Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Will you heed my warnings now?

scottaaronson.blog

Post reply on HN
Print view View original

71–80 of 106 posts

Re: Will you heed my warnings now?

#71

Post by rolandog »

Ardren wrote: post #27
sanxiyn wrote: post #19

Earlier quoted context omitted.

I will let Scott Aaronson speak. (See https://scottaaronson.blog/?p=9668 ) > Sometimes these days, I'll survey the spectacular recent progress in fault-tolerance, 2-qubit gate fidelities, programmable hundred-qubit systems, etc., only to be answered with a sneer: "What's the biggest number that Shor's algorithm has factored? Still 15 after all these years? Haha, apparently the emperor has no clothes!" I've commented…

> If there's a reason why you think it can't work beyond a certain scale, say so I'm not saying it can't work. Just that in 14 years no one has managed to factor a larger number than 21. Seemingly focus has shifted to other factoring algorithms that don't have performance improvements over conventional computing. I'm not the one implying that Shor's algorithm will breaking encryption in "a few years from now".

> [...] no one has managed to factor a larger number than 21.

Small correction: no one has PUBLICLY managed to factor a larger number than 21.

There could be advances (foreign and domestic) that just don't get published because they represent having an upper-hand with regards to cryptography. So, from Game Theory perspective, not making waves is in the interest of nation states. They'll even try to be dismissive about concerns.

Re: Will you heed my warnings now?

#72

Post by sehansen »

sanxiyn wrote: post #45
tgv wrote: post #41

Earlier quoted context omitted.

> dismissing the Manhattan Project as hopelessly stalled in 1944 Then again, there are enough examples of failed projects. Why should this be comparable to the Manhattan project? In 1944, it was only two years underway, whereas Shor's algorithm is over 30. Tons of articles have been published on quantum computing, while the A bomb was kept as secret as possible, making learning from other countries, sometimes even fr…

The main point is that just as you can't ask for tiny nuclear explosion because nuclear physics just doesn't work that way, you also can't ask for factoring of 21 with Shor's algorithm. Quantum computing just doesn't work that way, sorry.

Given that 15 has already been factored using Shor's algorithm on a real quantum computer, I think we can.

Re: Will you heed my warnings now?

#73

Post by rcxdude »

Ardren wrote: post #27
sanxiyn wrote: post #19

Earlier quoted context omitted.

I will let Scott Aaronson speak. (See https://scottaaronson.blog/?p=9668 ) > Sometimes these days, I'll survey the spectacular recent progress in fault-tolerance, 2-qubit gate fidelities, programmable hundred-qubit systems, etc., only to be answered with a sneer: "What's the biggest number that Shor's algorithm has factored? Still 15 after all these years? Haha, apparently the emperor has no clothes!" I've commented…

> If there's a reason why you think it can't work beyond a certain scale, say so I'm not saying it can't work. Just that in 14 years no one has managed to factor a larger number than 21. Seemingly focus has shifted to other factoring algorithms that don't have performance improvements over conventional computing. I'm not the one implying that Shor's algorithm will breaking encryption in "a few years from now".

The concern is that there's a large enough chance that it might to be worth planning for the outcome. That chance doesn't need to be high for that to be the case. And there's good reason to believe that the size of number that has been factored up to now is not a reliable indicator that the growth rate will remain very slow.

(The analogy with the Manhattan project is apt: an adversary learning about it would have been wise to adjust their planning around the possibility of it succeeding even if they judged that it was not a given that it would)

Re: Will you heed my warnings now?

#74

Post by BoppreH »

i_think_so wrote: post #68
BoppreH wrote: post #65

Many people in this thread are skeptical about quantum computers, and that's fair. This migration is a big part of my current job, and even I think that there's a non negligible chance that we won't see commercially available quantum computers anytime soon. The problem is that we're not trying to predict the exact future, we're hedging against possible developments. If there's a 50/50 chance of quantum computers bein…

Can you talk about what algorithms you're migrating to?

Disclaimer: what follows is my opinion.

There's a good consensus that for key exchange/encryption (TLS, SSH, age, etc) the way forward is ML-KEM 768 together with some classical algorithm, like X25519. The public keys are larger (1 KB), but that's usually ok unless you're working on very small microcontrollers. And you should migrate quickly because of harvest-now-decrypt-later attacks.

For signatures, things are harder because there are tradeoffs. Some algorithms have large signatures (10+ KB), others require keeping state and have catastrophic consequences if subkeys are reused. And the systems around it are also more complicated: in a certificate, should you put a classical and a PQC signature together? Or should the PQC signature go in an extension? Should the extension be marked as critical and fail loudly on old clients, or should new clients have a special case to always check it if PQC signature validation is available? Or should we abandon the certificate chains and move to Merkle Tree Certificates[1]?

So signatures/authentication are still up for debate. Unless your team is on the bleeding edge of either crypto research or security risks, then there's not much to do than wait for better consensus to form.

[1] https://postquantum.com/security-pqc/googles-merkle-tree-mtc...

Re: Will you heed my warnings now?

#75

Post by [deleted] »

missingdays wrote: post #63
watwut wrote: post #24

Earlier quoted context omitted.

