61–70 of 132 posts
Obligatory djb warnings: https://ntruprime.cr.yp.to/warnings.html
There's a linked PDF paper with more detail.
Waiting for the ELI5 sites to explain Kyber and LWE. :)
https://mark-schultz.github.io/nist-standard-out/
It's the same base scheme as Saber/Kyber, although as Saber/Kyber are over algebraically structured lattices they are significantly more efficient.
Earlier quoted context omitted.
Particularly sha-3 vs sha-512, which turned out to have issues.
SHA-512 doesn’t have any issues.
I'm having trouble finding it now but I recall someone complaining about the constants for 512 leaving something to be desired.
Earlier quoted context omitted.
Well, most modern cryptography is based on assumptions that can not be proven, so having different standards based on different assumptions is probably the only way to safeguard against if one of the assumptions would be proven false in the future.
Maybe it safeguards them from looking like they've screwed this up, but in terms of providing a concrete recommendation to system implementers, how does this safeguard anything? How does offering multiple algorithms in the PQC category help me make systems safer? What am I actually supposed to do here (how do I reflect this hedge in a system design)? They didn't feel the need to provide multiple recommendations durin…
So best practice would seem to be to implement both CRYSTALS-Dilithium and SPHINCS+, set CRYSTALS-Dilithium as the default, and provide a switch (config setting, whatever) to switch to SPHINCS+. If you have long-term keys, you should have both forms set up & ready to use.
Earlier quoted context omitted.
What's the "obligatory djb warnings"? Something like "any crypto that's not mine isn't great"? ;)
from skimming it, his main argument is that Kyber relies on many constructions (e.g. cyclotomic polynomials) that are actively under attack - researchers have been successfully chipping away at them and show no signs of stopping. he also alleges that NIST have been moving the goal posts to favor Kyber, and they've been duplicitous in their narrative. he favors NTRU, which iirc isn't his.
OpenSSH has already chosen NTRU-Prime. Will there be a retrofit of CRYSTALS-KYBER? Or has the market already chosen? DJB is an author on the SPHINCS+ team; glad to see that his work will be part of the standard. https://sphincs.org/
NTRU-Prime, NTRU, Kyber and SABER are all great KEMs. NIST could've chosen any one of them. NIST never standardised Ed25519 and OpenSSH still uses it, which is perfectly fine.
HN Crypto and Quantum Experts. What is your prediction when classical public key encryption using elliptical curve cryptographic becomes practically vulnerable to quantum computers, such that we would need these PQC algorithms. 10 years out? 20 years out? 50 years out? 100 years out?
It's hard to say. Here is a great paper that tries to answer this question. https://arxiv.org/pdf/2009.05045v1.pdf See Figure 11. Optimistically 15 years. Pessimistically 35 years. But anything can happen.
What's up with this? > In addition, NIST has engaged with third parties that own various patents directed to cryptography, and NIST acknowledges cooperation of ISARA, Philippe Gaborit, Carlos Aguilar Melchor, the laboratory XLIM, the French National Center for Scientific Research (CNRS), the University of Limoges, and Dr. Jintai Ding. NIST and these third parties are finalizing agreements such that the patents owned…
It is especially interesting that NTRU (nor NTRU Prime, a different proposal) is _not_ advancing to the 4th round. Wouldn't you want to encourage more analysis for your (implied) runner-up?
Earlier quoted context omitted.
I've been following this space for a while and this is a good question, but I think the answer is really a "ranges from 10 years to never". There's a lot of investment currently in the quantum computer space (+ a lot of hype and scams). Yet this is still all very early research and far away from any practical use. The challenges to really build a QC that can break cryptography are enormous - and it is absolutely a po…
This article asserts that D-Wave and other quantum annealing devices will be able to mount attacks long before a machine exists that can run Shor's algorithm with error-corrected qubits in sufficient quantity. https://www.forbes.com/sites/arthurherman/2021/06/07/q-day-i...
> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures > Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach? Is this a security con…