Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Will you heed my warnings now?

scottaaronson.blog

Post reply on HN
Print view View original

51–60 of 106 posts

Re: Will you heed my warnings now?

#51

Post by beloch »

Tyyps wrote: post #48
beloch wrote: post #32

Earlier quoted context omitted.

The most important thing to realize about cryptography is that, for most methods short of a Vernam cipher or quantum key distribution, coded messages need to be treated as published with delay . Cipher text can be archived today and attacked years from now with currently undeveloped, unknown, or unpredicted resources/algorithms. Sure, perhaps nobody archived the cipher text and you're fine. You don't know that for su…

About QKD: https://arxiv.org/abs/1803.04520

Did this pass peer review somewhere?

Re: Will you heed my warnings now?

#52

Post by ipython »

bradley13 wrote: post #11
AndrewStephens wrote: post #4

Aaronson know his stuff but I am not sure he hasn’t considered the fact that, in this current hype cycle, the quantum researchers breathlessly reporting to him on a breakthrough just around the corner are just lying to him and themselves. I have been hearing about one more technical hurdle to solve before quantum algorithms become feasible since before I graduated. That was in 1996.

This is true, practical quantum computing is always "just a couple of years away". At the same time, moving to more secure encryption really isn't difficult. How many times have algorithms been deprecated over the past 20 or so years? It's time to do it again. Let's just make sure that the NSA hasn't worked in any backdoors. At latest since Snowdon, anything they work on is suspect.

I hard disagree with your assertion that moving to more secure encryption isn't difficult. It is insanely difficult, especially at global scale.

Re: Will you heed my warnings now?

#53

Post by bwesterb »

sehansen wrote: post #21

As a software engineer with a good amount of freedom to choose what tools I want to use, what can I do presently to move towards post-quantum cryptography? AFAIK the hashes and symmetric cyphers that are in wide use are already resistant, leaving mainly public-key cryptography as the problem. Is there, for instance, a drop in replacement for `ssh-keygen -t ed25519`?

SSH is working on a drop-in as we speak. TLS is further along: most stacks already support X25519MLKEM768 (by default!) to counter store-now/decrypt-later. PQ certs are not widely supported yet, but that's being sped up as we speak.

Re: Will you heed my warnings now?

#54

Post by bwesterb »

alephnerd wrote: post #37
BoppreH wrote: post #35

Earlier quoted context omitted.

I have another comment[1] on this post with more practical instructions, but the `ssh-keygen` is a good question. The cryptography community is still focused on migrating encryption/key exchange algorithms, for fear of data being captured today and decrypted in the future. So OpenSSH 10.0+ already enables ML-KEM by default. SSH keys, on the other hand, are authentication and would require an online Quantum Computer t…

Cloudflare should have finished it's PQC migration already.

We're almost done countering store-now/decrypt-later, but the biggest part of the job, post-quantum authentication, still remains. Like Google, we target 2029 to be done .

Re: Will you heed my warnings now?

#56

Post by bwesterb »

KaiserPro wrote: post #2

Ok, maybe I'm missing something here. So we know that quantum computers hold a real risk of being able to break a lot of encryption. We also know that changing cyphers is hard (because reasons) But what I don't see is what I can practically do now, as either someone who is a CTO/Big Cheese™ or a lowly engineer?

Where available, you can migrate. Even if PQ is not yet available it helps to:

1. Make sure your dependencies are up to date. Move to a recent version of your crypto libraries. 2. Make sure your server can install multiple certificates: you'll need that unless you control all your clients. 3. Automate certificate issuance as far as possible.

Also, what you can do now is to run the following wargame: assume the CRQC arrived. What's the business impact?

For the migration itself I see three parallel streams.

1. Main push of straight-forward cases (TLS, etc.) Might need to wait a bit for software support.

2. Hard cases: crypto baked into hardware; custom protocols; keys in tight spaces (JWT in URLs); etc. You need to bubble those up soon to make decisions on how to fix them.

3. External dependencies. Barely any vendor has a PQ roadmap, so asking now is probably early, but you can figure out what to do if they don't get their stuff ready in time.

Re: Will you heed my warnings now?

#57

Post by bwesterb »

beloch wrote: post #32
KaiserPro wrote: post #2

Ok, maybe I'm missing something here. So we know that quantum computers hold a real risk of being able to break a lot of encryption. We also know that changing cyphers is hard (because reasons) But what I don't see is what I can practically do now, as either someone who is a CTO/Big Cheese™ or a lowly engineer?

The most important thing to realize about cryptography is that, for most methods short of a Vernam cipher or quantum key distribution, coded messages need to be treated as published with delay . Cipher text can be archived today and attacked years from now with currently undeveloped, unknown, or unpredicted resources/algorithms. Sure, perhaps nobody archived the cipher text and you're fine. You don't know that for su…

QKD is cool and all, but it just doesn't scale to the whole Internet. https://blog.cloudflare.com/you-dont-need-quantum-hardware/

Re: Will you heed my warnings now?

#58

Post by bwesterb »

bradley13 wrote: post #11
AndrewStephens wrote: post #4

Aaronson know his stuff but I am not sure he hasn’t considered the fact that, in this current hype cycle, the quantum researchers breathlessly reporting to him on a breakthrough just around the corner are just lying to him and themselves. I have been hearing about one more technical hurdle to solve before quantum algorithms become feasible since before I graduated. That was in 1996.

This is true, practical quantum computing is always "just a couple of years away". At the same time, moving to more secure encryption really isn't difficult. How many times have algorithms been deprecated over the past 20 or so years? It's time to do it again. Let's just make sure that the NSA hasn't worked in any backdoors. At latest since Snowdon, anything they work on is suspect.

It'll be a 90/10 rule: 90% of the upgrades will be straightforward. It's important the 10% that'll be hard early. For many it's probably already too late.

Re: Will you heed my warnings now?

#59

Post by bwesterb »

Ardren wrote: post #16

> Shor of Damocles What is the biggest number factored using Shor's algorithm? Last time I looked it was very unimpressive. Edit: It's gotten worse. 21 from 2012. "Replication of Quantum Factorisation Records with an 8-bit Home Computer, an Abacus, and a Dog" say the factorization of 35 in 2019 actually failed. https://eprint.iacr.org/2025/1237

The abacus thing is pretty funny, but it's dangerously uninformed. https://bas.westerbaan.name/notes/2026/04/02/factoring.html

Re: Will you heed my warnings now?

#60

Post by bwesterb »

toxik wrote: post #23
sanxiyn wrote: post #19

Earlier quoted context omitted.

I will let Scott Aaronson speak. (See https://scottaaronson.blog/?p=9668 ) > Sometimes these days, I'll survey the spectacular recent progress in fault-tolerance, 2-qubit gate fidelities, programmable hundred-qubit systems, etc., only to be answered with a sneer: "What's the biggest number that Shor's algorithm has factored? Still 15 after all these years? Haha, apparently the emperor has no clothes!" I've commented…

I talked to a guy who did his doctoral degree on quantum computing and he was not worried at all. In fact he thought it was wildly overhyped, and like cold fusion, self driving cars, or string theory, always just around the corner. Just give us five more years and another grant, please.

Scott used to be that guy.
Post reply on HN