Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debunking NIST's calculation of the Kyber-512 security level

blog.cr.yp.to

Post reply on HN
Print view View original

211–219 of 219 posts

Re: Debunking NIST's calculation of the Kyber-512 security level

#211

Post by bjourne »

lucb1e wrote: post #206
bjourne wrote: post #179

Earlier quoted context omitted.

HN readers that don't want to read the piece in full can take solace in that PQC has not been proven viable. Thus, what algorithms we should use to protect ourselves once what we thought was intractable becomes tractable may be a moot point. Shor's algorithm is capable of factoring 21 into 7 x 3. That's a long way off from factoring the thousands of digits-long numbers used for modern cryptography.

> Shor's algorithm is capable of factoring 21 into 7 x 3. That's a long way off from factoring the thousands of digits-long numbers That is quite misleading, per my understanding. Today's or near-future quantum computers can do this level of arithmetic, but Shor's algorithm does not have hardware limitations because it's an algorithm and not a computer. You can apply it to a thousand digits as well as to one. Apparen…

Right, implementations of Shor's algorithm on existing quantum computers can only factor 7 x 3. But even if quantum computing power doubled every year it would still take decades before breaking modern crypto becomes viable. That would require many scientific and engineering breakthroughs. Possible of course, but I wouldn't bet on it.

Re: Debunking NIST's calculation of the Kyber-512 security level

#212

Post by ComputerGuru »

kurikuri wrote: post #142
thadt wrote: post #67

The unfortunate reality of this is that while he may be right , it is difficult to classify the responses (or non-response) from the NIST people as deceptive vs just not wanting to engage with someone coming from such an adversarial position. NIST is staffed by normal people who probably view aggressively worded requests for clarification in the same way that most of us have probably fielded aggressively worded bug r…

> If Kyber-512 is actually this risky, then it deserves to be communicated clearly. The statement djb seems to be making: It is not known if Kyber-512 is as cryptographically strong as AES-128 by the definitions provided by NIST. This is an issue because these algorithms will be embedded within hardware soon . > Besides the fact that nobody is deploying standalone PQ for some time Now that an implementation has been…

> The current 3rd party estimates of Kyber-512's security strength (which is a nebulous term...) puts it below the original requirements

More to the point, (at least to my understanding) it puts it on par with another contender that was rejected from the NIST competition for being too weak a security construct.

Re: Debunking NIST's calculation of the Kyber-512 security level

#213

Post by blincoln »

denton-scratch wrote: post #181
hn_throwaway_99 wrote: post #106

Earlier quoted context omitted.

Edit: Just realized the author is djb, Daniel Bernstein, which I guess is semi-ironic for me because I was recently praising him on HN for an old, well-read blog post on ipv6. Thus, I guess I may take back a bit of what I said below, or least perhaps it would be better to say that I can better understand the adversarial tone given djb's history with NIST recommendations (more info at https://en.wikipedia.org/wiki/Dan…

> Did anyone actually read this whole thing? Yup. I'm not a cryptographer, so I didn't understand most of the detail. I realized it ws DJB after a couple of paragraphs. > the relevant details and "executive summary" if you will should be in the first couple paragraphs It wasn't written for "executives".

> It wasn't written for "executives".

When writing about real-world topics (especially where the goal is to educate or change opinions), it's usually a good idea to summarize the overall piece at the beginning, regardless of the intended audience. If the piece is broken up into chapters, sections, etc., it often helps to open each of those with a summary as well.

Like a lot of technical people, my default writing style tends to be a linear/journal-entry structure that tells a story more or less in the order it occurred. Over time I've learned that that type of structure only really works if someone is already interested in the material. Otherwise, they're likely to see a wall of text and move on.

Summarizing the overall piece as well as sections lets the reader immediately figure out if what they're reading is relevant to them, what the author's goals are, and if there are parts they can skip over because they're already familiar with those topics.

Re: Debunking NIST's calculation of the Kyber-512 security level

#214

Post by zahllos »

Ar-Curunir wrote: post #185
pigeonhole123 wrote: post #132

Earlier quoted context omitted.

Being incompetent is possible even if you’re not a US national.

And being incompetent is possible even if you’re DJB.

Competence was never the point I was making by adding nationality.

