51–60 of 132 posts
HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?
HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?
https://arxiv.org/pdf/2009.05045v1.pdf
See Figure 11. Optimistically 15 years. Pessimistically 35 years. But anything can happen.
Earlier quoted context omitted.
Presumably to hedge their bets. If suddenly someone finds a major problem with latices, its good to have an alternative waiting in the wings. See also sha-3 vs sha-256
If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.
Presumably, they'll have a better idea by then.
> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures > Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach? Is this a security con…
Presumably to hedge their bets. If suddenly someone finds a major problem with latices, its good to have an alternative waiting in the wings. See also sha-3 vs sha-256
Earlier quoted context omitted.
Presumably to hedge their bets. If suddenly someone finds a major problem with latices, its good to have an alternative waiting in the wings. See also sha-3 vs sha-256
Particularly sha-3 vs sha-512, which turned out to have issues.
> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures > Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach? Is this a security con…
Consider the graph in the Classic McEliece marketing materials, showing the exponent in the attack costs for lattice-based crypto:
https://classic.mceliece.org/comparison.html
Because of communication cost considerations the lattice candidates use problems small enough that another substantial improvement in attacks could leave them vulnerable (no shock that they use small problems: if you're really not communication cost constrained use McEliece and don't worry about it).
If you do use lattice key agreement, be sure to use it in a hybrid configuration (combined with ECC like ed25519 or Curve448) to avoid the (small but hard to assess) risk that your security upgrade could actually be a security downgrade.
Earlier quoted context omitted.
Presumably to hedge their bets. If suddenly someone finds a major problem with latices, its good to have an alternative waiting in the wings. See also sha-3 vs sha-256
If NIST feels the need to hedge their bets, why are they publishing at all? The whole point of these recommendations is so that I, a non-expert, don't have to reason about cryptographic bets.
Earlier quoted context omitted.
Well, most modern cryptography is based on assumptions that can not be proven, so having different standards based on different assumptions is probably the only way to safeguard against if one of the assumptions would be proven false in the future.
To nitpick, afaik, its not that they cannot be proven, its that they have not been, and look very hard to prove, which is slightly different (not my area of expertise, but i assume this would be tied to p vs np)
What's up with this? > In addition, NIST has engaged with third parties that own various patents directed to cryptography, and NIST acknowledges cooperation of ISARA, Philippe Gaborit, Carlos Aguilar Melchor, the laboratory XLIM, the French National Center for Scientific Research (CNRS), the University of Limoges, and Dr. Jintai Ding. NIST and these third parties are finalizing agreements such that the patents owned…
NIST is going the proper route to ensure that any standards they publish can be freely implemented without implementers having to pay patent royalties. That's the reason for your second quote - if KYBER patent holders don't want to agree, they should know that NIST won't choose them for the standard.
It's really unfortunate the the licensing terms weren't announced at the same time: Depending on how they're written the result may still be unattractive to use, and since they've already announced the selection NIST probably just lost some amount of negotiating leverage.
(As the obvious negotiation would be "agree to these terms we find reasonable, or we just select NTRU prime")
HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?