Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

words.filippo.io

Post reply on HN
Print view View original

31–40 of 116 posts

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#31

Post by knorker »

bob1029 wrote: post #23
cortesoft wrote: post #21

Earlier quoted context omitted.

This wouldn’t help symmetric key encryption, which is what this is talking about. The keys you are rotating are asymmetric keys, which are only used to exchange symmetric keys for the actual encryption. In good setups, those symmetric keys are changed every session anyway. If an attacker can break the symmetric encryption in a reasonable amount of time, they can capture the output and break it later. In addition, how…

> This wouldn’t help symmetric key encryption, which is what this is talking about. I agree. The point I am trying to make is that even for asymmetric encryption (which is far more vulnerable), there are still plausible ways to make a quantum break more difficult. The only thing that could compromise this scheme, aside from breaking the signing keys, would be to have TLS broken to the extent that viewing real-time tr…

> Any TLS break delayed by more than 15 minutes would be worthless.

What makes you say that? This is the store now decrypt later attack, and it's anything but worthless.

Oh, worthless for your oauth? Uh… but how do you bootstrap the trust? Sounds to me like you need post quantum to carry the whole thing anyway.

Or you mean one key signs the next? Ok, so your bet is that within the time window an RSA key, RSA can't be cracked?

Why in the world would anyone want to depend on that? Surely you will also pair it with PQ?

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#32

Post by briansmith »

TacticalCoder wrote: post #15

Tangentially related but regarding RSA and ECC... With RSA can't we just say: "Let's use 16 384 bit keys" and be safe for a long while? And for ECC, I know many are using the "2 exp 255 - 19" / 25519 for it's unlikely to be backdoored but it's only 256 bits but... Can't we find, say, "2 exp 2047 - 19" (just making that one up) and be safe for a while too? Basically: for RSA and ECC, is there anything preventing us fr…

Many implementations limit the RSA key size to 8,192 or 16,384 bits (because the maximum bit length determines indirectly how much stack space is required).

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#33

Post by minitech »

bob1029 wrote: post #23
cortesoft wrote: post #21

Earlier quoted context omitted.

This wouldn’t help symmetric key encryption, which is what this is talking about. The keys you are rotating are asymmetric keys, which are only used to exchange symmetric keys for the actual encryption. In good setups, those symmetric keys are changed every session anyway. If an attacker can break the symmetric encryption in a reasonable amount of time, they can capture the output and break it later. In addition, how…

> This wouldn’t help symmetric key encryption, which is what this is talking about. I agree. The point I am trying to make is that even for asymmetric encryption (which is far more vulnerable), there are still plausible ways to make a quantum break more difficult. The only thing that could compromise this scheme, aside from breaking the signing keys, would be to have TLS broken to the extent that viewing real-time tr…

> Any TLS break delayed by more than 15 minutes would be worthless.

It sounds like you’re talking about breaking TLS’s key exchange? Why would this not have the usual issue of being able to decrypt recorded traffic at any time in the future?

Edit: If it’s because the plaintext isn’t useful, as knorker got at in a sibling comment… I sure hope we aren’t still using classical TLS by the time requiring it to be broken in 1 minute instead of 15 is considered a mitigation. Post-quantum TLS already exists and is being deployed…

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#34

Post by bawolff »

bob1029 wrote: post #8

I think quantum may be practically mitigated with aggressive key rotation in some cases. I've been prototyping an oauth machine-to-machine integration with a banking vendor that has our ecdsa keys rotate every 5 minutes. The keys are scheduled for deletion after 10 minutes. I see no reason I couldn't reduce this to something like 30s/60s. Our counterparty frequently scans our JWKS endpoint for revocation, so in pract…

Going from breaking a key in a month to breaking a key in 1 second seems trivial compared to the effort of going from where we are now to being able to break a key in a month.

I dont know what the quantum future holds, but if quantum actually happens then i have low faith in your plan.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#35

Post by ndriscoll »

evil-olive wrote: post #25
ndriscoll wrote: post #9

Earlier quoted context omitted.

Does it matter if an attacker can decrypt public wifi traffic? You already have to assume the most likely adversary (e.g. the most likely to sell your information) is the entity running the free wifi, and they can already see everything.

