I have not been following this closely but I thought most all of the quantum safe algorithms that had been proposed so far had been found lacking for traditional attacks very soon after they where held up as a standard contender. Has this changed?
Rosenpass – formally verified post-quantum WireGuard
41–50 of 86 posts
Re: Rosenpass – formally verified post-quantum WireGuard
#42Why not just use PresharedKey in Wireguard?
Using a PSK alone doesn't make WireGuard quantum-safe. The security of the key exchange mechanism in WireGuard, which relies on the Diffie-Hellman protocol, is still vulnerable to quantum attacks. If an attacker were to obtain the PSK and use a quantum computer to break the Diffie-Hellman key exchange, they would be able to decrypt the VPN traffic. This is currently the thought-process and main reason behind why PQWG…
> Using a PSK alone doesn't make WireGuard quantum-safe.
Not sure what you're trying to say here. If you share the PSK out-of-band, securely, then wireguard is quantum resistant (I wouldn't say quantum-safe, because I'm not that optimistic).
> If an attacker were to obtain the PSK
Indeed if the attacker obtains the PSK then obviously the PSK isn't going to help you.
Re: Rosenpass – formally verified post-quantum WireGuard
#43Why not just use PresharedKey in Wireguard?
You still can. The problem arises when you don't actually wanna pre-share the key, and you still want post-quantum forward secrecy. Then you need a PQ KEM like McEliece or Kyber to run a PQ-secure key establishment.
Re: Rosenpass – formally verified post-quantum WireGuard
#44I have not been following this closely but I thought most all of the quantum safe algorithms that had been proposed so far had been found lacking for traditional attacks very soon after they where held up as a standard contender. Has this changed?
I believe three of the four contenders for round 4 of the NIST competition are still showing secure:
https://en.wikipedia.org/wiki/NIST_Post-Quantum_Cryptography...
Re: Rosenpass – formally verified post-quantum WireGuard
#45Does formal verification protect against buffer overflows? (it's a serious question)
My verifier (cbmc) does, the ones they used not. Frama-C/Eye would also catch buffer overflows.
Re: Rosenpass – formally verified post-quantum WireGuard
#46Earlier quoted context omitted.
Certainly. What I don't believe is certain is that only one such vulnerability has ever existed and none exist in Rust today. It's not pedantic to differentiate between mitigating a thing and preventing a thing.
You can add `#![forbid(unsafe_code)]` to your codebase to avoid any unsafe Rust, which should prevent buffer overflows. Obviously it may make writing a codebase somewhat harder.
Will that restriction also be applied transitively to all dependencies?
Re: Rosenpass – formally verified post-quantum WireGuard
#47Earlier quoted context omitted.
> No, symbolic verification does not protect from buffer overflows. Writing the implementation in Rust does I don't believe writing the implementation in Rust does that: https://blog.rust-lang.org/2018/09/21/Security-advisory-for-...
One would think that this would be fixed in the last five years?
The amount of reported and unfixed memory bugs in Rust went 10x more, not less in the last 5 years.
Re: Rosenpass – formally verified post-quantum WireGuard
#48I have not been following this closely but I thought most all of the quantum safe algorithms that had been proposed so far had been found lacking for traditional attacks very soon after they where held up as a standard contender. Has this changed?
One of the KEMS they've elected to (McEliece) has been around since the 70's, and has arguably been studied more than the others. If you're not quite sure about lattices, I've heard it called the "conservative choice" for a PQ KEM.
Re: Rosenpass – formally verified post-quantum WireGuard
#49Earlier quoted context omitted.
You can add `#![forbid(unsafe_code)]` to your codebase to avoid any unsafe Rust, which should prevent buffer overflows. Obviously it may make writing a codebase somewhat harder.
Will that restriction also be applied transitively to all dependencies?
No. That kind of restriction cannot realistically be applied to any project above toy scale. The stdlib uses unsafe code to implement a large number of memory management primitives, because the language is (by design!) not complex enough to express every necessary feature in just safe code. Rust's intention is merely to limit the amount of unsafe code as much as possible.
Re: Rosenpass – formally verified post-quantum WireGuard
#50Earlier quoted context omitted.
Using a PSK alone doesn't make WireGuard quantum-safe. The security of the key exchange mechanism in WireGuard, which relies on the Diffie-Hellman protocol, is still vulnerable to quantum attacks. If an attacker were to obtain the PSK and use a quantum computer to break the Diffie-Hellman key exchange, they would be able to decrypt the VPN traffic. This is currently the thought-process and main reason behind why PQWG…
Wireguard explicitly mentions that mixing in a PSK provides post-quantum security [1]. 1: https://www.wireguard.com/protocol/
Please be careful in your quoting. The page you linked says "post-quantum resistance", not "post-quantum security" (which would be a much stronger claim).