4 ms·
True. Note that some "post-quantum" key exchange schemes already exist (based on lattice cryptography, for which there are no known poly-time quantum attacks),
by y7 10y ago
True. Note that some "post-quantum" key exchange schemes already exist (based on lattice cryptography, for which there are no known poly-time quantum attacks), e.g. https://eprint.iacr.org/2015/1092 https://eprint.iacr.org/2015/1092 . But I haven't heard of it being used anywhere.
- da-bacon 10y agoGoogle has been experimenting with it in chrome https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html?m=1 https://security.googleblog.com/2016/07/experimenting-with-p... though it is just an experiment in Canary.
- Filligree 10y agoThe sad truth is, until we've spent a lot more time analysing and attacking those algorithms, they aren't as secure as what we've got.
- hackcasual 10y agoGoogle's canary test also does regular ECDH requiring it to be broken as well
- matthewaveryusa 10y agoThere's an extremely simple method which is to onion multiple algorithms. If you want to add the promised security features of a new algorithm that hasn't been battle-tested it's well worth the effort.
- copperx 10y agoI've never heard of such technique, what does onioning do?
- effie 10y agoUse of new encryption algorithm on the ciphertext encrypted by the old algorithm.
- bdamm 10y agoSounds good for symmetric crypto, but not for public key exchanges, which is what quantum compute attacks are so far all about. There could be double-tree PKI, where nodes in the tree are represented by two key pairs in different kinds of key spaces, with the different signatures terminating in two ephemeral key pairs, which are then used for key derivation, and the subsequent secret perhaps concatenated and boosted into a higher key space? The complexity would be mind boggling. And, weaknesses in one half of the tree could translate into a security reduction on the final symmetric key, so it would have to be way over powered to be effective. Not a simple problem to solve.
- eru 10y agoWhy wouldn't that work? Exchange all n keys with their respective methods in parallel?
- matthewaveryusa 10y agoI don't think there is an exact term (and if there is I'm all ears), so the closest one I found pertains to onion routing[1], except instead of each layer being a different key, each layer is a different algorithm and a different key. I.E if you wanted to use algorithm X and algorithm Y, you could encrypt your plaintext with cyphertext_x = X(x_key,plaintext), and then cyphertext = Y(y_key,cyphertext_x). If X is terrible, Y still protects your data. if Y is terrible, X still protects your data. Note that the order in which X and Y are applied doesn't matter. [1] https://en.wikipedia.org/wiki/Onion_routing https://en.wikipedia.org/wiki/Onion_routing
- vmarsy 10y agoAlgorithms composition? (similar to function compositions[1], since algorithms are just function that take an input and return an output.) [1] https://en.wikipedia.org/wiki/Function_composition https://en.wikipedia.org/wiki/Function_composition
- tgb 10y agoI know next to nothing about this subject, but this suggestion sounds like the kinds of things that amateurs suggest but experts scoff at. So my question to any actual experts: is this legit? Note that breaking A+B is not necessarily as hard as breaking both A and B, but it certainly seems likely to be true most of the time.
- Klathmon 10y agoI'm far from an expert, but I believe the big worry with layering systems like this is you double the amount of key management and implementation attack surface (which is often the weakest part of a cryptosystem), and traditionally it's not for much benefit. Ignoring quantum computing, doubling up algorithms doesn't really protect you against unknown unknowns all that much as there is a good chance that a massive flaw in one of them could apply to the others (since they are all somewhat based on the same "problem"). When you start layering lattice based crypto with traditional crypto the payoff might change and make it more viable.
- IncRnd 10y agoYour proposed use seems intended to add randomness. However, Schor's algorithm (for example) doesn't attack the randomness of a message but factors keys. How would you propose to securely exchange the keys for the several algorithms? If there is enough meta or implied information for you to know what algorithms are used, an attacker would also know what algorithms are in use. The obstacle isn't lack of randomness or an excess of decipherability but not using a quantum resistant algorithm.
- Ar-Curunir 10y agoLattice based schemes are roughly as old as ECC. They also enjoy something called worst-case to average-case redictions for certain parameter ranges, which gives us confidence in their strength.