Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quantum Resistance and the Signal Protocol

signal.org

Post reply on HN
Print view View original

91–100 of 135 posts

Re: Quantum Resistance and the Signal Protocol

#91

Post by wolverine876 »

ericjmorey wrote: post #75
wolverine876 wrote: post #50

That is very well-written, as someone else pointed out, though this common explanation for laypeople needs work (I'm not blaming Signal's blogger, who wrote it more carefully than most): "Instead of bits as in a classical computer, quantum computers operate on qubits. Rather than 0 or 1, qubits can exist in a superposition of states, in some sense allowing them to be both values at once." 'Instead of beads as in a cl…

You're frustrated because it's a bullshit answer based on a lack of understanding of what a superposition of states represents and what quantum computing is calculating. Qbit superpositions represent probability distributions between 1 and 0. And quantum computers calculate probable ranges of correct results of certain types of problems. They can produce these ranges of probable correct results using much less memory…

Thank you.

Re: Quantum Resistance and the Signal Protocol

#92

Post by vichle »

keurrr wrote: post #25
JanisErdmanis wrote: post #18

It is good that they kept the classical crypto along. However, the general tendency towards quantum-resistant cryptography leaves me puzzled. From my perspective as a physics PhD graduate, I firmly believe that a quantum computer capable of breaking public key crypto will never be built. This is because as you add more qubits, there's increased interference between them due to the additional connections required. It'…

So you are claiming the protocol that Signal has adopted is already backdoored by the government. Extraordinary claims require extraordinary evidence. You need to provide some kind of evidence of this. We are talking 20+ years of open and public research on post-quantum cryptography.

I think it's pretty clear that they are theorizing rather than claiming anything?

Re: Quantum Resistance and the Signal Protocol

#93

Post by wolverine876 »

ahelwer wrote: post #81
wolverine876 wrote: post #50

That is very well-written, as someone else pointed out, though this common explanation for laypeople needs work (I'm not blaming Signal's blogger, who wrote it more carefully than most): "Instead of bits as in a classical computer, quantum computers operate on qubits. Rather than 0 or 1, qubits can exist in a superposition of states, in some sense allowing them to be both values at once." 'Instead of beads as in a cl…

The shortest possible answer is that qubit states are modeled as two-dimensional vectors on the complex unit sphere. We arbitrarily designate two orthonormal vectors on this sphere as corresponding to classical states 0 and 1. If the qubit vector isn't in the 0 or 1 state, it's in some linear combination of them. This is called superposition. Since most people don't know what linear combination means, superposition i…

Thanks

Re: Quantum Resistance and the Signal Protocol

#94

Post by Tutanota »

Congrats to Signal, this is a great step!

At Tutanota we also use the Signal protocol to build post-quantum secure encryption for email and drive: https://tutanota.com/blog/pqdrive-project

Post-quantum secure encryption can't be developed early enough. In the end all our data today will be at risk of being decrypted in the future - unless we secure it now!

Re: Quantum Resistance and the Signal Protocol

#95

Post by yyyk »

JanisErdmanis wrote: post #18

It is good that they kept the classical crypto along. However, the general tendency towards quantum-resistant cryptography leaves me puzzled. From my perspective as a physics PhD graduate, I firmly believe that a quantum computer capable of breaking public key crypto will never be built. This is because as you add more qubits, there's increased interference between them due to the additional connections required. It'…

FM radio has frequency capture, interference there is not additive as in AM. You're very likely to capture the strongest station unless there's a lot of interference.

As for QC, we don't seem to be running into any limits yet. It may well be that any limits are well above useful amount of qbits.

Re: Quantum Resistance and the Signal Protocol

#96

Post by adgjlsfhk1 »

kickopotomus wrote: post #47
JanisErdmanis wrote: post #45

Earlier quoted context omitted.

I agree with this. My concern only applies if the classical crypt gets deprecated or new solutions use PQC exclusively using widespread hybrid use as an argument for trust.

