Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NIST selects HQC as fifth algorithm for post-quantum encryption

nist.gov

Post reply on HN
Print view View original

91–100 of 126 posts

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#91

Post by 0xDEAFBEAD »

immibis wrote: post #75
chowells wrote: post #63

Earlier quoted context omitted.

You generally don't want to layer encryption like that. It apparently really does introduce new kinds of attacks, which has been observed in the real world. The pattern typically used for this is that the key for the high-speed symmetric encryption is split into multiple parts, each of which is encrypted with a separate public key system. One classical, one (or two, now?) with a post-quantum algorithm. As long as eac…

Running TLS over TLS is fine, or ssh over ssh, or ssh over TLS, or so on. Otherwise the bad guy would just put the TLS traffic they intercepted from you, through their own TLS tunnel and somehow acquire more information. In the early days of SSL there were cross-protocol information leaks if you used the same key or related keys for different protocols or protocol versions. In the DROWN attack, I can get some ciphert…

This is a great point. If layering encryption really does introduce new attacks, that suggests encrypting single-layer ciphertext could allow you to perform that layered-ciphertext attack anyways. So I find myself skeptical of chowells' claim here.

Here's Wikipedia: https://en.wikipedia.org/wiki/Multiple_encryption

I'm no expert here, but if I understand Wikipedia correctly:

* Be sure to use distinct keys and IVs for each individual layer.

* Be aware that encrypting ciphertext could lead to a known-plaintext attack on the outer cipher, if the inner ciphertext starts in a standard way (file header etc.)

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#92

Post by MidnightRider39 »

bobsmooth wrote: post #88

Don't get me wrong, it's good to be prepared, but what are the chances we'll need these algorithms by 2050?

Basically zero.

Great talk by Peter Gutman why this whole quantum topic is bollocks: https://www.cs.auckland.ac.nz/~pgut001/pubs/bollocks.pdf

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#93

Post by MidnightRider39 »

grayhatter wrote: post #69
throw_pm23 wrote: post #68

Earlier quoted context omitted.

Sorry if my question appears ignorant, but how quickly is quantum really coming? If your prior belief is "nothing practical is ever likely to come out of quantum computing", then so far there is nothing that would seriously suggest you to reconsider it. I do not say this lightly, having followed the academic side of QC for more than a decade.

It's a reasonable question. The need for quantum resistant crypto isn't because the practical attack is right around the corner. All though, I do really enjoy the analogy of predicting when we'll get QC based crypto attacks, is similar to predicting when humans will land on the moon by looking at the altitude for the highest manned flight. It has more to do with the level of effort it takes to replace infra as critic…

The problem is more that people concentrate a lot of energy on hypothetical future quantum attacks when the actual threats have been the same since the 00s: unvalidated input, buffer overflow, bad auth, xss, injection etc.

All the big important systems are again and again vulnerable to these attacks (Cisco, M$, fortinet, etc.) - but of course those aren’t “sexy” problems to research and resolve, so we get the same stuff over and over again while everyone is gushing to protect against some science fiction crypto attacks that are and have been for the last 30 years complete fantasy. It’s all a bit tiring to be honest.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#94

Post by MidnightRider39 »

kerkeslager wrote: post #76
throw_pm23 wrote: post #68

Earlier quoted context omitted.

Sorry if my question appears ignorant, but how quickly is quantum really coming? If your prior belief is "nothing practical is ever likely to come out of quantum computing", then so far there is nothing that would seriously suggest you to reconsider it. I do not say this lightly, having followed the academic side of QC for more than a decade.

I agree with you based on my following QC that we're still pretty far away from QC attacks on current crypto. The problem is, this sort of question suffers from a lot of unknown unknowns. How confident are you that we don't see crypto broken by QC in the next 10 years? The next 20? Whatever your confidence, the answer is probably "not confident enough" because the costs of that prediction being wrong are incalculable…

You don’t need any QC attacks if you can far easier find exploits in the same top10 vulns that were used 20 years ago… Industry should first address that very real and serious risk that is present _right now_ before thinking about QC.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#95

Post by grayhatter »

MidnightRider39 wrote: post #93
grayhatter wrote: post #69

Earlier quoted context omitted.

