Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A cryptography engineer's perspective on quantum computing timelines

words.filippo.io

Post reply on HN
Print view View original

171–180 of 260 posts

Re: A cryptography engineer's perspective on quantum computing timelines

#171

Post by vasco »

> I simply don’t see how a non-expert can look at what the experts are saying, and decide “I know better, there is in fact Problem is the experts don't tell the truth, they say whatever game theory version of the world they came up with will make people do what they think people should do. If experts just said the literal truth it'd be different, and then when they would walk it back would be understandable.

But when later it becomes clear the experts said outright lies because they thought it'd induce the right behavior, that goes out the window.

Re: A cryptography engineer's perspective on quantum computing timelines

#172

Post by fc417fc802 »

Tyyps wrote: post #158

I think people have to be extremely careful with this kind of opinion. In particular seeing such a push for post-quantum crypto while the current state of the art for quantum factorisation is 15 and 21 and the fact that current assumptions (for KEM in particular) are clearly not as studied as dlog. It's maybe good to remember that SIDH was broken in polynomial time by a classical computer 3 years ago... I'm really co…

As long as a hybrid approach is taken what is there to worry about? Whereas not adopting PQC in a timely manner is obviously a gamble.

Re: A cryptography engineer's perspective on quantum computing timelines

#173

Post by brohee »

thhoo5886gjggy wrote: post #42
phicoh wrote: post #39

What surprises me is how non-linear this argument is. For a classical attack on, for example RSA, it is very easy to a factor an 8-bit composite. It is a bit harder to factor a 64-bit composite. For a 256-bit composite you need some tricky math, etc. And people did all of that. People didn't start out speculating that you can factor a 1024-bit composite and then one day out of the blue somebody did it. The weird thin…

IIRC the largest number factored still remains 21

Yeah that's treating D-Wave "breaking" RSA-2048 as the fraud that it is. They didn't factor anything, they computed a square root.

I'm still dubious about the accelerated timeline given what quite a bit of what is presented as progress in the field is fraud or borderline fraud when inspected closely. (e.g. some of the recent majorana claims by Microsoft are at best overhyped, at worst fraud)

Re: A cryptography engineer's perspective on quantum computing timelines

#174

Post by brohee »

rcxdude wrote: post #124
bitexploder wrote: post #28

Earlier quoted context omitted.

The Manhattan project employed some significant % of all of America. A project of that scale will likely never happen again. It was also about far more than the science. It was about industrializing the entire production process and creating industrial capability that simply did not exist before.

The Manhattan project had a huge impact but it was not that big as far as efforts in the war went (they managed to hide the budget allocated to the project from most of congress, for example).

Yeah and some of the figures often quoted like consuming 14% of the electricity produced in the US are wrong, it was below 1%. https://ui.adsabs.harvard.edu/abs/2011APS..APRH13004R/abstra...

Re: A cryptography engineer's perspective on quantum computing timelines

#175

Post by brohee »

lucb1e wrote: post #81
cwmma wrote: post #57

Earlier quoted context omitted.

he pretty explicitly states that AES 128 is not in any imminent danger and mandating a switch to 256 would distract from the actual thing he thinks needs to happen.

So why argue about whether AES-256 is worth it if we can just literally replace those 3 characters and be done with the upgrade? This was the smart move already in 2001 when Shor's algorithm was known and computers fast enough that we don't notice the difference. At least to me, it seems like less bikeshedding will be done if we abandon AES-128 and don't have to deal with all the people left wondering if that's truly…

I'm working on just that in some IoT context, and a lots of chips I have to deal with only have hardware support for AES-128, so it's a little more complicated...

Re: A cryptography engineer's perspective on quantum computing timelines

#176

Post by fc417fc802 »

tptacek wrote: post #168
cyberax wrote: post #166

Earlier quoted context omitted.

? I'm not entirely sure what's the problem?

It's definitely not that "The research on lattice-based crypto is still young compared to EC/RSA."

Perhaps you would care to enlighten us ignorant plebs rather than taunting us?

My understanding (obviously as a non expert) matches what cyberax wrote above. Is it not common wisdom that the pursuit of new and exciting crypto is an exercise filled with landmines? By that logic rushing to switch to the new shiny would appear to be extremely unwise.

I appreciate the points made in the article that the PQ algorithms aren't as new as they once were and that if you accept this new imminent deadline then ironing out the specification details for hybrid schemes might present the bigger downside between the two options.

