Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST announces first PQC algoritms to be standardized

groups.google.com

Post reply on HN
Print view View original

31–40 of 132 posts

Re: NIST announces first PQC algoritms to be standardized

#31

Post by rvz »

danuker wrote: post #29
RcouF1uZ4gsC wrote: post #17

HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?

I expect you'd see a large increase in Bitcoin Days Destroyed, perhaps unrelated to market volume, should someone break ECDSA. Bitcoin uses ECDSA to validate whether coins were spent by the owner of an address. https://en.bitcoin.it/wiki/Elliptic_Curve_Digital_Signature_...

Well good thing that some of the cryptographers that created Falcon [0][1] (the ones who developed Algorand) for post-quantum cryptography for digital signatures use cases is considered to be 'standardised' as such.

This tells me that Algorand is one of the more serious blockchain projects out there with top cryptographers as evidenced by Falcon.

[0] https://falcon-sign.info

[1] https://github.com/algorand/falcon

Re: NIST announces first PQC algoritms to be standardized

#32

Post by oconnore »

> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures

> Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices

What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach?

Is this a security concern, or is there some performance (ops/sec or size) related trade-off?

Re: NIST announces first PQC algoritms to be standardized

#33

Post by bawolff »

oconnore wrote: post #32

> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures > Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach? Is this a security con…

Presumably to hedge their bets. If suddenly someone finds a major problem with latices, its good to have an alternative waiting in the wings.

See also sha-3 vs sha-256

Re: NIST announces first PQC algoritms to be standardized

#34

Post by formerly_proven »

ENOTTY wrote: post #7

What's up with this? > In addition, NIST has engaged with third parties that own various patents directed to cryptography, and NIST acknowledges cooperation of ISARA, Philippe Gaborit, Carlos Aguilar Melchor, the laboratory XLIM, the French National Center for Scientific Research (CNRS), the University of Limoges, and Dr. Jintai Ding. NIST and these third parties are finalizing agreements such that the patents owned…

Crypto that requires royalties won't be widely implemented, so you basically don't need to bother standardizing it.

Re: NIST announces first PQC algoritms to be standardized

#35

Post by chasil »

layer8 wrote: post #22
chasil wrote: post #5

OpenSSH has already chosen NTRU-Prime. Will there be a retrofit of CRYSTALS-KYBER? Or has the market already chosen? DJB is an author on the SPHINCS+ team; glad to see that his work will be part of the standard. https://sphincs.org/

OpenSSH has merely chosen that as its current default. Surely multiple algorithms will be supported in the future as they have in the past.

There was considerable strife for Daniel J. Bernstein during this competition.

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...

It would not surprise me if OpenSSH only chooses to add SPHINCS+ and refuses the others.

Re: NIST announces first PQC algoritms to be standardized

#36

Post by oconnore »

bawolff wrote: post #33
oconnore wrote: post #32

> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures > Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach? Is this a security con…

Presumably to hedge their bets. If suddenly someone finds a major problem with latices, its good to have an alternative waiting in the wings. See also sha-3 vs sha-256

If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.

Re: NIST announces first PQC algoritms to be standardized

#37

Post by bawolff »

RcouF1uZ4gsC wrote: post #17

HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?

https://xkcd.com/678/

Any predictions on these time scales are pretty much pointless.

Re: NIST announces first PQC algoritms to be standardized

#38

Post by marcosdumay »

NavinF wrote: post #27
RcouF1uZ4gsC wrote: post #17

HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?

"When will 256 bit ECC become insecure?" : https://www.metaculus.com/questions/8169/?invite=GpV2Dc The community prediction is 22% by 2032 which seems way too high IMO. I predict 5% due to advances in automated algorithm search and 0% due to quantum computers in that time frame.

Why would a croudsoursing site know that? This is the kind of question where 1 expert will fare better than the average of 90% of the people.

Re: NIST announces first PQC algoritms to be standardized

#39

Post by buu700 »

forty wrote: post #21

Coincidentally, we have just published this today, if you want to play with PQ crypto in JavaScript https://github.com/Dashlane/pqc.js

Similarly, I just published this a few days ago: https://github.com/cyph/pqcrypto.js

Edit: lol, actually it looks like you guys borrowed some of my code for that. (Which is totally fine and part of the point of open source!)

Re: NIST announces first PQC algoritms to be standardized

#40

Post by kickling »

oconnore wrote: post #36
bawolff wrote: post #33

Earlier quoted context omitted.

Presumably to hedge their bets. If suddenly someone finds a major problem with latices, its good to have an alternative waiting in the wings. See also sha-3 vs sha-256

If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.

Well, most modern cryptography is based on assumptions that can not be proven, so having different standards based on different assumptions is probably the only way to safeguard against if one of the assumptions would be proven false in the future.
Post reply on HN