The Boy Who Cried Wolf is a story about a boy who have seen a wolf, successfully threatened the wolf away by causing a commotion in a disbelieving village. One day the disbelieving village refused to show up, boy was eaten and thus proven correct. But as it happens in real life politics too, people who were just proven they were wrong continued to blame the boy. The story is told from the point of view of a villagers…

That's one way to completely reframe the story to fit the narrative you want to push

[deleted]

Re: Will you heed my warnings now?

#76

Post by sanxiyn »

sehansen wrote: post #72
sanxiyn wrote: post #45

Earlier quoted context omitted.

The main point is that just as you can't ask for tiny nuclear explosion because nuclear physics just doesn't work that way, you also can't ask for factoring of 21 with Shor's algorithm. Quantum computing just doesn't work that way, sorry.

Given that 15 has already been factored using Shor's algorithm on a real quantum computer, I think we can.

No you really can't. Being able to factor 15 but not 21 with Shor's algorithm is normal. I know it sounds absurd, but it really is that way. Because factoring 21 is about 100x times harder than factoring 15.

See https://algassert.com/post/2500 for details.

Re: Will you heed my warnings now?

#77

Post by i_think_so »

BoppreH wrote: post #74
i_think_so wrote: post #68

Earlier quoted context omitted.

Can you talk about what algorithms you're migrating to?

Disclaimer: what follows is my opinion. There's a good consensus that for key exchange/encryption (TLS, SSH, age, etc) the way forward is ML-KEM 768 together with some classical algorithm, like X25519. The public keys are larger (1 KB), but that's usually ok unless you're working on very small microcontrollers. And you should migrate quickly because of harvest-now-decrypt-later attacks. For signatures, things are har…

Your opinion is most welcome. Cheers!

> And you should migrate quickly because of harvest-now-decrypt-later attacks.

...

> So signatures/authentication are still up for debate. Unless your team is on the bleeding edge of either crypto research or security risks, then there's not much to do than wait for better consensus to form.

I'm trying, as a layman, to find some not-too-insane middle ground between those contradictions.

Re: Will you heed my warnings now?

#78

Post by BoppreH »

i_think_so wrote: post #77
BoppreH wrote: post #74

Earlier quoted context omitted.

Disclaimer: what follows is my opinion. There's a good consensus that for key exchange/encryption (TLS, SSH, age, etc) the way forward is ML-KEM 768 together with some classical algorithm, like X25519. The public keys are larger (1 KB), but that's usually ok unless you're working on very small microcontrollers. And you should migrate quickly because of harvest-now-decrypt-later attacks. For signatures, things are har…

Your opinion is most welcome. Cheers! > And you should migrate quickly because of harvest-now-decrypt-later attacks. ... > So signatures/authentication are still up for debate. Unless your team is on the bleeding edge of either crypto research or security risks, then there's not much to do than wait for better consensus to form. I'm trying, as a layman, to find some not-too-insane middle ground between those contradi…

That's because of the difference between Confidentiality goals and Authenticity goals.

If I send you a document encrypted with classical crypto today, an attacker could grab a copy, wait a few years, then decrypt with a quantum computer (Harvest-Now-Decrypt-Later). The contents of the document I sent today are exposed in the future.

For documents/transmissions that must remain confidential for 10 years, assuming a quantum computer available in 2030, you should have been encrypting them with PQC since 2020! And if deploying PQC for your clients and servers takes two years, you should have started migrating in 2018!

But if I send you a signed document, it's safe because you're verifying the signature today and there are no quantum computers available today to forge a new signature. The same goes for SSH authentication and web certificates, for example. They're safe right until the moment quantum computers arrive (and by then you better have a good solution!).

That's why so many open-source projects already support ML-KEM for key exchange/encryption, but signatures are still under discussion. The former is more urgent.

Re: Will you heed my warnings now?

#79

Post by antonvs »

AndrewStephens wrote: post #44
red75prime wrote: post #34

Earlier quoted context omitted.

Quantum correction algorithms (that would allow factoring of thousands of digits) begin to work when the gate fidelity and other parameters are above certain threshold.

> gate fidelity and other parameters are above certain threshold A threshold that might be beyond what the physical properties of our universe allow. It is still unclear.

This is what bugs me about both quantum computers and commercial fusion power. There's so much talk about how it's just inevitable and will happen soonish, but a lot of the evidence suggests, in some cases strongly, that it might not ever be possible.

I find it weird how bleeding edge research, at the very edges of both physics and engineering, is treated as though it's a market development about to drop. Possibly a consequence of pure R&D having all but died? Getting funded requires pretending there's a business plan for what you're working on?

Re: Will you heed my warnings now?

#80

Post by red75prime »

vidarh wrote: post #47
red75prime wrote: post #43

Earlier quoted context omitted.

Waymo doesn't seem to know it. https://waymo.com/research/safety-performance-of-the-waymo-r... > Waymo’s rider-only ride-hailing operations reached its first one million rider-only miles on January 21, 2023

The key distinction being "rider-only".

If we are counting supervised miles, then Tesla is in the lead with around 8 billion miles.
Post reply on HN