3 ms·

So the conclusion is that the most reasonable theory is that the NSA has made an advance on ECDLP making them believe they can get faster Pollard-Rho (potential

by rockdoe 11y ago

So the conclusion is that the most reasonable theory is that the NSA has made an advance on ECDLP making them believe they can get faster Pollard-Rho (potentially n^1/3) or that they found signs the curve structures are weak? Pretty mind blowing.

tptacek 11y ago
Not really. The paper goes into much more detail, and the most reasonable theory in the paper is that if you believe there are going to be practical quantum computers in 15-20 years, there are lots of agencies and businesses that have secrets that need more than 15-20 years of protection, so the switch to PQ crypto needs to happen sooner than later.
- rockdoe 11y ago
  Hmm, that's not the vibe I get. The blog indeed doesn't say it is necessarily the most reasonable theory, but goes in depth towards only one: "I’d like to focus on what I think is the most intriguing hypotheses in the paper. Namely, that the NSA isn’t worried about quantum computers at all, but rather, that they’ve made a major advance in classical cryptanalysis of the elliptic curve discrete logarithm problem — and panic is the result." As for the viability of practical quantum computers, the original paper says: "If practical quantum computers are at least 15 years away, and possibly much longer, and if it will take many years to develop and test the proposed PQC systems and reach a consensus on standards, then a long time remains when people will be relying on ECC. But the NSA’s PQC announcement makes it clear that improved ECC standards (for example, an updated list of recommended curves) are not on the Agency’s agenda." "However, for such users the NSA statement recommends using an additional layer of AES to provide quantum resistance, without waiting for quantum-safe public-key standards. In any case, the statement is directed at the general public and obviously is going to have a big impact in the private sector. If the NSA had wanted to give advice that was intended only for high-security government users, they would have done so." The latter paragraph seems to contradict your conclusion directly. I read the paper as saying that in the case you describe, it would have been reasonable for the NSA to continue ECC work while fleshing out post QC alternatives. But this did not happen.
  - tptacek 11y ago
    The banking system is as important a target as the government. The paper stipulates that QC might be ~15 years out. It is the case that if QC is 15 years out, then even though there's no immediate danger to ECC and RSA, the switch needs to happen soon, because there are secrets that have more longevity than that. Apart from "the banking system is important", that's not conjecture; it's just simple logic applied to the paper.

by rockdoe 11y ago

tptacek 11y ago

Not really. The paper goes into much more detail, and the most reasonable theory in the paper is that if you believe there are going to be practical quantum computers in 15-20 years, there are lots of agencies and businesses that have secrets that need more than 15-20 years of protection, so the switch to PQ crypto needs to happen sooner than later.

rockdoe 11y ago
Hmm, that's not the vibe I get. The blog indeed doesn't say it is necessarily the most reasonable theory, but goes in depth towards only one: "I’d like to focus on what I think is the most intriguing hypotheses in the paper. Namely, that the NSA isn’t worried about quantum computers at all, but rather, that they’ve made a major advance in classical cryptanalysis of the elliptic curve discrete logarithm problem — and panic is the result." As for the viability of practical quantum computers, the original paper says: "If practical quantum computers are at least 15 years away, and possibly much longer, and if it will take many years to develop and test the proposed PQC systems and reach a consensus on standards, then a long time remains when people will be relying on ECC. But the NSA’s PQC announcement makes it clear that improved ECC standards (for example, an updated list of recommended curves) are not on the Agency’s agenda." "However, for such users the NSA statement recommends using an additional layer of AES to provide quantum resistance, without waiting for quantum-safe public-key standards. In any case, the statement is directed at the general public and obviously is going to have a big impact in the private sector. If the NSA had wanted to give advice that was intended only for high-security government users, they would have done so." The latter paragraph seems to contradict your conclusion directly. I read the paper as saying that in the case you describe, it would have been reasonable for the NSA to continue ECC work while fleshing out post QC alternatives. But this did not happen.
- tptacek 11y ago
  The banking system is as important a target as the government. The paper stipulates that QC might be ~15 years out. It is the case that if QC is 15 years out, then even though there's no immediate danger to ECC and RSA, the switch needs to happen soon, because there are secrets that have more longevity than that. Apart from "the banking system is important", that's not conjecture; it's just simple logic applied to the paper.