Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Soatok's Informal Guide to Threat Models

soatok.blog

Post reply on HN
Print view View original

41–50 of 55 posts

Re: Soatok's Informal Guide to Threat Models

#41

Post by some_furry »

ls612 wrote: post #37
some_furry wrote: post #34

Earlier quoted context omitted.

Read https://soatok.blog/2026/04/13/hybrid-constructions-the-post... for a longer explanation. The main thing I want to stress here is: I'm not anti-hybrid. Some people are. They tend to argue that less code / complexity is better, but you'll want to find one of them to ask directly.

So the argument boils down to 1. A mathematical attack against the PQC candidates would also break ECC (I have no ability to judge this claim). 2. Implementation bugs also exist in classical implementations. #2 seems questionable to me unless you think the same implementation bugs will exist in Curve25519 and whatever PQC algorithm you are using. If the concern is side-channel attacks then that is irrelevant to a HND…

You mostly got it, yeah. Point 1, ECC is only also broken after Q-Day.

Hybrids obviously help if you believe Q-Day is far into the future, or never coming.

But if you take Q-Day happening as possible in our lifetime, the HNDL threat means data being encrypted today depends entirely on PQ security in the long run (since breaking EC with a Quantum Computer has an attack cost of like 2^30 or so instead of 2^120 or so).

Re: Soatok's Informal Guide to Threat Models

#42

Post by loup-vaillant »

some_furry wrote: post #40
loup-vaillant wrote: post #39

Earlier quoted context omitted.

> I write in conversational English. Fair enough. When I write an article (and to a lesser extent even a comment like here), I tend to agonise over every sentence. I’m guessing I’m kinda assuming others do the same. Except of course they don’t.

It depends what I'm doing. My dayjob involves a lot of code review and protocol cryptanalysis, so I agonize quite a bit there. My blog would be less fun if I maintained the same level of rigor. If that makes any sense. ^^;

It does :-)

Re: Soatok's Informal Guide to Threat Models

#43

Post by matthewdgreen »

teravor wrote: post #4

> Hybrid PQ+ECDH is a hedged bet against an algorithm break before Q-Day, but is utterly fucking useless over Pure PQ once Q-Day occurs. there is also the likelihood that Q-Day never arrives, either because something we don't know prevents the construction of sufficiently large quantum computers (eg. quantum gravity) or because the entire field was a scam. in that scenario abandoning ECC would have been pretty stupid…

There's a lot of stuff in this post I agree with. There's also a lot of stuff that hints that the author doesn't believe in the worst case they name: that there might be a classical cryptanalytic attack on ML-KEM that occurs before Q-day.

Re: Soatok's Informal Guide to Threat Models

#44

Post by esseph »

teravor wrote: post #4

> Hybrid PQ+ECDH is a hedged bet against an algorithm break before Q-Day, but is utterly fucking useless over Pure PQ once Q-Day occurs. there is also the likelihood that Q-Day never arrives, either because something we don't know prevents the construction of sufficiently large quantum computers (eg. quantum gravity) or because the entire field was a scam. in that scenario abandoning ECC would have been pretty stupid…

> there is also the likelihood that Q-Day never arrives

A lot of big players have accelerated their Q-day timelines fairly recently by years.

Re: Soatok's Informal Guide to Threat Models

#45

Post by esseph »

loup-vaillant wrote: post #35
some_furry wrote: post #21

Earlier quoted context omitted.

> In your PQ safety blanket article https://soatok.blog/2026/04/13/hybrid-constructions-the-post... you make it pretty clear the reason you support hybrid is tactical, not cryptographic. What does it matter that my public arguments are tactical? Hybrid gets us to PQ faster, which makes progress on plugging up the HNDL risk. > Your wording ("Once Q-Day happens") strongly suggests Q-Day will happen, like, it’s so certa…

> recent changes in direction from large Internet providers about quantum computing risks. Do we have reason to suspect Google and Cloudflare have inside knowledge about quantum computers? To me this is more about the end of the NIST contest, and that one has no bearing on actual advances in quantum computing. > The rest of the article is predicated on "these companies' risk assessment turns out to be correct". Err,…

> Do we have reason to suspect Google and Cloudflare have inside knowledge about quantum computers?

Yes.

Both have internal global security orgs that are constantly communicating with other large companies and governments. If they are accelerating (as are others), it is a signal.

The reliability of that signal is up to the reader to determine.

https://www.microsoft.com/en-us/security/blog/2026/06/30/mic...

Re: Soatok's Informal Guide to Threat Models

#46

Post by ls612 »

some_furry wrote: post #41
ls612 wrote: post #37

Earlier quoted context omitted.

So the argument boils down to 1. A mathematical attack against the PQC candidates would also break ECC (I have no ability to judge this claim). 2. Implementation bugs also exist in classical implementations. #2 seems questionable to me unless you think the same implementation bugs will exist in Curve25519 and whatever PQC algorithm you are using. If the concern is side-channel attacks then that is irrelevant to a HND…

You mostly got it, yeah. Point 1, ECC is only also broken after Q-Day. Hybrids obviously help if you believe Q-Day is far into the future, or never coming. But if you take Q-Day happening as possible in our lifetime , the HNDL threat means data being encrypted today depends entirely on PQ security in the long run (since breaking EC with a Quantum Computer has an attack cost of like 2^30 or so instead of 2^120 or so).

