Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's threat model for post-quantum cryptography

bughunters.google.com

Post reply on HN
Print view View original

61–70 of 81 posts

Re: Google's threat model for post-quantum cryptography

#61

Post by n4r9 »

upofadown wrote: post #55
asah wrote: post #49

Earlier quoted context omitted.

The risk is non-linear advances That's what everybody said about AI, then sudden advances ~2013 led to the situation today.

A non-linear advance probably wouldn't involve Shor's algorithm. As what happened with AI algorithms. What we call post quantum cryptography is really post Shor's cryptography.

The difference is that we know Shor's algorithm will work once you solve certain engineering problems. As I understand it even the theoretical side of AI was always shooting in the dark.

Re: Google's threat model for post-quantum cryptography

#62

Post by tptacek »

n4r9 wrote: post #60
SamuelAdams wrote: post #53

Earlier quoted context omitted.

> It might be a long time (if ever) before cryptographically relevant quantum computers show up Don’t be so sure. From the article, Google seems to believe quantum computers will arrive in the next 10 years.

Certainly three engineers in Google want to project that claim. I'd be interested to know if there's been a recent study of expert consensus on it.

They're cryptographers (or, at least, two of them have cryptography doctorates, and are well known in the field). Cryptographers in generally are pretty warm to the idea of imminent quantum supremacy, as it's a motivator for a lot of interesting research. By which I mean, if you surveyed academic cryptographers outside of Google, you might get a pretty comparable answer.

Re: Google's threat model for post-quantum cryptography

#63

Post by worksonmine »

hammock wrote: post #59
tptacek wrote: post #5

Stateless tokens come with independent security concerns, and moving towards stateful tokens is prudent just to ensure more robust systems. [...] Our main recommendation is to use stateful tokens where possible, given their additional security benefits. This is smart. PQC schemes often add too much overhead for interoperable cookie sizes. Instead of trying to cram a PQC signature into a cookie, just stop using the st…

Are there privacy concerns with stateful tokens?

No more than there would be with a stateless one, they're both used to authenticate a request after all.

Re: Google's threat model for post-quantum cryptography

#64

Post by xhkkffbf »

NovemberWhiskey wrote: post #56
tptacek wrote: post #5

Stateless tokens come with independent security concerns, and moving towards stateful tokens is prudent just to ensure more robust systems. [...] Our main recommendation is to use stateful tokens where possible, given their additional security benefits. This is smart. PQC schemes often add too much overhead for interoperable cookie sizes. Instead of trying to cram a PQC signature into a cookie, just stop using the st…

> I'm not sure I buy the Global Risk Institute chart. I get that they need to motivate adoption, but practical cryptanalytic work with quantum computers seems unpromising right now. Yeah; that doesn't look right to me either. Perhaps "cryptographically relevant" has some unusual meaning (parity with conventional computing?). Otherwise, the consensus view is that there's, pessimistically, a 4% probability of a total b…

Who came to this consensus? I'm not aware that the quantum machines have been able to do much beyond, say, factoring 21.

Re: Google's threat model for post-quantum cryptography

#65

Post by xhkkffbf »

Tarq0n wrote: post #51
thadt wrote: post #41

A counter-point that perhaps everyone is taking PQ a bit too seriously [1]. Personally, it seems reasonable to at least spend some effort preparing for it, given the rather long lead time required to develop, study and stress the constructions needed. It might be a long time (if ever) before cryptographically relevant quantum computers show up, but if they do, we'll be glad we had a decade or two to get ready. The al…

It also depends on what your personal requirements for forward secrecy are. As a major platform operator Google should aim somewhere towards the top of that distribution.

Why does Google need long-term forward secrecy? They may encrypt my sessions with keys, but most of their data is the huge index of the public web which is, by definition, public. I suppose they dabble in things like health records, but it seems like most of what they store and forward are public.

Re: Google's threat model for post-quantum cryptography

#66

Post by ls612 »

NovemberWhiskey wrote: post #57
xyst wrote: post #11

Besides encrypting your user data at rest using these post-quantum cryptography algo. What can be done from a design point of view to make it as hard as possible to deter attackers? Would it make sense to segregate different types of data into other dbs rather than as a separate table? “Name DB” “Account DB” “Address DB” An attacker would need to have advanced knowledge of the app backend to know you have to snag bot…

> Besides encrypting your user data at rest using these post-quantum cryptography algo. If you're encrypting data at rest, just keep using an appropriate mode of AES (or ChaCha20 or whatever+) and exercising good key management practices. Quantum computing is largely irrelevant to conventional symmetric ciphers. + for tightly constrained values of 'whatever'

QC will break AES 128 and reduce the margin of security for AES 256 is my understanding.

Re: Google's threat model for post-quantum cryptography

#67

Post by [deleted] »

adastra22 wrote: post #24
dist-epoch wrote: post #15

Earlier quoted context omitted.

Is there any insight why there is no PQC signature with a short signature? Is it just us failing to find one, or something more fundamental prevents a quantum resistant short signature like?

I’m confused because there are such things. What you want here is authentication, and there are hashing modes which provide that.

[deleted]

Re: Google's threat model for post-quantum cryptography

#68

Post by adastra22 »

some_furry wrote: post #26
adastra22 wrote: post #24

Earlier quoted context omitted.

I’m confused because there are such things. What you want here is authentication, and there are hashing modes which provide that.

They specifically asked about PQC signatures, not MACs.

There are hashing modes that achieve both integrity and authentication. It usually involves prefixing the data with a server-provided secret before hashing. Only someone who knows the secret can produce such a hash, thereby providing both authentication and data integrity.

Cookies are signed by the server, not the client, and only the server needs to check the signature, so there really isn’t any reason to use much more expensive asymmetric cryptography. And post-quantum security is just a bonus.

In the context of cookies, authenticated hashing IS a PQC signature.

Re: Google's threat model for post-quantum cryptography

#70

Post by tapeloop »

GuB-42 wrote: post #21
dvh wrote: post #8

This may be a naive question but why not go back to Vernam? Storage is cheap.

In addition to the usual argument about the impracticality of the one time pad. There is also that it is symmetric cryptography (the one time pad is a shared secret). Symmetric algorithms (AES-256 in particular) are generally considered to be quantum resistant. Here is what written about it in the article. > Symmetric cryptography, using a single secret key to encrypt and authenticate data: In our current understandi…

excellent explanation.
Post reply on HN