3 ms·
Why would you switch from one to t'other? Why not use both? That way, you get the best of both options that are available today.
by jackgavigan 11y ago
Why would you switch from one to t'other? Why not use both? That way, you get the best of both options that are available today.
- sp332 11y agoIn terms of usability and compatibility, you get the worst of both worlds. And if we take it as given that current QSE implementations are weak, it's not going to add much security.
- jackgavigan 11y agoIn the context of PQ crypto, the primary objective is to implement a cryptosystem that is more resistant to cryptanalysis by quantum computer than a non-QSE algorithms like RSA. If that is indeed one's primary objective, usability and compatibility are far lesser concerns. We can't say for certain whether any cryptosystem will prove to be strong, particularly in the face of a theoretical/hypothetical technology like quantum computing, but it seems logical to assume that, until it is broken, there exists at least some possibility that it will turn out to be strong. There's also the question of how much time must pass or how much analysis must an implementation be subjected to before we can start taking it "as given" that it is no longer weak. I view this in a very binary fashion: You either care about being post-quantum secure or you don't. If you do, using both cryptosystems will either result in something that is either strongly resistant to cryptanalysis by quantum computer or is no less secure than the non-QSE cryptosystem. Either way, you're no worse off.