> You already have to assume the most likely adversary is the entity running the free wifi why do you have to assume that? you're at Acme Coffeeshop. their wifi password is "greatcoffee" and it's printed next to the cash register where all customers can see it. with WPA2 you have to consider N possible adversaries - Acme Coffee themselves, as well as every single other person at the coffeeshop. ...and also anyone els…

Because it's a near certainty (at least in the US) that businesses will spy on you to the extent that they can, but it's actually incredibly rare to be around a nerd with Wireshark? Things like facebook used to not use https long after public wifi was ubiquitous and you could easily sniff people, and it basically didn't matter. Now nearly everything uses TLS so it really doesn't matter. Actually most public wifi I encounter has no security.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#36

Post by semi-extrinsic »

cortesoft wrote: post #19
ninjahawk1 wrote: post #10

Very good breakdown, if I’m understanding Grover’s algorithm correctly, are you saying essentially that it would require either too much compute or too much time to be feasible but is still much more realistic than a brute force attack? If that’s the case, would the time eventually be basically irrelevant with enough compute? For instance, if what’s now a data center is able to fit in the palm of your hand (comparing…

I am not an expert, but while you are correct that a fast enough traditional computer (or a parallel enough computer) could brute force a 128 bit key, the amount of improvement required would dwarf what we have already experienced over the last 40 years, and is likely physically impossible without some major fundamental change in how computers work. Compute has seen in the ballpark of a 5-10 orders of magnitude incre…

> That isn’t happening with how we make computers today.

Keep here in mind that computers today have features approaching the size of a single atom, switching frequencies where the time to cross a single chip from one end to the other is becoming multiple cycles, and power densities that require us to operate at the physical limits of heat transfer for matter that exists at ambient conditions.

We can squeeze it quite a bit further, sure. But anything like 20-30 orders of magnitude is just laughable even with an infinite supply of unobtanium and fairy dust.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#37

Post by cedws »

bob1029 wrote: post #8

I think quantum may be practically mitigated with aggressive key rotation in some cases. I've been prototyping an oauth machine-to-machine integration with a banking vendor that has our ecdsa keys rotate every 5 minutes. The keys are scheduled for deletion after 10 minutes. I see no reason I couldn't reduce this to something like 30s/60s. Our counterparty frequently scans our JWKS endpoint for revocation, so in pract…

Sounds like overkill. Quantum is a premature concern, but if there’s really that much paranoia why not use PQC like ML-KEM instead of rolling this strange thing?

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#39

Post by f33d5173 »

semi-extrinsic wrote: post #36
cortesoft wrote: post #19

Earlier quoted context omitted.

I am not an expert, but while you are correct that a fast enough traditional computer (or a parallel enough computer) could brute force a 128 bit key, the amount of improvement required would dwarf what we have already experienced over the last 40 years, and is likely physically impossible without some major fundamental change in how computers work. Compute has seen in the ballpark of a 5-10 orders of magnitude incre…

> That isn’t happening with how we make computers today. Keep here in mind that computers today have features approaching the size of a single atom, switching frequencies where the time to cross a single chip from one end to the other is becoming multiple cycles, and power densities that require us to operate at the physical limits of heat transfer for matter that exists at ambient conditions. We can squeeze it quite…

You don't need to keep shrinking features. Brute forcing is highly parallel; to break a key within a certain time frame all you need is a large enough quantity of chips. While it's in the realm of science fiction today, in a few centuries we might have nanorobots that can tile the entire surface of mars with processors. That would get you enough orders of magnitude of additional compute to break a 128 bit key. 256 bit would probably still be out though.

Re: Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys

#40

Post by Mithriil »

dlcarrier wrote: post #28
rugina wrote: post #20

On one hand I hear that quantum computers will crack factorisation and discrete logarithms, on the other that the max number factorised is 15 and that 21 might not even be feasible. What is going on?

Coherency To get useful results, a quantum computer needs all of its qbits to stay entangled with each other, until the entire group collapses into the result. With current technology, it is very difficult for a reasonable sized group of qbits to stay coherently entangled, so it can only solve problems that are also relatively easy to solve on classical computers. If someone today were to figure out how to keep large…

> instantly

Shor's and Grover's still are algorithm that require a massive amount of steps...

Post reply on HN