So it seems like it comes down to a question of risk and cost. If your threat model is that it is much more costly for your communications to be decrypted today vs in 10 years then hybrid is a good strategy.

Re: Soatok's Informal Guide to Threat Models

#47

Post by pseudohadamard »

ezst wrote: post #27
wizzwizz4 wrote: post #22

Earlier quoted context omitted.

Does one have to be nuanced in everything one says? I'm not a fan of Signal's threat model, especially their historical threat models (e.g. acting like it's safe to link users to phone numbers, and then advertise which phone numbers are and aren't using Signal), but Signal's main protocol seems pretty solid, especially compared to some other systems.

> Does one have to be nuanced in everything one says? no, but unlike a computer, the real world isn't binary, and recognising that it's flawed and full of compromises generally heightens your chances of affecting it (by your ideas or actions). > I'm not a fan of Signal's threat model […] but Signal's main protocol seems pretty solid, especially compared to some other systems. My main gripe with Signal is that no amou…

My main gripe with Signal is that they force-push out multi-hundred MB updates to a multi-hundred MB app, disabling it if you don't keep updating, that sends texts and makes calls. Five gigabytes worth of forced updates earlier, it sent texts and made calls. Five gigabytes worth of forced updates later it'll also send texts and make calls. And every time there's yet another completely unnecessary update that changes nothing in the app I have to go around various older family members and update their phones with it.

Re: Soatok's Informal Guide to Threat Models

#48

Post by ezst »

pseudohadamard wrote: post #47
ezst wrote: post #27

Earlier quoted context omitted.

> Does one have to be nuanced in everything one says? no, but unlike a computer, the real world isn't binary, and recognising that it's flawed and full of compromises generally heightens your chances of affecting it (by your ideas or actions). > I'm not a fan of Signal's threat model […] but Signal's main protocol seems pretty solid, especially compared to some other systems. My main gripe with Signal is that no amou…

My main gripe with Signal is that they force-push out multi-hundred MB updates to a multi-hundred MB app, disabling it if you don't keep updating, that sends texts and makes calls. Five gigabytes worth of forced updates earlier, it sent texts and made calls. Five gigabytes worth of forced updates later it'll also send texts and make calls. And every time there's yet another completely unnecessary update that changes…

> disabling it if you don't keep updating

yep, it's almost like "Open Source" "non profit" and "we are the good guys, trust me bro" doesn't matter nearly as much as "open, federated, standardised protocols".

I've been self-hosting Jabber/XMPP for a very long time, now. There's nothing I feel I'm missing out from signal and others. Not to sound like I'm preaching, I generally tell the curious to give ejabberd a spin.

Re: Soatok's Informal Guide to Threat Models

#49

Post by ezst »

some_furry wrote: post #28
ezst wrote: post #27

Earlier quoted context omitted.

> Does one have to be nuanced in everything one says? no, but unlike a computer, the real world isn't binary, and recognising that it's flawed and full of compromises generally heightens your chances of affecting it (by your ideas or actions). > I'm not a fan of Signal's threat model […] but Signal's main protocol seems pretty solid, especially compared to some other systems. My main gripe with Signal is that no amou…

> Soatok seems unable to acknowledge that centralisation is a real (privacy, security, reliability, political, …) concern here, nor to see value in the decentralised (federated/P2P) alternative protocols implementing the same double-ratched/PFS crypto primitives. I genuinely do not understand where this impression is coming fron. The only thing I've ever written about this topic acknowledges that centralization has r…

> I genuinely do not understand where this impression is coming fron.

I don't want to engage in a citation battle, I just can't care enough for that. Having read those posts about Matrix, XMPP (OMEMO) and a couple others, many months/years ago, they really came across as "screw those amateurs for even trying, Signal is great, and by my very definition of it, only Signal can be".

Again, those are not your words, but something about the tone and the way you compare them made it sound that way.

Also, even if that's besides the initial point, I firmly disagree with the premise of the post you just linked. For the same reason mentioned in a sibling comment stating that the real world isn't binary even though IP addresses might be: A centralised service is political no matter what. If not their admins, their hosing provider or executive power may decide to censor you based on your country of origin, political beliefs, ideological activism or any other reason out of your control. Signal's crypto protects what's in the envelope, but does little else (neither can it) against a motivated state-actor fingerprinting you beyond the service boundaries, and guess what, we know it to be a fact for the jurisdiction Signal is operating under.

Re: Soatok's Informal Guide to Threat Models

#50

Post by loup-vaillant »

esseph wrote: post #45
loup-vaillant wrote: post #35

Earlier quoted context omitted.

> recent changes in direction from large Internet providers about quantum computing risks. Do we have reason to suspect Google and Cloudflare have inside knowledge about quantum computers? To me this is more about the end of the NIST contest, and that one has no bearing on actual advances in quantum computing. > The rest of the article is predicated on "these companies' risk assessment turns out to be correct". Err,…

> Do we have reason to suspect Google and Cloudflare have inside knowledge about quantum computers? Yes. Both have internal global security orgs that are constantly communicating with other large companies and governments. If they are accelerating (as are others), it is a signal. The reliability of that signal is up to the reader to determine. https://www.microsoft.com/en-us/security/blog/2026/06/30/mic...

> Advances in quantum research and development have shifted the risk horizon. We believe cryptographically relevant quantum computers could arrive sooner than previously expected

Aaand, there’s no citation, no reference or link for further reading, no justification for the claim. Not the most reliable signal.

Post reply on HN