Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Will you heed my warnings now?

scottaaronson.blog

Post reply on HN
Print view View original

81–90 of 106 posts

Re: Will you heed my warnings now?

#81

Post by i_think_so »

alephnerd wrote: post #33
sehansen wrote: post #21

As a software engineer with a good amount of freedom to choose what tools I want to use, what can I do presently to move towards post-quantum cryptography? AFAIK the hashes and symmetric cyphers that are in wide use are already resistant, leaving mainly public-key cryptography as the problem. Is there, for instance, a drop in replacement for `ssh-keygen -t ed25519`?

It's still being implemented or defined. The worry about "harvest and decrypt" in a 5 year timeframe is primarily from a nation state/natsec perspective. If you are being targeted by a nation state as a line level engineer, harvest and decrypt is the least of your worries.

I am reminded of a certain comedian who lost his job hosting an awards ceremony because he had once said something on stage that people didn't like....

...8 years previously.[1]

Long, long ago in a datacenter far away, breaking 3DES used to be the province of expensive bespoke hardware owned by only the elite nation states. Today it is so trivial that the gpu in your second hand laptop can do it "at scale".

5 years ago ChatGPT was a wet dream.

We should be very conservative in our planning where future security is concerned. The only thing we can be sure of is that Murphy's Law is looking for every chance to make us look foolish.

[1] https://www.bbc.com/news/entertainment-arts-46479017

Re: Will you heed my warnings now?

#82

Post by sehansen »

sanxiyn wrote: post #76
sehansen wrote: post #72

Earlier quoted context omitted.

Given that 15 has already been factored using Shor's algorithm on a real quantum computer, I think we can.

No you really can't. Being able to factor 15 but not 21 with Shor's algorithm is normal. I know it sounds absurd, but it really is that way. Because factoring 21 is about 100x times harder than factoring 15. See https://algassert.com/post/2500 for details.

My point was that the comparison with nuclear explosions is wonky, since we (in the world of that analogy) already have seen a tiny nuclear explosion 15 years ago. And we kept being told that explosions 100 times larger are just around the corner, but explosions 25% larger are way too hard to expect.

I get that there's a lot of R&D going on to make larger quantum computers a thing and that there's been very definite progress, but factoring 21 is just too hard to expect for now. But that also pushes the date where pre-quantum cryptography is broken further into the future. If we still struggle to factor one of the smaller 5 bit numbers, factoring the 128 bit numbers necessary to break elliptic curve cryptography seems quite far away.

Re: Will you heed my warnings now?

#83

Post by BoppreH »

BoppreH wrote: post #35
sehansen wrote: post #21

As a software engineer with a good amount of freedom to choose what tools I want to use, what can I do presently to move towards post-quantum cryptography? AFAIK the hashes and symmetric cyphers that are in wide use are already resistant, leaving mainly public-key cryptography as the problem. Is there, for instance, a drop in replacement for `ssh-keygen -t ed25519`?

I have another comment[1] on this post with more practical instructions, but the `ssh-keygen` is a good question. The cryptography community is still focused on migrating encryption/key exchange algorithms, for fear of data being captured today and decrypted in the future. So OpenSSH 10.0+ already enables ML-KEM by default. SSH keys, on the other hand, are authentication and would require an online Quantum Computer t…

Late edit: PQC migration also includes sometimes changing configuration files/library invocations to enable the new algorithms, and ensuring that your processes still work during the migration, where you might have both pure classical and PQC/hybrid at the same time.

Re: Will you heed my warnings now?

#84

Post by i_think_so »

tardedmeme wrote: post #29
Tyyps wrote: post #14

Earlier quoted context omitted.

There is no clear evidence that the risk of "a practical post quantum computer would arrive in the next 5 years" is greater than "post quantum scheme X is broken" for any scheme X. The only way to go is hybridation and it is quite hard from an engineering point apparently.

There is evidence of the opposite: graph singular isogeny mumbo jumbo algorithm was proven to be easily broken on an ordinary computer. Hybrid encryption is as simple as running one encryption and then the other. Problem is mostly that post quantum keys are large.

Am I missing something fundamental here?

If Algo-A and Algo-B both rely on "factoring big numbers is hard!" then once the Quantumpocalypse occurs, breaking Algo-B(Algo-A(plaintext)) is no harder than asking ChatGPT 99.5 to add an extra step in your vibe coded cracking engine's frontend, such that it now does B_breaker > plaintext.lol or whatever the equivalent is for the fashionable language of the that future day.

Re: Will you heed my warnings now?

#85

Post by red75prime »

antonvs wrote: post #79
AndrewStephens wrote: post #44

Earlier quoted context omitted.

> gate fidelity and other parameters are above certain threshold A threshold that might be beyond what the physical properties of our universe allow. It is still unclear.

This is what bugs me about both quantum computers and commercial fusion power. There's so much talk about how it's just inevitable and will happen soonish, but a lot of the evidence suggests, in some cases strongly, that it might not ever be possible. I find it weird how bleeding edge research, at the very edges of both physics and engineering, is treated as though it's a market development about to drop. Possibly a…

There's no strong evidence of impossibility. For quantum computers to be impossible at scale we need new unknown physics. Fusion requires lots of engineering. And before those engineering efforts would show practical impossibility or impracticality, there can't be strong evidence.

Re: Will you heed my warnings now?

#86

Post by MattPalmer1086 »

i_think_so wrote: post #81
alephnerd wrote: post #33

Earlier quoted context omitted.

It's still being implemented or defined. The worry about "harvest and decrypt" in a 5 year timeframe is primarily from a nation state/natsec perspective. If you are being targeted by a nation state as a line level engineer, harvest and decrypt is the least of your worries.