I mean TBH I don't really get it. It seems like we (as a society or species or whatever) ought to be able to trivially toss a standard out the door that's just two other standards glued together. Do we really need a combinatoric explosion here? Shouldn't 1 (or maybe 2) concrete algorithm pairings be enough? But if the evidence at this point is to the contrary of our ability to do that then I get it. Sometimes our systems just aren't all that functional and we have to make the best of it.

Re: A cryptography engineer's perspective on quantum computing timelines

#177

Post by nextaccountic »

adrian_b wrote: post #21
FiloSottile wrote: post #18

Earlier quoted context omitted.

That was my position until last year, and pretty much a consensus in the industry. What changed is that the new timeline might be so tight that (accounting for specification, rollout, and rotation time) the time to switch authentication has also come. ML-KEM deployment is tangentially touched on in the article because it's both uncontroversial and underway, but: > This is not the article I wanted to write. I’ve had a…

I agree with you that one must prepare for the transition to post-quantum signatures, so that when it becomes necessary the transition can be done immediately. However that does not mean that the switch should really be done as soon as it is possible, because it would add unnecessary overhead. This could be done by distributing a set of post-quantum certificates, while continuing to allow the use of the existing cert…

> when it becomes necessary

Perhaps it's already necessary, or it will be in the following months. We are hearing only about the public developments, not whatever classified work the US is doing

I think the analogy with the Manhattan project is apt. The US has enormous interest in decrypting communication streams at scale (see Snowden and the Utah NSA datacenter), and it's known for storing encrypted comms for decrypting later. Well maybe later is now

Re: A cryptography engineer's perspective on quantum computing timelines

#178

Post by nextaccountic »

mikestorrent wrote: post #167
Tyyps wrote: post #158

I think people have to be extremely careful with this kind of opinion. In particular seeing such a push for post-quantum crypto while the current state of the art for quantum factorisation is 15 and 21 and the fact that current assumptions (for KEM in particular) are clearly not as studied as dlog. It's maybe good to remember that SIDH was broken in polynomial time by a classical computer 3 years ago... I'm really co…

The largest number factorised on a quantum computer is 8,219,999 on a D-Wave machine (a quantum annealer, so not capable of running Shor's, but capable of being an actual shipping product you can use, unlike gate model machines). https://www.nature.com/articles/s41598-024-53708-7 > Overall, 8,219,999 = 32,749 × 251 was the highest prime product we were able to factorize within the limits of our QPU resources. To the…

The D-Wave machine doesn't benefit from the quantum speedups discussed in the article

Re: A cryptography engineer's perspective on quantum computing timelines

#179

Post by brohee »

bhaak wrote: post #130

> They weirdly[1] frame it around cryptocurrencies and mempools and salvaged goods or something [...] > [1] The whole paper is a bit goofy: it has a zero-knowledge proof for a quantum circuit that will certainly be rederived and improved upon before the actual hardware to run it on will exist. They seem to believe this is about responsible disclosure, so I assume this is just physicists not being experts in our field…

"This is one of the few domains where having access to a quantum computer ahead of others could translate directly into financial gain"

Doubt, the moment people get vocal about their fund being stolen that will be it for crypto, it will crash the bank run. The only way it could work is that if you steal too little to be noticed, which will also be too little to finance your venture...

Re: A cryptography engineer's perspective on quantum computing timelines

#180

Post by apt-apt-apt-apt »

rogerrogerr wrote: post #151
tennysont wrote: post #142

Earlier quoted context omitted.

A huge part of that, for me, was this from Scott Aaronson: > Once you understand quantum fault-tolerance, asking “so when are you going to factor 35 with Shor’s algorithm?” becomes sort of like asking the Manhattan Project physicists in 1943, “so when are you going to produce at least a small nuclear explosion?” That quote, alone, removed a lot of assumptions I had been carrying around.

Can anyone give the next layer of detail here? I understand the implications of this analogy, but looking for the underlying reasons the analogy is apt.

AIUI, the scientists achieved a self-sustaining nuclear chain reaction around 1943. That was the hard part, not even a small bomb yet, but a bomb just needed more fuel and scale.

Fault tolerance is the hard part for QC, once it's achieved, the difference between factoring 35 and RSA-2048 is an engineering challenge, not an impossibility.

Post reply on HN