the forcing function once you know who gets paged.
Post reply on HN