It's a reasonable question. The need for quantum resistant crypto isn't because the practical attack is right around the corner. All though, I do really enjoy the analogy of predicting when we'll get QC based crypto attacks, is similar to predicting when humans will land on the moon by looking at the altitude for the highest manned flight. It has more to do with the level of effort it takes to replace infra as critic…

The problem is more that people concentrate a lot of energy on hypothetical future quantum attacks when the actual threats have been the same since the 00s: unvalidated input, buffer overflow, bad auth, xss, injection etc. All the big important systems are again and again vulnerable to these attacks (Cisco, M$, fortinet, etc.) - but of course those aren’t “sexy” problems to research and resolve, so we get the same st…

It's a mistake to conflate cryptography, with application logic errors.

Your argument is akin to,

> The problem is that a lot of physicians concentrate on diabetes, or hypertension, when there's people who have been stabed, or shot. Constantly hearing about how heart disease is a big problem is tiring to be honest.

Also, I'm not sure what circles you run in, but if you had to ask any of my security friends if they wanted to spend time on a buffer overflow, or xss injection, or upgrading crypto primitives for quantum resistance... not a single one would pick quantum resistance.

> The problem is more that people concentrate a lot of energy on hypothetical future quantum attacks when the actual threats have been the same since the 00s

Just so I can be sure... you meant having the qbits to deploy such an attack, right? Because really the only thing stopping some of the quantum computing based attacks is number of stable qbits. They're not hypothetical attacks, they've been shown to work.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#96

Post by est31 »

MidnightRider39 wrote: post #92
bobsmooth wrote: post #88

Don't get me wrong, it's good to be prepared, but what are the chances we'll need these algorithms by 2050?

Basically zero. Great talk by Peter Gutman why this whole quantum topic is bollocks: https://www.cs.auckland.ac.nz/~pgut001/pubs/bollocks.pdf

hn thread about this (with some interesting comments): https://news.ycombinator.com/item?id=43046631

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#97

Post by bawolff »

immibis wrote: post #75
chowells wrote: post #63

Earlier quoted context omitted.

You generally don't want to layer encryption like that. It apparently really does introduce new kinds of attacks, which has been observed in the real world. The pattern typically used for this is that the key for the high-speed symmetric encryption is split into multiple parts, each of which is encrypted with a separate public key system. One classical, one (or two, now?) with a post-quantum algorithm. As long as eac…

Running TLS over TLS is fine, or ssh over ssh, or ssh over TLS, or so on. Otherwise the bad guy would just put the TLS traffic they intercepted from you, through their own TLS tunnel and somehow acquire more information. In the early days of SSL there were cross-protocol information leaks if you used the same key or related keys for different protocols or protocol versions. In the DROWN attack, I can get some ciphert…

One thing you do have to be careful about is layering hash functions, which generally does not work.

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#98

Post by bawolff »

bobsmooth wrote: post #88

Don't get me wrong, it's good to be prepared, but what are the chances we'll need these algorithms by 2050?

Predicting anything 25 years out is a fool's errand.

Cryptographically relavent Quantum computers are definitely not happening in the near term, but 25 years is a long enough time horizon that it is plausible.

Just consider what tech was like 25 years ago. Would anyone (without the benefit of hindsight) in 1999 really be able to predict modern AI, the ubiquity of smart phones, etc. Heck 25 years ago people still thought the internet thing was a fad. Anyone trying to predict 25 years out is full of crap.

https://xkcd.com/678/

Re: NIST selects HQC as fifth algorithm for post-quantum encryption

#100

Post by api »

chowells wrote: post #63
MJGrzymek wrote: post #52

Earlier quoted context omitted.

Isn't that trivial in a sense? Encrypt with layer 1, then use that encrypted channel to send layer 2 (and so on). Not sure about the performance. Signal has a post about using pre and post-quantum together: https://signal.org/blog/pqxdh/ > The essence of our protocol upgrade from X3DH to PQXDH is to compute a shared secret, data known only to the parties involved in a private communication session, using both the ell…

You generally don't want to layer encryption like that. It apparently really does introduce new kinds of attacks, which has been observed in the real world. The pattern typically used for this is that the key for the high-speed symmetric encryption is split into multiple parts, each of which is encrypted with a separate public key system. One classical, one (or two, now?) with a post-quantum algorithm. As long as eac…

Layering independent crypto is safe, otherwise one of the layers has some nasty vulnerability. Security should not depend on the type of traffic. If it does something is wrong.

In fact it’s common practice in high security government use cases to mandate two layers built by two different vendors for defense in depth. That way a nasty bug in one doesn’t compromise anything, and the odds of a nasty exploit in both at once are quite low.

You might be thinking of bespoke combinations of algorithms at the cryptographic construction level where the programmer is trying to be clever. Being clever with crypto is dangerous unless you really know what you are doing.

Post reply on HN