It seems that your primary concern is that the government (or some bad actor) will be able to install a backdoor into PQC algorithms. Is that right? Why would PQC be more exposed to this type of subversion than existing public-key cryptography? To your point about PQC being used exclusively, post-quantum encryption methods are designed to be resistant to both quantum and classical attacks. That is one of the key stat…

it's less about a backdoor and more about just being a lot less robust in general. classical crypto is based on ~100 years of math on finite fields and ~50 years of heavy scrutiny by cryptographers. the post quantum algorithms are much newer and built on much less well studied math. (and empirically, a large number of them have been found to be completely broken). we're at least 20 years from PQC that can be widely trusted. there really just isn't an alternative to having a generation of grad students studying an algorithm that's as old as they are

Re: Quantum Resistance and the Signal Protocol

#97

Post by plank »

krastanov wrote: post #23
JanisErdmanis wrote: post #18

It is good that they kept the classical crypto along. However, the general tendency towards quantum-resistant cryptography leaves me puzzled. From my perspective as a physics PhD graduate, I firmly believe that a quantum computer capable of breaking public key crypto will never be built. This is because as you add more qubits, there's increased interference between them due to the additional connections required. It'…

Doesn't your argument apply to classical bits too? The more interconnected a classical bit is, the more parasitic coupling it will experience. That used to be an argument used against the feasibility of classical computers in the 40s (until von Neumann published work on fault tolerant classical computing). Both classical and quantum computers (1) can not "scale" without error correction because of analog noise (altho…

Not the parent (and gotten my PhD more then 25 years ago), but the answer is no.

Quantum mechanics is a fickly thing. Schrödingers cat has not been observed ;-) because scaling kills the quantum mechanical properties.

My (entirely theoretical) PhD project dealt with a 2 dimensional electromagnetic cavity, with one 'perfect' mirror (100% reflecting) and one 'imperfect', say 99.999999999% reflecting.

My results were that if you started with a 'squeezed' vacuum, in just a few roundtrips, the 'squeeziness' disappears, due to the bath/loss of the non-perfect mirror. My 'gut feeling' tells me that if we have enough qbits to actually factor something more then 2x2, the loss/bath effect will delete any useful use of the quantum computer.

So I am in the 'will not happen' category. (Not in 1, not in 5, not in 30 years, not in 500 years).

This is different from classical error correction: as far as I understand Schors algorithm, there is no 'get N approximate answers, combine them, and get a better answer' part in there. While classically you could do 100 measurements and get a better approximation then with just one.

Re: Quantum Resistance and the Signal Protocol

#99

Post by bawolff »

upofadown wrote: post #60
eigenket wrote: post #32

Earlier quoted context omitted.

People have already said here most of what I want to say in this comment, but just to make it as explicit as possible: Essentially the only reason anyone thinks that useful quantum computation is possible is because of things called threshold theorems, which state that as long as the noise in each qubit is less than some small but non-zero error rate you can add more qubits and use quantum error correction to make yo…

>...as long as you're below the threshold rate quantum computers scale well. Last I heard, getting below that threshold was going to take one or two orders of magnitude of noise improvement. That seems unlikely. Say you were at a VC presentation and the company said that they had this really great system and the only thing stopping their immense success was the requirement to reduce the noise by an order or two of ma…

> the only thing stopping their immense success was the requirement to reduce the noise by an order or two of magnitude

I mean, i know its different context, but in general, a 1-2 magnitude improvement in hardware capability does not sound crazy on its face for most of the computer industry. Most computer hardware has improved by that much over very short time periods historically.

Re: Quantum Resistance and the Signal Protocol

#100

Post by dboreham »

krastanov wrote: post #70
andyferris wrote: post #59

Earlier quoted context omitted.

To add to the sibling comment, the reason our classical computers work is because the individual transistor errors in your CPU are basically zero. We do use “error correction” on storage (and do see bit errors creep into data stored on disk and in RAM over time) but not “fault tolerance” on the compute. In fact there is no such thing as fault-tolerant classical compute - the CPU only works if it “perfect” or “near pe…

With the benefit of hindsight, it is easy to agree with what you say. But from the point of view of the scientists creating the first classical computers, classical fault-tolerance seemed just as difficult to them as quantum fault-tolerant computation seems to us. See von Neumann's "Probabilistic Logics and the Synthesis of Reliable Organisms from Unreliable Components" from 1952 https://static.ias.edu/pitp/archive/2…

This idea that multiple redundant voting computing units would be magic to Johnny VN seems unlikely. This is because that exact scheme was used with manual "computers" (people with desk calculators) for example in code breaking and nuclear weapon simulation. You'll find descriptions of these techniques for example in Feynman talks.
Post reply on HN