Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST announces first PQC algoritms to be standardized

groups.google.com

Post reply on HN
Print view View original

41–50 of 132 posts

Re: NIST announces first PQC algoritms to be standardized

#41

Post by bawolff »

oconnore wrote: post #36
bawolff wrote: post #33

Earlier quoted context omitted.

Presumably to hedge their bets. If suddenly someone finds a major problem with latices, its good to have an alternative waiting in the wings. See also sha-3 vs sha-256

If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.

Life's hard and the world is uncertain. If NIST could make an algorithm that they could prove was 100% safe with no possibility of future cryptoanalytical breakthroughs, i am sure they would, but that is beyond current state of the art.

Re: NIST announces first PQC algoritms to be standardized

#42

Post by chasil »

hannob wrote: post #19
RcouF1uZ4gsC wrote: post #17

HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?

I've been following this space for a while and this is a good question, but I think the answer is really a "ranges from 10 years to never". There's a lot of investment currently in the quantum computer space (+ a lot of hype and scams). Yet this is still all very early research and far away from any practical use. The challenges to really build a QC that can break cryptography are enormous - and it is absolutely a po…

This article asserts that D-Wave and other quantum annealing devices will be able to mount attacks long before a machine exists that can run Shor's algorithm with error-corrected qubits in sufficient quantity.

https://www.forbes.com/sites/arthurherman/2021/06/07/q-day-i...

Re: NIST announces first PQC algoritms to be standardized

#43

Post by bawolff »

kickling wrote: post #40
oconnore wrote: post #36

Earlier quoted context omitted.

If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.

Well, most modern cryptography is based on assumptions that can not be proven, so having different standards based on different assumptions is probably the only way to safeguard against if one of the assumptions would be proven false in the future.

To nitpick, afaik, its not that they cannot be proven, its that they have not been, and look very hard to prove, which is slightly different (not my area of expertise, but i assume this would be tied to p vs np)

Re: NIST announces first PQC algoritms to be standardized

#44

Post by oconnore »

kickling wrote: post #40
oconnore wrote: post #36

Earlier quoted context omitted.

If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.

Well, most modern cryptography is based on assumptions that can not be proven, so having different standards based on different assumptions is probably the only way to safeguard against if one of the assumptions would be proven false in the future.

Maybe it safeguards them from looking like they've screwed this up, but in terms of providing a concrete recommendation to system implementers, how does this safeguard anything? How does offering multiple algorithms in the PQC category help me make systems safer? What am I actually supposed to do here (how do I reflect this hedge in a system design)?

They didn't feel the need to provide multiple recommendations during the AES, or the SHA-3 process, even though Rijndael and Keccak used different constructions relative to RC6/TwoFish and SHA-2/Blake2. Why now?

Re: NIST announces first PQC algoritms to be standardized

#45

Post by ghaff »

RcouF1uZ4gsC wrote: post #17

HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?

It's worth noting that the relevant timeframe to implement PQC isn't just when quantum computers become sufficiently fast to break current crypto (assuming the answer isn't never). It can take a decade or longer to re-encrypt data and/or to update cryptographic infrastructure.

Given that (varied) expert option on quantum computing being able to break current public key cryptography seems to mostly fall in the 10-20 year range, there is some, at least mild, urgency to start using PQC for the most sensitive data relatively soon.

Re: NIST announces first PQC algoritms to be standardized

#46

Post by bwesterb »

chasil wrote: post #5

OpenSSH has already chosen NTRU-Prime. Will there be a retrofit of CRYSTALS-KYBER? Or has the market already chosen? DJB is an author on the SPHINCS+ team; glad to see that his work will be part of the standard. https://sphincs.org/

NTRU-Prime, NTRU, Kyber and SABER are all great KEMs. NIST could've chosen any one of them. NIST never standardised Ed25519 and OpenSSH still uses it, which is perfectly fine.

Re: NIST announces first PQC algoritms to be standardized

#47

Post by bawolff »

oconnore wrote: post #44
kickling wrote: post #40

Earlier quoted context omitted.

Well, most modern cryptography is based on assumptions that can not be proven, so having different standards based on different assumptions is probably the only way to safeguard against if one of the assumptions would be proven false in the future.

Maybe it safeguards them from looking like they've screwed this up, but in terms of providing a concrete recommendation to system implementers, how does this safeguard anything? How does offering multiple algorithms in the PQC category help me make systems safer? What am I actually supposed to do here (how do I reflect this hedge in a system design)? They didn't feel the need to provide multiple recommendations durin…

> They didn't feel the need to provide multiple recommendations during the AES, or the SHA-3 process, even though Rijndael and Keccak used different constructions relative to RC6/TwoFish and SHA-2/Blake2. Why now?

SHA-3 was explicitly alternative reccomendation. The entire point was to come up with something that was not based on sha-2, because they were worried that the attacks on md5/sha1 could be extended to sha2 (which didn't really happen the way people were worried about). Even to this day, general advice is not to use sha3.

Less clear cut for aes, but at time of standardization (and even now afaik), triple des was considered secure, so its not like there wasn't a secure alternative.

These standards arent meant as implementation guides. You still need cryptography knowledge to securely use them.

Re: NIST announces first PQC algoritms to be standardized

#48

Post by bwesterb »

chrispeel wrote: post #3

Crystals-Kyber website: https://pq-crystals.org/kyber/ Press release: https://techxplore.com/news/2022-07-nist-quantum-resistant-c... Github: https://github.com/pq-crystals/kyber

And a Go implementation I wrote for Cloudflare. https://github.com/cloudflare/circl/tree/main/kem/kyber

Re: NIST announces first PQC algoritms to be standardized

#49

Post by [deleted] »

bawolff wrote: post #41
oconnore wrote: post #36

Earlier quoted context omitted.

If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.

Life's hard and the world is uncertain. If NIST could make an algorithm that they could prove was 100% safe with no possibility of future cryptoanalytical breakthroughs, i am sure they would, but that is beyond current state of the art.

[deleted]

Re: NIST announces first PQC algoritms to be standardized

#50

Post by kvathupo »

oconnore wrote: post #32

> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures > Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach? Is this a security con…

A point rendering the choice even more curious: Germany and the Netherlands have recommended the use of encryption not relying on the shortest vector problem [1]. The two suggestions of FrodoKEM (relying on hardness of the learning with errors problem) and Classic McEliece (relying on hardness of decoding random codes?) aren't lattice-based apparently.

Perhaps NIST knows something we don't ; ^ )

[1] - https://twitter.com/CJTjhai/status/1544398903591796736

Post reply on HN