I am reminded of a certain comedian who lost his job hosting an awards ceremony because he had once said something on stage that people didn't like.... ...8 years previously.[1] Long, long ago in a datacenter far away, breaking 3DES used to be the province of expensive bespoke hardware owned by only the elite nation states. Today it is so trivial that the gpu in your second hand laptop can do it "at scale". 5 years a…

As far as I know, cracking 3DES is still not trivial, and requires a very large number of operations and/or a very large amount of data. But can just about be done in some situations.

If you have any link to trivially cracking it on your second hand laptop and doing it at scale, would be very interested.

Re: Will you heed my warnings now?

#87

Post by Ardren »

bwesterb wrote: post #59
Ardren wrote: post #16

> Shor of Damocles What is the biggest number factored using Shor's algorithm? Last time I looked it was very unimpressive. Edit: It's gotten worse. 21 from 2012. "Replication of Quantum Factorisation Records with an 8-bit Home Computer, an Abacus, and a Dog" say the factorization of 35 in 2019 actually failed. https://eprint.iacr.org/2025/1237

The abacus thing is pretty funny, but it's dangerously uninformed. https://bas.westerbaan.name/notes/2026/04/02/factoring.html

Is there a better benchmark to use?

Honest question.

How can a lay person track the real word progress of quantum computers?

Re: Will you heed my warnings now?

#88

Post by throw0101c »

tgv wrote: post #41
sanxiyn wrote: post #19

Earlier quoted context omitted.

I will let Scott Aaronson speak. (See https://scottaaronson.blog/?p=9668 ) > Sometimes these days, I'll survey the spectacular recent progress in fault-tolerance, 2-qubit gate fidelities, programmable hundred-qubit systems, etc., only to be answered with a sneer: "What's the biggest number that Shor's algorithm has factored? Still 15 after all these years? Haha, apparently the emperor has no clothes!" I've commented…

> dismissing the Manhattan Project as hopelessly stalled in 1944 Then again, there are enough examples of failed projects. Why should this be comparable to the Manhattan project? In 1944, it was only two years underway, whereas Shor's algorithm is over 30. Tons of articles have been published on quantum computing, while the A bomb was kept as secret as possible, making learning from other countries, sometimes even fr…

> Then again, there are enough examples of failed projects. Why should this be comparable to the Manhattan project? In 1944, it was only two years underway, whereas Shor's algorithm is over 30.

1944 is a bit arbitrary. Szilard for one was thinking about it earlier:

> […] He conceived the nuclear chain reaction in 1933, and patented the idea in 1936. In late 1939 he wrote the letter for Albert Einstein's signature that resulted in the Manhattan Project that built the atomic bomb….

* https://en.wikipedia.org/wiki/Leo_Szilard

Partly inspired in 1932 by reading Wells' book, published in 1914:

* https://en.wikipedia.org/wiki/The_World_Set_Free

How long was humanity thinking about flying before the Wright brothers and 1903? We had Babbage's analytical engine (and Lovelace) in 1837, with Zuse's Z2 and the British bombes both in 1940; Zuse's Z3 in 1941.

Re: Will you heed my warnings now?

#89

Post by bwesterb »

Ardren wrote: post #87
bwesterb wrote: post #59

Earlier quoted context omitted.

The abacus thing is pretty funny, but it's dangerously uninformed. https://bas.westerbaan.name/notes/2026/04/02/factoring.html

Is there a better benchmark to use? Honest question. How can a lay person track the real word progress of quantum computers?

Most approaches have missing "capabilities" that can be tracked. Adam Zalcman lays them out for superconducting qubits here. https://westerbaan.name/~bas/rwpqc2026/adam.pdf

For the neutral atoms approach in particular there doesn't seem to be a clear capability missing anymore to building a full scale CRQC: each of the separate components has been demonstrated. Of course when they try to put everything together they'll undoubtedly hit unexpected issues with integration. Wish I could be a fly on the wall at those labs.

Re: Will you heed my warnings now?

#90

Post by mert-kurttutan »

BoppreH wrote: post #65

Many people in this thread are skeptical about quantum computers, and that's fair. This migration is a big part of my current job, and even I think that there's a non negligible chance that we won't see commercially available quantum computers anytime soon. The problem is that we're not trying to predict the exact future, we're hedging against possible developments. If there's a 50/50 chance of quantum computers bein…

There are different types of skepticism when it comes to Quantum Computing (QC). One can be skeptic about its feasibility, namely achieving Fault Tolerant Scalable Quantum Computer (for instance Gil Kalai).

Or, they can be skeptic its applications on the real world.

I am on the second camp, very much. It has mainly two important application areas: Breaking Some Public Key cryptography and Simulating Quantum System.

I think the 1st one is very real, we need to be serious and careful on the migration.

The second area is, I think, extremely overhyped.

One should ask what cases there are for investing in QC that makes financial sense. I can think of couple of areas where quantum effects are important enough to justify this. Better designs for Enzymes and Solid State Batteries. The case for enzyme designs is weakened even more if you check the recent paper by Garnet Chan: https://bsky.app/profile/dulwichquantum.bsky.social/post/3mh...

Unless we see collorobaration between IBM/Google and BYD/CATL/Tesla that will lead to next gen solid state batteries, I would say it wont have substantial impact on the real world. One also has to consider that QC is not the only method to simulation strongly coupled Quantum Systems, there are already other methods, tensor network, Deep Learning based, etc.

Lastly, the QCs will be coming in the future. SO, yhey kind of need to hurry up since current benchmarks for EV batteries are improving every year. There is also the issue of translating lab result into production environment.

All of these factors are eating away the relevance of QCs when it comes to real world applications.

I think we are essentially left with a situation where the only practical application of the technology (QC) is to steal stuff on the internet.

Post reply on HN