Foreign nationals don't meet the "Unquestioning loyalty to the US" criterion for security clearance, meaning it is much less likely they might collaborate willingly with the US. They're also less exposed to pressure from the US Government, especially if they are not resident/GC holders.

I personally think it is quite paranoid to assume that any US resident or national cryptographer is in cahoots with the NSA but if we are strictly considering risks, then this process is open to scrutiny by world-wide participants, many of whom may not sit on a vulnerability at the behest of the US GOV - actually, for many of them, finding such a vulnerability would likely mean a top tier paper at CRYPTO/EUROCRYPT probably with best paper awards and all the plaudits that make an academic career for life.

Re: Debunking NIST's calculation of the Kyber-512 security level

#215

Post by bdamm »

r3trohack3r wrote: post #194
bdamm wrote: post #47

Earlier quoted context omitted.

This apathy is an interesting phenomenon, let's not ignore it. The Internet has brought us a wealth of knowledge but it has also shown us how truly chaotic the world really is. And negativity is a profitable way to drive engagement, so damn near everyone can see how problematic our society is. And when the algorithm finds something you care to be sad about, it will show you more, more, and ever more all the way into…

Bad systems beat good people. Everything you listed is valid (through one lens), but they are symptoms. Distract yourself with symptoms and you'll never solve the problem. Application Service Providers, as they exist today, are bad systems. They provide tremendous value, that's why they exist. But they also carry tremendous cost. So far, nobody has solved the cost without compromising the value. If you want to fix th…

Do we have evidence that ballot reform actually can improve political outcomes?

Re: Debunking NIST's calculation of the Kyber-512 security level

#216

Post by r3trohack3r »

bdamm wrote: post #215
r3trohack3r wrote: post #194

Earlier quoted context omitted.

Bad systems beat good people. Everything you listed is valid (through one lens), but they are symptoms. Distract yourself with symptoms and you'll never solve the problem. Application Service Providers, as they exist today, are bad systems. They provide tremendous value, that's why they exist. But they also carry tremendous cost. So far, nobody has solved the cost without compromising the value. If you want to fix th…

Do we have evidence that ballot reform actually can improve political outcomes?

Not just evidence, we also have well established models for evaluating voting systems.

First-past-the-post is one of the objectively worst, seemingly sensible, voting systems.

https://en.wikipedia.org/wiki/First-past-the-post_voting#Vot...

Re: Debunking NIST's calculation of the Kyber-512 security level

#218

Post by nextaccountic »

lucb1e wrote: post #89
kpdemetriou wrote: post #75

Earlier quoted context omitted.

Absolutely, but NIST ultimately choose the winners, giving them the option to pick (non-obviously) weak/weaker algorithms. Historically only the winners are adopted. Look at the AES competition - how often do you see Serpent being mentioned, despite it having a larger security margin than Rijndael by most accounts?

> Historically only the winners are adopted. Look at the AES competition Often, yes. But also consider the SHA-3 competition. BLAKE2 seems more widely used than what was chosen for SHA-3 (Keccak). What was submitted for the SHA-3 competition was BLAKE1 (it didn't have a number back then but I think this is clearer) so it's not like NIST said that Keccak is better than BLAKE2, they only said it's better than BLAKE1 (p…

> BLAKE2 seems more widely used than what was chosen for SHA-3 (Keccak)

There's also BLAKE3 and it is amazing. How is its adoption going?

https://github.com/BLAKE3-team/BLAKE3

Re: Debunking NIST's calculation of the Kyber-512 security level

#219

Post by oconnor663 »

nextaccountic wrote: post #218
lucb1e wrote: post #89

Earlier quoted context omitted.

> Historically only the winners are adopted. Look at the AES competition Often, yes. But also consider the SHA-3 competition. BLAKE2 seems more widely used than what was chosen for SHA-3 (Keccak). What was submitted for the SHA-3 competition was BLAKE1 (it didn't have a number back then but I think this is clearer) so it's not like NIST said that Keccak is better than BLAKE2, they only said it's better than BLAKE1 (p…

> BLAKE2 seems more widely used than what was chosen for SHA-3 (Keccak) There's also BLAKE3 and it is amazing. How is its adoption going? https://github.com/BLAKE3-team/BLAKE3

It's been a good week! https://github.com/openzfs/zfs/releases/tag/zfs-2.2.0
Post reply on HN